@konfig.ts/k8s 0.0.1

package/dist/index.mjs

@@ -0,0 +1,1008 @@
+import { Dep, Manifest, RenderError, brand, unsafeCoerce } from "@konfig.ts/core";
+import { Data, Effect, Layer, Match, Redacted } from "effect";
+import { Environment as Environment$1, Secret as Secret$1, runtime } from "@konfig.ts/env";
+import { createHash } from "node:crypto";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/.generated/k8s-types/index.ts
+var k8s_types_exports = /* @__PURE__ */ __exportAll({});
+//#endregion
+//#region src/container.ts
+/**
+* `Container` value namespace.
+*
+*   const apiContainer = Container.define({
+*     name: "api",
+*     image: apiImage,
+*     ports: [Port.make({ name: "http", containerPort: 8080 })],
+*     readinessProbe: { httpGet: { port: Port.ref("http") } },
+*     env: [...],
+*   });
+*
+* `Container.define` captures the union of named ports (from
+* `Port.make`) as `Ports`, the union of mounted volume names (from
+* `Volume.mountRef`) as `Mounts`, and validates that the `env` list
+* has no duplicate env-var names. The first two phantoms travel on
+* `ContainerSpec`; `Pod.define` checks the container's Mounts against
+* the pod's declared volume names.
+*
+* Duplicate env names are caught at the call site via a template-literal
+* error message — see `EnvDupCheck`. With no volumeMounts and no env,
+* all phantoms collapse to `never` so the container slots into any pod.
+*/
+const Container = { define: (input) => {
+	return {
+		...input,
+		ports: unsafeCoerce(input.ports, "Ports tuple's element brands are the same PortName<N>; widening Ports → readonly ContainerPort<P>[] only changes the static shape, not the runtime values"),
+		readinessProbe: input.readinessProbe,
+		livenessProbe: input.livenessProbe,
+		startupProbe: input.startupProbe,
+		volumeMounts: unsafeCoerce(input.volumeMounts, "Mounts tuple's element brands are the same VolumeMount<N>; widening Mounts → readonly VolumeMount<M>[] preserves runtime shape"),
+		env: unsafeCoerce(input.env, "EnvDupCheck<Envs> intersection vanishes at runtime; the runtime value is the original EnvVar[]")
+	};
+} };
+/**
+* `Pod` value namespace.
+*
+*   const pod = Pod.define({
+*     volumes: [Volume.empty({ name: "config" })],
+*     containers: [Container.define({ ..., volumeMounts: [...] })],
+*   });
+*
+*   imagePullSecrets: [Pod.imagePullSecret(ghcrRef)],
+*
+* - `Pod.define(input)` ties container `volumeMounts[i].name` to the
+*   pod's declared volume names via `NoInfer`.
+* - `Pod.imagePullSecret(ref)` returns the `{ name: SecretRef }` entry
+*   consumed by Deployment / StatefulSet / Job / CronJob workloads.
+*/
+const Pod = {
+	define: (input) => ({
+		volumes: unsafeCoerce(input.volumes, "V tuple's elements are Volume<N>; widening V → readonly Volume<VolumeNamesOf<V>>[] is a structural relaxation, runtime value unchanged"),
+		containers: input.containers,
+		initContainers: input.initContainers
+	}),
+	imagePullSecret: (ref) => ({ name: ref })
+};
+//#endregion
+//#region src/ports.ts
+const _portName = (name) => brand(name);
+/**
+* `Port` value namespace.
+*
+*   ports: [Port.make({ name: "http", containerPort: 8080 })],
+*   readinessProbe: { httpGet: { port: Port.ref("http") } },
+*
+* - `Port.make(input)` constructs a named container port; the literal
+*   `name` is captured in the returned `ContainerPort<N>` brand so
+*   `Container` can infer the port-name union and constrain
+*   cross-references (probes, Service.targetPort).
+* - `Port.ref(name)` returns the brand alone, for probe targets and
+*   `targetPort` references that need to name an existing declared port.
+*/
+const Port = {
+	make: (input) => ({
+		containerPort: input.containerPort,
+		name: _portName(input.name),
+		protocol: input.protocol,
+		hostPort: input.hostPort,
+		hostIP: input.hostIP
+	}),
+	ref: (name) => _portName(name)
+};
+//#endregion
+//#region src/env.ts
+/**
+* `EnvVar` value namespace.
+*
+*   env: [
+*     EnvVar.value({ name: "PORT", value: "8080" }),
+*     EnvVar.fromSecret({ name: "DB_URL", ref: dbCreds.ref, key: "url" }),
+*     EnvVar.fromSecretForPod({
+*       name: "DB_URL_PRIMARY", ref: dbCreds.ref, key: "url",
+*       podNamespace: "app",
+*     }),
+*     EnvVar.fromConfigMap({ name: "NEW_UI", ref: flags.ref, key: "NEW_UI" }),
+*     EnvVar.raw({ name: "POD_NAME", valueFrom: { fieldRef: ... } }),
+*   ]
+*
+* Each constructor captures the literal env-var name (`N`) so
+* `Container` can detect duplicate entries across the env list.
+*/
+const EnvVar = {
+	value: (input) => ({
+		name: input.name,
+		value: input.value
+	}),
+	fromSecret: (input) => ({
+		name: input.name,
+		valueFrom: { secretKeyRef: {
+			name: input.ref,
+			key: input.key,
+			optional: input.optional
+		} }
+	}),
+	/**
+	* Namespace-checked variant. The ref's namespace slot (`Ns`) must
+	* match `podNamespace`. Catches "pod in namespace A references a
+	* Secret in namespace B" at compile time — kube-apiserver only
+	* resolves `valueFrom.secretKeyRef` against the pod's own namespace,
+	* so cross-namespace refs are runtime errors.
+	*/
+	fromSecretForPod: (input) => ({
+		name: input.name,
+		valueFrom: { secretKeyRef: {
+			name: input.ref,
+			key: input.key,
+			optional: input.optional
+		} }
+	}),
+	fromConfigMap: (input) => ({
+		name: input.name,
+		valueFrom: { configMapKeyRef: {
+			name: input.ref,
+			key: input.key,
+			optional: input.optional
+		} }
+	}),
+	raw: (input) => input
+};
+//#endregion
+//#region src/refs.ts
+const SecretRef = {
+	of: (name) => brand(name),
+	/**
+	* Escape hatch — widen a typed ref's namespace slot to `any`, making
+	* it usable across any pod context. Use sparingly (legitimate
+	* cross-namespace cases: ExternalSecret reflection, in-cluster
+	* shared infra). The cast is grep-able so PR reviewers see opt-ins.
+	*/
+	unsafeReNamespace: (ref) => ref
+};
+const ConfigMapRef = { of: (name) => brand(name) };
+const ServiceAccountRef = { of: (name) => brand(name) };
+const PvcRef = { of: (name) => brand(name) };
+//#endregion
+//#region src/identity.ts
+const Namespace = { make: (input) => {
+	const resource = {
+		apiVersion: "v1",
+		kind: "Namespace",
+		metadata: {
+			name: input.name,
+			labels: input.labels,
+			annotations: input.annotations
+		}
+	};
+	const m = Manifest.make(() => Effect.succeed(resource));
+	return Object.assign(m, { ref: input.name });
+} };
+const ServiceAccount = { make: (input) => {
+	const resource = {
+		apiVersion: "v1",
+		kind: "ServiceAccount",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations
+		},
+		automountServiceAccountToken: input.automountServiceAccountToken,
+		imagePullSecrets: input.imagePullSecrets?.map((s) => ({ name: s.name }))
+	};
+	const m = Manifest.make(() => Effect.succeed(resource));
+	return Object.assign(m, { ref: ServiceAccountRef.of(input.name) });
+} };
+const ConfigMap = { make: (input) => {
+	const resource = {
+		apiVersion: "v1",
+		kind: "ConfigMap",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations
+		},
+		data: input.data,
+		binaryData: input.binaryData,
+		immutable: input.immutable
+	};
+	const m = Manifest.make(() => Effect.succeed(resource));
+	return Object.assign(m, { ref: ConfigMapRef.of(input.name) });
+} };
+const Secret$2 = { make: (input) => {
+	const resource = {
+		apiVersion: "v1",
+		kind: "Secret",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations
+		},
+		type: input.type,
+		data: input.data,
+		stringData: input.stringData,
+		immutable: input.immutable
+	};
+	const m = Manifest.make(() => Effect.succeed(resource));
+	return Object.assign(m, { ref: SecretRef.of(input.name) });
+} };
+//#endregion
+//#region src/secretBind.ts
+const bindSecret = (input) => {
+	const { secret } = input;
+	const namespace = unsafeCoerce(input.namespace ?? secret.namespace, "Ns defaults to `string`; the override (if present) is `Ns`, the secret's own namespace is `string` — runtime value either way is a string");
+	const ref = SecretRef.of(secret.name);
+	const envVars = secret.keys.map((key) => EnvVar.fromSecret({
+		name: secret.env[key],
+		ref,
+		key
+	}));
+	const refLayer = Dep.provideSecret(secret.name);
+	const manifest = input.backend === void 0 ? void 0 : input.backend.emit({
+		name: secret.name,
+		namespace,
+		keys: secret.keys,
+		labels: input.labels,
+		annotations: input.annotations,
+		source: input.source
+	});
+	const out = {
+		ref,
+		name: secret.name,
+		namespace,
+		keys: secret.keys,
+		envVars,
+		manifest,
+		refLayer
+	};
+	if (input.source === void 0) return out;
+	const source = input.source;
+	const valuesTag = Dep.SecretValues(secret.name);
+	const layer = Layer.effect(valuesTag, source.resolve.pipe(Effect.mapError((cause) => new RenderError({
+		message: `SecretValues(${namespace}/${secret.name}): source failed for key "${cause.key}"`,
+		cause
+	}))));
+	return {
+		...out,
+		values: valuesTag,
+		layer
+	};
+};
+//#endregion
+//#region src/environmentBind.ts
+const _bindLiteral = (input) => {
+	const hasOverride = input.override !== void 0;
+	const value = hasOverride ? input.override : input.entry.value;
+	const serialized = hasOverride ? input.entry.serialize(input.override) : input.entry.serialized;
+	return {
+		envName: input.entry.envName,
+		value,
+		envVar: {
+			name: input.entry.envName,
+			value: serialized
+		}
+	};
+};
+const _bindDownward = (input) => ({
+	envName: input.entry.envName,
+	fieldPath: input.entry.fieldPath,
+	envVar: {
+		name: input.entry.envName,
+		valueFrom: { fieldRef: { fieldPath: input.entry.fieldPath } }
+	}
+});
+const _handleSecret = (input) => {
+	const memberOpts = unsafeCoerce(input.secretsOpts?.[input.memberKey], "SecretMembersOpts<M> shape — runtime key lookup against the typed input");
+	const d = bindSecret({
+		secret: unsafeCoerce(input.entry, "Match.tag('Secret') narrowed entry to SecretEntry; the helper-level signature is the general SecretEntry shape"),
+		backend: memberOpts?.backend,
+		source: memberOpts?.source,
+		labels: memberOpts?.labels,
+		annotations: memberOpts?.annotations,
+		namespace: input.namespace
+	});
+	input.acc.declared[input.memberKey] = d;
+	input.acc.envVars.push(...d.envVars);
+	if (d.manifest !== void 0) input.acc.manifests.push(d.manifest);
+	if (d.layer !== void 0) input.acc.valuesLayers.push(unsafeCoerce(d.layer, "DeclaredSecret.layer is Layer<Provide<SecretValues, N>, ...>; widen to unknown for the heterogeneous Layer.mergeAll"));
+};
+const _handleLiteral = (input) => {
+	const d = _bindLiteral({
+		entry: unsafeCoerce(input.entry, "Match.tag('Literal') narrowed entry to LiteralEntry<string, unknown>"),
+		override: input.literalsOpts?.[input.memberKey]
+	});
+	input.acc.declared[input.memberKey] = d;
+	input.acc.envVars.push(d.envVar);
+};
+const _handleDownward = (input) => {
+	const d = _bindDownward({ entry: unsafeCoerce(input.entry, "Match.tag('Downward') narrowed entry to DownwardEntry<string>") });
+	input.acc.declared[input.memberKey] = d;
+	input.acc.envVars.push(d.envVar);
+};
+const _handleEnvironment = (input) => {
+	const sub = bindEnvironment({
+		env: unsafeCoerce(input.entry, "Match.tag('Environment') narrowed entry to a nested Environment"),
+		secrets: unsafeCoerce(input.secretsOpts?.[input.memberKey] ?? {}, "sub-record from SecretMembersOpts<M> — type is checked at the outer call site"),
+		literals: unsafeCoerce(input.literalsOpts?.[input.memberKey] ?? {}, "sub-record from LiteralMembersOpts<M> — type is checked at the outer call site"),
+		namespace: input.namespace
+	});
+	input.acc.declared[input.memberKey] = sub.members;
+	input.acc.envVars.push(...sub.envVars);
+	input.acc.manifests.push(...sub.manifests);
+	input.acc.valuesLayers.push(unsafeCoerce(sub.valuesLayer, "valuesLayer aggregate over the recursive merge"));
+};
+const _dispatch = (input) => Match.value(input.entry._kind).pipe(Match.when("Secret", () => _handleSecret(input)), Match.when("Literal", () => _handleLiteral(input)), Match.when("Downward", () => _handleDownward(input)), Match.when("Environment", () => _handleEnvironment(input)), Match.exhaustive);
+const bindEnvironment = (input) => {
+	const { env } = input;
+	const acc = {
+		declared: {},
+		envVars: [],
+		manifests: [],
+		valuesLayers: []
+	};
+	const secretsOpts = unsafeCoerce(input.secrets, "discriminated union from BindEnvironmentInput; iterate keys at runtime");
+	const literalsOpts = unsafeCoerce(input.literals, "discriminated union from BindEnvironmentInput; iterate keys at runtime");
+	for (const memberKey of Object.keys(env.members)) _dispatch({
+		memberKey,
+		entry: unsafeCoerce(env.members[memberKey], "env.members values are EnvMember by construction"),
+		secretsOpts,
+		literalsOpts,
+		namespace: input.namespace,
+		acc
+	});
+	const valuesLayer = unsafeCoerce(acc.valuesLayers.length === 0 ? Layer.empty : Layer.mergeAll(acc.valuesLayers[0], ...acc.valuesLayers.slice(1)), "merged Layer over a heterogeneous list of per-secret value layers");
+	return {
+		envVars: acc.envVars,
+		manifests: acc.manifests,
+		members: unsafeCoerce(acc.declared, "declared populated by iterating env.members; each key maps to its DeclaredMember<M[K], Ns>"),
+		valuesLayer
+	};
+};
+//#endregion
+//#region src/backend.ts
+var BackendSourceMissing = class extends Data.TaggedError("BackendSourceMissing") {
+	get message() {
+		return `backend "${this.backend}" requires a source but none was provided for secret "${this.secret}"`;
+	}
+};
+//#endregion
+//#region src/nativeSecret.ts
+const _emit = (input) => Manifest.make((_ctx) => Effect.gen(function* () {
+	if (input.opts.silenceWarning !== true) yield* Effect.logWarning(`NativeSecret backend emits a plaintext Secret with stringData on disk for "${input.base.namespace}/${input.base.name}". Pass { silenceWarning: true } to suppress, or switch to ExternalSecrets / SealedSecrets / Sops for production.`);
+	const resolved = yield* input.source.resolve.pipe(Effect.mapError((cause) => new RenderError({
+		message: `NativeSecret(${input.base.namespace}/${input.base.name}): source failed for key "${cause.key}"`,
+		cause
+	})));
+	const stringData = {};
+	for (const key of input.base.keys) stringData[key] = Redacted.value(resolved[key]);
+	return {
+		apiVersion: "v1",
+		kind: "Secret",
+		metadata: {
+			name: input.base.name,
+			namespace: input.base.namespace,
+			labels: input.base.labels,
+			annotations: input.base.annotations
+		},
+		type: input.opts.type,
+		stringData,
+		immutable: input.opts.immutable
+	};
+}));
+const NativeSecret = { backend: (opts) => {
+	const resolvedOpts = opts ?? {};
+	return {
+		_tag: "NativeSecret",
+		requiresSource: true,
+		emit: (input) => {
+			if (input.source === void 0) throw new BackendSourceMissing({
+				backend: "NativeSecret",
+				secret: input.name
+			});
+			return _emit({
+				base: input,
+				opts: resolvedOpts,
+				source: input.source
+			});
+		}
+	};
+} };
+//#endregion
+//#region src/podHash.ts
+const _frame = (hasher, value) => {
+	const bytes = Buffer.from(value, "utf8");
+	hasher.update(`${bytes.length}:`);
+	hasher.update(bytes);
+	hasher.update(",");
+};
+const hashSecretValues = (input) => {
+	const hasher = createHash("sha256");
+	_frame(hasher, "konfig/secret-values-hash/v1");
+	_frame(hasher, input.salt);
+	const keys = Object.keys(input.values).sort();
+	for (const key of keys) {
+		_frame(hasher, key);
+		_frame(hasher, Redacted.value(input.values[key]));
+	}
+	return hasher.digest("hex");
+};
+//#endregion
+//#region src/network.ts
+const Service = {
+	make: (input) => {
+		const resource = {
+			apiVersion: "v1",
+			kind: "Service",
+			metadata: {
+				name: input.name,
+				namespace: input.namespace,
+				labels: input.labels,
+				annotations: input.annotations
+			},
+			spec: {
+				selector: input.selector,
+				type: input.type,
+				ports: unsafeCoerce(input.ports, "input.ports is the user-typed Service spec; K8s ServicePort allows the same fields"),
+				clusterIP: input.clusterIP,
+				sessionAffinity: input.sessionAffinity,
+				publishNotReadyAddresses: input.publishNotReadyAddresses,
+				externalTrafficPolicy: input.externalTrafficPolicy,
+				internalTrafficPolicy: input.internalTrafficPolicy
+			}
+		};
+		return Manifest.make(() => Effect.succeed(resource));
+	},
+	fromContainer: (input) => Service.make({
+		name: input.name,
+		namespace: input.namespace,
+		labels: input.labels,
+		annotations: input.annotations,
+		selector: input.selector,
+		ports: unsafeCoerce(input.ports, "ServicePortSpec<Ports> structurally matches K8sServicePort; targetPort's PortName<Ports> brand is a phantom — runtime value is the underlying string"),
+		type: input.type,
+		clusterIP: input.clusterIP,
+		sessionAffinity: input.sessionAffinity,
+		publishNotReadyAddresses: input.publishNotReadyAddresses,
+		externalTrafficPolicy: input.externalTrafficPolicy,
+		internalTrafficPolicy: input.internalTrafficPolicy
+	}),
+	fromPodSet: (input) => Service.make({
+		name: input.name,
+		namespace: input.namespace,
+		labels: input.labels,
+		annotations: input.annotations,
+		selector: input.podSet.labels,
+		ports: input.ports,
+		type: input.type,
+		clusterIP: input.clusterIP,
+		sessionAffinity: input.sessionAffinity,
+		publishNotReadyAddresses: input.publishNotReadyAddresses,
+		externalTrafficPolicy: input.externalTrafficPolicy,
+		internalTrafficPolicy: input.internalTrafficPolicy
+	})
+};
+const Ingress = {
+	make: (input) => {
+		const resource = {
+			apiVersion: "networking.k8s.io/v1",
+			kind: "Ingress",
+			metadata: {
+				name: input.name,
+				namespace: input.namespace,
+				labels: input.labels,
+				annotations: input.annotations
+			},
+			spec: {
+				ingressClassName: input.ingressClassName,
+				rules: unsafeCoerce(input.rules, "user-supplied Ingress rules; widening from our convenience type to the K8s type"),
+				tls: unsafeCoerce(input.tls, "Ingress.tls produces K8sIngressTLS with branded secretName"),
+				defaultBackend: unsafeCoerce(input.defaultBackend, "user-supplied IngressBackend; structural match to K8s type")
+			}
+		};
+		return Manifest.make(() => Effect.succeed(resource));
+	},
+	/**
+	* TLS entry constructor for `Ingress.make({ tls: [...] })`. Takes a
+	* branded `SecretRef` so the secret's name can't widen to a raw
+	* string at the call site.
+	*/
+	tls: (input) => ({
+		secretName: input.secretName,
+		hosts: input.hosts
+	})
+};
+//#endregion
+//#region src/policy.ts
+const PersistentVolume = { make: (input) => Manifest.make(() => Effect.succeed({
+	apiVersion: "v1",
+	kind: "PersistentVolume",
+	metadata: {
+		name: input.name,
+		labels: input.labels,
+		annotations: input.annotations
+	},
+	spec: unsafeCoerce(input.spec, "user-supplied PV spec; structural match to the K8s type")
+})) };
+const PersistentVolumeClaim = { make: (input) => Manifest.make(() => Effect.succeed({
+	apiVersion: "v1",
+	kind: "PersistentVolumeClaim",
+	metadata: {
+		name: input.name,
+		namespace: input.namespace,
+		labels: input.labels,
+		annotations: input.annotations
+	},
+	spec: unsafeCoerce(input.spec, "user-supplied PVC spec; structural match to the K8s type")
+})) };
+const _lowerPeer = (peer) => ({
+	...peer.podSet !== void 0 ? { podSelector: { matchLabels: peer.podSet.labels } } : {},
+	...peer.namespaceSelector !== void 0 ? { namespaceSelector: peer.namespaceSelector } : {},
+	...peer.ipBlock !== void 0 ? { ipBlock: peer.ipBlock } : {}
+});
+const NetworkPolicy = {
+	make: (input) => Manifest.make(() => Effect.succeed({
+		apiVersion: "networking.k8s.io/v1",
+		kind: "NetworkPolicy",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations
+		},
+		spec: input.spec
+	})),
+	fromPodSet: (input) => {
+		const ingress = input.ingress?.map((rule) => ({
+			from: rule.from?.map(_lowerPeer),
+			ports: rule.ports
+		}));
+		const egress = input.egress?.map((rule) => ({
+			to: rule.to?.map(_lowerPeer),
+			ports: rule.ports
+		}));
+		return NetworkPolicy.make({
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations,
+			spec: unsafeCoerce({
+				podSelector: { matchLabels: input.podSet.labels },
+				policyTypes: input.policyTypes,
+				ingress,
+				egress
+			}, "konfig peers carry readonly arrays; upstream NetworkPolicySpec is mutable but the runtime shape matches")
+		});
+	}
+};
+const ClusterRole = { make: (input) => Manifest.make(() => Effect.succeed({
+	apiVersion: "rbac.authorization.k8s.io/v1",
+	kind: "ClusterRole",
+	metadata: {
+		name: input.name,
+		labels: input.labels,
+		annotations: input.annotations
+	},
+	rules: input.rules,
+	aggregationRule: input.aggregationRule
+})) };
+const ClusterRoleBinding = { make: (input) => Manifest.make(() => Effect.succeed({
+	apiVersion: "rbac.authorization.k8s.io/v1",
+	kind: "ClusterRoleBinding",
+	metadata: {
+		name: input.name,
+		labels: input.labels,
+		annotations: input.annotations
+	},
+	roleRef: input.roleRef,
+	subjects: input.subjects
+})) };
+const Role = { make: (input) => Manifest.make(() => Effect.succeed({
+	apiVersion: "rbac.authorization.k8s.io/v1",
+	kind: "Role",
+	metadata: {
+		name: input.name,
+		namespace: input.namespace,
+		labels: input.labels,
+		annotations: input.annotations
+	},
+	rules: input.rules
+})) };
+const RoleBinding = { make: (input) => Manifest.make(() => Effect.succeed({
+	apiVersion: "rbac.authorization.k8s.io/v1",
+	kind: "RoleBinding",
+	metadata: {
+		name: input.name,
+		namespace: input.namespace,
+		labels: input.labels,
+		annotations: input.annotations
+	},
+	roleRef: input.roleRef,
+	subjects: input.subjects
+})) };
+//#endregion
+//#region src/volume.ts
+const _volumeName = (name) => brand(name);
+/**
+* `Volume` value namespace.
+*
+*   volumes: [
+*     Volume.empty({ name: "config" }),
+*     Volume.fromSecret({ name: "tls", ref: tlsSecret.ref }),
+*     Volume.fromConfigMap({ name: "settings", ref: cfg.ref }),
+*     Volume.fromPvc({ name: "data", claim: pvc.ref }),
+*   ],
+*   volumeMounts: [
+*     { name: Volume.mountRef("config"), mountPath: "/etc/conf" },
+*   ],
+*
+* All four constructors capture the literal `name` in the returned
+* `Volume<N>` brand; `Pod` infers the union and constrains each
+* container's `volumeMounts[i].name` to it.
+*/
+const Volume = {
+	empty: (input) => ({
+		name: _volumeName(input.name),
+		emptyDir: {
+			medium: input.medium,
+			sizeLimit: input.sizeLimit
+		}
+	}),
+	fromSecret: (input) => ({
+		name: _volumeName(input.name),
+		secret: {
+			secretName: input.ref,
+			optional: input.optional,
+			defaultMode: input.defaultMode
+		}
+	}),
+	fromConfigMap: (input) => ({
+		name: _volumeName(input.name),
+		configMap: {
+			name: input.ref,
+			optional: input.optional,
+			defaultMode: input.defaultMode,
+			items: input.items
+		}
+	}),
+	fromPvc: (input) => ({
+		name: _volumeName(input.name),
+		persistentVolumeClaim: {
+			claimName: input.claim,
+			readOnly: input.readOnly
+		}
+	}),
+	mountRef: (name) => _volumeName(name)
+};
+//#endregion
+//#region src/workload.ts
+const Deployment = {
+	make: (input) => {
+		const resource = {
+			apiVersion: "apps/v1",
+			kind: "Deployment",
+			metadata: {
+				name: input.name,
+				namespace: input.namespace,
+				labels: input.labels,
+				annotations: input.annotations
+			},
+			spec: {
+				replicas: input.replicas,
+				selector: input.selector,
+				template: unsafeCoerce(input.template, "konfig PodSpecInput is structurally a K8s PodTemplateSpec body; brand-checked fields lower at construction"),
+				strategy: unsafeCoerce(input.strategy, "DeploymentStrategy is escape-hatch unknown; lift to K8s type for serialization"),
+				revisionHistoryLimit: input.revisionHistoryLimit,
+				progressDeadlineSeconds: input.progressDeadlineSeconds,
+				minReadySeconds: input.minReadySeconds
+			}
+		};
+		return Manifest.make(() => Effect.succeed(resource));
+	},
+	fromPodSet: (input) => Deployment.make({
+		name: input.name,
+		namespace: input.namespace,
+		labels: input.labels,
+		annotations: input.annotations,
+		replicas: input.replicas,
+		selector: { matchLabels: input.podSet.labels },
+		template: {
+			metadata: {
+				labels: {
+					...input.template.metadata?.labels,
+					...input.podSet.labels
+				},
+				annotations: input.template.metadata?.annotations
+			},
+			spec: input.template.spec
+		},
+		strategy: input.strategy,
+		revisionHistoryLimit: input.revisionHistoryLimit,
+		progressDeadlineSeconds: input.progressDeadlineSeconds,
+		minReadySeconds: input.minReadySeconds
+	})
+};
+const StatefulSet = { make: (input) => {
+	const resource = {
+		apiVersion: "apps/v1",
+		kind: "StatefulSet",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations
+		},
+		spec: {
+			replicas: input.replicas,
+			selector: input.selector,
+			template: unsafeCoerce(input.template, "konfig PodSpecInput is structurally a K8s PodTemplateSpec body; brand-checked fields lower at construction"),
+			serviceName: input.serviceName,
+			volumeClaimTemplates: unsafeCoerce(input.volumeClaimTemplates, "StatefulSet volumeClaimTemplates is escape-hatch unknown; lift to K8s type"),
+			podManagementPolicy: input.podManagementPolicy,
+			updateStrategy: unsafeCoerce(input.updateStrategy, "StatefulSetUpdateStrategy is escape-hatch unknown")
+		}
+	};
+	return Manifest.make(() => Effect.succeed(resource));
+} };
+const Job = { make: (input) => {
+	const resource = {
+		apiVersion: "batch/v1",
+		kind: "Job",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations
+		},
+		spec: {
+			parallelism: input.parallelism,
+			completions: input.completions,
+			backoffLimit: input.backoffLimit,
+			activeDeadlineSeconds: input.activeDeadlineSeconds,
+			ttlSecondsAfterFinished: input.ttlSecondsAfterFinished,
+			suspend: input.suspend,
+			template: unsafeCoerce(input.template, "konfig PodSpecInput is structurally a K8s PodTemplateSpec body; brand-checked fields lower at construction")
+		}
+	};
+	return Manifest.make(() => Effect.succeed(resource));
+} };
+const CronJob = { make: (input) => {
+	const resource = {
+		apiVersion: "batch/v1",
+		kind: "CronJob",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: input.labels,
+			annotations: input.annotations
+		},
+		spec: {
+			schedule: input.schedule,
+			concurrencyPolicy: input.concurrencyPolicy,
+			successfulJobsHistoryLimit: input.successfulJobsHistoryLimit,
+			failedJobsHistoryLimit: input.failedJobsHistoryLimit,
+			startingDeadlineSeconds: input.startingDeadlineSeconds,
+			suspend: input.suspend,
+			jobTemplate: unsafeCoerce(input.jobTemplate, "konfig CronJob jobTemplate is structurally a K8s JobTemplateSpec body")
+		}
+	};
+	return Manifest.make(() => Effect.succeed(resource));
+} };
+//#endregion
+//#region src/workloadHelpers.ts
+var workloadHelpers_exports = /* @__PURE__ */ __exportAll({
+	cron: () => cron,
+	web: () => web
+});
+const _reloaderAnnotations = (opt) => {
+	if (opt === void 0 || opt === "off") return {};
+	if (opt === "stakater") return { "reloader.stakater.com/auto": "true" };
+	if (opt === "stakater-strict") return {
+		"reloader.stakater.com/auto": "true",
+		"reloader.stakater.com/match": "true"
+	};
+	const out = {};
+	if (opt.secrets && opt.secrets.length > 0) out["secret.reloader.stakater.com/reload"] = opt.secrets.join(",");
+	if (opt.configMaps && opt.configMaps.length > 0) out["configmap.reloader.stakater.com/reload"] = opt.configMaps.join(",");
+	return out;
+};
+const web = (input) => {
+	const selectorLabels = { app: input.name };
+	const podLabels = {
+		...input.deployment.podLabels,
+		...selectorLabels
+	};
+	const reloaderAnns = _reloaderAnnotations(input.reloader);
+	const deployment = Deployment.make({
+		name: input.name,
+		namespace: input.namespace,
+		labels: {
+			...selectorLabels,
+			...input.labels
+		},
+		annotations: {
+			...input.annotations,
+			...reloaderAnns
+		},
+		replicas: input.deployment.replicas,
+		selector: { matchLabels: selectorLabels },
+		template: {
+			metadata: {
+				labels: podLabels,
+				annotations: input.deployment.podAnnotations
+			},
+			spec: {
+				containers: input.deployment.containers,
+				volumes: input.deployment.volumes,
+				imagePullSecrets: input.deployment.imagePullSecrets,
+				serviceAccountName: input.deployment.serviceAccountName
+			}
+		}
+	});
+	const service = Service.make({
+		name: input.name,
+		namespace: input.namespace,
+		labels: {
+			...selectorLabels,
+			...input.labels
+		},
+		annotations: input.annotations,
+		selector: selectorLabels,
+		type: input.service.type ?? "ClusterIP",
+		ports: unsafeCoerce(input.service.ports, "ServicePortSpec<Ports> structurally matches K8sServicePort; the PortName<Ports> brand on targetPort is a phantom whose runtime value is the underlying string")
+	});
+	if (input.ingress === void 0) return Manifest.make((ctx) => Effect.all([deployment.render(ctx), service.render(ctx)], { concurrency: "unbounded" }));
+	const ingress = Ingress.make({
+		name: input.name,
+		namespace: input.namespace,
+		labels: {
+			...selectorLabels,
+			...input.labels
+		},
+		annotations: {
+			...input.annotations,
+			...input.ingress.annotations
+		},
+		ingressClassName: input.ingress.ingressClassName,
+		rules: input.ingress.rules,
+		tls: input.ingress.tls
+	});
+	return Manifest.make((ctx) => Effect.all([
+		deployment.render(ctx),
+		service.render(ctx),
+		ingress.render(ctx)
+	], { concurrency: "unbounded" }));
+};
+const cron = (input) => {
+	const selectorLabels = { app: input.name };
+	const sa = Manifest.make(() => Effect.succeed({
+		apiVersion: "v1",
+		kind: "ServiceAccount",
+		metadata: {
+			name: input.name,
+			namespace: input.namespace,
+			labels: {
+				...selectorLabels,
+				...input.labels
+			},
+			annotations: input.annotations
+		}
+	}));
+	const cronJob = CronJob.make({
+		name: input.name,
+		namespace: input.namespace,
+		labels: {
+			...selectorLabels,
+			...input.labels
+		},
+		annotations: input.annotations,
+		schedule: input.schedule,
+		concurrencyPolicy: input.concurrencyPolicy,
+		successfulJobsHistoryLimit: input.successfulJobsHistoryLimit,
+		failedJobsHistoryLimit: input.failedJobsHistoryLimit,
+		jobTemplate: { spec: { template: {
+			metadata: { labels: selectorLabels },
+			spec: {
+				containers: input.containers,
+				volumes: input.volumes,
+				imagePullSecrets: input.imagePullSecrets,
+				serviceAccountName: input.name,
+				restartPolicy: input.restartPolicy ?? "OnFailure"
+			}
+		} } }
+	});
+	return Manifest.make((ctx) => Effect.all([sa.render(ctx), cronJob.render(ctx)], { concurrency: "unbounded" }));
+};
+//#endregion
+//#region src/selector.ts
+/**
+* `Selector` value namespace.
+*
+*   const apiPods = Selector.make({ app: "api", tier: "web" });
+*/
+const Selector = { make: (labels) => unsafeCoerce({ labels }, "SelectorBrand is a unique-symbol phantom — no runtime value; runtime shape is { labels }") };
+//#endregion
+//#region src/podSet.ts
+/**
+* `PodSet` value namespace.
+*
+*   const trio = PodSet.define({
+*     podSet: redisCachePods,
+*     deployment: { ... },
+*     service: { ... },
+*     netPol: { ... },
+*   });
+*
+* Umbrella over `Deployment.fromPodSet`, `Service.fromPodSet`, and
+* `NetworkPolicy.fromPodSet` — emits whichever subset of the trio the
+* input specifies, all rooted at one `Selector`.
+*/
+const PodSet = { define: (input) => {
+	const deployment = Deployment.fromPodSet({
+		podSet: input.podSet,
+		...input.deployment
+	});
+	const service = input.service !== void 0 ? Service.fromPodSet({
+		podSet: input.podSet,
+		...input.service
+	}) : void 0;
+	const netPol = input.netPol !== void 0 ? NetworkPolicy.fromPodSet({
+		podSet: input.podSet,
+		...input.netPol
+	}) : void 0;
+	return Manifest.make((ctx) => Effect.gen(function* () {
+		const d = yield* deployment.render(ctx);
+		const s = service !== void 0 ? yield* service.render(ctx) : void 0;
+		const n = netPol !== void 0 ? yield* netPol.render(ctx) : void 0;
+		const reason = "tuple element types are statically known per branch; the array literal is widened by TS, the brand-free runtime shape matches the typed tuple";
+		if (s !== void 0 && n !== void 0) return unsafeCoerce([
+			d,
+			s,
+			n
+		], reason);
+		if (s !== void 0) return unsafeCoerce([d, s], reason);
+		if (n !== void 0) return unsafeCoerce([d, n], reason);
+		return unsafeCoerce([d], reason);
+	}));
+} };
+//#endregion
+//#region src/index.ts
+/**
+* `Secret` value namespace — merges the env-contracts side (`define`)
+* with the K8s side (`make`, `bind`, identity helpers). Importing
+* `Secret` from `@konfig.ts/k8s` gives you the full surface:
+*
+*   Secret.define({ name, namespace, env })  — env contract (from @konfig.ts/env)
+*   Secret.make({ name, namespace, stringData })  — K8s Secret manifest
+*   Secret.bind({ secret, backend, source })  — env-to-manifest binder
+*/
+const Secret = {
+	...Secret$1,
+	...Secret$2,
+	bind: bindSecret
+};
+/**
+* `Environment` value namespace — merges `define` (env-contracts) with
+* `bind` + `runtime` (K8s). The same `Environment` symbol carries the
+* declaration, the manifest binder, and the runtime decoder.
+*/
+const Environment = {
+	...Environment$1,
+	bind: bindEnvironment,
+	runtime
+};
+//#endregion
+export { BackendSourceMissing, ClusterRole, ClusterRoleBinding, ConfigMap, ConfigMapRef, Container, CronJob, Deployment, EnvVar, Environment, Ingress, Job, k8s_types_exports as K8s, Namespace, NativeSecret, NetworkPolicy, PersistentVolume, PersistentVolumeClaim, Pod, PodSet, Port, PvcRef, Role, RoleBinding, Secret, SecretRef, Selector, Service, ServiceAccount, ServiceAccountRef, StatefulSet, Volume, workloadHelpers_exports as Workload, hashSecretValues };
+
+//# sourceMappingURL=index.mjs.map