typekro 0.5.0 → 0.8.0

package/dist/factories/kubernetes/config/secret.js

@@ -1,13 +1,23 @@
 import { createAlwaysReadyEvaluator } from '../../../core/readiness/index.js';
 import { registerFactory } from '../../../core/resources/factory-registry.js';
 import { createResource } from '../../shared.js';
-// Self-register with semantic alias for fuzzy resource key matching.
+// Self-register under both the PascalCase `Secret` name (used by
+// `simple.Secret`) and the lowercase `secret` name (this module's
+// exported function). Registering both ensures that composition-body
+// AST analysis (`isKnownFactory`) recognises direct calls like
+// `secret({...})` inside compositions and can extract control-flow
+// directives (includeWhen, forEach, etc).
 registerFactory({
     factoryName: 'Secret',
     kind: 'Secret',
     apiVersion: 'v1',
     semanticAliases: ['secret'],
 });
+registerFactory({
+    factoryName: 'secret',
+    kind: 'Secret',
+    apiVersion: 'v1',
+});
 /**
  * Creates a Kubernetes Secret resource that is considered ready immediately upon creation.
  *

package/dist/factories/kubernetes/config/secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../../../src/factories/kubernetes/config/secret.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,qEAAqE;AACrE,eAAe,CAAC;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE,CAAC,QAAQ,CAAC;CAC5B,CAAC,CAAC;AAWH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAC,QAAoC;IACzD,wFAAwF;IACxF,oFAAoF;IACpF,gDAAgD;IAChD,OAAO,cAAc,CAA2B;QAC9C,GAAG,QAAQ;QACX,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACzD,kFAAkF;KACnF,CAAC,CAAC,sBAAsB,CAAC,0BAA0B,CAAW,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../../../src/factories/kubernetes/config/secret.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,iEAAiE;AACjE,kEAAkE;AAClE,qEAAqE;AACrE,+DAA+D;AAC/D,mEAAmE;AACnE,0CAA0C;AAC1C,eAAe,CAAC;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE,CAAC,QAAQ,CAAC;CAC5B,CAAC,CAAC;AACH,eAAe,CAAC;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,IAAI;CACjB,CAAC,CAAC;AAWH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAC,QAAoC;IACzD,wFAAwF;IACxF,oFAAoF;IACpF,gDAAgD;IAChD,OAAO,cAAc,CAA2B;QAC9C,GAAG,QAAQ;QACX,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACzD,kFAAkF;KACnF,CAAC,CAAC,sBAAsB,CAAC,0BAA0B,CAAW,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/factories/kubernetes/core/namespace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../../src/factories/kubernetes/core/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAG7D,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEnE,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,CA+CjG"}
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../../src/factories/kubernetes/core/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAG7D,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEnE,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAkDjG"}

package/dist/factories/kubernetes/core/namespace.js

@@ -17,7 +17,7 @@ export function namespace(resource) {
         apiVersion: 'v1',
         kind: 'Namespace',
         metadata: resource.metadata ?? { name: 'unnamed-namespace' },
-    }).withReadinessEvaluator((liveResource) => {
+    }, { scope: 'cluster' }).withReadinessEvaluator((liveResource) => {
         try {
             const status = liveResource.status;
             // Handle missing status gracefully

package/dist/factories/kubernetes/core/namespace.js.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../../src/factories/kubernetes/core/namespace.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AASjD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,QAAyB;IACjD,OAAO,cAAc,CAAC;QACpB,GAAG,QAAQ;QACX,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACvC,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE;KAC7D,CAAC,CAAC,sBAAsB,CAAC,CAAC,YAAyB,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAEnC,mCAAmC;YACnC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,oCAAoC;iBAC9C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAE3B,0CAA0C;YAC1C,MAAM,KAAK,GAAG,KAAK,KAAK,QAAQ,CAAC;YAEjC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,+BAA+B;iBACzC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,sBAAsB,KAAK,IAAI,SAAS,4BAA4B;oBAC7E,OAAO,EAAE,EAAE,KAAK,EAAE;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,yCAAyC,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;gBAC9E,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;aAC/C,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../../src/factories/kubernetes/core/namespace.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AASjD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,QAAyB;IACjD,OAAO,cAAc,CACnB;QACE,GAAG,QAAQ;QACX,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACvC,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE;KAC7D,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC,sBAAsB,CAAC,CAAC,YAAyB,EAAE,EAAE;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAEnC,mCAAmC;YACnC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,oCAAoC;iBAC9C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAE3B,0CAA0C;YAC1C,MAAM,KAAK,GAAG,KAAK,KAAK,QAAQ,CAAC;YAEjC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,+BAA+B;iBACzC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,sBAAsB,KAAK,IAAI,SAAS,4BAA4B;oBAC7E,OAAO,EAAE,EAAE,KAAK,EAAE;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,yCAAyC,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;gBAC9E,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;aAC/C,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/factories/searxng/compositions/index.d.ts

@@ -0,0 +1,2 @@
+export { searxngBootstrap } from './searxng-bootstrap.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/searxng/compositions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/searxng/compositions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/factories/searxng/compositions/index.js

@@ -0,0 +1,2 @@
+export { searxngBootstrap } from './searxng-bootstrap.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/searxng/compositions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/searxng/compositions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/factories/searxng/compositions/searxng-bootstrap.d.ts

@@ -0,0 +1,65 @@
+/**
+ * SearXNG Bootstrap Composition
+ *
+ * Deploys a complete SearXNG instance: Namespace + ConfigMap + Deployment + Service.
+ * Settings are built from typed spec fields — no proxy objects pass through to YAML.
+ *
+ * @example
+ * ```typescript
+ * import { searxngBootstrap } from 'typekro/searxng';
+ *
+ * const factory = searxngBootstrap.factory('direct', {
+ *   namespace: 'search',
+ *   waitForReady: true,
+ * });
+ *
+ * await factory.deploy({
+ *   name: 'searxng',
+ *   search: { formats: ['html', 'json'] },
+ *   server: { limiter: false, secret_key: 'change-me-in-production' },
+ * });
+ * ```
+ */
+export declare const searxngBootstrap: import("../../../index.js").CallableComposition<{
+    name: string;
+    namespace?: string;
+    image?: string;
+    replicas?: number;
+    instanceName?: string;
+    baseUrl?: string;
+    server?: {
+        secret_key?: string;
+        limiter?: boolean;
+        bind_address?: string;
+        method?: string;
+    };
+    secretKeyRef?: {
+        name: string;
+        key: string;
+    };
+    search?: {
+        formats?: string[];
+        default_lang?: string;
+        autocomplete?: string;
+        safe_search?: 0 | 1 | 2;
+    };
+    redisUrl?: string;
+    settingsYaml?: string;
+    env?: Record<string, string>;
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+}, {
+    ready: boolean;
+    phase: "Ready" | "Installing";
+    failed: boolean;
+    url: string;
+}>;
+//# sourceMappingURL=searxng-bootstrap.d.ts.map

package/dist/factories/searxng/compositions/searxng-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"searxng-bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/factories/searxng/compositions/searxng-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA8BH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2N5B,CAAC"}

package/dist/factories/searxng/compositions/searxng-bootstrap.js

@@ -0,0 +1,237 @@
+/**
+ * SearXNG Bootstrap Composition
+ *
+ * Deploys a complete SearXNG instance: Namespace + ConfigMap + Deployment + Service.
+ * Settings are built from typed spec fields — no proxy objects pass through to YAML.
+ *
+ * @example
+ * ```typescript
+ * import { searxngBootstrap } from 'typekro/searxng';
+ *
+ * const factory = searxngBootstrap.factory('direct', {
+ *   namespace: 'search',
+ *   waitForReady: true,
+ * });
+ *
+ * await factory.deploy({
+ *   name: 'searxng',
+ *   search: { formats: ['html', 'json'] },
+ *   server: { limiter: false, secret_key: 'change-me-in-production' },
+ * });
+ * ```
+ */
+import { kubernetesComposition } from '../../../core/composition/imperative.js';
+import { Cel } from '../../../core/references/cel.js';
+import { configMap } from '../../kubernetes/config/config-map.js';
+import { namespace } from '../../kubernetes/core/namespace.js';
+import { secret } from '../../kubernetes/config/secret.js';
+import { simple } from '../../simple/index.js';
+import { searxng } from '../resources/searxng.js';
+import { DEFAULT_SEARXNG_IMAGE, DEFAULT_SEARXNG_PORT, SearxngBootstrapConfigSchema, SearxngBootstrapStatusSchema, } from '../types.js';
+/**
+ * Return a copy of the server config with `secret_key` removed. The field
+ * is delivered via a dedicated K8s Secret, not via the Deployment spec —
+ * this helper makes sure the plaintext (or the KubernetesRef proxy that
+ * carries it in KRO mode) does not leak into the searxng() factory's
+ * `spec.server` which would otherwise fall back to injecting it as a
+ * plaintext env var.
+ */
+function stripSecretKey(server) {
+    const { secret_key: _discarded, ...rest } = server;
+    return rest;
+}
+export const searxngBootstrap = kubernetesComposition({
+    name: 'searxng-bootstrap',
+    kind: 'SearxngBootstrap',
+    spec: SearxngBootstrapConfigSchema,
+    status: SearxngBootstrapStatusSchema,
+}, (spec) => {
+    const resolvedNamespace = spec.namespace ?? 'searxng';
+    const resolvedImage = spec.image ?? DEFAULT_SEARXNG_IMAGE;
+    const port = DEFAULT_SEARXNG_PORT;
+    // ── Namespace ──────────────────────────────────────────────────────
+    const _ns = namespace({
+        metadata: {
+            name: resolvedNamespace,
+            labels: {
+                'app.kubernetes.io/name': 'searxng',
+                'app.kubernetes.io/instance': spec.name,
+                'app.kubernetes.io/managed-by': 'typekro',
+            },
+        },
+        id: 'searxngNamespace',
+    });
+    // ── Settings ConfigMap ─────────────────────────────────────────────
+    //
+    // WHY TEMPLATE LITERALS (not `yaml.dump(...)`):
+    //
+    // The composition function runs in two very different modes:
+    //
+    //   (1) Direct mode — spec fields are real values (`'redis://...'`,
+    //       `['html', 'json']`, `false`). `yaml.dump()` would work fine
+    //       and is in fact used by the `buildSearxngSettings` helper for
+    //       direct-mode callers who pass a pre-built `settingsYaml`.
+    //
+    //   (2) KRO mode — spec fields are `KubernetesRef` proxy objects
+    //       whose string coercion yields `__KUBERNETES_REF___schema___spec.xxx__`
+    //       marker tokens. These markers are recognized by the framework
+    //       later and rewritten into CEL expressions like
+    //       `${string(schema.spec.redisUrl)}` inside the final RGD YAML.
+    //       `yaml.dump()` cannot produce those markers — it would call
+    //       `.toString()`/`.toJSON()` on the proxy and flatten everything
+    //       into the wrong thing, losing the reference entirely.
+    //
+    // The template-literal approach is what makes mixed templates work:
+    // the literal text (`use_default_settings: true`, key names, indentation)
+    // is rendered as-is, while `${spec.redisUrl}` interpolation emits the
+    // marker token that the framework then converts to CEL. This is the
+    // only way to build a string that is BOTH (a) valid YAML when the
+    // spec is concrete, and (b) a carrier for CEL references when it
+    // isn't. Changing this to `yaml.dump()` will break KRO mode.
+    //
+    // The `typeof spec.settingsYaml === 'string'` branch lets advanced
+    // direct-mode callers override the entire file with a hand-crafted
+    // (or `buildSearxngSettings`-generated) string — in KRO mode the
+    // proxy isn't a string, so this branch is never taken.
+    //
+    // `secret_key` is intentionally NOT written into the ConfigMap — and
+    // it's also NOT injected as a plaintext env var on the Deployment
+    // (which would expose it via `kubectl get deploy -o yaml`). Instead,
+    // the secret is delivered via a dedicated K8s Secret resource that
+    // the Deployment mounts with `valueFrom.secretKeyRef`. See the
+    // Secret block below.
+    const redisSection = spec.redisUrl
+        ? `\nredis:\n  url: ${spec.redisUrl}`
+        : '';
+    // Build search formats: use spec.search.formats in direct mode (real array),
+    // fall back to defaults in KRO mode (the proxy isn't a real array, so
+    // `Array.isArray()` returns false and the literal default list is emitted).
+    // TODO(typekro#array-cel): once CEL template support for arrays lands,
+    // this can emit `${spec.search.formats}` in KRO mode too.
+    const searchFormats = Array.isArray(spec.search?.formats)
+        ? spec.search.formats.map((f) => `    - ${f}`).join('\n')
+        : '    - html\n    - json';
+    const settingsYaml = typeof spec.settingsYaml === 'string'
+        ? spec.settingsYaml
+        : `use_default_settings: true
+server:
+  limiter: ${spec.server?.limiter ?? false}
+search:
+  formats:
+${searchFormats}
+${redisSection}`;
+    const configMapName = `${spec.name}-config`;
+    const _config = configMap({
+        metadata: {
+            name: configMapName,
+            namespace: resolvedNamespace,
+            labels: {
+                'app.kubernetes.io/name': 'searxng',
+                'app.kubernetes.io/component': 'config',
+                'app.kubernetes.io/managed-by': 'typekro',
+            },
+        },
+        data: { 'settings.yml': settingsYaml },
+        id: 'searxngConfig',
+    });
+    // ── Secret (SEARXNG_SECRET delivery) ───────────────────────────────
+    //
+    // Secret delivery rules:
+    //   (1) If the user provided an external `secretKeyRef`, the Deployment
+    //       mounts that existing Secret via valueFrom — the bootstrap does
+    //       NOT create its own. This is the path for external-secrets
+    //       workflows (Vault, AWS SM, external-secrets operator).
+    //   (2) Otherwise, the bootstrap creates a dedicated `{name}-secret`
+    //       Secret from `server.secret_key`. The plaintext stops at the
+    //       Secret's stringData and never enters the Deployment env.
+    //
+    // The plain `if (!spec.secretKeyRef)` below is transformed into a KRO
+    // `includeWhen: ${!has(schema.spec.secretKeyRef)}` directive by the
+    // composition AST analyzer during serialization. In direct mode the
+    // `if` runs normally; in KRO mode the analyzer attaches the includeWhen
+    // so the Secret is only created when the user didn't provide an
+    // external ref. The Deployment's `secretKeyRef` field is computed by
+    // the JS ternary on the same condition and the analyzer emits the
+    // corresponding CEL ternary there as well.
+    //
+    // Why `simple.Secret` is NOT used here: it eagerly base64-encodes
+    // stringData values via `Buffer.from(...)` at composition time, which
+    // would encode the `__KUBERNETES_REF__` marker token in KRO mode
+    // instead of the actual user-supplied secret, baking a broken value
+    // into the RGD. The low-level `secret()` factory passes `stringData`
+    // through untouched so KRO can resolve it at reconcile time.
+    const secretName = `${spec.name}-secret`;
+    if (!spec.secretKeyRef) {
+        secret({
+            metadata: {
+                name: secretName,
+                namespace: resolvedNamespace,
+                labels: {
+                    'app.kubernetes.io/name': 'searxng',
+                    'app.kubernetes.io/instance': spec.name,
+                    'app.kubernetes.io/component': 'secret',
+                    'app.kubernetes.io/managed-by': 'typekro',
+                },
+            },
+            type: 'Opaque',
+            stringData: {
+                secret_key: spec.server?.secret_key,
+            },
+            id: 'searxngSecret',
+        });
+    }
+    // ── Deployment ─────────────────────────────────────────────────────
+    //
+    // The Deployment never sees the plaintext secret — it mounts a
+    // `secretKeyRef` instead, which the factory translates into
+    // `valueFrom.secretKeyRef` on the SEARXNG_SECRET env var.
+    //
+    // The two nested ternaries on `secretKeyRef.name` and `secretKeyRef.key`
+    // are detected by the composition AST analyzer and emitted as CEL
+    // conditionals in the final RGD — in KRO mode the user's CR value
+    // for `spec.secretKeyRef` selects between the external Secret and
+    // the auto-created one at reconcile time.
+    const _deployment = searxng({
+        name: spec.name,
+        namespace: resolvedNamespace,
+        spec: {
+            image: resolvedImage,
+            replicas: spec.replicas ?? 1,
+            instanceName: spec.instanceName ?? spec.name,
+            baseUrl: spec.baseUrl ?? `http://${spec.name}:${port}/`,
+            configMapName,
+            // Strip secret_key before passing server config through — the
+            // plaintext stops here and is delivered exclusively via the
+            // Secret resource above.
+            ...(spec.server && {
+                server: stripSecretKey(spec.server),
+            }),
+            secretKeyRef: {
+                name: spec.secretKeyRef ? spec.secretKeyRef.name : secretName,
+                key: spec.secretKeyRef ? spec.secretKeyRef.key : 'secret_key',
+            },
+            env: spec.env,
+            resources: spec.resources,
+        },
+        id: 'searxngDeployment',
+    });
+    // ── Service ────────────────────────────────────────────────────────
+    simple.Service({
+        name: spec.name,
+        namespace: resolvedNamespace,
+        selector: {
+            'app.kubernetes.io/name': 'searxng',
+            'app.kubernetes.io/instance': spec.name,
+        },
+        ports: [{ port, targetPort: port, name: 'http' }],
+        id: 'searxngService',
+    });
+    // ── Status ─────────────────────────────────────────────────────────
+    return {
+        ready: Cel.expr(_deployment.status.conditions, '.exists(c, c.type == "Available" && c.status == "True")'),
+        phase: Cel.expr(_deployment.status.conditions, '.exists(c, c.type == "Available" && c.status == "True") ? "Ready" : "Installing"'),
+        failed: Cel.expr(_deployment.status.conditions, '.exists(c, c.type == "Available" && c.status == "False")'),
+        url: `http://${spec.name}.${resolvedNamespace}:${port}`,
+    };
+});
+//# sourceMappingURL=searxng-bootstrap.js.map

package/dist/factories/searxng/compositions/searxng-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"searxng-bootstrap.js","sourceRoot":"","sources":["../../../../src/factories/searxng/compositions/searxng-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EAEpB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,SAAS,cAAc,CAAqC,MAAS;IACnE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CACnD;IACE,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,4BAA4B;IAClC,MAAM,EAAE,4BAA4B;CACrC,EACD,CAAC,IAA4B,EAAE,EAAE;IAC/B,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC;IAC1D,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAElC,sEAAsE;IAEtE,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,QAAQ,EAAE;YACR,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE;gBACN,wBAAwB,EAAE,SAAS;gBACnC,4BAA4B,EAAE,IAAI,CAAC,IAAI;gBACvC,8BAA8B,EAAE,SAAS;aAC1C;SACF;QACD,EAAE,EAAE,kBAAkB;KACvB,CAAC,CAAC;IAEH,sEAAsE;IACtE,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,6DAA6D;IAC7D,EAAE;IACF,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,iEAAiE;IACjE,EAAE;IACF,iEAAiE;IACjE,8EAA8E;IAC9E,qEAAqE;IACrE,sDAAsD;IACtD,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,6DAA6D;IAC7D,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,6DAA6D;IAC7D,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,iEAAiE;IACjE,uDAAuD;IACvD,EAAE;IACF,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,+DAA+D;IAC/D,sBAAsB;IACtB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ;QAChC,CAAC,CAAC,oBAAoB,IAAI,CAAC,QAAQ,EAAE;QACrC,CAAC,CAAC,EAAE,CAAC;IAEP,6EAA6E;IAC7E,sEAAsE;IACtE,4EAA4E;IAC5E,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,wBAAwB,CAAC;IAE7B,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACnC,CAAC,CAAC,IAAI,CAAC,YAAY;QACnB,CAAC,CAAC;;aAEG,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;;;EAGxC,aAAa;EACb,YAAY,EAAE,CAAC;IACb,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,IAAI,SAAS,CAAC;IAE5C,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,QAAQ,EAAE;YACR,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,iBAAiB;YAC5B,MAAM,EAAE;gBACN,wBAAwB,EAAE,SAAS;gBACnC,6BAA6B,EAAE,QAAQ;gBACvC,8BAA8B,EAAE,SAAS;aAC1C;SACF;QACD,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;QACtC,EAAE,EAAE,eAAe;KACpB,CAAC,CAAC;IAEH,sEAAsE;IACtE,EAAE;IACF,yBAAyB;IACzB,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,iEAAiE;IACjE,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,EAAE;IACF,kEAAkE;IAClE,sEAAsE;IACtE,iEAAiE;IACjE,oEAAoE;IACpE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,IAAI,SAAS,CAAC;IAEzC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,CAAC;YACL,QAAQ,EAAE;gBACR,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,iBAAiB;gBAC5B,MAAM,EAAE;oBACN,wBAAwB,EAAE,SAAS;oBACnC,4BAA4B,EAAE,IAAI,CAAC,IAAI;oBACvC,6BAA6B,EAAE,QAAQ;oBACvC,8BAA8B,EAAE,SAAS;iBAC1C;aACF;YACD,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,UAAoB;aAC9C;YACD,EAAE,EAAE,eAAe;SACpB,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,EAAE;IACF,+DAA+D;IAC/D,4DAA4D;IAC5D,0DAA0D;IAC1D,EAAE;IACF,yEAAyE;IACzE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,0CAA0C;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC;QAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,iBAAiB;QAC5B,IAAI,EAAE;YACJ,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;YAC5B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI;YAC5C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG;YACvD,aAAa;YACb,8DAA8D;YAC9D,4DAA4D;YAC5D,yBAAyB;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI;gBACjB,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;aACpC,CAAC;YACF,YAAY,EAAE;gBACZ,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;gBAC7D,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY;aAC9D;YACD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,EAAE,EAAE,mBAAmB;KACxB,CAAC,CAAC;IAEH,sEAAsE;IAEtE,MAAM,CAAC,OAAO,CAAC;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE;YACR,wBAAwB,EAAE,SAAS;YACnC,4BAA4B,EAAE,IAAI,CAAC,IAAI;SACxC;QACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACjD,EAAE,EAAE,gBAAgB;KACrB,CAAC,CAAC;IAEH,sEAAsE;IAEtE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,IAAI,CACb,WAAW,CAAC,MAAM,CAAC,UAAU,EAC7B,yDAAyD,CAC1D;QACD,KAAK,EAAE,GAAG,CAAC,IAAI,CACb,WAAW,CAAC,MAAM,CAAC,UAAU,EAC7B,kFAAkF,CACnF;QACD,MAAM,EAAE,GAAG,CAAC,IAAI,CACd,WAAW,CAAC,MAAM,CAAC,UAAU,EAC7B,0DAA0D,CAC3D;QACD,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,IAAI,iBAAiB,IAAI,IAAI,EAAE;KACxD,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/factories/searxng/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SearXNG Integration
+ *
+ * Privacy-respecting metasearch engine that aggregates results from
+ * multiple search providers (Google, Bing, DuckDuckGo, Brave, etc.).
+ *
+ * @example
+ * ```typescript
+ * import { searxngBootstrap } from 'typekro/searxng';
+ *
+ * const factory = searxngBootstrap.factory('direct', {
+ *   namespace: 'search',
+ *   waitForReady: true,
+ * });
+ *
+ * await factory.deploy({
+ *   name: 'searxng',
+ *   search: { formats: ['html', 'json'] },
+ *   server: { limiter: false, secret_key: 'change-me' },
+ * });
+ * ```
+ */
+export { searxngBootstrap } from './compositions/index.js';
+export { searxng } from './resources/index.js';
+export type { SearxngBootstrapConfig, SearxngBootstrapStatus, SearxngConfig, SearxngStatus, } from './types.js';
+export { DEFAULT_SEARXNG_IMAGE, DEFAULT_SEARXNG_PORT } from './types.js';
+export { buildSearxngSettings } from './utils/settings-builder.js';
+export type { SearxngSettingsInput } from './utils/settings-builder.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/searxng/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/factories/searxng/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,YAAY,EACV,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/factories/searxng/index.js

@@ -0,0 +1,27 @@
+/**
+ * SearXNG Integration
+ *
+ * Privacy-respecting metasearch engine that aggregates results from
+ * multiple search providers (Google, Bing, DuckDuckGo, Brave, etc.).
+ *
+ * @example
+ * ```typescript
+ * import { searxngBootstrap } from 'typekro/searxng';
+ *
+ * const factory = searxngBootstrap.factory('direct', {
+ *   namespace: 'search',
+ *   waitForReady: true,
+ * });
+ *
+ * await factory.deploy({
+ *   name: 'searxng',
+ *   search: { formats: ['html', 'json'] },
+ *   server: { limiter: false, secret_key: 'change-me' },
+ * });
+ * ```
+ */
+export { searxngBootstrap } from './compositions/index.js';
+export { searxng } from './resources/index.js';
+export { DEFAULT_SEARXNG_IMAGE, DEFAULT_SEARXNG_PORT } from './types.js';
+export { buildSearxngSettings } from './utils/settings-builder.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/searxng/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/factories/searxng/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAO/C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/factories/searxng/resources/index.d.ts

@@ -0,0 +1,2 @@
+export { searxng } from './searxng.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/searxng/resources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/searxng/resources/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/factories/searxng/resources/index.js

@@ -0,0 +1,2 @@
+export { searxng } from './searxng.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/searxng/resources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/searxng/resources/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/factories/searxng/resources/searxng.d.ts

@@ -0,0 +1,65 @@
+/**
+ * SearXNG Deployment Factory
+ *
+ * Creates a SearXNG Deployment with a mounted settings ConfigMap,
+ * health probes at /healthz, and optional environment variables.
+ * The secret_key is injected via SEARXNG_SECRET env var (not in ConfigMap).
+ */
+import type { CelExpression, Composable, Enhanced } from '../../../core/types/index.js';
+import { type SearxngConfig, type SearxngStatus } from '../types.js';
+/**
+ * Relaxed spec type for the factory. The ArkType schema constrains
+ * `secretKeyRef.name` and `secretKeyRef.key` to plain strings, but the
+ * bootstrap composition needs to pass `CelExpression<string>` values in
+ * KRO mode (where the field values are CEL ternaries that KRO evaluates
+ * at reconcile time). At runtime `createResource` handles both concrete
+ * strings and CelExpression objects uniformly, so widening the type here
+ * is purely a TypeScript ergonomics fix — no runtime behavior change.
+ */
+type SearxngFactoryConfig = Omit<SearxngConfig, 'spec'> & {
+    spec: Omit<SearxngConfig['spec'], 'secretKeyRef'> & {
+        secretKeyRef?: {
+            name: string | CelExpression<string>;
+            key: string | CelExpression<string>;
+        };
+    };
+};
+/**
+ * Create a SearXNG Deployment resource.
+ *
+ * @example Recommended — mount an existing Secret via `secretKeyRef`
+ * ```typescript
+ * const search = searxng({
+ *   name: 'my-searxng',
+ *   namespace: 'search',
+ *   spec: {
+ *     instanceName: 'My Search',
+ *     search: { formats: ['html', 'json'] },
+ *     server: { limiter: false },
+ *     // Secret is managed externally (Vault, external-secrets operator,
+ *     // or created alongside this factory). The Deployment mounts
+ *     // SEARXNG_SECRET via valueFrom.secretKeyRef — the plaintext
+ *     // never enters the Deployment spec.
+ *     secretKeyRef: { name: 'my-searxng-secret', key: 'secret_key' },
+ *   },
+ * });
+ * ```
+ *
+ * @example Discouraged — plaintext `secret_key` in the config
+ * ```typescript
+ * // Works, but the secret appears in `kubectl get deploy -o yaml` as
+ * // Deployment.spec.template.spec.containers[0].env[].value. Prefer the
+ * // `secretKeyRef` path above or use the `searxngBootstrap` composition
+ * // which auto-creates a K8s Secret and wires it through for you.
+ * const search = searxng({
+ *   name: 'my-searxng',
+ *   spec: {
+ *     server: { secret_key: 'change-me-in-production', limiter: false },
+ *   },
+ * });
+ * ```
+ */
+declare function createSearxngResource(config: Composable<SearxngFactoryConfig>): Enhanced<SearxngConfig['spec'], SearxngStatus>;
+export declare const searxng: typeof createSearxngResource;
+export {};
+//# sourceMappingURL=searxng.d.ts.map

package/dist/factories/searxng/resources/searxng.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"searxng.d.ts","sourceRoot":"","sources":["../../../../src/factories/searxng/resources/searxng.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,QAAQ,EAET,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB;;;;;;;;GAQG;AACH,KAAK,oBAAoB,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG;IACxD,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG;QAClD,YAAY,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;SACrC,CAAC;KACH,CAAC;CACH,CAAC;AA6BF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,iBAAS,qBAAqB,CAC5B,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC,GACvC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CA6HhD;AAED,eAAO,MAAM,OAAO,8BAAwB,CAAC"}