@r8s/recipes 0.2.0 → 0.3.0

package/dist/secret-provider.d.ts

@@ -1,4 +1,13 @@
-import { type SecretProvider as SecretProviderConfig } from '@r8s/core/defaults';
+import { type SecretProvider as SecretProviderConfig, type SecretProvisioner } from '@r8s/core/defaults';
+/**
+ * Provisioner resolution — THE single identity-aware point in the platform.
+ * Everything downstream codes against the `provision()` capability; new
+ * backends plug in by carrying their own provisioner on the context value
+ * (or by being registered here — the orchestration point).
+ */
+export declare function provisionerForSecretProvider(provider: SecretProviderConfig | null | undefined): SecretProvisioner | undefined;
+/** Can this provider provision secrets? (capability check, not identity) */
+export declare function canProvisionSecrets(provider: SecretProviderConfig | null | undefined): provider is SecretProviderConfig;
 /**
  * OpenBao configuration component.
  *
@@ -60,7 +69,7 @@ export interface SecretProviderProps {
      *
      * export default (
      *   <SecretProvider provider="openbao">
-     *     <Database name="app-db" />
+     *     <Database backup={false} name="app-db" />
      *   </SecretProvider>
      * )
      *
@@ -69,7 +78,7 @@ export interface SecretProviderProps {
      *
      * export default (
      *   <SecretProvider provider={<OpenBao mount="secret" path="infra" authRef="custom" />}>
-     *     <Database name="app-db" />
+     *     <Database backup={false} name="app-db" />
      *   </SecretProvider>
      * )
      */
@@ -88,7 +97,7 @@ export interface SecretProviderProps {
  *
  * export default (
  *   <SecretProvider provider="openbao">
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  *
@@ -97,7 +106,7 @@ export interface SecretProviderProps {
  *
  * export default (
  *   <SecretProvider provider={<OpenBao mount="secret" path="infra" authRef="custom-auth" />}>
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  *
@@ -106,7 +115,7 @@ export interface SecretProviderProps {
  *
  * export default (
  *   <SecretProvider provider={<Vault mount="kv" path="apps" />}>
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  *
@@ -115,7 +124,7 @@ export interface SecretProviderProps {
  *
  * export default (
  *   <SecretProvider provider="sealed-secrets">
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  */

package/dist/secret-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,IAAI,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAI/F;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAQjE;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAQ7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;CAAG;AAEtC,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,kCA0CxD"}
+{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,IAAI,oBAAoB,EAC3C,KAAK,iBAAiB,EAEvB,MAAM,oBAAoB,CAAA;AAI3B;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAChD,iBAAiB,GAAG,SAAS,CAO/B;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAChD,QAAQ,IAAI,oBAAoB,CAElC;AA2DD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,oBAAoB,CAQjE;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAQ7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;CAAG;AAEtC,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CAI7E;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,kCAuCxD"}

package/dist/secret-provider.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.provisionerForSecretProvider = provisionerForSecretProvider;
+exports.canProvisionSecrets = canProvisionSecrets;
 exports.OpenBao = OpenBao;
 exports.Vault = Vault;
 exports.SealedSecrets = SealedSecrets;
@@ -8,7 +10,79 @@ exports.SecretProvider = SecretProvider;
 const core_1 = require("@r8s/core");
 const defaults_1 = require("@r8s/core/defaults");
 const defaults_2 = require("@r8s/core/defaults");
-const crds_1 = require("@r8s/crds");
+const operator_vault_secrets_1 = require("@r8s/operator-vault-secrets");
+/**
+ * Provisioner resolution — THE single identity-aware point in the platform.
+ * Everything downstream codes against the `provision()` capability; new
+ * backends plug in by carrying their own provisioner on the context value
+ * (or by being registered here — the orchestration point).
+ */
+function provisionerForSecretProvider(provider) {
+    if (!provider)
+        return undefined;
+    if (typeof provider.provision === 'function')
+        return provider.provision;
+    if (provider.backend === 'vault' || provider.backend === 'openbao') {
+        return (req) => builtinProvisionStaticSecret(provider, req);
+    }
+    return undefined;
+}
+/** Can this provider provision secrets? (capability check, not identity) */
+function canProvisionSecrets(provider) {
+    return provisionerForSecretProvider(provider) !== undefined;
+}
+/** Built-in Vault/OpenBao emission (VaultStaticSecret / OpenBaoStaticSecret) */
+function builtinProvisionStaticSecret(provider, req) {
+    // Two modes: an EXHAUSTIVE bundle (keys/templates given — destination
+    // carries exactly those keys, excludeRaw) or a RAW SYNC (empty keys and
+    // no templates — destination passes the whole store entry through,
+    // legacy Database/operator-contract shape).
+    const exhaustive = Object.keys(req.keys).length > 0 || req.templates !== undefined;
+    const spec = {
+        ...(provider.backend === 'vault'
+            ? { vaultAuthRef: req.authRef ?? provider.authRef }
+            : { openbaoAuthRef: req.authRef ?? provider.authRef }),
+        mount: req.mount ?? provider.mount,
+        type: 'kv-v2',
+        path: req.path,
+        refreshAfter: req.refreshAfter ?? provider.refreshAfter ?? (exhaustive ? '1h' : undefined),
+        ...(req.restartTargets && req.restartTargets.length > 0
+            ? { rolloutRestartTargets: req.restartTargets }
+            : {}),
+        destination: exhaustive
+            ? {
+                create: true,
+                name: req.secretName ?? req.name,
+                overwrite: true,
+                transformation: {
+                    excludeRaw: true,
+                    templates: {
+                        ...Object.fromEntries(Object.entries(req.keys).map(([dest, src]) => [
+                            dest,
+                            { text: `{{ .Secrets.${src} }}` },
+                        ])),
+                        // Raw passthrough templates (literals, composed templates) win
+                        // over key-mapped entries on collision
+                        ...Object.fromEntries(Object.entries(req.templates ?? {}).map(([dest, tpl]) => [dest, { text: tpl }])),
+                    },
+                },
+            }
+            : { create: true, name: req.secretName ?? req.name },
+    };
+    return provider.backend === 'vault'
+        ? (0, core_1.jsx)('VaultStaticSecret', {
+            apiVersion: 'secrets.hashicorp.com/v1beta1',
+            kind: 'VaultStaticSecret',
+            metadata: { name: req.name, namespace: req.namespace },
+            spec,
+        })
+        : (0, core_1.jsx)('OpenBaoStaticSecret', {
+            apiVersion: 'secrets.openbao.org/v1beta1',
+            kind: 'OpenBaoStaticSecret',
+            metadata: { name: req.name, namespace: req.namespace },
+            spec,
+        });
+}
 function OpenBao(props) {
     return {
         backend: 'openbao',
@@ -48,7 +122,7 @@ function ManualSecrets(props) {
  *
  * export default (
  *   <SecretProvider provider="openbao">
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  *
@@ -57,7 +131,7 @@ function ManualSecrets(props) {
  *
  * export default (
  *   <SecretProvider provider={<OpenBao mount="secret" path="infra" authRef="custom-auth" />}>
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  *
@@ -66,7 +140,7 @@ function ManualSecrets(props) {
  *
  * export default (
  *   <SecretProvider provider={<Vault mount="kv" path="apps" />}>
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  *
@@ -75,7 +149,7 @@ function ManualSecrets(props) {
  *
  * export default (
  *   <SecretProvider provider="sealed-secrets">
- *     <Database name="app-db" />
+ *     <Database backup={false} name="app-db" />
  *   </SecretProvider>
  * )
  */
@@ -115,10 +189,7 @@ function SecretProvider(props) {
     const resources = [];
     // Declare VSO for vault/openbao
     if (config.backend === 'vault' || config.backend === 'openbao') {
-        const hasVSO = sharedOperators.some((op) => op.name === 'vault-secrets-operator');
-        if (!hasVSO) {
-            resources.push((0, core_1.declareOperator)(crds_1.operators['vault-secrets-operator']()));
-        }
+        resources.push(...(0, operator_vault_secrets_1.declareIfMissing)(sharedOperators));
     }
     return (0, core_1.jsx)(core_1.Fragment, {
         children: [...resources, (0, core_1.jsx)(defaults_1.SecretContext.Provider, { value: config, children })],

package/dist/secret-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":";;AAwBA,0BAQC;AAgBD,sBAQC;AAUD,sCAIC;AAUD,sCAIC;AA2ED,wCA0CC;AAzMD,oCAAsE;AACtE,iDAA+F;AAC/F,iDAAoD;AACpD,oCAAqC;AAqBrC,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAgBD,SAAgB,KAAK,CAAC,KAAiB;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,IAAI,MAA4B,CAAA;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;SAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAI,QAAgB,CAAC,IAAI,CAAA;QACxC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,OAAO,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,KAAK,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,wBAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACnF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.tsx"],"names":[],"mappings":";;AAgBA,oEASC;AAGD,kDAIC;AA8ED,0BAQC;AAgBD,sBAQC;AAUD,sCAIC;AAUD,sCAIC;AA2ED,wCAuCC;AA5RD,oCAAsE;AACtE,iDAK2B;AAC3B,iDAAoD;AACpD,wEAA8D;AAE9D;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,QAAiD;IAEjD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC,SAAS,CAAA;IACvE,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,4EAA4E;AAC5E,SAAgB,mBAAmB,CACjC,QAAiD;IAEjD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA;AAC7D,CAAC;AAED,gFAAgF;AAChF,SAAS,4BAA4B,CAAC,QAA8B,EAAE,GAAwB;IAC5F,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAA;IAClF,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;YACnD,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;QAClC,IAAI,EAAE,OAAgB;QACtB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,CAAC,cAAc,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EAAE,UAAU;YACrB,CAAC,CAAC;gBACE,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI;gBAChC,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE;oBACd,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE;wBACT,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;4BAC5C,IAAI;4BACJ,EAAE,IAAI,EAAE,eAAe,GAAG,KAAK,EAAE;yBAClC,CAAC,CACH;wBACD,+DAA+D;wBAC/D,uCAAuC;wBACvC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAChF;qBACF;iBACF;aACF;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE;KACvD,CAAA;IACD,OAAO,QAAQ,CAAC,OAAO,KAAK,OAAO;QACjC,CAAC,CAAC,IAAA,UAAG,EAAC,mBAAmB,EAAE;YACvB,UAAU,EAAE,+BAA+B;YAC3C,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;YACtD,IAAI;SACL,CAAC;QACJ,CAAC,CAAC,IAAA,UAAG,EAAC,qBAAqB,EAAE;YACzB,UAAU,EAAE,6BAA6B;YACzC,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;YACtD,IAAI;SACL,CAAC,CAAA;AACR,CAAC;AAqBD,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAgBD,SAAgB,KAAK,CAAC,KAAiB;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAUD,SAAgB,aAAa,CAAC,KAAyB;IACrD,OAAO;QACL,OAAO,EAAE,gBAAgB;KAC1B,CAAA;AACH,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,IAAI,MAA4B,CAAA;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;SAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAI,QAAgB,CAAC,IAAI,CAAA;QACxC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,OAAO,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,KAAK,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,aAAa,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,SAAS,CAAC,IAAI,CAAC,GAAG,IAAA,yCAAgB,EAAC,eAAe,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,wBAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACnF,CAAC,CAAA;AACJ,CAAC"}

package/dist/static-secret.d.ts

@@ -0,0 +1,107 @@
+export interface StaticSecretProps {
+    /**
+     * Resource name (also the default for the provisioned Kubernetes
+     * Secret's name — override with secretName).
+     */
+    name: string;
+    /** Kubernetes namespace (inherited from Platform context when omitted) */
+    namespace?: string;
+    /**
+     * Vault/OpenBao KV v2 path holding the source keys, e.g. 'outline/app'.
+     * Build it from the provider's base path when composing:
+     * `${secretProvider.path}/myapp/credentials`.
+     */
+    path: string;
+    /**
+     * Destination→source key mapping. The destination carries env-case
+     * names consumed by the app; the vault/store keys stay snake_case:
+     *   keys={{ SECRET_KEY: 'secret_key', UTILS_SECRET: 'utils_secret' }}
+     * A string array is shorthand for identity mappings ({ KEY: 'KEY' }).
+     *
+     * Rendered as destination.transformation.templates + excludeRaw —
+     * the destination holds ONLY these keys.
+     */
+    keys: Record<string, string> | string[];
+    /**
+     * Raw Go-template passthrough merged AFTER the keys mapping — for
+     * advanced bundles needing literals or composed templates
+     * (e.g. `AWS_ENDPOINTS: 'https://s3.berget.cloud'`). Passthrough wins
+     * over key-mapped entries on collision.
+     */
+    templates?: Record<string, string>;
+    /** Provisioned Kubernetes Secret name (defaults to name) */
+    secretName?: string;
+    /**
+     * Re-sync interval rendered as refreshAfter. Defaults to the provider's
+     * refreshAfter, else '1h'.
+     */
+    refreshAfter?: string;
+    /**
+     * Workloads restarted after rotation (rolloutRestartTargets). Pass the
+     * workloads consuming these values so a rotation actually takes effect —
+     * pod env vars do not update in place.
+     *
+     * Deliberately has no default: some consumers read the Secret at use
+     * time (e.g. CNPG barman backup credentials are read when a backup
+     * runs, and the Cluster CRD is not a supported restart target), so an
+     * automatic restart is wrong for them.
+     */
+    restart?: {
+        kind?: string;
+        name: string;
+        apiVersion?: string;
+    }[];
+    /**
+     * Auth reference override (defaults to the provider's authRef).
+     * Rendered as vaultAuthRef / openbaoAuthRef per backend.
+     */
+    authRef?: string;
+}
+/**
+ * StaticSecret — provision a Kubernetes Secret from Vault/OpenBao,
+ * with rotation semantics that actually reach the workloads.
+ *
+ * Wraps VaultStaticSecret / OpenBaoStaticSecret with the platform's
+ * conventions baked in:
+ * - snake_case source keys templated to env-case destination keys
+ *   (excludeRaw: only the declared keys land in the Secret)
+ * - destination create + overwrite (idempotent sync)
+ * - hourly refresh by default, inheriting the provider's refreshAfter
+ * - explicit, per-bundle restart semantics (app creds restart pods;
+ *   backup creds read at use time never restart)
+ *
+ * Requires an active secrets backend (openbao or vault) — passive
+ * backends (manual-secrets, sealed-secrets) cannot provision: reference
+ * a pre-created Secret instead.
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret
+ *       name="myapp-secrets"
+ *       path="myapp/app"
+ *       keys={{
+ *         SECRET_KEY: 'secret_key',
+ *         OIDC_CLIENT_ID: 'oidc_client_id',
+ *         OIDC_CLIENT_SECRET: 'oidc_client_secret',
+ *       }}
+ *       restart={[{ kind: 'Deployment', name: 'myapp' }]}
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * // backup creds: read at use time — never restart workloads
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret name="myapp-backup-creds" path="rustfs/myapp"
+ *       keys={['accesskey', 'secretkey']} />
+ *   </Platform>
+ * )
+ */
+export declare function StaticSecret(props: StaticSecretProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=static-secret.d.ts.map

package/dist/static-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-secret.d.ts","sourceRoot":"","sources":["../src/static-secret.tsx"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAA;IACvC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAChE;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,kCAoDpD"}

package/dist/static-secret.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaticSecret = StaticSecret;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const secret_provider_1 = require("./secret-provider");
+/**
+ * StaticSecret — provision a Kubernetes Secret from Vault/OpenBao,
+ * with rotation semantics that actually reach the workloads.
+ *
+ * Wraps VaultStaticSecret / OpenBaoStaticSecret with the platform's
+ * conventions baked in:
+ * - snake_case source keys templated to env-case destination keys
+ *   (excludeRaw: only the declared keys land in the Secret)
+ * - destination create + overwrite (idempotent sync)
+ * - hourly refresh by default, inheriting the provider's refreshAfter
+ * - explicit, per-bundle restart semantics (app creds restart pods;
+ *   backup creds read at use time never restart)
+ *
+ * Requires an active secrets backend (openbao or vault) — passive
+ * backends (manual-secrets, sealed-secrets) cannot provision: reference
+ * a pre-created Secret instead.
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret
+ *       name="myapp-secrets"
+ *       path="myapp/app"
+ *       keys={{
+ *         SECRET_KEY: 'secret_key',
+ *         OIDC_CLIENT_ID: 'oidc_client_id',
+ *         OIDC_CLIENT_SECRET: 'oidc_client_secret',
+ *       }}
+ *       restart={[{ kind: 'Deployment', name: 'myapp' }]}
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform, StaticSecret } from '@r8s/recipes'
+ *
+ * // backup creds: read at use time — never restart workloads
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <StaticSecret name="myapp-backup-creds" path="rustfs/myapp"
+ *       keys={['accesskey', 'secretkey']} />
+ *   </Platform>
+ * )
+ */
+function StaticSecret(props) {
+    const { name, namespace: namespaceProp, path, keys, templates, secretName, refreshAfter, restart, authRef, } = props;
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const provisioner = (0, secret_provider_1.provisionerForSecretProvider)(secretProvider);
+    if (!provisioner) {
+        throw new Error(`StaticSecret "${name}" requires a provisioning secrets backend (openbao, vault,\n` +
+            `or any provider carrying a provision() hook).\n` +
+            `\n` +
+            `Fix: configure a backend on the Platform:\n` +
+            `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+            `    <StaticSecret name="${name}" path="${path}" keys={...} />\n` +
+            `  </Platform>\n` +
+            `\n` +
+            `On passive backends (manual-secrets, sealed-secrets, kubernetes), create the Secret\n` +
+            `out of band and reference it directly instead of rendering this component.`);
+    }
+    const mapping = Object.fromEntries((Array.isArray(keys) ? keys.map((k) => [k, k]) : Object.entries(keys)));
+    // Default missing fields (consistent with Database/WebService restart
+    // target conventions)
+    const restartTargets = restart?.map((t) => ({ kind: 'Deployment', ...t }));
+    const el = provisioner({
+        name,
+        namespace,
+        path,
+        keys: mapping,
+        templates,
+        secretName,
+        authRef,
+        refreshAfter,
+        restartTargets,
+    });
+    return Array.isArray(el) ? (0, core_1.jsx)(core_1.Fragment, { children: el }) : el;
+}
+//# sourceMappingURL=static-secret.js.map

package/dist/static-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-secret.js","sourceRoot":"","sources":["../src/static-secret.tsx"],"names":[],"mappings":";;AA0GA,oCAoDC;AA9JD,oCAAqD;AACrD,iDAAgE;AAChE,uDAAgE;AA0DhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,MAAM,EACJ,IAAI,EACJ,SAAS,EAAE,aAAa,EACxB,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,UAAU,EACV,YAAY,EACZ,OAAO,EACP,OAAO,GACR,GAAG,KAAK,CAAA;IAET,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAA,8CAA4B,EAAC,cAAc,CAAC,CAAA;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,8DAA8D;YACjF,iDAAiD;YACjD,IAAI;YACJ,6CAA6C;YAC7C,4EAA4E;YAC5E,2BAA2B,IAAI,WAAW,IAAI,mBAAmB;YACjE,iBAAiB;YACjB,IAAI;YACJ,uFAAuF;YACvF,4EAA4E,CAC/E,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAA2B,MAAM,CAAC,WAAW,CACxD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAuB,CAC7F,CAAA;IAED,sEAAsE;IACtE,sBAAsB;IACtB,MAAM,cAAc,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAE1E,MAAM,EAAE,GAAG,WAAW,CAAC;QACrB,IAAI;QACJ,SAAS;QACT,IAAI;QACJ,IAAI,EAAE,OAAO;QACb,SAAS;QACT,UAAU;QACV,OAAO;QACP,YAAY;QACZ,cAAc;KACf,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAA6B,CAAA;AAC7F,CAAC"}

package/dist/use-operators.d.ts

@@ -0,0 +1,7 @@
+import type { Operator } from '@r8s/k8s-types';
+/**
+ * Read the operators the surrounding Platform already provides — the
+ * dedupe-seed shared with every consumer's `declareIfMissing`.
+ */
+export declare function useOperators(): Operator[];
+//# sourceMappingURL=use-operators.d.ts.map

package/dist/use-operators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-operators.d.ts","sourceRoot":"","sources":["../src/use-operators.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C;;;GAGG;AACH,wBAAgB,YAAY,IAAI,QAAQ,EAAE,CAEzC"}

package/dist/use-operators.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useOperators = useOperators;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+/**
+ * Read the operators the surrounding Platform already provides — the
+ * dedupe-seed shared with every consumer's `declareIfMissing`.
+ */
+function useOperators() {
+    return (0, core_1.useContext)(defaults_1.OperatorContext);
+}
+//# sourceMappingURL=use-operators.js.map

package/dist/use-operators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-operators.js","sourceRoot":"","sources":["../src/use-operators.ts"],"names":[],"mappings":";;AAQA,oCAEC;AAVD,oCAAsC;AACtC,iDAAoD;AAGpD;;;GAGG;AACH,SAAgB,YAAY;IAC1B,OAAO,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;AACpC,CAAC"}

package/dist/web-service.d.ts

@@ -100,7 +100,11 @@ export interface WebServiceProps {
     tolerations?: Record<string, unknown>[];
     /** Pod topologySpreadConstraints (spread replicas across nodes) */
     topologySpreadConstraints?: Record<string, unknown>[];
-    /** Deployment update strategy — 'Recreate' for RWO-volume/migration apps */
+    /**
+     * Deployment update strategy ('Recreate' for RWO-volume/migration apps).
+     * Default: 'Recreate' when the pod mounts a PVC volume and replicas=1
+     * (RollingUpdate would deadlock on the single-attach volume).
+     */
     strategy?: 'Recreate' | 'RollingUpdate' | {
         type: string;
         rollingUpdate?: {
@@ -130,7 +134,11 @@ export interface WebServiceProps {
     } & Record<string, unknown>)[];
     /** Container lifecycle hooks (e.g. { preStop: { exec: { command: [...] } } }) */
     lifecycle?: Record<string, unknown>;
-    /** Image pull policy (defaults to 'Always') */
+    /**
+     * Image pull policy. Default depends on the tag: floating tags
+     * (latest/main/master/dev/edge/head/nightly/canary) get 'Always', pinned
+     * tags and digests get 'IfNotPresent' (immutable — pointless to re-pull).
+     */
     imagePullPolicy?: 'Always' | 'IfNotPresent' | 'Never';
     /** Names of Secrets used to pull private registry images */
     imagePullSecrets?: string[];

package/dist/web-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-service.d.ts","sourceRoot":"","sources":["../src/web-service.tsx"],"names":[],"mappings":"AACA,OAAO,EAAuB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAI5D,MAAM,WAAW,SAAS;IACxB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC9E;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC3B,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC5B,gFAAgF;QAChF,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;KAC3B,CAAA;IACD,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;IAC5C,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,gCAAgC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACvC,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,EACL,UAAU,GACV,eAAe,GACf;QACE,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAA;KACjF,CAAA;IACL,iFAAiF;IACjF,OAAO,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IACxD,0CAA0C;IAC1C,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1F;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IAC9E,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,+CAA+C;IAC/C,eAAe,CAAC,EAAE,QAAQ,GAAG,cAAc,GAAG,OAAO,CAAA;IACrD,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,oCAwOhD"}
+{"version":3,"file":"web-service.d.ts","sourceRoot":"","sources":["../src/web-service.tsx"],"names":[],"mappings":"AACA,OAAO,EAAuB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAI5D,MAAM,WAAW,SAAS;IACxB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC9E;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC3B,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC5B,gFAAgF;QAChF,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;KAC3B,CAAA;IACD,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;IAC5C,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,gCAAgC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACvC,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACrD;;;;OAIG;IACH,QAAQ,CAAC,EACL,UAAU,GACV,eAAe,GACf;QACE,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAA;KACjF,CAAA;IACL,iFAAiF;IACjF,OAAO,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IACxD,0CAA0C;IAC1C,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1F;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IAC9E,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC;;;;OAIG;IACH,eAAe,CAAC,EAAE,QAAQ,GAAG,cAAc,GAAG,OAAO,CAAA;IACrD,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,oCAoRhD"}

package/dist/web-service.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebService = WebService;
 const core_1 = require("@r8s/core");
 const defaults_1 = require("@r8s/core/defaults");
-const operators_1 = require("./operators");
+const operator_vault_secrets_1 = require("@r8s/operator-vault-secrets");
 /**
  * Simple web service (backend or frontend).
  *
@@ -42,7 +42,7 @@ const operators_1 = require("./operators");
  * )
  */
 function WebService(props) {
-    const { name, namespace = 'default', image, port = 3000, replicas = 2, probes, env = {}, secrets = {}, vault = {}, command, args, rawEnv = [], resources, securityContext, podSecurityContext, tolerations, topologySpreadConstraints, strategy, volumes, volumeMounts, initContainers, lifecycle, imagePullPolicy = 'Always', imagePullSecrets, } = props;
+    const { name, namespace: namespaceProp, image, port = 3000, replicas = 2, probes, env = {}, secrets = {}, vault = {}, command, args, rawEnv = [], resources, securityContext, podSecurityContext, tolerations, topologySpreadConstraints, strategy, volumes, volumeMounts, initContainers, lifecycle, imagePullPolicy, imagePullSecrets, } = props;
     const buildProbe = (spec, fallbackPath) => {
         if (spec === null)
             return undefined;
@@ -51,18 +51,57 @@ function WebService(props) {
         const initialDelaySeconds = spec.initialDelaySeconds ?? 10;
         const periodSeconds = spec.periodSeconds ?? 10;
         if (spec.tcp) {
-            return { tcpSocket: { port: spec.port ?? port }, initialDelaySeconds, periodSeconds };
+            return {
+                tcpSocket: { port: spec.port ?? port },
+                initialDelaySeconds,
+                periodSeconds,
+                // !== undefined (not truthy): an explicit 0 must surface as-is so
+                // Kubernetes validation fails loudly instead of silently reverting
+                // to the default
+                ...(spec.failureThreshold !== undefined && { failureThreshold: spec.failureThreshold }),
+            };
         }
         return {
             httpGet: { path: spec.path ?? fallbackPath, port: spec.port ?? port },
             initialDelaySeconds,
             periodSeconds,
-            ...(spec.failureThreshold && { failureThreshold: spec.failureThreshold }),
+            ...(spec.failureThreshold !== undefined && { failureThreshold: spec.failureThreshold }),
         };
     };
     const livenessProbe = buildProbe(probes?.liveness, '/health');
     const readinessProbe = buildProbe(probes?.readiness, '/ready');
     const startupProbe = buildProbe(probes?.startup ?? null, '/health');
+    // --- Safe defaults derived from the image and storage shape -------------
+    // imagePullPolicy: a floating tag must be re-pulled (Always); a pinned tag
+    // (or digest) is immutable, so IfNotPresent avoids pointless pulls and
+    // makes deploys robust when a registry is slow/unreachable. Explicit prop
+    // always wins. Floating set covers the conventional mutables.
+    const imageLeaf = image.slice(image.lastIndexOf('/') + 1);
+    const imageTag = imageLeaf.includes('@')
+        ? imageLeaf.slice(imageLeaf.indexOf('@') + 1)
+        : imageLeaf.includes(':')
+            ? imageLeaf.slice(imageLeaf.indexOf(':') + 1)
+            : 'latest';
+    const FLOATING_TAGS = new Set([
+        'latest',
+        'main',
+        'master',
+        'dev',
+        'edge',
+        'head',
+        'nightly',
+        'canary',
+    ]);
+    const pullPolicy = imagePullPolicy ??
+        (!imageLeaf.includes('@') && FLOATING_TAGS.has(imageTag.toLowerCase())
+            ? 'Always'
+            : 'IfNotPresent');
+    // strategy: RollingUpdate + a ReadWriteOnce PVC + replicas=1 deadlocks
+    // (the new pod cannot attach the volume until the old releases it), and
+    // in-place DB-migration apps (n8n, outline) must not run two versions at
+    // once. Recreate is always safe at replicas=1 — there is already no HA.
+    const hasPvcVolume = (volumes ?? []).some((v) => 'persistentVolumeClaim' in v);
+    const derivedStrategy = strategy ?? (hasPvcVolume && replicas === 1 ? 'Recreate' : undefined);
     const envVars = [];
     const vaultResources = [];
     // Secrets from Kubernetes Secrets — pushed before plain env vars so
@@ -89,6 +128,7 @@ function WebService(props) {
         envVars.push({ name: key, value });
     }
     // Vault secrets — create VaultStaticSecret objects
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
     const platformSecrets = (0, core_1.useContext)(defaults_1.SecretContext);
     for (const [envName, ref] of Object.entries(vault)) {
         const secretName = `${name}-${envName.toLowerCase().replace(/_/g, '-')}-vault`;
@@ -155,10 +195,7 @@ function WebService(props) {
     // Declare Vault Secrets Operator if vault secrets are used
     if (Object.keys(vault).length > 0) {
         const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
-        const hasVSO = sharedOperators.some((op) => op.name === 'vault-secrets-operator');
-        if (!hasVSO) {
-            vaultResources.push((0, core_1.declareOperator)((0, operators_1.vaultSecretsOperator)()));
-        }
+        vaultResources.push(...(0, operator_vault_secrets_1.declareIfMissing)(sharedOperators));
     }
     const deployment = {
         apiVersion: 'apps/v1',
@@ -166,8 +203,8 @@ function WebService(props) {
         metadata: { name, namespace, labels: { app: name } },
         spec: {
             replicas,
-            ...(strategy && {
-                strategy: typeof strategy === 'string' ? { type: strategy } : strategy,
+            ...(derivedStrategy && {
+                strategy: typeof derivedStrategy === 'string' ? { type: derivedStrategy } : derivedStrategy,
             }),
             selector: { matchLabels: { app: name } },
             template: {
@@ -187,7 +224,7 @@ function WebService(props) {
                         {
                             name: 'app',
                             image,
-                            imagePullPolicy,
+                            imagePullPolicy: pullPolicy,
                             ...(command && { command }),
                             ...(args && { args }),
                             ports: [{ containerPort: port }],
@@ -215,11 +252,14 @@ function WebService(props) {
             // Expose the app port directly (so consumers can reference it) while
             // keeping 80 as a stable backward-compatible alias: existing
             // Endpoints/default servicePort=80 users keep routing during
-            // migration to explicit servicePort
+            // migration to explicit servicePort.
+            // Port names are REQUIRED whenever a Service has more than one port —
+            // without them the API server rejects the resource (caught by Flux
+            // dry-run as "spec.ports[i].name: Required value").
             ports: [
-                { port, targetPort: port },
+                { name: 'http', port, targetPort: port },
                 // eslint-disable-next-line -- 80 alias for legacy servicePort=80 consumers
-                ...(port !== 80 ? [{ port: 80, targetPort: port }] : []),
+                ...(port !== 80 ? [{ name: 'http-80', port: 80, targetPort: port }] : []),
             ],
         },
     };