timonel 3.0.0-beta.1 → 3.1.0-beta.1

package/dist/lib/resources/cloud/aws/karpenterResources.js

@@ -15,8 +15,16 @@ export function isValidDisruptionBudget(budget) {
     return nodePattern.test(budget.nodes);
 }
 export function isValidKubernetesDuration(duration) {
-    const durationPattern = /^(\d+h)?(\d+m)?(\d+s)?$/;
-    return durationPattern.test(duration) && duration.length > 0;
+    try {
+        if (typeof duration !== 'string') {
+            return false;
+        }
+        const durationPattern = /^(\d+h)?(\d+m)?(\d+s)?$/;
+        return durationPattern.test(duration) && duration.length > 0;
+    }
+    catch {
+        return false;
+    }
 }
 export const DEFAULT_TERMINATION_GRACE_PERIOD = '30s';
 export class KarpenterResources extends BaseResourceProvider {
@@ -121,9 +129,15 @@ export class KarpenterResources extends BaseResourceProvider {
             nodePoolConfig['weight'] = spec.weight;
         }
         if (spec.labels) {
+            if (typeof spec.labels !== 'object' || Array.isArray(spec.labels)) {
+                throw new Error('Labels must be a valid object');
+            }
             nodePoolConfig['labels'] = spec.labels;
         }
         if (spec.annotations) {
+            if (typeof spec.annotations !== 'object' || Array.isArray(spec.annotations)) {
+                throw new Error('Annotations must be a valid object');
+            }
             nodePoolConfig['annotations'] = spec.annotations;
         }
         return this.addKarpenterNodePool(nodePoolConfig);

package/dist/lib/rutter.d.ts

@@ -2,10 +2,12 @@ import { ApiObject } from 'cdk8s';
 import type { ChartProps } from 'cdk8s';
 import type { Ingress, ServiceAccount } from 'cdk8s-plus-33';
 import type { Construct } from 'constructs';
+import { type SynthAsset } from './helmChartWriter.js';
 import { type TimonelLogger } from './utils/logger.js';
 import type { AWSALBIngressSpec, AWSEBSStorageClassSpec, AWSECRServiceAccountSpec, AWSEFSStorageClassSpec, AWSIRSAServiceAccountSpec } from './resources/cloud/aws/awsResources.js';
 import type { KarpenterEC2NodeClassSpec, KarpenterNodeClaimSpec, KarpenterNodePoolSpec } from './resources/cloud/aws/karpenterResources.js';
 import type { HelperDefinition } from './utils/helmHelpers.js';
+import type { PolicyEngine } from './policy/index.js';
 export declare class Rutter {
     private static readonly HELPER_NAME;
     private readonly app;
@@ -92,8 +94,10 @@ export declare class Rutter {
         yaml: string;
         target: string;
     }>;
-    private toSynthArray;
-    write(outDir: string): void;
+    toSynthArray(): Promise<SynthAsset[]>;
+    toSynthArraySync(): SynthAsset[];
+    private formatPolicyErrors;
+    write(outDir: string): Promise<void>;
 }
 export interface ChartMetadata {
     description?: string;
@@ -117,6 +121,7 @@ export interface RutterProps {
     manifestPrefix?: string;
     meta: ChartMetadata;
     namespace?: string;
+    policyEngine?: PolicyEngine;
     scope?: Construct;
     singleManifestFile?: boolean;
     logger?: TimonelLogger;

package/dist/lib/rutter.js

@@ -8,6 +8,7 @@ import { KarpenterResources } from './resources/cloud/aws/karpenterResources.js'
 import { isHelmExpression, isHelmConstruct } from './utils/helmControlStructures.js';
 import { dumpHelmAwareYaml, preprocessHelmConstructs } from './utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from './utils/helmHelpers.js';
+const UNKNOWN_ERROR_MESSAGE = 'Unknown error';
 export class Rutter {
     constructor(props) {
         this.assets = [];
@@ -29,6 +30,13 @@ export class Rutter {
         });
         this.awsResources = new AWSResources(this.chart);
         this.karpenterResources = new KarpenterResources(this.chart);
+        const originalToSynthArray = this.toSynthArray.bind(this);
+        this['toSynthArray'] = (..._args) => {
+            if (!this.props.policyEngine) {
+                return this.toSynthArraySync();
+            }
+            return originalToSynthArray();
+        };
     }
     addAWSEBSStorageClass(spec) {
         return this.awsResources.addEBSStorageClass(spec);
@@ -67,7 +75,7 @@ export class Rutter {
                 manifestObject = parse(yamlOrObject);
             }
             catch (error) {
-                throw new Error(`Invalid YAML provided to addManifest(): ${error instanceof Error ? error.message : 'Unknown error'}`);
+                throw new Error(`Invalid YAML provided to addManifest(): ${error instanceof Error ? error.message : UNKNOWN_ERROR_MESSAGE}`);
             }
         }
         else if (typeof yamlOrObject === 'object' && yamlOrObject !== null) {
@@ -126,7 +134,7 @@ ${yamlContent.trim()}
             this.assets.push(conditionalAsset);
         }
         catch (error) {
-            throw new Error(`Failed to generate conditional template for manifest '${id}': ${error instanceof Error ? error.message : 'Unknown error'}`);
+            throw new Error(`Failed to generate conditional template for manifest '${id}': ${error instanceof Error ? error.message : UNKNOWN_ERROR_MESSAGE}`);
         }
         return new ApiObject(this.chart, `${id}-placeholder`, {
             apiVersion: manifestObject['apiVersion'],
@@ -190,7 +198,7 @@ ${yamlContent.trim()}
     getAssets() {
         return [...this.assets];
     }
-    toSynthArray() {
+    async toSynthArray() {
         const timer = this.logger.time('chart_synthesis');
         this.logger.debug('Starting chart synthesis', {
             chartName: this.meta.name,
@@ -217,6 +225,51 @@ ${yamlContent.trim()}
             apiObjectCount: apiObjectIds.length,
             operation: 'manifest_processing',
         });
+        if (this.props.policyEngine) {
+            this.logger.debug('Starting policy validation before enrichment', {
+                chartName: this.meta.name,
+                manifestCount: manifestObjs.length,
+                operation: 'policy_validation_start',
+            });
+            try {
+                const validationResult = await this.props.policyEngine.validate(manifestObjs, this.meta);
+                if (!validationResult.valid) {
+                    const errorMessage = this.formatPolicyErrors(validationResult);
+                    this.logger.error('Policy validation failed', {
+                        chartName: this.meta.name,
+                        violationCount: validationResult.violations.length,
+                        operation: 'policy_validation_failed',
+                    });
+                    throw new Error(`Policy validation failed: ${errorMessage}`);
+                }
+                if (validationResult.warnings.length > 0) {
+                    this.logger.warn('Policy validation warnings', {
+                        chartName: this.meta.name,
+                        warningCount: validationResult.warnings.length,
+                        warnings: validationResult.warnings.map((w) => ({
+                            plugin: w.plugin,
+                            message: w.message,
+                            severity: w.severity,
+                        })),
+                        operation: 'policy_validation_warnings',
+                    });
+                }
+                this.logger.info('Policy validation completed successfully before enrichment', {
+                    chartName: this.meta.name,
+                    pluginCount: validationResult.metadata.pluginCount,
+                    executionTime: validationResult.metadata.executionTime,
+                    operation: 'policy_validation_success',
+                });
+            }
+            catch (error) {
+                this.logger.error('Policy validation error', {
+                    chartName: this.meta.name,
+                    error: error instanceof Error ? error.message : UNKNOWN_ERROR_MESSAGE,
+                    operation: 'policy_validation_error',
+                });
+                throw error;
+            }
+        }
         const enriched = manifestObjs.map((obj) => {
             const preprocessed = preprocessHelmConstructs(obj);
             if (preprocessed && typeof preprocessed === 'object') {
@@ -247,7 +300,7 @@ ${yamlContent.trim()}
                 .filter(Boolean)
                 .join('\n---\n');
             const manifestId = this.props.manifestPrefix ?? 'manifests';
-            synthAssets.push({ id: manifestId, yaml: combinedYaml });
+            synthAssets.push({ id: manifestId, yaml: combinedYaml, target: 'templates' });
         }
         else {
             enriched.forEach((obj, index) => {
@@ -255,12 +308,16 @@ ${yamlContent.trim()}
                 const manifestId = apiObjectId || `manifest-${index + 1}`;
                 const yaml = dumpHelmAwareYaml(obj).trim();
                 if (yaml) {
-                    synthAssets.push({ id: manifestId, yaml });
+                    synthAssets.push({ id: manifestId, yaml, target: 'templates' });
                 }
             });
         }
         this.assets.forEach((asset) => {
-            synthAssets.push({ id: asset.id, yaml: asset.yaml });
+            synthAssets.push({
+                id: asset.id,
+                yaml: asset.yaml,
+                target: asset.target || 'templates',
+            });
         });
         this.logger.info('Chart synthesis completed', {
             chartName: this.meta.name,
@@ -271,7 +328,119 @@ ${yamlContent.trim()}
         timer();
         return synthAssets;
     }
-    write(outDir) {
+    toSynthArraySync() {
+        if (this.props.policyEngine) {
+            throw new Error('toSynthArraySync() cannot be used with policy engine. Use toSynthArray() instead.');
+        }
+        const timer = this.logger.time('chart_synthesis_sync');
+        this.logger.debug('Starting synchronous chart synthesis', {
+            chartName: this.meta.name,
+            operation: 'synthesis_start_sync',
+        });
+        const apiObjectIds = [];
+        for (const child of this.chart.node.children) {
+            if (child instanceof ApiObject && !child.node.id.endsWith('-placeholder')) {
+                apiObjectIds.push(child.node.id);
+            }
+        }
+        const allManifestObjs = Testing.synth(this.chart);
+        const manifestObjs = allManifestObjs.filter((obj) => {
+            if (obj && typeof obj === 'object') {
+                const o = obj;
+                const annotations = o.metadata?.annotations || {};
+                return annotations['timonel.sh/placeholder'] !== 'true';
+            }
+            return true;
+        });
+        this.logger.info('Processing manifest objects synchronously', {
+            chartName: this.meta.name,
+            manifestCount: manifestObjs.length,
+            apiObjectCount: apiObjectIds.length,
+            operation: 'manifest_processing_sync',
+        });
+        const enriched = manifestObjs.map((obj) => {
+            const preprocessed = preprocessHelmConstructs(obj);
+            if (preprocessed && typeof preprocessed === 'object') {
+                const o = preprocessed;
+                o.metadata = o.metadata ?? {};
+                o.metadata.labels = o.metadata.labels ?? {};
+                const labels = o.metadata.labels;
+                const defaults = {
+                    'helm.sh/chart': `{{ .Chart.Name }}-{{ .Chart.Version }}`,
+                    'app.kubernetes.io/name': include(Rutter.HELPER_NAME),
+                    'app.kubernetes.io/instance': '{{ .Release.Name }}',
+                    'app.kubernetes.io/version': '{{ .Chart.Version }}',
+                    'app.kubernetes.io/managed-by': '{{ .Release.Service }}',
+                    'app.kubernetes.io/part-of': '{{ .Chart.Name }}',
+                };
+                for (const [key, value] of Object.entries(defaults)) {
+                    if (!(key in labels)) {
+                        labels[key] = value;
+                    }
+                }
+            }
+            return preprocessed;
+        });
+        const synthAssets = [];
+        if (this.props.singleManifestFile) {
+            const combinedYaml = enriched
+                .map((obj) => dumpHelmAwareYaml(obj).trim())
+                .filter(Boolean)
+                .join('\n---\n');
+            const manifestId = this.props.manifestPrefix ?? 'manifests';
+            synthAssets.push({ id: manifestId, yaml: combinedYaml, target: 'templates' });
+        }
+        else {
+            enriched.forEach((obj, index) => {
+                const apiObjectId = apiObjectIds[index];
+                const manifestId = apiObjectId || `manifest-${index + 1}`;
+                const yaml = dumpHelmAwareYaml(obj).trim();
+                if (yaml) {
+                    synthAssets.push({ id: manifestId, yaml, target: 'templates' });
+                }
+            });
+        }
+        this.assets.forEach((asset) => {
+            synthAssets.push({
+                id: asset.id,
+                yaml: asset.yaml,
+                target: asset.target || 'templates',
+            });
+        });
+        this.logger.info('Synchronous chart synthesis completed', {
+            chartName: this.meta.name,
+            totalAssets: synthAssets.length,
+            additionalAssets: this.assets.length,
+            operation: 'synthesis_complete_sync',
+        });
+        timer();
+        return synthAssets;
+    }
+    formatPolicyErrors(result) {
+        const errorMessages = [];
+        if (result.violations && result.violations.length > 0) {
+            errorMessages.push(`Found ${result.violations.length} policy violation(s):`);
+            result.violations.forEach((violation, index) => {
+                const parts = [`${index + 1}. [${violation.plugin}] ${violation.message}`];
+                if (violation.resourcePath) {
+                    parts.push(`Resource: ${violation.resourcePath}`);
+                }
+                if (violation.field) {
+                    parts.push(`Field: ${violation.field}`);
+                }
+                if (violation.suggestion) {
+                    parts.push(`Suggestion: ${violation.suggestion}`);
+                }
+                errorMessages.push(`   ${parts.join(' | ')}`);
+            });
+        }
+        if (result.summary) {
+            const summary = result.summary;
+            errorMessages.push(`Summary: ${summary.violationsBySeverity.error} error(s), ${summary.violationsBySeverity.warning} warning(s), ${summary.violationsBySeverity.info} info(s)`);
+        }
+        return errorMessages.join('\n');
+    }
+    async write(outDir) {
         const timer = this.logger.time('chart_write');
         this.logger.info('Starting chart write operation', {
             chartName: this.meta.name,
@@ -297,7 +466,7 @@ ${helper.template}
         else {
             helpersContent = generateHelpersTemplate(this.props.cloudProvider);
         }
-        const synthAssets = this.toSynthArray();
+        const synthAssets = await this.toSynthArray();
         this.logger.info('Generated assets for chart', {
             chartName: this.meta.name,
             assetCount: synthAssets.length,

package/dist/lib/security.js

@@ -84,7 +84,7 @@ export class SecurityUtils {
         }
         const sanitized = env.replace(/[^a-zA-Z0-9-_]/g, '');
         if (sanitized !== env) {
-            throw new Error(`Invalid environment name: ${this.sanitizeLogMessage(env)}`);
+            throw new Error(`Invalid environment name: ${SecurityUtils.sanitizeLogMessage(env)}`);
         }
         if (sanitized.length === 0 || sanitized.length > 63) {
             throw new Error('Environment name must be 1-63 characters long');
@@ -150,7 +150,7 @@ export class SecurityUtils {
         }
         const nameRegex = /^[A-Z_][A-Z0-9_]*$/;
         if (!nameRegex.test(sanitizedName)) {
-            throw new Error(`Invalid environment variable name: ${this.sanitizeLogMessage(name)}`);
+            throw new Error(`Invalid environment variable name: ${SecurityUtils.sanitizeLogMessage(name)}`);
         }
         const hasDangerousPattern = (val) => {
             if (val.includes('$(') && val.includes(')'))
@@ -173,7 +173,7 @@ export class SecurityUtils {
         };
         const dangerousPattern = hasDangerousPattern(value);
         if (dangerousPattern) {
-            throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${this.sanitizeLogMessage(value)}`);
+            throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${SecurityUtils.sanitizeLogMessage(value)}`);
         }
         if (value.length > 32768) {
             throw new Error('Environment variable value exceeds maximum length (32KB)');
@@ -194,7 +194,7 @@ export class SecurityUtils {
         }
         const tagRegex = /^[a-zA-Z0-9._-]+$/;
         if (!tagRegex.test(trimmedTag)) {
-            throw new Error(`Invalid image tag format: ${this.sanitizeLogMessage(trimmedTag)}`);
+            throw new Error(`Invalid image tag format: ${SecurityUtils.sanitizeLogMessage(trimmedTag)}`);
         }
         if (trimmedTag.length > 128) {
             throw new Error('Image tag exceeds maximum length (128 characters)');

package/dist/lib/templates/flexible-subchart.js

@@ -1,6 +1,7 @@
 import { writeFileSync, mkdirSync, existsSync } from 'fs';
 import { join } from 'path';
 import { Chart } from 'cdk8s';
+import { SecurityUtils } from '../security.js';
 import { dumpHelmAwareYaml } from '../utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from '../utils/helmHelpers.js';
 export class FlexibleSubchart extends Chart {
@@ -51,13 +52,19 @@ export class FlexibleSubchart extends Chart {
             version: this.config.version || '1.0.0',
             appVersion: this.config.version || '1.0.0',
         };
-        writeFileSync(join(outputDir, 'Chart.yaml'), dumpHelmAwareYaml(subchartYaml));
+        const chartYamlPath = SecurityUtils.validatePath(join(outputDir, 'Chart.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(chartYamlPath, dumpHelmAwareYaml(subchartYaml));
         const subchartValues = {
             enabled: true,
             ...Object.fromEntries(Object.entries(this.config).filter(([key, value]) => key !== 'chart' && typeof value !== 'function' && value !== null && value !== undefined)),
         };
-        writeFileSync(join(outputDir, 'values.yaml'), dumpHelmAwareYaml(subchartValues));
-        const templatesDir = join(outputDir, 'templates');
+        const valuesYamlPath = SecurityUtils.validatePath(join(outputDir, 'values.yaml'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(valuesYamlPath, dumpHelmAwareYaml(subchartValues));
+        const templatesDir = SecurityUtils.validatePath(join(outputDir, 'templates'), process.cwd(), {
+            allowAbsolute: true,
+        });
         if (!existsSync(templatesDir)) {
             mkdirSync(templatesDir, { recursive: true });
         }
@@ -65,13 +72,15 @@ export class FlexibleSubchart extends Chart {
             includeKubernetes: true,
             includeSprig: true,
         });
-        writeFileSync(join(templatesDir, '_helpers.tpl'), helpersTpl);
+        const helpersTplPath = SecurityUtils.validatePath(join(templatesDir, '_helpers.tpl'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(helpersTplPath, helpersTpl);
         this._manifests.forEach((item) => {
             if (item && typeof item === 'object' && 'manifest' in item && 'id' in item) {
                 const { manifest, id } = item;
                 if (manifest && typeof manifest === 'object') {
                     const templateContent = this._generateManifestTemplate(manifest, id);
-                    writeFileSync(join(templatesDir, `${id}.yaml`), templateContent);
+                    const manifestPath = SecurityUtils.validatePath(join(templatesDir, `${id}.yaml`), process.cwd(), { allowAbsolute: true });
+                    writeFileSync(manifestPath, templateContent);
                 }
             }
         });
@@ -195,8 +204,10 @@ export default function createChart() {
 
 // Auto-execute when run directly
 if (import.meta.url === new URL(import.meta.url).href) {
-  const chart = createChart();
-  chart.write('dist');
+  (async () => {
+    const chart = createChart();
+    await chart.write('dist');
+  })();
 }
 `;
 }

package/dist/lib/templates/umbrella-chart.js

@@ -2,6 +2,7 @@ import { writeFileSync, mkdirSync, existsSync, copyFileSync, readdirSync, rmSync
 import { join } from 'path';
 import { parse } from 'yaml';
 import { App, Chart, ApiObject } from 'cdk8s';
+import { SecurityUtils } from '../security.js';
 import { dumpHelmAwareYaml } from '../utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from '../utils/helmHelpers.js';
 import { createFlexibleSubchart } from './flexible-subchart.js';
@@ -46,7 +47,7 @@ function readYamlFile(filePath: string): Record<string, unknown> {
   return content && typeof content === 'object' ? (content as Record<string, unknown>) : {};
 }
 
-export function synth(outDir: string, options?: SynthOptions) {
+export async function synth(outDir: string, options?: SynthOptions) {
   const mode = resolveMode(options);
   const app = new App({
     outdir: outDir,
@@ -81,7 +82,7 @@ export function synth(outDir: string, options?: SynthOptions) {
     'namespace',
   );
 
-  umbrella.write(outDir);
+  await umbrella.write(outDir);
 
   const chartPath = join(outDir, 'Chart.yaml');
   const valuesPath = join(outDir, 'values.yaml');
@@ -97,11 +98,11 @@ export function synth(outDir: string, options?: SynthOptions) {
 
     const dependencies: Array<{ name: string; version: string; repository: string }> = [];
 
-    SUBCHARTS.forEach((subchart) => {
+    for (const subchart of SUBCHARTS) {
       const instance = subchart.factory();
       const targetDir = join(chartsDir, subchart.name);
       rmSync(targetDir, { recursive: true, force: true });
-      instance.write(targetDir);
+      await instance.write(targetDir);
       const meta = instance.getMeta();
       const version = meta.version ?? '0.1.0';
       dependencies.push({
@@ -113,7 +114,7 @@ export function synth(outDir: string, options?: SynthOptions) {
       if (Object.keys(subchartValues).length > 0) {
         valuesDoc[subchart.name] = subchartValues;
       }
-    });
+    }
 
     chartDoc.dependencies = dependencies;
   } else {
@@ -123,11 +124,11 @@ export function synth(outDir: string, options?: SynthOptions) {
     }
     delete chartDoc.dependencies;
 
-    SUBCHARTS.forEach((subchart) => {
+    for (const subchart of SUBCHARTS) {
       const instance = subchart.factory();
       const tempDir = join(outDir, '.timonel-inline-' + subchart.name);
       rmSync(tempDir, { recursive: true, force: true });
-      instance.write(tempDir);
+      await instance.write(tempDir);
 
       const subTemplatesDir = join(tempDir, 'templates');
       if (existsSync(subTemplatesDir)) {
@@ -144,7 +145,7 @@ export function synth(outDir: string, options?: SynthOptions) {
       }
 
       rmSync(tempDir, { recursive: true, force: true });
-    });
+    }
   }
 
   writeFileSync(chartPath, stringify(chartDoc));
@@ -227,10 +228,12 @@ export class UmbrellaChartTemplate extends Chart {
             else if (subchart.chart && typeof subchart.chart === 'object') {
                 this._handleObjectChart(subchart, flexibleSubchart);
             }
-            console.log(`Added flexible subchart: ${subchart.name}`);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.log(`Added flexible subchart: ${sanitizedName}`);
         }
         catch (_error) {
-            console.warn(`Failed to add subchart ${subchart.name}:`, _error);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.warn(`Failed to add subchart ${sanitizedName}:`, _error);
             this._createFallbackSubchart(subchart, index);
         }
     }
@@ -249,7 +252,8 @@ export class UmbrellaChartTemplate extends Chart {
             version: subchart.version || '1.0.0',
             description: `${subchart.name} subchart (fallback)`,
         });
-        console.log(`Created fallback subchart: ${subchart.name}`);
+        const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+        console.log(`Created fallback subchart: ${sanitizedName}`);
     }
     _handleFunctionChart(subchart, index, flexibleSubchart) {
         try {
@@ -263,7 +267,8 @@ export class UmbrellaChartTemplate extends Chart {
             }
         }
         catch (error) {
-            console.log(`Failed to process subchart ${subchart.name}:`, error);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.log(`Failed to process subchart ${sanitizedName}:`, error);
         }
     }
     _handleObjectChart(subchart, flexibleSubchart) {
@@ -338,7 +343,8 @@ export class UmbrellaChartTemplate extends Chart {
                 }
             }
             catch (error) {
-                console.log(`Failed to parse asset ${asset.id}:`, error);
+                const sanitizedId = asset.id.replace(/[\r\n]/g, '');
+                console.log(`Failed to parse asset ${sanitizedId}:`, error);
             }
         });
     }
@@ -375,7 +381,8 @@ export class UmbrellaChartTemplate extends Chart {
             includeSprig: true,
         });
         writeFileSync(join(templatesDir, '_helpers.tpl'), helpersTpl);
-        console.log(`Created basic Helm chart structure for subchart: ${subchartName}`);
+        const sanitizedName = subchartName.replace(/[\r\n]/g, '');
+        console.log(`Created basic Helm chart structure for subchart: ${sanitizedName}`);
     }
     writeHelmChart(outputDir) {
         if (!existsSync(outputDir)) {
@@ -412,7 +419,7 @@ export class UmbrellaChartTemplate extends Chart {
             mkdirSync(chartsDir, { recursive: true });
         }
         this.config.subcharts?.forEach((subchart) => {
-            const subchartDir = join(chartsDir, subchart.name);
+            const subchartDir = SecurityUtils.validatePath(join(chartsDir, subchart.name), process.cwd(), { allowAbsolute: true });
             if (!existsSync(subchartDir)) {
                 mkdirSync(subchartDir, { recursive: true });
             }
@@ -444,7 +451,8 @@ export class UmbrellaChartTemplate extends Chart {
                         }
                     }
                     catch (fallbackError) {
-                        console.warn(`Failed to create subchart ${subchart.name}:`, fallbackError);
+                        const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+                        console.warn(`Failed to create subchart ${sanitizedName}:`, fallbackError);
                         flexibleSubchart.writeHelmChart(subchartDir);
                     }
                 }
@@ -462,7 +470,9 @@ export class UmbrellaChartTemplate extends Chart {
                 flexibleSubchart.writeHelmChart(subchartDir);
             }
         });
-        const templatesDir = join(outputDir, 'templates');
+        const templatesDir = SecurityUtils.validatePath(join(outputDir, 'templates'), process.cwd(), {
+            allowAbsolute: true,
+        });
         if (!existsSync(templatesDir)) {
             mkdirSync(templatesDir, { recursive: true });
         }
@@ -479,7 +489,8 @@ export class UmbrellaChartTemplate extends Chart {
                 },
             },
         };
-        writeFileSync(join(templatesDir, 'namespace.yaml'), dumpHelmAwareYaml(namespaceYaml));
+        const namespaceYamlPath = SecurityUtils.validatePath(join(templatesDir, 'namespace.yaml'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(namespaceYamlPath, dumpHelmAwareYaml(namespaceYaml));
         const helpersTpl = generateHelpersTemplate('aws', undefined, {
             includeKubernetes: true,
             includeSprig: true,

package/dist/lib/umbrellaRutter.d.ts

@@ -21,7 +21,7 @@ export declare class UmbrellaRutter {
     private readonly logger;
     constructor(props: UmbrellaRutterProps);
     private validateMetadata;
-    write(outDir: string): void;
+    write(outDir: string): Promise<void>;
     private writeParentChart;
     private writeParentValues;
     private deepMerge;

package/dist/lib/umbrellaRutter.js

@@ -22,24 +22,29 @@ export class UmbrellaRutter {
             throw new Error('Chart version must follow semantic versioning (e.g., 1.0.0)');
         }
     }
-    write(outDir) {
+    async write(outDir) {
         const validatedOutDir = SecurityUtils.validatePath(outDir, process.cwd(), {
             allowAbsolute: true,
         });
         mkdirSync(validatedOutDir, { recursive: true });
-        mkdirSync(join(validatedOutDir, 'charts'), { recursive: true });
+        const chartsDir = SecurityUtils.validatePath(join(validatedOutDir, 'charts'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        mkdirSync(chartsDir, { recursive: true });
         for (const subchart of this.props.subcharts) {
             if (!SecurityUtils.isValidSubchartName(subchart.name)) {
                 throw new Error(`Invalid subchart name: ${SecurityUtils.sanitizeLogMessage(subchart.name)}`);
             }
             const sanitizedName = subchart.name;
-            const subchartDir = join(validatedOutDir, 'charts', sanitizedName);
-            subchart.rutter.write(subchartDir);
+            const subchartDir = SecurityUtils.validatePath(join(validatedOutDir, 'charts', sanitizedName), process.cwd(), { allowAbsolute: true });
+            await subchart.rutter.write(subchartDir);
         }
         this.writeParentChart(validatedOutDir);
         this.writeParentValues(validatedOutDir);
-        mkdirSync(join(validatedOutDir, 'templates'), { recursive: true });
-        writeFileSync(join(validatedOutDir, 'templates', 'NOTES.txt'), this.generateNotesTemplate());
+        const templatesDir = SecurityUtils.validatePath(join(validatedOutDir, 'templates'), process.cwd(), { allowAbsolute: true });
+        mkdirSync(templatesDir, { recursive: true });
+        const notesPath = SecurityUtils.validatePath(join(validatedOutDir, 'templates', 'NOTES.txt'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(notesPath, this.generateNotesTemplate());
     }
     writeParentChart(outDir) {
         const chartYaml = {
@@ -63,7 +68,10 @@ export class UmbrellaRutter {
                 };
             }),
         };
-        writeFileSync(join(outDir, 'Chart.yaml'), dumpHelmAwareYaml(chartYaml));
+        const chartYamlPath = SecurityUtils.validatePath(join(outDir, 'Chart.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(chartYamlPath, dumpHelmAwareYaml(chartYaml));
     }
     writeParentValues(outDir) {
         const values = {
@@ -77,12 +85,16 @@ export class UmbrellaRutter {
                 };
             }
         }
-        writeFileSync(join(outDir, 'values.yaml'), dumpHelmAwareYaml(values));
+        const valuesYamlPath = SecurityUtils.validatePath(join(outDir, 'values.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(valuesYamlPath, dumpHelmAwareYaml(values));
         if (this.props.envValues) {
             for (const [env, envVals] of Object.entries(this.props.envValues)) {
                 const sanitizedEnv = SecurityUtils.sanitizeEnvironmentName(env);
                 const envValues = this.deepMerge(values, envVals);
-                writeFileSync(join(outDir, `values-${sanitizedEnv}.yaml`), dumpHelmAwareYaml(envValues));
+                const envValuesPath = SecurityUtils.validatePath(join(outDir, `values-${sanitizedEnv}.yaml`), process.cwd(), { allowAbsolute: true });
+                writeFileSync(envValuesPath, dumpHelmAwareYaml(envValues));
             }
         }
     }