@flanksource/clicky-ui 0.3.10 → 0.3.11

package/dist/components/SecretKeySelector.d.ts

@@ -1,24 +1,32 @@
-export type SecretKind = "secret" | "configmap";
-/** Toggle options: the two resource kinds plus the inline-literal mode. */
-export type SecretValueSource = SecretKind | "value";
+/** Kinds that reference a named resource plus one of its keys. */
+export type SecretKind = "secret" | "configmap" | "helm";
+/** Every source the picker can emit, including the non-keyed ones. */
+export type SecretValueSource = SecretKind | "serviceaccount" | "onepassword" | "value";
 /** One key's mid-masked preview. `value` is already masked by the consumer. */
 export type KeyPreview = {
     key: string;
     value: string;
 };
 /**
- * The selector's value: either a {kind,name,key} reference into a Secret /
- * ConfigMap, or a static inline literal ({kind:"value", value}).
+ * The selector's value: a {kind,name,key} reference into a Secret / ConfigMap /
+ * Helm release, a service-account token by name, a 1Password op:// reference, or
+ * a static inline literal.
  */
 export type SecretKeyValue = {
     kind: SecretKind;
     name: string;
     key: string;
+} | {
+    kind: "serviceaccount";
+    name: string;
+} | {
+    kind: "onepassword";
+    ref: string;
 } | {
     kind: "value";
     value: string;
 };
-/** A named secret/configmap and its data key names (values never returned). */
+/** A named secret/configmap/helm-release and its data key names (values never returned). */
 export type SecretResource = {
     name: string;
     keys?: string[];
@@ -26,24 +34,34 @@ export type SecretResource = {
 export type SecretKeySelectorProps = {
     value: SecretKeyValue | undefined;
     onChange: (next: SecretKeyValue | undefined) => void;
-    /** Loads the named kind's resources (name + data key names). */
+    /** Loads the named keyed kind's resources (name + data key names). */
     loadResources: (kind: SecretKind) => Promise<SecretResource[]>;
-    /** Loads mid-masked previews for the named resource's keys. */
+    /** Loads mid-masked previews for the named keyed resource's keys. */
     loadKeyPreview: (kind: SecretKind, name: string) => Promise<KeyPreview[]>;
     /**
-     * Offer a third "Value" toggle for typing a static inline literal. Enabled by
-     * default; pass `false` to restrict the selector to Secret/ConfigMap
-     * references only.
+     * Loads the service-account names (no keys) for the "serviceaccount" source.
+     * When omitted, that source's name field accepts freeform entry only.
+     */
+    loadServiceAccounts?: () => Promise<SecretResource[]>;
+    /**
+     * The sources offered in the picker, in order. Defaults to
+     * `["secret", "configmap", "value"]` (or drops "value" when `allowLiteral` is
+     * false). Pass an explicit list to offer helm / serviceaccount / onepassword.
+     */
+    sources?: SecretValueSource[];
+    /**
+     * Shorthand honoured only when `sources` is not supplied: `false` drops the
+     * inline "Value" source, leaving Secret/ConfigMap. Ignored when `sources` is
+     * given.
      */
     allowLiteral?: boolean;
     /**
-     * When true, a chosen secret/configmap name absent from the loaded resources,
-     * or a key absent from the chosen resource's keys, is flagged invalid (once
-     * the respective load settles). The reference doesn't exist in the namespace.
-     * The literal "Value" mode is never strict-flagged.
+     * When true, a chosen name absent from the loaded resources, or a key absent
+     * from the chosen keyed resource's keys, is flagged invalid (once the load
+     * settles). The onepassword and literal sources are never strict-flagged.
      */
     strict?: boolean;
     className?: string;
 };
-export declare function SecretKeySelector({ value, onChange, loadResources, loadKeyPreview, allowLiteral, strict, className, }: SecretKeySelectorProps): import("react/jsx-runtime").JSX.Element;
+export declare function SecretKeySelector({ value, onChange, loadResources, loadKeyPreview, loadServiceAccounts, sources, allowLiteral, strict, className, }: SecretKeySelectorProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=SecretKeySelector.d.ts.map

package/dist/components/SecretKeySelector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecretKeySelector.d.ts","sourceRoot":"","sources":["../../src/components/SecretKeySelector.tsx"],"names":[],"mappings":"AAcA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEhD,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,OAAO,CAAC;AAErD,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,cAAc,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;IACrD,gEAAgE;IAChE,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/D,+DAA+D;IAC/D,cAAc,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,cAAc,EACd,YAAmB,EACnB,MAAc,EACd,SAAS,GACV,EAAE,sBAAsB,2CAgJxB"}
+{"version":3,"file":"SecretKeySelector.d.ts","sourceRoot":"","sources":["../../src/components/SecretKeySelector.tsx"],"names":[],"mappings":"AAqBA,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;AAEzD,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,GAAG,OAAO,CAAC;AAExF,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,cAAc,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;IACrD,sEAAsE;IACtE,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/D,qEAAqE;IACrE,cAAc,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACtD;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAIF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,OAAO,EACP,YAAmB,EACnB,MAAc,EACd,SAAS,GACV,EAAE,sBAAsB,2CA+LxB"}

package/dist/components/SecretKeySelector.js

@@ -1,39 +1,54 @@
-import { jsxs, jsx, Fragment } from "react/jsx-runtime";
-import { useState, useEffect, useMemo } from "react";
-import { K8SConfigmap, K8SSecret } from "@flanksource/icons/mi";
+import { jsxs, jsx } from "react/jsx-runtime";
+import { useMemo, useState, useEffect, createElement } from "react";
+import { Vault, K8SServiceaccount, Helm, K8SConfigmap, K8SSecret } from "@flanksource/icons/mi";
 import { cn } from "../lib/utils.js";
 import { Combobox } from "./Combobox.js";
 import { UiEdit } from "../icons/components/UiEdit.js";
+const DEFAULT_SOURCES = ["secret", "configmap", "value"];
 function SecretKeySelector({
   value,
   onChange,
   loadResources,
   loadKeyPreview,
+  loadServiceAccounts,
+  sources,
   allowLiteral = true,
   strict = false,
   className
 }) {
-  const source = (value == null ? void 0 : value.kind) ?? "secret";
+  const sourceList = useMemo(
+    () => sources ?? (allowLiteral ? DEFAULT_SOURCES : ["secret", "configmap"]),
+    [sources, allowLiteral]
+  );
+  const source = (value == null ? void 0 : value.kind) ?? sourceList[0] ?? "secret";
+  const isKeyed = source === "secret" || source === "configmap" || source === "helm";
+  const isServiceAccount = source === "serviceaccount";
+  const isOnePassword = source === "onepassword";
   const isLiteral = source === "value";
-  const refKind = isLiteral ? "secret" : source;
-  const selectedName = value && value.kind !== "value" ? value.name : "";
-  const selectedKey = value && value.kind !== "value" ? value.key : "";
+  const refKind = isKeyed ? source : "secret";
+  const selectedName = value && (value.kind === "serviceaccount" || isRefKind(value)) ? value.name : "";
+  const selectedKey = value && isRefKind(value) ? value.key : "";
   const literalValue = value && value.kind === "value" ? value.value : "";
+  const opRef = value && value.kind === "onepassword" ? value.ref : "";
   const [resources, setResources] = useState([]);
   const [resourcesLoading, setResourcesLoading] = useState(false);
   const [previews, setPreviews] = useState([]);
   const [previewLoading, setPreviewLoading] = useState(false);
   useEffect(() => {
-    if (isLiteral) return;
+    const loader = isKeyed ? () => loadResources(refKind) : isServiceAccount && loadServiceAccounts ? loadServiceAccounts : null;
+    if (!loader) {
+      setResources([]);
+      return;
+    }
     let cancelled = false;
     setResourcesLoading(true);
-    loadResources(refKind).then((res) => !cancelled && setResources(res)).finally(() => !cancelled && setResourcesLoading(false));
+    loader().then((res) => !cancelled && setResources(res)).finally(() => !cancelled && setResourcesLoading(false));
     return () => {
       cancelled = true;
     };
-  }, [loadResources, refKind, isLiteral]);
+  }, [loadResources, loadServiceAccounts, refKind, isKeyed, isServiceAccount]);
   useEffect(() => {
-    if (!selectedName) {
+    if (!isKeyed || !selectedName) {
       setPreviews([]);
       return;
     }
@@ -43,7 +58,7 @@ function SecretKeySelector({
     return () => {
       cancelled = true;
     };
-  }, [loadKeyPreview, refKind, selectedName]);
+  }, [loadKeyPreview, refKind, selectedName, isKeyed]);
   const nameOptions = useMemo(
     () => resources.map((r) => ({ value: r.name, label: r.name })),
     [resources]
@@ -56,81 +71,154 @@ function SecretKeySelector({
     () => buildKeyOptions((selectedResource == null ? void 0 : selectedResource.keys) ?? [], previews, selectedKey),
     [selectedResource, selectedKey, previews]
   );
-  const nameInvalid = strict && !!selectedName && !resourcesLoading && !selectedResource;
-  const keyInvalid = strict && !!selectedKey && !!selectedResource && !resourcesLoading && !(selectedResource.keys ?? []).includes(selectedKey);
-  const setSource = (next) => onChange(next === "value" ? { kind: "value", value: "" } : { kind: next, name: "", key: "" });
-  const setName = (name) => onChange(name ? { kind: refKind, name, key: selectedKey } : void 0);
+  const listsNames = isKeyed || isServiceAccount && !!loadServiceAccounts;
+  const nameInvalid = strict && listsNames && !!selectedName && !resourcesLoading && !selectedResource;
+  const keyInvalid = strict && isKeyed && !!selectedKey && !!selectedResource && !resourcesLoading && !(selectedResource.keys ?? []).includes(selectedKey);
+  const setSource = (next) => {
+    switch (next) {
+      case "value":
+        return onChange({ kind: "value", value: "" });
+      case "onepassword":
+        return onChange({ kind: "onepassword", ref: "" });
+      case "serviceaccount":
+        return onChange({ kind: "serviceaccount", name: "" });
+      default:
+        return onChange({ kind: next, name: "", key: "" });
+    }
+  };
+  const setName = (name) => {
+    if (isServiceAccount) return onChange(name ? { kind: "serviceaccount", name } : void 0);
+    return onChange(name ? { kind: refKind, name, key: selectedKey } : void 0);
+  };
   const setKey = (key) => selectedName ? onChange({ kind: refKind, name: selectedName, key }) : void 0;
   const setLiteral = (v) => onChange({ kind: "value", value: v });
-  const sources = allowLiteral ? ["secret", "configmap", "value"] : ["secret", "configmap"];
-  return /* @__PURE__ */ jsxs("div", { className: cn("flex items-center gap-2", className), children: [
-    /* @__PURE__ */ jsx("div", { className: "flex shrink-0 overflow-hidden rounded border border-border text-xs", children: sources.map((k) => {
-      const Glyph = SOURCE_ICON[k];
-      return /* @__PURE__ */ jsxs(
-        "button",
-        {
-          type: "button",
-          onClick: () => setSource(k),
-          className: cn(
-            "flex items-center gap-1 whitespace-nowrap px-2 py-1",
-            source === k ? "bg-primary text-primary-foreground" : "bg-muted text-muted-foreground hover:bg-accent"
-          ),
-          children: [
-            /* @__PURE__ */ jsx(Glyph, { className: "h-3.5 w-3.5" }),
-            SOURCE_LABEL[k]
-          ]
-        },
-        k
-      );
-    }) }),
+  const setOpRef = (v) => onChange({ kind: "onepassword", ref: v });
+  const sourceOptions = useMemo(
+    () => sourceList.map((k) => ({
+      value: k,
+      label: SOURCE_LABEL[k],
+      icon: createElement(SOURCE_ICON[k], { className: "size-4" })
+    })),
+    [sourceList]
+  );
+  return /* @__PURE__ */ jsxs("div", { className: cn("flex flex-wrap items-center gap-2", className), children: [
+    /* @__PURE__ */ jsx("div", { className: "w-[9.5rem] shrink-0", children: /* @__PURE__ */ jsx(
+      Combobox,
+      {
+        ariaLabel: "Secret value source",
+        options: sourceOptions,
+        value: source,
+        onChange: (next) => setSource(next),
+        allowCustomValue: false,
+        required: true
+      }
+    ) }),
     isLiteral ? /* @__PURE__ */ jsx(
-      "input",
+      TextField,
       {
-        type: "text",
         value: literalValue,
-        onChange: (e) => setLiteral(e.target.value),
+        onChange: setLiteral,
         placeholder: "Static value…",
-        className: cn(
-          "h-control-h min-w-0 flex-1 rounded border border-input bg-background px-control-px text-sm",
-          "outline-none focus-visible:ring-2 focus-visible:ring-ring"
-        )
+        ariaLabel: "Static value"
+      }
+    ) : isOnePassword ? /* @__PURE__ */ jsx(
+      TextField,
+      {
+        value: opRef,
+        onChange: setOpRef,
+        placeholder: "op://vault/item/field",
+        ariaLabel: "1Password reference",
+        mono: true
+      }
+    ) : isServiceAccount ? /* @__PURE__ */ jsx("div", { className: "min-w-0 flex-[1_1_16rem]", "data-slot": "secret-serviceaccount-field", children: /* @__PURE__ */ jsx(
+      Combobox,
+      {
+        options: nameOptions,
+        value: selectedName,
+        onChange: setName,
+        allowCustomValue: true,
+        loading: resourcesLoading,
+        invalid: nameInvalid,
+        placeholder: "Service account…"
+      }
+    ) }) : /* @__PURE__ */ jsxs(
+      "div",
+      {
+        className: "grid min-w-0 flex-[1_1_18rem] grid-cols-[minmax(8rem,11rem)_minmax(8rem,1fr)] items-center gap-2",
+        "data-slot": "secret-reference-fields",
+        children: [
+          /* @__PURE__ */ jsx("div", { className: "min-w-0", children: /* @__PURE__ */ jsx(
+            Combobox,
+            {
+              options: nameOptions,
+              value: selectedName,
+              onChange: setName,
+              allowCustomValue: true,
+              loading: resourcesLoading,
+              invalid: nameInvalid,
+              placeholder: `Select ${refKind}…`
+            }
+          ) }),
+          /* @__PURE__ */ jsx("div", { className: "min-w-0", children: /* @__PURE__ */ jsx(
+            Combobox,
+            {
+              options: keyOptions,
+              value: selectedKey,
+              onChange: setKey,
+              allowCustomValue: true,
+              loading: previewLoading,
+              invalid: keyInvalid,
+              placeholder: selectedName ? keyPlaceholder(refKind) : "—"
+            }
+          ) })
+        ]
       }
-    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsx("div", { className: "w-44 shrink-0", children: /* @__PURE__ */ jsx(
-        Combobox,
-        {
-          options: nameOptions,
-          value: selectedName,
-          onChange: setName,
-          allowCustomValue: true,
-          loading: resourcesLoading,
-          invalid: nameInvalid,
-          placeholder: `Select ${refKind}…`
-        }
-      ) }),
-      /* @__PURE__ */ jsx("div", { className: "min-w-0 flex-1", children: /* @__PURE__ */ jsx(
-        Combobox,
-        {
-          options: keyOptions,
-          value: selectedKey,
-          onChange: setKey,
-          allowCustomValue: true,
-          loading: previewLoading,
-          invalid: keyInvalid,
-          placeholder: selectedName ? "Key…" : "—"
-        }
-      ) })
-    ] })
+    )
   ] });
 }
+function TextField({
+  value,
+  onChange,
+  placeholder,
+  ariaLabel,
+  mono
+}) {
+  return /* @__PURE__ */ jsx("div", { className: "min-w-0 flex-[1_1_16rem]", "data-slot": "secret-value-fields", children: /* @__PURE__ */ jsx(
+    "input",
+    {
+      type: "text",
+      value,
+      onChange: (e) => onChange(e.target.value),
+      placeholder,
+      "aria-label": ariaLabel,
+      className: cn(
+        "h-control-h w-full min-w-0 rounded border border-input bg-background px-control-px text-sm",
+        "outline-none focus-visible:ring-2 focus-visible:ring-ring",
+        mono && "font-mono"
+      )
+    }
+  ) });
+}
+function isRefKind(v) {
+  return v.kind === "secret" || v.kind === "configmap" || v.kind === "helm";
+}
+function keyPlaceholder(kind) {
+  return kind === "helm" ? "jsonpath…" : "Key…";
+}
 const SOURCE_ICON = {
   secret: K8SSecret,
   configmap: K8SConfigmap,
+  helm: Helm,
+  serviceaccount: K8SServiceaccount,
+  onepassword: Vault,
   value: UiEdit
 };
 const SOURCE_LABEL = {
   secret: "Secret",
   configmap: "ConfigMap",
+  helm: "Helm",
+  serviceaccount: "Service Account",
+  onepassword: "1Password",
   value: "Value"
 };
 function buildKeyOptions(keys, previews, selectedKey) {

package/dist/components/SecretKeySelector.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecretKeySelector.js","sources":["../../src/components/SecretKeySelector.tsx"],"sourcesContent":["import { useEffect, useMemo, useState, type ReactNode } from \"react\";\nimport { K8SSecret, K8SConfigmap } from \"@flanksource/icons/mi\";\nimport { cn } from \"../lib/utils\";\nimport { UiEdit } from \"../icons\";\nimport { Combobox, type ComboboxOption } from \"./Combobox\";\n\n// SecretKeySelector picks a Secret or ConfigMap and one of its keys, with a\n// mid-masked preview of every key's value so the operator can tell which key\n// holds the host vs the db vs a password. It also offers a \"Value\" mode (on by\n// default; opt out with `allowLiteral={false}`) for typing a static inline\n// string. It is presentational: it fetches nothing — the consumer supplies\n// async `loadResources` / `loadKeyPreview` getters. It emits a discriminated\n// value the consumer lowers into whatever reference shape it needs.\n\nexport type SecretKind = \"secret\" | \"configmap\";\n\n/** Toggle options: the two resource kinds plus the inline-literal mode. */\nexport type SecretValueSource = SecretKind | \"value\";\n\n/** One key's mid-masked preview. `value` is already masked by the consumer. */\nexport type KeyPreview = { key: string; value: string };\n\n/**\n * The selector's value: either a {kind,name,key} reference into a Secret /\n * ConfigMap, or a static inline literal ({kind:\"value\", value}).\n */\nexport type SecretKeyValue =\n  | { kind: SecretKind; name: string; key: string }\n  | { kind: \"value\"; value: string };\n\n/** A named secret/configmap and its data key names (values never returned). */\nexport type SecretResource = { name: string; keys?: string[] };\n\nexport type SecretKeySelectorProps = {\n  value: SecretKeyValue | undefined;\n  onChange: (next: SecretKeyValue | undefined) => void;\n  /** Loads the named kind's resources (name + data key names). */\n  loadResources: (kind: SecretKind) => Promise<SecretResource[]>;\n  /** Loads mid-masked previews for the named resource's keys. */\n  loadKeyPreview: (kind: SecretKind, name: string) => Promise<KeyPreview[]>;\n  /**\n   * Offer a third \"Value\" toggle for typing a static inline literal. Enabled by\n   * default; pass `false` to restrict the selector to Secret/ConfigMap\n   * references only.\n   */\n  allowLiteral?: boolean;\n  /**\n   * When true, a chosen secret/configmap name absent from the loaded resources,\n   * or a key absent from the chosen resource's keys, is flagged invalid (once\n   * the respective load settles). The reference doesn't exist in the namespace.\n   * The literal \"Value\" mode is never strict-flagged.\n   */\n  strict?: boolean;\n  className?: string;\n};\n\nexport function SecretKeySelector({\n  value,\n  onChange,\n  loadResources,\n  loadKeyPreview,\n  allowLiteral = true,\n  strict = false,\n  className,\n}: SecretKeySelectorProps) {\n  const source: SecretValueSource = value?.kind ?? \"secret\";\n  const isLiteral = source === \"value\";\n  // A literal value carries no resource kind; the loaders default to \"secret\".\n  const refKind: SecretKind = isLiteral ? \"secret\" : source;\n  const selectedName = value && value.kind !== \"value\" ? value.name : \"\";\n  const selectedKey = value && value.kind !== \"value\" ? value.key : \"\";\n  const literalValue = value && value.kind === \"value\" ? value.value : \"\";\n\n  const [resources, setResources] = useState<SecretResource[]>([]);\n  const [resourcesLoading, setResourcesLoading] = useState(false);\n  const [previews, setPreviews] = useState<KeyPreview[]>([]);\n  const [previewLoading, setPreviewLoading] = useState(false);\n\n  useEffect(() => {\n    // Literal mode references no resource, so skip the list fetch entirely.\n    if (isLiteral) return;\n    let cancelled = false;\n    setResourcesLoading(true);\n    loadResources(refKind)\n      .then((res) => !cancelled && setResources(res))\n      .finally(() => !cancelled && setResourcesLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadResources, refKind, isLiteral]);\n\n  useEffect(() => {\n    if (!selectedName) {\n      setPreviews([]);\n      return;\n    }\n    let cancelled = false;\n    setPreviewLoading(true);\n    loadKeyPreview(refKind, selectedName)\n      .then((res) => !cancelled && setPreviews(res))\n      .catch(() => !cancelled && setPreviews([]))\n      .finally(() => !cancelled && setPreviewLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadKeyPreview, refKind, selectedName]);\n\n  const nameOptions = useMemo<ComboboxOption[]>(\n    () => resources.map((r) => ({ value: r.name, label: r.name })),\n    [resources],\n  );\n  const selectedResource = useMemo(\n    () => resources.find((r) => r.name === selectedName),\n    [resources, selectedName],\n  );\n  const keyOptions = useMemo(\n    () => buildKeyOptions(selectedResource?.keys ?? [], previews, selectedKey),\n    [selectedResource, selectedKey, previews],\n  );\n\n  // Strict validity: the name is invalid when it names no loaded resource; the\n  // key is invalid when, with a resolved resource, it isn't one of that\n  // resource's keys. The key list comes from the resource list (not previews),\n  // so both are gated on resourcesLoading only.\n  const nameInvalid = strict && !!selectedName && !resourcesLoading && !selectedResource;\n  const keyInvalid =\n    strict &&\n    !!selectedKey &&\n    !!selectedResource &&\n    !resourcesLoading &&\n    !(selectedResource.keys ?? []).includes(selectedKey);\n\n  // Switching source resets the selection: a resource kind clears name+key; the\n  // literal mode seeds an empty string (so onChange emits a value-kind value).\n  const setSource = (next: SecretValueSource) =>\n    onChange(next === \"value\" ? { kind: \"value\", value: \"\" } : { kind: next, name: \"\", key: \"\" });\n  const setName = (name: string) =>\n    onChange(name ? { kind: refKind, name, key: selectedKey } : undefined);\n  const setKey = (key: string) =>\n    selectedName ? onChange({ kind: refKind, name: selectedName, key }) : undefined;\n  const setLiteral = (v: string) => onChange({ kind: \"value\", value: v });\n\n  const sources: SecretValueSource[] = allowLiteral\n    ? [\"secret\", \"configmap\", \"value\"]\n    : [\"secret\", \"configmap\"];\n\n  return (\n    <div className={cn(\"flex items-center gap-2\", className)}>\n      <div className=\"flex shrink-0 overflow-hidden rounded border border-border text-xs\">\n        {sources.map((k) => {\n          const Glyph = SOURCE_ICON[k];\n          return (\n            <button\n              key={k}\n              type=\"button\"\n              onClick={() => setSource(k)}\n              className={cn(\n                \"flex items-center gap-1 whitespace-nowrap px-2 py-1\",\n                source === k\n                  ? \"bg-primary text-primary-foreground\"\n                  : \"bg-muted text-muted-foreground hover:bg-accent\",\n              )}\n            >\n              <Glyph className=\"h-3.5 w-3.5\" />\n              {SOURCE_LABEL[k]}\n            </button>\n          );\n        })}\n      </div>\n      {isLiteral ? (\n        <input\n          type=\"text\"\n          value={literalValue}\n          onChange={(e) => setLiteral(e.target.value)}\n          placeholder=\"Static value…\"\n          className={cn(\n            \"h-control-h min-w-0 flex-1 rounded border border-input bg-background px-control-px text-sm\",\n            \"outline-none focus-visible:ring-2 focus-visible:ring-ring\",\n          )}\n        />\n      ) : (\n        <>\n          <div className=\"w-44 shrink-0\">\n            <Combobox\n              options={nameOptions}\n              value={selectedName}\n              onChange={setName}\n              allowCustomValue\n              loading={resourcesLoading}\n              invalid={nameInvalid}\n              placeholder={`Select ${refKind}…`}\n            />\n          </div>\n          <div className=\"min-w-0 flex-1\">\n            <Combobox\n              options={keyOptions}\n              value={selectedKey}\n              onChange={setKey}\n              allowCustomValue\n              loading={previewLoading}\n              invalid={keyInvalid}\n              placeholder={selectedName ? \"Key…\" : \"—\"}\n            />\n          </div>\n        </>\n      )}\n    </div>\n  );\n}\n\n// Icons share a className-only call shape; the flanksource FCs carry extra\n// static metadata that doesn't unify with ComponentType, so type the slot as a\n// plain render function instead.\nconst SOURCE_ICON: Record<SecretValueSource, (p: { className?: string }) => ReactNode> = {\n  secret: K8SSecret,\n  configmap: K8SConfigmap,\n  value: UiEdit,\n};\n\nconst SOURCE_LABEL: Record<SecretValueSource, string> = {\n  secret: \"Secret\",\n  configmap: \"ConfigMap\",\n  value: \"Value\",\n};\n\n// buildKeyOptions labels each key with its mid-masked preview value when one is\n// available. A selected key absent from the list is pinned so the selection\n// stays visible.\nfunction buildKeyOptions(\n  keys: string[],\n  previews: KeyPreview[],\n  selectedKey: string,\n): ComboboxOption[] {\n  const masked = new Map(previews.map((p) => [p.key, p.value]));\n  const base = keys.map((k) => ({\n    value: k,\n    label: masked.has(k) ? `${k} — ${masked.get(k)}` : k,\n  }));\n  if (selectedKey && !base.some((o) => o.value === selectedKey)) {\n    return [{ value: selectedKey, label: selectedKey }, ...base];\n  }\n  return base;\n}\n"],"names":[],"mappings":";;;;;;AAwDO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf,SAAS;AAAA,EACT;AACF,GAA2B;AACzB,QAAM,UAA4B,+BAAO,SAAQ;AACjD,QAAM,YAAY,WAAW;AAE7B,QAAM,UAAsB,YAAY,WAAW;AACnD,QAAM,eAAe,SAAS,MAAM,SAAS,UAAU,MAAM,OAAO;AACpE,QAAM,cAAc,SAAS,MAAM,SAAS,UAAU,MAAM,MAAM;AAClE,QAAM,eAAe,SAAS,MAAM,SAAS,UAAU,MAAM,QAAQ;AAErE,QAAM,CAAC,WAAW,YAAY,IAAI,SAA2B,CAAA,CAAE;AAC/D,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,SAAS,KAAK;AAC9D,QAAM,CAAC,UAAU,WAAW,IAAI,SAAuB,CAAA,CAAE;AACzD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAS,KAAK;AAE1D,YAAU,MAAM;AAEd,QAAI,UAAW;AACf,QAAI,YAAY;AAChB,wBAAoB,IAAI;AACxB,kBAAc,OAAO,EAClB,KAAK,CAAC,QAAQ,CAAC,aAAa,aAAa,GAAG,CAAC,EAC7C,QAAQ,MAAM,CAAC,aAAa,oBAAoB,KAAK,CAAC;AACzD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,eAAe,SAAS,SAAS,CAAC;AAEtC,YAAU,MAAM;AACd,QAAI,CAAC,cAAc;AACjB,kBAAY,CAAA,CAAE;AACd;AAAA,IACF;AACA,QAAI,YAAY;AAChB,sBAAkB,IAAI;AACtB,mBAAe,SAAS,YAAY,EACjC,KAAK,CAAC,QAAQ,CAAC,aAAa,YAAY,GAAG,CAAC,EAC5C,MAAM,MAAM,CAAC,aAAa,YAAY,CAAA,CAAE,CAAC,EACzC,QAAQ,MAAM,CAAC,aAAa,kBAAkB,KAAK,CAAC;AACvD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,gBAAgB,SAAS,YAAY,CAAC;AAE1C,QAAM,cAAc;AAAA,IAClB,MAAM,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,KAAA,EAAO;AAAA,IAC7D,CAAC,SAAS;AAAA,EAAA;AAEZ,QAAM,mBAAmB;AAAA,IACvB,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY;AAAA,IACnD,CAAC,WAAW,YAAY;AAAA,EAAA;AAE1B,QAAM,aAAa;AAAA,IACjB,MAAM,iBAAgB,qDAAkB,SAAQ,CAAA,GAAI,UAAU,WAAW;AAAA,IACzE,CAAC,kBAAkB,aAAa,QAAQ;AAAA,EAAA;AAO1C,QAAM,cAAc,UAAU,CAAC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;AACtE,QAAM,aACJ,UACA,CAAC,CAAC,eACF,CAAC,CAAC,oBACF,CAAC,oBACD,EAAE,iBAAiB,QAAQ,CAAA,GAAI,SAAS,WAAW;AAIrD,QAAM,YAAY,CAAC,SACjB,SAAS,SAAS,UAAU,EAAE,MAAM,SAAS,OAAO,GAAA,IAAO,EAAE,MAAM,MAAM,MAAM,IAAI,KAAK,IAAI;AAC9F,QAAM,UAAU,CAAC,SACf,SAAS,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK,YAAA,IAAgB,MAAS;AACvE,QAAM,SAAS,CAAC,QACd,eAAe,SAAS,EAAE,MAAM,SAAS,MAAM,cAAc,IAAA,CAAK,IAAI;AACxE,QAAM,aAAa,CAAC,MAAc,SAAS,EAAE,MAAM,SAAS,OAAO,GAAG;AAEtE,QAAM,UAA+B,eACjC,CAAC,UAAU,aAAa,OAAO,IAC/B,CAAC,UAAU,WAAW;AAE1B,8BACG,OAAA,EAAI,WAAW,GAAG,2BAA2B,SAAS,GACrD,UAAA;AAAA,IAAA,oBAAC,SAAI,WAAU,sEACZ,UAAA,QAAQ,IAAI,CAAC,MAAM;AAClB,YAAM,QAAQ,YAAY,CAAC;AAC3B,aACE;AAAA,QAAC;AAAA,QAAA;AAAA,UAEC,MAAK;AAAA,UACL,SAAS,MAAM,UAAU,CAAC;AAAA,UAC1B,WAAW;AAAA,YACT;AAAA,YACA,WAAW,IACP,uCACA;AAAA,UAAA;AAAA,UAGN,UAAA;AAAA,YAAA,oBAAC,OAAA,EAAM,WAAU,cAAA,CAAc;AAAA,YAC9B,aAAa,CAAC;AAAA,UAAA;AAAA,QAAA;AAAA,QAXV;AAAA,MAAA;AAAA,IAcX,CAAC,EAAA,CACH;AAAA,IACC,YACC;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,MAAK;AAAA,QACL,OAAO;AAAA,QACP,UAAU,CAAC,MAAM,WAAW,EAAE,OAAO,KAAK;AAAA,QAC1C,aAAY;AAAA,QACZ,WAAW;AAAA,UACT;AAAA,UACA;AAAA,QAAA;AAAA,MACF;AAAA,IAAA,IAGF,qBAAA,UAAA,EACE,UAAA;AAAA,MAAA,oBAAC,OAAA,EAAI,WAAU,iBACb,UAAA;AAAA,QAAC;AAAA,QAAA;AAAA,UACC,SAAS;AAAA,UACT,OAAO;AAAA,UACP,UAAU;AAAA,UACV,kBAAgB;AAAA,UAChB,SAAS;AAAA,UACT,SAAS;AAAA,UACT,aAAa,UAAU,OAAO;AAAA,QAAA;AAAA,MAAA,GAElC;AAAA,MACA,oBAAC,OAAA,EAAI,WAAU,kBACb,UAAA;AAAA,QAAC;AAAA,QAAA;AAAA,UACC,SAAS;AAAA,UACT,OAAO;AAAA,UACP,UAAU;AAAA,UACV,kBAAgB;AAAA,UAChB,SAAS;AAAA,UACT,SAAS;AAAA,UACT,aAAa,eAAe,SAAS;AAAA,QAAA;AAAA,MAAA,EACvC,CACF;AAAA,IAAA,EAAA,CACF;AAAA,EAAA,GAEJ;AAEJ;AAKA,MAAM,cAAmF;AAAA,EACvF,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,OAAO;AACT;AAEA,MAAM,eAAkD;AAAA,EACtD,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,OAAO;AACT;AAKA,SAAS,gBACP,MACA,UACA,aACkB;AAClB,QAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5D,QAAM,OAAO,KAAK,IAAI,CAAC,OAAO;AAAA,IAC5B,OAAO;AAAA,IACP,OAAO,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC,KAAK;AAAA,EAAA,EACnD;AACF,MAAI,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,WAAW,GAAG;AAC7D,WAAO,CAAC,EAAE,OAAO,aAAa,OAAO,YAAA,GAAe,GAAG,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;"}
+{"version":3,"file":"SecretKeySelector.js","sources":["../../src/components/SecretKeySelector.tsx"],"sourcesContent":["import { createElement, useEffect, useMemo, useState } from \"react\";\nimport {\n  K8SSecret,\n  K8SConfigmap,\n  Helm,\n  K8SServiceaccount,\n  Vault,\n} from \"@flanksource/icons/mi\";\nimport { type StaticIconComponent } from \"../data/Icon\";\nimport { cn } from \"../lib/utils\";\nimport { UiEdit } from \"../icons\";\nimport { Combobox, type ComboboxOption } from \"./Combobox\";\n\n// SecretKeySelector picks how a credential is sourced and lowers the choice into\n// a single reference string the consumer persists. It supports Kubernetes\n// Secrets and ConfigMaps (name + key), Helm release values (name + jsonpath\n// key), a service-account token (name only), a 1Password reference\n// (op://vault/item/field), and a static inline \"Value\". It is presentational:\n// it fetches nothing — the consumer supplies async `loadResources` /\n// `loadKeyPreview` (for keyed kinds) and optional `loadServiceAccounts` getters.\n\n/** Kinds that reference a named resource plus one of its keys. */\nexport type SecretKind = \"secret\" | \"configmap\" | \"helm\";\n\n/** Every source the picker can emit, including the non-keyed ones. */\nexport type SecretValueSource = SecretKind | \"serviceaccount\" | \"onepassword\" | \"value\";\n\n/** One key's mid-masked preview. `value` is already masked by the consumer. */\nexport type KeyPreview = { key: string; value: string };\n\n/**\n * The selector's value: a {kind,name,key} reference into a Secret / ConfigMap /\n * Helm release, a service-account token by name, a 1Password op:// reference, or\n * a static inline literal.\n */\nexport type SecretKeyValue =\n  | { kind: SecretKind; name: string; key: string }\n  | { kind: \"serviceaccount\"; name: string }\n  | { kind: \"onepassword\"; ref: string }\n  | { kind: \"value\"; value: string };\n\n/** A named secret/configmap/helm-release and its data key names (values never returned). */\nexport type SecretResource = { name: string; keys?: string[] };\n\nexport type SecretKeySelectorProps = {\n  value: SecretKeyValue | undefined;\n  onChange: (next: SecretKeyValue | undefined) => void;\n  /** Loads the named keyed kind's resources (name + data key names). */\n  loadResources: (kind: SecretKind) => Promise<SecretResource[]>;\n  /** Loads mid-masked previews for the named keyed resource's keys. */\n  loadKeyPreview: (kind: SecretKind, name: string) => Promise<KeyPreview[]>;\n  /**\n   * Loads the service-account names (no keys) for the \"serviceaccount\" source.\n   * When omitted, that source's name field accepts freeform entry only.\n   */\n  loadServiceAccounts?: () => Promise<SecretResource[]>;\n  /**\n   * The sources offered in the picker, in order. Defaults to\n   * `[\"secret\", \"configmap\", \"value\"]` (or drops \"value\" when `allowLiteral` is\n   * false). Pass an explicit list to offer helm / serviceaccount / onepassword.\n   */\n  sources?: SecretValueSource[];\n  /**\n   * Shorthand honoured only when `sources` is not supplied: `false` drops the\n   * inline \"Value\" source, leaving Secret/ConfigMap. Ignored when `sources` is\n   * given.\n   */\n  allowLiteral?: boolean;\n  /**\n   * When true, a chosen name absent from the loaded resources, or a key absent\n   * from the chosen keyed resource's keys, is flagged invalid (once the load\n   * settles). The onepassword and literal sources are never strict-flagged.\n   */\n  strict?: boolean;\n  className?: string;\n};\n\nconst DEFAULT_SOURCES: SecretValueSource[] = [\"secret\", \"configmap\", \"value\"];\n\nexport function SecretKeySelector({\n  value,\n  onChange,\n  loadResources,\n  loadKeyPreview,\n  loadServiceAccounts,\n  sources,\n  allowLiteral = true,\n  strict = false,\n  className,\n}: SecretKeySelectorProps) {\n  const sourceList = useMemo<SecretValueSource[]>(\n    () => sources ?? (allowLiteral ? DEFAULT_SOURCES : [\"secret\", \"configmap\"]),\n    [sources, allowLiteral],\n  );\n\n  const source: SecretValueSource = value?.kind ?? sourceList[0] ?? \"secret\";\n  const isKeyed = source === \"secret\" || source === \"configmap\" || source === \"helm\";\n  const isServiceAccount = source === \"serviceaccount\";\n  const isOnePassword = source === \"onepassword\";\n  const isLiteral = source === \"value\";\n  // A keyed source's refKind drives the loaders; other sources default to \"secret\".\n  const refKind: SecretKind = isKeyed ? (source as SecretKind) : \"secret\";\n\n  const selectedName =\n    value && (value.kind === \"serviceaccount\" || isRefKind(value)) ? value.name : \"\";\n  const selectedKey = value && isRefKind(value) ? value.key : \"\";\n  const literalValue = value && value.kind === \"value\" ? value.value : \"\";\n  const opRef = value && value.kind === \"onepassword\" ? value.ref : \"\";\n\n  const [resources, setResources] = useState<SecretResource[]>([]);\n  const [resourcesLoading, setResourcesLoading] = useState(false);\n  const [previews, setPreviews] = useState<KeyPreview[]>([]);\n  const [previewLoading, setPreviewLoading] = useState(false);\n\n  // Load the name list for keyed kinds (secret/configmap/helm) and, when a\n  // loader is supplied, for the serviceaccount source. Other sources list nothing.\n  useEffect(() => {\n    const loader = isKeyed\n      ? () => loadResources(refKind)\n      : isServiceAccount && loadServiceAccounts\n        ? loadServiceAccounts\n        : null;\n    if (!loader) {\n      setResources([]);\n      return;\n    }\n    let cancelled = false;\n    setResourcesLoading(true);\n    loader()\n      .then((res) => !cancelled && setResources(res))\n      .finally(() => !cancelled && setResourcesLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadResources, loadServiceAccounts, refKind, isKeyed, isServiceAccount]);\n\n  useEffect(() => {\n    if (!isKeyed || !selectedName) {\n      setPreviews([]);\n      return;\n    }\n    let cancelled = false;\n    setPreviewLoading(true);\n    loadKeyPreview(refKind, selectedName)\n      .then((res) => !cancelled && setPreviews(res))\n      .catch(() => !cancelled && setPreviews([]))\n      .finally(() => !cancelled && setPreviewLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadKeyPreview, refKind, selectedName, isKeyed]);\n\n  const nameOptions = useMemo<ComboboxOption[]>(\n    () => resources.map((r) => ({ value: r.name, label: r.name })),\n    [resources],\n  );\n  const selectedResource = useMemo(\n    () => resources.find((r) => r.name === selectedName),\n    [resources, selectedName],\n  );\n  const keyOptions = useMemo(\n    () => buildKeyOptions(selectedResource?.keys ?? [], previews, selectedKey),\n    [selectedResource, selectedKey, previews],\n  );\n\n  // Strict validity: the name is invalid when it names no loaded resource; the\n  // key is invalid when, with a resolved resource, it isn't one of that\n  // resource's keys. Only names from a listed source are checked (a\n  // serviceaccount source with no loader lists nothing, so it never flags).\n  const listsNames = isKeyed || (isServiceAccount && !!loadServiceAccounts);\n  const nameInvalid = strict && listsNames && !!selectedName && !resourcesLoading && !selectedResource;\n  const keyInvalid =\n    strict &&\n    isKeyed &&\n    !!selectedKey &&\n    !!selectedResource &&\n    !resourcesLoading &&\n    !(selectedResource.keys ?? []).includes(selectedKey);\n\n  const setSource = (next: SecretValueSource) => {\n    switch (next) {\n      case \"value\":\n        return onChange({ kind: \"value\", value: \"\" });\n      case \"onepassword\":\n        return onChange({ kind: \"onepassword\", ref: \"\" });\n      case \"serviceaccount\":\n        return onChange({ kind: \"serviceaccount\", name: \"\" });\n      default:\n        return onChange({ kind: next, name: \"\", key: \"\" });\n    }\n  };\n  const setName = (name: string) => {\n    if (isServiceAccount) return onChange(name ? { kind: \"serviceaccount\", name } : undefined);\n    return onChange(name ? { kind: refKind, name, key: selectedKey } : undefined);\n  };\n  const setKey = (key: string) =>\n    selectedName ? onChange({ kind: refKind, name: selectedName, key }) : undefined;\n  const setLiteral = (v: string) => onChange({ kind: \"value\", value: v });\n  const setOpRef = (v: string) => onChange({ kind: \"onepassword\", ref: v });\n\n  const sourceOptions = useMemo<ComboboxOption[]>(\n    () =>\n      sourceList.map((k) => ({\n        value: k,\n        label: SOURCE_LABEL[k],\n        icon: createElement(SOURCE_ICON[k], { className: \"size-4\" }),\n      })),\n    [sourceList],\n  );\n\n  return (\n    <div className={cn(\"flex flex-wrap items-center gap-2\", className)}>\n      <div className=\"w-[9.5rem] shrink-0\">\n        <Combobox\n          ariaLabel=\"Secret value source\"\n          options={sourceOptions}\n          value={source}\n          onChange={(next) => setSource(next as SecretValueSource)}\n          allowCustomValue={false}\n          required\n        />\n      </div>\n      {isLiteral ? (\n        <TextField\n          value={literalValue}\n          onChange={setLiteral}\n          placeholder=\"Static value…\"\n          ariaLabel=\"Static value\"\n        />\n      ) : isOnePassword ? (\n        <TextField\n          value={opRef}\n          onChange={setOpRef}\n          placeholder=\"op://vault/item/field\"\n          ariaLabel=\"1Password reference\"\n          mono\n        />\n      ) : isServiceAccount ? (\n        <div className=\"min-w-0 flex-[1_1_16rem]\" data-slot=\"secret-serviceaccount-field\">\n          <Combobox\n            options={nameOptions}\n            value={selectedName}\n            onChange={setName}\n            allowCustomValue\n            loading={resourcesLoading}\n            invalid={nameInvalid}\n            placeholder=\"Service account…\"\n          />\n        </div>\n      ) : (\n        <div\n          className=\"grid min-w-0 flex-[1_1_18rem] grid-cols-[minmax(8rem,11rem)_minmax(8rem,1fr)] items-center gap-2\"\n          data-slot=\"secret-reference-fields\"\n        >\n          <div className=\"min-w-0\">\n            <Combobox\n              options={nameOptions}\n              value={selectedName}\n              onChange={setName}\n              allowCustomValue\n              loading={resourcesLoading}\n              invalid={nameInvalid}\n              placeholder={`Select ${refKind}…`}\n            />\n          </div>\n          <div className=\"min-w-0\">\n            <Combobox\n              options={keyOptions}\n              value={selectedKey}\n              onChange={setKey}\n              allowCustomValue\n              loading={previewLoading}\n              invalid={keyInvalid}\n              placeholder={selectedName ? keyPlaceholder(refKind) : \"—\"}\n            />\n          </div>\n        </div>\n      )}\n    </div>\n  );\n}\n\n// TextField is the shared single-input surface for the literal and 1Password\n// sources (no resource list backs either).\nfunction TextField({\n  value,\n  onChange,\n  placeholder,\n  ariaLabel,\n  mono,\n}: {\n  value: string;\n  onChange: (v: string) => void;\n  placeholder: string;\n  ariaLabel: string;\n  mono?: boolean;\n}) {\n  return (\n    <div className=\"min-w-0 flex-[1_1_16rem]\" data-slot=\"secret-value-fields\">\n      <input\n        type=\"text\"\n        value={value}\n        onChange={(e) => onChange(e.target.value)}\n        placeholder={placeholder}\n        aria-label={ariaLabel}\n        className={cn(\n          \"h-control-h w-full min-w-0 rounded border border-input bg-background px-control-px text-sm\",\n          \"outline-none focus-visible:ring-2 focus-visible:ring-ring\",\n          mono && \"font-mono\",\n        )}\n      />\n    </div>\n  );\n}\n\n// isRefKind narrows to the keyed variants that carry both a name and a key.\nfunction isRefKind(\n  v: SecretKeyValue,\n): v is { kind: SecretKind; name: string; key: string } {\n  return v.kind === \"secret\" || v.kind === \"configmap\" || v.kind === \"helm\";\n}\n\n// keyPlaceholder hints the key field: helm keys are jsonpath expressions into\n// the merged release values, the others are literal data keys.\nfunction keyPlaceholder(kind: SecretKind): string {\n  return kind === \"helm\" ? \"jsonpath…\" : \"Key…\";\n}\n\n// Each source's leading glyph. The flanksource FCs carry static metadata that\n// doesn't unify with ComponentType, so type the slot as a plain render function.\nconst SOURCE_ICON: Record<SecretValueSource, StaticIconComponent> = {\n  secret: K8SSecret,\n  configmap: K8SConfigmap,\n  helm: Helm,\n  serviceaccount: K8SServiceaccount,\n  onepassword: Vault,\n  value: UiEdit,\n};\n\nconst SOURCE_LABEL: Record<SecretValueSource, string> = {\n  secret: \"Secret\",\n  configmap: \"ConfigMap\",\n  helm: \"Helm\",\n  serviceaccount: \"Service Account\",\n  onepassword: \"1Password\",\n  value: \"Value\",\n};\n\n// buildKeyOptions labels each key with its mid-masked preview value when one is\n// available. A selected key absent from the list is pinned so the selection\n// stays visible.\nfunction buildKeyOptions(\n  keys: string[],\n  previews: KeyPreview[],\n  selectedKey: string,\n): ComboboxOption[] {\n  const masked = new Map(previews.map((p) => [p.key, p.value]));\n  const base = keys.map((k) => ({\n    value: k,\n    label: masked.has(k) ? `${k} — ${masked.get(k)}` : k,\n  }));\n  if (selectedKey && !base.some((o) => o.value === selectedKey)) {\n    return [{ value: selectedKey, label: selectedKey }, ...base];\n  }\n  return base;\n}\n"],"names":[],"mappings":";;;;;;AA6EA,MAAM,kBAAuC,CAAC,UAAU,aAAa,OAAO;AAErE,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf,SAAS;AAAA,EACT;AACF,GAA2B;AACzB,QAAM,aAAa;AAAA,IACjB,MAAM,YAAY,eAAe,kBAAkB,CAAC,UAAU,WAAW;AAAA,IACzE,CAAC,SAAS,YAAY;AAAA,EAAA;AAGxB,QAAM,UAA4B,+BAAO,SAAQ,WAAW,CAAC,KAAK;AAClE,QAAM,UAAU,WAAW,YAAY,WAAW,eAAe,WAAW;AAC5E,QAAM,mBAAmB,WAAW;AACpC,QAAM,gBAAgB,WAAW;AACjC,QAAM,YAAY,WAAW;AAE7B,QAAM,UAAsB,UAAW,SAAwB;AAE/D,QAAM,eACJ,UAAU,MAAM,SAAS,oBAAoB,UAAU,KAAK,KAAK,MAAM,OAAO;AAChF,QAAM,cAAc,SAAS,UAAU,KAAK,IAAI,MAAM,MAAM;AAC5D,QAAM,eAAe,SAAS,MAAM,SAAS,UAAU,MAAM,QAAQ;AACrE,QAAM,QAAQ,SAAS,MAAM,SAAS,gBAAgB,MAAM,MAAM;AAElE,QAAM,CAAC,WAAW,YAAY,IAAI,SAA2B,CAAA,CAAE;AAC/D,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,SAAS,KAAK;AAC9D,QAAM,CAAC,UAAU,WAAW,IAAI,SAAuB,CAAA,CAAE;AACzD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAS,KAAK;AAI1D,YAAU,MAAM;AACd,UAAM,SAAS,UACX,MAAM,cAAc,OAAO,IAC3B,oBAAoB,sBAClB,sBACA;AACN,QAAI,CAAC,QAAQ;AACX,mBAAa,CAAA,CAAE;AACf;AAAA,IACF;AACA,QAAI,YAAY;AAChB,wBAAoB,IAAI;AACxB,WAAA,EACG,KAAK,CAAC,QAAQ,CAAC,aAAa,aAAa,GAAG,CAAC,EAC7C,QAAQ,MAAM,CAAC,aAAa,oBAAoB,KAAK,CAAC;AACzD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,eAAe,qBAAqB,SAAS,SAAS,gBAAgB,CAAC;AAE3E,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,cAAc;AAC7B,kBAAY,CAAA,CAAE;AACd;AAAA,IACF;AACA,QAAI,YAAY;AAChB,sBAAkB,IAAI;AACtB,mBAAe,SAAS,YAAY,EACjC,KAAK,CAAC,QAAQ,CAAC,aAAa,YAAY,GAAG,CAAC,EAC5C,MAAM,MAAM,CAAC,aAAa,YAAY,CAAA,CAAE,CAAC,EACzC,QAAQ,MAAM,CAAC,aAAa,kBAAkB,KAAK,CAAC;AACvD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,gBAAgB,SAAS,cAAc,OAAO,CAAC;AAEnD,QAAM,cAAc;AAAA,IAClB,MAAM,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,KAAA,EAAO;AAAA,IAC7D,CAAC,SAAS;AAAA,EAAA;AAEZ,QAAM,mBAAmB;AAAA,IACvB,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY;AAAA,IACnD,CAAC,WAAW,YAAY;AAAA,EAAA;AAE1B,QAAM,aAAa;AAAA,IACjB,MAAM,iBAAgB,qDAAkB,SAAQ,CAAA,GAAI,UAAU,WAAW;AAAA,IACzE,CAAC,kBAAkB,aAAa,QAAQ;AAAA,EAAA;AAO1C,QAAM,aAAa,WAAY,oBAAoB,CAAC,CAAC;AACrD,QAAM,cAAc,UAAU,cAAc,CAAC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;AACpF,QAAM,aACJ,UACA,WACA,CAAC,CAAC,eACF,CAAC,CAAC,oBACF,CAAC,oBACD,EAAE,iBAAiB,QAAQ,CAAA,GAAI,SAAS,WAAW;AAErD,QAAM,YAAY,CAAC,SAA4B;AAC7C,YAAQ,MAAA;AAAA,MACN,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,SAAS,OAAO,IAAI;AAAA,MAC9C,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,eAAe,KAAK,IAAI;AAAA,MAClD,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,kBAAkB,MAAM,IAAI;AAAA,MACtD;AACE,eAAO,SAAS,EAAE,MAAM,MAAM,MAAM,IAAI,KAAK,IAAI;AAAA,IAAA;AAAA,EAEvD;AACA,QAAM,UAAU,CAAC,SAAiB;AAChC,QAAI,yBAAyB,SAAS,OAAO,EAAE,MAAM,kBAAkB,KAAA,IAAS,MAAS;AACzF,WAAO,SAAS,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK,YAAA,IAAgB,MAAS;AAAA,EAC9E;AACA,QAAM,SAAS,CAAC,QACd,eAAe,SAAS,EAAE,MAAM,SAAS,MAAM,cAAc,IAAA,CAAK,IAAI;AACxE,QAAM,aAAa,CAAC,MAAc,SAAS,EAAE,MAAM,SAAS,OAAO,GAAG;AACtE,QAAM,WAAW,CAAC,MAAc,SAAS,EAAE,MAAM,eAAe,KAAK,GAAG;AAExE,QAAM,gBAAgB;AAAA,IACpB,MACE,WAAW,IAAI,CAAC,OAAO;AAAA,MACrB,OAAO;AAAA,MACP,OAAO,aAAa,CAAC;AAAA,MACrB,MAAM,cAAc,YAAY,CAAC,GAAG,EAAE,WAAW,UAAU;AAAA,IAAA,EAC3D;AAAA,IACJ,CAAC,UAAU;AAAA,EAAA;AAGb,8BACG,OAAA,EAAI,WAAW,GAAG,qCAAqC,SAAS,GAC/D,UAAA;AAAA,IAAA,oBAAC,OAAA,EAAI,WAAU,uBACb,UAAA;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,WAAU;AAAA,QACV,SAAS;AAAA,QACT,OAAO;AAAA,QACP,UAAU,CAAC,SAAS,UAAU,IAAyB;AAAA,QACvD,kBAAkB;AAAA,QAClB,UAAQ;AAAA,MAAA;AAAA,IAAA,GAEZ;AAAA,IACC,YACC;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,OAAO;AAAA,QACP,UAAU;AAAA,QACV,aAAY;AAAA,QACZ,WAAU;AAAA,MAAA;AAAA,IAAA,IAEV,gBACF;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,OAAO;AAAA,QACP,UAAU;AAAA,QACV,aAAY;AAAA,QACZ,WAAU;AAAA,QACV,MAAI;AAAA,MAAA;AAAA,IAAA,IAEJ,mBACF,oBAAC,SAAI,WAAU,4BAA2B,aAAU,+BAClD,UAAA;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,SAAS;AAAA,QACT,OAAO;AAAA,QACP,UAAU;AAAA,QACV,kBAAgB;AAAA,QAChB,SAAS;AAAA,QACT,SAAS;AAAA,QACT,aAAY;AAAA,MAAA;AAAA,IAAA,GAEhB,IAEA;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,WAAU;AAAA,QACV,aAAU;AAAA,QAEV,UAAA;AAAA,UAAA,oBAAC,OAAA,EAAI,WAAU,WACb,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,SAAS;AAAA,cACT,OAAO;AAAA,cACP,UAAU;AAAA,cACV,kBAAgB;AAAA,cAChB,SAAS;AAAA,cACT,SAAS;AAAA,cACT,aAAa,UAAU,OAAO;AAAA,YAAA;AAAA,UAAA,GAElC;AAAA,UACA,oBAAC,OAAA,EAAI,WAAU,WACb,UAAA;AAAA,YAAC;AAAA,YAAA;AAAA,cACC,SAAS;AAAA,cACT,OAAO;AAAA,cACP,UAAU;AAAA,cACV,kBAAgB;AAAA,cAChB,SAAS;AAAA,cACT,SAAS;AAAA,cACT,aAAa,eAAe,eAAe,OAAO,IAAI;AAAA,YAAA;AAAA,UAAA,EACxD,CACF;AAAA,QAAA;AAAA,MAAA;AAAA,IAAA;AAAA,EACF,GAEJ;AAEJ;AAIA,SAAS,UAAU;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,SACE,oBAAC,OAAA,EAAI,WAAU,4BAA2B,aAAU,uBAClD,UAAA;AAAA,IAAC;AAAA,IAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,MACxC;AAAA,MACA,cAAY;AAAA,MACZ,WAAW;AAAA,QACT;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MAAA;AAAA,IACV;AAAA,EAAA,GAEJ;AAEJ;AAGA,SAAS,UACP,GACsD;AACtD,SAAO,EAAE,SAAS,YAAY,EAAE,SAAS,eAAe,EAAE,SAAS;AACrE;AAIA,SAAS,eAAe,MAA0B;AAChD,SAAO,SAAS,SAAS,cAAc;AACzC;AAIA,MAAM,cAA8D;AAAA,EAClE,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,MAAM;AAAA,EACN,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,OAAO;AACT;AAEA,MAAM,eAAkD;AAAA,EACtD,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,MAAM;AAAA,EACN,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,OAAO;AACT;AAKA,SAAS,gBACP,MACA,UACA,aACkB;AAClB,QAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5D,QAAM,OAAO,KAAK,IAAI,CAAC,OAAO;AAAA,IAC5B,OAAO;AAAA,IACP,OAAO,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC,KAAK;AAAA,EAAA,EACnD;AACF,MAAI,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,WAAW,GAAG;AAC7D,WAAO,CAAC,EAAE,OAAO,aAAa,OAAO,YAAA,GAAe,GAAG,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;"}

package/dist/components/SecretKeySelector.model.cjs

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+function serializeSecretRef(value) {
+  if (!value) return "";
+  switch (value.kind) {
+    case "value":
+      return value.value;
+    case "onepassword":
+      return value.ref;
+    case "serviceaccount":
+      return value.name ? `serviceaccount://${value.name}` : "";
+    default:
+      return `${value.kind}://${value.name}/${value.key}`;
+  }
+}
+function parseSecretRef(raw) {
+  if (typeof raw !== "string" || raw === "") return void 0;
+  if (raw.startsWith("op://")) return { kind: "onepassword", ref: raw };
+  const saPrefix = "serviceaccount://";
+  if (raw.startsWith(saPrefix)) return { kind: "serviceaccount", name: raw.slice(saPrefix.length) };
+  for (const kind of ["secret", "configmap", "helm"]) {
+    const prefix = `${kind}://`;
+    if (raw.startsWith(prefix)) {
+      const [name = "", key = ""] = raw.slice(prefix.length).split("/", 2);
+      return { kind, name, key };
+    }
+  }
+  return { kind: "value", value: raw };
+}
+exports.parseSecretRef = parseSecretRef;
+exports.serializeSecretRef = serializeSecretRef;
+//# sourceMappingURL=SecretKeySelector.model.cjs.map

package/dist/components/SecretKeySelector.model.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretKeySelector.model.cjs","sources":["../../src/components/SecretKeySelector.model.ts"],"sourcesContent":["import type { SecretKeyValue, SecretKind } from \"./SecretKeySelector\";\n\n// serializeSecretRef lowers a value into the single reference string the backend\n// EnvVar.Scan understands: secret://name/key, configmap://name/key,\n// helm://name/key, serviceaccount://name, an op:// reference, or a bare literal.\nexport function serializeSecretRef(value: SecretKeyValue | undefined): string {\n  if (!value) return \"\";\n  switch (value.kind) {\n    case \"value\":\n      return value.value;\n    case \"onepassword\":\n      return value.ref;\n    case \"serviceaccount\":\n      return value.name ? `serviceaccount://${value.name}` : \"\";\n    default:\n      return `${value.kind}://${value.name}/${value.key}`;\n  }\n}\n\n// parseSecretRef is the inverse of serializeSecretRef: any unrecognised string\n// (including an empty one that still carries text) is treated as a literal.\nexport function parseSecretRef(raw: unknown): SecretKeyValue | undefined {\n  if (typeof raw !== \"string\" || raw === \"\") return undefined;\n  if (raw.startsWith(\"op://\")) return { kind: \"onepassword\", ref: raw };\n  const saPrefix = \"serviceaccount://\";\n  if (raw.startsWith(saPrefix)) return { kind: \"serviceaccount\", name: raw.slice(saPrefix.length) };\n  for (const kind of [\"secret\", \"configmap\", \"helm\"] as const satisfies readonly SecretKind[]) {\n    const prefix = `${kind}://`;\n    if (raw.startsWith(prefix)) {\n      const [name = \"\", key = \"\"] = raw.slice(prefix.length).split(\"/\", 2);\n      return { kind, name, key };\n    }\n  }\n  return { kind: \"value\", value: raw };\n}\n"],"names":[],"mappings":";;AAKO,SAAS,mBAAmB,OAA2C;AAC5E,MAAI,CAAC,MAAO,QAAO;AACnB,UAAQ,MAAM,MAAA;AAAA,IACZ,KAAK;AACH,aAAO,MAAM;AAAA,IACf,KAAK;AACH,aAAO,MAAM;AAAA,IACf,KAAK;AACH,aAAO,MAAM,OAAO,oBAAoB,MAAM,IAAI,KAAK;AAAA,IACzD;AACE,aAAO,GAAG,MAAM,IAAI,MAAM,MAAM,IAAI,IAAI,MAAM,GAAG;AAAA,EAAA;AAEvD;AAIO,SAAS,eAAe,KAA0C;AACvE,MAAI,OAAO,QAAQ,YAAY,QAAQ,GAAI,QAAO;AAClD,MAAI,IAAI,WAAW,OAAO,UAAU,EAAE,MAAM,eAAe,KAAK,IAAA;AAChE,QAAM,WAAW;AACjB,MAAI,IAAI,WAAW,QAAQ,EAAG,QAAO,EAAE,MAAM,kBAAkB,MAAM,IAAI,MAAM,SAAS,MAAM,EAAA;AAC9F,aAAW,QAAQ,CAAC,UAAU,aAAa,MAAM,GAA4C;AAC3F,UAAM,SAAS,GAAG,IAAI;AACtB,QAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,YAAM,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,IAAI,MAAM,OAAO,MAAM,EAAE,MAAM,KAAK,CAAC;AACnE,aAAO,EAAE,MAAM,MAAM,IAAA;AAAA,IACvB;AAAA,EACF;AACA,SAAO,EAAE,MAAM,SAAS,OAAO,IAAA;AACjC;;;"}

package/dist/components/SecretKeySelector.model.d.ts

@@ -0,0 +1,4 @@
+import { SecretKeyValue } from './SecretKeySelector';
+export declare function serializeSecretRef(value: SecretKeyValue | undefined): string;
+export declare function parseSecretRef(raw: unknown): SecretKeyValue | undefined;
+//# sourceMappingURL=SecretKeySelector.model.d.ts.map

package/dist/components/SecretKeySelector.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretKeySelector.model.d.ts","sourceRoot":"","sources":["../../src/components/SecretKeySelector.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,qBAAqB,CAAC;AAKtE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,CAY5E;AAID,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAavE"}

package/dist/components/SecretKeySelector.model.js

@@ -0,0 +1,32 @@
+function serializeSecretRef(value) {
+  if (!value) return "";
+  switch (value.kind) {
+    case "value":
+      return value.value;
+    case "onepassword":
+      return value.ref;
+    case "serviceaccount":
+      return value.name ? `serviceaccount://${value.name}` : "";
+    default:
+      return `${value.kind}://${value.name}/${value.key}`;
+  }
+}
+function parseSecretRef(raw) {
+  if (typeof raw !== "string" || raw === "") return void 0;
+  if (raw.startsWith("op://")) return { kind: "onepassword", ref: raw };
+  const saPrefix = "serviceaccount://";
+  if (raw.startsWith(saPrefix)) return { kind: "serviceaccount", name: raw.slice(saPrefix.length) };
+  for (const kind of ["secret", "configmap", "helm"]) {
+    const prefix = `${kind}://`;
+    if (raw.startsWith(prefix)) {
+      const [name = "", key = ""] = raw.slice(prefix.length).split("/", 2);
+      return { kind, name, key };
+    }
+  }
+  return { kind: "value", value: raw };
+}
+export {
+  parseSecretRef,
+  serializeSecretRef
+};
+//# sourceMappingURL=SecretKeySelector.model.js.map

package/dist/components/SecretKeySelector.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretKeySelector.model.js","sources":["../../src/components/SecretKeySelector.model.ts"],"sourcesContent":["import type { SecretKeyValue, SecretKind } from \"./SecretKeySelector\";\n\n// serializeSecretRef lowers a value into the single reference string the backend\n// EnvVar.Scan understands: secret://name/key, configmap://name/key,\n// helm://name/key, serviceaccount://name, an op:// reference, or a bare literal.\nexport function serializeSecretRef(value: SecretKeyValue | undefined): string {\n  if (!value) return \"\";\n  switch (value.kind) {\n    case \"value\":\n      return value.value;\n    case \"onepassword\":\n      return value.ref;\n    case \"serviceaccount\":\n      return value.name ? `serviceaccount://${value.name}` : \"\";\n    default:\n      return `${value.kind}://${value.name}/${value.key}`;\n  }\n}\n\n// parseSecretRef is the inverse of serializeSecretRef: any unrecognised string\n// (including an empty one that still carries text) is treated as a literal.\nexport function parseSecretRef(raw: unknown): SecretKeyValue | undefined {\n  if (typeof raw !== \"string\" || raw === \"\") return undefined;\n  if (raw.startsWith(\"op://\")) return { kind: \"onepassword\", ref: raw };\n  const saPrefix = \"serviceaccount://\";\n  if (raw.startsWith(saPrefix)) return { kind: \"serviceaccount\", name: raw.slice(saPrefix.length) };\n  for (const kind of [\"secret\", \"configmap\", \"helm\"] as const satisfies readonly SecretKind[]) {\n    const prefix = `${kind}://`;\n    if (raw.startsWith(prefix)) {\n      const [name = \"\", key = \"\"] = raw.slice(prefix.length).split(\"/\", 2);\n      return { kind, name, key };\n    }\n  }\n  return { kind: \"value\", value: raw };\n}\n"],"names":[],"mappings":"AAKO,SAAS,mBAAmB,OAA2C;AAC5E,MAAI,CAAC,MAAO,QAAO;AACnB,UAAQ,MAAM,MAAA;AAAA,IACZ,KAAK;AACH,aAAO,MAAM;AAAA,IACf,KAAK;AACH,aAAO,MAAM;AAAA,IACf,KAAK;AACH,aAAO,MAAM,OAAO,oBAAoB,MAAM,IAAI,KAAK;AAAA,IACzD;AACE,aAAO,GAAG,MAAM,IAAI,MAAM,MAAM,IAAI,IAAI,MAAM,GAAG;AAAA,EAAA;AAEvD;AAIO,SAAS,eAAe,KAA0C;AACvE,MAAI,OAAO,QAAQ,YAAY,QAAQ,GAAI,QAAO;AAClD,MAAI,IAAI,WAAW,OAAO,UAAU,EAAE,MAAM,eAAe,KAAK,IAAA;AAChE,QAAM,WAAW;AACjB,MAAI,IAAI,WAAW,QAAQ,EAAG,QAAO,EAAE,MAAM,kBAAkB,MAAM,IAAI,MAAM,SAAS,MAAM,EAAA;AAC9F,aAAW,QAAQ,CAAC,UAAU,aAAa,MAAM,GAA4C;AAC3F,UAAM,SAAS,GAAG,IAAI;AACtB,QAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,YAAM,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,IAAI,MAAM,OAAO,MAAM,EAAE,MAAM,KAAK,CAAC;AACnE,aAAO,EAAE,MAAM,MAAM,IAAA;AAAA,IACvB;AAAA,EACF;AACA,SAAO,EAAE,MAAM,SAAS,OAAO,IAAA;AACjC;"}