@r8s/eneo 0.2.0

package/__tests__/eneo.test.ts

@@ -0,0 +1,422 @@
+import { describe, it, expect } from 'vitest'
+import { render, jsx } from '@r8s/core'
+import { Namespace, OperatorContext, SecretContext, RoutingContext } from '@r8s/core/defaults'
+import { runGuardrails, noPlaintextSecrets, validateResource } from '@r8s/core'
+import { operators } from '@r8s/crds'
+import type { r8sElement } from '@r8s/core'
+
+// Eneo recipe tests:
+//   1. Operator declarations (deduped via OperatorContext)
+//   2. Rendering: defaults, all props, gateway/ingress adaptation, dbStorage
+//   3. Namespace inheritance from the Platform context
+//   4. Security: no plaintext credentials in rendered output
+import { Eneo } from '../src/index'
+
+const openbao = { backend: 'openbao', mount: 'kv', path: 'test' }
+
+/** Render Eneo inside a Platform-like secrets backend (OpenBao). */
+function renderEneo(props: Record<string, unknown>): ReturnType<typeof render> {
+  return render(
+    jsx(SecretContext.Provider, {
+      value: openbao as never,
+      children: jsx(Eneo, props as never),
+    })
+  )
+}
+
+/** Render Eneo inside a Platform-like Namespace context (no explicit namespace prop). */
+function renderEneoInNamespace(
+  namespaceValue: string,
+  props: Record<string, unknown>
+): ReturnType<typeof render> {
+  return render(
+    jsx(Namespace.Provider, {
+      value: namespaceValue,
+      children: jsx(SecretContext.Provider, {
+        value: openbao as never,
+        children: jsx(Eneo, props as never),
+      }),
+    })
+  )
+}
+
+/** Wrap Eneo in an OperatorContext (no secrets backend). */
+function elementWithContext(ops: any[], props: Record<string, unknown>): r8sElement {
+  return jsx(OperatorContext.Provider, {
+    value: ops,
+    children: jsx(Eneo, props as never),
+  })
+}
+
+const objectStorage = {
+  endpoint: 'https://s3.internal.example.com',
+  bucket: 'eneo-corpora',
+  credentialsSecret: 'eneo-object-storage',
+}
+
+const sso = {
+  issuer: 'https://keycloak.example.com/realms/platform',
+  clientId: 'eneo',
+  clientSecretRef: { secret: 'eneo-sso', key: 'clientSecret' },
+}
+
+describe('operator declarations', () => {
+  it('declares the cnpg operator via the Database recipe', () => {
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage })
+    expect(result.operators.some((op) => op.name === 'cnpg')).toBe(true)
+  })
+
+  it('declares no cache operator on a plain render', () => {
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage })
+    expect(result.operators.some((op) => op.name === 'redis-operator')).toBe(false)
+  })
+
+  it('deduplicates operators provided via context', () => {
+    const result = render(
+      elementWithContext([operators['cnpg']()], {
+        host: 'eneo.example.com',
+        objectStorage,
+        secretsName: 'existing-secrets',
+      })
+    )
+    const names = result.operators.map((op) => op.name)
+    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
+  })
+})
+
+describe('rendering defaults', () => {
+  it('renders deployment, service, ingress and database cluster', () => {
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage })
+    const kinds = result.resources.map((r) => r.kind)
+    expect(kinds).toContain('Deployment')
+    expect(kinds).toContain('Service')
+    expect(kinds).toContain('Ingress')
+    expect(kinds).toContain('Cluster')
+  })
+
+  it('renders gateway resources when platform uses gateway routing', () => {
+    const result = render(
+      jsx(RoutingContext.Provider, {
+        value: { mode: 'gateway', gatewayClassName: 'eg' },
+        children: jsx(SecretContext.Provider, {
+          value: openbao as never,
+          children: jsx(Eneo, { host: 'eneo.example.com', objectStorage }),
+        }),
+      })
+    )
+    const kinds = result.resources.map((r) => r.kind)
+    expect(kinds).toContain('HTTPRoute')
+  })
+
+  it('renders a valid Ingress when platform uses ingress routing', () => {
+    const result = render(
+      jsx(RoutingContext.Provider, {
+        value: { mode: 'ingress' },
+        children: jsx(SecretContext.Provider, {
+          value: openbao as never,
+          children: jsx(Eneo, { host: 'eneo.example.com', objectStorage }),
+        }),
+      })
+    )
+    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
+    expect(ingress).toBeDefined()
+    expect(ingress.spec.rules[0].host).toBe('eneo.example.com')
+  })
+
+  it('defaults app replicas to 2', () => {
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    expect(app.spec.replicas).toBe(2)
+  })
+
+  it('passes resource validation', () => {
+    const result = renderEneo({
+      host: 'eneo.example.com',
+      objectStorage,
+      sso,
+      smtp: { host: 'smtp.example.com', port: 587, from: 'no-reply@eneo.example.com' },
+      dbStorage: '50Gi',
+    })
+    for (const resource of result.resources) {
+      expect(validateResource(resource)).toEqual([])
+    }
+  })
+})
+
+describe('namespace inheritance', () => {
+  it('inherits namespace from the Platform context when namespace prop is not set', () => {
+    const result = renderEneoInNamespace('ai', { host: 'eneo.example.com', objectStorage })
+    for (const kind of ['Deployment', 'Service', 'Cluster', 'Ingress']) {
+      const resource = result.resources.find((r: any) => r.kind === kind)
+      expect(resource).toBeDefined()
+      expect(resource.metadata.namespace).toBe('ai')
+    }
+  })
+
+  it('inherits non-default context namespace even with multiple levels', () => {
+    const result = renderEneoInNamespace('team-corpora', {
+      host: 'eneo.example.com',
+      objectStorage,
+      secretsName: 'existing-secrets',
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    expect(app.metadata.namespace).toBe('team-corpora')
+  })
+
+  it('explicit namespace prop wins over the Platform context', () => {
+    const result = renderEneoInNamespace('ai', {
+      host: 'eneo.example.com',
+      objectStorage,
+      namespace: 'assistant-ns',
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    expect(app.metadata.namespace).toBe('assistant-ns')
+  })
+
+  it('falls back to default when no Platform namespace is present', () => {
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    expect(app.metadata.namespace).toBe('default')
+  })
+})
+
+describe('document corpus storage', () => {
+  it('renders no PVC (corpora live in object storage; local corpus PVC is a v1.1 item)', () => {
+    const result = renderEneo({
+      host: 'eneo.example.com',
+      objectStorage,
+      dbStorage: '50Gi',
+    })
+    expect(result.resources.map((r) => r.kind)).not.toContain('PersistentVolumeClaim')
+  })
+
+  it('passes dbStorage to the Postgres cluster (default 10Gi)', () => {
+    const defaults = renderEneo({ host: 'eneo.example.com', objectStorage })
+    const defaultCluster = defaults.resources.find((r) => r.kind === 'Cluster') as any
+    expect(defaultCluster.spec.storage.size).toBe('10Gi')
+
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage, dbStorage: '50Gi' })
+    const cluster = result.resources.find((r) => r.kind === 'Cluster') as any
+    expect(cluster.spec.storage.size).toBe('50Gi')
+  })
+})
+
+describe('rendering with all props', () => {
+  it('accepts the full prop surface', () => {
+    const result = renderEneo({
+      name: 'assistant',
+      namespace: 'ai',
+      version: '1.4.0',
+      host: 'assistant.example.com',
+      replicas: 3,
+      objectStorage: { ...objectStorage, bucket: 'assistant-corpora', region: 'eu-north-1' },
+      sso,
+      smtp: { host: 'smtp.example.com', port: 587, from: 'no-reply@assistant.example.com' },
+      dbStorage: '100Gi',
+      resources: {
+        requests: { memory: '1Gi', cpu: '500m' },
+        limits: { memory: '4Gi', cpu: '2000m' },
+      },
+      tls: { secretName: 'assistant-tls', clusterIssuer: 'letsencrypt-prod' },
+    })
+
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'assistant'
+    ) as any
+    expect(app).toBeDefined()
+    expect(app.spec.replicas).toBe(3)
+    expect(app.spec.template.spec.containers[0].image).toBe('ghcr.io/berget-ai/eneo:1.4.0')
+    expect(app.spec.template.spec.containers[0].resources.limits.memory).toBe('4Gi')
+
+    const env = app.spec.template.spec.containers[0].env
+    expect(env.find((e: any) => e.name === 'S3_BUCKET').value).toBe('assistant-corpora')
+    expect(env.find((e: any) => e.name === 'AWS_REGION').value).toBe('eu-north-1')
+    expect(env.find((e: any) => e.name === 'OIDC_ISSUER').value).toBe(sso.issuer)
+    expect(env.find((e: any) => e.name === 'OIDC_TOKEN_URI').value).toBe(
+      '$(OIDC_ISSUER)/protocol/openid-connect/token'
+    )
+    expect(env.find((e: any) => e.name === 'SMTP_HOST').value).toBe('smtp.example.com')
+    expect(env.find((e: any) => e.name === 'SMTP_PORT').value).toBe('587')
+    expect(env.find((e: any) => e.name === 'SMTP_FROM').value).toBe(
+      'no-reply@assistant.example.com'
+    )
+
+    const cluster = result.resources.find((r) => r.kind === 'Cluster') as any
+    expect(cluster.spec.storage.size).toBe('100Gi')
+  })
+
+  it('renders unique env var names (k8s rejects duplicates)', () => {
+    const result = renderEneo({
+      host: 'eneo.example.com',
+      objectStorage,
+      sso,
+      smtp: { host: 'smtp.example.com' },
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env as Array<{ name: string }>
+    const names = env.map((e) => e.name)
+    expect(new Set(names).size).toBe(names.length)
+    // The OIDC client secret must come from the secretKeyRef entry only —
+    // no plain env duplicate.
+    expect(names.filter((n) => n === 'OIDC_CLIENT_SECRET')).toHaveLength(1)
+  })
+})
+
+describe('secrets handling', () => {
+  it('provisions app secrets through the openbao backend', () => {
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage })
+    const bao = result.resources.find((r: any) => r.kind === 'OpenBaoStaticSecret') as any
+    expect(bao).toBeDefined()
+    expect(bao.spec.destination.name).toBe('eneo-secrets')
+    expect(bao.spec.path).toBe('test/eneo/secrets')
+  })
+
+  it('provisions app secrets through Vault', () => {
+    const result = render(
+      jsx(SecretContext.Provider, {
+        value: { backend: 'vault', mount: 'kv', path: 'apps' },
+        children: jsx(Eneo, { host: 'eneo.example.com', objectStorage }),
+      })
+    )
+    const vault = result.resources.find((r: any) => r.kind === 'VaultStaticSecret') as any
+    expect(vault).toBeDefined()
+    expect(vault.spec.destination.name).toBe('eneo-secrets')
+    expect(vault.spec.path).toBe('apps/eneo/secrets')
+  })
+
+  it('throws when no secrets backend and no secretsName (bundle requires appSecret)', () => {
+    expect(() => render(jsx(Eneo, { host: 'eneo.example.com', objectStorage }))).toThrow(
+      /application secrets \(appSecret\)/
+    )
+  })
+
+  it('requires smtpPassword from the bundle only when the smtp prop is set', () => {
+    expect(() =>
+      render(
+        jsx(Eneo, { host: 'eneo.example.com', objectStorage, smtp: { host: 'smtp.example.com' } })
+      )
+    ).toThrow(/application secrets \(appSecret, smtpPassword\)/)
+  })
+
+  it('accepts an existing secretsName without a backend', () => {
+    expect(() =>
+      render(
+        jsx(Eneo, {
+          host: 'eneo.example.com',
+          objectStorage,
+          secretsName: 'existing-secrets',
+        })
+      )
+    ).not.toThrow()
+  })
+
+  it('wires credentials via secretKeyRef (never plaintext env)', () => {
+    const result = renderEneo({
+      host: 'eneo.example.com',
+      objectStorage,
+      sso,
+      smtp: { host: 'smtp.example.com' },
+      secretsName: 'existing-secrets',
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const appSecret = env.find((e: any) => e.name === 'APP_SECRET')
+    const smtpPassword = env.find((e: any) => e.name === 'SMTP_PASSWORD')
+    const awsAccessKey = env.find((e: any) => e.name === 'AWS_ACCESS_KEY_ID')
+    const oidcClientSecret = env.find((e: any) => e.name === 'OIDC_CLIENT_SECRET')
+    const pgPassword = env.find((e: any) => e.name === 'PGPASSWORD')
+    expect(appSecret.valueFrom.secretKeyRef).toEqual({
+      name: 'existing-secrets',
+      key: 'appSecret',
+    })
+    expect(smtpPassword.valueFrom.secretKeyRef).toEqual({
+      name: 'existing-secrets',
+      key: 'smtpPassword',
+    })
+    expect(awsAccessKey.valueFrom.secretKeyRef).toEqual({
+      name: 'eneo-object-storage',
+      key: 'accessKey',
+    })
+    expect(oidcClientSecret.valueFrom.secretKeyRef).toEqual({
+      name: 'eneo-sso',
+      key: 'clientSecret',
+    })
+    expect(pgPassword.valueFrom.secretKeyRef.name).toBe('eneo-db-credentials')
+    for (const e of [appSecret, smtpPassword, awsAccessKey, oidcClientSecret, pgPassword]) {
+      expect(e.value).toBeUndefined()
+    }
+  })
+
+  it('injects SMTP password via secretKeyRef only when smtp is configured', () => {
+    const withSmtp = renderEneo({
+      host: 'eneo.example.com',
+      objectStorage,
+      smtp: { host: 'smtp.example.com', port: 465, from: 'no-reply@eneo.example.com' },
+      secretsName: 'existing-secrets',
+    })
+    const smtpApp = withSmtp.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    const smtpEnv = smtpApp.spec.template.spec.containers[0].env
+    const smtpPassword = smtpEnv.find((e: any) => e.name === 'SMTP_PASSWORD')
+    expect(smtpPassword.valueFrom.secretKeyRef).toEqual({
+      name: 'existing-secrets',
+      key: 'smtpPassword',
+    })
+    expect(smtpPassword.value).toBeUndefined()
+    expect(smtpEnv.find((e: any) => e.name === 'SMTP_HOST').value).toBe('smtp.example.com')
+    expect(smtpEnv.find((e: any) => e.name === 'SMTP_PORT').value).toBe('465')
+    expect(smtpEnv.find((e: any) => e.name === 'SMTP_FROM').value).toBe('no-reply@eneo.example.com')
+
+    const withoutSmtp = renderEneo({
+      host: 'eneo.example.com',
+      objectStorage,
+      secretsName: 'existing-secrets',
+    })
+    const plainApp = withoutSmtp.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    const plainEnv = plainApp.spec.template.spec.containers[0].env
+    expect(plainEnv.find((e: any) => e.name === 'SMTP_PASSWORD')).toBeUndefined()
+    expect(plainEnv.find((e: any) => e.name === 'SMTP_HOST')).toBeUndefined()
+  })
+
+  it('auto-wires DATABASE_URL from the Database context without plaintext', () => {
+    const result = renderEneo({ host: 'eneo.example.com', objectStorage })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eneo'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const dbUrl = env.find((e: any) => e.name === 'DATABASE_URL')
+    expect(dbUrl.value).toBe(
+      'postgresql://$(PGUSER):$(PGPASSWORD)@$(PGHOST):$(PGPORT)/$(PGDATABASE)'
+    )
+  })
+
+  it('renders no plaintext credentials anywhere', () => {
+    const result = renderEneo({
+      host: 'eneo.example.com',
+      objectStorage,
+      sso,
+      smtp: { host: 'smtp.example.com', port: 587, from: 'no-reply@eneo.example.com' },
+      dbStorage: '50Gi',
+    })
+    const { passed, errors } = runGuardrails(result.resources as any[], [noPlaintextSecrets])
+    if (!passed) {
+      console.error('Plaintext credential violations:', errors)
+    }
+    expect(passed).toBe(true)
+  })
+})

package/examples/basic.tsx

@@ -0,0 +1,16 @@
+import { Platform } from '@r8s/recipes'
+import { Eneo } from '@r8s/eneo'
+
+export default (
+  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+    <Eneo
+      name="eneo"
+      host="eneo.example.com"
+      objectStorage={{
+        endpoint: 'https://s3.internal.example.com',
+        bucket: 'eneo-corpora',
+        credentialsSecret: 'eneo-object-storage',
+      }}
+    />
+  </Platform>
+)

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@r8s/eneo",
+  "version": "0.2.0",
+  "description": "Eneo — open AI platform from Sundsvall municipality (agent workspaces, assistants, document AI)",
+  "license": "MIT",
+  "author": "Berget AI AB",
+  "homepage": "https://r8s.berget.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/berget-ai/r8s.git",
+    "directory": "packages/eneo"
+  },
+  "bugs": "https://github.com/berget-ai/r8s/issues",
+  "keywords": [
+    "eneo",
+    "documents",
+    "corpora",
+    "knowledge"
+  ],
+  "r8s": {
+    "category": "Agent Platforms"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "test": "vitest run",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "category": "Collaboration & Productivity",
+  "dependencies": {
+    "@r8s/core": "^0.2.0",
+    "@r8s/crds": "^0.2.0",
+    "@r8s/k8s-types": "^0.2.0",
+    "@r8s/recipes": "^0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  }
+}

package/src/index.tsx

@@ -0,0 +1,292 @@
+import { jsx, Fragment, useContext } from '@r8s/core'
+import { Namespace, SecretContext } from '@r8s/core/defaults'
+import { Database, WebService, Endpoint } from '@r8s/recipes'
+import type { SecretRef } from '@r8s/recipes'
+
+export interface EneoProps {
+  /** Resource name (defaults to 'eneo') */
+  name?: string
+  /** Kubernetes namespace (defaults to 'default') */
+  namespace?: string
+  /** Container image tag (defaults to 'latest' — pin a version in production) */
+  version?: string
+  /** Public hostname for the Eneo web app (required) */
+  host: string
+  /** Number of app replicas (defaults to 2 — scale freely, the app is stateless) */
+  replicas?: number
+  /**
+   * S3-compatible object storage for document corpora (RustFS in the
+   * platform). Required. Reference a bucket whose credentials live in a
+   * Secret provisioned by the secrets backend (keys: accessKey, secretKey)
+   * — never plaintext.
+   */
+  objectStorage: {
+    /** S3 endpoint URL, e.g. https://s3.internal.example.com */
+    endpoint: string
+    /** Bucket holding document corpora */
+    bucket: string
+    /** Name of the Secret holding accessKey / secretKey */
+    credentialsSecret: string
+    /** Region string for the S3 client (defaults to 'us-east-1') */
+    region?: string
+  }
+  /**
+   * OIDC SSO client — register Eneo as a client in Keycloak (the Auth
+   * recipe) and reference the client secret through the backend.
+   */
+  sso?: {
+    issuer: string
+    clientId: string
+    clientSecretRef: SecretRef
+    scopes?: string
+  }
+  /**
+   * Outgoing SMTP for invitations and notifications (mirror of the
+   * EuroOffice recipe). When set, SMTP_HOST / SMTP_PORT / SMTP_FROM are
+   * rendered as plain env and SMTP_PASSWORD is delivered via secretKeyRef
+   * from the `${name}-secrets` bundle (key: smtpPassword) — never
+   * plaintext. The bundle then requires the `smtpPassword` key as well;
+   * without `smtp` only `appSecret` is required from the bundle.
+   */
+  smtp?: {
+    /** SMTP server hostname, e.g. smtp.example.com */
+    host: string
+    /** SMTP port (defaults to 587) */
+    port?: number
+    /** From address for outgoing mail, e.g. no-reply@example.com */
+    from?: string
+  }
+  /**
+   * Name of an existing Secret holding `appSecret` (and `smtpPassword`
+   * when `smtp` is set). Required unless a secrets backend
+   * (openbao/vault) is configured on the surrounding Platform — the
+   * backend then provisions them.
+   */
+  secretsName?: string
+  /**
+   * Storage size for the Postgres cluster (defaults to '10Gi').
+   *
+   * Document corpora live in object storage (`objectStorage`, S3/RustFS)
+   * — Eneo does not persist corpora on a local volume. A local corpus
+   * PVC (mounted volumes/sidecars on the app workload) is a v1.1 item.
+   */
+  dbStorage?: string
+  /** Requested app resources */
+  resources?: {
+    requests?: { cpu?: string; memory?: string }
+    limits?: { cpu?: string; memory?: string }
+  }
+  /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+  tls?: {
+    secretName: string
+    clusterIssuer: string
+  }
+}
+
+/**
+ * Eneo — open AI platform from Sundsvall municipality (agent workspaces,
+ * assistants, document AI).
+ *
+ * @title Eneo
+ * @category Agent Platforms
+ *
+ * Composes:
+ * - CNPG Postgres cluster (conversations, workspaces, document metadata;
+ *   size via `dbStorage`)
+ * - Eneo Deployment + Service + Endpoint (DATABASE_URL auto-wired)
+ * - S3/RustFS bucket reference for document corpora (required) — corpora
+ *   do not use local volumes; a local corpus PVC is a v1.1 item
+ * - App secrets (appSecret, plus smtpPassword when `smtp` is set)
+ *   provisioned by the Platform secrets backend (openbao / vault), or
+ *   referenced from an existing Secret
+ * - Optional SMTP delivery; password via the `${name}-secrets` bundle
+ * - OIDC SSO against the Keycloak `Auth` recipe
+ *
+ * The namespace is inherited from the surrounding `<Platform>` (via the
+ * Namespace context) unless set explicitly.
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the app secrets bundle is provisioned for you. Without a backend you
+ * must point `secretsName` at a pre-created Secret.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Eneo } from '@r8s/eneo'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <Eneo
+ *       name="eneo"
+ *       host="eneo.example.com"
+ *       objectStorage={{
+ *         endpoint: 'https://s3.internal.example.com',
+ *         bucket: 'eneo-corpora',
+ *         credentialsSecret: 'eneo-object-storage',
+ *       }}
+ *     />
+ *   </Platform>
+ * )
+ */
+export function Eneo(props: EneoProps) {
+  const {
+    name = 'eneo',
+    namespace: namespaceProp,
+    version = 'latest',
+    host,
+    replicas = 2,
+    objectStorage,
+    sso,
+    smtp,
+    secretsName,
+    dbStorage = '10Gi',
+    resources = {
+      requests: { memory: '512Mi', cpu: '250m' },
+      limits: { memory: '2Gi', cpu: '1000m' },
+    },
+    tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' },
+  } = props
+
+  // Inherit namespace from <Platform> context if not explicitly set
+  const contextNamespace = useContext(Namespace)
+  const namespace =
+    namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default'
+
+  const secretProvider = useContext(SecretContext)
+  const resources_: ReturnType<typeof jsx>[] = []
+
+  const platformSecretsName = secretsName ?? `${name}-secrets`
+
+  // --- App secrets (appSecret / smtpPassword) -------------------------------
+  // Session signing and SMTP delivery credentials are the crown jewels of an
+  // Eneo install — never render them as plaintext. With a secrets backend
+  // they are provisioned through the backend; otherwise reference a
+  // pre-created Secret. smtpPassword is only required from the bundle when
+  // the `smtp` prop is configured.
+  const requiredSecretKeys = smtp ? 'appSecret, smtpPassword' : 'appSecret'
+  if (!secretsName) {
+    if (
+      !secretProvider ||
+      (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')
+    ) {
+      throw new Error(
+        `Eneo "${name}" requires application secrets (${requiredSecretKeys}).\n` +
+          `\n` +
+          `These must not be rendered as plaintext.\n` +
+          `\n` +
+          `Fix: configure a secrets backend on the Platform:\n` +
+          `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+          `    <Eneo name="${name}" host="${host}" />\n` +
+          `  </Platform>\n` +
+          `\n` +
+          `Or reference a pre-created Secret (keys: ${requiredSecretKeys}):\n` +
+          `  <Eneo name="${name}" host="${host}" secretsName="${name}-secrets" />`
+      )
+    }
+
+    const spec = {
+      ...(secretProvider.backend === 'vault'
+        ? { vaultAuthRef: secretProvider.authRef }
+        : { openbaoAuthRef: secretProvider.authRef }),
+      mount: secretProvider.mount,
+      type: 'kv-v2' as const,
+      path: `${secretProvider.path ?? name}/${name}/secrets`,
+      destination: { create: true, name: platformSecretsName },
+    }
+    resources_.push(
+      secretProvider.backend === 'vault'
+        ? jsx('VaultStaticSecret', {
+            apiVersion: 'secrets.hashicorp.com/v1beta1',
+            kind: 'VaultStaticSecret',
+            metadata: { name: `${name}-secrets`, namespace },
+            spec,
+          })
+        : jsx('OpenBaoStaticSecret', {
+            apiVersion: 'secrets.openbao.org/v1beta1',
+            kind: 'OpenBaoStaticSecret',
+            metadata: { name: `${name}-secrets`, namespace },
+            spec,
+          })
+    )
+  }
+
+  // --- Env wiring --------------------------------------------------------------
+  // Every credential is referenced with $(VAR) expansion or secretKeyRef —
+  // no plaintext in the manifest. The WebService declares secret-backed
+  // vars before plain env vars, so dependent expansion resolves. DATABASE_URL
+  // and PG* vars are auto-wired from the Database context (see below).
+  const env: Record<string, string> = {
+    PORT: '3000',
+    BASE_URL: `https://${host}`,
+    S3_ENDPOINT: objectStorage.endpoint,
+    S3_BUCKET: objectStorage.bucket,
+    AWS_REGION: objectStorage.region ?? 'us-east-1',
+    ...(sso
+      ? {
+          OIDC_ISSUER: sso.issuer,
+          OIDC_CLIENT_ID: sso.clientId,
+          OIDC_SCOPES: sso.scopes ?? 'openid email profile',
+          OIDC_AUTH_URI: '$(OIDC_ISSUER)/protocol/openid-connect/auth',
+          OIDC_TOKEN_URI: '$(OIDC_ISSUER)/protocol/openid-connect/token',
+          OIDC_USERINFO_URI: '$(OIDC_ISSUER)/protocol/openid-connect/userinfo',
+        }
+      : {}),
+    ...(smtp
+      ? {
+          SMTP_HOST: smtp.host,
+          SMTP_PORT: String(smtp.port ?? 587),
+          ...(smtp.from && { SMTP_FROM: smtp.from }),
+        }
+      : {}),
+  }
+
+  // Credentials delivered via secretKeyRef (runtime injection).
+  // OIDC_CLIENT_SECRET comes from sso.clientSecretRef — do NOT also render
+  // it as a plain $(VAR) env entry: duplicate env names are rejected by
+  // Kubernetes.
+  const secrets: Record<string, SecretRef | string> = {
+    APP_SECRET: { secret: platformSecretsName, key: 'appSecret' },
+    ...(smtp
+      ? { SMTP_PASSWORD: { secret: platformSecretsName, key: 'smtpPassword' as const } }
+      : {}),
+    AWS_ACCESS_KEY_ID: { secret: objectStorage.credentialsSecret, key: 'accessKey' },
+    AWS_SECRET_ACCESS_KEY: { secret: objectStorage.credentialsSecret, key: 'secretKey' },
+    ...(sso ? { OIDC_CLIENT_SECRET: sso.clientSecretRef } : {}),
+  }
+
+  // --- Database + app + endpoint ------------------------------------------------
+  // Database wraps the app so credentials stay consistent with the r8s
+  // Database recipe (CNPG dedicated cluster provisions the secret) and the
+  // WebService auto-wires PG* + DATABASE_URL from DatabaseContext.
+  resources_.push(
+    jsx(Database, {
+      name,
+      namespace,
+      storage: dbStorage,
+      children: (
+        <WebService
+          name={name}
+          namespace={namespace}
+          image={`ghcr.io/berget-ai/eneo:${version}`}
+          port={3000}
+          replicas={replicas}
+          resources={resources}
+          env={env}
+          secrets={secrets}
+        />
+      ),
+    })
+  )
+
+  resources_.push(
+    <Endpoint
+      name={`${name}-endpoint`}
+      namespace={namespace}
+      host={host}
+      serviceName={name}
+      servicePort={3000}
+      tls={tls}
+    />
+  )
+
+  return jsx(Fragment, { children: resources_ })
+}

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "composite": true
+  },
+  "include": ["src/**/*"],
+  "references": [
+    { "path": "../core" },
+    { "path": "../k8s-types" },
+    { "path": "../crds" },
+    { "path": "../recipes" }
+  ]
+}