@r8s/open-webui 0.2.0 → 0.3.0

package/dist/index.d.ts

@@ -0,0 +1,144 @@
+import type { SecretRef } from '@r8s/recipes';
+export interface OpenWebuiProps {
+    /** Resource name (defaults to 'open-webui') */
+    name?: string;
+    /** Kubernetes namespace (defaults to 'default') */
+    namespace?: string;
+    /** Container image tag (defaults to 'latest' — pin a version in production) */
+    version?: string;
+    /** Public hostname for the chat UI (required) */
+    host: string;
+    /**
+     * Number of replicas (defaults to 1). Multiple replicas need a shared
+     * object store for uploads/RAG (this recipe errors when `storage` is
+     * set with replicas > 1 — its PVC is ReadWriteOnce) and Redis-backed
+     * websocket coordination (WEBSOCKET_MANAGER=redis + REDIS_URL).
+     */
+    replicas?: number;
+    /**
+     * PVC size for uploads and RAG document storage (e.g. '10Gi'). When set,
+     * a `${name}-uploads` PersistentVolumeClaim is rendered and mounted at
+     * /app/backend/data. WebService cannot express volume mounts, which is
+     * why this component composes a raw Deployment (probes /health:8080).
+     * The PVC is ReadWriteOnce — combining this with replicas > 1 throws
+     * (single-node attach); multi-replica installs must move files/RAG to
+     * an S3-compatible store and set WEBSOCKET_MANAGER=redis.
+     */
+    storage?: string;
+    /**
+     * OpenAI-compatible API base URL for the model backend (defaults to
+     * 'https://api.berget.ai/v1'). The key itself is never passed as a
+     * prop — it arrives via secretKeyRef from the secrets bundle below.
+     */
+    backend?: string;
+    /**
+     * Name of an existing Secret holding `modelApiKey` (the key used to
+     * call `backend`) and `secretKey` (the WEBUI_SECRET_KEY used to sign
+     * auth tokens). Required unless a secrets backend (openbao/vault) is
+     * configured on the surrounding Platform — the backend then provisions
+     * both keys automatically. Plaintext keys are not supported.
+     */
+    secretsName?: string;
+    /**
+     * OAuth/OIDC SSO client — register Open WebUI as a client in Keycloak
+     * (the Auth recipe) and reference the client secret through the backend.
+     * Uses the upstream OAUTH_* env names; OPENID_PROVIDER_URL carries the
+     * issuer (Open WebUI appends /.well-known/openid-configuration itself).
+     */
+    sso?: {
+        /** OIDC discovery issuer, e.g. https://keycloak.example.com/realms/platform */
+        issuer: string;
+        /** Client id registered at the issuer (non-sensitive) */
+        clientId: string;
+        /** Reference to the Kubernetes Secret holding the client secret */
+        clientSecretRef: SecretRef;
+        /** Scope list (defaults to 'openid email profile') */
+        scopes?: string;
+    };
+    /** Provision a redis-backed replication group for caching/events (default: false) */
+    cache?: boolean;
+    /**
+     * Air-gapped installs: sets OFFLINE_MODE (disable runtime model/param
+     * fetches), removes the update checks and disables the native Ollama
+     * API — only OpenAI-compatible backends are served (default: false).
+     */
+    offline?: boolean;
+    /** Requested resources */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+    /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * Open WebUI — self-hosted chat frontend for OpenAI-compatible backends.
+ *
+ * @title OpenWebui
+ * @category AI & Chat
+ *
+ * Composes:
+ * - CNPG Postgres cluster (users, chats, presets) via the Database recipe
+ * - Open WebUI Deployment + Service + Endpoint (websocket-friendly
+ *   proxy annotations; works through Ingress or Envoy Gateway)
+ * - Optional PVC for uploaded files and RAG documents
+ *   (`${name}-uploads` mounted at /app/backend/data)
+ * - Optional redis replication group for caching (`cache`,
+ *   service ${name}-redis)
+ * - Model API key + WEBUI_SECRET_KEY provisioned through the Platform
+ *   secrets backend (openbao / vault), or referenced from an existing
+ *   Secret
+ * - OAuth/OIDC SSO against the Keycloak `Auth` recipe
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the OPENAI_API_KEY / WEBUI_SECRET_KEY pair is provisioned for you.
+ * Without a backend you must point `secretsName` at a pre-created Secret.
+ * The Perplexity-style "search the web" extras are not wired — only
+ * OPENAI-models via the OpenAI-compatible `backend`.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { OpenWebui } from '@r8s/open-webui'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <OpenWebui
+ *       name="chat"
+ *       host="chat.example.com"
+ *       version="v0.6.5"
+ *       storage="10Gi"
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { OpenWebui } from '@r8s/open-webui'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <OpenWebui
+ *       name="chat"
+ *       host="chat.example.com"
+ *       storage="10Gi"
+ *       cache
+ *       sso={{
+ *         issuer: 'https://keycloak.example.com/realms/platform',
+ *         clientId: 'open-webui',
+ *         clientSecretRef: { secret: 'chat-sso', key: 'clientSecret' },
+ *       }}
+ *     />
+ *   </Platform>
+ * )
+ */
+export declare function OpenWebui(props: OpenWebuiProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAK7C,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,GAAG,CAAC,EAAE;QACJ,+EAA+E;QAC/E,MAAM,EAAE,MAAM,CAAA;QACd,yDAAyD;QACzD,QAAQ,EAAE,MAAM,CAAA;QAChB,mEAAmE;QACnE,eAAe,EAAE,SAAS,CAAA;QAC1B,sDAAsD;QACtD,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,0BAA0B;IAC1B,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,sEAAsE;IACtE,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,kCA6R9C"}

package/dist/index.js

@@ -0,0 +1,304 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenWebui = OpenWebui;
+const jsx_runtime_1 = require("@r8s/core/jsx-runtime");
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+const redis_1 = require("@r8s/crds/redis");
+const operator_redis_1 = require("@r8s/operator-redis");
+/**
+ * Open WebUI — self-hosted chat frontend for OpenAI-compatible backends.
+ *
+ * @title OpenWebui
+ * @category AI & Chat
+ *
+ * Composes:
+ * - CNPG Postgres cluster (users, chats, presets) via the Database recipe
+ * - Open WebUI Deployment + Service + Endpoint (websocket-friendly
+ *   proxy annotations; works through Ingress or Envoy Gateway)
+ * - Optional PVC for uploaded files and RAG documents
+ *   (`${name}-uploads` mounted at /app/backend/data)
+ * - Optional redis replication group for caching (`cache`,
+ *   service ${name}-redis)
+ * - Model API key + WEBUI_SECRET_KEY provisioned through the Platform
+ *   secrets backend (openbao / vault), or referenced from an existing
+ *   Secret
+ * - OAuth/OIDC SSO against the Keycloak `Auth` recipe
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the OPENAI_API_KEY / WEBUI_SECRET_KEY pair is provisioned for you.
+ * Without a backend you must point `secretsName` at a pre-created Secret.
+ * The Perplexity-style "search the web" extras are not wired — only
+ * OPENAI-models via the OpenAI-compatible `backend`.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { OpenWebui } from '@r8s/open-webui'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <OpenWebui
+ *       name="chat"
+ *       host="chat.example.com"
+ *       version="v0.6.5"
+ *       storage="10Gi"
+ *     />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { OpenWebui } from '@r8s/open-webui'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <OpenWebui
+ *       name="chat"
+ *       host="chat.example.com"
+ *       storage="10Gi"
+ *       cache
+ *       sso={{
+ *         issuer: 'https://keycloak.example.com/realms/platform',
+ *         clientId: 'open-webui',
+ *         clientSecretRef: { secret: 'chat-sso', key: 'clientSecret' },
+ *       }}
+ *     />
+ *   </Platform>
+ * )
+ */
+function OpenWebui(props) {
+    const { name = 'open-webui', namespace = 'default', version = 'latest', host, replicas = 1, storage, backend = 'https://api.berget.ai/v1', secretsName, sso, cache = false, offline = false, resources = {
+        requests: { memory: '1Gi', cpu: '500m' },
+        limits: { memory: '4Gi', cpu: '2000m' },
+    }, tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const resources_ = [];
+    // --- Validation -----------------------------------------------------------
+    // The uploads PVC is ReadWriteOnce: a single volume can only be attached
+    // to one node at a time, so extra replicas with `storage` set would
+    // crash-loop. Multi-replica installs are viable only with a shared
+    // S3-compatible object store and WEBSOCKET_MANAGER=redis for socket
+    // fan-out.
+    if (storage && replicas > 1) {
+        throw new Error(`OpenWebui "${name}" cannot combine storage with replicas > 1.\n` +
+            `\n` +
+            `The ${name}-uploads PVC is ReadWriteOnce and Open WebUI keeps ` +
+            `uploads/RAG on it — mounting it on multiple nodes is impossible, ` +
+            `so extra replicas would stay Unschedulable or crash-loop. ` +
+            `Multi-replica deployments also need WEBSOCKET_MANAGER=redis plus a ` +
+            `REDIS_URL for socket coordination.\n` +
+            `\n` +
+            `Fix: either run a single replica alongside the PVC:\n` +
+            `  <OpenWebui name="${name}" host="${host}" storage="${storage}" replicas={1} />\n` +
+            `\n` +
+            `Or drop the storage prop and move uploads to S3-compatible storage ` +
+            `with a Redis instance (cache) before scaling out:\n` +
+            `  <OpenWebui name="${name}" host="${host}" replicas={3} cache />`);
+    }
+    const dbHost = `${name}-rw`;
+    const dbCredentialsName = `${name}-db-credentials`;
+    const appSecretsName = secretsName ?? `${name}-secrets`;
+    // --- Secret provisioning -------------------------------------------------
+    // The model API key and the WEBUI_SECRET_KEY are the crown jewels of an
+    // Open WebUI install — never render them as plaintext. With a secrets
+    // backend they are provisioned through the backend (keys `modelApiKey`
+    // and `secretKey`); otherwise reference a pre-created Secret.
+    if (!secretsName) {
+        if (!secretProvider ||
+            (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')) {
+            throw new Error(`OpenWebui "${name}" requires application secrets (OPENAI_API_KEY, WEBUI_SECRET_KEY).\n` +
+                `\n` +
+                `The model API key for "${backend}" and the auth-token signing key must ` +
+                `not be rendered as plaintext.\n` +
+                `\n` +
+                `Fix: configure a secrets backend on the Platform:\n` +
+                `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+                `    <OpenWebui name="${name}" host="${host}" />\n` +
+                `  </Platform>\n` +
+                `\n` +
+                `Or reference a pre-created Secret (keys: modelApiKey, secretKey):\n` +
+                `  <OpenWebui name="${name}" host="${host}" secretsName="${name}-secrets" />`);
+        }
+        const spec = {
+            ...(secretProvider.backend === 'vault'
+                ? { vaultAuthRef: secretProvider.authRef }
+                : { openbaoAuthRef: secretProvider.authRef }),
+            mount: secretProvider.mount,
+            type: 'kv-v2',
+            path: `${secretProvider.path ?? name}/${name}/secrets`,
+            destination: { create: true, name: appSecretsName },
+        };
+        resources_.push(secretProvider.backend === 'vault'
+            ? (0, core_1.jsx)('VaultStaticSecret', {
+                apiVersion: 'secrets.hashicorp.com/v1beta1',
+                kind: 'VaultStaticSecret',
+                metadata: { name: `${name}-secrets`, namespace },
+                spec,
+            })
+            : (0, core_1.jsx)('OpenBaoStaticSecret', {
+                apiVersion: 'secrets.openbao.org/v1beta1',
+                kind: 'OpenBaoStaticSecret',
+                metadata: { name: `${name}-secrets`, namespace },
+                spec,
+            }));
+    }
+    // --- Operators ------------------------------------------------------------
+    if (cache) {
+        resources_.push(...(0, operator_redis_1.declareIfMissing)(sharedOperators));
+    }
+    // Redis — caching (OT-Container-Kit operator). A replication group so
+    // the single ${name}-redis master service fronts a 3-node replication
+    // set (1 master + 2 replicas) instead of a lone stateful pod.
+    if (cache) {
+        resources_.push((0, redis_1.RedisReplicationComponent)({
+            metadata: { name: `${name}-redis`, namespace },
+            spec: {
+                clusterSize: 3,
+                kubernetesConfig: { image: 'redis:7.2-alpine' },
+            },
+        }));
+    }
+    // --- Uploads/RAG PVC --------------------------------------------------------
+    // WebService cannot mount volumes, so the app controller below is a raw
+    // Deployment. The PVC is rendered alongside and bound when `storage` is
+    // set. Without it, uploaded files and RAG documents are lost on restart.
+    if (storage) {
+        const pvc = {
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: { name: `${name}-uploads`, namespace },
+            spec: {
+                accessModes: ['ReadWriteOnce'],
+                resources: { requests: { storage } },
+            },
+        };
+        resources_.push((0, core_1.jsx)('PersistentVolumeClaim', pvc));
+    }
+    // --- Env wiring --------------------------------------------------------------
+    // Every credential arrives via secretKeyRef — declared BEFORE plain env
+    // vars in the container env array, so Kubernetes dependent-variable
+    // expansion resolves the $(VAR) templates below at runtime.
+    const secretRefs = {
+        PGPASSWORD: { secret: dbCredentialsName, key: 'password' },
+        OPENAI_API_KEY: { secret: appSecretsName, key: 'modelApiKey' },
+        WEBUI_SECRET_KEY: { secret: appSecretsName, key: 'secretKey' },
+        ...(sso ? { OAUTH_CLIENT_SECRET: sso.clientSecretRef } : {}),
+    };
+    const envVars = [];
+    for (const [envName, ref] of Object.entries(secretRefs)) {
+        const typed = typeof ref === 'string' ? { secret: ref } : ref;
+        envVars.push({
+            name: envName,
+            valueFrom: { secretKeyRef: { name: typed.secret, key: typed.key ?? envName } },
+        });
+    }
+    const env = {
+        WEBUI_URL: `https://${host}`,
+        ENABLE_OPENAI_API: 'true',
+        // This recipe targets OpenAI-compatible backends only — the native
+        // Ollama API discovery stays off (offline mode forces the same).
+        ENABLE_OLLAMA_API: 'false',
+        OPENAI_API_BASE_URL: backend,
+        // Deterministic parts inlined; the password arrives via $(PGPASSWORD)
+        // (secret-backed var declared first in the env array).
+        DATABASE_URL: `postgresql://${name}:$(PGPASSWORD)@${dbHost}:5432/${name}`,
+        ...(cache ? { REDIS_URL: `redis://${name}-redis:6379` } : {}),
+        // Upstream OAUTH_* names; ENABLE_OAUTH_SIGNUP (default true) governs
+        // whether local-password login is offered alongside the SSO flow.
+        ...(sso
+            ? {
+                ENABLE_OAUTH_SIGNUP: 'true',
+                OPENID_PROVIDER_URL: sso.issuer,
+                OAUTH_CLIENT_ID: sso.clientId,
+                OPENID_REDIRECT_URI: `https://${host}/oauth/oidc/callback`,
+                OAUTH_SCOPES: sso.scopes ?? 'openid email profile',
+            }
+            : {}),
+        ...(offline
+            ? {
+                OFFLINE_MODE: 'true',
+                ENABLE_UPDATE_CHECK: 'false',
+            }
+            : {}),
+    };
+    for (const [key, value] of Object.entries(env)) {
+        envVars.push({ name: key, value });
+    }
+    // --- App controller (raw Deployment — WebService cannot mount volumes) -----
+    // Generous probe delays/failures: first-boot runs Alembic migrations
+    // against Postgres before /health starts answering.
+    const deployment = {
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: { name, namespace, labels: { app: name } },
+        spec: {
+            replicas,
+            selector: { matchLabels: { app: name } },
+            template: {
+                metadata: { labels: { app: name } },
+                spec: {
+                    containers: [
+                        {
+                            name: 'open-webui',
+                            image: `ghcr.io/open-webui/open-webui:${version}`,
+                            imagePullPolicy: 'Always',
+                            ports: [{ containerPort: 8080 }],
+                            env: envVars,
+                            resources,
+                            livenessProbe: {
+                                httpGet: { path: '/health', port: 8080 },
+                                initialDelaySeconds: 30,
+                                periodSeconds: 10,
+                                failureThreshold: 6,
+                            },
+                            readinessProbe: {
+                                httpGet: { path: '/health', port: 8080 },
+                                initialDelaySeconds: 30,
+                                periodSeconds: 5,
+                                failureThreshold: 6,
+                            },
+                            ...(storage && {
+                                volumeMounts: [{ name: 'uploads', mountPath: '/app/backend/data' }],
+                            }),
+                        },
+                    ],
+                    ...(storage && {
+                        volumes: [{ name: 'uploads', persistentVolumeClaim: { claimName: `${name}-uploads` } }],
+                    }),
+                },
+            },
+        },
+    };
+    // Database parent wraps the app so the CNPG cluster, its credentials
+    // secret (${name}-db-credentials) and connection conventions stay
+    // consistent with the r8s Database recipe. The raw Deployment sets
+    // DATABASE_URL statically (the WebService auto-PG block does not apply).
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        backup: false,
+        name,
+        namespace,
+        storage: '10Gi',
+        children: (0, core_1.jsx)('Deployment', deployment),
+    }));
+    // --- Service -----------------------------------------------------------------
+    const service = {
+        apiVersion: 'v1',
+        kind: 'Service',
+        metadata: { name, namespace },
+        spec: {
+            type: 'ClusterIP',
+            selector: { app: name },
+            ports: [{ port: 8080, targetPort: 8080 }],
+        },
+    };
+    resources_.push((0, core_1.jsx)('Service', service));
+    // --- Endpoint — websocket-friendly proxy timeouts ------------------------------
+    resources_.push((0, jsx_runtime_1.jsx)(recipes_1.Endpoint, { name: `${name}-endpoint`, namespace: namespace, host: host, serviceName: name, servicePort: 8080, tls: tls, annotations: {
+            'nginx.ingress.kubernetes.io/proxy-read-timeout': '300',
+            'nginx.ingress.kubernetes.io/proxy-send-timeout': '300',
+        } }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AAgJA,8BA6RC;;AA7aD,oCAAsE;AACtE,iDAAmE;AACnE,0CAAiD;AAEjD,2CAA2D;AAC3D,wDAAsD;AA+EtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,SAAgB,SAAS,CAAC,KAAqB;IAC7C,MAAM,EACJ,IAAI,GAAG,YAAY,EACnB,SAAS,GAAG,SAAS,EACrB,OAAO,GAAG,QAAQ,EAClB,IAAI,EACJ,QAAQ,GAAG,CAAC,EACZ,OAAO,EACP,OAAO,GAAG,0BAA0B,EACpC,WAAW,EACX,GAAG,EACH,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,KAAK,EACf,SAAS,GAAG;QACV,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;QACxC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;KACxC,EACD,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACvE,GAAG,KAAK,CAAA;IAET,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,WAAW;IACX,IAAI,OAAO,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,+CAA+C;YAC/D,IAAI;YACJ,OAAO,IAAI,qDAAqD;YAChE,mEAAmE;YACnE,4DAA4D;YAC5D,qEAAqE;YACrE,sCAAsC;YACtC,IAAI;YACJ,uDAAuD;YACvD,sBAAsB,IAAI,WAAW,IAAI,cAAc,OAAO,qBAAqB;YACnF,IAAI;YACJ,qEAAqE;YACrE,qDAAqD;YACrD,sBAAsB,IAAI,WAAW,IAAI,yBAAyB,CACrE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,CAAA;IAC3B,MAAM,iBAAiB,GAAG,GAAG,IAAI,iBAAiB,CAAA;IAClD,MAAM,cAAc,GAAG,WAAW,IAAI,GAAG,IAAI,UAAU,CAAA;IAEvD,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IACE,CAAC,cAAc;YACf,CAAC,cAAc,CAAC,OAAO,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO,KAAK,SAAS,CAAC,EAC5E,CAAC;YACD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,sEAAsE;gBACtF,IAAI;gBACJ,0BAA0B,OAAO,wCAAwC;gBACzE,iCAAiC;gBACjC,IAAI;gBACJ,qDAAqD;gBACrD,4EAA4E;gBAC5E,wBAAwB,IAAI,WAAW,IAAI,QAAQ;gBACnD,iBAAiB;gBACjB,IAAI;gBACJ,qEAAqE;gBACrE,sBAAsB,IAAI,WAAW,IAAI,kBAAkB,IAAI,cAAc,CAChF,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG;YACX,GAAG,CAAC,cAAc,CAAC,OAAO,KAAK,OAAO;gBACpC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,OAAO,EAAE;gBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;YAC/C,KAAK,EAAE,cAAc,CAAC,KAAK;YAC3B,IAAI,EAAE,OAAgB;YACtB,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,UAAU;YACtD,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE;SACpD,CAAA;QACD,UAAU,CAAC,IAAI,CACb,cAAc,CAAC,OAAO,KAAK,OAAO;YAChC,CAAC,CAAC,IAAA,UAAG,EAAC,mBAAmB,EAAE;gBACvB,UAAU,EAAE,+BAA+B;gBAC3C,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE;gBAChD,IAAI;aACL,CAAC;YACJ,CAAC,CAAC,IAAA,UAAG,EAAC,qBAAqB,EAAE;gBACzB,UAAU,EAAE,6BAA6B;gBACzC,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE;gBAChD,IAAI;aACL,CAAC,CACP,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,IAAI,CAAC,GAAG,IAAA,iCAAgB,EAAC,eAAe,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,IAAI,CACb,IAAA,iCAAyB,EAAC;YACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,QAAQ,EAAE,SAAS,EAAE;YAC9C,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC;gBACd,gBAAgB,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;aAChD;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAA0B;YACjC,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE;YAChD,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC,eAAe,CAAC;gBAC9B,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE;aACrC;SACF,CAAA;QACD,UAAU,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,CAAA;IACpD,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,UAAU,GAAuC;QACrD,UAAU,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,UAAU,EAAE;QAC1D,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE;QAC9D,gBAAgB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,WAAW,EAAE;QAC9D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAA;IAED,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;QAC7D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,EAAE,EAAE;SAC/E,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAA2B;QAClC,SAAS,EAAE,WAAW,IAAI,EAAE;QAC5B,iBAAiB,EAAE,MAAM;QACzB,mEAAmE;QACnE,iEAAiE;QACjE,iBAAiB,EAAE,OAAO;QAC1B,mBAAmB,EAAE,OAAO;QAC5B,sEAAsE;QACtE,uDAAuD;QACvD,YAAY,EAAE,gBAAgB,IAAI,kBAAkB,MAAM,SAAS,IAAI,EAAE;QACzE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,qEAAqE;QACrE,kEAAkE;QAClE,GAAG,CAAC,GAAG;YACL,CAAC,CAAC;gBACE,mBAAmB,EAAE,MAAM;gBAC3B,mBAAmB,EAAE,GAAG,CAAC,MAAM;gBAC/B,eAAe,EAAE,GAAG,CAAC,QAAQ;gBAC7B,mBAAmB,EAAE,WAAW,IAAI,sBAAsB;gBAC1D,YAAY,EAAE,GAAG,CAAC,MAAM,IAAI,sBAAsB;aACnD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,YAAY,EAAE,MAAM;gBACpB,mBAAmB,EAAE,OAAO;aAC7B;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IACpC,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,oDAAoD;IACpD,MAAM,UAAU,GAAe;QAC7B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,EAAE;YACJ,QAAQ;YACR,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACxC,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACnC,IAAI,EAAE;oBACJ,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,YAAY;4BAClB,KAAK,EAAE,iCAAiC,OAAO,EAAE;4BACjD,eAAe,EAAE,QAAQ;4BACzB,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;4BAChC,GAAG,EAAE,OAAO;4BACZ,SAAS;4BACT,aAAa,EAAE;gCACb,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;gCACxC,mBAAmB,EAAE,EAAE;gCACvB,aAAa,EAAE,EAAE;gCACjB,gBAAgB,EAAE,CAAC;6BACpB;4BACD,cAAc,EAAE;gCACd,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;gCACxC,mBAAmB,EAAE,EAAE;gCACvB,aAAa,EAAE,CAAC;gCAChB,gBAAgB,EAAE,CAAC;6BACpB;4BACD,GAAG,CAAC,OAAO,IAAI;gCACb,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;6BACpE,CAAC;yBACH;qBACF;oBACD,GAAG,CAAC,OAAO,IAAI;wBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;qBACxF,CAAC;iBACH;aACF;SACF;KACF,CAAA;IAED,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,yEAAyE;IACzE,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,MAAM,EAAE,KAAK;QACb,IAAI;QACJ,SAAS;QACT,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,IAAA,UAAG,EAAC,YAAY,EAAE,UAAU,CAAC;KACxC,CAAC,CACH,CAAA;IAED,gFAAgF;IAChF,MAAM,OAAO,GAAY;QACvB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACJ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;YACvB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SAC1C;KACF,CAAA;IACD,UAAU,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAExC,kFAAkF;IAClF,UAAU,CAAC,IAAI,CACb,uBAAC,kBAAQ,IACP,IAAI,EAAE,GAAG,IAAI,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,IAAI,EACjB,WAAW,EAAE,IAAI,EACjB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;YACX,gDAAgD,EAAE,KAAK;YACvD,gDAAgD,EAAE,KAAK;SACxD,GACD,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@r8s/open-webui",
-  "version": "0.2.0",
-  "description": "Open WebUI — chat frontend for OpenAI-compatible backends, Postgres persistence, uploads/RAG storage, OIDC SSO, optional Redis cache",
+  "version": "0.3.0",
+  "description": "Open WebUI \u2014 chat frontend for OpenAI-compatible backends, Postgres persistence, uploads/RAG storage, OIDC SSO, optional Redis cache",
   "license": "MIT",
   "author": "Berget AI AB",
   "homepage": "https://r8s.berget.ai",
@@ -29,13 +29,20 @@
   },
   "category": "AI & Assistants",
   "dependencies": {
-    "@r8s/core": "^0.2.0",
-    "@r8s/crds": "^0.2.0",
-    "@r8s/k8s-types": "^0.2.0",
-    "@r8s/recipes": "^0.2.0"
+    "@r8s/core": "^0.3.0",
+    "@r8s/crds": "^0.3.0",
+    "@r8s/k8s-types": "^0.3.0",
+    "@r8s/recipes": "^0.3.0"
   },
   "devDependencies": {
     "typescript": "^5.3.0",
-    "vitest": "^1.0.0"
+    "vitest": "^1.0.0",
+    "@r8s/operator-redis": "^0.22.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "peerDependencies": {
+    "@r8s/operator-redis": "^0.22.0"
   }
 }