@r8s/recipes 0.1.0 → 0.2.1

package/dist/r8s-cluster.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.R8sCluster = R8sCluster;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+const loki_1 = require("@r8s/crds/loki");
+const logging_1 = require("@r8s/crds/logging");
+const secret_provider_1 = require("./secret-provider");
+const dns_provider_1 = require("./dns-provider");
+const endpoint_provider_1 = require("./endpoint-provider");
+/**
+ * R8sCluster — opinionated cluster foundation with all recommended operators.
+ *
+ * @title R8sCluster
+ * @category Complete Solution
+ *
+ * Sets up a complete cluster foundation in one component:
+ * - **cert-manager** for TLS certificate automation
+ * - **external-dns** with TSIG for secure DNS updates
+ * - **Envoy Gateway** for Gateway API routing
+ * - **OpenBao VSO** for secrets management
+ * - **Prometheus** for metrics and alerting
+ * - **Loki + FluentBit** for log aggregation of all user pods
+ *
+ * All operators are declared automatically. Children inherit routing,
+ * secrets, and DNS contexts — just add your apps.
+ *
+ * R8sCluster is cluster-scoped — it does not take a namespace. Operators
+ * install to their own namespaces (cert-manager, external-dns, etc.).
+ * Logging infrastructure lives in a dedicated namespace (default:
+ * 'logging'). App namespaces are managed by Platform or the apps
+ * themselves.
+ *
+ * @example
+ * import { R8sCluster, Platform, App, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <>
+ *     <R8sCluster
+ *       secrets={{ mount: 'secret', path: 'production' }}
+ *       dns={{ server: 'ns1.example.com', zone: 'example.com', tsigPath: 'dns/tsig' }}
+ *     >
+ *       <Platform namespace="production">
+ *         <Database name="api-db" storage="20Gi" />
+ *         <App name="api" image="api:v1" host="api.example.com" />
+ *       </Platform>
+ *     </R8sCluster>
+ *   </>
+ * )
+ */
+function R8sCluster(props) {
+    const { secrets, dns, gatewayClassName = 'eg', labels, operators: preinstalled = [], logsNamespace = 'logging', logsStorageClass = 'standard', children, } = props;
+    // Build the operator list — R8sCluster declares all cluster operators
+    // so children don't have to. Children can still declare more (e.g.
+    // cnpg, keycloak) via their own logic.
+    const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+    const declared = [];
+    const clusterOperators = [
+        'cert-manager',
+        'external-dns',
+        'envoy-gateway',
+        'vault-secrets-operator',
+        'prometheus',
+        'loki',
+        'logging-operator',
+    ];
+    for (const opName of clusterOperators) {
+        const alreadyDeclared = sharedOperators.some((op) => op.name === opName) ||
+            preinstalled.some((op) => op.name === opName) ||
+            declared.some((op) => op.name === opName);
+        if (!alreadyDeclared && crds_1.operators[opName]) {
+            declared.push(crds_1.operators[opName]());
+        }
+    }
+    // Build the secrets provider (OpenBao VSO)
+    const secretProvider = (0, secret_provider_1.OpenBao)({
+        mount: secrets.mount,
+        path: secrets.path,
+        authRef: secrets.authRef,
+    });
+    // Build the DNS provider (ExternalDNS with TSIG)
+    const dnsProvider = (0, dns_provider_1.ExternalDns)({
+        server: dns.server,
+        zone: dns.zone,
+        tsig: {
+            path: dns.tsigPath,
+            key: dns.tsigKey ?? 'secret',
+        },
+    });
+    // Build the endpoint provider (Envoy Gateway)
+    const endpointProvider = (0, endpoint_provider_1.EnvoyGateway)({ className: gatewayClassName });
+    // Cluster-level logging: FluentBit collects logs from ALL pods
+    // and ships to Loki. Resources live in the logs namespace.
+    const loggingName = 'cluster-logging';
+    const lokiName = 'cluster-loki';
+    const lokiOutputName = 'cluster-loki-output';
+    const lokiStorageSecret = 'cluster-loki-storage';
+    const clusterResources = [];
+    // LokiStack — log aggregation backend (in logs namespace)
+    clusterResources.push((0, loki_1.LokiStackComponent)({
+        metadata: { name: lokiName, namespace: logsNamespace },
+        spec: {
+            size: '1x.small',
+            storageClassName: logsStorageClass,
+            storage: {
+                schemas: [{ version: 'v13', effectiveDate: '2024-01-01' }],
+                secret: { name: lokiStorageSecret, type: 's3' },
+            },
+            tenants: {
+                mode: 'static',
+                authentication: [{ tenantName: 'application', tenantId: 'app' }],
+                authorization: {
+                    roles: [
+                        {
+                            name: 'app-reader',
+                            permissions: ['read'],
+                            resources: ['logs'],
+                            tenants: ['application'],
+                        },
+                    ],
+                    roleBindings: [
+                        {
+                            name: 'app-reader-binding',
+                            roles: ['app-reader'],
+                            subjects: [{ kind: 'group', name: 'system:authenticated' }],
+                        },
+                    ],
+                },
+            },
+        },
+    }));
+    // Logging — Banzai Cloud Logging Operator with FluentBit
+    // FluentBit runs as a DaemonSet on every node, collecting all
+    // container logs from /var/log/containers/.
+    clusterResources.push((0, logging_1.LoggingComponent)({
+        metadata: { name: loggingName, namespace: logsNamespace },
+        spec: {
+            fluentd: {},
+            fluentbit: {},
+            controlNamespace: logsNamespace,
+        },
+    }));
+    // Output — ship logs to Loki gateway
+    clusterResources.push((0, logging_1.OutputComponent)({
+        metadata: { name: lokiOutputName, namespace: logsNamespace },
+        spec: {
+            loki: {
+                url: `http://loki-gateway.${logsNamespace}.svc.cluster.local`,
+                tenant: 'application',
+            },
+        },
+    }));
+    // Flow — match ALL pods (empty selector = match everything)
+    clusterResources.push((0, logging_1.FlowComponent)({
+        metadata: { name: 'cluster-flow', namespace: logsNamespace },
+        spec: {
+            match: [{ select: { labels: {} } }],
+            localOutputRefs: [lokiOutputName],
+        },
+    }));
+    // Assemble the full context stack. R8sCluster does NOT set a namespace
+    // context — it's cluster-scoped. Children (or Platform) handle
+    // app namespaces.
+    let result = children;
+    // Cluster-level resources first (LokiStack, Logging, Flow, Output)
+    result = (0, core_1.jsx)(core_1.Fragment, {
+        children: [...clusterResources, result],
+    });
+    // Apply DNS context (inside SecretProvider so it can access TSIG secret)
+    result = (0, core_1.jsx)(dns_provider_1.DnsProvider, { provider: dnsProvider, children: result });
+    // Apply secrets context (OpenBao VSO)
+    result = (0, core_1.jsx)(secret_provider_1.SecretProvider, { provider: secretProvider, children: result });
+    // Apply routing context (Envoy Gateway)
+    result = (0, core_1.jsx)(endpoint_provider_1.EndpointProvider, { provider: endpointProvider, children: result });
+    // Apply operators context — merge parent operators + preinstalled + declared
+    const allOperators = [...sharedOperators, ...preinstalled, ...declared];
+    if (allOperators.length > 0) {
+        result = (0, core_1.jsx)(defaults_1.OperatorContext.Provider, { value: allOperators, children: result });
+    }
+    // Apply labels context
+    if (labels) {
+        result = (0, core_1.jsx)(defaults_1.Labels.Provider, { value: labels, children: result });
+    }
+    return result;
+}
+//# sourceMappingURL=r8s-cluster.js.map

package/dist/r8s-cluster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r8s-cluster.js","sourceRoot":"","sources":["../src/r8s-cluster.tsx"],"names":[],"mappings":";;AAiHA,gCA2KC;AA5RD,oCAAqD;AACrD,iDAA4D;AAC5D,oCAAqC;AACrC,yCAAmD;AACnD,+CAAoF;AACpF,uDAA2D;AAC3D,iDAAyD;AACzD,2DAAoE;AAkEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,EACJ,OAAO,EACP,GAAG,EACH,gBAAgB,GAAG,IAAI,EACvB,MAAM,EACN,SAAS,EAAE,YAAY,GAAG,EAAE,EAC5B,aAAa,GAAG,SAAS,EACzB,gBAAgB,GAAG,UAAU,EAC7B,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,sEAAsE;IACtE,mEAAmE;IACnE,uCAAuC;IACvC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAe,EAAE,CAAA;IAC/B,MAAM,gBAAgB,GAAG;QACvB,cAAc;QACd,cAAc;QACd,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,MAAM;QACN,kBAAkB;KACnB,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,MAAM,eAAe,GACnB,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC;YAChD,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,eAAe,IAAI,gBAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,gBAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,cAAc,GAAG,IAAA,yBAAO,EAAC;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAA;IAEF,iDAAiD;IACjD,MAAM,WAAW,GAAG,IAAA,0BAAW,EAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE;YACJ,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,QAAQ;SAC7B;KACF,CAAC,CAAA;IAEF,8CAA8C;IAC9C,MAAM,gBAAgB,GAAG,IAAA,gCAAY,EAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAEtE,+DAA+D;IAC/D,2DAA2D;IAC3D,MAAM,WAAW,GAAG,iBAAiB,CAAA;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAA;IAC/B,MAAM,cAAc,GAAG,qBAAqB,CAAA;IAC5C,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;IAEhD,MAAM,gBAAgB,GAA6B,EAAE,CAAA;IAErD,0DAA0D;IAC1D,gBAAgB,CAAC,IAAI,CACnB,IAAA,yBAAkB,EAAC;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;QACtD,IAAI,EAAE;YACJ,IAAI,EAAE,UAAU;YAChB,gBAAgB,EAAE,gBAAgB;YAClC,OAAO,EAAE;gBACP,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;gBAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;aAChD;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBAChE,aAAa,EAAE;oBACb,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,YAAY;4BAClB,WAAW,EAAE,CAAC,MAAM,CAAC;4BACrB,SAAS,EAAE,CAAC,MAAM,CAAC;4BACnB,OAAO,EAAE,CAAC,aAAa,CAAC;yBACzB;qBACF;oBACD,YAAY,EAAE;wBACZ;4BACE,IAAI,EAAE,oBAAoB;4BAC1B,KAAK,EAAE,CAAC,YAAY,CAAC;4BACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;yBAC5D;qBACF;iBACF;aACF;SACF;KACF,CAAC,CACH,CAAA;IAED,yDAAyD;IACzD,8DAA8D;IAC9D,4CAA4C;IAC5C,gBAAgB,CAAC,IAAI,CACnB,IAAA,0BAAgB,EAAC;QACf,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE;QACzD,IAAI,EAAE;YACJ,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,gBAAgB,EAAE,aAAa;SAChC;KACF,CAAC,CACH,CAAA;IAED,qCAAqC;IACrC,gBAAgB,CAAC,IAAI,CACnB,IAAA,yBAAe,EAAC;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE;QAC5D,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,GAAG,EAAE,uBAAuB,aAAa,oBAAoB;gBAC7D,MAAM,EAAE,aAAa;aACtB;SACF;KACF,CAAC,CACH,CAAA;IAED,4DAA4D;IAC5D,gBAAgB,CAAC,IAAI,CACnB,IAAA,uBAAa,EAAC;QACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE;QAC5D,IAAI,EAAE;YACJ,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YACnC,eAAe,EAAE,CAAC,cAAc,CAAC;SAClC;KACF,CAAC,CACH,CAAA;IAED,uEAAuE;IACvE,+DAA+D;IAC/D,kBAAkB;IAClB,IAAI,MAAM,GAAY,QAAQ,CAAA;IAE9B,mEAAmE;IACnE,MAAM,GAAG,IAAA,UAAG,EAAC,eAAQ,EAAE;QACrB,QAAQ,EAAE,CAAC,GAAG,gBAAgB,EAAE,MAAM,CAAC;KACxC,CAAC,CAAA;IAEF,yEAAyE;IACzE,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAEtE,sCAAsC;IACtC,MAAM,GAAG,IAAA,UAAG,EAAC,gCAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAE5E,wCAAwC;IACxC,MAAM,GAAG,IAAA,UAAG,EAAC,oCAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAEhF,6EAA6E;IAC7E,MAAM,YAAY,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAA;IACvE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,IAAA,UAAG,EAAC,iBAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/secret-provider.d.ts

@@ -1,4 +1,13 @@
-import { type SecretProvider as SecretProviderConfig } from '@r8s/core/defaults';
+import { type SecretProvider as SecretProviderConfig, type SecretProvisioner } from '@r8s/core/defaults';
+/**
+ * Provisioner resolution — THE single identity-aware point in the platform.
+ * Everything downstream codes against the `provision()` capability; new
+ * backends plug in by carrying their own provisioner on the context value
+ * (or by being registered here — the orchestration point).
+ */
+export declare function provisionerForSecretProvider(provider: SecretProviderConfig | null | undefined): SecretProvisioner | undefined;
+/** Can this provider provision secrets? (capability check, not identity) */
+export declare function canProvisionSecrets(provider: SecretProviderConfig | null | undefined): provider is SecretProviderConfig;
 /**
  * OpenBao configuration component.
  *
@@ -14,6 +23,8 @@ export interface OpenBaoProps {
     path?: string;
     /** Auth reference (OpenBaoAuth name) */
     authRef?: string;
+    /** Re-sync interval for rotation (e.g. '3600s') — rendered as refreshAfter */
+    refreshAfter?: string;
 }
 export declare function OpenBao(props: OpenBaoProps): SecretProviderConfig;
 /**
@@ -26,6 +37,8 @@ export interface VaultProps {
     path?: string;
     /** Auth reference (VaultAuth name) */
     authRef?: string;
+    /** Re-sync interval for rotation (e.g. '3600s') — rendered as refreshAfter */
+    refreshAfter?: string;
 }
 export declare function Vault(props: VaultProps): SecretProviderConfig;
 /**
@@ -111,7 +124,7 @@ export interface SecretProviderProps {
  *
  * export default (
  *   <SecretProvider provider="sealed-secrets">
- *     <Database name="app-db" password="supersecret" />
+ *     <Database name="app-db" />
  *   </SecretProvider>
  * )
  */

package/dist/secret-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,IAAI,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAI/F;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAOjE;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAO7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;CAAG;AAEtC,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,kCA0CxD"}
+{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,IAAI,oBAAoB,EAC3C,KAAK,iBAAiB,EAEvB,MAAM,oBAAoB,CAAA;AAI3B;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAChD,iBAAiB,GAAG,SAAS,CAO/B;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAChD,QAAQ,IAAI,oBAAoB,CAElC;AA2DD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAQjE;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAQ7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;CAAG;AAEtC,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,kCA0CxD"}

package/dist/secret-provider.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.provisionerForSecretProvider = provisionerForSecretProvider;
+exports.canProvisionSecrets = canProvisionSecrets;
 exports.OpenBao = OpenBao;
 exports.Vault = Vault;
 exports.SealedSecrets = SealedSecrets;
@@ -9,12 +11,85 @@ const core_1 = require("@r8s/core");
 const defaults_1 = require("@r8s/core/defaults");
 const defaults_2 = require("@r8s/core/defaults");
 const crds_1 = require("@r8s/crds");
+/**
+ * Provisioner resolution — THE single identity-aware point in the platform.
+ * Everything downstream codes against the `provision()` capability; new
+ * backends plug in by carrying their own provisioner on the context value
+ * (or by being registered here — the orchestration point).
+ */
+function provisionerForSecretProvider(provider) {
+    if (!provider)
+        return undefined;
+    if (typeof provider.provision === 'function')
+        return provider.provision;
+    if (provider.backend === 'vault' || provider.backend === 'openbao') {
+        return (req) => builtinProvisionStaticSecret(provider, req);
+    }
+    return undefined;
+}
+/** Can this provider provision secrets? (capability check, not identity) */
+function canProvisionSecrets(provider) {
+    return provisionerForSecretProvider(provider) !== undefined;
+}
+/** Built-in Vault/OpenBao emission (VaultStaticSecret / OpenBaoStaticSecret) */
+function builtinProvisionStaticSecret(provider, req) {
+    // Two modes: an EXHAUSTIVE bundle (keys/templates given — destination
+    // carries exactly those keys, excludeRaw) or a RAW SYNC (empty keys and
+    // no templates — destination passes the whole store entry through,
+    // legacy Database/operator-contract shape).
+    const exhaustive = Object.keys(req.keys).length > 0 || req.templates !== undefined;
+    const spec = {
+        ...(provider.backend === 'vault'
+            ? { vaultAuthRef: req.authRef ?? provider.authRef }
+            : { openbaoAuthRef: req.authRef ?? provider.authRef }),
+        mount: req.mount ?? provider.mount,
+        type: 'kv-v2',
+        path: req.path,
+        refreshAfter: req.refreshAfter ?? provider.refreshAfter ?? (exhaustive ? '1h' : undefined),
+        ...(req.restartTargets && req.restartTargets.length > 0
+            ? { rolloutRestartTargets: req.restartTargets }
+            : {}),
+        destination: exhaustive
+            ? {
+                create: true,
+                name: req.secretName ?? req.name,
+                overwrite: true,
+                transformation: {
+                    excludeRaw: true,
+                    templates: {
+                        ...Object.fromEntries(Object.entries(req.keys).map(([dest, src]) => [
+                            dest,
+                            { text: `{{ .Secrets.${src} }}` },
+                        ])),
+                        // Raw passthrough templates (literals, composed templates) win
+                        // over key-mapped entries on collision
+                        ...Object.fromEntries(Object.entries(req.templates ?? {}).map(([dest, tpl]) => [dest, { text: tpl }])),
+                    },
+                },
+            }
+            : { create: true, name: req.secretName ?? req.name },
+    };
+    return provider.backend === 'vault'
+        ? (0, core_1.jsx)('VaultStaticSecret', {
+            apiVersion: 'secrets.hashicorp.com/v1beta1',
+            kind: 'VaultStaticSecret',
+            metadata: { name: req.name, namespace: req.namespace },
+            spec,
+        })
+        : (0, core_1.jsx)('OpenBaoStaticSecret', {
+            apiVersion: 'secrets.openbao.org/v1beta1',
+            kind: 'OpenBaoStaticSecret',
+            metadata: { name: req.name, namespace: req.namespace },
+            spec,
+        });
+}
 function OpenBao(props) {
     return {
         backend: 'openbao',
         mount: props.mount,
         path: props.path,
         authRef: props.authRef,
+        ...(props.refreshAfter && { refreshAfter: props.refreshAfter }),
     };
 }
 function Vault(props) {
@@ -23,6 +98,7 @@ function Vault(props) {
         mount: props.mount,
         path: props.path,
         authRef: props.authRef,
+        ...(props.refreshAfter && { refreshAfter: props.refreshAfter }),
     };
 }
 function SealedSecrets(props) {
@@ -73,7 +149,7 @@ function ManualSecrets(props) {
  *
  * export default (
  *   <SecretProvider provider="sealed-secrets">
- *     <Database name="app-db" password="supersecret" />
+ *     <Database name="app-db" />
  *   </SecretProvider>
  * )
  */

package/dist/secret-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":";;AAsBA,0BAOC;AAcD,sBAOC;AAUD,sCAIC;AAUD,sCAIC;AA2ED,wCA0CC;AAnMD,oCAAsE;AACtE,iDAA+F;AAC/F,iDAAoD;AACpD,oCAAqC;AAmBrC,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAA;AACH,CAAC;AAcD,SAAgB,KAAK,CAAC,KAAiB;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,IAAI,MAA4B,CAAA;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;SAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAI,QAAgB,CAAC,IAAI,CAAA;QACxC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,OAAO,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,KAAK,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,wBAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACnF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":";;AAgBA,oEASC;AAGD,kDAIC;AA8ED,0BAQC;AAgBD,sBAQC;AAUD,sCAIC;AAUD,sCAIC;AA2ED,wCA0CC;AA/RD,oCAAsE;AACtE,iDAK2B;AAC3B,iDAAoD;AACpD,oCAAqC;AAErC;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,QAAiD;IAEjD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC,SAAS,CAAA;IACvE,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,4EAA4E;AAC5E,SAAgB,mBAAmB,CACjC,QAAiD;IAEjD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA;AAC7D,CAAC;AAED,gFAAgF;AAChF,SAAS,4BAA4B,CAAC,QAA8B,EAAE,GAAwB;IAC5F,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAA;IAClF,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;YACnD,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;QAClC,IAAI,EAAE,OAAgB;QACtB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,CAAC,cAAc,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EAAE,UAAU;YACrB,CAAC,CAAC;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI;gBAChC,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE;oBACd,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE;wBACT,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;4BAC5C,IAAI;4BACJ,EAAE,IAAI,EAAE,eAAe,GAAG,KAAK,EAAE;yBAClC,CAAC,CACH;wBACD,+DAA+D;wBAC/D,uCAAuC;wBACvC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAChF;qBACF;iBACF;aACF;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE;KACvD,CAAA;IACD,OAAO,QAAQ,CAAC,OAAO,KAAK,OAAO;QACjC,CAAC,CAAC,IAAA,UAAG,EAAC,mBAAmB,EAAE;YACvB,UAAU,EAAE,+BAA+B;YAC3C,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;YACtD,IAAI;SACL,CAAC;QACJ,CAAC,CAAC,IAAA,UAAG,EAAC,qBAAqB,EAAE;YACzB,UAAU,EAAE,6BAA6B;YACzC,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;YACtD,IAAI;SACL,CAAC,CAAA;AACR,CAAC;AAqBD,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAgBD,SAAgB,KAAK,CAAC,KAAiB;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,IAAI,MAA4B,CAAA;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;SAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAI,QAAgB,CAAC,IAAI,CAAA;QACxC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,OAAO,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,KAAK,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,wBAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACnF,CAAC,CAAA;AACJ,CAAC"}

package/dist/static-secret.d.ts

@@ -0,0 +1,107 @@
+export interface StaticSecretProps {
+    /**
+     * Resource name (also the default for the provisioned Kubernetes
+     * Secret's name — override with secretName).
+     */
+    name: string;
+    /** Kubernetes namespace (inherited from Platform context when omitted) */
+    namespace?: string;
+    /**
+     * Vault/OpenBao KV v2 path holding the source keys, e.g. 'outline/app'.
+     * Build it from the provider's base path when composing:
+     * `${secretProvider.path}/myapp/credentials`.
+     */
+    path: string;
+    /**
+     * Destination→source key mapping. The destination carries env-case
+     * names consumed by the app; the vault/store keys stay snake_case:
+     *   keys={{ SECRET_KEY: 'secret_key', UTILS_SECRET: 'utils_secret' }}
+     * A string array is shorthand for identity mappings ({ KEY: 'KEY' }).
+     *
+     * Rendered as destination.transformation.templates + excludeRaw —
+     * the destination holds ONLY these keys.
+     */
+    keys: Record<string, string> | string[];
+    /**
+     * Raw Go-template passthrough merged AFTER the keys mapping — for
+     * advanced bundles needing literals or composed templates
+     * (e.g. `AWS_ENDPOINTS: 'https://s3.berget.cloud'`). Passthrough wins
+     * over key-mapped entries on collision.
+     */
+    templates?: Record<string, string>;
+    /** Provisioned Kubernetes Secret name (defaults to name) */
+    secretName?: string;
+    /**
+     * Re-sync interval rendered as refreshAfter. Defaults to the provider's
+     * refreshAfter, else '1h'.
+     */
+    refreshAfter?: string;
+    /**
+     * Workloads restarted after rotation (rolloutRestartTargets). Pass the
+     * workloads consuming these values so a rotation actually takes effect —
+     * pod env vars do not update in place.
+     *
+     * Deliberately has no default: some consumers read the Secret at use
+     * time (e.g. CNPG barman backup credentials are read when a backup
+     * runs, and the Cluster CRD is not a supported restart target), so an
+     * automatic restart is wrong for them.
+     */
+    restart?: {
+        kind?: string;
+        name: string;
+        apiVersion?: string;
+    }[];
+    /**
+     * Auth reference override (defaults to the provider's authRef).
+     * Rendered as vaultAuthRef / openbaoAuthRef per backend.
+     */
+    authRef?: string;
+}
+/**
+ * StaticSecret — provision a Kubernetes Secret from Vault/OpenBao,
+ * with rotation semantics that actually reach the workloads.
+ *
+ * Wraps VaultStaticSecret / OpenBaoStaticSecret with the platform's
+ * conventions baked in:
+ * - snake_case source keys templated to env-case destination keys
+ *   (excludeRaw: only the declared keys land in the Secret)
+ * - destination create + overwrite (idempotent sync)
+ * - hourly refresh by default, inheriting the provider's refreshAfter
+ * - explicit, per-bundle restart semantics (app creds restart pods;
+ *   backup creds read at use time never restart)
+ *
+ * Requires an active secrets backend (openbao or vault) — passive
+ * backends (manual-secrets, sealed-secrets) cannot provision: reference
+ * a pre-created Secret instead.
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret
+ *       name="myapp-secrets"
+ *       path="myapp/app"
+ *       keys={{
+ *         SECRET_KEY: 'secret_key',
+ *         OIDC_CLIENT_ID: 'oidc_client_id',
+ *         OIDC_CLIENT_SECRET: 'oidc_client_secret',
+ *       }}
+ *       restart={[{ kind: 'Deployment', name: 'myapp' }]}
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * // backup creds: read at use time — never restart workloads
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret name="myapp-backup-creds" path="rustfs/myapp"
+ *       keys={['accesskey', 'secretkey']} />
+ *   </Platform>
+ * )
+ */
+export declare function StaticSecret(props: StaticSecretProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=static-secret.d.ts.map

package/dist/static-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-secret.d.ts","sourceRoot":"","sources":["../src/static-secret.tsx"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAA;IACvC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAChE;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,kCAoDpD"}

package/dist/static-secret.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaticSecret = StaticSecret;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const secret_provider_1 = require("./secret-provider");
+/**
+ * StaticSecret — provision a Kubernetes Secret from Vault/OpenBao,
+ * with rotation semantics that actually reach the workloads.
+ *
+ * Wraps VaultStaticSecret / OpenBaoStaticSecret with the platform's
+ * conventions baked in:
+ * - snake_case source keys templated to env-case destination keys
+ *   (excludeRaw: only the declared keys land in the Secret)
+ * - destination create + overwrite (idempotent sync)
+ * - hourly refresh by default, inheriting the provider's refreshAfter
+ * - explicit, per-bundle restart semantics (app creds restart pods;
+ *   backup creds read at use time never restart)
+ *
+ * Requires an active secrets backend (openbao or vault) — passive
+ * backends (manual-secrets, sealed-secrets) cannot provision: reference
+ * a pre-created Secret instead.
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret
+ *       name="myapp-secrets"
+ *       path="myapp/app"
+ *       keys={{
+ *         SECRET_KEY: 'secret_key',
+ *         OIDC_CLIENT_ID: 'oidc_client_id',
+ *         OIDC_CLIENT_SECRET: 'oidc_client_secret',
+ *       }}
+ *       restart={[{ kind: 'Deployment', name: 'myapp' }]}
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * // backup creds: read at use time — never restart workloads
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret name="myapp-backup-creds" path="rustfs/myapp"
+ *       keys={['accesskey', 'secretkey']} />
+ *   </Platform>
+ * )
+ */
+function StaticSecret(props) {
+    const { name, namespace: namespaceProp, path, keys, templates, secretName, refreshAfter, restart, authRef, } = props;
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const provisioner = (0, secret_provider_1.provisionerForSecretProvider)(secretProvider);
+    if (!provisioner) {
+        throw new Error(`StaticSecret "${name}" requires a provisioning secrets backend (openbao, vault,\n` +
+            `or any provider carrying a provision() hook).\n` +
+            `\n` +
+            `Fix: configure a backend on the Platform:\n` +
+            `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+            `    <StaticSecret name="${name}" path="${path}" keys={...} />\n` +
+            `  </Platform>\n` +
+            `\n` +
+            `On passive backends (manual-secrets, sealed-secrets, kubernetes), create the Secret\n` +
+            `out of band and reference it directly instead of rendering this component.`);
+    }
+    const mapping = Object.fromEntries((Array.isArray(keys) ? keys.map((k) => [k, k]) : Object.entries(keys)));
+    // Default missing fields (consistent with Database/WebService restart
+    // target conventions)
+    const restartTargets = restart?.map((t) => ({ kind: 'Deployment', ...t }));
+    const el = provisioner({
+        name,
+        namespace,
+        path,
+        keys: mapping,
+        templates,
+        secretName,
+        authRef,
+        refreshAfter,
+        restartTargets,
+    });
+    return Array.isArray(el) ? (0, core_1.jsx)(core_1.Fragment, { children: el }) : el;
+}
+//# sourceMappingURL=static-secret.js.map

package/dist/static-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-secret.js","sourceRoot":"","sources":["../src/static-secret.tsx"],"names":[],"mappings":";;AA0GA,oCAoDC;AA9JD,oCAAqD;AACrD,iDAAgE;AAChE,uDAAgE;AA0DhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,MAAM,EACJ,IAAI,EACJ,SAAS,EAAE,aAAa,EACxB,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,UAAU,EACV,YAAY,EACZ,OAAO,EACP,OAAO,GACR,GAAG,KAAK,CAAA;IAET,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAA,8CAA4B,EAAC,cAAc,CAAC,CAAA;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,8DAA8D;YACjF,iDAAiD;YACjD,IAAI;YACJ,6CAA6C;YAC7C,4EAA4E;YAC5E,2BAA2B,IAAI,WAAW,IAAI,mBAAmB;YACjE,iBAAiB;YACjB,IAAI;YACJ,uFAAuF;YACvF,4EAA4E,CAC/E,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAA2B,MAAM,CAAC,WAAW,CACxD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAuB,CAC7F,CAAA;IAED,sEAAsE;IACtE,sBAAsB;IACtB,MAAM,cAAc,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAE1E,MAAM,EAAE,GAAG,WAAW,CAAC;QACrB,IAAI;QACJ,SAAS;QACT,IAAI;QACJ,IAAI,EAAE,OAAO;QACb,SAAS;QACT,UAAU;QACV,OAAO;QACP,YAAY;QACZ,cAAc;KACf,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAA6B,CAAA;AAC7F,CAAC"}