@r8s/recipes 0.1.0

package/dist/platform.d.ts

@@ -0,0 +1,116 @@
+import type { Operator } from '@r8s/k8s-types';
+import { type SecretProviderValue } from './secret-provider';
+import { type DnsProviderValue } from './dns-provider';
+export type RoutingMode = 'ingress' | 'gateway';
+export interface PlatformProps {
+    /**
+     * Routing implementation for the cluster.
+     * - 'ingress': nginx Ingress (default)
+     * - 'gateway': Envoy Gateway (Gateway API)
+     */
+    routing?: RoutingMode;
+    /** Gateway class name (only used when routing='gateway', default: 'eg') */
+    gatewayClassName?: string;
+    /** Default namespace for all child resources */
+    namespace?: string;
+    /** Default labels applied to all child resources */
+    labels?: Record<string, string>;
+    /** Shared operators for all child resources */
+    operators?: Operator[];
+    /**
+     * Secrets backend for all child resources. When set, Database and other
+     * recipes generate credentials through this backend instead of requiring
+     * plaintext passwords.
+     *
+     * - 'openbao': OpenBao Vault Secrets Operator (default when omitted)
+     * - 'vault': HashiCorp Vault Secrets Operator
+     * - 'sealed-secrets': Bitnami Sealed Secrets
+     * - 'kubernetes': plain Kubernetes Secrets (CNPG-managed, no plaintext)
+     *
+     * Use a string for simple cases, or a component for advanced config:
+     * `secrets={<OpenBao mount="secret" path="infra" />}`
+     */
+    secrets?: SecretProviderValue;
+    /**
+     * DNS configuration for all child endpoints. When set, Endpoint/App
+     * automatically create DNS records via ExternalDNS.
+     *
+     * Use a string for simple cases, or a component for advanced config:
+     * `dns={<ExternalDns server="ns1.example.com" tsig={{...}} />}`
+     */
+    dns?: DnsProviderValue;
+    /** Child components that inherit the cluster-level configuration this Platform sets */
+    children?: unknown;
+}
+/**
+ * Platform — cluster-level configuration wrapper.
+ *
+ * @title Platform
+ * @category Cluster Configuration
+ *
+ * Sets routing mode, namespace, labels, and shared operators for all
+ * child components. Use this once at the top of your manifest instead
+ * of manually wiring context providers.
+ *
+ * For finer control, use the individual providers directly:
+ * - `<SecretProvider>` for secrets backend
+ * - `<DnsProvider>` for DNS configuration
+ * - `<EndpointProvider>` for routing
+ *
+ * @example
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform routing="gateway" namespace="production">
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *     <App name="web" image="myapp/web:v1" host="app.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform namespace="production">
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, App, Database, cnpgOperator } from '@r8s/recipes'
+ * import { operators } from '@r8s/crds'
+ *
+ * export default (
+ *   <Platform
+ *     routing="gateway"
+ *     namespace="production"
+ *     operators={[cnpgOperator(), operators['cert-manager']()]}
+ *   >
+ *     <Database name="app-db" storage="10Gi" />
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * // Full hierarchy with DNS and secrets
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform
+ *     namespace="production"
+ *     secrets={{ backend: 'openbao', mount: 'secret', path: 'infra' }}
+ *     dns={{
+ *       provider: 'external-dns',
+ *       settings: {
+ *         server: 'ns1.example.com',
+ *         zone: 'example.com',
+ *         tsig: { path: 'dns/tsig', key: 'secret' },
+ *       },
+ *     }}
+ *   >
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *   </Platform>
+ * )
+ */
+export declare function Platform(props: PlatformProps): unknown;
+//# sourceMappingURL=platform.d.ts.map

package/dist/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAOnE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAA;AAE/C,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,WA4D5C"}

package/dist/platform.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Platform = Platform;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const secret_provider_1 = require("./secret-provider");
+const dns_provider_1 = require("./dns-provider");
+const endpoint_provider_1 = require("./endpoint-provider");
+/**
+ * Platform — cluster-level configuration wrapper.
+ *
+ * @title Platform
+ * @category Cluster Configuration
+ *
+ * Sets routing mode, namespace, labels, and shared operators for all
+ * child components. Use this once at the top of your manifest instead
+ * of manually wiring context providers.
+ *
+ * For finer control, use the individual providers directly:
+ * - `<SecretProvider>` for secrets backend
+ * - `<DnsProvider>` for DNS configuration
+ * - `<EndpointProvider>` for routing
+ *
+ * @example
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform routing="gateway" namespace="production">
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *     <App name="web" image="myapp/web:v1" host="app.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform namespace="production">
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, App, Database, cnpgOperator } from '@r8s/recipes'
+ * import { operators } from '@r8s/crds'
+ *
+ * export default (
+ *   <Platform
+ *     routing="gateway"
+ *     namespace="production"
+ *     operators={[cnpgOperator(), operators['cert-manager']()]}
+ *   >
+ *     <Database name="app-db" storage="10Gi" />
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * // Full hierarchy with DNS and secrets
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform
+ *     namespace="production"
+ *     secrets={{ backend: 'openbao', mount: 'secret', path: 'infra' }}
+ *     dns={{
+ *       provider: 'external-dns',
+ *       settings: {
+ *         server: 'ns1.example.com',
+ *         zone: 'example.com',
+ *         tsig: { path: 'dns/tsig', key: 'secret' },
+ *       },
+ *     }}
+ *   >
+ *     <App name="api" image="myapp/api:v1" host="api.example.com" />
+ *   </Platform>
+ * )
+ */
+function Platform(props) {
+    const { routing = 'ingress', gatewayClassName = 'eg', namespace, labels, operators, secrets, dns, children, } = props;
+    let result = children;
+    // Materialize the Namespace resource so rendered output is self-contained.
+    // Without this, every resource references a namespace that may not exist.
+    if (namespace) {
+        result = (0, core_1.jsx)(core_1.Fragment, {
+            children: [
+                (0, core_1.jsx)('Namespace', {
+                    apiVersion: 'v1',
+                    kind: 'Namespace',
+                    metadata: { name: namespace },
+                }),
+                result,
+            ],
+        });
+    }
+    // Apply DNS context via DnsProvider (inside SecretProvider so it can access secrets)
+    if (dns) {
+        result = (0, core_1.jsx)(dns_provider_1.DnsProvider, { provider: dns, children: result });
+    }
+    // Apply secrets context via SecretProvider (outside DnsProvider)
+    if (secrets) {
+        result = (0, core_1.jsx)(secret_provider_1.SecretProvider, { provider: secrets, children: result });
+    }
+    // Apply routing context via EndpointProvider
+    const endpointProvider = routing === 'gateway' ? { provider: 'envoy-gateway', settings: { gatewayClassName } } : 'nginx';
+    result = (0, core_1.jsx)(endpoint_provider_1.EndpointProvider, { provider: endpointProvider, children: result });
+    // Apply operators context
+    if (operators && operators.length > 0) {
+        result = (0, core_1.jsx)(defaults_1.OperatorContext.Provider, { value: operators, children: result });
+    }
+    // Apply labels context
+    if (labels) {
+        result = (0, core_1.jsx)(defaults_1.Labels.Provider, { value: labels, children: result });
+    }
+    // Apply namespace context
+    if (namespace) {
+        result = (0, core_1.jsx)(defaults_1.Namespace.Provider, { value: namespace, children: result });
+    }
+    return result;
+}
+//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.tsx"],"names":[],"mappings":";;AAmIA,4BA4DC;AA/LD,oCAAqD;AACrD,iDAO2B;AAE3B,uDAA4E;AAC5E,iDAAmE;AACnE,2DAI4B;AA6C5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,SAAgB,QAAQ,CAAC,KAAoB;IAC3C,MAAM,EACJ,OAAO,GAAG,SAAS,EACnB,gBAAgB,GAAG,IAAI,EACvB,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,GAAG,EACH,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,IAAI,MAAM,GAAY,QAAQ,CAAA;IAE9B,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAA,UAAG,EAAC,eAAQ,EAAE;YACrB,QAAQ,EAAE;gBACR,IAAA,UAAG,EAAC,WAAW,EAAE;oBACf,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAC9B,CAAC;gBACF,MAAM;aACP;SACF,CAAC,CAAA;IACJ,CAAC;IAED,qFAAqF;IACrF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,UAAG,EAAC,gCAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,6CAA6C;IAC7C,MAAM,gBAAgB,GACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACjG,MAAM,GAAG,IAAA,UAAG,EAAC,oCAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAEhF,0BAA0B;IAC1B,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,IAAA,UAAG,EAAC,iBAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,0BAA0B;IAC1B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAA,UAAG,EAAC,oBAAS,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/secret-provider.d.ts

@@ -0,0 +1,119 @@
+import { type SecretProvider as SecretProviderConfig } from '@r8s/core/defaults';
+/**
+ * OpenBao configuration component.
+ *
+ * Use as a value in SecretProvider when you need custom configuration:
+ * ```tsx
+ * <SecretProvider provider={<OpenBao mount="secret" path="infra" authRef="custom" />}>
+ * ```
+ */
+export interface OpenBaoProps {
+    /** OpenBao mount path (default: 'secret') */
+    mount?: string;
+    /** Base path for all secrets (e.g., 'infra' → 'infra/app/db') */
+    path?: string;
+    /** Auth reference (OpenBaoAuth name) */
+    authRef?: string;
+}
+export declare function OpenBao(props: OpenBaoProps): SecretProviderConfig;
+/**
+ * Vault configuration component.
+ */
+export interface VaultProps {
+    /** Vault mount path (default: 'secret') */
+    mount?: string;
+    /** Base path for all secrets */
+    path?: string;
+    /** Auth reference (VaultAuth name) */
+    authRef?: string;
+}
+export declare function Vault(props: VaultProps): SecretProviderConfig;
+/**
+ * SealedSecrets configuration component.
+ */
+export interface SealedSecretsProps {
+    /** Namespace where sealed-secrets controller runs (default: 'kube-system') */
+    namespace?: string;
+}
+export declare function SealedSecrets(props: SealedSecretsProps): SecretProviderConfig;
+/**
+ * ManualSecrets configuration component (plain Kubernetes Secrets, CNPG-managed).
+ *
+ * Use for simple deployments or development. CNPG creates and manages
+ * bootstrap secrets automatically. No external secrets backend required.
+ */
+export interface ManualSecretsProps {
+}
+export declare function ManualSecrets(props: ManualSecretsProps): SecretProviderConfig;
+/** Union of all secret provider configurations */
+export type SecretProviderValue = 'openbao' | 'vault' | 'sealed-secrets' | 'manual-secrets' | SecretProviderConfig;
+export interface SecretProviderProps {
+    /**
+     * Secrets backend — string for simple cases, component for advanced config.
+     *
+     * @example
+     * import { SecretProvider, Database } from '@r8s/recipes'
+     *
+     * export default (
+     *   <SecretProvider provider="openbao">
+     *     <Database name="app-db" />
+     *   </SecretProvider>
+     * )
+     *
+     * @example
+     * import { SecretProvider, OpenBao, Database } from '@r8s/recipes'
+     *
+     * export default (
+     *   <SecretProvider provider={<OpenBao mount="secret" path="infra" authRef="custom" />}>
+     *     <Database name="app-db" />
+     *   </SecretProvider>
+     * )
+     */
+    provider: SecretProviderValue;
+    /** Child components */
+    children?: unknown;
+}
+/**
+ * SecretProvider — cluster-level secrets backend.
+ *
+ * All Database, Auth, and other secret-consuming children use this backend.
+ * Automatically declares the required operator (VSO for vault/openbao).
+ *
+ * @example
+ * import { SecretProvider, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="openbao">
+ *     <Database name="app-db" />
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { SecretProvider, OpenBao, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider={<OpenBao mount="secret" path="infra" authRef="custom-auth" />}>
+ *     <Database name="app-db" />
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { SecretProvider, Vault, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider={<Vault mount="kv" path="apps" />}>
+ *     <Database name="app-db" />
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { SecretProvider, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="sealed-secrets">
+ *     <Database name="app-db" password="supersecret" />
+ *   </SecretProvider>
+ * )
+ */
+export declare function SecretProvider(props: SecretProviderProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=secret-provider.d.ts.map

package/dist/secret-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,IAAI,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAI/F;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAOjE;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAO7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;CAAG;AAEtC,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,kCA0CxD"}

package/dist/secret-provider.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenBao = OpenBao;
+exports.Vault = Vault;
+exports.SealedSecrets = SealedSecrets;
+exports.ManualSecrets = ManualSecrets;
+exports.SecretProvider = SecretProvider;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const defaults_2 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+function OpenBao(props) {
+    return {
+        backend: 'openbao',
+        mount: props.mount,
+        path: props.path,
+        authRef: props.authRef,
+    };
+}
+function Vault(props) {
+    return {
+        backend: 'vault',
+        mount: props.mount,
+        path: props.path,
+        authRef: props.authRef,
+    };
+}
+function SealedSecrets(props) {
+    return {
+        backend: 'sealed-secrets',
+    };
+}
+function ManualSecrets(props) {
+    return {
+        backend: 'manual-secrets',
+    };
+}
+/**
+ * SecretProvider — cluster-level secrets backend.
+ *
+ * All Database, Auth, and other secret-consuming children use this backend.
+ * Automatically declares the required operator (VSO for vault/openbao).
+ *
+ * @example
+ * import { SecretProvider, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="openbao">
+ *     <Database name="app-db" />
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { SecretProvider, OpenBao, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider={<OpenBao mount="secret" path="infra" authRef="custom-auth" />}>
+ *     <Database name="app-db" />
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { SecretProvider, Vault, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider={<Vault mount="kv" path="apps" />}>
+ *     <Database name="app-db" />
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { SecretProvider, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="sealed-secrets">
+ *     <Database name="app-db" password="supersecret" />
+ *   </SecretProvider>
+ * )
+ */
+function SecretProvider(props) {
+    const { provider, children } = props;
+    const sharedOperators = (0, core_1.useContext)(defaults_2.OperatorContext);
+    // Resolve provider config
+    let config;
+    if (typeof provider === 'string') {
+        config = { backend: provider };
+    }
+    else if ('backend' in provider) {
+        config = provider;
+    }
+    else if (provider && typeof provider === 'object' && 'type' in provider) {
+        // r8s JSX element — call the component with its props
+        const component = provider.type;
+        if (component === OpenBao) {
+            config = OpenBao(provider.props);
+        }
+        else if (component === Vault) {
+            config = Vault(provider.props);
+        }
+        else if (component === SealedSecrets) {
+            config = SealedSecrets(provider.props);
+        }
+        else if (component === ManualSecrets) {
+            config = ManualSecrets(provider.props);
+        }
+        else {
+            throw new Error(`Unknown secret provider component: ${component.name || component}`);
+        }
+    }
+    else {
+        throw new Error(`Invalid secret provider: ${JSON.stringify(provider)}`);
+    }
+    const resources = [];
+    // Declare VSO for vault/openbao
+    if (config.backend === 'vault' || config.backend === 'openbao') {
+        const hasVSO = sharedOperators.some((op) => op.name === 'vault-secrets-operator');
+        if (!hasVSO) {
+            resources.push((0, core_1.declareOperator)(crds_1.operators['vault-secrets-operator']()));
+        }
+    }
+    return (0, core_1.jsx)(core_1.Fragment, {
+        children: [...resources, (0, core_1.jsx)(defaults_1.SecretContext.Provider, { value: config, children })],
+    });
+}
+//# sourceMappingURL=secret-provider.js.map

package/dist/secret-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":";;AAsBA,0BAOC;AAcD,sBAOC;AAUD,sCAIC;AAUD,sCAIC;AA2ED,wCA0CC;AAnMD,oCAAsE;AACtE,iDAA+F;AAC/F,iDAAoD;AACpD,oCAAqC;AAmBrC,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAA;AACH,CAAC;AAcD,SAAgB,KAAK,CAAC,KAAiB;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,IAAI,MAA4B,CAAA;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;SAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAI,QAAgB,CAAC,IAAI,CAAA;QACxC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,OAAO,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,KAAK,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,wBAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACnF,CAAC,CAAA;AACJ,CAAC"}

package/dist/web-service.d.ts

@@ -0,0 +1,87 @@
+import { EnvVar } from '@r8s/k8s-types';
+export interface SecretRef {
+    /** Name of the Kubernetes Secret containing this value */
+    secret: string;
+    /** Key within the secret (defaults to env var name) */
+    key?: string;
+}
+export interface VaultSecretRef {
+    /** Vault KV mount path */
+    mount: string;
+    /** Secret path in Vault */
+    path: string;
+    /** Key within the Vault secret (defaults to env var name) */
+    key?: string;
+    /** VaultAuth reference name (defaults to 'default') */
+    vaultAuthRef?: string;
+}
+export interface WebServiceProps {
+    /** Resource name */
+    name: string;
+    /** Kubernetes namespace (defaults to 'default') */
+    namespace?: string;
+    /** Container image (e.g., 'myapp/api:v1.2.3') */
+    image: string;
+    /** Container port the app listens on (defaults to 3000) */
+    port?: number;
+    /** Number of pod replicas (defaults to 2) */
+    replicas?: number;
+    /** Plain environment variables (non-sensitive) */
+    env?: Record<string, string>;
+    /** Secrets from Kubernetes Secrets — safe by default */
+    secrets?: Record<string, SecretRef | string>;
+    /** Secrets from Vault — creates VaultStaticSecret objects */
+    vault?: Record<string, VaultSecretRef>;
+    /** Raw env vars for advanced use cases */
+    rawEnv?: EnvVar[];
+    /** CPU and memory requests/limits for the app container */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+}
+/**
+ * Simple web service (backend or frontend).
+ *
+ * @title Web Service
+ * @category Workloads
+ *
+ * Creates a Deployment + Service with health checks.
+ *
+ * @example
+ * import { WebService } from '@r8s/recipes'
+ *
+ * export default <WebService name="api" image="myapp/api:v1" port={3000} env={{ LOG_LEVEL: 'info' }} />
+ *
+ * @example
+ * import { WebService } from '@r8s/recipes'
+ *
+ * export default (
+ *   <WebService
+ *     name="api"
+ *     image="myapp/api:v1"
+ *     env={{ LOG_LEVEL: 'info' }}
+ *     secrets={{ DATABASE_URL: 'app-secrets', API_KEY: 'app-secrets' }}
+ *   />
+ * )
+ *
+ * @example
+ * import { WebService } from '@r8s/recipes'
+ *
+ * export default (
+ *   <WebService
+ *     name="api"
+ *     image="myapp/api:v1"
+ *     env={{ LOG_LEVEL: 'info' }}
+ *     vault={{ DATABASE_URL: { mount: 'kv', path: 'db/credentials' } }}
+ *   />
+ * )
+ */
+export declare function WebService(props: WebServiceProps): import("@r8s/core").r8sElement[];
+//# sourceMappingURL=web-service.d.ts.map

package/dist/web-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-service.d.ts","sourceRoot":"","sources":["../src/web-service.tsx"],"names":[],"mappings":"AACA,OAAO,EAAuB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAI5D,MAAM,WAAW,SAAS;IACxB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;IAC5C,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,oCA8JhD"}