@r8s/recipes 0.2.0 → 0.2.1

package/dist/index.js

@@ -4,7 +4,7 @@
 // with good defaults. Named after what the user wants to achieve, not the
 // underlying tools.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperator = exports.CertManager = exports.CertContext = exports.CertProvider = exports.EnvoyGateway = exports.Nginx = exports.EndpointContext = exports.EndpointProvider = exports.ExternalDns = exports.DnsContext = exports.DnsProvider = exports.ManualSecrets = exports.SealedSecrets = exports.Vault = exports.OpenBao = exports.SecretProvider = exports.Backup = exports.Monitoring = exports.Auth = exports.WebService = exports.Endpoint = exports.Database = exports.App = exports.R8sCluster = exports.Platform = void 0;
+exports.secretsRequiredError = exports.maybeOperator = exports.useOperators = exports.StaticSecret = exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperator = exports.CertManager = exports.CertContext = exports.CertProvider = exports.EnvoyGateway = exports.Nginx = exports.EndpointContext = exports.EndpointProvider = exports.ExternalDns = exports.DnsContext = exports.DnsProvider = exports.canProvisionSecrets = exports.provisionerForSecretProvider = exports.ManualSecrets = exports.SealedSecrets = exports.Vault = exports.OpenBao = exports.SecretProvider = exports.Backup = exports.Monitoring = exports.Auth = exports.WebService = exports.Endpoint = exports.Database = exports.App = exports.R8sCluster = exports.Platform = void 0;
 var platform_1 = require("./platform");
 Object.defineProperty(exports, "Platform", { enumerable: true, get: function () { return platform_1.Platform; } });
 var r8s_cluster_1 = require("./r8s-cluster");
@@ -30,6 +30,8 @@ Object.defineProperty(exports, "OpenBao", { enumerable: true, get: function () {
 Object.defineProperty(exports, "Vault", { enumerable: true, get: function () { return secret_provider_1.Vault; } });
 Object.defineProperty(exports, "SealedSecrets", { enumerable: true, get: function () { return secret_provider_1.SealedSecrets; } });
 Object.defineProperty(exports, "ManualSecrets", { enumerable: true, get: function () { return secret_provider_1.ManualSecrets; } });
+Object.defineProperty(exports, "provisionerForSecretProvider", { enumerable: true, get: function () { return secret_provider_1.provisionerForSecretProvider; } });
+Object.defineProperty(exports, "canProvisionSecrets", { enumerable: true, get: function () { return secret_provider_1.canProvisionSecrets; } });
 var dns_provider_1 = require("./dns-provider");
 Object.defineProperty(exports, "DnsProvider", { enumerable: true, get: function () { return dns_provider_1.DnsProvider; } });
 Object.defineProperty(exports, "DnsContext", { enumerable: true, get: function () { return dns_provider_1.DnsContext; } });
@@ -48,4 +50,12 @@ var operators_1 = require("./operators");
 Object.defineProperty(exports, "cnpgOperator", { enumerable: true, get: function () { return operators_1.cnpgOperator; } });
 Object.defineProperty(exports, "nginxIngressOperator", { enumerable: true, get: function () { return operators_1.nginxIngressOperator; } });
 Object.defineProperty(exports, "vaultSecretsOperator", { enumerable: true, get: function () { return operators_1.vaultSecretsOperator; } });
+var static_secret_1 = require("./static-secret");
+Object.defineProperty(exports, "StaticSecret", { enumerable: true, get: function () { return static_secret_1.StaticSecret; } });
+// Composition helpers — loose building blocks for packages
+var operators_2 = require("./operators");
+Object.defineProperty(exports, "useOperators", { enumerable: true, get: function () { return operators_2.useOperators; } });
+Object.defineProperty(exports, "maybeOperator", { enumerable: true, get: function () { return operators_2.maybeOperator; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "secretsRequiredError", { enumerable: true, get: function () { return errors_1.secretsRequiredError; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,4EAA4E;AAC5E,0EAA0E;AAC1E,oBAAoB;;;AAEpB,uCAA2E;AAAlE,oGAAA,QAAQ,OAAA;AACjB,6CAAgE;AAAvD,yGAAA,UAAU,OAAA;AACnB,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,6CAKsB;AAJpB,yGAAA,UAAU,OAAA;AAKZ,+BAA6C;AAApC,4FAAA,IAAI,OAAA;AACb,2CAA+D;AAAtD,wGAAA,UAAU,OAAA;AACnB,mCAAmD;AAA1C,gGAAA,MAAM,OAAA;AAEf,wEAAwE;AACxE,qDAY0B;AAXxB,iHAAA,cAAc,OAAA;AAGd,0GAAA,OAAO,OAAA;AAEP,wGAAA,KAAK,OAAA;AAEL,gHAAA,aAAa,OAAA;AAEb,gHAAA,aAAa,OAAA;AAGf,+CAQuB;AAPrB,2GAAA,WAAW,OAAA;AAIX,0GAAA,UAAU,OAAA;AACV,2GAAA,WAAW,OAAA;AAGb,yDAU4B;AAT1B,qHAAA,gBAAgB,OAAA;AAIhB,oHAAA,eAAe,OAAA;AACf,0GAAA,KAAK,OAAA;AAEL,iHAAA,YAAY,OAAA;AAGd,iDAQwB;AAPtB,6GAAA,YAAY,OAAA;AAIZ,4GAAA,WAAW,OAAA;AACX,4GAAA,WAAW,OAAA;AAIb,uDAAuD;AACvD,yCAAsF;AAA7E,yGAAA,YAAY,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,4EAA4E;AAC5E,0EAA0E;AAC1E,oBAAoB;;;AAEpB,uCAA2E;AAAlE,oGAAA,QAAQ,OAAA;AACjB,6CAAgE;AAAvD,yGAAA,UAAU,OAAA;AACnB,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,6CAKsB;AAJpB,yGAAA,UAAU,OAAA;AAKZ,+BAA6C;AAApC,4FAAA,IAAI,OAAA;AACb,2CAA+D;AAAtD,wGAAA,UAAU,OAAA;AACnB,mCAAmD;AAA1C,gGAAA,MAAM,OAAA;AAEf,wEAAwE;AACxE,qDAc0B;AAbxB,iHAAA,cAAc,OAAA;AAGd,0GAAA,OAAO,OAAA;AAEP,wGAAA,KAAK,OAAA;AAEL,gHAAA,aAAa,OAAA;AAEb,gHAAA,aAAa,OAAA;AAEb,+HAAA,4BAA4B,OAAA;AAC5B,sHAAA,mBAAmB,OAAA;AAErB,+CAQuB;AAPrB,2GAAA,WAAW,OAAA;AAIX,0GAAA,UAAU,OAAA;AACV,2GAAA,WAAW,OAAA;AAGb,yDAU4B;AAT1B,qHAAA,gBAAgB,OAAA;AAIhB,oHAAA,eAAe,OAAA;AACf,0GAAA,KAAK,OAAA;AAEL,iHAAA,YAAY,OAAA;AAGd,iDAQwB;AAPtB,6GAAA,YAAY,OAAA;AAIZ,4GAAA,WAAW,OAAA;AACX,4GAAA,WAAW,OAAA;AAIb,uDAAuD;AACvD,yCAAsF;AAA7E,yGAAA,YAAY,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAEjE,iDAAsE;AAA7D,6GAAA,YAAY,OAAA;AAErB,2DAA2D;AAC3D,yCAAyD;AAAhD,yGAAA,YAAY,OAAA;AAAE,0GAAA,aAAa,OAAA;AACpC,mCAA4E;AAAnE,8GAAA,oBAAoB,OAAA"}

package/dist/operators.d.ts

@@ -1,5 +1,19 @@
+import { declareOperator } from '@r8s/core';
+import type { Operator } from '@r8s/k8s-types';
+/**
+ * Read the operators already declared by the Platform tree. Packages call
+ * this once (unconditionally) and pass the result to maybeOperator() —
+ * no sharedOperators.some(...) boilerplate in every package.
+ */
+export declare function useOperators(): Operator[];
+/**
+ * Declare an operator unless the Platform already provides it. Returns
+ * [] (nothing to add) or a one-element array — spread into resources:
+ * `resources_.push(...maybeOperator('redis-operator', shared))`
+ */
+export declare function maybeOperator(name: string, shared: Operator[], version?: string): ReturnType<typeof declareOperator>[];
 /** CloudNativePG operator declaration */
-export declare const cnpgOperator: (version?: string) => import("@r8s/k8s-types").Operator;
+export declare const cnpgOperator: (version?: string) => Operator;
 /** NGINX Ingress Controller operator declaration (not in operators.yaml — nginx-specific) */
 export declare const nginxIngressOperator: (version?: string) => {
     name: string;
@@ -15,5 +29,5 @@ export declare const nginxIngressOperator: (version?: string) => {
     installCommand: string;
 };
 /** Vault Secrets Operator declaration */
-export declare const vaultSecretsOperator: (version?: string) => import("@r8s/k8s-types").Operator;
+export declare const vaultSecretsOperator: (version?: string) => Operator;
 //# sourceMappingURL=operators.d.ts.map

package/dist/operators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operators.d.ts","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":"AAQA,yCAAyC;AACzC,eAAO,MAAM,YAAY,yDAAoB,CAAA;AAE7C,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,GAAI,gBAAkB;;;;;;;;;;;;CAYrD,CAAA;AAEF,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,yDAAsC,CAAA"}
+{"version":3,"file":"operators.d.ts","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":"AAOA,OAAO,EAAc,eAAe,EAAE,MAAM,WAAW,CAAA;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,QAAQ,EAAE,CAEzC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,QAAQ,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,UAAU,CAAC,OAAO,eAAe,CAAC,EAAE,CAMtC;AAED,yCAAyC;AACzC,eAAO,MAAM,YAAY,gCAAoB,CAAA;AAE7C,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,GAAI,gBAAkB;;;;;;;;;;;;CAYrD,CAAA;AAEF,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,gCAAsC,CAAA"}

package/dist/operators.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperator = void 0;
+exports.useOperators = useOperators;
+exports.maybeOperator = maybeOperator;
 /**
  * Operator declarations re-exported from @r8s/crds.
  *
@@ -8,6 +10,30 @@ exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperat
  * exist for backwards compatibility with recipes that import from here.
  */
 const crds_1 = require("@r8s/crds");
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+/**
+ * Read the operators already declared by the Platform tree. Packages call
+ * this once (unconditionally) and pass the result to maybeOperator() —
+ * no sharedOperators.some(...) boilerplate in every package.
+ */
+function useOperators() {
+    return (0, core_1.useContext)(defaults_1.OperatorContext);
+}
+/**
+ * Declare an operator unless the Platform already provides it. Returns
+ * [] (nothing to add) or a one-element array — spread into resources:
+ * `resources_.push(...maybeOperator('redis-operator', shared))`
+ */
+function maybeOperator(name, shared, version) {
+    if (shared.some((op) => op.name === name))
+        return [];
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const factory = crds_1.operators[name];
+    if (!factory)
+        throw new Error(`Unknown operator '${name}' — check packages/crds/operators.yaml`);
+    return [(0, core_1.declareOperator)(factory(version))];
+}
 /** CloudNativePG operator declaration */
 exports.cnpgOperator = crds_1.operators['cnpg'];
 /** NGINX Ingress Controller operator declaration (not in operators.yaml — nginx-specific) */

package/dist/operators.js.map

@@ -1 +1 @@
-{"version":3,"file":"operators.js","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,oCAAqC;AAErC,yCAAyC;AAC5B,QAAA,YAAY,GAAG,gBAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,6FAA6F;AACtF,MAAM,oBAAoB,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE;QACN,IAAI,EAAE,UAAmB;QACzB,GAAG,EAAE,0EAA0E,OAAO,2CAA2C;QACjI,OAAO;QACP,SAAS,EAAE,eAAe;KAC3B;IACD,OAAO;IACP,SAAS,EAAE,eAAe;IAC1B,cAAc,EAAE,yGAAyG,OAAO,2CAA2C;CAC5K,CAAC,CAAA;AAZW,QAAA,oBAAoB,wBAY/B;AAEF,yCAAyC;AAC5B,QAAA,oBAAoB,GAAG,gBAAS,CAAC,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"operators.js","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":";;;AAgBA,oCAEC;AAOD,sCAUC;AAnCD;;;;;GAKG;AACH,oCAAqC;AACrC,oCAAuD;AACvD,iDAAoD;AAGpD;;;;GAIG;AACH,SAAgB,YAAY;IAC1B,OAAO,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,IAAY,EACZ,MAAkB,EAClB,OAAgB;IAEhB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IACpD,8DAA8D;IAC9D,MAAM,OAAO,GAAI,gBAAmE,CAAC,IAAI,CAAC,CAAA;IAC1F,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wCAAwC,CAAC,CAAA;IAChG,OAAO,CAAC,IAAA,sBAAe,EAAC,OAAO,CAAC,OAAO,CAAU,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,yCAAyC;AAC5B,QAAA,YAAY,GAAG,gBAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,6FAA6F;AACtF,MAAM,oBAAoB,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE;QACN,IAAI,EAAE,UAAmB;QACzB,GAAG,EAAE,0EAA0E,OAAO,2CAA2C;QACjI,OAAO;QACP,SAAS,EAAE,eAAe;KAC3B;IACD,OAAO;IACP,SAAS,EAAE,eAAe;IAC1B,cAAc,EAAE,yGAAyG,OAAO,2CAA2C;CAC5K,CAAC,CAAA;AAZW,QAAA,oBAAoB,wBAY/B;AAEF,yCAAyC;AAC5B,QAAA,oBAAoB,GAAG,gBAAS,CAAC,wBAAwB,CAAC,CAAA"}

package/dist/secret-provider.d.ts

@@ -1,4 +1,13 @@
-import { type SecretProvider as SecretProviderConfig } from '@r8s/core/defaults';
+import { type SecretProvider as SecretProviderConfig, type SecretProvisioner } from '@r8s/core/defaults';
+/**
+ * Provisioner resolution — THE single identity-aware point in the platform.
+ * Everything downstream codes against the `provision()` capability; new
+ * backends plug in by carrying their own provisioner on the context value
+ * (or by being registered here — the orchestration point).
+ */
+export declare function provisionerForSecretProvider(provider: SecretProviderConfig | null | undefined): SecretProvisioner | undefined;
+/** Can this provider provision secrets? (capability check, not identity) */
+export declare function canProvisionSecrets(provider: SecretProviderConfig | null | undefined): provider is SecretProviderConfig;
 /**
  * OpenBao configuration component.
  *

package/dist/secret-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,IAAI,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAI/F;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAQjE;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAQ7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;CAAG;AAEtC,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,kCA0CxD"}
+{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,IAAI,oBAAoB,EAC3C,KAAK,iBAAiB,EAEvB,MAAM,oBAAoB,CAAA;AAI3B;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAChD,iBAAiB,GAAG,SAAS,CAO/B;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAChD,QAAQ,IAAI,oBAAoB,CAElC;AA2DD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAQjE;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAQ7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;CAAG;AAEtC,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,kCA0CxD"}

package/dist/secret-provider.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.provisionerForSecretProvider = provisionerForSecretProvider;
+exports.canProvisionSecrets = canProvisionSecrets;
 exports.OpenBao = OpenBao;
 exports.Vault = Vault;
 exports.SealedSecrets = SealedSecrets;
@@ -9,6 +11,78 @@ const core_1 = require("@r8s/core");
 const defaults_1 = require("@r8s/core/defaults");
 const defaults_2 = require("@r8s/core/defaults");
 const crds_1 = require("@r8s/crds");
+/**
+ * Provisioner resolution — THE single identity-aware point in the platform.
+ * Everything downstream codes against the `provision()` capability; new
+ * backends plug in by carrying their own provisioner on the context value
+ * (or by being registered here — the orchestration point).
+ */
+function provisionerForSecretProvider(provider) {
+    if (!provider)
+        return undefined;
+    if (typeof provider.provision === 'function')
+        return provider.provision;
+    if (provider.backend === 'vault' || provider.backend === 'openbao') {
+        return (req) => builtinProvisionStaticSecret(provider, req);
+    }
+    return undefined;
+}
+/** Can this provider provision secrets? (capability check, not identity) */
+function canProvisionSecrets(provider) {
+    return provisionerForSecretProvider(provider) !== undefined;
+}
+/** Built-in Vault/OpenBao emission (VaultStaticSecret / OpenBaoStaticSecret) */
+function builtinProvisionStaticSecret(provider, req) {
+    // Two modes: an EXHAUSTIVE bundle (keys/templates given — destination
+    // carries exactly those keys, excludeRaw) or a RAW SYNC (empty keys and
+    // no templates — destination passes the whole store entry through,
+    // legacy Database/operator-contract shape).
+    const exhaustive = Object.keys(req.keys).length > 0 || req.templates !== undefined;
+    const spec = {
+        ...(provider.backend === 'vault'
+            ? { vaultAuthRef: req.authRef ?? provider.authRef }
+            : { openbaoAuthRef: req.authRef ?? provider.authRef }),
+        mount: req.mount ?? provider.mount,
+        type: 'kv-v2',
+        path: req.path,
+        refreshAfter: req.refreshAfter ?? provider.refreshAfter ?? (exhaustive ? '1h' : undefined),
+        ...(req.restartTargets && req.restartTargets.length > 0
+            ? { rolloutRestartTargets: req.restartTargets }
+            : {}),
+        destination: exhaustive
+            ? {
+                create: true,
+                name: req.secretName ?? req.name,
+                overwrite: true,
+                transformation: {
+                    excludeRaw: true,
+                    templates: {
+                        ...Object.fromEntries(Object.entries(req.keys).map(([dest, src]) => [
+                            dest,
+                            { text: `{{ .Secrets.${src} }}` },
+                        ])),
+                        // Raw passthrough templates (literals, composed templates) win
+                        // over key-mapped entries on collision
+                        ...Object.fromEntries(Object.entries(req.templates ?? {}).map(([dest, tpl]) => [dest, { text: tpl }])),
+                    },
+                },
+            }
+            : { create: true, name: req.secretName ?? req.name },
+    };
+    return provider.backend === 'vault'
+        ? (0, core_1.jsx)('VaultStaticSecret', {
+            apiVersion: 'secrets.hashicorp.com/v1beta1',
+            kind: 'VaultStaticSecret',
+            metadata: { name: req.name, namespace: req.namespace },
+            spec,
+        })
+        : (0, core_1.jsx)('OpenBaoStaticSecret', {
+            apiVersion: 'secrets.openbao.org/v1beta1',
+            kind: 'OpenBaoStaticSecret',
+            metadata: { name: req.name, namespace: req.namespace },
+            spec,
+        });
+}
 function OpenBao(props) {
     return {
         backend: 'openbao',

package/dist/secret-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":";;AAwBA,0BAQC;AAgBD,sBAQC;AAUD,sCAIC;AAUD,sCAIC;AA2ED,wCA0CC;AAzMD,oCAAsE;AACtE,iDAA+F;AAC/F,iDAAoD;AACpD,oCAAqC;AAqBrC,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAgBD,SAAgB,KAAK,CAAC,KAAiB;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,IAAI,MAA4B,CAAA;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;SAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAI,QAAgB,CAAC,IAAI,CAAA;QACxC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,OAAO,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,KAAK,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,wBAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACnF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":";;AAgBA,oEASC;AAGD,kDAIC;AA8ED,0BAQC;AAgBD,sBAQC;AAUD,sCAIC;AAUD,sCAIC;AA2ED,wCA0CC;AA/RD,oCAAsE;AACtE,iDAK2B;AAC3B,iDAAoD;AACpD,oCAAqC;AAErC;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,QAAiD;IAEjD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC,SAAS,CAAA;IACvE,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,4EAA4E;AAC5E,SAAgB,mBAAmB,CACjC,QAAiD;IAEjD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA;AAC7D,CAAC;AAED,gFAAgF;AAChF,SAAS,4BAA4B,CAAC,QAA8B,EAAE,GAAwB;IAC5F,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAA;IAClF,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;YACnD,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;QAClC,IAAI,EAAE,OAAgB;QACtB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,CAAC,cAAc,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EAAE,UAAU;YACrB,CAAC,CAAC;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI;gBAChC,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE;oBACd,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE;wBACT,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;4BAC5C,IAAI;4BACJ,EAAE,IAAI,EAAE,eAAe,GAAG,KAAK,EAAE;yBAClC,CAAC,CACH;wBACD,+DAA+D;wBAC/D,uCAAuC;wBACvC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAChF;qBACF;iBACF;aACF;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE;KACvD,CAAA;IACD,OAAO,QAAQ,CAAC,OAAO,KAAK,OAAO;QACjC,CAAC,CAAC,IAAA,UAAG,EAAC,mBAAmB,EAAE;YACvB,UAAU,EAAE,+BAA+B;YAC3C,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;YACtD,IAAI;SACL,CAAC;QACJ,CAAC,CAAC,IAAA,UAAG,EAAC,qBAAqB,EAAE;YACzB,UAAU,EAAE,6BAA6B;YACzC,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;YACtD,IAAI;SACL,CAAC,CAAA;AACR,CAAC;AAqBD,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAgBD,SAAgB,KAAK,CAAC,KAAiB;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,IAAI,MAA4B,CAAA;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;SAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAI,QAAgB,CAAC,IAAI,CAAA;QACxC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,OAAO,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,KAAK,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,wBAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACnF,CAAC,CAAA;AACJ,CAAC"}

package/dist/static-secret.d.ts

@@ -0,0 +1,107 @@
+export interface StaticSecretProps {
+    /**
+     * Resource name (also the default for the provisioned Kubernetes
+     * Secret's name — override with secretName).
+     */
+    name: string;
+    /** Kubernetes namespace (inherited from Platform context when omitted) */
+    namespace?: string;
+    /**
+     * Vault/OpenBao KV v2 path holding the source keys, e.g. 'outline/app'.
+     * Build it from the provider's base path when composing:
+     * `${secretProvider.path}/myapp/credentials`.
+     */
+    path: string;
+    /**
+     * Destination→source key mapping. The destination carries env-case
+     * names consumed by the app; the vault/store keys stay snake_case:
+     *   keys={{ SECRET_KEY: 'secret_key', UTILS_SECRET: 'utils_secret' }}
+     * A string array is shorthand for identity mappings ({ KEY: 'KEY' }).
+     *
+     * Rendered as destination.transformation.templates + excludeRaw —
+     * the destination holds ONLY these keys.
+     */
+    keys: Record<string, string> | string[];
+    /**
+     * Raw Go-template passthrough merged AFTER the keys mapping — for
+     * advanced bundles needing literals or composed templates
+     * (e.g. `AWS_ENDPOINTS: 'https://s3.berget.cloud'`). Passthrough wins
+     * over key-mapped entries on collision.
+     */
+    templates?: Record<string, string>;
+    /** Provisioned Kubernetes Secret name (defaults to name) */
+    secretName?: string;
+    /**
+     * Re-sync interval rendered as refreshAfter. Defaults to the provider's
+     * refreshAfter, else '1h'.
+     */
+    refreshAfter?: string;
+    /**
+     * Workloads restarted after rotation (rolloutRestartTargets). Pass the
+     * workloads consuming these values so a rotation actually takes effect —
+     * pod env vars do not update in place.
+     *
+     * Deliberately has no default: some consumers read the Secret at use
+     * time (e.g. CNPG barman backup credentials are read when a backup
+     * runs, and the Cluster CRD is not a supported restart target), so an
+     * automatic restart is wrong for them.
+     */
+    restart?: {
+        kind?: string;
+        name: string;
+        apiVersion?: string;
+    }[];
+    /**
+     * Auth reference override (defaults to the provider's authRef).
+     * Rendered as vaultAuthRef / openbaoAuthRef per backend.
+     */
+    authRef?: string;
+}
+/**
+ * StaticSecret — provision a Kubernetes Secret from Vault/OpenBao,
+ * with rotation semantics that actually reach the workloads.
+ *
+ * Wraps VaultStaticSecret / OpenBaoStaticSecret with the platform's
+ * conventions baked in:
+ * - snake_case source keys templated to env-case destination keys
+ *   (excludeRaw: only the declared keys land in the Secret)
+ * - destination create + overwrite (idempotent sync)
+ * - hourly refresh by default, inheriting the provider's refreshAfter
+ * - explicit, per-bundle restart semantics (app creds restart pods;
+ *   backup creds read at use time never restart)
+ *
+ * Requires an active secrets backend (openbao or vault) — passive
+ * backends (manual-secrets, sealed-secrets) cannot provision: reference
+ * a pre-created Secret instead.
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret
+ *       name="myapp-secrets"
+ *       path="myapp/app"
+ *       keys={{
+ *         SECRET_KEY: 'secret_key',
+ *         OIDC_CLIENT_ID: 'oidc_client_id',
+ *         OIDC_CLIENT_SECRET: 'oidc_client_secret',
+ *       }}
+ *       restart={[{ kind: 'Deployment', name: 'myapp' }]}
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * // backup creds: read at use time — never restart workloads
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret name="myapp-backup-creds" path="rustfs/myapp"
+ *       keys={['accesskey', 'secretkey']} />
+ *   </Platform>
+ * )
+ */
+export declare function StaticSecret(props: StaticSecretProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=static-secret.d.ts.map

package/dist/static-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-secret.d.ts","sourceRoot":"","sources":["../src/static-secret.tsx"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAA;IACvC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAChE;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,kCAoDpD"}

package/dist/static-secret.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaticSecret = StaticSecret;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const secret_provider_1 = require("./secret-provider");
+/**
+ * StaticSecret — provision a Kubernetes Secret from Vault/OpenBao,
+ * with rotation semantics that actually reach the workloads.
+ *
+ * Wraps VaultStaticSecret / OpenBaoStaticSecret with the platform's
+ * conventions baked in:
+ * - snake_case source keys templated to env-case destination keys
+ *   (excludeRaw: only the declared keys land in the Secret)
+ * - destination create + overwrite (idempotent sync)
+ * - hourly refresh by default, inheriting the provider's refreshAfter
+ * - explicit, per-bundle restart semantics (app creds restart pods;
+ *   backup creds read at use time never restart)
+ *
+ * Requires an active secrets backend (openbao or vault) — passive
+ * backends (manual-secrets, sealed-secrets) cannot provision: reference
+ * a pre-created Secret instead.
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret
+ *       name="myapp-secrets"
+ *       path="myapp/app"
+ *       keys={{
+ *         SECRET_KEY: 'secret_key',
+ *         OIDC_CLIENT_ID: 'oidc_client_id',
+ *         OIDC_CLIENT_SECRET: 'oidc_client_secret',
+ *       }}
+ *       restart={[{ kind: 'Deployment', name: 'myapp' }]}
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * // backup creds: read at use time — never restart workloads
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret name="myapp-backup-creds" path="rustfs/myapp"
+ *       keys={['accesskey', 'secretkey']} />
+ *   </Platform>
+ * )
+ */
+function StaticSecret(props) {
+    const { name, namespace: namespaceProp, path, keys, templates, secretName, refreshAfter, restart, authRef, } = props;
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const provisioner = (0, secret_provider_1.provisionerForSecretProvider)(secretProvider);
+    if (!provisioner) {
+        throw new Error(`StaticSecret "${name}" requires a provisioning secrets backend (openbao, vault,\n` +
+            `or any provider carrying a provision() hook).\n` +
+            `\n` +
+            `Fix: configure a backend on the Platform:\n` +
+            `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+            `    <StaticSecret name="${name}" path="${path}" keys={...} />\n` +
+            `  </Platform>\n` +
+            `\n` +
+            `On passive backends (manual-secrets, sealed-secrets, kubernetes), create the Secret\n` +
+            `out of band and reference it directly instead of rendering this component.`);
+    }
+    const mapping = Object.fromEntries((Array.isArray(keys) ? keys.map((k) => [k, k]) : Object.entries(keys)));
+    // Default missing fields (consistent with Database/WebService restart
+    // target conventions)
+    const restartTargets = restart?.map((t) => ({ kind: 'Deployment', ...t }));
+    const el = provisioner({
+        name,
+        namespace,
+        path,
+        keys: mapping,
+        templates,
+        secretName,
+        authRef,
+        refreshAfter,
+        restartTargets,
+    });
+    return Array.isArray(el) ? (0, core_1.jsx)(core_1.Fragment, { children: el }) : el;
+}
+//# sourceMappingURL=static-secret.js.map

package/dist/static-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-secret.js","sourceRoot":"","sources":["../src/static-secret.tsx"],"names":[],"mappings":";;AA0GA,oCAoDC;AA9JD,oCAAqD;AACrD,iDAAgE;AAChE,uDAAgE;AA0DhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,MAAM,EACJ,IAAI,EACJ,SAAS,EAAE,aAAa,EACxB,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,UAAU,EACV,YAAY,EACZ,OAAO,EACP,OAAO,GACR,GAAG,KAAK,CAAA;IAET,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAA,8CAA4B,EAAC,cAAc,CAAC,CAAA;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,8DAA8D;YACjF,iDAAiD;YACjD,IAAI;YACJ,6CAA6C;YAC7C,4EAA4E;YAC5E,2BAA2B,IAAI,WAAW,IAAI,mBAAmB;YACjE,iBAAiB;YACjB,IAAI;YACJ,uFAAuF;YACvF,4EAA4E,CAC/E,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAA2B,MAAM,CAAC,WAAW,CACxD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAuB,CAC7F,CAAA;IAED,sEAAsE;IACtE,sBAAsB;IACtB,MAAM,cAAc,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAE1E,MAAM,EAAE,GAAG,WAAW,CAAC;QACrB,IAAI;QACJ,SAAS;QACT,IAAI;QACJ,IAAI,EAAE,OAAO;QACb,SAAS;QACT,UAAU;QACV,OAAO;QACP,YAAY;QACZ,cAAc;KACf,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAA6B,CAAA;AAC7F,CAAC"}

package/dist/web-service.d.ts

@@ -100,7 +100,11 @@ export interface WebServiceProps {
     tolerations?: Record<string, unknown>[];
     /** Pod topologySpreadConstraints (spread replicas across nodes) */
     topologySpreadConstraints?: Record<string, unknown>[];
-    /** Deployment update strategy — 'Recreate' for RWO-volume/migration apps */
+    /**
+     * Deployment update strategy ('Recreate' for RWO-volume/migration apps).
+     * Default: 'Recreate' when the pod mounts a PVC volume and replicas=1
+     * (RollingUpdate would deadlock on the single-attach volume).
+     */
     strategy?: 'Recreate' | 'RollingUpdate' | {
         type: string;
         rollingUpdate?: {
@@ -130,7 +134,11 @@ export interface WebServiceProps {
     } & Record<string, unknown>)[];
     /** Container lifecycle hooks (e.g. { preStop: { exec: { command: [...] } } }) */
     lifecycle?: Record<string, unknown>;
-    /** Image pull policy (defaults to 'Always') */
+    /**
+     * Image pull policy. Default depends on the tag: floating tags
+     * (latest/main/master/dev/edge/head/nightly/canary) get 'Always', pinned
+     * tags and digests get 'IfNotPresent' (immutable — pointless to re-pull).
+     */
     imagePullPolicy?: 'Always' | 'IfNotPresent' | 'Never';
     /** Names of Secrets used to pull private registry images */
     imagePullSecrets?: string[];

package/dist/web-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-service.d.ts","sourceRoot":"","sources":["../src/web-service.tsx"],"names":[],"mappings":"AACA,OAAO,EAAuB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAI5D,MAAM,WAAW,SAAS;IACxB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC9E;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC3B,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC5B,gFAAgF;QAChF,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;KAC3B,CAAA;IACD,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;IAC5C,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,gCAAgC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACvC,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,EACL,UAAU,GACV,eAAe,GACf;QACE,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAA;KACjF,CAAA;IACL,iFAAiF;IACjF,OAAO,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IACxD,0CAA0C;IAC1C,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1F;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IAC9E,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,+CAA+C;IAC/C,eAAe,CAAC,EAAE,QAAQ,GAAG,cAAc,GAAG,OAAO,CAAA;IACrD,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,oCAwOhD"}
+{"version":3,"file":"web-service.d.ts","sourceRoot":"","sources":["../src/web-service.tsx"],"names":[],"mappings":"AACA,OAAO,EAAuB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAI5D,MAAM,WAAW,SAAS;IACxB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC9E;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC3B,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC5B,gFAAgF;QAChF,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;KAC3B,CAAA;IACD,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;IAC5C,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,gCAAgC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACvC,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACrD;;;;OAIG;IACH,QAAQ,CAAC,EACL,UAAU,GACV,eAAe,GACf;QACE,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAA;KACjF,CAAA;IACL,iFAAiF;IACjF,OAAO,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IACxD,0CAA0C;IAC1C,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1F;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IAC9E,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC;;;;OAIG;IACH,eAAe,CAAC,EAAE,QAAQ,GAAG,cAAc,GAAG,OAAO,CAAA;IACrD,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,oCAuRhD"}

package/dist/web-service.js

@@ -42,7 +42,7 @@ const operators_1 = require("./operators");
  * )
  */
 function WebService(props) {
-    const { name, namespace = 'default', image, port = 3000, replicas = 2, probes, env = {}, secrets = {}, vault = {}, command, args, rawEnv = [], resources, securityContext, podSecurityContext, tolerations, topologySpreadConstraints, strategy, volumes, volumeMounts, initContainers, lifecycle, imagePullPolicy = 'Always', imagePullSecrets, } = props;
+    const { name, namespace: namespaceProp, image, port = 3000, replicas = 2, probes, env = {}, secrets = {}, vault = {}, command, args, rawEnv = [], resources, securityContext, podSecurityContext, tolerations, topologySpreadConstraints, strategy, volumes, volumeMounts, initContainers, lifecycle, imagePullPolicy, imagePullSecrets, } = props;
     const buildProbe = (spec, fallbackPath) => {
         if (spec === null)
             return undefined;
@@ -51,18 +51,57 @@ function WebService(props) {
         const initialDelaySeconds = spec.initialDelaySeconds ?? 10;
         const periodSeconds = spec.periodSeconds ?? 10;
         if (spec.tcp) {
-            return { tcpSocket: { port: spec.port ?? port }, initialDelaySeconds, periodSeconds };
+            return {
+                tcpSocket: { port: spec.port ?? port },
+                initialDelaySeconds,
+                periodSeconds,
+                // !== undefined (not truthy): an explicit 0 must surface as-is so
+                // Kubernetes validation fails loudly instead of silently reverting
+                // to the default
+                ...(spec.failureThreshold !== undefined && { failureThreshold: spec.failureThreshold }),
+            };
         }
         return {
             httpGet: { path: spec.path ?? fallbackPath, port: spec.port ?? port },
             initialDelaySeconds,
             periodSeconds,
-            ...(spec.failureThreshold && { failureThreshold: spec.failureThreshold }),
+            ...(spec.failureThreshold !== undefined && { failureThreshold: spec.failureThreshold }),
         };
     };
     const livenessProbe = buildProbe(probes?.liveness, '/health');
     const readinessProbe = buildProbe(probes?.readiness, '/ready');
     const startupProbe = buildProbe(probes?.startup ?? null, '/health');
+    // --- Safe defaults derived from the image and storage shape -------------
+    // imagePullPolicy: a floating tag must be re-pulled (Always); a pinned tag
+    // (or digest) is immutable, so IfNotPresent avoids pointless pulls and
+    // makes deploys robust when a registry is slow/unreachable. Explicit prop
+    // always wins. Floating set covers the conventional mutables.
+    const imageLeaf = image.slice(image.lastIndexOf('/') + 1);
+    const imageTag = imageLeaf.includes('@')
+        ? imageLeaf.slice(imageLeaf.indexOf('@') + 1)
+        : imageLeaf.includes(':')
+            ? imageLeaf.slice(imageLeaf.indexOf(':') + 1)
+            : 'latest';
+    const FLOATING_TAGS = new Set([
+        'latest',
+        'main',
+        'master',
+        'dev',
+        'edge',
+        'head',
+        'nightly',
+        'canary',
+    ]);
+    const pullPolicy = imagePullPolicy ??
+        (!imageLeaf.includes('@') && FLOATING_TAGS.has(imageTag.toLowerCase())
+            ? 'Always'
+            : 'IfNotPresent');
+    // strategy: RollingUpdate + a ReadWriteOnce PVC + replicas=1 deadlocks
+    // (the new pod cannot attach the volume until the old releases it), and
+    // in-place DB-migration apps (n8n, outline) must not run two versions at
+    // once. Recreate is always safe at replicas=1 — there is already no HA.
+    const hasPvcVolume = (volumes ?? []).some((v) => 'persistentVolumeClaim' in v);
+    const derivedStrategy = strategy ?? (hasPvcVolume && replicas === 1 ? 'Recreate' : undefined);
     const envVars = [];
     const vaultResources = [];
     // Secrets from Kubernetes Secrets — pushed before plain env vars so
@@ -89,6 +128,7 @@ function WebService(props) {
         envVars.push({ name: key, value });
     }
     // Vault secrets — create VaultStaticSecret objects
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
     const platformSecrets = (0, core_1.useContext)(defaults_1.SecretContext);
     for (const [envName, ref] of Object.entries(vault)) {
         const secretName = `${name}-${envName.toLowerCase().replace(/_/g, '-')}-vault`;
@@ -166,8 +206,8 @@ function WebService(props) {
         metadata: { name, namespace, labels: { app: name } },
         spec: {
             replicas,
-            ...(strategy && {
-                strategy: typeof strategy === 'string' ? { type: strategy } : strategy,
+            ...(derivedStrategy && {
+                strategy: typeof derivedStrategy === 'string' ? { type: derivedStrategy } : derivedStrategy,
             }),
             selector: { matchLabels: { app: name } },
             template: {
@@ -187,7 +227,7 @@ function WebService(props) {
                         {
                             name: 'app',
                             image,
-                            imagePullPolicy,
+                            imagePullPolicy: pullPolicy,
                             ...(command && { command }),
                             ...(args && { args }),
                             ports: [{ containerPort: port }],
@@ -215,11 +255,14 @@ function WebService(props) {
             // Expose the app port directly (so consumers can reference it) while
             // keeping 80 as a stable backward-compatible alias: existing
             // Endpoints/default servicePort=80 users keep routing during
-            // migration to explicit servicePort
+            // migration to explicit servicePort.
+            // Port names are REQUIRED whenever a Service has more than one port —
+            // without them the API server rejects the resource (caught by Flux
+            // dry-run as "spec.ports[i].name: Required value").
             ports: [
-                { port, targetPort: port },
+                { name: 'http', port, targetPort: port },
                 // eslint-disable-next-line -- 80 alias for legacy servicePort=80 consumers
-                ...(port !== 80 ? [{ port: 80, targetPort: port }] : []),
+                ...(port !== 80 ? [{ name: 'http-80', port: 80, targetPort: port }] : []),
             ],
         },
     };