Bind Radius.Security/secrets to postgreSqlDatabases and mySqlDatabases, retained at rest

Data/mySqlDatabases/mySqlDatabases.yaml

@@ -2,14 +2,16 @@ namespace: Radius.Data
 types:
   mySqlDatabases:
     description: |
-      The Radius.Data/mySqlDatabases Resource Type deploys a MySQL database. To deploy a new MySQL database, first add a secret resource with the database credentials to the application definition Bicep file, then add a mySqlDatabases resource referencing the secret name.
+      The Radius.Data/mySqlDatabases Resource Type deploys a MySQL database. To deploy a new MySQL database, first add a secret resource with the database credentials to the application definition Bicep file, then add a mySqlDatabases resource listing that secret in its `secrets` array.
       ```
       resource mysql 'Radius.Data/mySqlDatabases@2025-08-01-preview' = {
         name: 'mysql'
         properties: {
           environment: environment
           application: myApplication.id
-          secretName: dbCredentials.name
+          secrets: [
+            dbCredentials.id
+          ]
         }
       }
 
@@ -19,11 +21,11 @@ types:
           environment: environment
           application: myApplication.id
           data: {
-            USERNAME: {
+            username: {
               value: 'admin'
             }
-            PASSWORD: {
-              # From password parameter passed in via CLI
+            password: {
+              // From password parameter passed in via CLI
               value: password
             }
           }
@@ -79,9 +81,13 @@ types:
             database:
               type: string
               description: "(Optional) The name of the database. Defaults to `mysql_db` if not provided."
-            secretName:
-              type: string
-              description: "(Required) The name of the secret containing the database credentials."
+            secrets:
+              type: array
+              x-radius-secret-binding: true
+              description: "(Required) The Radius.Security/secrets resources holding the credentials this database needs. Each entry is a secret resource ID (for example `dbSecret.id`). Radius loads every key of each listed secret and exposes it to the recipe as `{{context.resource.secrets.<secretName>.<key>}}`, where `<secretName>` is the secret resource's name and `<key>` is a key in its `data`."
+              items:
+                type: string
+                description: "The resource ID of a Radius.Security/secrets resource (for example `dbSecret.id`)."
             version:
               type: string
               enum: ['5.7', '8.0', '8.4']
@@ -94,4 +100,4 @@ types:
               type: integer
               description: "(Read-only) The port number used to connect to the database."
               readOnly: true
-          required: [environment,secretName]
+          required: [environment,secrets]

Data/postgreSqlDatabases/postgreSqlDatabases.yaml

@@ -2,36 +2,22 @@ namespace: Radius.Data
 types:
   postgreSqlDatabases:  
     description: |
-      The Radius.Data/postgreSqlDatabases Resource Type deploys a PostgreSQL database. To deploy a PostgreSQL database, first add a secret resource with the database credentials to the application definition Bicep file, then add a postgreSqlDatabases resource referencing the secret name.
+      The Radius.Data/postgreSqlDatabases Resource Type deploys a PostgreSQL database. Provide the administrator `username` and `password` directly on the resource. The `password` property is marked `x-radius-sensitive`, so Radius encrypts it at rest, redacts it on reads, and exposes it (decrypted) only to the recipe that provisions the database.
       ```
       resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = {
           name: 'postgresql'
           properties: {
             environment: environment
             application: myApplication.id
             size: 'S'
-            secretName: dbCredentials.name
-          }
-        }
-
-        resource dbCredentials 'Radius.Security/secrets@2025-08-01-preview' = {
-          name: 'db-creds'
-          properties: {
-            environment: environment
-            application: myApplication.id
-            data: {
-              username: {
-                value: 'admin'
-              }
-              password: {
-                // From password parameter passed in via CLI
-                value: password
-              }
-            }
+            database: 'appdb'
+            username: 'myadmin'
+            // From a @secure() password parameter passed in via the CLI
+            password: password
           }
         }
       ```
-      
+
       When deploying the application definition, provide the database password value as a parameter. It is recommended to use a password generator such as `openssl` or equivalent. For example, `rad deploy app.bicep -p password=$(openssl rand -hex 16)`.
 
       To connect your container to the database, create a connection from the Container resource to the database as shown below. 
@@ -81,9 +67,20 @@ types:
               type: string
               enum: ['S', 'M', 'L']
               description: "(Optional) The size of the PostgreSQL database. Defaults to `S` if not provided."
-            secretName:
+            username:
+              type: string
+              description: "(Required) The administrator username for the PostgreSQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`."
+            password:
               type: string
-              description: "(Required) The name of the secret containing the database credentials."
+              x-radius-sensitive: true
+              description: "(Required) The administrator password for the PostgreSQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`."
+            secrets:
+              type: array
+              x-radius-secret-binding: true
+              description: "(Optional, legacy) An alternative to the direct `username`/`password` properties: a list of Radius.Security/secrets resource IDs holding the credentials this database needs (for example `dbSecret.id`). Radius loads every key of each listed secret and exposes it to the recipe as `{{context.resource.secrets.<secretName>.<key>}}`, where `<secretName>` is the secret resource's name and `<key>` is a key in its `data`."
+              items:
+                type: string
+                description: "The resource ID of a Radius.Security/secrets resource (for example `dbSecret.id`)."
             database:
               type: string
               description: "(Optional) The name of the database. Defaults to `postgres_db` if not provided."
@@ -98,4 +95,4 @@ types:
               type: string
               description: The port number used to connect to the database.
               readOnly: true
-          required: [environment,secretName]
+          required: [environment,username,password]

Security/secrets/secrets.yaml

@@ -77,6 +77,7 @@ types:
                   value:
                     type: string
                     x-radius-sensitive: true
+                    x-radius-retain: true
                     description: (Required) The string value of the secret unless encoding is set to 'base64'.
                 required: [value]
           required: