@decaf-ts/integrations 0.14.2 → 0.15.3

package/lib/esm/secrets/core/SecretReference.js

@@ -40,6 +40,7 @@ function isValidProvider(provider) {
         "azure-key-vault",
         "gcp-secret-manager",
         "1password",
+        "kubernetes",
     ];
     return validProviders.includes(provider);
 }

package/lib/esm/secrets/core/SecretReference.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecretReference.js","sourceRoot":"","sources":["../../../../src/secrets/core/SecretReference.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,0BAAuB;AAE7C,MAAM,WAAW,GACf,oGAAyH,CAAC;AAC5H,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAK9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,oCAAoC,GAAG,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IAEjD,IAAI,CAAC,eAAe,CAAC,QAA0B,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,kCAAkC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAA0B;QACpC,IAAI;QACJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAwB,EACxB,IAAY,EACZ,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,WAAW,QAAQ,IAAI,IAAI,YAAY,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,WAAW,QAAQ,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC;QACH,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,cAAc,GAAqB;QACvC,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,iBAAiB;QACjB,qBAAqB;QACrB,iBAAiB;QACjB,oBAAoB;QACpB,WAAW;KACZ,CAAC;IACF,OAAO,cAAc,CAAC,QAAQ,CAAC,QAA0B,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"SecretReference.js","sourceRoot":"","sources":["../../../../src/secrets/core/SecretReference.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,0BAAuB;AAE7C,MAAM,WAAW,GACf,oGAAyH,CAAC;AAC5H,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAK9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,oCAAoC,GAAG,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IAEjD,IAAI,CAAC,eAAe,CAAC,QAA0B,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,kCAAkC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAA0B;QACpC,IAAI;QACJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAwB,EACxB,IAAY,EACZ,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,WAAW,QAAQ,IAAI,IAAI,YAAY,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,WAAW,QAAQ,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC;QACH,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,cAAc,GAAqB;QACvC,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,iBAAiB;QACjB,qBAAqB;QACrB,iBAAiB;QACjB,oBAAoB;QACpB,WAAW;QACX,YAAY;KACb,CAAC;IACF,OAAO,cAAc,CAAC,QAAQ,CAAC,QAA0B,CAAC,CAAC;AAC7D,CAAC"}

package/lib/esm/secrets/kubernetes/KubernetesSecretEnvironment.js

@@ -0,0 +1,30 @@
+/**
+ * @module integrations/secrets/kubernetes/environment
+ * @summary Kubernetes secret environment.
+ * @description Extends the common secrets environment with the `secrets.kubernetes`
+ * shape matching {@link KubernetesSecretServiceConfig}, so
+ * {@link KubernetesSecretService} can fall back to it when no config is passed to
+ * `initialize`.
+ */
+import { SecretEnvironment } from "./../core/SecretEnvironment.js";
+export const KubernetesSecretEnvironment = SecretEnvironment.accumulate({
+    secrets: {
+        kubernetes: {
+            namespace: "",
+            kubeconfig: "",
+            context: "",
+            server: "",
+            token: "",
+            tokenFile: "",
+            caFile: "",
+            caData: "",
+            certFile: "",
+            keyFile: "",
+            certData: "",
+            keyData: "",
+            skipTLSVerify: false,
+            serviceAccount: false,
+        },
+    },
+});
+//# sourceMappingURL=KubernetesSecretEnvironment.js.map

package/lib/esm/secrets/kubernetes/KubernetesSecretEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesSecretEnvironment.js","sourceRoot":"","sources":["../../../../src/secrets/kubernetes/KubernetesSecretEnvironment.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,uCAAkC;AAyB9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC,UAAU,CAAC;IACtE,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,aAAa,EAAE,KAAK;YACpB,cAAc,EAAE,KAAK;SACtB;KACF;CACkC,CAAC,CAAC"}

package/lib/esm/secrets/kubernetes/KubernetesSecretService.js

@@ -0,0 +1,474 @@
+import { ApiException, CoreV1Api, KubeConfig, } from "@kubernetes/client-node";
+import { AuthorizationError } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretError, } from "./../core/index.js";
+import { validateSecretName, normalizeSecretName } from "./../core/index.js";
+import { serializeSecretPayload, deserializeSecretPayload, } from "./../core/index.js";
+import { KubernetesSecretEnvironment } from "./KubernetesSecretEnvironment.js";
+import { envBoolean, envString } from "./../../shared/environmentValue.js";
+import { BadRequestError, BaseError, ConflictError, InternalError, NotFoundError, } from "@decaf-ts/db-decorators";
+const PAYLOAD_DATA_KEY = "payload";
+const MANAGED_LABEL = "decaf-ts.io/managed";
+const ANNOTATION_PREFIX = "decaf-ts.io/";
+const ENCODING_ANNOTATION = `${ANNOTATION_PREFIX}encoding`;
+const CONTENT_TYPE_ANNOTATION = `${ANNOTATION_PREFIX}content-type`;
+const TAGS_ANNOTATION = `${ANNOTATION_PREFIX}tags`;
+const VERSION_ANNOTATION = `${ANNOTATION_PREFIX}version`;
+const UPDATED_AT_ANNOTATION = `${ANNOTATION_PREFIX}updated-at`;
+const TENANT_ANNOTATION = `${ANNOTATION_PREFIX}tenant-id`;
+const ORG_UNIT_ANNOTATION = `${ANNOTATION_PREFIX}org-unit-id`;
+const OWNER_ANNOTATION = `${ANNOTATION_PREFIX}owner-principal-id`;
+const DNS_SUBDOMAIN_PATTERN = /^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$/;
+const DNS_LABEL_PATTERN = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+function assertKubernetesName(name) {
+    if (name.length > 253 || !DNS_SUBDOMAIN_PATTERN.test(name)) {
+        throw new SecretError("SECRET_INVALID_NAME", `Invalid Kubernetes secret name: "${name}". Names must be lowercase DNS-1123 subdomains (letters, digits, '-', and '.').`);
+    }
+}
+function assertKubernetesNamespace(namespace) {
+    if (namespace.length > 63 || !DNS_LABEL_PATTERN.test(namespace)) {
+        throw new SecretError("SECRET_INVALID_NAME", `Invalid Kubernetes namespace: "${namespace}". Namespaces must be lowercase DNS-1123 labels.`);
+    }
+}
+function toDate(value) {
+    if (!value)
+        return undefined;
+    const date = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(date.getTime()) ? undefined : date;
+}
+function parseTags(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object"
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * @class KubernetesSecretService
+ * @summary Native Kubernetes Secrets backend.
+ * @description Implements the {@link SecretService} contract on top of
+ * namespaced Kubernetes `Secret` objects. Each DECAF secret is stored as an
+ * `Opaque` Secret whose `payload` data key holds the serialized
+ * {@link SerializedSecretPayload} envelope, while encoding, content type, tags,
+ * logical version, and ownership hints live in `decaf-ts.io/*` annotations.
+ *
+ * Authentication uses the standard Kubernetes client resolution order:
+ * explicit `server` credentials, an explicit `kubeconfig` path, `KUBECONFIG`,
+ * `~/.kube/config`, and finally the in-cluster service account.
+ */
+export class KubernetesSecretService extends ClientBasedSecretService {
+    constructor() {
+        super(...arguments);
+        this.provider = "kubernetes";
+    }
+    configFromEnvironment() {
+        const env = KubernetesSecretEnvironment.secrets.kubernetes;
+        const namespace = envString(env?.namespace);
+        const kubeconfig = envString(env?.kubeconfig);
+        const context = envString(env?.context);
+        const server = envString(env?.server);
+        if (!namespace && !kubeconfig && !context && !server)
+            return undefined;
+        return {
+            provider: "kubernetes",
+            namespace,
+            kubeconfig,
+            context,
+            server,
+            token: envString(env.token),
+            tokenFile: envString(env.tokenFile),
+            caFile: envString(env.caFile),
+            caData: envString(env.caData),
+            certFile: envString(env.certFile),
+            keyFile: envString(env.keyFile),
+            certData: envString(env.certData),
+            keyData: envString(env.keyData),
+            skipTLSVerify: envBoolean(env.skipTLSVerify),
+            serviceAccount: envBoolean(env.serviceAccount),
+        };
+    }
+    async initialize(...args) {
+        const { log } = (await this.logCtx(args, "initialize", true)).for(this.initialize);
+        const config = this.getConfigFromArgs(...args);
+        const kubeConfig = this.buildKubeConfig(config);
+        const namespace = this.resolveNamespace(config, kubeConfig);
+        const resolved = { ...config, namespace };
+        const client = kubeConfig.makeApiClient(CoreV1Api);
+        this._config = resolved;
+        this._client = client;
+        log.verbose(`Initialized Kubernetes secret service for namespace "${namespace}"`);
+        return { config: resolved, client };
+    }
+    async store(name, value, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "store", true)).for(this.store);
+        const normalizedName = this.normalizeName(name);
+        const namespace = this.resolveNamespaceOption(options.namespace);
+        log.verbose(`Storing secret ${normalizedName} in namespace ${namespace}`);
+        const serialized = serializeSecretPayload(value);
+        const body = this.buildSecret(normalizedName, namespace, serialized, options);
+        try {
+            await this.client.createNamespacedSecret({ namespace, body });
+        }
+        catch (error) {
+            if (this.statusOf(error) === 409) {
+                try {
+                    const existing = await this.client.readNamespacedSecret({
+                        name: normalizedName,
+                        namespace,
+                    });
+                    body.metadata = {
+                        ...(body.metadata || {}),
+                        resourceVersion: existing.metadata?.resourceVersion,
+                    };
+                    await this.client.replaceNamespacedSecret({
+                        name: normalizedName,
+                        namespace,
+                        body,
+                    });
+                }
+                catch (replaceError) {
+                    throw this.parseError(replaceError);
+                }
+            }
+            else {
+                throw this.parseError(error);
+            }
+        }
+        return {
+            provider: this.provider,
+            name: normalizedName,
+            namespace,
+            version: options.version,
+            uri: `kubernetes://${namespace}/${normalizedName}`,
+        };
+    }
+    async retrieve(nameOrRef, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "retrieve", true)).for(this.retrieve);
+        const { name, namespace, version } = this.resolveReference(nameOrRef, options);
+        log.verbose(`Retrieving secret ${name} from namespace ${namespace}`);
+        const secret = await this.readSecret(name, namespace);
+        this.assertVersion(secret, version);
+        const raw = secret.data?.[PAYLOAD_DATA_KEY];
+        if (!raw) {
+            throw new NotFoundError(`No secret value found for "${name}" in namespace "${namespace}"`);
+        }
+        let payload;
+        try {
+            payload = JSON.parse(Buffer.from(raw, "base64").toString("utf8"));
+        }
+        catch (error) {
+            throw new SecretError("SECRET_DESERIALIZATION_FAILED", `Failed to parse secret payload for "${name}": ${error.message}`, error);
+        }
+        return deserializeSecretPayload(payload);
+    }
+    async delete(nameOrRef, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "delete", true)).for(this.delete);
+        const { name, namespace, version } = this.resolveReference(nameOrRef, options);
+        log.verbose(`Deleting secret ${name} from namespace ${namespace}`);
+        if (version) {
+            const secret = await this.readSecret(name, namespace);
+            this.assertVersion(secret, version);
+        }
+        try {
+            await this.client.deleteNamespacedSecret({ name, namespace });
+        }
+        catch (error) {
+            throw this.parseError(error);
+        }
+    }
+    async exists(nameOrRef, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "exists", true)).for(this.exists);
+        const { name, namespace, version } = this.resolveReference(nameOrRef, options);
+        log.verbose(`Checking if secret ${name} exists in namespace ${namespace}`);
+        try {
+            const secret = await this.readSecret(name, namespace);
+            this.assertVersion(secret, version);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof NotFoundError)
+                return false;
+            throw error;
+        }
+    }
+    async list(options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "list", true)).for(this.list);
+        const namespace = this.resolveNamespaceOption(options.namespace);
+        log.verbose(`Listing secrets in namespace ${namespace}`);
+        const result = [];
+        let continueToken;
+        try {
+            do {
+                const response = await this.client.listNamespacedSecret({
+                    namespace,
+                    labelSelector: `${MANAGED_LABEL}=true`,
+                    limit: 100,
+                    _continue: continueToken,
+                });
+                for (const secret of response.items || []) {
+                    result.push(this.toMetadata(secret, namespace));
+                }
+                continueToken = response.metadata?._continue;
+            } while (continueToken);
+        }
+        catch (error) {
+            throw this.parseError(error);
+        }
+        const filtered = result.filter((meta) => {
+            if (options.enabled === false)
+                return false;
+            if (!options.tags)
+                return true;
+            return Object.entries(options.tags).every(([key, value]) => meta.tags?.[key] === value);
+        });
+        const offset = options.offset ?? 0;
+        const end = typeof options.limit === "number" ? offset + options.limit : undefined;
+        return filtered.slice(offset, end);
+    }
+    async metadata(nameOrRef, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "metadata", true)).for(this.metadata);
+        const { name, namespace, version } = this.resolveReference(nameOrRef, options);
+        log.verbose(`Getting metadata for secret ${name} in namespace ${namespace}`);
+        try {
+            const secret = await this.readSecret(name, namespace);
+            this.assertVersion(secret, version);
+            return this.toMetadata(secret, namespace);
+        }
+        catch (error) {
+            if (error instanceof NotFoundError)
+                return undefined;
+            throw error;
+        }
+    }
+    async rotate(nameOrRef, value, options = {}, ...args) {
+        const { name, namespace } = this.resolveReference(nameOrRef, options);
+        return this.store(name, value, { version: options.newVersion, namespace }, ...args);
+    }
+    buildKubeConfig(config) {
+        const kubeConfig = new KubeConfig();
+        try {
+            if (config.serviceAccount) {
+                kubeConfig.loadFromCluster();
+            }
+            else if (config.server) {
+                const clusterName = "decaf-cluster";
+                const userName = "decaf-user";
+                const contextName = "decaf-context";
+                kubeConfig.loadFromOptions({
+                    clusters: [
+                        {
+                            name: clusterName,
+                            server: config.server,
+                            caData: config.caData,
+                            caFile: config.caFile,
+                            skipTLSVerify: config.skipTLSVerify,
+                        },
+                    ],
+                    users: [
+                        {
+                            name: userName,
+                            token: config.token,
+                            tokenFile: config.tokenFile,
+                            certData: config.certData,
+                            certFile: config.certFile,
+                            keyData: config.keyData,
+                            keyFile: config.keyFile,
+                        },
+                    ],
+                    contexts: [
+                        {
+                            name: contextName,
+                            cluster: clusterName,
+                            user: userName,
+                            namespace: config.namespace,
+                        },
+                    ],
+                    currentContext: contextName,
+                });
+            }
+            else if (config.kubeconfig) {
+                kubeConfig.loadFromFile(config.kubeconfig);
+            }
+            else {
+                kubeConfig.loadFromDefault();
+            }
+            if (config.context) {
+                kubeConfig.setCurrentContext(config.context);
+            }
+        }
+        catch (error) {
+            throw this.parseError(error);
+        }
+        return kubeConfig;
+    }
+    resolveNamespace(config, kubeConfig) {
+        const namespace = config.namespace ||
+            kubeConfig.getContextObject(kubeConfig.getCurrentContext())?.namespace ||
+            "default";
+        assertKubernetesNamespace(namespace);
+        return namespace;
+    }
+    resolveNamespaceOption(namespace) {
+        const resolved = namespace || this.config.namespace || "default";
+        assertKubernetesNamespace(resolved);
+        return resolved;
+    }
+    resolveReference(nameOrRef, options) {
+        const name = typeof nameOrRef === "string" ? nameOrRef : nameOrRef.name;
+        const namespace = options.namespace ||
+            (typeof nameOrRef === "string" ? undefined : nameOrRef.namespace) ||
+            this.config.namespace ||
+            "default";
+        assertKubernetesNamespace(namespace);
+        const version = options.version ||
+            (typeof nameOrRef === "string" ? undefined : nameOrRef.version);
+        return { name: this.normalizeName(name), namespace, version };
+    }
+    normalizeName(name) {
+        try {
+            validateSecretName(name);
+        }
+        catch (error) {
+            throw this.parseError(error);
+        }
+        const normalizedName = normalizeSecretName(name);
+        assertKubernetesName(normalizedName);
+        return normalizedName;
+    }
+    buildSecret(name, namespace, serialized, options) {
+        const annotations = {
+            [ENCODING_ANNOTATION]: serialized.encoding,
+            [UPDATED_AT_ANNOTATION]: new Date().toISOString(),
+        };
+        if (options.contentType) {
+            annotations[CONTENT_TYPE_ANNOTATION] = options.contentType;
+        }
+        if (options.tags) {
+            annotations[TAGS_ANNOTATION] = JSON.stringify(options.tags);
+        }
+        if (options.version) {
+            annotations[VERSION_ANNOTATION] = options.version;
+        }
+        if (options.tenantId) {
+            annotations[TENANT_ANNOTATION] = options.tenantId;
+        }
+        if (options.orgUnitId) {
+            annotations[ORG_UNIT_ANNOTATION] = options.orgUnitId;
+        }
+        if (options.ownerPrincipalId) {
+            annotations[OWNER_ANNOTATION] = options.ownerPrincipalId;
+        }
+        return {
+            apiVersion: "v1",
+            kind: "Secret",
+            type: "Opaque",
+            metadata: {
+                name,
+                namespace,
+                labels: {
+                    [MANAGED_LABEL]: "true",
+                },
+                annotations,
+            },
+            stringData: {
+                [PAYLOAD_DATA_KEY]: JSON.stringify(serialized),
+            },
+        };
+    }
+    async readSecret(name, namespace) {
+        try {
+            return await this.client.readNamespacedSecret({ name, namespace });
+        }
+        catch (error) {
+            throw this.parseError(error);
+        }
+    }
+    assertVersion(secret, version) {
+        if (!version)
+            return;
+        const stored = secret.metadata?.annotations?.[VERSION_ANNOTATION];
+        if (stored !== version) {
+            throw new NotFoundError(`Secret "${secret.metadata?.name}" version "${version}" not found`);
+        }
+    }
+    toMetadata(secret, namespace) {
+        const annotations = secret.metadata?.annotations || {};
+        const updatedAt = annotations[UPDATED_AT_ANNOTATION];
+        const name = secret.metadata?.name || "";
+        return {
+            provider: this.provider,
+            name,
+            version: annotations[VERSION_ANNOTATION],
+            createdAt: toDate(secret.metadata?.creationTimestamp),
+            updatedAt: updatedAt
+                ? new Date(updatedAt)
+                : toDate(secret.metadata?.creationTimestamp),
+            enabled: true,
+            contentType: annotations[CONTENT_TYPE_ANNOTATION],
+            tags: parseTags(annotations[TAGS_ANNOTATION]),
+            externalId: secret.metadata?.uid,
+            uri: `kubernetes://${namespace}/${name}`,
+        };
+    }
+    statusOf(error) {
+        if (error instanceof ApiException)
+            return error.code;
+        const candidate = error;
+        if (typeof candidate?.code === "number")
+            return candidate.code;
+        if (typeof candidate?.statusCode === "number") {
+            return candidate.statusCode;
+        }
+        return undefined;
+    }
+    messageOf(error) {
+        const err = error;
+        return err?.body?.message || err?.body?.reason || err?.message || err?.name || "Unknown error";
+    }
+    parseError(error) {
+        if (error instanceof BaseError)
+            return error;
+        const status = this.statusOf(error);
+        const message = this.messageOf(error);
+        const lowerMessage = message.toLowerCase();
+        if (status === 404 ||
+            lowerMessage.includes("not found") ||
+            lowerMessage.includes("404")) {
+            return new NotFoundError(message);
+        }
+        if (status === 409 ||
+            lowerMessage.includes("already exists") ||
+            lowerMessage.includes("conflict") ||
+            lowerMessage.includes("409")) {
+            return new ConflictError(message);
+        }
+        if (status === 401 || lowerMessage.includes("unauthorized")) {
+            return new AuthorizationError(`Authentication failed: ${message}`);
+        }
+        if (status === 403 || lowerMessage.includes("forbidden")) {
+            return new AuthorizationError(`Permission denied: ${message}`);
+        }
+        if (status === 400 ||
+            status === 422 ||
+            lowerMessage.includes("bad request")) {
+            return new BadRequestError(message);
+        }
+        if (status === 429 || lowerMessage.includes("rate limit")) {
+            return new SecretError("SECRET_PROVIDER_RATE_LIMITED", `Rate limited: ${message}`, error);
+        }
+        if (status === undefined ||
+            (status !== undefined && status >= 500) ||
+            lowerMessage.includes("connection") ||
+            lowerMessage.includes("timeout") ||
+            lowerMessage.includes("unavailable")) {
+            return new SecretError("SECRET_PROVIDER_UNAVAILABLE", `Provider unavailable: ${message}`, error);
+        }
+        return new InternalError(message);
+    }
+}
+//# sourceMappingURL=KubernetesSecretService.js.map

package/lib/esm/secrets/kubernetes/KubernetesSecretService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesSecretService.js","sourceRoot":"","sources":["../../../../src/secrets/kubernetes/KubernetesSecretService.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,SAAS,EACT,UAAU,GAEX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EACL,wBAAwB,EACxB,WAAW,GAMZ,2BAA2B;AAU5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B;AAC7E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GAEzB,2BAA2B;AAE5B,OAAO,EAAE,2BAA2B,EAAE,yCAAsC;AAC5E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,2CAAsC;AACtE,OAAO,EACL,eAAe,EACf,SAAS,EACT,aAAa,EACb,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAC5C,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,GAAG,iBAAiB,UAAU,CAAC;AAC3D,MAAM,uBAAuB,GAAG,GAAG,iBAAiB,cAAc,CAAC;AACnE,MAAM,eAAe,GAAG,GAAG,iBAAiB,MAAM,CAAC;AACnD,MAAM,kBAAkB,GAAG,GAAG,iBAAiB,SAAS,CAAC;AACzD,MAAM,qBAAqB,GAAG,GAAG,iBAAiB,YAAY,CAAC;AAC/D,MAAM,iBAAiB,GAAG,GAAG,iBAAiB,WAAW,CAAC;AAC1D,MAAM,mBAAmB,GAAG,GAAG,iBAAiB,aAAa,CAAC;AAC9D,MAAM,gBAAgB,GAAG,GAAG,iBAAiB,oBAAoB,CAAC;AAElE,MAAM,qBAAqB,GACzB,kCAAkC,CAAC;AACrC,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAE5D,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,oCAAoC,IAAI,iFAAiF,CAC1H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,kCAAkC,SAAS,kDAAkD,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YACzC,CAAC,CAAE,MAAiC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,uBAAwB,SAAQ,wBAG5C;IAHD;;QAIW,aAAQ,GAAmB,YAAY,CAAC;IAgiBnD,CAAC;IA9hBW,qBAAqB;QAG7B,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvE,OAAO;YACL,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,UAAU;YACV,OAAO;YACP,MAAM;YACN,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAC3B,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;YACnC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAC7B,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAC/B,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAC/B,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;YAC5C,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAC/D,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,MAAM,GACV,IAAI,CAAC,iBAAiB,CAAgC,GAAG,IAAI,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAkC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,GAAG,CAAC,OAAO,CACT,wDAAwD,SAAS,GAAG,CACrE,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAAgB,EAChB,KAAQ,EACR,UAA8B,EAAE,EAChC,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,kBAAkB,cAAc,iBAAiB,SAAS,EAAE,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;wBACtD,IAAI,EAAE,cAAc;wBACpB,SAAS;qBACV,CAAC,CAAC;oBACH,IAAI,CAAC,QAAQ,GAAG;wBACd,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;wBACxB,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe;qBACpD,CAAC;oBACF,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;wBACxC,IAAI,EAAE,cAAc;wBACpB,SAAS;wBACT,IAAI;qBACL,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,cAAc;YACpB,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,gBAAgB,SAAS,IAAI,cAAc,EAAE;SACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAuC,EACvC,UAAiC,EAAE,EACnC,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAC7D,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CACxD,SAAS,EACT,OAAO,CACR,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,mBAAmB,SAAS,EAAE,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,mBAAmB,SAAS,GAAG,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAClB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjB,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,+BAA+B,EAC/B,uCAAuC,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,EAC3E,KAAc,CACf,CAAC;QACJ,CAAC;QAED,OAAO,wBAAwB,CAAC,OAAO,CAAM,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CACV,SAAuC,EACvC,UAA+B,EAAE,EACjC,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CACxD,SAAS,EACT,OAAO,CACR,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,mBAAmB,SAAS,EAAE,CAAC,CAAC;QAEnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,SAAuC,EACvC,UAA+B,EAAE,EACjC,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CACxD,SAAS,EACT,OAAO,CACR,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,wBAAwB,SAAS,EAAE,CAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa;gBAAE,OAAO,KAAK,CAAC;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAA8B,EAAE,EAChC,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,IAAI,aAAiC,CAAC;QAEtC,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACtD,SAAS;oBACT,aAAa,EAAE,GAAG,aAAa,OAAO;oBACtC,KAAK,EAAE,GAAG;oBACV,SAAS,EAAE,aAAa;iBACzB,CAAC,CAAC;gBAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClD,CAAC;gBAED,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC/C,CAAC,QAAQ,aAAa,EAAE;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACtC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CACvC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAC7C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GACP,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAuC,EACvC,UAAiC,EAAE,EACnC,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAC7D,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CACxD,SAAS,EACT,OAAO,CACR,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,+BAA+B,IAAI,iBAAiB,SAAS,EAAE,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa;gBAAE,OAAO,SAAS,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,SAAuC,EACvC,KAAQ,EACR,UAA+B,EAAE,EACjC,GAAG,IAA6B;QAEhC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,EACJ,KAAK,EACL,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,EAC1C,GAAG,IAAI,CACR,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,MAAqC;QAC3D,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,UAAU,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,WAAW,GAAG,eAAe,CAAC;gBACpC,MAAM,QAAQ,GAAG,YAAY,CAAC;gBAC9B,MAAM,WAAW,GAAG,eAAe,CAAC;gBACpC,UAAU,CAAC,eAAe,CAAC;oBACzB,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,WAAW;4BACjB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,aAAa,EAAE,MAAM,CAAC,aAAa;yBACpC;qBACF;oBACD,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,OAAO,EAAE,MAAM,CAAC,OAAO;yBACxB;qBACF;oBACD,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,WAAW;4BACjB,OAAO,EAAE,WAAW;4BACpB,IAAI,EAAE,QAAQ;4BACd,SAAS,EAAE,MAAM,CAAC,SAAS;yBAC5B;qBACF;oBACD,cAAc,EAAE,WAAW;iBAC5B,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC7B,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,gBAAgB,CACtB,MAAqC,EACrC,UAAsB;QAEtB,MAAM,SAAS,GACb,MAAM,CAAC,SAAS;YAChB,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE,SAAS;YACtE,SAAS,CAAC;QACZ,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,sBAAsB,CAAC,SAAkB;QAC/C,MAAM,QAAQ,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;QACjE,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,gBAAgB,CACtB,SAAuC,EACvC,OAGC;QAED,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;QAC7D,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;YACjB,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,SAAS;YACrB,SAAS,CAAC;QACZ,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;YACf,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IAEO,aAAa,CAAC,IAAY;QAChC,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,UAAU,CAAC,KAAc,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACrC,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,WAAW,CACjB,IAAY,EACZ,SAAiB,EACjB,UAAmC,EACnC,OAA2B;QAE3B,MAAM,WAAW,GAA2B;YAC1C,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC,QAAQ;YAC1C,CAAC,qBAAqB,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClD,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,WAAW,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,WAAW,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,WAAW,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,WAAW,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,WAAW,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAC3D,CAAC;QAED,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE;gBACR,IAAI;gBACJ,SAAS;gBACT,MAAM,EAAE;oBACN,CAAC,aAAa,CAAC,EAAE,MAAM;iBACxB;gBACD,WAAW;aACZ;YACD,UAAU,EAAE;gBACV,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;aAC/C;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,SAAiB;QAEjB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,MAAgB,EAAE,OAAgB;QACtD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CACrB,WAAW,MAAM,CAAC,QAAQ,EAAE,IAAI,cAAc,OAAO,aAAa,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAgB,EAAE,SAAiB;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI;YACJ,OAAO,EAAE,WAAW,CAAC,kBAAkB,CAAC;YACxC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;YACrD,SAAS,EAAE,SAAS;gBAClB,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;gBACrB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;YAC9C,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,WAAW,CAAC,uBAAuB,CAAC;YACjD,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC7C,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG;YAChC,GAAG,EAAE,gBAAgB,SAAS,IAAI,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,KAAc;QAC7B,IAAI,KAAK,YAAY,YAAY;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QACrD,MAAM,SAAS,GAAG,KAAiD,CAAC;QACpE,IAAI,OAAO,SAAS,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC;QAC/D,IAAI,OAAO,SAAS,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,UAAU,CAAC;QAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,SAAS,CAAC,KAAc;QAC9B,MAAM,GAAG,GAAG,KAIX,CAAC;QACF,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,IAAI,IAAI,eAAe,CAAC;IACjG,CAAC;IAES,UAAU,CAAC,KAAc;QACjC,IAAI,KAAK,YAAY,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3C,IACE,MAAM,KAAK,GAAG;YACd,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5B,CAAC;YACD,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IACE,MAAM,KAAK,GAAG;YACd,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACvC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;YACjC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5B,CAAC;YACD,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,kBAAkB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,kBAAkB,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IACE,MAAM,KAAK,GAAG;YACd,MAAM,KAAK,GAAG;YACd,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,EACpC,CAAC;YACD,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,WAAW,CACpB,8BAA8B,EAC9B,iBAAiB,OAAO,EAAE,EAC1B,KAAc,CACf,CAAC;QACJ,CAAC;QAED,IACE,MAAM,KAAK,SAAS;YACpB,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,CAAC;YACvC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;YACnC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;YAChC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,EACpC,CAAC;YACD,OAAO,IAAI,WAAW,CACpB,6BAA6B,EAC7B,yBAAyB,OAAO,EAAE,EAClC,KAAc,CACf,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;CACF"}

package/lib/esm/secrets/kubernetes/KubernetesSecretServiceConfig.js

@@ -0,0 +1,9 @@
+/**
+ * @module integrations/secrets/kubernetes/config
+ * @summary Kubernetes secret service configuration.
+ * @description Configuration schema for the native Kubernetes Secrets integration,
+ * including kubeconfig selection, explicit API-server credentials, and the
+ * default namespace used by every operation.
+ */
+export {};
+//# sourceMappingURL=KubernetesSecretServiceConfig.js.map

package/lib/esm/secrets/kubernetes/KubernetesSecretServiceConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesSecretServiceConfig.js","sourceRoot":"","sources":["../../../../src/secrets/kubernetes/KubernetesSecretServiceConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/lib/esm/secrets/kubernetes/index.js

@@ -0,0 +1,10 @@
+/**
+ * @module integrations/secrets/kubernetes
+ * @summary Kubernetes secret service exports.
+ * @description Re-exports the native Kubernetes Secrets service, its configuration,
+ * and its environment slice.
+ */
+export * from "./KubernetesSecretService.js";
+export * from "./KubernetesSecretServiceConfig.js";
+export * from "./KubernetesSecretEnvironment.js";
+//# sourceMappingURL=index.js.map

package/lib/esm/secrets/kubernetes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/secrets/kubernetes/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,6CAA0C;AAC1C,mDAAgD;AAChD,iDAA8C"}

package/lib/types/index.d.cts

@@ -7,6 +7,6 @@ export * from "./utils.d.cts";
 export * from "./namespaces/index.d.cts";
 export * from "./feature-flags/index.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "b661b6f";
-export declare const FULL_VERSION = "0.14.1-b661b6f";
+export declare const COMMIT = "86da5d7";
+export declare const FULL_VERSION = "0.15.3-86da5d7";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -7,6 +7,6 @@ export * from "./utils.d.mts";
 export * from "./namespaces/index.d.mts";
 export * from "./feature-flags/index.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "b661b6f";
-export declare const FULL_VERSION = "0.14.1-b661b6f";
+export declare const COMMIT = "86da5d7";
+export declare const FULL_VERSION = "0.15.3-86da5d7";
 export declare const PACKAGE_NAME: string;

package/lib/types/secrets/core/SecretTypes.d.cts

@@ -3,7 +3,7 @@
  * @summary Secret core types.
  * @description Shared payload, metadata, option, and configuration types for secret service implementations.
  */
-export type SecretProvider = "model" | "memory" | "filesystem" | "hashicorp-vault" | "aws-secrets-manager" | "azure-key-vault" | "gcp-secret-manager" | "1password";
+export type SecretProvider = "model" | "memory" | "filesystem" | "hashicorp-vault" | "aws-secrets-manager" | "azure-key-vault" | "gcp-secret-manager" | "1password" | "kubernetes";
 export type SecretName = string;
 export type SecretPayload = string | Record<string, unknown> | Uint8Array;
 export interface SerializedSecretPayload {
@@ -61,30 +61,42 @@ export interface StoreSecretOptions {
      * @description Principal that owns the secret.
      */
     ownerPrincipalId?: string;
+    /**
+     * @description Backend namespace or tenant partition for the secret.
+     * @summary Kubernetes uses this as the object namespace; other providers may
+     * ignore it when their backend is not namespace-scoped.
+     */
+    namespace?: string;
 }
 export interface RetrieveSecretOptions {
     version?: string;
     includeMetadata?: boolean;
+    namespace?: string;
 }
 export interface DeleteSecretOptions {
     force?: boolean;
     version?: string;
+    namespace?: string;
 }
 export interface ExistsSecretOptions {
     version?: string;
+    namespace?: string;
 }
 export interface ListSecretsOptions {
     limit?: number;
     offset?: number;
     tags?: Record<string, string>;
     enabled?: boolean;
+    namespace?: string;
 }
 export interface SecretMetadataOptions {
     version?: string;
     includeTags?: boolean;
+    namespace?: string;
 }
 export interface RotateSecretOptions {
     oldVersion?: string;
     newVersion?: string;
     keyId?: string;
+    namespace?: string;
 }