@r8s/n8n 0.2.0 → 0.2.1

package/dist/index.d.ts

@@ -0,0 +1,129 @@
+import { type DatabaseProps } from '@r8s/recipes';
+export interface N8nProps {
+    /** Resource name (defaults to 'n8n') */
+    name?: string;
+    /** Kubernetes namespace (inherited from Platform context when omitted) */
+    namespace?: string;
+    /**
+     * Container image tag (defaults to a pinned release — see
+     * https://github.com/n8n-io/n8n/releases when upgrading). Use 'latest'
+     * only for throwaway environments.
+     */
+    version?: string;
+    /** Public hostname for the editor and webhooks (required) */
+    host: string;
+    /** Number of editor replicas when not running in queue mode (defaults to 1) */
+    replicas?: number;
+    /**
+     * Redis-backed queue mode. Adds a Redis master/replica set and a worker
+     * Deployment so webhook ingestion and heavy executions scale independently.
+     */
+    queueMode?: boolean;
+    /** Queue worker replicas (defaults to 2, only used with queueMode) */
+    workers?: number;
+    /** Storage request for the CNPG Postgres cluster (defaults to '10Gi') */
+    storage?: string;
+    /**
+     * Persistent volume for `/home/node/.n8n` (workflow-local state).
+     * Pass a size string ('5Gi', the facit default) or an object for more
+     * control. When set: a RWO PVC is created, an initContainer fixes
+     * ownership (1000:1000), the rollout strategy becomes Recreate, and
+     * binary data is stored on the filesystem instead of Postgres.
+     */
+    dataStorage?: string | {
+        size?: string;
+        storageClass?: string;
+    };
+    /**
+     * CNPG backup configuration passed through to the Database recipe
+     * (continuous WAL archiving + scheduled base backups).
+     */
+    backup?: DatabaseProps['backup'];
+    /**
+     * Number of trusted proxy hops for client IP / rate limiting
+     * (N8N_PROXY_HOPS). Defaults to 1 — trust the ingress one hop.
+     */
+    proxyHops?: number;
+    /**
+     * Execution-data pruning (EXECUTIONS_DATA_PRUNE /
+     * EXECUTIONS_DATA_MAX_AGE). Defaults to pruning data older than
+     * 168 h (7 days). Set to false to disable.
+     */
+    pruning?: {
+        maxAgeHours?: number;
+    } | false;
+    /**
+     * Opt-in value for NODE_FUNCTION_ALLOW_BUILTIN (e.g. '*'). Deliberately
+     * unset by default: granting workflows access to every builtin Node.js
+     * module is a security-sensitive choice.
+     */
+    allowBuiltinNodeFunctions?: string;
+    /**
+     * Tune the backend-provisioned encryption secret: vault path, key name,
+     * and refresh/restart behaviour (default: refreshAfter '1h', restarts
+     * the editor + workers on rotation).
+     */
+    encryptionSecret?: {
+        path?: string;
+        key?: string;
+        refreshAfter?: string;
+        rolloutRestartTargets?: string[];
+    };
+    /** Extra annotations merged onto the Endpoint's IngressRoute/Ingress */
+    endpointAnnotations?: Record<string, string>;
+    /**
+     * Name of an existing Secret containing key `encryptionKey`. n8n
+     * encrypts all workflow credentials with this key — lose it and every
+     * stored credential is unreadable.
+     *
+     * Required unless a secrets backend (openbao/vault) is configured on
+     * the surrounding Platform — the backend then provisions the key
+     * automatically. Plaintext keys are not supported.
+     */
+    encryptionKeySecretName?: string;
+    /** Requested editor resources */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+    /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * n8n — fair-code workflow automation.
+ *
+ * @title N8n
+ * @category Automation
+ *
+ * Composes:
+ * - CNPG Postgres cluster (workflows, executions, stored credentials)
+ * - n8n editor Deployment + Service + Endpoint (webhooks share the host)
+ * - Redis cluster + worker Deployment in queue mode
+ * - Encryption key provisioned through the Platform secrets backend
+ *   (openbao / vault), or referenced from an existing Secret
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the N8N_ENCRYPTION_KEY is provisioned for you. Without a backend you
+ * must point `encryptionKeySecretName` at a pre-created Secret.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { N8n } from '@r8s/n8n'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <N8n name="n8n" host="n8n.example.com" queueMode workers={3} />
+ *   </Platform>
+ * )
+ */
+export declare function N8n(props: N8nProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAA;AAGrB,MAAM,WAAW,QAAQ;IACvB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;IAC1C;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QACjB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;KACjC,CAAA;IACD,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5C;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iCAAiC;IACjC,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,sEAAsE;IACtE,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,kCAkQlC"}

package/dist/index.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.N8n = N8n;
+const jsx_runtime_1 = require("@r8s/core/jsx-runtime");
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+const redis_1 = require("@r8s/crds/redis");
+/**
+ * n8n — fair-code workflow automation.
+ *
+ * @title N8n
+ * @category Automation
+ *
+ * Composes:
+ * - CNPG Postgres cluster (workflows, executions, stored credentials)
+ * - n8n editor Deployment + Service + Endpoint (webhooks share the host)
+ * - Redis cluster + worker Deployment in queue mode
+ * - Encryption key provisioned through the Platform secrets backend
+ *   (openbao / vault), or referenced from an existing Secret
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the N8N_ENCRYPTION_KEY is provisioned for you. Without a backend you
+ * must point `encryptionKeySecretName` at a pre-created Secret.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { N8n } from '@r8s/n8n'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <N8n name="n8n" host="n8n.example.com" queueMode workers={3} />
+ *   </Platform>
+ * )
+ */
+function N8n(props) {
+    const { name = 'n8n', namespace: namespaceProp, version = '2.35.5', host, replicas = 1, queueMode = false, workers = 2, storage = '10Gi', dataStorage, backup, proxyHops = 1, pruning = { maxAgeHours: 168 }, allowBuiltinNodeFunctions, encryptionSecret, endpointAnnotations = {}, encryptionKeySecretName, resources = {
+        requests: { memory: '512Mi', cpu: '100m' },
+        limits: { memory: '1Gi', cpu: '1000m' },
+    }, tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const sharedOperators = (0, recipes_1.useOperators)();
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const resources_ = [];
+    const dbCredentialsName = `${name}-db-credentials`;
+    const encryptionSecretName = encryptionKeySecretName ?? `${name}-encryption-key`;
+    const encryptionKeyDestKey = encryptionSecret?.key ?? 'encryptionKey';
+    // --- Secret provisioning -------------------------------------------------
+    // The encryption key is the crown jewel of an n8n install — never render
+    // it as plaintext. With a secrets backend it is provisioned through the
+    // backend (key `encryptionKey`); otherwise reference a pre-created Secret.
+    if (!encryptionKeySecretName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('N8n', name, 'an encryption key — n8n encrypts all workflow credentials with N8N_ENCRYPTION_KEY', {
+                propName: 'encryptionKeySecretName',
+                exampleValue: `${name}-encryption-key`,
+                keys: ['encryptionKey'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-encryption`,
+            namespace,
+            path: encryptionSecret?.path ?? `${secretProvider.path ?? name}/${name}/encryption`,
+            secretName: encryptionSecretName,
+            refreshAfter: encryptionSecret?.refreshAfter,
+            keys: { [encryptionKeyDestKey]: encryptionKeyDestKey },
+            // Rotate-in-place: restart pods on key changes so editors re-read
+            // the key (stale keys break credential decryption silently)
+            restart: encryptionSecret?.rolloutRestartTargets ?? [
+                { kind: 'Deployment', name },
+                ...(queueMode ? [{ kind: 'Deployment', name: `${name}-worker` }] : []),
+            ],
+        }));
+    }
+    // --- Operators ------------------------------------------------------------
+    if (queueMode) {
+        resources_.push(...(0, recipes_1.maybeOperator)('redis-operator', sharedOperators));
+    }
+    // --- Database (CNPG) — workflows, executions, stored credentials ----------
+    const dbHost = `${name}-rw`;
+    const dataVolumeName = `${name}-data`;
+    const dataVolumeDef = dataStorage
+        ? [{ name: dataVolumeName, persistentVolumeClaim: { claimName: dataVolumeName } }]
+        : [];
+    const dataInitContainer = {
+        name: 'fix-data-permissions',
+        image: 'busybox:1.36',
+        command: ['sh', '-c', 'chown -R 1000:1000 /data'],
+        volumeMounts: [{ name: dataVolumeName, mountPath: '/data' }],
+    };
+    if (dataStorage) {
+        const size = typeof dataStorage === 'string' ? dataStorage : (dataStorage.size ?? '5Gi');
+        const storageClass = typeof dataStorage === 'object' ? dataStorage.storageClass : undefined;
+        resources_.push((0, core_1.jsx)('PersistentVolumeClaim', {
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: { name: dataVolumeName, namespace },
+            spec: {
+                accessModes: ['ReadWriteOnce'],
+                ...(storageClass ? { storageClassName: storageClass } : {}),
+                resources: { requests: { storage: size } },
+            },
+        }));
+    }
+    const sharedEnv = {
+        DB_TYPE: 'postgresdb',
+        DB_POSTGRESDB_HOST: dbHost,
+        DB_POSTGRESDB_PORT: '5432',
+        DB_POSTGRESDB_DATABASE: name,
+        DB_POSTGRESDB_USER: name,
+        N8N_HOST: host,
+        N8N_PORT: '5678',
+        N8N_PROTOCOL: 'https',
+        WEBHOOK_URL: `https://${host}/`,
+        // Trust the ingress (Endpoint/TLS) for client IPs/rate limiting
+        N8N_PROXY_HOPS: String(proxyHops),
+        // Binary data in Postgres for queue mode (shared across editor+workers);
+        // filesystem when a data volume exists; Postgres otherwise (no volume
+        // means /home/node/.n8n is ephemeral)
+        N8N_DEFAULT_BINARY_DATA_MODE: queueMode ? 'default' : dataStorage ? 'filesystem' : 'default',
+        ...(pruning
+            ? {
+                EXECUTIONS_DATA_PRUNE: 'true',
+                EXECUTIONS_DATA_MAX_AGE: String(pruning.maxAgeHours ?? 168),
+            }
+            : {}),
+        ...(allowBuiltinNodeFunctions
+            ? { NODE_FUNCTION_ALLOW_BUILTIN: allowBuiltinNodeFunctions }
+            : {}),
+    };
+    const sharedSecrets = {
+        DB_POSTGRESDB_PASSWORD: { secret: dbCredentialsName, key: 'password' },
+        N8N_ENCRYPTION_KEY: { secret: encryptionSecretName, key: encryptionKeyDestKey },
+    };
+    if (queueMode) {
+        Object.assign(sharedEnv, {
+            EXECUTIONS_MODE: 'queue',
+            QUEUE_BULL_REDIS_HOST: `${name}-redis`,
+            QUEUE_BULL_REDIS_PORT: '6379',
+        });
+    }
+    if (!queueMode && replicas > 1) {
+        throw new Error(`N8n "${name}" requested replicas={${replicas}} without queue mode.\n` +
+            `\n` +
+            `Multiple main instances without Redis queue mode run every trigger ` +
+            `execution once per replica (duplicated webhooks and schedules).\n` +
+            `\n` +
+            `Fix: enable queue mode:\n` +
+            `  <N8n name="${name}" host="${host}" queueMode workers={${replicas}} />\n` +
+            `\n` +
+            `Or keep a single main instance (workers handle executions in queue mode).`);
+    }
+    // Database wraps the editor so credentials stay consistent with the
+    // r8s Database recipe (CNPG dedicated cluster provisions the secret).
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        name,
+        namespace,
+        storage,
+        ...(backup ? { backup } : {}),
+        children: ((0, jsx_runtime_1.jsx)(recipes_1.WebService, { name: name, namespace: namespace, image: `docker.n8n.io/n8nio/n8n:${version}`, 
+            // Pinned tags are immutable — no need to re-pull on every start
+            imagePullPolicy: version === 'latest' ? 'Always' : 'IfNotPresent', port: 5678, replicas: queueMode ? 1 : replicas, resources: resources, 
+            // RWO volume + in-place DB migrations on boot roll → Recreate
+            strategy: dataStorage ? 'Recreate' : undefined, volumes: dataVolumeDef.length > 0 ? dataVolumeDef : undefined, volumeMounts: dataVolumeDef.length > 0
+                ? [{ name: dataVolumeName, mountPath: '/home/node/.n8n' }]
+                : undefined, initContainers: dataVolumeDef.length > 0 ? [dataInitContainer] : undefined, probes: {
+                // n8n boots slowly after code upgrades (DB migrations); facit
+                // probe timing keeps the pod alive through them
+                liveness: { path: '/healthz', initialDelaySeconds: 60, periodSeconds: 30 },
+                readiness: { path: '/healthz', initialDelaySeconds: 15, failureThreshold: 6 },
+            }, env: { ...sharedEnv, ...(queueMode ? {} : { N8N_CONCURRENCY_PRODUCTION_LIMIT: '10' }) }, secrets: sharedSecrets })),
+    }));
+    // --- Queue mode: Redis + workers ------------------------------------------
+    if (queueMode) {
+        // Bull (n8n's queue backend) speaks plain Redis protocol — use a
+        // master/replica topology, not a Redis cluster (no MOVED-safe client)
+        resources_.push((0, redis_1.RedisReplicationComponent)({
+            metadata: { name: `${name}-redis`, namespace },
+            spec: {
+                clusterSize: 3,
+                kubernetesConfig: { image: 'redis:7.2-alpine' },
+            },
+        }));
+        resources_.push((0, jsx_runtime_1.jsx)(recipes_1.WebService, { name: `${name}-worker`, namespace: namespace, image: `docker.n8n.io/n8nio/n8n:${version}`, imagePullPolicy: version === 'latest' ? 'Always' : 'IfNotPresent', port: 5678, replicas: workers, command: ['n8n', 'worker', '--concurrency=10'], resources: {
+                requests: { memory: '512Mi', cpu: '250m' },
+                limits: { memory: '2Gi', cpu: '2000m' },
+            }, probes: {
+                liveness: { path: '/healthz' },
+                readiness: { path: '/healthz', initialDelaySeconds: 20 },
+            }, env: { ...sharedEnv, QUEUE_HEALTH_CHECK_ACTIVE: 'true' }, secrets: sharedSecrets }));
+    }
+    // --- Endpoint — webhooks share the editor host -----------------------------
+    resources_.push((0, jsx_runtime_1.jsx)(recipes_1.Endpoint, { name: `${name}-endpoint`, namespace: namespace, host: host, serviceName: name, servicePort: 5678, tls: tls, annotations: {
+            // Long-lived webhook/queue connections (editor SSE, waiting webhooks)
+            // die at the default 60 s proxy timeout — facit sets one hour
+            'nginx.ingress.kubernetes.io/proxy-read-timeout': '3600',
+            'nginx.ingress.kubernetes.io/proxy-send-timeout': '3600',
+            ...endpointAnnotations,
+        } }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AAmIA,kBAkQC;;AArYD,oCAAqD;AACrD,iDAAgE;AAChE,0CAUqB;AACrB,2CAA2D;AA2F3D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,GAAG,CAAC,KAAe;IACjC,MAAM,EACJ,IAAI,GAAG,KAAK,EACZ,SAAS,EAAE,aAAa,EACxB,OAAO,GAAG,QAAQ,EAClB,IAAI,EACJ,QAAQ,GAAG,CAAC,EACZ,SAAS,GAAG,KAAK,EACjB,OAAO,GAAG,CAAC,EACX,OAAO,GAAG,MAAM,EAChB,WAAW,EACX,MAAM,EACN,SAAS,GAAG,CAAC,EACb,OAAO,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,EAC9B,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,GAAG,EAAE,EACxB,uBAAuB,EACvB,SAAS,GAAG;QACV,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;QAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;KACxC,EACD,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACvE,GAAG,KAAK,CAAA;IAET,MAAM,eAAe,GAAG,IAAA,sBAAY,GAAE,CAAA;IACtC,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,MAAM,iBAAiB,GAAG,GAAG,IAAI,iBAAiB,CAAA;IAClD,MAAM,oBAAoB,GAAG,uBAAuB,IAAI,GAAG,IAAI,iBAAiB,CAAA;IAEhF,MAAM,oBAAoB,GAAG,gBAAgB,EAAE,GAAG,IAAI,eAAe,CAAA;IAErE,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,KAAK,EACL,IAAI,EACJ,mFAAmF,EACnF;gBACE,QAAQ,EAAE,yBAAyB;gBACnC,YAAY,EAAE,GAAG,IAAI,iBAAiB;gBACtC,IAAI,EAAE,CAAC,eAAe,CAAC;aACxB,CACF,CAAA;QACH,CAAC;QAED,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,aAAa;YAC1B,SAAS;YACT,IAAI,EAAE,gBAAgB,EAAE,IAAI,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,aAAa;YACnF,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,gBAAgB,EAAE,YAAY;YAC5C,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,EAAE;YACtD,kEAAkE;YAClE,4DAA4D;YAC5D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,IAAI;gBAClD,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC5B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,SAAS,EAAE,CAAC;QACd,UAAU,CAAC,IAAI,CAAC,GAAG,IAAA,uBAAa,EAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAA;IACtE,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,CAAA;IAE3B,MAAM,cAAc,GAAG,GAAG,IAAI,OAAO,CAAA;IACrC,MAAM,aAAa,GAAG,WAAW;QAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC;QAClF,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,iBAAiB,GAAG;QACxB,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,0BAA0B,CAAC;QACjD,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;KAC7D,CAAA;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,CAAA;QACxF,MAAM,YAAY,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,uBAAuB,EAAE;YAC3B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE;YAC7C,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC,eAAe,CAAC;gBAC9B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;aAC3C;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAA2B;QACxC,OAAO,EAAE,YAAY;QACrB,kBAAkB,EAAE,MAAM;QAC1B,kBAAkB,EAAE,MAAM;QAC1B,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,OAAO;QACrB,WAAW,EAAE,WAAW,IAAI,GAAG;QAC/B,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,sCAAsC;QACtC,4BAA4B,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC5F,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,qBAAqB,EAAE,MAAM;gBAC7B,uBAAuB,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;aAC5D;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,yBAAyB;YAC3B,CAAC,CAAC,EAAE,2BAA2B,EAAE,yBAAyB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,MAAM,aAAa,GAAG;QACpB,sBAAsB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,UAAU,EAAE;QACtE,kBAAkB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE;KAChF,CAAA;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;YACvB,eAAe,EAAE,OAAO;YACxB,qBAAqB,EAAE,GAAG,IAAI,QAAQ;YACtC,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,QAAQ,IAAI,yBAAyB,QAAQ,yBAAyB;YACpE,IAAI;YACJ,qEAAqE;YACrE,mEAAmE;YACnE,IAAI;YACJ,2BAA2B;YAC3B,gBAAgB,IAAI,WAAW,IAAI,wBAAwB,QAAQ,QAAQ;YAC3E,IAAI;YACJ,2EAA2E,CAC9E,CAAA;IACH,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI;QACJ,SAAS;QACT,OAAO;QACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,QAAQ,EAAE,CACR,uBAAC,oBAAU,IACT,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,2BAA2B,OAAO,EAAE;YAC3C,gEAAgE;YAChE,eAAe,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,EACjE,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAClC,SAAS,EAAE,SAAS;YACpB,8DAA8D;YAC9D,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAC9C,OAAO,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAC7D,YAAY,EACV,aAAa,CAAC,MAAM,GAAG,CAAC;gBACtB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;gBAC1D,CAAC,CAAC,SAAS,EAEf,cAAc,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,EAC1E,MAAM,EAAE;gBACN,8DAA8D;gBAC9D,gDAAgD;gBAChD,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;gBAC1E,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;aAC9E,EACD,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,EAAE,EACvF,OAAO,EAAE,aAAa,GACtB,CACH;KACF,CAAC,CACH,CAAA;IAED,6EAA6E;IAC7E,IAAI,SAAS,EAAE,CAAC;QACd,iEAAiE;QACjE,sEAAsE;QACtE,UAAU,CAAC,IAAI,CACb,IAAA,iCAAyB,EAAC;YACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,QAAQ,EAAE,SAAS,EAAE;YAC9C,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC;gBACd,gBAAgB,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;aAChD;SACF,CAAC,CACH,CAAA;QAED,UAAU,CAAC,IAAI,CACb,uBAAC,oBAAU,IACT,IAAI,EAAE,GAAG,IAAI,SAAS,EACtB,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,2BAA2B,OAAO,EAAE,EAC3C,eAAe,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,EACjE,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,OAAO,EACjB,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAC9C,SAAS,EAAE;gBACT,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;aACxC,EACD,MAAM,EAAE;gBACN,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,EAAE;aACzD,EACD,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,yBAAyB,EAAE,MAAM,EAAE,EACxD,OAAO,EAAE,aAAa,GACtB,CACH,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,UAAU,CAAC,IAAI,CACb,uBAAC,kBAAQ,IACP,IAAI,EAAE,GAAG,IAAI,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,IAAI,EACjB,WAAW,EAAE,IAAI,EACjB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;YACX,sEAAsE;YACtE,8DAA8D;YAC9D,gDAAgD,EAAE,MAAM;YACxD,gDAAgD,EAAE,MAAM;YACxD,GAAG,mBAAmB;SACvB,GACD,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/n8n",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "n8n workflow automation — editor, Postgres persistence, Redis queue mode, webhook endpoints",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -37,5 +37,8 @@
   "devDependencies": {
     "typescript": "^5.3.0",
     "vitest": "^1.0.0"
-  }
+  },
+  "files": [
+    "dist"
+  ]
 }

package/__tests__/n8n.test.ts

@@ -1,267 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { render, jsx } from '@r8s/core'
-import { OperatorContext, SecretContext, RoutingContext } from '@r8s/core/defaults'
-import { runGuardrails, noPlaintextSecrets, validateResource } from '@r8s/core'
-import { operators } from '@r8s/crds'
-import type { r8sElement } from '@r8s/core'
-
-// N8n recipe tests:
-//   1. Operator declarations (deduped via OperatorContext)
-//   2. Rendering: defaults, all props, gateway/ingress adaptation
-//   3. Security: no plaintext credentials in rendered output
-import { N8n } from '../src/index'
-
-/** Render N8n inside a Platform-like secrets backend (OpenBao). */
-function renderN8n(props: Record<string, unknown>): ReturnType<typeof render> {
-  return render(
-    jsx(SecretContext.Provider, {
-      value: { backend: 'openbao', mount: 'kv', path: 'test' },
-      children: jsx(N8n, props as never),
-    })
-  )
-}
-
-/** Render N8n wrapped only in an OperatorContext (no secrets backend). */
-function renderN8nWithContext(operators_: any[], props: Record<string, unknown>): r8sElement {
-  return jsx(OperatorContext.Provider, {
-    value: operators_,
-    children: jsx(N8n, props as never),
-  })
-}
-
-const openbao = { backend: 'openbao', mount: 'kv', path: 'test' }
-
-describe('operator declarations', () => {
-  it('declares the redis operator when queue mode is enabled', () => {
-    const result = renderN8n({
-      host: 'n8n.example.com',
-      queueMode: true,
-      encryptionKeySecretName: 'enc',
-    })
-    expect(result.operators.some((op) => op.name === 'redis-operator')).toBe(true)
-  })
-
-  it('does not declare the redis operator without queue mode', () => {
-    const result = renderN8n({ host: 'n8n.example.com' })
-    expect(result.operators.some((op) => op.name === 'redis-operator')).toBe(false)
-  })
-
-  it('declares the cnpg operator via the Database recipe', () => {
-    const result = renderN8n({ host: 'n8n.example.com' })
-    expect(result.operators.some((op) => op.name === 'cnpg')).toBe(true)
-  })
-
-  it('deduplicates operators provided via context', () => {
-    const result = render(
-      renderN8nWithContext([operators['redis-operator'](), operators['cnpg']()], {
-        host: 'n8n.example.com',
-        encryptionKeySecretName: 'existing-encryption',
-      })
-    )
-    const names = result.operators.map((op) => op.name)
-    expect(names.filter((n) => n === 'redis-operator')).toHaveLength(1)
-    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
-  })
-
-  it('allows version overrides through context operators', () => {
-    const result = render(
-      renderN8nWithContext([operators['redis-operator']('1.0.0')], {
-        host: 'n8n.example.com',
-        queueMode: true,
-        encryptionKeySecretName: 'existing-encryption',
-      })
-    )
-    const redis = result.operators.filter((op) => op.name === 'redis-operator')
-    expect(redis).toHaveLength(1)
-    expect(redis[0].version).toBe('1.0.0')
-  })
-})
-
-describe('rendering defaults', () => {
-  it('renders editor deployment, service, database and endpoint', () => {
-    const result = renderN8n({ host: 'n8n.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('Deployment')
-    expect(kinds).toContain('Service')
-    expect(kinds).toContain('Ingress')
-    expect(kinds).toContain('Cluster')
-  })
-
-  it('renders queue mode with Redis and workers', () => {
-    const result = renderN8n({ host: 'n8n.example.com', queueMode: true, workers: 3 })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('RedisReplication')
-    const deployments = result.resources.filter((r) => r.kind === 'Deployment')
-    expect(deployments.map((d: any) => d.metadata.name)).toContain('n8n-worker')
-    expect(deployments.map((d: any) => d.metadata.name)).toContain('n8n')
-  })
-
-  it('wires the worker to the RedisReplication service and health checks', () => {
-    const result = renderN8n({ host: 'n8n.example.com', queueMode: true })
-    const worker = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'n8n-worker'
-    ) as any
-    const env = worker.spec.template.spec.containers[0].env
-    expect(env.find((e: any) => e.name === 'QUEUE_BULL_REDIS_HOST').value).toBe('n8n-redis')
-    expect(env.find((e: any) => e.name === 'QUEUE_HEALTH_CHECK_ACTIVE').value).toBe('true')
-    const probes = worker.spec.template.spec.containers[0]
-    expect(probes.livenessProbe.httpGet.path).toBe('/healthz')
-  })
-
-  it('throws on multiple editor replicas without queue mode', () => {
-    expect(() => renderN8n({ host: 'n8n.example.com', replicas: 3 })).toThrow(/queue mode/)
-  })
-
-  it('propagates the storage prop to the CNPG cluster', () => {
-    const result = renderN8n({ host: 'n8n.example.com', storage: '30Gi' })
-    const cluster = result.resources.find((r: any) => r.kind === 'Cluster') as any
-    expect(cluster.spec.storage.size).toBe('30Gi')
-  })
-
-  it('renders gateway resources when platform uses gateway routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'gateway', gatewayClassName: 'eg' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(N8n, { host: 'n8n.example.com' }),
-        }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('HTTPRoute')
-  })
-
-  it('renders a valid Ingress when platform uses ingress routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'ingress' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(N8n, { host: 'n8n.example.com' }),
-        }),
-      })
-    )
-    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
-    expect(ingress).toBeDefined()
-    expect(ingress.spec.rules[0].host).toBe('n8n.example.com')
-  })
-
-  it('passes resource validation', () => {
-    const result = renderN8n({ host: 'n8n.example.com', queueMode: true })
-    for (const resource of result.resources) {
-      expect(validateResource(resource)).toEqual([])
-    }
-  })
-})
-
-describe('rendering with all props', () => {
-  it('accepts the full prop surface', () => {
-    const result = renderN8n({
-      name: 'automation',
-      namespace: 'automation',
-      version: '1.60.0',
-      host: 'automation.example.com',
-      replicas: 2,
-      queueMode: true,
-      workers: 4,
-      resources: {
-        requests: { memory: '1Gi', cpu: '500m' },
-        limits: { memory: '4Gi', cpu: '2000m' },
-      },
-      tls: { secretName: 'automation-tls', clusterIssuer: 'letsencrypt-prod' },
-    })
-    expect(result.resources.length).toBeGreaterThan(0)
-    const editor = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'automation'
-    ) as any
-    expect(editor.spec.template.spec.containers[0].image).toContain('1.60.0')
-    expect(editor.spec.template.spec.containers[0].resources.limits.memory).toBe('4Gi')
-  })
-})
-
-describe('secrets handling', () => {
-  it('accepts an explicit encryptionKeySecretName without a backend', () => {
-    expect(() =>
-      render(jsx(N8n, { host: 'n8n.example.com', encryptionKeySecretName: 'existing-encryption' }))
-    ).not.toThrow()
-  })
-
-  it('provisions the encryption key through a secrets backend', () => {
-    const result = renderN8n({ host: 'n8n.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('OpenBaoStaticSecret')
-  })
-
-  it('provisions the encryption key through Vault', () => {
-    const result = render(
-      jsx(SecretContext.Provider, {
-        value: { backend: 'vault', mount: 'kv', path: 'apps' },
-        children: jsx(N8n, { host: 'n8n.example.com' }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('VaultStaticSecret')
-  })
-
-  it('wires credentials via secretKeyRef (never plaintext env)', () => {
-    const result = renderN8n({
-      host: 'n8n.example.com',
-      encryptionKeySecretName: 'existing-encryption',
-    })
-    const editor = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'n8n'
-    ) as any
-    const env = editor.spec.template.spec.containers[0].env
-    const encryption = env.find((e: any) => e.name === 'N8N_ENCRYPTION_KEY')
-    const dbPassword = env.find((e: any) => e.name === 'DB_POSTGRESDB_PASSWORD')
-    expect(encryption.valueFrom.secretKeyRef.name).toBe('existing-encryption')
-    expect(dbPassword.valueFrom.secretKeyRef.name).toBe('n8n-db-credentials')
-    expect(encryption.value).toBeUndefined()
-    expect(dbPassword.value).toBeUndefined()
-  })
-
-  it('renders no plaintext credentials anywhere', () => {
-    const result = renderN8n({ host: 'n8n.example.com', queueMode: true })
-    const { passed, errors } = runGuardrails(result.resources as any[], [noPlaintextSecrets])
-    if (!passed) {
-      console.error('Plaintext credential violations:', errors)
-    }
-    expect(passed).toBe(true)
-  })
-})
-
-describe('validation errors', () => {
-  it('throws when no secrets backend and no encryption key secret', () => {
-    expect(() => render(jsx(N8n, { host: 'n8n.example.com' }))).toThrow(/encryption key/)
-  })
-
-  it('throws for unknown secrets backends', () => {
-    expect(() =>
-      render(
-        jsx(SecretContext.Provider, {
-          value: { backend: 'unknown' as never },
-          children: jsx(N8n, { host: 'n8n.example.com' }),
-        })
-      )
-    ).toThrow(/encryption key/)
-  })
-})
-
-describe('secretKeyRef wiring in queue mode', () => {
-  it('worker deployment uses the same credentials secret', () => {
-    const result = renderN8n({
-      host: 'n8n.example.com',
-      queueMode: true,
-      encryptionKeySecretName: 'existing-encryption',
-    })
-    const worker = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'n8n-worker'
-    ) as any
-    expect(worker).toBeDefined()
-    const env = worker.spec.template.spec.containers[0].env
-    const dbPassword = env.find((e: any) => e.name === 'DB_POSTGRESDB_PASSWORD')
-    expect(dbPassword.valueFrom.secretKeyRef.name).toBe('n8n-db-credentials')
-    expect(dbPassword.value).toBeUndefined()
-  })
-})

package/examples/basic.tsx

@@ -1,8 +0,0 @@
-import { Platform } from '@r8s/recipes'
-import { N8n } from '@r8s/n8n'
-
-export default (
-  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
-    <N8n name="n8n" host="n8n.example.com" queueMode workers={3} />
-  </Platform>
-)

package/src/index.tsx

@@ -1,284 +0,0 @@
-import { jsx, Fragment, useContext, declareOperator } from '@r8s/core'
-import { Namespace, OperatorContext, SecretContext } from '@r8s/core/defaults'
-import { operators } from '@r8s/crds'
-import { Database, WebService, Endpoint } from '@r8s/recipes'
-import { RedisReplicationComponent } from '@r8s/crds/redis'
-
-export interface N8nProps {
-  /** Resource name (defaults to 'n8n') */
-  name?: string
-  /** Kubernetes namespace (inherited from Platform context when omitted) */
-  namespace?: string
-  /** Container image tag (defaults to 'latest' — pin a version in production) */
-  version?: string
-  /** Public hostname for the editor and webhooks (required) */
-  host: string
-  /** Number of editor replicas when not running in queue mode (defaults to 1) */
-  replicas?: number
-  /**
-   * Redis-backed queue mode. Adds a Redis master/replica set and a worker
-   * Deployment so webhook ingestion and heavy executions scale independently.
-   */
-  queueMode?: boolean
-  /** Queue worker replicas (defaults to 2, only used with queueMode) */
-  workers?: number
-  /** Storage request for the CNPG Postgres cluster (defaults to '10Gi') */
-  storage?: string
-  /**
-   * Name of an existing Secret containing key `encryptionKey`. n8n
-   * encrypts all workflow credentials with this key — lose it and every
-   * stored credential is unreadable.
-   *
-   * Required unless a secrets backend (openbao/vault) is configured on
-   * the surrounding Platform — the backend then provisions the key
-   * automatically. Plaintext keys are not supported.
-   */
-  encryptionKeySecretName?: string
-  /** Requested editor resources */
-  resources?: {
-    requests?: { cpu?: string; memory?: string }
-    limits?: { cpu?: string; memory?: string }
-  }
-  /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
-  tls?: {
-    secretName: string
-    clusterIssuer: string
-  }
-}
-
-const OPERATOR_REDIS = 'redis-operator'
-
-/**
- * n8n — fair-code workflow automation.
- *
- * @title N8n
- * @category Automation
- *
- * Composes:
- * - CNPG Postgres cluster (workflows, executions, stored credentials)
- * - n8n editor Deployment + Service + Endpoint (webhooks share the host)
- * - Redis cluster + worker Deployment in queue mode
- * - Encryption key provisioned through the Platform secrets backend
- *   (openbao / vault), or referenced from an existing Secret
- *
- * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
- * the N8N_ENCRYPTION_KEY is provisioned for you. Without a backend you
- * must point `encryptionKeySecretName` at a pre-created Secret.
- *
- * @example
- * import { Platform } from '@r8s/recipes'
- * import { N8n } from '@r8s/n8n'
- *
- * export default (
- *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
- *     <N8n name="n8n" host="n8n.example.com" queueMode workers={3} />
- *   </Platform>
- * )
- */
-export function N8n(props: N8nProps) {
-  const {
-    name = 'n8n',
-    namespace: namespaceProp,
-    version = 'latest',
-    host,
-    replicas = 1,
-    queueMode = false,
-    workers = 2,
-    storage = '10Gi',
-    encryptionKeySecretName,
-    resources = {
-      requests: { memory: '512Mi', cpu: '250m' },
-      limits: { memory: '2Gi', cpu: '1000m' },
-    },
-    tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' },
-  } = props
-
-  const sharedOperators = useContext(OperatorContext)
-  const secretProvider = useContext(SecretContext)
-  // Inherit namespace from <Platform> context — mirrors recipes/database.tsx
-  const contextNamespace = useContext(Namespace)
-  const namespace =
-    namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default'
-  const resources_: ReturnType<typeof jsx>[] = []
-
-  const dbCredentialsName = `${name}-db-credentials`
-  const encryptionSecretName = encryptionKeySecretName ?? `${name}-encryption-key`
-
-  // --- Secret provisioning -------------------------------------------------
-  // The encryption key is the crown jewel of an n8n install — never render
-  // it as plaintext. With a secrets backend it is provisioned through the
-  // backend (key `encryptionKey`); otherwise reference a pre-created Secret.
-  if (!encryptionKeySecretName) {
-    if (
-      !secretProvider ||
-      (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')
-    ) {
-      throw new Error(
-        `N8n "${name}" requires an encryption key.\n` +
-          `\n` +
-          `n8n encrypts all workflow credentials with N8N_ENCRYPTION_KEY — ` +
-          `it must not be rendered as plaintext.\n` +
-          `\n` +
-          `Fix: configure a secrets backend on the Platform:\n` +
-          `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'n8n' }}>\n` +
-          `    <N8n name="${name}" host="${host}" />\n` +
-          `  </Platform>\n` +
-          `\n` +
-          `Or reference a pre-created Secret (key: encryptionKey):\n` +
-          `  <N8n name="${name}" host="${host}" encryptionKeySecretName="${name}-encryption-key" />`
-      )
-    }
-
-    const spec = {
-      ...(secretProvider.backend === 'vault'
-        ? { vaultAuthRef: secretProvider.authRef }
-        : { openbaoAuthRef: secretProvider.authRef }),
-      mount: secretProvider.mount,
-      type: 'kv-v2' as const,
-      path: `${secretProvider.path ?? name}/${name}/encryption`,
-      destination: { create: true, name: encryptionSecretName },
-    }
-    resources_.push(
-      secretProvider.backend === 'vault'
-        ? jsx('VaultStaticSecret', {
-            apiVersion: 'secrets.hashicorp.com/v1beta1',
-            kind: 'VaultStaticSecret',
-            metadata: { name: `${name}-encryption`, namespace },
-            spec,
-          })
-        : jsx('OpenBaoStaticSecret', {
-            apiVersion: 'secrets.openbao.org/v1beta1',
-            kind: 'OpenBaoStaticSecret',
-            metadata: { name: `${name}-encryption`, namespace },
-            spec,
-          })
-    )
-  }
-
-  // --- Operators ------------------------------------------------------------
-  if (queueMode && !sharedOperators.some((op) => op.name === OPERATOR_REDIS)) {
-    resources_.push(declareOperator(operators[OPERATOR_REDIS]()))
-  }
-
-  // --- Database (CNPG) — workflows, executions, stored credentials ----------
-  const dbHost = `${name}-rw`
-
-  const sharedEnv = {
-    DB_TYPE: 'postgresdb',
-    DB_POSTGRESDB_HOST: dbHost,
-    DB_POSTGRESDB_PORT: '5432',
-    DB_POSTGRESDB_DATABASE: name,
-    DB_POSTGRESDB_USER: name,
-    N8N_HOST: host,
-    N8N_PORT: '5678',
-    N8N_PROTOCOL: 'https',
-    WEBHOOK_URL: `https://${host}/`,
-    NODE_FUNCTION_ALLOW_BUILTIN: '*',
-    // Binary data must live in Postgres in queue mode — the filesystem
-    // backend is not shared across editors/workers and is unsupported.
-    N8N_DEFAULT_BINARY_DATA_MODE: 'default',
-  }
-
-  const sharedSecrets = {
-    DB_POSTGRESDB_PASSWORD: { secret: dbCredentialsName, key: 'password' },
-    N8N_ENCRYPTION_KEY: { secret: encryptionSecretName, key: 'encryptionKey' },
-  }
-
-  if (queueMode) {
-    Object.assign(sharedEnv, {
-      EXECUTIONS_MODE: 'queue',
-      QUEUE_BULL_REDIS_HOST: `${name}-redis`,
-      QUEUE_BULL_REDIS_PORT: '6379',
-    })
-  }
-
-  if (!queueMode && replicas > 1) {
-    throw new Error(
-      `N8n "${name}" requested replicas={${replicas}} without queue mode.\n` +
-        `\n` +
-        `Multiple main instances without Redis queue mode run every trigger ` +
-        `execution once per replica (duplicated webhooks and schedules).\n` +
-        `\n` +
-        `Fix: enable queue mode:\n` +
-        `  <N8n name="${name}" host="${host}" queueMode workers={${replicas}} />\n` +
-        `\n` +
-        `Or keep a single main instance (workers handle executions in queue mode).`
-    )
-  }
-
-  // Database wraps the editor so credentials stay consistent with the
-  // r8s Database recipe (CNPG dedicated cluster provisions the secret).
-  resources_.push(
-    jsx(Database, {
-      name,
-      namespace,
-      storage,
-      children: (
-        <WebService
-          name={name}
-          namespace={namespace}
-          image={`docker.n8n.io/n8nio/n8n:${version}`}
-          port={5678}
-          replicas={queueMode ? 1 : replicas}
-          resources={resources}
-          probes={{
-            liveness: { path: '/healthz' },
-            readiness: { path: '/healthz', initialDelaySeconds: 15 },
-          }}
-          env={{ ...sharedEnv, ...(queueMode ? {} : { N8N_CONCURRENCY_PRODUCTION_LIMIT: '10' }) }}
-          secrets={sharedSecrets}
-        />
-      ),
-    })
-  )
-
-  // --- Queue mode: Redis + workers ------------------------------------------
-  if (queueMode) {
-    // Bull (n8n's queue backend) speaks plain Redis protocol — use a
-    // master/replica topology, not a Redis cluster (no MOVED-safe client)
-    resources_.push(
-      RedisReplicationComponent({
-        metadata: { name: `${name}-redis`, namespace },
-        spec: {
-          clusterSize: 3,
-          kubernetesConfig: { image: 'redis:7.2-alpine' },
-        },
-      })
-    )
-
-    resources_.push(
-      <WebService
-        name={`${name}-worker`}
-        namespace={namespace}
-        image={`docker.n8n.io/n8nio/n8n:${version}`}
-        port={5678}
-        replicas={workers}
-        command={['n8n', 'worker', '--concurrency=10']}
-        resources={{
-          requests: { memory: '512Mi', cpu: '250m' },
-          limits: { memory: '2Gi', cpu: '2000m' },
-        }}
-        probes={{
-          liveness: { path: '/healthz' },
-          readiness: { path: '/healthz', initialDelaySeconds: 20 },
-        }}
-        env={{ ...sharedEnv, QUEUE_HEALTH_CHECK_ACTIVE: 'true' }}
-        secrets={sharedSecrets}
-      />
-    )
-  }
-
-  // --- Endpoint — webhooks share the editor host -----------------------------
-  resources_.push(
-    <Endpoint
-      name={`${name}-endpoint`}
-      namespace={namespace}
-      host={host}
-      serviceName={name}
-      servicePort={5678}
-      tls={tls}
-    />
-  )
-
-  return jsx(Fragment, { children: resources_ })
-}

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": true
-  },
-  "include": ["src/**/*"],
-  "references": [
-    { "path": "../core" },
-    { "path": "../k8s-types" },
-    { "path": "../crds" },
-    { "path": "../recipes" }
-  ]
-}