typekro 0.4.0 → 0.7.0

package/dist/core/proxy/known-status-fields.js

@@ -0,0 +1,185 @@
+/**
+ * Known status fields for standard Kubernetes resource kinds
+ *
+ * Used by the proxy's status property access trap to detect typos at runtime
+ * when debug mode is enabled. Only fires for known K8s kinds — CRDs and
+ * cross-composition references have unknown kinds, so no false positives.
+ *
+ * @see ROADMAP.md Phase 2.12
+ */
+import { levenshteinDistance } from '../../utils/string.js';
+/**
+ * Map of Kubernetes kind → known status field names.
+ *
+ * These are the fields defined by the standard Kubernetes API for each kind.
+ * Only includes kinds with meaningful status fields; kinds like ConfigMap
+ * and Secret that have no status are omitted (no warning needed for them).
+ */
+const KNOWN_STATUS_FIELDS = {
+    // Workloads
+    Deployment: [
+        'replicas',
+        'readyReplicas',
+        'availableReplicas',
+        'updatedReplicas',
+        'unavailableReplicas',
+        'conditions',
+        'observedGeneration',
+        'collisionCount',
+    ],
+    StatefulSet: [
+        'replicas',
+        'readyReplicas',
+        'currentReplicas',
+        'updatedReplicas',
+        'currentRevision',
+        'updateRevision',
+        'collisionCount',
+        'conditions',
+        'observedGeneration',
+        'availableReplicas',
+    ],
+    DaemonSet: [
+        'desiredNumberScheduled',
+        'numberReady',
+        'numberAvailable',
+        'numberMisscheduled',
+        'numberUnavailable',
+        'updatedNumberScheduled',
+        'currentNumberScheduled',
+        'collisionCount',
+        'conditions',
+        'observedGeneration',
+    ],
+    ReplicaSet: [
+        'replicas',
+        'readyReplicas',
+        'availableReplicas',
+        'fullyLabeledReplicas',
+        'conditions',
+        'observedGeneration',
+    ],
+    Job: [
+        'succeeded',
+        'failed',
+        'active',
+        'completionTime',
+        'startTime',
+        'conditions',
+        'completedIndexes',
+        'ready',
+        'uncountedTerminatedPods',
+    ],
+    CronJob: ['lastScheduleTime', 'lastSuccessfulTime', 'active'],
+    // Core
+    Pod: [
+        'phase',
+        'conditions',
+        'containerStatuses',
+        'initContainerStatuses',
+        'ephemeralContainerStatuses',
+        'hostIP',
+        'podIP',
+        'podIPs',
+        'startTime',
+        'message',
+        'reason',
+        'nominatedNodeName',
+        'qosClass',
+    ],
+    Namespace: ['phase', 'conditions'],
+    Node: [
+        'conditions',
+        'addresses',
+        'allocatable',
+        'capacity',
+        'daemonEndpoints',
+        'images',
+        'nodeInfo',
+        'phase',
+        'volumesAttached',
+        'volumesInUse',
+    ],
+    Service: ['loadBalancer', 'conditions'],
+    // Networking
+    Ingress: ['loadBalancer', 'observedGeneration'],
+    // Storage
+    PersistentVolumeClaim: [
+        'phase',
+        'accessModes',
+        'capacity',
+        'conditions',
+        'allocatedResources',
+        'allocatedResourceStatuses',
+    ],
+    PersistentVolume: ['phase', 'message', 'reason', 'lastPhaseTransitionTime'],
+    // Autoscaling
+    HorizontalPodAutoscaler: [
+        'currentReplicas',
+        'desiredReplicas',
+        'currentMetrics',
+        'conditions',
+        'observedGeneration',
+        'lastScaleTime',
+    ],
+    // Policy
+    PodDisruptionBudget: [
+        'currentHealthy',
+        'desiredHealthy',
+        'expectedPods',
+        'disruptionsAllowed',
+        'disruptedPods',
+        'observedGeneration',
+        'conditions',
+    ],
+};
+/**
+ * Maximum Levenshtein distance to consider a field name as a typo.
+ * 2 catches common typos like readyReplica→readyReplicas, reedyReplicas→readyReplicas.
+ */
+const MAX_TYPO_DISTANCE = 2;
+/**
+ * Check if a status field access looks like a typo of a known field.
+ *
+ * Returns the closest known field name if the accessed property:
+ * 1. Is NOT already a known field for the kind
+ * 2. Has a Levenshtein distance ≤ MAX_TYPO_DISTANCE to a known field
+ * 3. The kind is in the KNOWN_STATUS_FIELDS registry
+ *
+ * Returns `null` if no typo is detected (either valid field, unknown kind,
+ * or no close match found).
+ */
+export function detectStatusFieldTypo(kind, accessedField) {
+    const knownFields = KNOWN_STATUS_FIELDS[kind];
+    if (!knownFields) {
+        // Unknown kind (CRD, cross-composition) — no false positives
+        return null;
+    }
+    if (knownFields.length === 0) {
+        // Kind has no status fields (ConfigMap, Secret) — no warning
+        return null;
+    }
+    // Check if the field is known
+    if (knownFields.includes(accessedField)) {
+        return null;
+    }
+    // Find the closest known field
+    let bestMatch = null;
+    let bestDistance = MAX_TYPO_DISTANCE + 1;
+    for (const knownField of knownFields) {
+        const distance = levenshteinDistance(accessedField, knownField);
+        if (distance <= MAX_TYPO_DISTANCE && distance < bestDistance) {
+            bestDistance = distance;
+            bestMatch = knownField;
+        }
+    }
+    return bestMatch;
+}
+/**
+ * Get the list of known status fields for a kind.
+ * Returns undefined for unknown kinds.
+ */
+export function getKnownStatusFields(kind) {
+    return KNOWN_STATUS_FIELDS[kind];
+}
+//# sourceMappingURL=known-status-fields.js.map

package/dist/core/proxy/known-status-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-status-fields.js","sourceRoot":"","sources":["../../../src/core/proxy/known-status-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAgD;IACvE,YAAY;IACZ,UAAU,EAAE;QACV,UAAU;QACV,eAAe;QACf,mBAAmB;QACnB,iBAAiB;QACjB,qBAAqB;QACrB,YAAY;QACZ,oBAAoB;QACpB,gBAAgB;KACjB;IACD,WAAW,EAAE;QACX,UAAU;QACV,eAAe;QACf,iBAAiB;QACjB,iBAAiB;QACjB,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB;QAChB,YAAY;QACZ,oBAAoB;QACpB,mBAAmB;KACpB;IACD,SAAS,EAAE;QACT,wBAAwB;QACxB,aAAa;QACb,iBAAiB;QACjB,oBAAoB;QACpB,mBAAmB;QACnB,wBAAwB;QACxB,wBAAwB;QACxB,gBAAgB;QAChB,YAAY;QACZ,oBAAoB;KACrB;IACD,UAAU,EAAE;QACV,UAAU;QACV,eAAe;QACf,mBAAmB;QACnB,sBAAsB;QACtB,YAAY;QACZ,oBAAoB;KACrB;IACD,GAAG,EAAE;QACH,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,WAAW;QACX,YAAY;QACZ,kBAAkB;QAClB,OAAO;QACP,yBAAyB;KAC1B;IACD,OAAO,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,QAAQ,CAAC;IAE7D,OAAO;IACP,GAAG,EAAE;QACH,OAAO;QACP,YAAY;QACZ,mBAAmB;QACnB,uBAAuB;QACvB,4BAA4B;QAC5B,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,WAAW;QACX,SAAS;QACT,QAAQ;QACR,mBAAmB;QACnB,UAAU;KACX;IACD,SAAS,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC;IAClC,IAAI,EAAE;QACJ,YAAY;QACZ,WAAW;QACX,aAAa;QACb,UAAU;QACV,iBAAiB;QACjB,QAAQ;QACR,UAAU;QACV,OAAO;QACP,iBAAiB;QACjB,cAAc;KACf;IACD,OAAO,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;IAEvC,aAAa;IACb,OAAO,EAAE,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C,UAAU;IACV,qBAAqB,EAAE;QACrB,OAAO;QACP,aAAa;QACb,UAAU;QACV,YAAY;QACZ,oBAAoB;QACpB,2BAA2B;KAC5B;IACD,gBAAgB,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,yBAAyB,CAAC;IAE3E,cAAc;IACd,uBAAuB,EAAE;QACvB,iBAAiB;QACjB,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,oBAAoB;QACpB,eAAe;KAChB;IAED,SAAS;IACT,mBAAmB,EAAE;QACnB,gBAAgB;QAChB,gBAAgB;QAChB,cAAc;QACd,oBAAoB;QACpB,eAAe;QACf,oBAAoB;QACpB,YAAY;KACb;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,aAAqB;IACvE,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,YAAY,GAAG,iBAAiB,GAAG,CAAC,CAAC;IAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,QAAQ,IAAI,iBAAiB,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;YAC7D,YAAY,GAAG,QAAQ,CAAC;YACxB,SAAS,GAAG,UAAU,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/readiness/evaluator-factories.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Readiness Evaluator Factories
+ *
+ * Generic factories for creating readiness evaluators that follow common
+ * Kubernetes patterns. These eliminate duplication across factory files
+ * that each implement near-identical readiness logic.
+ *
+ * Patterns covered:
+ * - Always Ready: Configuration resources with no meaningful status
+ * - Condition-Based: Standard Kubernetes condition checking (Ready=True)
+ * - Phase-Based: Single status.phase field comparison
+ */
+import type { ReadinessEvaluator } from '../types/kubernetes.js';
+/**
+ * Creates a readiness evaluator that always returns ready.
+ *
+ * Used for configuration resources (ConfigMap, Secret, ClusterRole, etc.)
+ * that have no meaningful status and are considered ready upon creation.
+ *
+ * @param kind - Resource kind name for messages (e.g., 'ConfigMap')
+ * @returns A ReadinessEvaluator that always returns `{ ready: true }`
+ *
+ * @example
+ * ```typescript
+ * createResource({ ... }).withReadinessEvaluator(
+ *   createAlwaysReadyEvaluator('ConfigMap')
+ * );
+ * ```
+ */
+export declare function createAlwaysReadyEvaluator<T = unknown>(kind: string): ReadinessEvaluator<T>;
+/** Options for creating a condition-based readiness evaluator. */
+export interface ConditionBasedEvaluatorOptions {
+    /** Resource kind name for messages (e.g., 'Certificate', 'ClusterIssuer') */
+    kind: string;
+    /**
+     * Primary condition type to check.
+     * @default 'Ready'
+     */
+    conditionType?: string;
+    /**
+     * Default ready message when the condition message is absent.
+     * @default `${kind} is ready`
+     */
+    defaultReadyMessage?: string;
+}
+/**
+ * Creates a readiness evaluator that checks `status.conditions` for a
+ * specific condition type with `status: 'True'`.
+ *
+ * This is the standard Kubernetes condition-checking pattern used by
+ * cert-manager Issuers/Certificates, Flux GitRepositories, and many CRDs.
+ *
+ * @param options - Configuration for the evaluator
+ * @returns A ReadinessEvaluator that checks conditions
+ *
+ * @example
+ * ```typescript
+ * // Simple: check Ready condition
+ * const evaluator = createConditionBasedReadinessEvaluator({ kind: 'ClusterIssuer' });
+ *
+ * // Custom condition type
+ * const evaluator = createConditionBasedReadinessEvaluator({
+ *   kind: 'MyResource',
+ *   conditionType: 'Available',
+ * });
+ * ```
+ */
+export declare function createConditionBasedReadinessEvaluator(options: ConditionBasedEvaluatorOptions): ReadinessEvaluator<unknown>;
+/** Options for creating a phase-based readiness evaluator. */
+export interface PhaseBasedEvaluatorOptions {
+    /** Resource kind name for messages (e.g., 'Namespace', 'PersistentVolumeClaim') */
+    kind: string;
+    /** Phase values that indicate readiness (e.g., ['Active'], ['Bound'], ['Available', 'Bound']) */
+    readyPhases: string[];
+    /**
+     * Name of the status field containing the phase.
+     * @default 'phase'
+     */
+    phaseField?: string;
+}
+/**
+ * Creates a readiness evaluator that checks `status.phase` (or a custom
+ * field) against a set of expected values.
+ *
+ * Used for resources like Namespaces (Active), PVCs (Bound), and PVs
+ * (Available/Bound).
+ *
+ * @param options - Configuration for the evaluator
+ * @returns A ReadinessEvaluator that checks the phase field
+ *
+ * @example
+ * ```typescript
+ * const evaluator = createPhaseBasedReadinessEvaluator({
+ *   kind: 'Namespace',
+ *   readyPhases: ['Active'],
+ * });
+ * ```
+ */
+export declare function createPhaseBasedReadinessEvaluator<T = unknown>(options: PhaseBasedEvaluatorOptions): ReadinessEvaluator<T>;
+//# sourceMappingURL=evaluator-factories.d.ts.map

package/dist/core/readiness/evaluator-factories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator-factories.d.ts","sourceRoot":"","sources":["../../../src/core/readiness/evaluator-factories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,wBAAwB,CAAC;AAMjF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAK3F;AAMD,kEAAkE;AAClE,MAAM,WAAW,8BAA8B;IAC7C,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAWD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,8BAA8B,GACtC,kBAAkB,CAAC,OAAO,CAAC,CA0D7B;AAMD,8DAA8D;AAC9D,MAAM,WAAW,0BAA0B;IACzC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IAEb,iGAAiG;IACjG,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,CAAC,GAAG,OAAO,EAC5D,OAAO,EAAE,0BAA0B,GAClC,kBAAkB,CAAC,CAAC,CAAC,CAuCvB"}

package/dist/core/readiness/evaluator-factories.js

@@ -0,0 +1,168 @@
+/**
+ * Readiness Evaluator Factories
+ *
+ * Generic factories for creating readiness evaluators that follow common
+ * Kubernetes patterns. These eliminate duplication across factory files
+ * that each implement near-identical readiness logic.
+ *
+ * Patterns covered:
+ * - Always Ready: Configuration resources with no meaningful status
+ * - Condition-Based: Standard Kubernetes condition checking (Ready=True)
+ * - Phase-Based: Single status.phase field comparison
+ */
+import { ensureError } from '../errors.js';
+// =============================================================================
+// Pattern 1: Always Ready
+// =============================================================================
+/**
+ * Creates a readiness evaluator that always returns ready.
+ *
+ * Used for configuration resources (ConfigMap, Secret, ClusterRole, etc.)
+ * that have no meaningful status and are considered ready upon creation.
+ *
+ * @param kind - Resource kind name for messages (e.g., 'ConfigMap')
+ * @returns A ReadinessEvaluator that always returns `{ ready: true }`
+ *
+ * @example
+ * ```typescript
+ * createResource({ ... }).withReadinessEvaluator(
+ *   createAlwaysReadyEvaluator('ConfigMap')
+ * );
+ * ```
+ */
+export function createAlwaysReadyEvaluator(kind) {
+    return () => ({
+        ready: true,
+        message: `${kind} is ready (configuration resource)`,
+    });
+}
+/**
+ * Creates a readiness evaluator that checks `status.conditions` for a
+ * specific condition type with `status: 'True'`.
+ *
+ * This is the standard Kubernetes condition-checking pattern used by
+ * cert-manager Issuers/Certificates, Flux GitRepositories, and many CRDs.
+ *
+ * @param options - Configuration for the evaluator
+ * @returns A ReadinessEvaluator that checks conditions
+ *
+ * @example
+ * ```typescript
+ * // Simple: check Ready condition
+ * const evaluator = createConditionBasedReadinessEvaluator({ kind: 'ClusterIssuer' });
+ *
+ * // Custom condition type
+ * const evaluator = createConditionBasedReadinessEvaluator({
+ *   kind: 'MyResource',
+ *   conditionType: 'Available',
+ * });
+ * ```
+ */
+export function createConditionBasedReadinessEvaluator(options) {
+    const { kind, conditionType = 'Ready' } = options;
+    return (liveResource) => {
+        try {
+            const resource = liveResource;
+            const status = resource?.status;
+            if (!status) {
+                return {
+                    ready: false,
+                    reason: 'StatusMissing',
+                    message: `${kind} status not available`,
+                };
+            }
+            const conditions = status.conditions;
+            if (!conditions || conditions.length === 0) {
+                return {
+                    ready: false,
+                    reason: 'ConditionsMissing',
+                    message: `${kind} conditions not available`,
+                };
+            }
+            // Look for the target condition
+            const targetCondition = conditions.find((c) => c.type === conditionType);
+            if (!targetCondition) {
+                return {
+                    ready: false,
+                    reason: `${conditionType}ConditionMissing`,
+                    message: `${kind} ${conditionType} condition not found`,
+                };
+            }
+            if (targetCondition.status === 'True') {
+                return {
+                    ready: true,
+                    message: targetCondition.message || options.defaultReadyMessage || `${kind} is ready`,
+                    reason: 'Ready',
+                };
+            }
+            // Not ready
+            return {
+                ready: false,
+                reason: targetCondition.reason || 'NotReady',
+                message: targetCondition.message || targetCondition.reason || `${kind} is not ready`,
+            };
+        }
+        catch (error) {
+            return {
+                ready: false,
+                reason: 'EvaluationError',
+                message: `Error evaluating ${kind} readiness: ${ensureError(error).message}`,
+            };
+        }
+    };
+}
+/**
+ * Creates a readiness evaluator that checks `status.phase` (or a custom
+ * field) against a set of expected values.
+ *
+ * Used for resources like Namespaces (Active), PVCs (Bound), and PVs
+ * (Available/Bound).
+ *
+ * @param options - Configuration for the evaluator
+ * @returns A ReadinessEvaluator that checks the phase field
+ *
+ * @example
+ * ```typescript
+ * const evaluator = createPhaseBasedReadinessEvaluator({
+ *   kind: 'Namespace',
+ *   readyPhases: ['Active'],
+ * });
+ * ```
+ */
+export function createPhaseBasedReadinessEvaluator(options) {
+    const { kind, readyPhases, phaseField = 'phase' } = options;
+    return (liveResource) => {
+        try {
+            const resource = liveResource;
+            const status = resource?.status;
+            if (!status) {
+                return {
+                    ready: false,
+                    reason: 'StatusMissing',
+                    message: `${kind} status not available yet`,
+                };
+            }
+            const phase = status[phaseField];
+            const ready = phase !== undefined && readyPhases.includes(phase);
+            if (ready) {
+                return {
+                    ready: true,
+                    message: `${kind} is ready with phase: ${phase}`,
+                };
+            }
+            return {
+                ready: false,
+                reason: 'PhaseNotReady',
+                message: `${kind} phase is ${phase || 'unknown'}, expected: ${readyPhases.join(' or ')}`,
+            };
+        }
+        catch (error) {
+            return {
+                ready: false,
+                reason: 'EvaluationError',
+                message: `Error evaluating ${kind} readiness: ${ensureError(error).message}`,
+            };
+        }
+    };
+}
+//# sourceMappingURL=evaluator-factories.js.map

package/dist/core/readiness/evaluator-factories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator-factories.js","sourceRoot":"","sources":["../../../src/core/readiness/evaluator-factories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAc,IAAY;IAClE,OAAO,GAAG,EAAE,CAAC,CAAC;QACZ,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,GAAG,IAAI,oCAAoC;KACrD,CAAC,CAAC;AACL,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sCAAsC,CACpD,OAAuC;IAEvC,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;IAElD,OAAO,CAAC,YAAqB,EAAkB,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAoE,CAAC;YACtF,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;YAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,GAAG,IAAI,uBAAuB;iBACxC,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YACrC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,mBAAmB;oBAC3B,OAAO,EAAE,GAAG,IAAI,2BAA2B;iBAC5C,CAAC;YACJ,CAAC;YAED,gCAAgC;YAChC,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;YAEzE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,GAAG,aAAa,kBAAkB;oBAC1C,OAAO,EAAE,GAAG,IAAI,IAAI,aAAa,sBAAsB;iBACxD,CAAC;YACJ,CAAC;YAED,IAAI,eAAe,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,eAAe,CAAC,OAAO,IAAI,OAAO,CAAC,mBAAmB,IAAI,GAAG,IAAI,WAAW;oBACrF,MAAM,EAAE,OAAO;iBAChB,CAAC;YACJ,CAAC;YAED,YAAY;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,UAAU;gBAC5C,OAAO,EAAE,eAAe,CAAC,OAAO,IAAI,eAAe,CAAC,MAAM,IAAI,GAAG,IAAI,eAAe;aACrF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,oBAAoB,IAAI,eAAe,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;aAC7E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAmC;IAEnC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5D,OAAO,CAAC,YAAe,EAAkB,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAuE,CAAC;YACzF,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;YAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,GAAG,IAAI,2BAA2B;iBAC5C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAuB,CAAC;YACvD,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAEjE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,GAAG,IAAI,yBAAyB,KAAK,EAAE;iBACjD,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,GAAG,IAAI,aAAa,KAAK,IAAI,SAAS,eAAe,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;aACzF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,oBAAoB,IAAI,eAAe,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;aAC7E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/readiness/evaluator.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Readiness Evaluator Resolution
+ *
+ * Ensures that a Kubernetes resource has a readiness evaluator attached,
+ * either from an existing attachment, from the global registry, or throws
+ * an informative error if none can be found.
+ */
+import type { Enhanced } from '../types/kubernetes.js';
+/**
+ * Ensure a readiness evaluator is attached to the given resource.
+ *
+ * Resolution order:
+ * 1. Resource already has an attached evaluator → return as-is.
+ * 2. Global {@link ReadinessEvaluatorRegistry} has an evaluator for the
+ *    resource's `kind` → attach it.
+ * 3. Neither → throw a {@link TypeKroError} with guidance.
+ *
+ * @throws {TypeKroError} If no readiness evaluator can be resolved.
+ */
+export declare function ensureReadinessEvaluator<T extends Enhanced<unknown, unknown>>(resource: T): T;
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/core/readiness/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../src/core/readiness/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAsB7F"}

package/dist/core/readiness/evaluator.js

@@ -0,0 +1,38 @@
+/**
+ * Readiness Evaluator Resolution
+ *
+ * Ensures that a Kubernetes resource has a readiness evaluator attached,
+ * either from an existing attachment, from the global registry, or throws
+ * an informative error if none can be found.
+ */
+import { TypeKroError } from '../errors.js';
+import { getReadinessEvaluator, setReadinessEvaluator } from '../metadata/index.js';
+import { ReadinessEvaluatorRegistry } from './registry.js';
+/**
+ * Ensure a readiness evaluator is attached to the given resource.
+ *
+ * Resolution order:
+ * 1. Resource already has an attached evaluator → return as-is.
+ * 2. Global {@link ReadinessEvaluatorRegistry} has an evaluator for the
+ *    resource's `kind` → attach it.
+ * 3. Neither → throw a {@link TypeKroError} with guidance.
+ *
+ * @throws {TypeKroError} If no readiness evaluator can be resolved.
+ */
+export function ensureReadinessEvaluator(resource) {
+    // First: Check if resource already has attached evaluator (via WeakMap metadata)
+    if (typeof getReadinessEvaluator(resource) === 'function') {
+        return resource;
+    }
+    // Second: Look up in registry by KIND
+    const registry = ReadinessEvaluatorRegistry.getInstance();
+    const evaluator = registry.getEvaluatorForKind(resource.kind);
+    if (evaluator) {
+        setReadinessEvaluator(resource, evaluator);
+        return resource;
+    }
+    // Third: No evaluator found anywhere
+    throw new TypeKroError(`No readiness evaluator found for ${resource.kind}/${resource.metadata?.name}. ` +
+        `Use a factory function like deployment(), configMap(), etc., or call .withReadinessEvaluator().`, 'MISSING_READINESS_EVALUATOR', { kind: resource.kind, name: resource.metadata?.name });
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/core/readiness/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/core/readiness/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAuC,QAAW;IACxF,iFAAiF;IACjF,IAAI,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE9D,IAAI,SAAS,EAAE,CAAC;QACd,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,qCAAqC;IACrC,MAAM,IAAI,YAAY,CACpB,oCAAoC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI;QAC9E,iGAAiG,EACnG,6BAA6B,EAC7B,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CACvD,CAAC;AACJ,CAAC"}

package/dist/core/readiness/index.d.ts

@@ -1,5 +1,8 @@
 /**
  * Readiness Evaluator System
  */
+export { ensureReadinessEvaluator } from './evaluator.js';
+export type { ConditionBasedEvaluatorOptions, PhaseBasedEvaluatorOptions, } from './evaluator-factories.js';
+export { createAlwaysReadyEvaluator, createConditionBasedReadinessEvaluator, createPhaseBasedReadinessEvaluator, } from './evaluator-factories.js';
 export { ReadinessEvaluatorRegistry } from './registry.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/readiness/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/readiness/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/readiness/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EACV,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC"}

package/dist/core/readiness/index.js

@@ -1,5 +1,7 @@
 /**
  * Readiness Evaluator System
  */
+export { ensureReadinessEvaluator } from './evaluator.js';
+export { createAlwaysReadyEvaluator, createConditionBasedReadinessEvaluator, createPhaseBasedReadinessEvaluator, } from './evaluator-factories.js';
 export { ReadinessEvaluatorRegistry } from './registry.js';
 //# sourceMappingURL=index.js.map

package/dist/core/readiness/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/readiness/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/readiness/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAK1D,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC"}

package/dist/core/readiness/registry.d.ts

@@ -6,7 +6,7 @@
  */
 import type { ReadinessEvaluator } from '../types/index.js';
 interface ReadinessEvaluatorEntry {
-    evaluator: ReadinessEvaluator;
+    evaluator: ReadinessEvaluator<any>;
     factoryName?: string | undefined;
     resourceKind: string;
     registeredAt: number;
@@ -19,11 +19,11 @@ export declare class ReadinessEvaluatorRegistry {
     /**
      * Register evaluator by resource kind when withReadinessEvaluator is called
      */
-    registerForKind(kind: string, evaluator: ReadinessEvaluator, factoryName?: string): void;
+    registerForKind(kind: string, evaluator: ReadinessEvaluator<any>, factoryName?: string): void;
     /**
      * Lookup evaluator by resource kind
      */
-    getEvaluatorForKind(kind: string): ReadinessEvaluator | null;
+    getEvaluatorForKind(kind: string): ReadinessEvaluator<any> | null;
     /**
      * Check if kind has registered evaluator
      */

package/dist/core/readiness/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/core/readiness/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,UAAU,uBAAuB;IAC/B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAA6B;IACpD,OAAO,CAAC,eAAe,CAA8C;IAErE,OAAO;IAIP,MAAM,CAAC,WAAW,IAAI,0BAA0B;IAOhD;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAWxF;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAK5D;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1C;;OAEG;IACH,QAAQ,IAAI;QACV,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,uBAAuB,EAAE,CAAC;KACpC;IASD;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/core/readiness/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,UAAU,uBAAuB;IAE/B,SAAS,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAA6B;IACpD,OAAO,CAAC,eAAe,CAA8C;IAErE,OAAO;IAIP,MAAM,CAAC,WAAW,IAAI,0BAA0B;IAOhD;;OAEG;IAEH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAW7F;;OAEG;IAEH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI;IAKjE;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1C;;OAEG;IACH,QAAQ,IAAI;QACV,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,uBAAuB,EAAE,CAAC;KACpC;IASD;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/core/readiness/registry.js

@@ -19,6 +19,7 @@ export class ReadinessEvaluatorRegistry {
     /**
      * Register evaluator by resource kind when withReadinessEvaluator is called
      */
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts evaluators typed for any K8s resource
     registerForKind(kind, evaluator, factoryName) {
         const entry = {
             evaluator,
@@ -31,6 +32,7 @@ export class ReadinessEvaluatorRegistry {
     /**
      * Lookup evaluator by resource kind
      */
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- returns evaluators for heterogeneous K8s types
     getEvaluatorForKind(kind) {
         const entry = this.kindToEvaluator.get(kind);
         return entry?.evaluator || null;

package/dist/core/readiness/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/core/readiness/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,OAAO,0BAA0B;IAC7B,MAAM,CAAC,QAAQ,CAA6B;IAC5C,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAC;IAErE;QACE,4CAA4C;IAC9C,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,CAAC;YACzC,0BAA0B,CAAC,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,0BAA0B,CAAC,QAAQ,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAY,EAAE,SAA6B,EAAE,WAAoB;QAC/E,MAAM,KAAK,GAA4B;YACrC,SAAS;YACT,WAAW;YACX,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,QAAQ;QAKN,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC9C,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/core/readiness/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,MAAM,OAAO,0BAA0B;IAC7B,MAAM,CAAC,QAAQ,CAA6B;IAC5C,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAC;IAErE;QACE,4CAA4C;IAC9C,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,CAAC;YACzC,0BAA0B,CAAC,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,0BAA0B,CAAC,QAAQ,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,+GAA+G;IAC/G,eAAe,CAAC,IAAY,EAAE,SAAkC,EAAE,WAAoB;QACpF,MAAM,KAAK,GAA4B;YACrC,SAAS;YACT,WAAW;YACX,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,gHAAgH;IAChH,mBAAmB,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,QAAQ;QAKN,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC9C,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/core/references/cel-evaluator.d.ts

@@ -49,6 +49,17 @@ export declare class CelEvaluator {
      * Create a CEL expression from a template string with resource references
      */
     static createExpression(template: string, ...refs: KubernetesRef[]): CelExpression;
+    /**
+     * Escape a string for safe embedding in a CEL string literal.
+     * Prevents CEL injection by escaping quotes and backslashes.
+     */
+    private static escapeCelString;
+    /**
+     * Validate a CEL predicate/expression fragment to prevent injection.
+     * Rejects expressions containing string literals with unbalanced quotes
+     * or suspicious patterns that could indicate injection attempts.
+     */
+    private static validateCelFragment;
     /**
      * Common CEL expression builders
      */

package/dist/core/references/cel-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-evaluator.d.ts","sourceRoot":"","sources":["../../../src/core/references/cel-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE,qBAAa,YAAY;IACvB;;OAEG;IACG,QAAQ,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC1F;;OAEG;IACH,KAAK,CAAC,UAAU,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC;IAsCrF;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAmBvE;;OAEG;YACW,eAAe;IAyC7B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAuBjC;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,GAAG,aAAa;IAgBlF;;OAEG;IACH,MAAM,CAAC,WAAW;QAChB;;WAEG;2BACgB,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,KAAG,aAAa;QAgBhE;;WAEG;iCAEU,MAAM,GAAG,aAAa,aACtB,OAAO,cACN,OAAO,KAClB,aAAa;QAWhB;;WAEG;mBACQ,aAAa,KAAG,aAAa;QAKxC;;WAEG;oBACS,aAAa,KAAG,aAAa;QAKzC;;WAEG;wBACa,aAAa,aAAa,MAAM,KAAG,aAAa;QAKhE;;WAEG;0BACe,aAAa,UAAU,MAAM,KAAG,aAAa;QAK/D;;WAEG;wBACa,aAAa,UAAU,MAAM,KAAG,aAAa;QAK7D;;WAEG;mBACQ,aAAa,aAAa,MAAM,KAAG,aAAa;QAK3D;;WAEG;sBACW,aAAa,aAAa,MAAM,KAAG,aAAa;QAK9D;;WAEG;sBACW,aAAa,aAAa,MAAM,KAAG,aAAa;QAK9D;;WAEG;mBACQ,aAAa,aAAa,MAAM,KAAG,aAAa;MAI3D;CACH"}
+{"version":3,"file":"cel-evaluator.d.ts","sourceRoot":"","sources":["../../../src/core/references/cel-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE,qBAAa,YAAY;IACvB;;OAEG;IACG,QAAQ,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC1F;;OAEG;IACH,KAAK,CAAC,UAAU,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC;IAwCrF;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAmBvE;;OAEG;YACW,eAAe;IA6C7B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAuBjC;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,GAAG,aAAa;IAgBlF;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAI9B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAYlC;;OAEG;IACH,MAAM,CAAC,WAAW;QAChB;;WAEG;2BACgB,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,KAAG,aAAa;QAgBhE;;WAEG;iCAEU,MAAM,GAAG,aAAa,aACtB,OAAO,cACN,OAAO,KAClB,aAAa;QAgBhB;;WAEG;mBACQ,aAAa,KAAG,aAAa;QAKxC;;WAEG;oBACS,aAAa,KAAG,aAAa;QAKzC;;WAEG;wBACa,aAAa,aAAa,MAAM,KAAG,aAAa;QAKhE;;WAEG;0BACe,aAAa,UAAU,MAAM,KAAG,aAAa;QAK/D;;WAEG;wBACa,aAAa,UAAU,MAAM,KAAG,aAAa;QAK7D;;WAEG;mBACQ,aAAa,aAAa,MAAM,KAAG,aAAa;QAQ3D;;WAEG;sBACW,aAAa,aAAa,MAAM,KAAG,aAAa;QAQ9D;;WAEG;sBACW,aAAa,aAAa,MAAM,KAAG,aAAa;QAQ9D;;WAEG;mBACQ,aAAa,aAAa,MAAM,KAAG,aAAa;MAO3D;CACH"}