@flanksource/clicky-ui 0.3.18 → 0.3.20

package/dist/components/SecretFormField.cjs

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const jsxRuntime = require("react/jsx-runtime");
+const react = require("react");
+const EndpointSelector = require("./EndpointSelector.cjs");
+const EndpointSelector_model = require("./EndpointSelector.model.cjs");
+const SecretKeySelector_model = require("./SecretKeySelector.model.cjs");
+const SecretKeySelector = require("./SecretKeySelector.cjs");
+function defaultSecretValue(source) {
+  switch (source) {
+    case "value":
+      return { kind: "value", value: "" };
+    case "onepassword":
+      return { kind: "onepassword", ref: "" };
+    case "serviceaccount":
+      return { kind: "serviceaccount", name: "" };
+    case "secret":
+    case "configmap":
+    case "helm":
+      return { kind: source, name: "", key: "" };
+    default:
+      return void 0;
+  }
+}
+function useFieldDraft({
+  raw,
+  parsed,
+  seeded,
+  serialize,
+  onChange
+}) {
+  const rawString = typeof raw === "string" ? raw : "";
+  const [draft, setDraft] = react.useState();
+  const committed = react.useRef(rawString);
+  react.useEffect(() => {
+    if (rawString === committed.current) return;
+    committed.current = rawString;
+    setDraft(void 0);
+  }, [rawString]);
+  const commit = react.useCallback(
+    (next) => {
+      setDraft(next);
+      const serialized = serialize(next);
+      committed.current = serialized;
+      onChange(serialized);
+    },
+    [onChange, serialize]
+  );
+  return [draft ?? parsed ?? seeded, commit];
+}
+function SecretFormField({
+  field,
+  namespace,
+  allowWorkload,
+  loaders,
+  secretSources,
+  urlSources
+}) {
+  const loadResources = react.useCallback(
+    (kind) => loaders.loadResources(kind, namespace),
+    [loaders, namespace]
+  );
+  const loadKeyPreview = react.useCallback(
+    (kind, name) => loaders.loadKeyPreview(kind, name, namespace),
+    [loaders, namespace]
+  );
+  const loadServiceAccounts = react.useCallback(
+    () => loaders.loadServiceAccounts(namespace),
+    [loaders, namespace]
+  );
+  const loadWorkloads = react.useCallback(
+    (kinds) => loaders.loadWorkloads(namespace, kinds),
+    [loaders, namespace]
+  );
+  const onePassword = react.useMemo(
+    () => ({
+      loadVaults: loaders.loadOnePasswordVaults,
+      loadItems: loaders.loadOnePasswordItems,
+      loadFields: loaders.loadOnePasswordFields
+    }),
+    [loaders]
+  );
+  const defaultSource = field.schema["x-clicky-default-source"];
+  const [secretValue, changeSecret] = useFieldDraft({
+    raw: field.value,
+    parsed: SecretKeySelector_model.parseSecretRef(field.value),
+    seeded: defaultSecretValue(defaultSource),
+    serialize: SecretKeySelector_model.serializeSecretRef,
+    onChange: field.onChange
+  });
+  const endpointSeed = defaultSecretValue(defaultSource);
+  const [endpointValue, changeEndpoint] = useFieldDraft({
+    raw: field.value,
+    parsed: EndpointSelector_model.parseEndpointValue(field.value),
+    seeded: endpointSeed ? { mode: "url", source: endpointSeed } : void 0,
+    serialize: EndpointSelector_model.serializeEndpointValue,
+    onChange: field.onChange
+  });
+  if (allowWorkload) {
+    return /* @__PURE__ */ jsxRuntime.jsx(
+      EndpointSelector.EndpointSelector,
+      {
+        value: endpointValue,
+        onChange: changeEndpoint,
+        namespace,
+        modes: [
+          "url",
+          "service",
+          "cluster-ip",
+          "api-proxy",
+          "ingress",
+          "port-forward"
+        ],
+        loadWorkloads,
+        urlSelector: {
+          loadResources,
+          loadKeyPreview,
+          loadServiceAccounts,
+          onePassword,
+          ...urlSources ? { sources: urlSources } : {}
+        },
+        showPath: true,
+        showIngressPort: true,
+        allowCustomPort: true
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    SecretKeySelector.SecretKeySelector,
+    {
+      value: secretValue,
+      onChange: changeSecret,
+      loadResources,
+      loadKeyPreview,
+      loadServiceAccounts,
+      onePassword,
+      ...secretSources ? { sources: secretSources } : {}
+    }
+  );
+}
+exports.SecretFormField = SecretFormField;
+//# sourceMappingURL=SecretFormField.cjs.map

package/dist/components/SecretFormField.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretFormField.cjs","sources":["../../src/components/SecretFormField.tsx"],"sourcesContent":["import { useCallback, useEffect, useMemo, useRef, useState } from \"react\";\nimport { EndpointSelector } from \"./EndpointSelector\";\nimport {\n  parseEndpointValue,\n  serializeEndpointValue,\n  type EndpointSelectorValue,\n} from \"./EndpointSelector.model\";\nimport {\n  parseSecretRef,\n  serializeSecretRef,\n} from \"./SecretKeySelector.model\";\nimport {\n  SecretKeySelector,\n  type SecretKeyValue,\n} from \"./SecretKeySelector\";\nimport type { FieldControl } from \"./json-schema-form-types\";\nimport type { SecretFormExtensionOptions } from \"./secret-form-extension\";\n\nexport type SecretFormFieldProps = SecretFormExtensionOptions & {\n  field: FieldControl;\n  namespace: string;\n  allowWorkload: boolean;\n};\n\nfunction defaultSecretValue(source: unknown): SecretKeyValue | undefined {\n  switch (source) {\n    case \"value\":\n      return { kind: \"value\", value: \"\" };\n    case \"onepassword\":\n      return { kind: \"onepassword\", ref: \"\" };\n    case \"serviceaccount\":\n      return { kind: \"serviceaccount\", name: \"\" };\n    case \"secret\":\n    case \"configmap\":\n    case \"helm\":\n      return { kind: source, name: \"\", key: \"\" };\n    default:\n      return undefined;\n  }\n}\n\nfunction useFieldDraft<T>({\n  raw,\n  parsed,\n  seeded,\n  serialize,\n  onChange,\n}: {\n  raw: unknown;\n  parsed: T | undefined;\n  seeded: T | undefined;\n  serialize: (next: T | undefined) => string;\n  onChange: (next: unknown) => void;\n}): [T | undefined, (next: T | undefined) => void] {\n  const rawString = typeof raw === \"string\" ? raw : \"\";\n  const [draft, setDraft] = useState<T | undefined>();\n  const committed = useRef(rawString);\n\n  useEffect(() => {\n    if (rawString === committed.current) return;\n    committed.current = rawString;\n    setDraft(undefined);\n  }, [rawString]);\n\n  const commit = useCallback(\n    (next: T | undefined) => {\n      setDraft(next);\n      const serialized = serialize(next);\n      committed.current = serialized;\n      onChange(serialized);\n    },\n    [onChange, serialize],\n  );\n\n  return [draft ?? parsed ?? seeded, commit];\n}\n\nexport function SecretFormField({\n  field,\n  namespace,\n  allowWorkload,\n  loaders,\n  secretSources,\n  urlSources,\n}: SecretFormFieldProps) {\n  const loadResources = useCallback(\n    (kind: Parameters<typeof loaders.loadResources>[0]) =>\n      loaders.loadResources(kind, namespace),\n    [loaders, namespace],\n  );\n  const loadKeyPreview = useCallback(\n    (kind: Parameters<typeof loaders.loadKeyPreview>[0], name: string) =>\n      loaders.loadKeyPreview(kind, name, namespace),\n    [loaders, namespace],\n  );\n  const loadServiceAccounts = useCallback(\n    () => loaders.loadServiceAccounts(namespace),\n    [loaders, namespace],\n  );\n  const loadWorkloads = useCallback(\n    (kinds: Parameters<typeof loaders.loadWorkloads>[1]) =>\n      loaders.loadWorkloads(namespace, kinds),\n    [loaders, namespace],\n  );\n  const onePassword = useMemo(\n    () => ({\n      loadVaults: loaders.loadOnePasswordVaults,\n      loadItems: loaders.loadOnePasswordItems,\n      loadFields: loaders.loadOnePasswordFields,\n    }),\n    [loaders],\n  );\n\n  const defaultSource = field.schema[\"x-clicky-default-source\"];\n  const [secretValue, changeSecret] = useFieldDraft<SecretKeyValue>({\n    raw: field.value,\n    parsed: parseSecretRef(field.value),\n    seeded: defaultSecretValue(defaultSource),\n    serialize: serializeSecretRef,\n    onChange: field.onChange,\n  });\n  const endpointSeed = defaultSecretValue(defaultSource);\n  const [endpointValue, changeEndpoint] = useFieldDraft<EndpointSelectorValue>({\n    raw: field.value,\n    parsed: parseEndpointValue(field.value),\n    seeded: endpointSeed ? { mode: \"url\", source: endpointSeed } : undefined,\n    serialize: serializeEndpointValue,\n    onChange: field.onChange,\n  });\n\n  if (allowWorkload) {\n    return (\n      <EndpointSelector\n        value={endpointValue}\n        onChange={changeEndpoint}\n        namespace={namespace}\n        modes={[\n          \"url\",\n          \"service\",\n          \"cluster-ip\",\n          \"api-proxy\",\n          \"ingress\",\n          \"port-forward\",\n        ]}\n        loadWorkloads={loadWorkloads}\n        urlSelector={{\n          loadResources,\n          loadKeyPreview,\n          loadServiceAccounts,\n          onePassword,\n          ...(urlSources ? { sources: urlSources } : {}),\n        }}\n        showPath\n        showIngressPort\n        allowCustomPort\n      />\n    );\n  }\n\n  return (\n    <SecretKeySelector\n      value={secretValue}\n      onChange={changeSecret}\n      loadResources={loadResources}\n      loadKeyPreview={loadKeyPreview}\n      loadServiceAccounts={loadServiceAccounts}\n      onePassword={onePassword}\n      {...(secretSources ? { sources: secretSources } : {})}\n    />\n  );\n}\n"],"names":["useState","useRef","useEffect","useCallback","useMemo","parseSecretRef","serializeSecretRef","parseEndpointValue","serializeEndpointValue","jsx","EndpointSelector","SecretKeySelector"],"mappings":";;;;;;;;AAwBA,SAAS,mBAAmB,QAA6C;AACvE,UAAQ,QAAA;AAAA,IACN,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,OAAO,GAAA;AAAA,IACjC,KAAK;AACH,aAAO,EAAE,MAAM,eAAe,KAAK,GAAA;AAAA,IACrC,KAAK;AACH,aAAO,EAAE,MAAM,kBAAkB,MAAM,GAAA;AAAA,IACzC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,MAAM,IAAI,KAAK,GAAA;AAAA,IACxC;AACE,aAAO;AAAA,EAAA;AAEb;AAEA,SAAS,cAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMmD;AACjD,QAAM,YAAY,OAAO,QAAQ,WAAW,MAAM;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAIA,eAAA;AAC1B,QAAM,YAAYC,MAAAA,OAAO,SAAS;AAElCC,QAAAA,UAAU,MAAM;AACd,QAAI,cAAc,UAAU,QAAS;AACrC,cAAU,UAAU;AACpB,aAAS,MAAS;AAAA,EACpB,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,SAASC,MAAAA;AAAAA,IACb,CAAC,SAAwB;AACvB,eAAS,IAAI;AACb,YAAM,aAAa,UAAU,IAAI;AACjC,gBAAU,UAAU;AACpB,eAAS,UAAU;AAAA,IACrB;AAAA,IACA,CAAC,UAAU,SAAS;AAAA,EAAA;AAGtB,SAAO,CAAC,SAAS,UAAU,QAAQ,MAAM;AAC3C;AAEO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAyB;AACvB,QAAM,gBAAgBA,MAAAA;AAAAA,IACpB,CAAC,SACC,QAAQ,cAAc,MAAM,SAAS;AAAA,IACvC,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,iBAAiBA,MAAAA;AAAAA,IACrB,CAAC,MAAoD,SACnD,QAAQ,eAAe,MAAM,MAAM,SAAS;AAAA,IAC9C,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,sBAAsBA,MAAAA;AAAAA,IAC1B,MAAM,QAAQ,oBAAoB,SAAS;AAAA,IAC3C,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,gBAAgBA,MAAAA;AAAAA,IACpB,CAAC,UACC,QAAQ,cAAc,WAAW,KAAK;AAAA,IACxC,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,cAAcC,MAAAA;AAAAA,IAClB,OAAO;AAAA,MACL,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,IAAA;AAAA,IAEtB,CAAC,OAAO;AAAA,EAAA;AAGV,QAAM,gBAAgB,MAAM,OAAO,yBAAyB;AAC5D,QAAM,CAAC,aAAa,YAAY,IAAI,cAA8B;AAAA,IAChE,KAAK,MAAM;AAAA,IACX,QAAQC,wBAAAA,eAAe,MAAM,KAAK;AAAA,IAClC,QAAQ,mBAAmB,aAAa;AAAA,IACxC,WAAWC,wBAAAA;AAAAA,IACX,UAAU,MAAM;AAAA,EAAA,CACjB;AACD,QAAM,eAAe,mBAAmB,aAAa;AACrD,QAAM,CAAC,eAAe,cAAc,IAAI,cAAqC;AAAA,IAC3E,KAAK,MAAM;AAAA,IACX,QAAQC,uBAAAA,mBAAmB,MAAM,KAAK;AAAA,IACtC,QAAQ,eAAe,EAAE,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IAC/D,WAAWC,uBAAAA;AAAAA,IACX,UAAU,MAAM;AAAA,EAAA,CACjB;AAED,MAAI,eAAe;AACjB,WACEC,2BAAAA;AAAAA,MAACC,iBAAAA;AAAAA,MAAA;AAAA,QACC,OAAO;AAAA,QACP,UAAU;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAAA,QAEF;AAAA,QACA,aAAa;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAI,aAAa,EAAE,SAAS,eAAe,CAAA;AAAA,QAAC;AAAA,QAE9C,UAAQ;AAAA,QACR,iBAAe;AAAA,QACf,iBAAe;AAAA,MAAA;AAAA,IAAA;AAAA,EAGrB;AAEA,SACED,2BAAAA;AAAAA,IAACE,kBAAAA;AAAAA,IAAA;AAAA,MACC,OAAO;AAAA,MACP,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACC,GAAI,gBAAgB,EAAE,SAAS,kBAAkB,CAAA;AAAA,IAAC;AAAA,EAAA;AAGzD;;"}

package/dist/components/SecretFormField.d.ts

@@ -0,0 +1,9 @@
+import { FieldControl } from './json-schema-form-types';
+import { SecretFormExtensionOptions } from './secret-form-extension';
+export type SecretFormFieldProps = SecretFormExtensionOptions & {
+    field: FieldControl;
+    namespace: string;
+    allowWorkload: boolean;
+};
+export declare function SecretFormField({ field, namespace, allowWorkload, loaders, secretSources, urlSources, }: SecretFormFieldProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SecretFormField.d.ts.map

package/dist/components/SecretFormField.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretFormField.d.ts","sourceRoot":"","sources":["../../src/components/SecretFormField.tsx"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,GAAG;IAC9D,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAuDF,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,SAAS,EACT,aAAa,EACb,OAAO,EACP,aAAa,EACb,UAAU,GACX,EAAE,oBAAoB,2CAsFtB"}

package/dist/components/SecretFormField.js

@@ -0,0 +1,142 @@
+import { jsx } from "react/jsx-runtime";
+import { useCallback, useMemo, useState, useRef, useEffect } from "react";
+import { EndpointSelector } from "./EndpointSelector.js";
+import { parseEndpointValue, serializeEndpointValue } from "./EndpointSelector.model.js";
+import { parseSecretRef, serializeSecretRef } from "./SecretKeySelector.model.js";
+import { SecretKeySelector } from "./SecretKeySelector.js";
+function defaultSecretValue(source) {
+  switch (source) {
+    case "value":
+      return { kind: "value", value: "" };
+    case "onepassword":
+      return { kind: "onepassword", ref: "" };
+    case "serviceaccount":
+      return { kind: "serviceaccount", name: "" };
+    case "secret":
+    case "configmap":
+    case "helm":
+      return { kind: source, name: "", key: "" };
+    default:
+      return void 0;
+  }
+}
+function useFieldDraft({
+  raw,
+  parsed,
+  seeded,
+  serialize,
+  onChange
+}) {
+  const rawString = typeof raw === "string" ? raw : "";
+  const [draft, setDraft] = useState();
+  const committed = useRef(rawString);
+  useEffect(() => {
+    if (rawString === committed.current) return;
+    committed.current = rawString;
+    setDraft(void 0);
+  }, [rawString]);
+  const commit = useCallback(
+    (next) => {
+      setDraft(next);
+      const serialized = serialize(next);
+      committed.current = serialized;
+      onChange(serialized);
+    },
+    [onChange, serialize]
+  );
+  return [draft ?? parsed ?? seeded, commit];
+}
+function SecretFormField({
+  field,
+  namespace,
+  allowWorkload,
+  loaders,
+  secretSources,
+  urlSources
+}) {
+  const loadResources = useCallback(
+    (kind) => loaders.loadResources(kind, namespace),
+    [loaders, namespace]
+  );
+  const loadKeyPreview = useCallback(
+    (kind, name) => loaders.loadKeyPreview(kind, name, namespace),
+    [loaders, namespace]
+  );
+  const loadServiceAccounts = useCallback(
+    () => loaders.loadServiceAccounts(namespace),
+    [loaders, namespace]
+  );
+  const loadWorkloads = useCallback(
+    (kinds) => loaders.loadWorkloads(namespace, kinds),
+    [loaders, namespace]
+  );
+  const onePassword = useMemo(
+    () => ({
+      loadVaults: loaders.loadOnePasswordVaults,
+      loadItems: loaders.loadOnePasswordItems,
+      loadFields: loaders.loadOnePasswordFields
+    }),
+    [loaders]
+  );
+  const defaultSource = field.schema["x-clicky-default-source"];
+  const [secretValue, changeSecret] = useFieldDraft({
+    raw: field.value,
+    parsed: parseSecretRef(field.value),
+    seeded: defaultSecretValue(defaultSource),
+    serialize: serializeSecretRef,
+    onChange: field.onChange
+  });
+  const endpointSeed = defaultSecretValue(defaultSource);
+  const [endpointValue, changeEndpoint] = useFieldDraft({
+    raw: field.value,
+    parsed: parseEndpointValue(field.value),
+    seeded: endpointSeed ? { mode: "url", source: endpointSeed } : void 0,
+    serialize: serializeEndpointValue,
+    onChange: field.onChange
+  });
+  if (allowWorkload) {
+    return /* @__PURE__ */ jsx(
+      EndpointSelector,
+      {
+        value: endpointValue,
+        onChange: changeEndpoint,
+        namespace,
+        modes: [
+          "url",
+          "service",
+          "cluster-ip",
+          "api-proxy",
+          "ingress",
+          "port-forward"
+        ],
+        loadWorkloads,
+        urlSelector: {
+          loadResources,
+          loadKeyPreview,
+          loadServiceAccounts,
+          onePassword,
+          ...urlSources ? { sources: urlSources } : {}
+        },
+        showPath: true,
+        showIngressPort: true,
+        allowCustomPort: true
+      }
+    );
+  }
+  return /* @__PURE__ */ jsx(
+    SecretKeySelector,
+    {
+      value: secretValue,
+      onChange: changeSecret,
+      loadResources,
+      loadKeyPreview,
+      loadServiceAccounts,
+      onePassword,
+      ...secretSources ? { sources: secretSources } : {}
+    }
+  );
+}
+export {
+  SecretFormField
+};
+//# sourceMappingURL=SecretFormField.js.map

package/dist/components/SecretFormField.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretFormField.js","sources":["../../src/components/SecretFormField.tsx"],"sourcesContent":["import { useCallback, useEffect, useMemo, useRef, useState } from \"react\";\nimport { EndpointSelector } from \"./EndpointSelector\";\nimport {\n  parseEndpointValue,\n  serializeEndpointValue,\n  type EndpointSelectorValue,\n} from \"./EndpointSelector.model\";\nimport {\n  parseSecretRef,\n  serializeSecretRef,\n} from \"./SecretKeySelector.model\";\nimport {\n  SecretKeySelector,\n  type SecretKeyValue,\n} from \"./SecretKeySelector\";\nimport type { FieldControl } from \"./json-schema-form-types\";\nimport type { SecretFormExtensionOptions } from \"./secret-form-extension\";\n\nexport type SecretFormFieldProps = SecretFormExtensionOptions & {\n  field: FieldControl;\n  namespace: string;\n  allowWorkload: boolean;\n};\n\nfunction defaultSecretValue(source: unknown): SecretKeyValue | undefined {\n  switch (source) {\n    case \"value\":\n      return { kind: \"value\", value: \"\" };\n    case \"onepassword\":\n      return { kind: \"onepassword\", ref: \"\" };\n    case \"serviceaccount\":\n      return { kind: \"serviceaccount\", name: \"\" };\n    case \"secret\":\n    case \"configmap\":\n    case \"helm\":\n      return { kind: source, name: \"\", key: \"\" };\n    default:\n      return undefined;\n  }\n}\n\nfunction useFieldDraft<T>({\n  raw,\n  parsed,\n  seeded,\n  serialize,\n  onChange,\n}: {\n  raw: unknown;\n  parsed: T | undefined;\n  seeded: T | undefined;\n  serialize: (next: T | undefined) => string;\n  onChange: (next: unknown) => void;\n}): [T | undefined, (next: T | undefined) => void] {\n  const rawString = typeof raw === \"string\" ? raw : \"\";\n  const [draft, setDraft] = useState<T | undefined>();\n  const committed = useRef(rawString);\n\n  useEffect(() => {\n    if (rawString === committed.current) return;\n    committed.current = rawString;\n    setDraft(undefined);\n  }, [rawString]);\n\n  const commit = useCallback(\n    (next: T | undefined) => {\n      setDraft(next);\n      const serialized = serialize(next);\n      committed.current = serialized;\n      onChange(serialized);\n    },\n    [onChange, serialize],\n  );\n\n  return [draft ?? parsed ?? seeded, commit];\n}\n\nexport function SecretFormField({\n  field,\n  namespace,\n  allowWorkload,\n  loaders,\n  secretSources,\n  urlSources,\n}: SecretFormFieldProps) {\n  const loadResources = useCallback(\n    (kind: Parameters<typeof loaders.loadResources>[0]) =>\n      loaders.loadResources(kind, namespace),\n    [loaders, namespace],\n  );\n  const loadKeyPreview = useCallback(\n    (kind: Parameters<typeof loaders.loadKeyPreview>[0], name: string) =>\n      loaders.loadKeyPreview(kind, name, namespace),\n    [loaders, namespace],\n  );\n  const loadServiceAccounts = useCallback(\n    () => loaders.loadServiceAccounts(namespace),\n    [loaders, namespace],\n  );\n  const loadWorkloads = useCallback(\n    (kinds: Parameters<typeof loaders.loadWorkloads>[1]) =>\n      loaders.loadWorkloads(namespace, kinds),\n    [loaders, namespace],\n  );\n  const onePassword = useMemo(\n    () => ({\n      loadVaults: loaders.loadOnePasswordVaults,\n      loadItems: loaders.loadOnePasswordItems,\n      loadFields: loaders.loadOnePasswordFields,\n    }),\n    [loaders],\n  );\n\n  const defaultSource = field.schema[\"x-clicky-default-source\"];\n  const [secretValue, changeSecret] = useFieldDraft<SecretKeyValue>({\n    raw: field.value,\n    parsed: parseSecretRef(field.value),\n    seeded: defaultSecretValue(defaultSource),\n    serialize: serializeSecretRef,\n    onChange: field.onChange,\n  });\n  const endpointSeed = defaultSecretValue(defaultSource);\n  const [endpointValue, changeEndpoint] = useFieldDraft<EndpointSelectorValue>({\n    raw: field.value,\n    parsed: parseEndpointValue(field.value),\n    seeded: endpointSeed ? { mode: \"url\", source: endpointSeed } : undefined,\n    serialize: serializeEndpointValue,\n    onChange: field.onChange,\n  });\n\n  if (allowWorkload) {\n    return (\n      <EndpointSelector\n        value={endpointValue}\n        onChange={changeEndpoint}\n        namespace={namespace}\n        modes={[\n          \"url\",\n          \"service\",\n          \"cluster-ip\",\n          \"api-proxy\",\n          \"ingress\",\n          \"port-forward\",\n        ]}\n        loadWorkloads={loadWorkloads}\n        urlSelector={{\n          loadResources,\n          loadKeyPreview,\n          loadServiceAccounts,\n          onePassword,\n          ...(urlSources ? { sources: urlSources } : {}),\n        }}\n        showPath\n        showIngressPort\n        allowCustomPort\n      />\n    );\n  }\n\n  return (\n    <SecretKeySelector\n      value={secretValue}\n      onChange={changeSecret}\n      loadResources={loadResources}\n      loadKeyPreview={loadKeyPreview}\n      loadServiceAccounts={loadServiceAccounts}\n      onePassword={onePassword}\n      {...(secretSources ? { sources: secretSources } : {})}\n    />\n  );\n}\n"],"names":[],"mappings":";;;;;;AAwBA,SAAS,mBAAmB,QAA6C;AACvE,UAAQ,QAAA;AAAA,IACN,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,OAAO,GAAA;AAAA,IACjC,KAAK;AACH,aAAO,EAAE,MAAM,eAAe,KAAK,GAAA;AAAA,IACrC,KAAK;AACH,aAAO,EAAE,MAAM,kBAAkB,MAAM,GAAA;AAAA,IACzC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,MAAM,IAAI,KAAK,GAAA;AAAA,IACxC;AACE,aAAO;AAAA,EAAA;AAEb;AAEA,SAAS,cAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMmD;AACjD,QAAM,YAAY,OAAO,QAAQ,WAAW,MAAM;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAA;AAC1B,QAAM,YAAY,OAAO,SAAS;AAElC,YAAU,MAAM;AACd,QAAI,cAAc,UAAU,QAAS;AACrC,cAAU,UAAU;AACpB,aAAS,MAAS;AAAA,EACpB,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,SAAS;AAAA,IACb,CAAC,SAAwB;AACvB,eAAS,IAAI;AACb,YAAM,aAAa,UAAU,IAAI;AACjC,gBAAU,UAAU;AACpB,eAAS,UAAU;AAAA,IACrB;AAAA,IACA,CAAC,UAAU,SAAS;AAAA,EAAA;AAGtB,SAAO,CAAC,SAAS,UAAU,QAAQ,MAAM;AAC3C;AAEO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAyB;AACvB,QAAM,gBAAgB;AAAA,IACpB,CAAC,SACC,QAAQ,cAAc,MAAM,SAAS;AAAA,IACvC,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,iBAAiB;AAAA,IACrB,CAAC,MAAoD,SACnD,QAAQ,eAAe,MAAM,MAAM,SAAS;AAAA,IAC9C,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,sBAAsB;AAAA,IAC1B,MAAM,QAAQ,oBAAoB,SAAS;AAAA,IAC3C,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,gBAAgB;AAAA,IACpB,CAAC,UACC,QAAQ,cAAc,WAAW,KAAK;AAAA,IACxC,CAAC,SAAS,SAAS;AAAA,EAAA;AAErB,QAAM,cAAc;AAAA,IAClB,OAAO;AAAA,MACL,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,IAAA;AAAA,IAEtB,CAAC,OAAO;AAAA,EAAA;AAGV,QAAM,gBAAgB,MAAM,OAAO,yBAAyB;AAC5D,QAAM,CAAC,aAAa,YAAY,IAAI,cAA8B;AAAA,IAChE,KAAK,MAAM;AAAA,IACX,QAAQ,eAAe,MAAM,KAAK;AAAA,IAClC,QAAQ,mBAAmB,aAAa;AAAA,IACxC,WAAW;AAAA,IACX,UAAU,MAAM;AAAA,EAAA,CACjB;AACD,QAAM,eAAe,mBAAmB,aAAa;AACrD,QAAM,CAAC,eAAe,cAAc,IAAI,cAAqC;AAAA,IAC3E,KAAK,MAAM;AAAA,IACX,QAAQ,mBAAmB,MAAM,KAAK;AAAA,IACtC,QAAQ,eAAe,EAAE,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IAC/D,WAAW;AAAA,IACX,UAAU,MAAM;AAAA,EAAA,CACjB;AAED,MAAI,eAAe;AACjB,WACE;AAAA,MAAC;AAAA,MAAA;AAAA,QACC,OAAO;AAAA,QACP,UAAU;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAAA,QAEF;AAAA,QACA,aAAa;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAI,aAAa,EAAE,SAAS,eAAe,CAAA;AAAA,QAAC;AAAA,QAE9C,UAAQ;AAAA,QACR,iBAAe;AAAA,QACf,iBAAe;AAAA,MAAA;AAAA,IAAA;AAAA,EAGrB;AAEA,SACE;AAAA,IAAC;AAAA,IAAA;AAAA,MACC,OAAO;AAAA,MACP,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACC,GAAI,gBAAgB,EAAE,SAAS,kBAAkB,CAAA;AAAA,IAAC;AAAA,EAAA;AAGzD;"}

package/dist/components/SecretKeySelector.cjs

@@ -6,6 +6,7 @@ const mi = require("@flanksource/icons/mi");
 const utils = require("../lib/utils.cjs");
 const Combobox = require("./Combobox.cjs");
 const iconMenuPicker = require("./icon-menu-picker.cjs");
+const OnePasswordSelector = require("./OnePasswordSelector.cjs");
 const UiEdit = require("../icons/components/UiEdit.cjs");
 const DEFAULT_SOURCES = ["secret", "configmap", "value"];
 const SHRINKABLE_FIELD = "max-w-full min-w-0 shrink";
@@ -19,6 +20,7 @@ function SecretKeySelector({
   loadResources,
   loadKeyPreview,
   loadServiceAccounts,
+  onePassword,
   sources,
   allowLiteral = true,
   strict = false,
@@ -103,7 +105,7 @@ function SecretKeySelector({
   };
   const setKey = (key) => selectedName ? onChange({ kind: refKind, name: selectedName, key }) : void 0;
   const setLiteral = (v) => onChange({ kind: "value", value: v });
-  const setOpRef = (v) => onChange({ kind: "onepassword", ref: v });
+  const setOpRef = (ref) => onChange({ kind: "onepassword", ref });
   const sourceOptions = react.useMemo(
     () => sourceList.map((k) => ({
       value: k,
@@ -174,16 +176,22 @@ function SecretKeySelector({
                 placeholder: "Static value…",
                 ariaLabel: "Static value"
               }
-            ) : isOnePassword ? /* @__PURE__ */ jsxRuntime.jsx(
-              TextField,
-              {
-                value: opRef,
-                onChange: setOpRef,
-                placeholder: "op://vault/item/field",
-                ariaLabel: "1Password reference",
-                mono: true
+            ) : isOnePassword ? (() => {
+              if (!onePassword) {
+                throw new Error(
+                  "SecretKeySelector onepassword source requires onePassword loaders"
+                );
               }
-            ) : isServiceAccount ? /* @__PURE__ */ jsxRuntime.jsx(
+              return /* @__PURE__ */ jsxRuntime.jsx("div", { className: VALUE_FIELD, "data-slot": "secret-onepassword-field", children: /* @__PURE__ */ jsxRuntime.jsx(
+                OnePasswordSelector.OnePasswordSelector,
+                {
+                  value: opRef,
+                  onChange: setOpRef,
+                  ...onePassword,
+                  allowCustomValue: true
+                }
+              ) });
+            })() : isServiceAccount ? /* @__PURE__ */ jsxRuntime.jsx(
               "div",
               {
                 className: VALUE_FIELD,
@@ -255,8 +263,7 @@ function TextField({
   value,
   onChange,
   placeholder,
-  ariaLabel,
-  mono
+  ariaLabel
 }) {
   return /* @__PURE__ */ jsxRuntime.jsx("div", { className: VALUE_FIELD, "data-slot": "secret-value-fields", children: /* @__PURE__ */ jsxRuntime.jsx(
     "input",
@@ -268,8 +275,7 @@ function TextField({
       "aria-label": ariaLabel,
       className: utils.cn(
         "h-control-h w-full min-w-0 rounded border border-input bg-background px-control-px text-sm",
-        "outline-none focus-visible:ring-2 focus-visible:ring-ring",
-        mono && "font-mono"
+        "outline-none focus-visible:ring-2 focus-visible:ring-ring"
       )
     }
   ) });

package/dist/components/SecretKeySelector.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SecretKeySelector.cjs","sources":["../../src/components/SecretKeySelector.tsx"],"sourcesContent":["import { createElement, useEffect, useMemo, useState } from \"react\";\nimport {\n  K8SSecret,\n  K8SConfigmap,\n  Helm,\n  K8SServiceaccount,\n  Vault,\n} from \"@flanksource/icons/mi\";\nimport { type StaticIconComponent } from \"../data/Icon\";\nimport { cn } from \"../lib/utils\";\nimport { UiEdit } from \"../icons\";\nimport { Combobox, type ComboboxOption } from \"./Combobox\";\nimport { IconMenuPicker, type IconMenuOption } from \"./icon-menu-picker\";\n\n// SecretKeySelector picks how a credential is sourced and lowers the choice into\n// a single reference string the consumer persists. It supports Kubernetes\n// Secrets and ConfigMaps (name + key), Helm release values (name + jsonpath\n// key), a service-account token (name only), a 1Password reference\n// (op://vault/item/field), and a static inline \"Value\". It is presentational:\n// it fetches nothing — the consumer supplies async `loadResources` /\n// `loadKeyPreview` (for keyed kinds) and optional `loadServiceAccounts` getters.\n\n/** Kinds that reference a named resource plus one of its keys. */\nexport type SecretKind = \"secret\" | \"configmap\" | \"helm\";\n\n/** Every source the picker can emit, including the non-keyed ones. */\nexport type SecretValueSource =\n  | SecretKind\n  | \"serviceaccount\"\n  | \"onepassword\"\n  | \"value\";\n\n/** One key's mid-masked preview. `value` is already masked by the consumer. */\nexport type KeyPreview = { key: string; value: string };\n\n/**\n * The selector's value: a {kind,name,key} reference into a Secret / ConfigMap /\n * Helm release, a service-account token by name, a 1Password op:// reference, or\n * a static inline literal.\n */\nexport type SecretKeyValue =\n  | { kind: SecretKind; name: string; key: string }\n  | { kind: \"serviceaccount\"; name: string }\n  | { kind: \"onepassword\"; ref: string }\n  | { kind: \"value\"; value: string };\n\n/** A named secret/configmap/helm-release and its data key names (values never returned). */\nexport type SecretResource = { name: string; keys?: string[] };\n\nexport type SecretKeySelectorProps = {\n  value: SecretKeyValue | undefined;\n  onChange: (next: SecretKeyValue | undefined) => void;\n  /** Loads the named keyed kind's resources (name + data key names). */\n  loadResources: (kind: SecretKind) => Promise<SecretResource[]>;\n  /** Loads mid-masked previews for the named keyed resource's keys. */\n  loadKeyPreview: (kind: SecretKind, name: string) => Promise<KeyPreview[]>;\n  /**\n   * Loads the service-account names (no keys) for the \"serviceaccount\" source.\n   * When omitted, that source's name field accepts freeform entry only.\n   */\n  loadServiceAccounts?: () => Promise<SecretResource[]>;\n  /**\n   * The sources offered in the picker, in order. Defaults to\n   * `[\"secret\", \"configmap\", \"value\"]` (or drops \"value\" when `allowLiteral` is\n   * false). Pass an explicit list to offer helm / serviceaccount / onepassword.\n   */\n  sources?: SecretValueSource[];\n  /**\n   * Shorthand honoured only when `sources` is not supplied: `false` drops the\n   * inline \"Value\" source, leaving Secret/ConfigMap. Ignored when `sources` is\n   * given.\n   */\n  allowLiteral?: boolean;\n  /**\n   * When true, a chosen name absent from the loaded resources, or a key absent\n   * from the chosen keyed resource's keys, is flagged invalid (once the load\n   * settles). The onepassword and literal sources are never strict-flagged.\n   */\n  strict?: boolean;\n  className?: string;\n};\n\nconst DEFAULT_SOURCES: SecretValueSource[] = [\"secret\", \"configmap\", \"value\"];\n\nconst SHRINKABLE_FIELD = \"max-w-full min-w-0 shrink\";\nconst SOURCE_FIELD = `${SHRINKABLE_FIELD} basis-40 grow-0`;\nconst RESOURCE_FIELD = `${SHRINKABLE_FIELD} basis-40 grow-0`;\nconst KEY_FIELD = `${SHRINKABLE_FIELD} basis-72 grow`;\nconst VALUE_FIELD = `${SHRINKABLE_FIELD} basis-64 grow`;\n\nexport function SecretKeySelector({\n  value,\n  onChange,\n  loadResources,\n  loadKeyPreview,\n  loadServiceAccounts,\n  sources,\n  allowLiteral = true,\n  strict = false,\n  className,\n}: SecretKeySelectorProps) {\n  const sourceList = useMemo<SecretValueSource[]>(\n    () => sources ?? (allowLiteral ? DEFAULT_SOURCES : [\"secret\", \"configmap\"]),\n    [sources, allowLiteral],\n  );\n\n  const source: SecretValueSource = value?.kind ?? sourceList[0] ?? \"secret\";\n  const isKeyed =\n    source === \"secret\" || source === \"configmap\" || source === \"helm\";\n  const isServiceAccount = source === \"serviceaccount\";\n  const isOnePassword = source === \"onepassword\";\n  const isLiteral = source === \"value\";\n  // A keyed source's refKind drives the loaders; other sources default to \"secret\".\n  const refKind: SecretKind = isKeyed ? (source as SecretKind) : \"secret\";\n\n  const selectedName =\n    value && (value.kind === \"serviceaccount\" || isRefKind(value))\n      ? value.name\n      : \"\";\n  const selectedKey = value && isRefKind(value) ? value.key : \"\";\n  const literalValue = value && value.kind === \"value\" ? value.value : \"\";\n  const opRef = value && value.kind === \"onepassword\" ? value.ref : \"\";\n\n  const [resources, setResources] = useState<SecretResource[]>([]);\n  const [resourcesLoading, setResourcesLoading] = useState(false);\n  const [previews, setPreviews] = useState<KeyPreview[]>([]);\n  const [previewLoading, setPreviewLoading] = useState(false);\n\n  // Load the name list for keyed kinds (secret/configmap/helm) and, when a\n  // loader is supplied, for the serviceaccount source. Other sources list nothing.\n  useEffect(() => {\n    const loader = isKeyed\n      ? () => loadResources(refKind)\n      : isServiceAccount && loadServiceAccounts\n        ? loadServiceAccounts\n        : null;\n    if (!loader) {\n      setResources([]);\n      return;\n    }\n    let cancelled = false;\n    setResourcesLoading(true);\n    loader()\n      .then((res) => !cancelled && setResources(res))\n      .finally(() => !cancelled && setResourcesLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadResources, loadServiceAccounts, refKind, isKeyed, isServiceAccount]);\n\n  useEffect(() => {\n    if (!isKeyed || !selectedName) {\n      setPreviews([]);\n      return;\n    }\n    let cancelled = false;\n    setPreviewLoading(true);\n    loadKeyPreview(refKind, selectedName)\n      .then((res) => !cancelled && setPreviews(res))\n      .catch(() => !cancelled && setPreviews([]))\n      .finally(() => !cancelled && setPreviewLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadKeyPreview, refKind, selectedName, isKeyed]);\n\n  const nameOptions = useMemo<ComboboxOption[]>(\n    () => resources.map((r) => ({ value: r.name, label: r.name })),\n    [resources],\n  );\n  const selectedResource = useMemo(\n    () => resources.find((r) => r.name === selectedName),\n    [resources, selectedName],\n  );\n  const keyOptions = useMemo(\n    () => buildKeyOptions(selectedResource?.keys ?? [], previews, selectedKey),\n    [selectedResource, selectedKey, previews],\n  );\n\n  // Strict validity: the name is invalid when it names no loaded resource; the\n  // key is invalid when, with a resolved resource, it isn't one of that\n  // resource's keys. Only names from a listed source are checked (a\n  // serviceaccount source with no loader lists nothing, so it never flags).\n  const listsNames = isKeyed || (isServiceAccount && !!loadServiceAccounts);\n  const nameInvalid =\n    strict &&\n    listsNames &&\n    !!selectedName &&\n    !resourcesLoading &&\n    !selectedResource;\n  const keyInvalid =\n    strict &&\n    isKeyed &&\n    !!selectedKey &&\n    !!selectedResource &&\n    !resourcesLoading &&\n    !(selectedResource.keys ?? []).includes(selectedKey);\n\n  const setSource = (next: SecretValueSource) => {\n    switch (next) {\n      case \"value\":\n        return onChange({ kind: \"value\", value: \"\" });\n      case \"onepassword\":\n        return onChange({ kind: \"onepassword\", ref: \"\" });\n      case \"serviceaccount\":\n        return onChange({ kind: \"serviceaccount\", name: \"\" });\n      default:\n        return onChange({ kind: next, name: \"\", key: \"\" });\n    }\n  };\n  const setName = (name: string) => {\n    if (isServiceAccount)\n      return onChange(name ? { kind: \"serviceaccount\", name } : undefined);\n    return onChange(\n      name ? { kind: refKind, name, key: selectedKey } : undefined,\n    );\n  };\n  const setKey = (key: string) =>\n    selectedName\n      ? onChange({ kind: refKind, name: selectedName, key })\n      : undefined;\n  const setLiteral = (v: string) => onChange({ kind: \"value\", value: v });\n  const setOpRef = (v: string) => onChange({ kind: \"onepassword\", ref: v });\n\n  const sourceOptions = useMemo<ComboboxOption[]>(\n    () =>\n      sourceList.map((k) => ({\n        value: k,\n        label: SOURCE_LABEL[k],\n        icon: createElement(SOURCE_ICON[k], { className: \"size-4\" }),\n      })),\n    [sourceList],\n  );\n  const sourceMenuOptions = useMemo<IconMenuOption<SecretValueSource>[]>(\n    () =>\n      sourceList.map((kind) => ({\n        value: kind,\n        label: SOURCE_LABEL[kind],\n        icon: SOURCE_ICON[kind],\n      })),\n    [sourceList],\n  );\n\n  return (\n    <div\n      data-slot=\"secret-key-selector\"\n      className={cn(\"@container w-full min-w-0\", className)}\n    >\n      <div\n        className=\"flex w-full max-w-full min-w-0 flex-nowrap items-center gap-2\"\n        data-slot=\"secret-fields\"\n      >\n        <div\n          className={cn(SOURCE_FIELD, \"@max-md:hidden\")}\n          data-slot=\"secret-source-combobox\"\n        >\n          <Combobox\n            ariaLabel=\"Secret value source\"\n            options={sourceOptions}\n            value={source}\n            onChange={(next) => setSource(next as SecretValueSource)}\n            allowCustomValue={false}\n            required\n          />\n        </div>\n        <div\n          className=\"hidden shrink-0 @max-md:!block\"\n          data-slot=\"secret-source-menu\"\n        >\n          <IconMenuPicker\n            value={source}\n            onChange={setSource}\n            options={sourceMenuOptions}\n            ariaLabel=\"Secret value source\"\n            triggerClassName=\"size-control-h rounded-md border border-input bg-background\"\n          />\n        </div>\n        {isLiteral ? (\n          <TextField\n            value={literalValue}\n            onChange={setLiteral}\n            placeholder=\"Static value…\"\n            ariaLabel=\"Static value\"\n          />\n        ) : isOnePassword ? (\n          <TextField\n            value={opRef}\n            onChange={setOpRef}\n            placeholder=\"op://vault/item/field\"\n            ariaLabel=\"1Password reference\"\n            mono\n          />\n        ) : isServiceAccount ? (\n          <div\n            className={VALUE_FIELD}\n            data-slot=\"secret-serviceaccount-field\"\n          >\n            <Combobox\n              options={nameOptions}\n              value={selectedName}\n              onChange={setName}\n              allowCustomValue\n              loading={resourcesLoading}\n              invalid={nameInvalid}\n              placeholder=\"Service account…\"\n            />\n          </div>\n        ) : (\n          <div\n            className={cn(\n              \"flex flex-nowrap items-center gap-2\",\n              SHRINKABLE_FIELD,\n              \"grow\",\n            )}\n            data-slot=\"secret-reference-fields\"\n          >\n            <div\n              className={RESOURCE_FIELD}\n              data-slot=\"secret-resource-field\"\n            >\n              <Combobox\n                options={nameOptions}\n                value={selectedName}\n                onChange={setName}\n                allowCustomValue\n                loading={resourcesLoading}\n                invalid={nameInvalid}\n                placeholder={`Select ${refKind}…`}\n              />\n            </div>\n            <div className={KEY_FIELD} data-slot=\"secret-key-field\">\n              <Combobox\n                options={keyOptions}\n                value={selectedKey}\n                onChange={setKey}\n                allowCustomValue\n                loading={previewLoading}\n                invalid={keyInvalid}\n                placeholder={selectedName ? keyPlaceholder(refKind) : \"—\"}\n              />\n            </div>\n          </div>\n        )}\n      </div>\n    </div>\n  );\n}\n\n// TextField is the shared single-input surface for the literal and 1Password\n// sources (no resource list backs either).\nfunction TextField({\n  value,\n  onChange,\n  placeholder,\n  ariaLabel,\n  mono,\n}: {\n  value: string;\n  onChange: (v: string) => void;\n  placeholder: string;\n  ariaLabel: string;\n  mono?: boolean;\n}) {\n  return (\n    <div className={VALUE_FIELD} data-slot=\"secret-value-fields\">\n      <input\n        type=\"text\"\n        value={value}\n        onChange={(e) => onChange(e.target.value)}\n        placeholder={placeholder}\n        aria-label={ariaLabel}\n        className={cn(\n          \"h-control-h w-full min-w-0 rounded border border-input bg-background px-control-px text-sm\",\n          \"outline-none focus-visible:ring-2 focus-visible:ring-ring\",\n          mono && \"font-mono\",\n        )}\n      />\n    </div>\n  );\n}\n\n// isRefKind narrows to the keyed variants that carry both a name and a key.\nfunction isRefKind(\n  v: SecretKeyValue,\n): v is { kind: SecretKind; name: string; key: string } {\n  return v.kind === \"secret\" || v.kind === \"configmap\" || v.kind === \"helm\";\n}\n\n// keyPlaceholder hints the key field: helm keys are jsonpath expressions into\n// the merged release values, the others are literal data keys.\nfunction keyPlaceholder(kind: SecretKind): string {\n  return kind === \"helm\" ? \"jsonpath…\" : \"Key…\";\n}\n\n// Each source's leading glyph. The flanksource FCs carry static metadata that\n// doesn't unify with ComponentType, so type the slot as a plain render function.\nconst SOURCE_ICON: Record<SecretValueSource, StaticIconComponent> = {\n  secret: K8SSecret,\n  configmap: K8SConfigmap,\n  helm: Helm,\n  serviceaccount: K8SServiceaccount,\n  onepassword: Vault,\n  value: UiEdit,\n};\n\nconst SOURCE_LABEL: Record<SecretValueSource, string> = {\n  secret: \"Secret\",\n  configmap: \"ConfigMap\",\n  helm: \"Helm\",\n  serviceaccount: \"Service Account\",\n  onepassword: \"1Password\",\n  value: \"Value\",\n};\n\n// buildKeyOptions labels each key with its mid-masked preview value when one is\n// available. A selected key absent from the list is pinned so the selection\n// stays visible.\nfunction buildKeyOptions(\n  keys: string[],\n  previews: KeyPreview[],\n  selectedKey: string,\n): ComboboxOption[] {\n  const masked = new Map(previews.map((p) => [p.key, p.value]));\n  const base = keys.map((k) => ({\n    value: k,\n    label: masked.has(k) ? `${k} — ${masked.get(k)}` : k,\n  }));\n  if (selectedKey && !base.some((o) => o.value === selectedKey)) {\n    return [{ value: selectedKey, label: selectedKey }, ...base];\n  }\n  return base;\n}\n"],"names":["useMemo","useState","useEffect","createElement","jsx","cn","jsxs","Combobox","IconMenuPicker","K8SSecret","K8SConfigmap","Helm","K8SServiceaccount","Vault","UiEdit"],"mappings":";;;;;;;;;AAkFA,MAAM,kBAAuC,CAAC,UAAU,aAAa,OAAO;AAE5E,MAAM,mBAAmB;AACzB,MAAM,eAAe,GAAG,gBAAgB;AACxC,MAAM,iBAAiB,GAAG,gBAAgB;AAC1C,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,cAAc,GAAG,gBAAgB;AAEhC,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf,SAAS;AAAA,EACT;AACF,GAA2B;AACzB,QAAM,aAAaA,MAAAA;AAAAA,IACjB,MAAM,YAAY,eAAe,kBAAkB,CAAC,UAAU,WAAW;AAAA,IACzE,CAAC,SAAS,YAAY;AAAA,EAAA;AAGxB,QAAM,UAA4B,+BAAO,SAAQ,WAAW,CAAC,KAAK;AAClE,QAAM,UACJ,WAAW,YAAY,WAAW,eAAe,WAAW;AAC9D,QAAM,mBAAmB,WAAW;AACpC,QAAM,gBAAgB,WAAW;AACjC,QAAM,YAAY,WAAW;AAE7B,QAAM,UAAsB,UAAW,SAAwB;AAE/D,QAAM,eACJ,UAAU,MAAM,SAAS,oBAAoB,UAAU,KAAK,KACxD,MAAM,OACN;AACN,QAAM,cAAc,SAAS,UAAU,KAAK,IAAI,MAAM,MAAM;AAC5D,QAAM,eAAe,SAAS,MAAM,SAAS,UAAU,MAAM,QAAQ;AACrE,QAAM,QAAQ,SAAS,MAAM,SAAS,gBAAgB,MAAM,MAAM;AAElE,QAAM,CAAC,WAAW,YAAY,IAAIC,MAAAA,SAA2B,CAAA,CAAE;AAC/D,QAAM,CAAC,kBAAkB,mBAAmB,IAAIA,MAAAA,SAAS,KAAK;AAC9D,QAAM,CAAC,UAAU,WAAW,IAAIA,MAAAA,SAAuB,CAAA,CAAE;AACzD,QAAM,CAAC,gBAAgB,iBAAiB,IAAIA,MAAAA,SAAS,KAAK;AAI1DC,QAAAA,UAAU,MAAM;AACd,UAAM,SAAS,UACX,MAAM,cAAc,OAAO,IAC3B,oBAAoB,sBAClB,sBACA;AACN,QAAI,CAAC,QAAQ;AACX,mBAAa,CAAA,CAAE;AACf;AAAA,IACF;AACA,QAAI,YAAY;AAChB,wBAAoB,IAAI;AACxB,WAAA,EACG,KAAK,CAAC,QAAQ,CAAC,aAAa,aAAa,GAAG,CAAC,EAC7C,QAAQ,MAAM,CAAC,aAAa,oBAAoB,KAAK,CAAC;AACzD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,eAAe,qBAAqB,SAAS,SAAS,gBAAgB,CAAC;AAE3EA,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,cAAc;AAC7B,kBAAY,CAAA,CAAE;AACd;AAAA,IACF;AACA,QAAI,YAAY;AAChB,sBAAkB,IAAI;AACtB,mBAAe,SAAS,YAAY,EACjC,KAAK,CAAC,QAAQ,CAAC,aAAa,YAAY,GAAG,CAAC,EAC5C,MAAM,MAAM,CAAC,aAAa,YAAY,CAAA,CAAE,CAAC,EACzC,QAAQ,MAAM,CAAC,aAAa,kBAAkB,KAAK,CAAC;AACvD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,gBAAgB,SAAS,cAAc,OAAO,CAAC;AAEnD,QAAM,cAAcF,MAAAA;AAAAA,IAClB,MAAM,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,KAAA,EAAO;AAAA,IAC7D,CAAC,SAAS;AAAA,EAAA;AAEZ,QAAM,mBAAmBA,MAAAA;AAAAA,IACvB,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY;AAAA,IACnD,CAAC,WAAW,YAAY;AAAA,EAAA;AAE1B,QAAM,aAAaA,MAAAA;AAAAA,IACjB,MAAM,iBAAgB,qDAAkB,SAAQ,CAAA,GAAI,UAAU,WAAW;AAAA,IACzE,CAAC,kBAAkB,aAAa,QAAQ;AAAA,EAAA;AAO1C,QAAM,aAAa,WAAY,oBAAoB,CAAC,CAAC;AACrD,QAAM,cACJ,UACA,cACA,CAAC,CAAC,gBACF,CAAC,oBACD,CAAC;AACH,QAAM,aACJ,UACA,WACA,CAAC,CAAC,eACF,CAAC,CAAC,oBACF,CAAC,oBACD,EAAE,iBAAiB,QAAQ,CAAA,GAAI,SAAS,WAAW;AAErD,QAAM,YAAY,CAAC,SAA4B;AAC7C,YAAQ,MAAA;AAAA,MACN,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,SAAS,OAAO,IAAI;AAAA,MAC9C,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,eAAe,KAAK,IAAI;AAAA,MAClD,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,kBAAkB,MAAM,IAAI;AAAA,MACtD;AACE,eAAO,SAAS,EAAE,MAAM,MAAM,MAAM,IAAI,KAAK,IAAI;AAAA,IAAA;AAAA,EAEvD;AACA,QAAM,UAAU,CAAC,SAAiB;AAChC,QAAI;AACF,aAAO,SAAS,OAAO,EAAE,MAAM,kBAAkB,KAAA,IAAS,MAAS;AACrE,WAAO;AAAA,MACL,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK,gBAAgB;AAAA,IAAA;AAAA,EAEvD;AACA,QAAM,SAAS,CAAC,QACd,eACI,SAAS,EAAE,MAAM,SAAS,MAAM,cAAc,IAAA,CAAK,IACnD;AACN,QAAM,aAAa,CAAC,MAAc,SAAS,EAAE,MAAM,SAAS,OAAO,GAAG;AACtE,QAAM,WAAW,CAAC,MAAc,SAAS,EAAE,MAAM,eAAe,KAAK,GAAG;AAExE,QAAM,gBAAgBA,MAAAA;AAAAA,IACpB,MACE,WAAW,IAAI,CAAC,OAAO;AAAA,MACrB,OAAO;AAAA,MACP,OAAO,aAAa,CAAC;AAAA,MACrB,MAAMG,MAAAA,cAAc,YAAY,CAAC,GAAG,EAAE,WAAW,UAAU;AAAA,IAAA,EAC3D;AAAA,IACJ,CAAC,UAAU;AAAA,EAAA;AAEb,QAAM,oBAAoBH,MAAAA;AAAAA,IACxB,MACE,WAAW,IAAI,CAAC,UAAU;AAAA,MACxB,OAAO;AAAA,MACP,OAAO,aAAa,IAAI;AAAA,MACxB,MAAM,YAAY,IAAI;AAAA,IAAA,EACtB;AAAA,IACJ,CAAC,UAAU;AAAA,EAAA;AAGb,SACEI,2BAAAA;AAAAA,IAAC;AAAA,IAAA;AAAA,MACC,aAAU;AAAA,MACV,WAAWC,MAAAA,GAAG,6BAA6B,SAAS;AAAA,MAEpD,UAAAC,2BAAAA;AAAAA,QAAC;AAAA,QAAA;AAAA,UACC,WAAU;AAAA,UACV,aAAU;AAAA,UAEV,UAAA;AAAA,YAAAF,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAWC,MAAAA,GAAG,cAAc,gBAAgB;AAAA,gBAC5C,aAAU;AAAA,gBAEV,UAAAD,2BAAAA;AAAAA,kBAACG,SAAAA;AAAAA,kBAAA;AAAA,oBACC,WAAU;AAAA,oBACV,SAAS;AAAA,oBACT,OAAO;AAAA,oBACP,UAAU,CAAC,SAAS,UAAU,IAAyB;AAAA,oBACvD,kBAAkB;AAAA,oBAClB,UAAQ;AAAA,kBAAA;AAAA,gBAAA;AAAA,cACV;AAAA,YAAA;AAAA,YAEFH,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAU;AAAA,gBACV,aAAU;AAAA,gBAEV,UAAAA,2BAAAA;AAAAA,kBAACI,eAAAA;AAAAA,kBAAA;AAAA,oBACC,OAAO;AAAA,oBACP,UAAU;AAAA,oBACV,SAAS;AAAA,oBACT,WAAU;AAAA,oBACV,kBAAiB;AAAA,kBAAA;AAAA,gBAAA;AAAA,cACnB;AAAA,YAAA;AAAA,YAED,YACCJ,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,OAAO;AAAA,gBACP,UAAU;AAAA,gBACV,aAAY;AAAA,gBACZ,WAAU;AAAA,cAAA;AAAA,YAAA,IAEV,gBACFA,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,OAAO;AAAA,gBACP,UAAU;AAAA,gBACV,aAAY;AAAA,gBACZ,WAAU;AAAA,gBACV,MAAI;AAAA,cAAA;AAAA,YAAA,IAEJ,mBACFA,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAW;AAAA,gBACX,aAAU;AAAA,gBAEV,UAAAA,2BAAAA;AAAAA,kBAACG,SAAAA;AAAAA,kBAAA;AAAA,oBACC,SAAS;AAAA,oBACT,OAAO;AAAA,oBACP,UAAU;AAAA,oBACV,kBAAgB;AAAA,oBAChB,SAAS;AAAA,oBACT,SAAS;AAAA,oBACT,aAAY;AAAA,kBAAA;AAAA,gBAAA;AAAA,cACd;AAAA,YAAA,IAGFD,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAWD,MAAAA;AAAAA,kBACT;AAAA,kBACA;AAAA,kBACA;AAAA,gBAAA;AAAA,gBAEF,aAAU;AAAA,gBAEV,UAAA;AAAA,kBAAAD,2BAAAA;AAAAA,oBAAC;AAAA,oBAAA;AAAA,sBACC,WAAW;AAAA,sBACX,aAAU;AAAA,sBAEV,UAAAA,2BAAAA;AAAAA,wBAACG,SAAAA;AAAAA,wBAAA;AAAA,0BACC,SAAS;AAAA,0BACT,OAAO;AAAA,0BACP,UAAU;AAAA,0BACV,kBAAgB;AAAA,0BAChB,SAAS;AAAA,0BACT,SAAS;AAAA,0BACT,aAAa,UAAU,OAAO;AAAA,wBAAA;AAAA,sBAAA;AAAA,oBAChC;AAAA,kBAAA;AAAA,kBAEFH,2BAAAA,IAAC,OAAA,EAAI,WAAW,WAAW,aAAU,oBACnC,UAAAA,2BAAAA;AAAAA,oBAACG,SAAAA;AAAAA,oBAAA;AAAA,sBACC,SAAS;AAAA,sBACT,OAAO;AAAA,sBACP,UAAU;AAAA,sBACV,kBAAgB;AAAA,sBAChB,SAAS;AAAA,sBACT,SAAS;AAAA,sBACT,aAAa,eAAe,eAAe,OAAO,IAAI;AAAA,oBAAA;AAAA,kBAAA,EACxD,CACF;AAAA,gBAAA;AAAA,cAAA;AAAA,YAAA;AAAA,UACF;AAAA,QAAA;AAAA,MAAA;AAAA,IAEJ;AAAA,EAAA;AAGN;AAIA,SAAS,UAAU;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,SACEH,2BAAAA,IAAC,OAAA,EAAI,WAAW,aAAa,aAAU,uBACrC,UAAAA,2BAAAA;AAAAA,IAAC;AAAA,IAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,MACxC;AAAA,MACA,cAAY;AAAA,MACZ,WAAWC,MAAAA;AAAAA,QACT;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MAAA;AAAA,IACV;AAAA,EAAA,GAEJ;AAEJ;AAGA,SAAS,UACP,GACsD;AACtD,SAAO,EAAE,SAAS,YAAY,EAAE,SAAS,eAAe,EAAE,SAAS;AACrE;AAIA,SAAS,eAAe,MAA0B;AAChD,SAAO,SAAS,SAAS,cAAc;AACzC;AAIA,MAAM,cAA8D;AAAA,EAClE,QAAQI,GAAAA;AAAAA,EACR,WAAWC,GAAAA;AAAAA,EACX,MAAMC,GAAAA;AAAAA,EACN,gBAAgBC,GAAAA;AAAAA,EAChB,aAAaC,GAAAA;AAAAA,EACb,OAAOC,OAAAA;AACT;AAEA,MAAM,eAAkD;AAAA,EACtD,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,MAAM;AAAA,EACN,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,OAAO;AACT;AAKA,SAAS,gBACP,MACA,UACA,aACkB;AAClB,QAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5D,QAAM,OAAO,KAAK,IAAI,CAAC,OAAO;AAAA,IAC5B,OAAO;AAAA,IACP,OAAO,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC,KAAK;AAAA,EAAA,EACnD;AACF,MAAI,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,WAAW,GAAG;AAC7D,WAAO,CAAC,EAAE,OAAO,aAAa,OAAO,YAAA,GAAe,GAAG,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;;"}
+{"version":3,"file":"SecretKeySelector.cjs","sources":["../../src/components/SecretKeySelector.tsx"],"sourcesContent":["import { createElement, useEffect, useMemo, useState } from \"react\";\nimport {\n  K8SSecret,\n  K8SConfigmap,\n  Helm,\n  K8SServiceaccount,\n  Vault,\n} from \"@flanksource/icons/mi\";\nimport { type StaticIconComponent } from \"../data/Icon\";\nimport { cn } from \"../lib/utils\";\nimport { UiEdit } from \"../icons\";\nimport { Combobox, type ComboboxOption } from \"./Combobox\";\nimport { IconMenuPicker, type IconMenuOption } from \"./icon-menu-picker\";\nimport { OnePasswordSelector } from \"./OnePasswordSelector\";\nimport type { OnePasswordLoaders } from \"./OnePasswordSelector.model\";\n\n// SecretKeySelector picks how a credential is sourced and lowers the choice into\n// a single reference string the consumer persists. It supports Kubernetes\n// Secrets and ConfigMaps (name + key), Helm release values (name + jsonpath\n// key), a service-account token (name only), a 1Password reference\n// (op://vault/item/field), and a static inline \"Value\". It is presentational:\n// it fetches nothing — the consumer supplies async `loadResources` /\n// `loadKeyPreview` (for keyed kinds) and optional `loadServiceAccounts` getters.\n\n/** Kinds that reference a named resource plus one of its keys. */\nexport type SecretKind = \"secret\" | \"configmap\" | \"helm\";\n\n/** Every source the picker can emit, including the non-keyed ones. */\nexport type SecretValueSource =\n  | SecretKind\n  | \"serviceaccount\"\n  | \"onepassword\"\n  | \"value\";\n\n/** One key's mid-masked preview. `value` is already masked by the consumer. */\nexport type KeyPreview = { key: string; value: string };\n\n/**\n * The selector's value: a {kind,name,key} reference into a Secret / ConfigMap /\n * Helm release, a service-account token by name, a 1Password op:// reference, or\n * a static inline literal.\n */\nexport type SecretKeyValue =\n  | { kind: SecretKind; name: string; key: string }\n  | { kind: \"serviceaccount\"; name: string }\n  | { kind: \"onepassword\"; ref: string }\n  | { kind: \"value\"; value: string };\n\n/** A named secret/configmap/helm-release and its data key names (values never returned). */\nexport type SecretResource = { name: string; keys?: string[] };\n\nexport type SecretKeySelectorProps = {\n  value: SecretKeyValue | undefined;\n  onChange: (next: SecretKeyValue | undefined) => void;\n  /** Loads the named keyed kind's resources (name + data key names). */\n  loadResources: (kind: SecretKind) => Promise<SecretResource[]>;\n  /** Loads mid-masked previews for the named keyed resource's keys. */\n  loadKeyPreview: (kind: SecretKind, name: string) => Promise<KeyPreview[]>;\n  /**\n   * Loads the service-account names (no keys) for the \"serviceaccount\" source.\n   * When omitted, that source's name field accepts freeform entry only.\n   */\n  loadServiceAccounts?: () => Promise<SecretResource[]>;\n  /** Loads metadata for the cascading 1Password vault, item, and field pickers. */\n  onePassword?: OnePasswordLoaders;\n  /**\n   * The sources offered in the picker, in order. Defaults to\n   * `[\"secret\", \"configmap\", \"value\"]` (or drops \"value\" when `allowLiteral` is\n   * false). Pass an explicit list to offer helm / serviceaccount / onepassword.\n   */\n  sources?: SecretValueSource[];\n  /**\n   * Shorthand honoured only when `sources` is not supplied: `false` drops the\n   * inline \"Value\" source, leaving Secret/ConfigMap. Ignored when `sources` is\n   * given.\n   */\n  allowLiteral?: boolean;\n  /**\n   * When true, a chosen name absent from the loaded resources, or a key absent\n   * from the chosen keyed resource's keys, is flagged invalid (once the load\n   * settles). The onepassword and literal sources are never strict-flagged.\n   */\n  strict?: boolean;\n  className?: string;\n};\n\nconst DEFAULT_SOURCES: SecretValueSource[] = [\"secret\", \"configmap\", \"value\"];\n\nconst SHRINKABLE_FIELD = \"max-w-full min-w-0 shrink\";\nconst SOURCE_FIELD = `${SHRINKABLE_FIELD} basis-40 grow-0`;\nconst RESOURCE_FIELD = `${SHRINKABLE_FIELD} basis-40 grow-0`;\nconst KEY_FIELD = `${SHRINKABLE_FIELD} basis-72 grow`;\nconst VALUE_FIELD = `${SHRINKABLE_FIELD} basis-64 grow`;\n\nexport function SecretKeySelector({\n  value,\n  onChange,\n  loadResources,\n  loadKeyPreview,\n  loadServiceAccounts,\n  onePassword,\n  sources,\n  allowLiteral = true,\n  strict = false,\n  className,\n}: SecretKeySelectorProps) {\n  const sourceList = useMemo<SecretValueSource[]>(\n    () => sources ?? (allowLiteral ? DEFAULT_SOURCES : [\"secret\", \"configmap\"]),\n    [sources, allowLiteral],\n  );\n\n  const source: SecretValueSource = value?.kind ?? sourceList[0] ?? \"secret\";\n  const isKeyed =\n    source === \"secret\" || source === \"configmap\" || source === \"helm\";\n  const isServiceAccount = source === \"serviceaccount\";\n  const isOnePassword = source === \"onepassword\";\n  const isLiteral = source === \"value\";\n  // A keyed source's refKind drives the loaders; other sources default to \"secret\".\n  const refKind: SecretKind = isKeyed ? (source as SecretKind) : \"secret\";\n\n  const selectedName =\n    value && (value.kind === \"serviceaccount\" || isRefKind(value))\n      ? value.name\n      : \"\";\n  const selectedKey = value && isRefKind(value) ? value.key : \"\";\n  const literalValue = value && value.kind === \"value\" ? value.value : \"\";\n  const opRef = value && value.kind === \"onepassword\" ? value.ref : \"\";\n\n  const [resources, setResources] = useState<SecretResource[]>([]);\n  const [resourcesLoading, setResourcesLoading] = useState(false);\n  const [previews, setPreviews] = useState<KeyPreview[]>([]);\n  const [previewLoading, setPreviewLoading] = useState(false);\n\n  // Load the name list for keyed kinds (secret/configmap/helm) and, when a\n  // loader is supplied, for the serviceaccount source. Other sources list nothing.\n  useEffect(() => {\n    const loader = isKeyed\n      ? () => loadResources(refKind)\n      : isServiceAccount && loadServiceAccounts\n        ? loadServiceAccounts\n        : null;\n    if (!loader) {\n      setResources([]);\n      return;\n    }\n    let cancelled = false;\n    setResourcesLoading(true);\n    loader()\n      .then((res) => !cancelled && setResources(res))\n      .finally(() => !cancelled && setResourcesLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadResources, loadServiceAccounts, refKind, isKeyed, isServiceAccount]);\n\n  useEffect(() => {\n    if (!isKeyed || !selectedName) {\n      setPreviews([]);\n      return;\n    }\n    let cancelled = false;\n    setPreviewLoading(true);\n    loadKeyPreview(refKind, selectedName)\n      .then((res) => !cancelled && setPreviews(res))\n      .catch(() => !cancelled && setPreviews([]))\n      .finally(() => !cancelled && setPreviewLoading(false));\n    return () => {\n      cancelled = true;\n    };\n  }, [loadKeyPreview, refKind, selectedName, isKeyed]);\n\n  const nameOptions = useMemo<ComboboxOption[]>(\n    () => resources.map((r) => ({ value: r.name, label: r.name })),\n    [resources],\n  );\n  const selectedResource = useMemo(\n    () => resources.find((r) => r.name === selectedName),\n    [resources, selectedName],\n  );\n  const keyOptions = useMemo(\n    () => buildKeyOptions(selectedResource?.keys ?? [], previews, selectedKey),\n    [selectedResource, selectedKey, previews],\n  );\n\n  // Strict validity: the name is invalid when it names no loaded resource; the\n  // key is invalid when, with a resolved resource, it isn't one of that\n  // resource's keys. Only names from a listed source are checked (a\n  // serviceaccount source with no loader lists nothing, so it never flags).\n  const listsNames = isKeyed || (isServiceAccount && !!loadServiceAccounts);\n  const nameInvalid =\n    strict &&\n    listsNames &&\n    !!selectedName &&\n    !resourcesLoading &&\n    !selectedResource;\n  const keyInvalid =\n    strict &&\n    isKeyed &&\n    !!selectedKey &&\n    !!selectedResource &&\n    !resourcesLoading &&\n    !(selectedResource.keys ?? []).includes(selectedKey);\n\n  const setSource = (next: SecretValueSource) => {\n    switch (next) {\n      case \"value\":\n        return onChange({ kind: \"value\", value: \"\" });\n      case \"onepassword\":\n        return onChange({ kind: \"onepassword\", ref: \"\" });\n      case \"serviceaccount\":\n        return onChange({ kind: \"serviceaccount\", name: \"\" });\n      default:\n        return onChange({ kind: next, name: \"\", key: \"\" });\n    }\n  };\n  const setName = (name: string) => {\n    if (isServiceAccount)\n      return onChange(name ? { kind: \"serviceaccount\", name } : undefined);\n    return onChange(\n      name ? { kind: refKind, name, key: selectedKey } : undefined,\n    );\n  };\n  const setKey = (key: string) =>\n    selectedName\n      ? onChange({ kind: refKind, name: selectedName, key })\n      : undefined;\n  const setLiteral = (v: string) => onChange({ kind: \"value\", value: v });\n  const setOpRef = (ref: string) => onChange({ kind: \"onepassword\", ref });\n\n  const sourceOptions = useMemo<ComboboxOption[]>(\n    () =>\n      sourceList.map((k) => ({\n        value: k,\n        label: SOURCE_LABEL[k],\n        icon: createElement(SOURCE_ICON[k], { className: \"size-4\" }),\n      })),\n    [sourceList],\n  );\n  const sourceMenuOptions = useMemo<IconMenuOption<SecretValueSource>[]>(\n    () =>\n      sourceList.map((kind) => ({\n        value: kind,\n        label: SOURCE_LABEL[kind],\n        icon: SOURCE_ICON[kind],\n      })),\n    [sourceList],\n  );\n\n  return (\n    <div\n      data-slot=\"secret-key-selector\"\n      className={cn(\"@container w-full min-w-0\", className)}\n    >\n      <div\n        className=\"flex w-full max-w-full min-w-0 flex-nowrap items-center gap-2\"\n        data-slot=\"secret-fields\"\n      >\n        <div\n          className={cn(SOURCE_FIELD, \"@max-md:hidden\")}\n          data-slot=\"secret-source-combobox\"\n        >\n          <Combobox\n            ariaLabel=\"Secret value source\"\n            options={sourceOptions}\n            value={source}\n            onChange={(next) => setSource(next as SecretValueSource)}\n            allowCustomValue={false}\n            required\n          />\n        </div>\n        <div\n          className=\"hidden shrink-0 @max-md:!block\"\n          data-slot=\"secret-source-menu\"\n        >\n          <IconMenuPicker\n            value={source}\n            onChange={setSource}\n            options={sourceMenuOptions}\n            ariaLabel=\"Secret value source\"\n            triggerClassName=\"size-control-h rounded-md border border-input bg-background\"\n          />\n        </div>\n        {isLiteral ? (\n          <TextField\n            value={literalValue}\n            onChange={setLiteral}\n            placeholder=\"Static value…\"\n            ariaLabel=\"Static value\"\n          />\n        ) : isOnePassword ? (\n          (() => {\n            if (!onePassword) {\n              throw new Error(\n                \"SecretKeySelector onepassword source requires onePassword loaders\",\n              );\n            }\n            return (\n              <div className={VALUE_FIELD} data-slot=\"secret-onepassword-field\">\n                <OnePasswordSelector\n                  value={opRef}\n                  onChange={setOpRef}\n                  {...onePassword}\n                  allowCustomValue\n                />\n              </div>\n            );\n          })()\n        ) : isServiceAccount ? (\n          <div\n            className={VALUE_FIELD}\n            data-slot=\"secret-serviceaccount-field\"\n          >\n            <Combobox\n              options={nameOptions}\n              value={selectedName}\n              onChange={setName}\n              allowCustomValue\n              loading={resourcesLoading}\n              invalid={nameInvalid}\n              placeholder=\"Service account…\"\n            />\n          </div>\n        ) : (\n          <div\n            className={cn(\n              \"flex flex-nowrap items-center gap-2\",\n              SHRINKABLE_FIELD,\n              \"grow\",\n            )}\n            data-slot=\"secret-reference-fields\"\n          >\n            <div\n              className={RESOURCE_FIELD}\n              data-slot=\"secret-resource-field\"\n            >\n              <Combobox\n                options={nameOptions}\n                value={selectedName}\n                onChange={setName}\n                allowCustomValue\n                loading={resourcesLoading}\n                invalid={nameInvalid}\n                placeholder={`Select ${refKind}…`}\n              />\n            </div>\n            <div className={KEY_FIELD} data-slot=\"secret-key-field\">\n              <Combobox\n                options={keyOptions}\n                value={selectedKey}\n                onChange={setKey}\n                allowCustomValue\n                loading={previewLoading}\n                invalid={keyInvalid}\n                placeholder={selectedName ? keyPlaceholder(refKind) : \"—\"}\n              />\n            </div>\n          </div>\n        )}\n      </div>\n    </div>\n  );\n}\n\nfunction TextField({\n  value,\n  onChange,\n  placeholder,\n  ariaLabel,\n}: {\n  value: string;\n  onChange: (v: string) => void;\n  placeholder: string;\n  ariaLabel: string;\n}) {\n  return (\n    <div className={VALUE_FIELD} data-slot=\"secret-value-fields\">\n      <input\n        type=\"text\"\n        value={value}\n        onChange={(e) => onChange(e.target.value)}\n        placeholder={placeholder}\n        aria-label={ariaLabel}\n        className={cn(\n          \"h-control-h w-full min-w-0 rounded border border-input bg-background px-control-px text-sm\",\n          \"outline-none focus-visible:ring-2 focus-visible:ring-ring\",\n        )}\n      />\n    </div>\n  );\n}\n\n// isRefKind narrows to the keyed variants that carry both a name and a key.\nfunction isRefKind(\n  v: SecretKeyValue,\n): v is { kind: SecretKind; name: string; key: string } {\n  return v.kind === \"secret\" || v.kind === \"configmap\" || v.kind === \"helm\";\n}\n\n// keyPlaceholder hints the key field: helm keys are jsonpath expressions into\n// the merged release values, the others are literal data keys.\nfunction keyPlaceholder(kind: SecretKind): string {\n  return kind === \"helm\" ? \"jsonpath…\" : \"Key…\";\n}\n\n// Each source's leading glyph. The flanksource FCs carry static metadata that\n// doesn't unify with ComponentType, so type the slot as a plain render function.\nconst SOURCE_ICON: Record<SecretValueSource, StaticIconComponent> = {\n  secret: K8SSecret,\n  configmap: K8SConfigmap,\n  helm: Helm,\n  serviceaccount: K8SServiceaccount,\n  onepassword: Vault,\n  value: UiEdit,\n};\n\nconst SOURCE_LABEL: Record<SecretValueSource, string> = {\n  secret: \"Secret\",\n  configmap: \"ConfigMap\",\n  helm: \"Helm\",\n  serviceaccount: \"Service Account\",\n  onepassword: \"1Password\",\n  value: \"Value\",\n};\n\n// buildKeyOptions labels each key with its mid-masked preview value when one is\n// available. A selected key absent from the list is pinned so the selection\n// stays visible.\nfunction buildKeyOptions(\n  keys: string[],\n  previews: KeyPreview[],\n  selectedKey: string,\n): ComboboxOption[] {\n  const masked = new Map(previews.map((p) => [p.key, p.value]));\n  const base = keys.map((k) => ({\n    value: k,\n    label: masked.has(k) ? `${k} — ${masked.get(k)}` : k,\n  }));\n  if (selectedKey && !base.some((o) => o.value === selectedKey)) {\n    return [{ value: selectedKey, label: selectedKey }, ...base];\n  }\n  return base;\n}\n"],"names":["useMemo","useState","useEffect","createElement","jsx","cn","jsxs","Combobox","IconMenuPicker","OnePasswordSelector","K8SSecret","K8SConfigmap","Helm","K8SServiceaccount","Vault","UiEdit"],"mappings":";;;;;;;;;;AAsFA,MAAM,kBAAuC,CAAC,UAAU,aAAa,OAAO;AAE5E,MAAM,mBAAmB;AACzB,MAAM,eAAe,GAAG,gBAAgB;AACxC,MAAM,iBAAiB,GAAG,gBAAgB;AAC1C,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,cAAc,GAAG,gBAAgB;AAEhC,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EACf,SAAS;AAAA,EACT;AACF,GAA2B;AACzB,QAAM,aAAaA,MAAAA;AAAAA,IACjB,MAAM,YAAY,eAAe,kBAAkB,CAAC,UAAU,WAAW;AAAA,IACzE,CAAC,SAAS,YAAY;AAAA,EAAA;AAGxB,QAAM,UAA4B,+BAAO,SAAQ,WAAW,CAAC,KAAK;AAClE,QAAM,UACJ,WAAW,YAAY,WAAW,eAAe,WAAW;AAC9D,QAAM,mBAAmB,WAAW;AACpC,QAAM,gBAAgB,WAAW;AACjC,QAAM,YAAY,WAAW;AAE7B,QAAM,UAAsB,UAAW,SAAwB;AAE/D,QAAM,eACJ,UAAU,MAAM,SAAS,oBAAoB,UAAU,KAAK,KACxD,MAAM,OACN;AACN,QAAM,cAAc,SAAS,UAAU,KAAK,IAAI,MAAM,MAAM;AAC5D,QAAM,eAAe,SAAS,MAAM,SAAS,UAAU,MAAM,QAAQ;AACrE,QAAM,QAAQ,SAAS,MAAM,SAAS,gBAAgB,MAAM,MAAM;AAElE,QAAM,CAAC,WAAW,YAAY,IAAIC,MAAAA,SAA2B,CAAA,CAAE;AAC/D,QAAM,CAAC,kBAAkB,mBAAmB,IAAIA,MAAAA,SAAS,KAAK;AAC9D,QAAM,CAAC,UAAU,WAAW,IAAIA,MAAAA,SAAuB,CAAA,CAAE;AACzD,QAAM,CAAC,gBAAgB,iBAAiB,IAAIA,MAAAA,SAAS,KAAK;AAI1DC,QAAAA,UAAU,MAAM;AACd,UAAM,SAAS,UACX,MAAM,cAAc,OAAO,IAC3B,oBAAoB,sBAClB,sBACA;AACN,QAAI,CAAC,QAAQ;AACX,mBAAa,CAAA,CAAE;AACf;AAAA,IACF;AACA,QAAI,YAAY;AAChB,wBAAoB,IAAI;AACxB,WAAA,EACG,KAAK,CAAC,QAAQ,CAAC,aAAa,aAAa,GAAG,CAAC,EAC7C,QAAQ,MAAM,CAAC,aAAa,oBAAoB,KAAK,CAAC;AACzD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,eAAe,qBAAqB,SAAS,SAAS,gBAAgB,CAAC;AAE3EA,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,cAAc;AAC7B,kBAAY,CAAA,CAAE;AACd;AAAA,IACF;AACA,QAAI,YAAY;AAChB,sBAAkB,IAAI;AACtB,mBAAe,SAAS,YAAY,EACjC,KAAK,CAAC,QAAQ,CAAC,aAAa,YAAY,GAAG,CAAC,EAC5C,MAAM,MAAM,CAAC,aAAa,YAAY,CAAA,CAAE,CAAC,EACzC,QAAQ,MAAM,CAAC,aAAa,kBAAkB,KAAK,CAAC;AACvD,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,gBAAgB,SAAS,cAAc,OAAO,CAAC;AAEnD,QAAM,cAAcF,MAAAA;AAAAA,IAClB,MAAM,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,KAAA,EAAO;AAAA,IAC7D,CAAC,SAAS;AAAA,EAAA;AAEZ,QAAM,mBAAmBA,MAAAA;AAAAA,IACvB,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY;AAAA,IACnD,CAAC,WAAW,YAAY;AAAA,EAAA;AAE1B,QAAM,aAAaA,MAAAA;AAAAA,IACjB,MAAM,iBAAgB,qDAAkB,SAAQ,CAAA,GAAI,UAAU,WAAW;AAAA,IACzE,CAAC,kBAAkB,aAAa,QAAQ;AAAA,EAAA;AAO1C,QAAM,aAAa,WAAY,oBAAoB,CAAC,CAAC;AACrD,QAAM,cACJ,UACA,cACA,CAAC,CAAC,gBACF,CAAC,oBACD,CAAC;AACH,QAAM,aACJ,UACA,WACA,CAAC,CAAC,eACF,CAAC,CAAC,oBACF,CAAC,oBACD,EAAE,iBAAiB,QAAQ,CAAA,GAAI,SAAS,WAAW;AAErD,QAAM,YAAY,CAAC,SAA4B;AAC7C,YAAQ,MAAA;AAAA,MACN,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,SAAS,OAAO,IAAI;AAAA,MAC9C,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,eAAe,KAAK,IAAI;AAAA,MAClD,KAAK;AACH,eAAO,SAAS,EAAE,MAAM,kBAAkB,MAAM,IAAI;AAAA,MACtD;AACE,eAAO,SAAS,EAAE,MAAM,MAAM,MAAM,IAAI,KAAK,IAAI;AAAA,IAAA;AAAA,EAEvD;AACA,QAAM,UAAU,CAAC,SAAiB;AAChC,QAAI;AACF,aAAO,SAAS,OAAO,EAAE,MAAM,kBAAkB,KAAA,IAAS,MAAS;AACrE,WAAO;AAAA,MACL,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK,gBAAgB;AAAA,IAAA;AAAA,EAEvD;AACA,QAAM,SAAS,CAAC,QACd,eACI,SAAS,EAAE,MAAM,SAAS,MAAM,cAAc,IAAA,CAAK,IACnD;AACN,QAAM,aAAa,CAAC,MAAc,SAAS,EAAE,MAAM,SAAS,OAAO,GAAG;AACtE,QAAM,WAAW,CAAC,QAAgB,SAAS,EAAE,MAAM,eAAe,KAAK;AAEvE,QAAM,gBAAgBA,MAAAA;AAAAA,IACpB,MACE,WAAW,IAAI,CAAC,OAAO;AAAA,MACrB,OAAO;AAAA,MACP,OAAO,aAAa,CAAC;AAAA,MACrB,MAAMG,MAAAA,cAAc,YAAY,CAAC,GAAG,EAAE,WAAW,UAAU;AAAA,IAAA,EAC3D;AAAA,IACJ,CAAC,UAAU;AAAA,EAAA;AAEb,QAAM,oBAAoBH,MAAAA;AAAAA,IACxB,MACE,WAAW,IAAI,CAAC,UAAU;AAAA,MACxB,OAAO;AAAA,MACP,OAAO,aAAa,IAAI;AAAA,MACxB,MAAM,YAAY,IAAI;AAAA,IAAA,EACtB;AAAA,IACJ,CAAC,UAAU;AAAA,EAAA;AAGb,SACEI,2BAAAA;AAAAA,IAAC;AAAA,IAAA;AAAA,MACC,aAAU;AAAA,MACV,WAAWC,MAAAA,GAAG,6BAA6B,SAAS;AAAA,MAEpD,UAAAC,2BAAAA;AAAAA,QAAC;AAAA,QAAA;AAAA,UACC,WAAU;AAAA,UACV,aAAU;AAAA,UAEV,UAAA;AAAA,YAAAF,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAWC,MAAAA,GAAG,cAAc,gBAAgB;AAAA,gBAC5C,aAAU;AAAA,gBAEV,UAAAD,2BAAAA;AAAAA,kBAACG,SAAAA;AAAAA,kBAAA;AAAA,oBACC,WAAU;AAAA,oBACV,SAAS;AAAA,oBACT,OAAO;AAAA,oBACP,UAAU,CAAC,SAAS,UAAU,IAAyB;AAAA,oBACvD,kBAAkB;AAAA,oBAClB,UAAQ;AAAA,kBAAA;AAAA,gBAAA;AAAA,cACV;AAAA,YAAA;AAAA,YAEFH,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAU;AAAA,gBACV,aAAU;AAAA,gBAEV,UAAAA,2BAAAA;AAAAA,kBAACI,eAAAA;AAAAA,kBAAA;AAAA,oBACC,OAAO;AAAA,oBACP,UAAU;AAAA,oBACV,SAAS;AAAA,oBACT,WAAU;AAAA,oBACV,kBAAiB;AAAA,kBAAA;AAAA,gBAAA;AAAA,cACnB;AAAA,YAAA;AAAA,YAED,YACCJ,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,OAAO;AAAA,gBACP,UAAU;AAAA,gBACV,aAAY;AAAA,gBACZ,WAAU;AAAA,cAAA;AAAA,YAAA,IAEV,iBACD,MAAM;AACL,kBAAI,CAAC,aAAa;AAChB,sBAAM,IAAI;AAAA,kBACR;AAAA,gBAAA;AAAA,cAEJ;AACA,qBACEA,2BAAAA,IAAC,OAAA,EAAI,WAAW,aAAa,aAAU,4BACrC,UAAAA,2BAAAA;AAAAA,gBAACK,oBAAAA;AAAAA,gBAAA;AAAA,kBACC,OAAO;AAAA,kBACP,UAAU;AAAA,kBACT,GAAG;AAAA,kBACJ,kBAAgB;AAAA,gBAAA;AAAA,cAAA,GAEpB;AAAA,YAEJ,GAAA,IACE,mBACFL,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAW;AAAA,gBACX,aAAU;AAAA,gBAEV,UAAAA,2BAAAA;AAAAA,kBAACG,SAAAA;AAAAA,kBAAA;AAAA,oBACC,SAAS;AAAA,oBACT,OAAO;AAAA,oBACP,UAAU;AAAA,oBACV,kBAAgB;AAAA,oBAChB,SAAS;AAAA,oBACT,SAAS;AAAA,oBACT,aAAY;AAAA,kBAAA;AAAA,gBAAA;AAAA,cACd;AAAA,YAAA,IAGFD,2BAAAA;AAAAA,cAAC;AAAA,cAAA;AAAA,gBACC,WAAWD,MAAAA;AAAAA,kBACT;AAAA,kBACA;AAAA,kBACA;AAAA,gBAAA;AAAA,gBAEF,aAAU;AAAA,gBAEV,UAAA;AAAA,kBAAAD,2BAAAA;AAAAA,oBAAC;AAAA,oBAAA;AAAA,sBACC,WAAW;AAAA,sBACX,aAAU;AAAA,sBAEV,UAAAA,2BAAAA;AAAAA,wBAACG,SAAAA;AAAAA,wBAAA;AAAA,0BACC,SAAS;AAAA,0BACT,OAAO;AAAA,0BACP,UAAU;AAAA,0BACV,kBAAgB;AAAA,0BAChB,SAAS;AAAA,0BACT,SAAS;AAAA,0BACT,aAAa,UAAU,OAAO;AAAA,wBAAA;AAAA,sBAAA;AAAA,oBAChC;AAAA,kBAAA;AAAA,kBAEFH,2BAAAA,IAAC,OAAA,EAAI,WAAW,WAAW,aAAU,oBACnC,UAAAA,2BAAAA;AAAAA,oBAACG,SAAAA;AAAAA,oBAAA;AAAA,sBACC,SAAS;AAAA,sBACT,OAAO;AAAA,sBACP,UAAU;AAAA,sBACV,kBAAgB;AAAA,sBAChB,SAAS;AAAA,sBACT,SAAS;AAAA,sBACT,aAAa,eAAe,eAAe,OAAO,IAAI;AAAA,oBAAA;AAAA,kBAAA,EACxD,CACF;AAAA,gBAAA;AAAA,cAAA;AAAA,YAAA;AAAA,UACF;AAAA,QAAA;AAAA,MAAA;AAAA,IAEJ;AAAA,EAAA;AAGN;AAEA,SAAS,UAAU;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKG;AACD,SACEH,2BAAAA,IAAC,OAAA,EAAI,WAAW,aAAa,aAAU,uBACrC,UAAAA,2BAAAA;AAAAA,IAAC;AAAA,IAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,MACxC;AAAA,MACA,cAAY;AAAA,MACZ,WAAWC,MAAAA;AAAAA,QACT;AAAA,QACA;AAAA,MAAA;AAAA,IACF;AAAA,EAAA,GAEJ;AAEJ;AAGA,SAAS,UACP,GACsD;AACtD,SAAO,EAAE,SAAS,YAAY,EAAE,SAAS,eAAe,EAAE,SAAS;AACrE;AAIA,SAAS,eAAe,MAA0B;AAChD,SAAO,SAAS,SAAS,cAAc;AACzC;AAIA,MAAM,cAA8D;AAAA,EAClE,QAAQK,GAAAA;AAAAA,EACR,WAAWC,GAAAA;AAAAA,EACX,MAAMC,GAAAA;AAAAA,EACN,gBAAgBC,GAAAA;AAAAA,EAChB,aAAaC,GAAAA;AAAAA,EACb,OAAOC,OAAAA;AACT;AAEA,MAAM,eAAkD;AAAA,EACtD,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,MAAM;AAAA,EACN,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,OAAO;AACT;AAKA,SAAS,gBACP,MACA,UACA,aACkB;AAClB,QAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5D,QAAM,OAAO,KAAK,IAAI,CAAC,OAAO;AAAA,IAC5B,OAAO;AAAA,IACP,OAAO,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC,KAAK;AAAA,EAAA,EACnD;AACF,MAAI,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,WAAW,GAAG;AAC7D,WAAO,CAAC,EAAE,OAAO,aAAa,OAAO,YAAA,GAAe,GAAG,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;;"}

package/dist/components/SecretKeySelector.d.ts

@@ -1,3 +1,4 @@
+import { OnePasswordLoaders } from './OnePasswordSelector.model';
 /** Kinds that reference a named resource plus one of its keys. */
 export type SecretKind = "secret" | "configmap" | "helm";
 /** Every source the picker can emit, including the non-keyed ones. */
@@ -43,6 +44,8 @@ export type SecretKeySelectorProps = {
      * When omitted, that source's name field accepts freeform entry only.
      */
     loadServiceAccounts?: () => Promise<SecretResource[]>;
+    /** Loads metadata for the cascading 1Password vault, item, and field pickers. */
+    onePassword?: OnePasswordLoaders;
     /**
      * The sources offered in the picker, in order. Defaults to
      * `["secret", "configmap", "value"]` (or drops "value" when `allowLiteral` is
@@ -63,5 +66,5 @@ export type SecretKeySelectorProps = {
     strict?: boolean;
     className?: string;
 };
-export declare function SecretKeySelector({ value, onChange, loadResources, loadKeyPreview, loadServiceAccounts, sources, allowLiteral, strict, className, }: SecretKeySelectorProps): import("react/jsx-runtime").JSX.Element;
+export declare function SecretKeySelector({ value, onChange, loadResources, loadKeyPreview, loadServiceAccounts, onePassword, sources, allowLiteral, strict, className, }: SecretKeySelectorProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=SecretKeySelector.d.ts.map

package/dist/components/SecretKeySelector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecretKeySelector.d.ts","sourceRoot":"","sources":["../../src/components/SecretKeySelector.tsx"],"names":[],"mappings":"AAsBA,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;AAEzD,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,OAAO,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,cAAc,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;IACrD,sEAAsE;IACtE,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/D,qEAAqE;IACrE,cAAc,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACtD;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAUF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,OAAO,EACP,YAAmB,EACnB,MAAc,EACd,SAAS,GACV,EAAE,sBAAsB,2CAsPxB"}
+{"version":3,"file":"SecretKeySelector.d.ts","sourceRoot":"","sources":["../../src/components/SecretKeySelector.tsx"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAUtE,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;AAEzD,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,OAAO,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,cAAc,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;IACrD,sEAAsE;IACtE,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/D,qEAAqE;IACrE,cAAc,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACtD,iFAAiF;IACjF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAUF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,OAAO,EACP,YAAmB,EACnB,MAAc,EACd,SAAS,GACV,EAAE,sBAAsB,2CAgQxB"}

package/dist/components/SecretKeySelector.js

@@ -4,6 +4,7 @@ import { Vault, K8SServiceaccount, Helm, K8SConfigmap, K8SSecret } from "@flanks
 import { cn } from "../lib/utils.js";
 import { Combobox } from "./Combobox.js";
 import { IconMenuPicker } from "./icon-menu-picker.js";
+import { OnePasswordSelector } from "./OnePasswordSelector.js";
 import { UiEdit } from "../icons/components/UiEdit.js";
 const DEFAULT_SOURCES = ["secret", "configmap", "value"];
 const SHRINKABLE_FIELD = "max-w-full min-w-0 shrink";
@@ -17,6 +18,7 @@ function SecretKeySelector({
   loadResources,
   loadKeyPreview,
   loadServiceAccounts,
+  onePassword,
   sources,
   allowLiteral = true,
   strict = false,
@@ -101,7 +103,7 @@ function SecretKeySelector({
   };
   const setKey = (key) => selectedName ? onChange({ kind: refKind, name: selectedName, key }) : void 0;
   const setLiteral = (v) => onChange({ kind: "value", value: v });
-  const setOpRef = (v) => onChange({ kind: "onepassword", ref: v });
+  const setOpRef = (ref) => onChange({ kind: "onepassword", ref });
   const sourceOptions = useMemo(
     () => sourceList.map((k) => ({
       value: k,
@@ -172,16 +174,22 @@ function SecretKeySelector({
                 placeholder: "Static value…",
                 ariaLabel: "Static value"
               }
-            ) : isOnePassword ? /* @__PURE__ */ jsx(
-              TextField,
-              {
-                value: opRef,
-                onChange: setOpRef,
-                placeholder: "op://vault/item/field",
-                ariaLabel: "1Password reference",
-                mono: true
+            ) : isOnePassword ? (() => {
+              if (!onePassword) {
+                throw new Error(
+                  "SecretKeySelector onepassword source requires onePassword loaders"
+                );
               }
-            ) : isServiceAccount ? /* @__PURE__ */ jsx(
+              return /* @__PURE__ */ jsx("div", { className: VALUE_FIELD, "data-slot": "secret-onepassword-field", children: /* @__PURE__ */ jsx(
+                OnePasswordSelector,
+                {
+                  value: opRef,
+                  onChange: setOpRef,
+                  ...onePassword,
+                  allowCustomValue: true
+                }
+              ) });
+            })() : isServiceAccount ? /* @__PURE__ */ jsx(
               "div",
               {
                 className: VALUE_FIELD,
@@ -253,8 +261,7 @@ function TextField({
   value,
   onChange,
   placeholder,
-  ariaLabel,
-  mono
+  ariaLabel
 }) {
   return /* @__PURE__ */ jsx("div", { className: VALUE_FIELD, "data-slot": "secret-value-fields", children: /* @__PURE__ */ jsx(
     "input",
@@ -266,8 +273,7 @@ function TextField({
       "aria-label": ariaLabel,
       className: cn(
         "h-control-h w-full min-w-0 rounded border border-input bg-background px-control-px text-sm",
-        "outline-none focus-visible:ring-2 focus-visible:ring-ring",
-        mono && "font-mono"
+        "outline-none focus-visible:ring-2 focus-visible:ring-ring"
       )
     }
   ) });