@r8s/eurooffice 0.2.0 → 0.2.1

package/dist/index.d.ts

@@ -0,0 +1,137 @@
+import { type DatabaseProps } from '@r8s/recipes';
+export interface EuroOfficeProps {
+    /** Resource name (defaults to 'onlyoffice') */
+    name?: string;
+    /** Kubernetes namespace (inherited from <Platform> unless set) */
+    namespace?: string;
+    /**
+     * DocumentServer image tag (defaults to 'v9.3.2').
+     * PINNED VERSION REQUIRED — the ghcr.io/euro-office/documentserver repo
+     * also carries CI build tags, so 'latest' is rejected.
+     */
+    version?: string;
+    /** Public hostname for the document server (required) — used by Odoo/WOPI integrations */
+    host: string;
+    /**
+     * Number of app replicas. Must be exactly 1: the DocumentServer ships
+     * with embedded Redis + RabbitMQ and keeps its secure-link secret and
+     * WOPI keys on the RWO data volume — it does not scale horizontally.
+     */
+    replicas?: number;
+    /**
+     * RWO data volume at /var/www/euro-office/Data (subPath `data`) holding
+     * the auto-generated secure-link secret and WOPI keys. Defaults to
+     * '5Gi'. Pass `false` to manage storage yourself.
+     */
+    dataStorage?: string | {
+        size?: string;
+        storageClass?: string;
+    } | false;
+    /**
+     * Custom UI fonts baked into the container at boot (curlimages/curl
+     * init container downloads static TTFs into core-fonts/berget — variable
+     * TTFs render under the wrong family name, so statics are used).
+     * Defaults to the Berget brand set (DM Sans Regular/Medium/Bold + Ovo).
+     * Pass `false` to disable.
+     */
+    customFonts?: {
+        name: string;
+        url: string;
+    }[] | false;
+    /**
+     * JWT securing the document-server API (Odoo integration). Enabled
+     * always (JWT_ENABLED=true, JWT_HEADER=Authorization); the secret is
+     * provisioned through the Platform secrets backend with a 1h refresh
+     * and pod restart on rotation, unless `jwtSecretName` references a
+     * pre-created Secret (key: JWT_SECRET).
+     */
+    jwt?: {
+        /** Backend path (defaults to `<provider.path>/<name>/jwt`) */
+        path?: string;
+        /** Re-sync interval (defaults to the provider's, else '1h') */
+        refreshAfter?: string;
+        /** Explicit pod restart targets on rotation (defaults to this Deployment) */
+        rolloutRestartTargets?: {
+            kind?: string;
+            name: string;
+            apiVersion?: string;
+        }[];
+    };
+    /** Reference a pre-created JWT Secret (keys: JWT_SECRET) instead of backend provisioning */
+    jwtSecretName?: string;
+    /** Show the /example test UI (EXAMPLE_ENABLED). Defaults to false — enable during bring-up, then turn off */
+    exampleEnabled?: boolean;
+    /**
+     * CNPG cluster name (also the database and user name). Defaults to
+     * 'eurooffice-db' — the production cluster name, deliberately distinct
+     * from older naming to avoid PVC collisions.
+     */
+    dbName?: string;
+    /** Number of CNPG instances (defaults to 2) */
+    dbInstances?: number;
+    /** CNPG data volume size (defaults to '20Gi') */
+    dbStorage?: string;
+    /** CNPG storage class (defaults to cluster default) */
+    dbStorageClass?: string;
+    /** CNPG backup configuration passed through to the Database recipe (continuous WAL + scheduled base backups) */
+    backup?: DatabaseProps['backup'];
+    /**
+     * SQL statements run once on a fresh cluster (CNPG postInitApplicationSQL).
+     * Note: v9.3.2 cannot bootstrap an empty database by itself (entrypoint
+     * lacks ensure_db_schema) — on a NEW cluster apply the image's
+     * createdb.sql, or provide it here so the package handles it for you.
+     */
+    postInitSQL?: string[];
+    /** Requested app resources (defaults to facit: 1Gi/500m → 4Gi/2) */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+    /** Extra annotations merged onto the Endpoint (proxy-body-size 100m + 600s timeouts are defaults) */
+    endpointAnnotations?: Record<string, string>;
+    /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * EuroOffice — Euro-Office DocumentServer (self-hosted collaborative
+ * document editing, facit-aligned).
+ *
+ * @title EuroOffice
+ * @category Productivity & Documents
+ *
+ * Composes:
+ * - DocumentServer Deployment + Service (port 80, `/healthcheck` probes,
+ *   startup probe tolerating the ~10-minute first boot: schema + fonts)
+ * - CNPG Postgres cluster (default 2 instances, facit-tuned parameters)
+ * - RWO data volume for the secure-link secret + WOPI keys
+ * - JWT secret provisioned through the Platform secrets backend (or a
+ *   referenced pre-created Secret) with pod restart on rotation
+ * - preStop lifecycle hook (documentserver-prepare4shutdown.sh — saves
+ *   open documents and disconnects sessions before shutdown)
+ * - Optional brand-font init container
+ * - Endpoint with 100m body-size + 600s proxy timeouts
+ *
+ * The DocumentServer is strictly single-replica (embedded Redis +
+ * RabbitMQ, RWO volume) — `replicas` other than 1 is rejected.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { EuroOffice } from '@r8s/eurooffice'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <EuroOffice host="docs.example.com" exampleEnabled />
+ *   </Platform>
+ * )
+ */
+export declare function EuroOffice(props: EuroOfficeProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAA;AAErB,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;IACvE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,KAAK,CAAA;IACrD;;;;;;OAMG;IACH,GAAG,CAAC,EAAE;QACJ,8DAA8D;QAC9D,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,6EAA6E;QAC7E,qBAAqB,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAC/E,CAAA;IACD,4FAA4F;IAC5F,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6GAA6G;IAC7G,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gHAAgH;IAChH,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,oEAAoE;IACpE,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,qGAAqG;IACrG,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5C,sEAAsE;IACtE,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,kCA0OhD"}

package/dist/index.js

@@ -0,0 +1,246 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EuroOffice = EuroOffice;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+// Berget brand fonts — static TTFs (variable fonts render under the wrong
+// family name inside the document server). Downloaded by an init container
+// into an emptyDir mounted over core-fonts/berget.
+const DEFAULT_FONT_URLS = [
+    {
+        name: 'DMSans-Regular.ttf',
+        url: 'https://fonts.gstatic.com/s/dmsans/v17/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAopxhTg.ttf',
+    },
+    {
+        name: 'DMSans-Medium.ttf',
+        url: 'https://fonts.gstatic.com/s/dmsans/v17/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAkJxhTg.ttf',
+    },
+    {
+        name: 'DMSans-Bold.ttf',
+        url: 'https://fonts.gstatic.com/s/dmsans/v17/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwARZthTg.ttf',
+    },
+    {
+        name: 'Ovo-Regular.ttf',
+        url: 'https://fonts.gstatic.com/s/ovo/v18/yYLl0h7Wyfzjyw.ttf',
+    },
+];
+/**
+ * EuroOffice — Euro-Office DocumentServer (self-hosted collaborative
+ * document editing, facit-aligned).
+ *
+ * @title EuroOffice
+ * @category Productivity & Documents
+ *
+ * Composes:
+ * - DocumentServer Deployment + Service (port 80, `/healthcheck` probes,
+ *   startup probe tolerating the ~10-minute first boot: schema + fonts)
+ * - CNPG Postgres cluster (default 2 instances, facit-tuned parameters)
+ * - RWO data volume for the secure-link secret + WOPI keys
+ * - JWT secret provisioned through the Platform secrets backend (or a
+ *   referenced pre-created Secret) with pod restart on rotation
+ * - preStop lifecycle hook (documentserver-prepare4shutdown.sh — saves
+ *   open documents and disconnects sessions before shutdown)
+ * - Optional brand-font init container
+ * - Endpoint with 100m body-size + 600s proxy timeouts
+ *
+ * The DocumentServer is strictly single-replica (embedded Redis +
+ * RabbitMQ, RWO volume) — `replicas` other than 1 is rejected.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { EuroOffice } from '@r8s/eurooffice'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <EuroOffice host="docs.example.com" exampleEnabled />
+ *   </Platform>
+ * )
+ */
+function EuroOffice(props) {
+    const { name = 'onlyoffice', namespace: namespaceProp, version = 'v9.3.2', host, replicas = 1, dataStorage = '5Gi', customFonts, jwt, jwtSecretName, exampleEnabled = false, dbName = 'eurooffice-db', dbInstances = 2, dbStorage = '20Gi', dbStorageClass, backup, postInitSQL, resources = {
+        requests: { memory: '1Gi', cpu: '500m' },
+        limits: { memory: '4Gi', cpu: '2' },
+    }, endpointAnnotations = {}, tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const resources_ = [];
+    if (version === 'latest') {
+        throw new Error(`EuroOffice "${name}" requires a pinned version.\n` +
+            `\n` +
+            `The ghcr.io/euro-office/documentserver repo also carries CI build tags —\n` +
+            `'latest' may resolve to an untested build and break document editing.\n` +
+            `\n` +
+            `Fix: <EuroOffice version="v9.3.2" ... />`);
+    }
+    if (replicas !== 1) {
+        throw new Error(`EuroOffice "${name}" requires replicas=1.\n` +
+            `\n` +
+            `The DocumentServer ships embedded Redis + RabbitMQ and keeps its\n` +
+            `secure-link secret and WOPI keys on the RWO data volume — it does\n` +
+            `not scale horizontally (received replicas=${replicas}).`);
+    }
+    // --- JWT secret (core of the Odoo/WOPI integration) ------------------------
+    const jwtSecretResourceName = jwtSecretName ?? `${name}-jwt-secret`;
+    if (!jwtSecretName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('EuroOffice', name, 'a JWT secret — it signs every document-server API call (Odoo integration)', {
+                propName: 'jwtSecretName',
+                exampleValue: `${name}-jwt-secret`,
+                keys: ['JWT_SECRET'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-jwt`,
+            namespace,
+            path: jwt?.path ?? `${secretProvider.path ?? name}/${name}/jwt`,
+            secretName: jwtSecretResourceName,
+            refreshAfter: jwt?.refreshAfter,
+            keys: ['JWT_SECRET'],
+            restart: jwt?.rolloutRestartTargets ?? [{ kind: 'Deployment', name }],
+        }));
+    }
+    // --- Data volume (secure-link secret + WOPI keys) --------------------------
+    const dataVolumeName = `${name}-data`;
+    if (dataStorage) {
+        const size = typeof dataStorage === 'string' ? dataStorage : (dataStorage.size ?? '5Gi');
+        const storageClass = typeof dataStorage === 'object' ? dataStorage.storageClass : undefined;
+        resources_.push((0, core_1.jsx)('PersistentVolumeClaim', {
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: { name: dataVolumeName, namespace },
+            spec: {
+                accessModes: ['ReadWriteOnce'],
+                ...(storageClass ? { storageClassName: storageClass } : {}),
+                resources: { requests: { storage: size } },
+            },
+        }));
+    }
+    // --- Fonts -----------------------------------------------------------------
+    const fonts = customFonts === undefined ? DEFAULT_FONT_URLS : customFonts;
+    const fontsEnabled = fonts !== false && fonts.length > 0;
+    // --- Database (CNPG) — document metadata, sessions --------------------------
+    const dbHost = `${dbName}-rw.${namespace}.svc.cluster.local`;
+    const dbCredentialsName = `${dbName}-db-credentials`;
+    // --- Env wiring --------------------------------------------------------------
+    // Every credential is delivered via secretKeyRef — no plaintext in the
+    // manifest. DB_* uses the DocumentServer's own variable names (it does
+    // not read DATABASE_URL), so no WebService/Database auto-wiring.
+    const env = {
+        DB_TYPE: 'postgres',
+        DB_HOST: dbHost,
+        DB_PORT: '5432',
+        DB_NAME: dbName,
+        DB_USER: dbName,
+        JWT_ENABLED: 'true',
+        JWT_HEADER: 'Authorization',
+        ...(exampleEnabled ? { EXAMPLE_ENABLED: 'true' } : {}),
+    };
+    const secrets = {
+        DB_PWD: { secret: dbCredentialsName, key: 'password' },
+        JWT_SECRET: { secret: jwtSecretResourceName, key: 'JWT_SECRET' },
+    };
+    const volumes = [
+        ...(dataStorage
+            ? [{ name: 'data', persistentVolumeClaim: { claimName: dataVolumeName } }]
+            : []),
+        ...(fontsEnabled ? [{ name: 'custom-fonts', emptyDir: {} }] : []),
+    ];
+    const volumeMounts = [
+        ...(dataStorage
+            ? [{ name: 'data', mountPath: '/var/www/euro-office/Data', subPath: 'data' }]
+            : []),
+        ...(fontsEnabled
+            ? [
+                {
+                    name: 'custom-fonts',
+                    mountPath: '/var/www/euro-office/documentserver/core-fonts/berget',
+                },
+            ]
+            : []),
+    ];
+    const fontScript = fontsEnabled
+        ? [
+            'set -e',
+            'mkdir -p /fonts',
+            ...fonts.map((f) => `curl -fsSL -o /fonts/${f.name} "${f.url}"`),
+            'echo "Downloaded fonts:"',
+            'ls -la /fonts/',
+        ].join('\n')
+        : undefined;
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        name: dbName,
+        namespace,
+        instances: dbInstances,
+        storage: dbStorage,
+        ...(dbStorageClass ? { storageClass: dbStorageClass } : {}),
+        parameters: {
+            shared_buffers: '256MB',
+            max_connections: '200',
+            work_mem: '8MB',
+            maintenance_work_mem: '128MB',
+            effective_cache_size: '768MB',
+        },
+        ...(backup ? { backup } : {}),
+        ...(postInitSQL && postInitSQL.length > 0 ? { postInitSQL } : {}),
+    }), (0, core_1.jsx)(recipes_1.WebService, {
+        name,
+        namespace,
+        image: `ghcr.io/euro-office/documentserver:${version}`,
+        port: 80,
+        replicas: 1,
+        strategy: 'Recreate',
+        resources,
+        env,
+        secrets,
+        volumes,
+        volumeMounts,
+        ...(fontsEnabled
+            ? {
+                initContainers: [
+                    {
+                        name: 'custom-fonts',
+                        image: 'curlimages/curl:8.12.0',
+                        command: ['sh', '-c'],
+                        args: [fontScript],
+                        volumeMounts: [{ name: 'custom-fonts', mountPath: '/fonts' }],
+                    },
+                ],
+            }
+            : {}),
+        // Graceful shutdown: save open documents and disconnect sessions
+        // before the pod goes away
+        lifecycle: {
+            preStop: {
+                exec: {
+                    command: [
+                        'sh',
+                        '-c',
+                        'command -v documentserver-prepare4shutdown.sh >/dev/null 2>&1 && documentserver-prepare4shutdown.sh || true',
+                    ],
+                },
+            },
+        },
+        probes: {
+            // First boot runs schema migration + font refresh — up to ~10 min
+            startup: { path: '/healthcheck', periodSeconds: 10, failureThreshold: 60 },
+            readiness: { path: '/healthcheck', periodSeconds: 15, failureThreshold: 3 },
+            liveness: { path: '/healthcheck', periodSeconds: 30, failureThreshold: 3 },
+        },
+    }), (0, core_1.jsx)(recipes_1.Endpoint, {
+        name: `${name}-endpoint`,
+        namespace,
+        host,
+        serviceName: name,
+        servicePort: 80,
+        annotations: {
+            'nginx.ingress.kubernetes.io/proxy-body-size': '100m',
+            'nginx.ingress.kubernetes.io/proxy-read-timeout': '600',
+            'nginx.ingress.kubernetes.io/proxy-send-timeout': '600',
+            ...endpointAnnotations,
+        },
+        tls,
+    }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AAyJA,gCA0OC;AAnYD,oCAAqD;AACrD,iDAAgE;AAChE,0CAQqB;AAyFrB,0EAA0E;AAC1E,2EAA2E;AAC3E,mDAAmD;AACnD,MAAM,iBAAiB,GAAG;IACxB;QACE,IAAI,EAAE,oBAAoB;QAC1B,GAAG,EAAE,mGAAmG;KACzG;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,mGAAmG;KACzG;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,GAAG,EAAE,mGAAmG;KACzG;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,GAAG,EAAE,wDAAwD;KAC9D;CACF,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,EACJ,IAAI,GAAG,YAAY,EACnB,SAAS,EAAE,aAAa,EACxB,OAAO,GAAG,QAAQ,EAClB,IAAI,EACJ,QAAQ,GAAG,CAAC,EACZ,WAAW,GAAG,KAAK,EACnB,WAAW,EACX,GAAG,EACH,aAAa,EACb,cAAc,GAAG,KAAK,EACtB,MAAM,GAAG,eAAe,EACxB,WAAW,GAAG,CAAC,EACf,SAAS,GAAG,MAAM,EAClB,cAAc,EACd,MAAM,EACN,WAAW,EACX,SAAS,GAAG;QACV,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;QACxC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;KACpC,EACD,mBAAmB,GAAG,EAAE,EACxB,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACvE,GAAG,KAAK,CAAA;IAET,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,gCAAgC;YACjD,IAAI;YACJ,4EAA4E;YAC5E,yEAAyE;YACzE,IAAI;YACJ,0CAA0C,CAC7C,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,0BAA0B;YAC3C,IAAI;YACJ,oEAAoE;YACpE,qEAAqE;YACrE,6CAA6C,QAAQ,IAAI,CAC5D,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,qBAAqB,GAAG,aAAa,IAAI,GAAG,IAAI,aAAa,CAAA;IACnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,YAAY,EACZ,IAAI,EACJ,2EAA2E,EAC3E;gBACE,QAAQ,EAAE,eAAe;gBACzB,YAAY,EAAE,GAAG,IAAI,aAAa;gBAClC,IAAI,EAAE,CAAC,YAAY,CAAC;aACrB,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,MAAM;YACnB,SAAS;YACT,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM;YAC/D,UAAU,EAAE,qBAAqB;YACjC,YAAY,EAAE,GAAG,EAAE,YAAY;YAC/B,IAAI,EAAE,CAAC,YAAY,CAAC;YACpB,OAAO,EAAE,GAAG,EAAE,qBAAqB,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACtE,CAAC,CACH,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,GAAG,IAAI,OAAO,CAAA;IACrC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,CAAA;QACxF,MAAM,YAAY,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,uBAAuB,EAAE;YAC3B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE;YAC7C,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC,eAAe,CAAC;gBAC9B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;aAC3C;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAA;IACzE,MAAM,YAAY,GAAG,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IAExD,+EAA+E;IAC/E,MAAM,MAAM,GAAG,GAAG,MAAM,OAAO,SAAS,oBAAoB,CAAA;IAC5D,MAAM,iBAAiB,GAAG,GAAG,MAAM,iBAAiB,CAAA;IAEpD,gFAAgF;IAChF,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,GAAG,GAA2B;QAClC,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,eAAe;QAC3B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAA;IAED,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,UAAU,EAAE;QACtD,UAAU,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,YAAY,EAAE;KACjE,CAAA;IAED,MAAM,OAAO,GAAmD;QAC9D,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;IACD,MAAM,YAAY,GAAG;QACnB,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY;YACd,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,uDAAuD;iBACnE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,MAAM,UAAU,GAAG,YAAY;QAC7B,CAAC,CAAC;YACE,QAAQ;YACR,iBAAiB;YACjB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC;YAChE,0BAA0B;YAC1B,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC;QACd,CAAC,CAAC,SAAS,CAAA;IAEb,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI,EAAE,MAAM;QACZ,SAAS;QACT,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,UAAU,EAAE;YACV,cAAc,EAAE,OAAO;YACvB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,KAAK;YACf,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,OAAO;SAC9B;QACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,EACF,IAAA,UAAG,EAAC,oBAAU,EAAE;QACd,IAAI;QACJ,SAAS;QACT,KAAK,EAAE,sCAAsC,OAAO,EAAE;QACtD,IAAI,EAAE,EAAE;QACR,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,UAAU;QACpB,SAAS;QACT,GAAG;QACH,OAAO;QACP,OAAO;QACP,YAAY;QACZ,GAAG,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,cAAc,EAAE;oBACd;wBACE,IAAI,EAAE,cAAc;wBACpB,KAAK,EAAE,wBAAwB;wBAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;wBACrB,IAAI,EAAE,CAAC,UAAU,CAAC;wBAClB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;qBAC9D;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,iEAAiE;QACjE,2BAA2B;QAC3B,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,OAAO,EAAE;wBACP,IAAI;wBACJ,IAAI;wBACJ,6GAA6G;qBAC9G;iBACF;aACF;SACF;QACD,MAAM,EAAE;YACN,kEAAkE;YAClE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE;YAC1E,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;YAC3E,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;SAC3E;KACF,CAAC,EACF,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI,EAAE,GAAG,IAAI,WAAW;QACxB,SAAS;QACT,IAAI;QACJ,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,6CAA6C,EAAE,MAAM;YACrD,gDAAgD,EAAE,KAAK;YACvD,gDAAgD,EAAE,KAAK;YACvD,GAAG,mBAAmB;SACvB;QACD,GAAG;KACJ,CAAC,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/eurooffice",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "EuroOffice collaborative document suite — Postgres persistence, S3 blob storage, LibreOffice conversions, SMTP delivery and websocket collaboration",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -37,5 +37,8 @@
   "devDependencies": {
     "typescript": "^5.3.0",
     "vitest": "^1.0.0"
-  }
+  },
+  "files": [
+    "dist"
+  ]
 }

package/__tests__/eurooffice.test.ts

@@ -1,427 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { render, jsx } from '@r8s/core'
-import { Namespace, OperatorContext, SecretContext, RoutingContext } from '@r8s/core/defaults'
-import { runGuardrails, noPlaintextSecrets, validateResource } from '@r8s/core'
-import { operators } from '@r8s/crds'
-import type { r8sElement } from '@r8s/core'
-
-// EuroOffice recipe tests:
-//   1. Operator declarations (deduped via OperatorContext)
-//   2. Rendering: defaults, all props, gateway/ingress adaptation, TCP probes
-//   3. Namespace inheritance from the Platform context
-//   4. Security: no plaintext credentials in rendered output
-import { EuroOffice } from '../src/index'
-
-const objectStorage = {
-  endpoint: 'https://s3.test',
-  bucket: 'docs-blobs',
-  credentialsSecret: 'docs-blobs-credentials',
-}
-
-const openbao = { backend: 'openbao', mount: 'kv', path: 'test' }
-
-/** Render EuroOffice inside a Platform-like secrets backend (OpenBao). */
-function renderEuroOffice(props: Record<string, unknown>): ReturnType<typeof render> {
-  return render(
-    jsx(SecretContext.Provider, {
-      value: { backend: 'openbao', mount: 'kv', path: 'test' },
-      children: jsx(EuroOffice, { objectStorage, ...props } as never),
-    })
-  )
-}
-
-/** Render EuroOffice wrapped only in an OperatorContext (no secrets backend). */
-function renderEuroOfficeWithContext(
-  operators_: any[],
-  props: Record<string, unknown>
-): r8sElement {
-  return jsx(OperatorContext.Provider, {
-    value: operators_,
-    children: jsx(EuroOffice, {
-      objectStorage,
-      secretsName: 'existing-secrets',
-      ...props,
-    } as never),
-  })
-}
-
-/** Render EuroOffice inside a Platform-like Namespace context (no explicit namespace prop). */
-function renderEuroOfficeInNamespace(
-  namespaceValue: string,
-  props: Record<string, unknown>
-): ReturnType<typeof render> {
-  return render(
-    jsx(Namespace.Provider, {
-      value: namespaceValue,
-      children: jsx(SecretContext.Provider, {
-        value: openbao as never,
-        children: jsx(EuroOffice, { objectStorage, ...props } as never),
-      }),
-    })
-  )
-}
-
-describe('operator declarations', () => {
-  it('declares the cnpg operator via the Database recipe', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com' })
-    expect(result.operators.some((op) => op.name === 'cnpg')).toBe(true)
-  })
-
-  it('adds no app-level operators beyond cnpg (Endpoint owns routing operators)', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com', conversions: true })
-    const names = result.operators.map((op) => op.name)
-    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
-    expect(names).not.toContain('redis-operator')
-  })
-
-  it('deduplicates operators provided via context', () => {
-    const result = render(
-      renderEuroOfficeWithContext([operators['cnpg']()], { host: 'docs.example.com' })
-    )
-    const names = result.operators.map((op) => op.name)
-    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
-  })
-
-  it('allows version overrides through context operators', () => {
-    const result = render(renderEuroOfficeWithContext([operators['cnpg']('1.24.0')], {}))
-    const cnpg = result.operators.filter((op) => op.name === 'cnpg')
-    expect(cnpg).toHaveLength(1)
-    expect(cnpg[0].version).toBe('1.24.0')
-  })
-})
-
-describe('rendering defaults', () => {
-  it('renders app deployment, service, database and endpoint', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('Deployment')
-    expect(kinds).toContain('Service')
-    expect(kinds).toContain('Ingress')
-    expect(kinds).toContain('Cluster')
-  })
-
-  it('adds LibreOffice conversion workers when conversions is set', () => {
-    const result = renderEuroOffice({
-      host: 'docs.example.com',
-      conversions: true,
-      conversionWorkers: 2,
-    })
-    const deployments = result.resources.filter((r) => r.kind === 'Deployment')
-    const soffice = deployments.find((d: any) => d.metadata.name === 'eurooffice-soffice') as any
-    expect(soffice).toBeDefined()
-    expect(soffice.spec.replicas).toBe(2)
-    expect(soffice.spec.template.spec.containers[0].command).toContain(
-      '--accept=socket,host=0.0.0.0,port=2002;urp;'
-    )
-    const services = result.resources.filter((r) => r.kind === 'Service')
-    expect(services.some((s: any) => s.metadata.name === 'eurooffice-soffice')).toBe(true)
-  })
-
-  it('probes the soffice workers on the UNO TCP socket (not HTTP)', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com', conversions: true })
-    const soffice = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice-soffice'
-    ) as any
-    const container = soffice.spec.template.spec.containers[0]
-    expect(container.livenessProbe.tcpSocket).toEqual({ port: 2002 })
-    expect(container.readinessProbe.tcpSocket).toEqual({ port: 2002 })
-    expect(container.readinessProbe.initialDelaySeconds).toBe(20)
-    expect(container.livenessProbe.httpGet).toBeUndefined()
-    expect(container.readinessProbe.httpGet).toBeUndefined()
-  })
-
-  it('does not render conversion workers by default', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com' })
-    const deployments = result.resources
-      .filter((r) => r.kind === 'Deployment')
-      .map((d: any) => d.metadata.name)
-    expect(deployments).not.toContain('eurooffice-soffice')
-  })
-
-  it('defaults app replicas to 1 when websockets are enabled (no session affinity)', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com' })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    expect(app.spec.replicas).toBe(1)
-  })
-
-  it('defaults app replicas to 2 when websockets are disabled', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com', websockets: false })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    expect(app.spec.replicas).toBe(2)
-  })
-
-  it('renders explicit replicas with websockets enabled (caller opts into sticky sessions)', () => {
-    const result = renderEuroOffice({
-      host: 'docs.example.com',
-      websockets: true,
-      replicas: 3,
-    })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    expect(app.spec.replicas).toBe(3)
-  })
-
-  it('enables websockets by default and allows disabling them', () => {
-    const on = renderEuroOffice({ host: 'docs.example.com' })
-    const appOn = on.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    const envOn = appOn.spec.template.spec.containers[0].env
-    expect(envOn.find((e: any) => e.name === 'WEBSOCKETS_ENABLED').value).toBe('true')
-
-    const off = renderEuroOffice({ host: 'docs.example.com', websockets: false })
-    const appOff = off.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    const envOff = appOff.spec.template.spec.containers[0].env
-    expect(envOff.find((e: any) => e.name === 'WEBSOCKETS_ENABLED').value).toBe('false')
-  })
-
-  it('renders gateway resources when platform uses gateway routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'gateway', gatewayClassName: 'eg' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(EuroOffice, { objectStorage, host: 'docs.example.com' } as never),
-        }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('HTTPRoute')
-  })
-
-  it('renders a valid Ingress when platform uses ingress routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'ingress' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(EuroOffice, { objectStorage, host: 'docs.example.com' } as never),
-        }),
-      })
-    )
-    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
-    expect(ingress).toBeDefined()
-    expect(ingress.spec.rules[0].host).toBe('docs.example.com')
-  })
-
-  it('passes resource validation', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com', conversions: true })
-    for (const resource of result.resources) {
-      expect(validateResource(resource)).toEqual([])
-    }
-  })
-})
-
-describe('namespace inheritance', () => {
-  it('inherits namespace from the Platform context when namespace prop is not set', () => {
-    const result = renderEuroOfficeInNamespace('docs', { host: 'docs.example.com' })
-    for (const kind of ['Deployment', 'Service', 'Cluster', 'Ingress']) {
-      const resource = result.resources.find((r: any) => r.kind === kind)
-      expect(resource).toBeDefined()
-      expect(resource.metadata.namespace).toBe('docs')
-    }
-  })
-
-  it('explicit namespace prop wins over the Platform context', () => {
-    const result = renderEuroOfficeInNamespace('docs', {
-      host: 'docs.example.com',
-      namespace: 'collab',
-    })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    expect(app.metadata.namespace).toBe('collab')
-  })
-
-  it('falls back to default when no Platform namespace is present', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com' })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    expect(app.metadata.namespace).toBe('default')
-  })
-})
-
-describe('rendering with all props', () => {
-  it('accepts the full prop surface', () => {
-    const result = renderEuroOffice({
-      name: 'docs',
-      namespace: 'docs',
-      version: '1.2.0',
-      host: 'docs.example.com',
-      replicas: 3,
-      websockets: false,
-      smtp: { host: 'smtp.example.com', port: 465, from: 'no-reply@docs.example.com' },
-      conversions: true,
-      conversionWorkers: 4,
-      objectStorage: {
-        endpoint: 'https://s3.internal.example.com',
-        bucket: 'docs-blobs',
-        credentialsSecret: 'docs-blobs-credentials',
-        region: 'eu-north-1',
-      },
-      resources: {
-        requests: { memory: '1Gi', cpu: '500m' },
-        limits: { memory: '4Gi', cpu: '2000m' },
-      },
-      tls: { secretName: 'docs-tls', clusterIssuer: 'letsencrypt-prod' },
-    })
-    expect(result.resources.length).toBeGreaterThan(0)
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'docs'
-    ) as any
-    expect(app.spec.template.spec.containers[0].image).toBe('ghcr.io/berget-ai/eurooffice:1.2.0')
-    expect(app.spec.replicas).toBe(3)
-    expect(app.spec.template.spec.containers[0].resources.limits.memory).toBe('4Gi')
-    const env = app.spec.template.spec.containers[0].env
-    expect(env.find((e: any) => e.name === 'WEBSOCKETS_ENABLED').value).toBe('false')
-    expect(env.find((e: any) => e.name === 'SMTP_HOST').value).toBe('smtp.example.com')
-    expect(env.find((e: any) => e.name === 'SMTP_PORT').value).toBe('465')
-    expect(env.find((e: any) => e.name === 'SMTP_FROM').value).toBe('no-reply@docs.example.com')
-    expect(env.find((e: any) => e.name === 'AWS_REGION').value).toBe('eu-north-1')
-    expect(env.find((e: any) => e.name === 'SOFFICE_HOST').value).toBe('docs-soffice')
-
-    const soffice = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'docs-soffice'
-    ) as any
-    expect(soffice.spec.template.spec.containers[0].image).toBe(
-      'ghcr.io/berget-ai/eurooffice:1.2.0'
-    )
-    expect(soffice.spec.replicas).toBe(4)
-  })
-})
-
-describe('secrets handling', () => {
-  it('accepts an explicit secretsName without a backend', () => {
-    expect(() =>
-      render(
-        jsx(EuroOffice, {
-          host: 'docs.example.com',
-          objectStorage,
-          secretsName: 'existing-secrets',
-        } as never)
-      )
-    ).not.toThrow()
-
-    const result = render(
-      jsx(EuroOffice, {
-        host: 'docs.example.com',
-        objectStorage,
-        secretsName: 'existing-secrets',
-      } as never)
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).not.toContain('OpenBaoStaticSecret')
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    const env = app.spec.template.spec.containers[0].env
-    const appSecret = env.find((e: any) => e.name === 'APP_SECRET')
-    expect(appSecret.valueFrom.secretKeyRef.name).toBe('existing-secrets')
-    expect(appSecret.valueFrom.secretKeyRef.key).toBe('secretKey')
-  })
-
-  it('provisions the app secrets bundle through a secrets backend', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com' })
-    const secretCr = result.resources.find((r) => r.kind === 'OpenBaoStaticSecret') as any
-    expect(secretCr).toBeDefined()
-    expect(secretCr.metadata.name).toBe('eurooffice-secrets')
-    expect(secretCr.spec.destination.name).toBe('eurooffice-secrets')
-    expect(secretCr.spec.path).toBe('test/eurooffice/secrets')
-  })
-
-  it('provisions the app secrets bundle through Vault', () => {
-    const result = render(
-      jsx(SecretContext.Provider, {
-        value: { backend: 'vault', mount: 'kv', path: 'apps' },
-        children: jsx(EuroOffice, { objectStorage, host: 'docs.example.com' } as never),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('VaultStaticSecret')
-    const secretCr = result.resources.find((r) => r.kind === 'VaultStaticSecret') as any
-    expect(secretCr.spec.path).toBe('apps/eurooffice/secrets')
-  })
-
-  it('wires credentials via secretKeyRef (never plaintext env)', () => {
-    const result = renderEuroOffice({
-      host: 'docs.example.com',
-      smtp: { host: 'smtp.example.com' },
-    })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    const env = app.spec.template.spec.containers[0].env
-    const smtpPassword = env.find((e: any) => e.name === 'SMTP_PASSWORD')
-    const appSecret = env.find((e: any) => e.name === 'APP_SECRET')
-    const accessKey = env.find((e: any) => e.name === 'AWS_ACCESS_KEY_ID')
-    const secretAccessKey = env.find((e: any) => e.name === 'AWS_SECRET_ACCESS_KEY')
-    expect(smtpPassword.valueFrom.secretKeyRef.name).toBe('eurooffice-secrets')
-    expect(smtpPassword.valueFrom.secretKeyRef.key).toBe('smtpPassword')
-    expect(appSecret.valueFrom.secretKeyRef.name).toBe('eurooffice-secrets')
-    expect(appSecret.valueFrom.secretKeyRef.key).toBe('secretKey')
-    expect(accessKey.valueFrom.secretKeyRef.name).toBe('docs-blobs-credentials')
-    expect(accessKey.valueFrom.secretKeyRef.key).toBe('accessKey')
-    expect(secretAccessKey.valueFrom.secretKeyRef.name).toBe('docs-blobs-credentials')
-    expect(secretAccessKey.valueFrom.secretKeyRef.key).toBe('secretKey')
-    expect(smtpPassword.value).toBeUndefined()
-    expect(appSecret.value).toBeUndefined()
-    expect(accessKey.value).toBeUndefined()
-    expect(secretAccessKey.value).toBeUndefined()
-  })
-
-  it('auto-wires DATABASE_URL from the DatabaseContext (no manual connection string)', () => {
-    const result = renderEuroOffice({ host: 'docs.example.com' })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'eurooffice'
-    ) as any
-    const env = app.spec.template.spec.containers[0].env
-    const databaseUrl = env.find((e: any) => e.name === 'DATABASE_URL')
-    expect(databaseUrl.value).toBe(
-      'postgresql://$(PGUSER):$(PGPASSWORD)@$(PGHOST):$(PGPORT)/$(PGDATABASE)'
-    )
-    const dbPassword = env.find((e: any) => e.name === 'PGPASSWORD')
-    expect(dbPassword.valueFrom.secretKeyRef.name).toBe('eurooffice-db-credentials')
-    expect(dbPassword.value).toBeUndefined()
-  })
-
-  it('renders no plaintext credentials anywhere', () => {
-    const result = renderEuroOffice({
-      host: 'docs.example.com',
-      smtp: { host: 'smtp.example.com', port: 587, from: 'no-reply@docs.example.com' },
-      conversions: true,
-      conversionWorkers: 2,
-    })
-    const { passed, errors } = runGuardrails(result.resources as any[], [noPlaintextSecrets])
-    if (!passed) {
-      console.error('Plaintext credential violations:', errors)
-    }
-    expect(passed).toBe(true)
-  })
-})
-
-describe('validation errors', () => {
-  it('throws when no secrets backend and no secrets name', () => {
-    expect(() =>
-      render(jsx(EuroOffice, { host: 'docs.example.com', objectStorage } as never))
-    ).toThrow(/application secrets/)
-  })
-
-  it('throws for unknown secrets backends', () => {
-    expect(() =>
-      render(
-        jsx(SecretContext.Provider, {
-          value: { backend: 'unknown' as never },
-          children: jsx(EuroOffice, { objectStorage, host: 'docs.example.com' } as never),
-        })
-      )
-    ).toThrow(/application secrets/)
-  })
-})

package/examples/basic.tsx

@@ -1,17 +0,0 @@
-import { Platform } from '@r8s/recipes'
-import { EuroOffice } from '@r8s/eurooffice'
-
-export default (
-  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
-    <EuroOffice
-      name="docs"
-      host="docs.example.com"
-      objectStorage={{
-        endpoint: 'https://s3.internal.example.com',
-        bucket: 'docs-blobs',
-        credentialsSecret: 'docs-blobs-credentials',
-      }}
-      smtp={{ host: 'smtp.example.com', port: 587, from: 'no-reply@${env:MAIL_DOMAIN}' }}
-    />
-  </Platform>
-)

package/src/index.tsx

@@ -1,324 +0,0 @@
-import { jsx, Fragment, useContext } from '@r8s/core'
-import { Namespace, SecretContext } from '@r8s/core/defaults'
-import { Database, WebService, Endpoint } from '@r8s/recipes'
-import type { SecretRef } from '@r8s/recipes'
-
-export interface EuroOfficeProps {
-  /** Resource name (defaults to 'eurooffice') */
-  name?: string
-  /** Kubernetes namespace (defaults to 'default') */
-  namespace?: string
-  /** Container image tag (defaults to 'latest' — pin a version in production) */
-  version?: string
-  /** Public hostname for the document suite (required) */
-  host: string
-  /**
-   * Number of app replicas.
-   *
-   * With `websockets` enabled (the default) this defaults to **1**:
-   * websocket sessions are pinned to the pod that accepted the
-   * connection and the workload has no session affinity, so >1 replicas
-   * means collaborators on different pods stop seeing each other live.
-   * An explicitly set `replicas` is rendered as asked — pair it with a
-   * sticky-session (source-IP) ingress strategy for live co-editing.
-   * With `websockets: false` the default is 2 (the app is stateless —
-   * scale freely).
-   */
-  replicas?: number
-  /**
-   * Collaborative editing over websockets (default: true). Disable only
-   * for single-user or read-only deployments — document presence,
-   * cursor sharing and live co-editing all rely on websockets.
-   */
-  websockets?: boolean
-  /**
-   * S3-compatible object storage for document blobs and attachments
-   * (RustFS in the platform). Required — reference a bucket whose
-   * credentials live in a Secret provisioned by the secrets backend
-   * (keys: accessKey, secretKey) — never plaintext.
-   */
-  objectStorage: {
-    /** S3 endpoint URL, e.g. https://s3.internal.example.com */
-    endpoint: string
-    /** Bucket name for document blobs */
-    bucket: string
-    /** Name of the Secret holding accessKey / secretKey */
-    credentialsSecret: string
-    /** Region string for the S3 client (defaults to 'us-east-1') */
-    region?: string
-  }
-  /**
-   * Outgoing SMTP for invitations and notifications. The SMTP password is
-   * delivered via secretKeyRef from the `${name}-secrets` bundle
-   * (key: smtpPassword) — never plaintext.
-   */
-  smtp?: {
-    /** SMTP server hostname, e.g. smtp.example.com */
-    host: string
-    /** SMTP port (defaults to 587) */
-    port?: number
-    /** From address for outgoing mail, e.g. no-reply@example.com */
-    from?: string
-  }
-  /**
-   * LibreOffice headless document-conversion workers (same app image,
-   * which must include soffice). Adds a `${name}-soffice` Deployment +
-   * Service; the app reaches it at SOFFICE_HOST:SOFFICE_PORT. Workers
-   * serve the UNO socket (TCP), not HTTP — their probes probe the socket.
-   */
-  conversions?: boolean
-  /** LibreOffice conversion worker replicas (defaults to 1, only used with conversions) */
-  conversionWorkers?: number
-  /**
-   * Name of an existing Secret holding `secretKey` and `smtpPassword`.
-   * Required unless a secrets backend (openbao/vault) is configured on
-   * the surrounding Platform — the backend then provisions them.
-   * Plaintext values are not supported.
-   */
-  secretsName?: string
-  /** Requested app resources */
-  resources?: {
-    requests?: { cpu?: string; memory?: string }
-    limits?: { cpu?: string; memory?: string }
-  }
-  /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
-  tls?: {
-    secretName: string
-    clusterIssuer: string
-  }
-}
-
-/**
- * EuroOffice — collaborative document suite.
- *
- * @title EuroOffice
- * @category Productivity & Documents
- *
- * Composes:
- * - CNPG Postgres cluster (documents, revisions, users; DATABASE_URL is
- *   auto-wired from the DatabaseContext — no manual connection string)
- * - EuroOffice Deployment + Service + Endpoint (websockets enabled by
- *   default for live co-editing)
- * - Required S3/RustFS object storage for document blobs
- * - Optional LibreOffice headless conversion workers (same image; probed
- *   on their UNO TCP socket)
- * - Optional SMTP delivery; password via the `${name}-secrets` bundle
- * - APP_SECRET (and SMTP_PASSWORD) provisioned through the Platform
- *   secrets backend (openbao / vault), or referenced from an existing
- *   Secret via `secretsName`
- *
- * The namespace is inherited from the surrounding `<Platform>` (via the
- * Namespace context) unless set explicitly.
- *
- * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
- * the app secrets bundle is provisioned for you. Without a backend you
- * must point `secretsName` at a pre-created Secret.
- *
- * @example
- * import { Platform } from '@r8s/recipes'
- * import { EuroOffice } from '@r8s/eurooffice'
- *
- * export default (
- *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
- *     <EuroOffice
- *       name="docs"
- *       host="docs.example.com"
- *       objectStorage={{
- *         endpoint: 'https://s3.internal.example.com',
- *         bucket: 'docs-blobs',
- *         credentialsSecret: 'docs-blobs-credentials',
- *       }}
- *       smtp={{ host: 'smtp.example.com', port: 587, from: 'no-reply@${env:MAIL_DOMAIN}' }}
- *     />
- *   </Platform>
- * )
- */
-export function EuroOffice(props: EuroOfficeProps) {
-  const {
-    name = 'eurooffice',
-    namespace: namespaceProp,
-    version = 'latest',
-    host,
-    replicas: replicasProp,
-    websockets = true,
-    objectStorage,
-    smtp,
-    conversions = false,
-    conversionWorkers = 1,
-    secretsName,
-    resources = {
-      requests: { memory: '512Mi', cpu: '250m' },
-      limits: { memory: '2Gi', cpu: '1000m' },
-    },
-    tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' },
-  } = props
-
-  // Inherit namespace from <Platform> context if not explicitly set
-  const contextNamespace = useContext(Namespace)
-  const namespace =
-    namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default'
-
-  // Live co-editing runs over websockets pinned to a single pod (no session
-  // affinity) — default to 1 replica unless the caller explicitly scales.
-  const replicas = replicasProp ?? (websockets ? 1 : 2)
-
-  const secretProvider = useContext(SecretContext)
-  const resources_: ReturnType<typeof jsx>[] = []
-
-  const platformSecretsName = secretsName ?? `${name}-secrets`
-
-  // --- App secrets (APP_SECRET / SMTP_PASSWORD) -----------------------------
-  // The app secret signs sessions and collaborator tokens — never render
-  // it as plaintext. With a secrets backend the bundle is provisioned
-  // through the backend (keys: secretKey, smtpPassword); otherwise
-  // reference a pre-created Secret.
-  if (!secretsName) {
-    if (
-      !secretProvider ||
-      (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')
-    ) {
-      throw new Error(
-        `EuroOffice "${name}" requires application secrets (APP_SECRET, SMTP_PASSWORD).\n` +
-          `\n` +
-          `The app secret signs sessions and collaborator tokens — it must ` +
-          `not be rendered as plaintext.\n` +
-          `\n` +
-          `Fix: configure a secrets backend on the Platform:\n` +
-          `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
-          `    <EuroOffice name="${name}" host="${host}" />\n` +
-          `  </Platform>\n` +
-          `\n` +
-          `Or reference a pre-created Secret (keys: secretKey, smtpPassword):\n` +
-          `  <EuroOffice name="${name}" host="${host}" secretsName="${name}-secrets" />`
-      )
-    }
-
-    const spec = {
-      ...(secretProvider.backend === 'vault'
-        ? { vaultAuthRef: secretProvider.authRef }
-        : { openbaoAuthRef: secretProvider.authRef }),
-      mount: secretProvider.mount,
-      type: 'kv-v2' as const,
-      path: `${secretProvider.path ?? name}/${name}/secrets`,
-      destination: { create: true, name: platformSecretsName },
-    }
-    resources_.push(
-      secretProvider.backend === 'vault'
-        ? jsx('VaultStaticSecret', {
-            apiVersion: 'secrets.hashicorp.com/v1beta1',
-            kind: 'VaultStaticSecret',
-            metadata: { name: `${name}-secrets`, namespace },
-            spec,
-          })
-        : jsx('OpenBaoStaticSecret', {
-            apiVersion: 'secrets.openbao.org/v1beta1',
-            kind: 'OpenBaoStaticSecret',
-            metadata: { name: `${name}-secrets`, namespace },
-            spec,
-          })
-    )
-  }
-
-  // --- Env wiring -------------------------------------------------------------
-  // Every credential is delivered via secretKeyRef — no plaintext in the
-  // manifest. DATABASE_URL is auto-wired by WebService from the
-  // DatabaseContext (PG* vars + $(VAR) template), so it is not declared here.
-  const env: Record<string, string> = {
-    PORT: '3000',
-    APP_URL: `https://${host}`,
-    WEBSOCKETS_ENABLED: websockets ? 'true' : 'false',
-    AWS_REGION: objectStorage.region ?? 'us-east-1',
-    AWS_S3_UPLOAD_BUCKET_URL: `${objectStorage.endpoint}/${objectStorage.bucket}`,
-    AWS_S3_UPLOAD_BUCKET_NAME: objectStorage.bucket,
-    AWS_S3_ENDPOINT: objectStorage.endpoint,
-    AWS_S3_FORCE_PATH_STYLE: 'true',
-    ...(smtp
-      ? {
-          SMTP_HOST: smtp.host,
-          SMTP_PORT: String(smtp.port ?? 587),
-          ...(smtp.from && { SMTP_FROM: smtp.from }),
-        }
-      : {}),
-    ...(conversions
-      ? {
-          SOFFICE_HOST: `${name}-soffice`,
-          SOFFICE_PORT: '2002',
-        }
-      : {}),
-  }
-
-  // Credentials delivered via secretKeyRef (runtime injection)
-  const secrets: Record<string, SecretRef | string> = {
-    APP_SECRET: { secret: platformSecretsName, key: 'secretKey' },
-    ...(smtp
-      ? { SMTP_PASSWORD: { secret: platformSecretsName, key: 'smtpPassword' as const } }
-      : {}),
-    AWS_ACCESS_KEY_ID: { secret: objectStorage.credentialsSecret, key: 'accessKey' },
-    AWS_SECRET_ACCESS_KEY: { secret: objectStorage.credentialsSecret, key: 'secretKey' },
-  }
-
-  // --- Database + app + conversions + endpoint --------------------------------
-  // Database wraps the app so credentials stay consistent with the r8s
-  // Database recipe (CNPG dedicated cluster provisions the secret) and
-  // WebService auto-wires DATABASE_URL from the DatabaseContext.
-  resources_.push(
-    jsx(Database, {
-      name,
-      namespace,
-      storage: '10Gi',
-      children: (
-        <WebService
-          name={name}
-          namespace={namespace}
-          image={`ghcr.io/berget-ai/eurooffice:${version}`}
-          port={3000}
-          replicas={replicas}
-          resources={resources}
-          env={env}
-          secrets={secrets}
-        />
-      ),
-    })
-  )
-
-  // LibreOffice headless conversion workers — same app image (must include
-  // soffice), listening for UNO socket connections. The workers know HTTP
-  // health endpoints no better than we do, so probe the UNO TCP socket
-  // directly (httpGet /health would crash-loop them).
-  if (conversions) {
-    resources_.push(
-      <WebService
-        name={`${name}-soffice`}
-        namespace={namespace}
-        image={`ghcr.io/berget-ai/eurooffice:${version}`}
-        port={2002}
-        replicas={conversionWorkers}
-        command={[
-          'soffice',
-          '--headless',
-          '--norestore',
-          '--accept=socket,host=0.0.0.0,port=2002;urp;',
-        ]}
-        env={{ SOFFICE_MODE: 'worker' }}
-        probes={{
-          liveness: { tcp: true, port: 2002 },
-          readiness: { tcp: true, port: 2002, initialDelaySeconds: 20 },
-        }}
-      />
-    )
-  }
-
-  // --- Endpoint — collaborative editing shares the app host -------------------
-  resources_.push(
-    <Endpoint
-      name={`${name}-endpoint`}
-      namespace={namespace}
-      host={host}
-      serviceName={name}
-      servicePort={3000}
-      tls={tls}
-    />
-  )
-
-  return jsx(Fragment, { children: resources_ })
-}

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": true
-  },
-  "include": ["src/**/*"],
-  "references": [
-    { "path": "../core" },
-    { "path": "../k8s-types" },
-    { "path": "../crds" },
-    { "path": "../recipes" }
-  ]
-}