@r8s/outline 0.2.0 → 0.2.1

package/dist/index.d.ts

@@ -0,0 +1,147 @@
+import { type DatabaseProps } from '@r8s/recipes';
+import type { SecretRef } from '@r8s/recipes';
+export interface OutlineProps {
+    /** Resource name (defaults to 'outline') */
+    name?: string;
+    /** Kubernetes namespace (defaults to 'default') */
+    namespace?: string;
+    /**
+     * Container image tag (defaults to a pinned release — see
+     * https://github.com/outline/outline/releases when upgrading).
+     */
+    version?: string;
+    /** Public hostname for the wiki */
+    host: string;
+    /** Storage request for the CNPG Postgres cluster (defaults to '20Gi') */
+    storage?: string;
+    /** Number of CNPG instances (defaults to 2 — facit production sizing) */
+    instances?: number;
+    /**
+     * CNPG backup configuration passed through to the Database recipe
+     * (continuous WAL archiving + scheduled base backups). Attachments
+     * durability belongs to the object store (erasure-coded RustFS),
+     * NOT to Velero — CNPG barman is the backup path.
+     */
+    backup?: DatabaseProps['backup'];
+    /**
+     * Number of replicas. Defaults to 1 with strategy Recreate: Outline runs
+     * DB migrations at boot and two concurrent migrating pods corrupt state.
+     * Scale via WEB_CONCURRENCY inside the pod instead.
+     */
+    replicas?: number;
+    /** Provision a standalone Redis (caching + websockets) — default on */
+    cache?: boolean;
+    /** Redis shape (standalone by facit default; opt out with cache: false) */
+    redis?: {
+        /** Redis image (default 'redis:7.0.12') */
+        image?: string;
+        /** PVC size (default '1Gi') */
+        storage?: string;
+        /** storageClassName (default cluster default) */
+        storageClass?: string;
+        /** Promote metrics via redis-exporter sidecar (default true) */
+        exporter?: boolean;
+    };
+    /**
+     * S3-compatible object storage for attachments (RustFS in the platform).
+     * Reference a bucket whose credentials live in a Secret provisioned by
+     * the secrets backend (keys: accessKey, secretKey) — never plaintext.
+     */
+    objectStorage?: {
+        /** S3 endpoint URL, e.g. https://s3.internal.example.com */
+        endpoint: string;
+        /** Bucket name for attachments */
+        bucket: string;
+        /** Name of the Secret holding accessKey / secretKey */
+        credentialsSecret: string;
+        /** Region string for Outline's S3 client (defaults to 'us-east-1') */
+        region?: string;
+    };
+    /**
+     * OIDC SSO client — register Outline as a client in Keycloak (the
+     * Auth recipe). With a secrets backend, client id/secret are taken
+     * from the provisioned bundle (keys oidc_client_id/oidc_client_secret)
+     * unless clientSecretRef is given.
+     */
+    sso?: {
+        issuer: string;
+        /** Optional when the backend bundle carries oidc_client_id */
+        clientId?: string;
+        /** Optional when the backend bundle carries oidc_client_secret */
+        clientSecretRef?: SecretRef;
+        scopes?: string;
+        /** OIDC_DISPLAY_NAME — login-button label (default 'SSO') */
+        displayName?: string;
+        /** OIDC_USERNAME_CLAIM (default 'preferred_username') */
+        usernameClaim?: string;
+        /** OIDC_LOGOUT_URI — optional full logout URL */
+        logoutUri?: string;
+    };
+    /**
+     * Name of an existing Secret holding `SECRET_KEY`/`UTILS_SECRET`
+     * (and OIDC_* when using bundled SSO). Required unless a secrets
+     * backend (openbao/vault) is configured on the surrounding
+     * Platform — the backend then provisions them.
+     */
+    secretsName?: string;
+    /** Requested resources */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+    /** Extra env for the app container (merged last — escape hatch) */
+    env?: Record<string, string>;
+    /** Extra annotations merged onto the Endpoint */
+    endpointAnnotations?: Record<string, string>;
+    /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * Outline — team wiki with Postgres, Redis, S3 attachments and OIDC SSO.
+ *
+ * @title Outline
+ * @category Knowledge & Documentation
+ *
+ * Composes:
+ * - CNPG Postgres cluster (documents, revisions, users)
+ * - Redis cluster for queue + rate limiting (default on)
+ * - Outline Deployment + Service + Endpoint
+ * - S3/RustFS bucket reference for attachments
+ * - SECRET_KEY / UTILS_SECRET provisioned by the Platform secrets
+ *   backend (openbao / vault), or referenced from an existing Secret
+ * - OIDC SSO against the Keycloak `Auth` recipe
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Outline } from '@r8s/outline'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <Outline
+ *       name="wiki"
+ *       host="wiki.example.com"
+ *       objectStorage={{
+ *         endpoint: 'https://s3.internal.example.com',
+ *         bucket: 'wiki-attachments',
+ *         credentialsSecret: 'wiki-attachments-credentials',
+ *       }}
+ *       sso={{
+ *         issuer: 'https://keycloak.example.com/realms/platform',
+ *         clientId: 'outline',
+ *         clientSecretRef: { secret: 'outline-sso', key: 'clientSecret' },
+ *       }}
+ *     />
+ *   </Platform>
+ * )
+ */
+export declare function Outline(props: OutlineProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QACN,2CAA2C;QAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,+BAA+B;QAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,iDAAiD;QACjD,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,gEAAgE;QAChE,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;IACD;;;;OAIG;IACH,aAAa,CAAC,EAAE;QACd,4DAA4D;QAC5D,QAAQ,EAAE,MAAM,CAAA;QAChB,kCAAkC;QAClC,MAAM,EAAE,MAAM,CAAA;QACd,uDAAuD;QACvD,iBAAiB,EAAE,MAAM,CAAA;QACzB,sEAAsE;QACtE,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;IACD;;;;;OAKG;IACH,GAAG,CAAC,EAAE;QACJ,MAAM,EAAE,MAAM,CAAA;QACd,8DAA8D;QAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,kEAAkE;QAClE,eAAe,CAAC,EAAE,SAAS,CAAA;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,yDAAyD;QACzD,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,iDAAiD;QACjD,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0BAA0B;IAC1B,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5C,sEAAsE;IACtE,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,kCAwQ1C"}

package/dist/index.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Outline = Outline;
+const jsx_runtime_1 = require("@r8s/core/jsx-runtime");
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+/**
+ * Outline — team wiki with Postgres, Redis, S3 attachments and OIDC SSO.
+ *
+ * @title Outline
+ * @category Knowledge & Documentation
+ *
+ * Composes:
+ * - CNPG Postgres cluster (documents, revisions, users)
+ * - Redis cluster for queue + rate limiting (default on)
+ * - Outline Deployment + Service + Endpoint
+ * - S3/RustFS bucket reference for attachments
+ * - SECRET_KEY / UTILS_SECRET provisioned by the Platform secrets
+ *   backend (openbao / vault), or referenced from an existing Secret
+ * - OIDC SSO against the Keycloak `Auth` recipe
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Outline } from '@r8s/outline'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <Outline
+ *       name="wiki"
+ *       host="wiki.example.com"
+ *       objectStorage={{
+ *         endpoint: 'https://s3.internal.example.com',
+ *         bucket: 'wiki-attachments',
+ *         credentialsSecret: 'wiki-attachments-credentials',
+ *       }}
+ *       sso={{
+ *         issuer: 'https://keycloak.example.com/realms/platform',
+ *         clientId: 'outline',
+ *         clientSecretRef: { secret: 'outline-sso', key: 'clientSecret' },
+ *       }}
+ *     />
+ *   </Platform>
+ * )
+ */
+function Outline(props) {
+    const { name = 'outline', namespace: namespaceProp, version = '1.9.2', host, storage = '20Gi', instances = 2, backup, replicas = 1, cache = true, redis = {}, objectStorage, sso, secretsName, resources = {
+        requests: { memory: '512Mi', cpu: '250m' },
+        limits: { memory: '2Gi', cpu: '1000m' },
+    }, env: extraEnv = {}, endpointAnnotations = {}, tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const sharedOperators = (0, recipes_1.useOperators)();
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const resources_ = [];
+    const dbHost = `${name}-rw`;
+    const dbCredentialsName = `${name}-db-credentials`;
+    const platformSecretsName = secretsName ?? `${name}-app-secrets`;
+    // --- App secrets (SECRET_KEY / UTILS_SECRET) ------------------------------
+    if (!secretsName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Outline', name, 'application secrets (SECRET_KEY, UTILS_SECRET)', {
+                propName: 'secretsName',
+                exampleValue: `${name}-app-secrets`,
+                keys: ['SECRET_KEY', 'UTILS_SECRET'],
+            });
+        }
+        // Facit bundle: vault keys are snake_case, the destination carries
+        // env-case names so Outline reads SECRET_KEY/UTILS_SECRET/OIDC_* directly.
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-secrets`,
+            namespace,
+            path: `${secretProvider.path ?? name}/${name}/app`,
+            secretName: platformSecretsName,
+            // Facit interval; rotation of SECRET_KEY/OIDC invalidates sessions —
+            // restart the single Deployment so the pod re-reads fresh values
+            refreshAfter: '3600s',
+            keys: {
+                SECRET_KEY: 'secret_key',
+                UTILS_SECRET: 'utils_secret',
+                ...(sso
+                    ? { OIDC_CLIENT_ID: 'oidc_client_id', OIDC_CLIENT_SECRET: 'oidc_client_secret' }
+                    : {}),
+            },
+            restart: [{ kind: 'Deployment', name }],
+        }));
+    }
+    // --- Operators -------------------------------------------------------------
+    if (cache) {
+        resources_.push(...(0, recipes_1.maybeOperator)('redis-operator', sharedOperators));
+    }
+    // Redis — caching + websockets. Standalone is the facit shape: durable via
+    // a 1Gi PVC, observable via the exporter sidecar, sized 100m/256Mi→250m/512Mi.
+    // (A Replication topology exists for durable queues; Outline's cache can
+    // simply rebuild after pod loss — no need to spend three pods here.)
+    if (cache) {
+        const exporter = redis.exporter ?? true;
+        resources_.push((0, core_1.jsx)('Redis', {
+            apiVersion: 'redis.redis.opstreelabs.in/v1beta2',
+            kind: 'Redis',
+            metadata: {
+                name: `${name}-redis`,
+                namespace,
+                // Scrape annotations only make sense when the exporter sidecar runs
+                ...(exporter
+                    ? {
+                        annotations: {
+                            'prometheus.io/scrape': 'true',
+                            'prometheus.io/port': '9121',
+                        },
+                    }
+                    : {}),
+            },
+            spec: {
+                kubernetesConfig: {
+                    image: redis.image ?? 'redis:7.0.12',
+                    imagePullPolicy: 'IfNotPresent',
+                    resources: {
+                        requests: { cpu: '100m', memory: '256Mi' },
+                        limits: { cpu: '250m', memory: '512Mi' },
+                    },
+                },
+                storage: {
+                    volumeClaimTemplate: {
+                        spec: {
+                            accessModes: ['ReadWriteOnce'],
+                            resources: { requests: { storage: redis.storage ?? '1Gi' } },
+                            ...(redis.storageClass ? { storageClassName: redis.storageClass } : {}),
+                        },
+                    },
+                },
+                ...(exporter
+                    ? {
+                        redisExporter: {
+                            enabled: true,
+                            image: 'quay.io/opstree/redis-exporter:v1.44.0',
+                            resources: {
+                                requests: { cpu: '50m', memory: '64Mi' },
+                                limits: { cpu: '100m', memory: '128Mi' },
+                            },
+                        },
+                    }
+                    : {}),
+            },
+        }));
+    }
+    // --- Env wiring --------------------------------------------------------------
+    // Every credential is referenced with $(VAR) expansion or secretKeyRef —
+    // no plaintext in the manifest. The WebService declares secret-backed
+    // vars before plain env vars, so dependent expansion resolves.
+    const env = {
+        NODE_ENV: 'production',
+        PORT: '3000',
+        HOST: '0.0.0.0',
+        // One in-process worker: scaling happens via WEB_CONCURRENCY/resources
+        // inside the pod, while replicas stays 1 (boot-time DB migrations must
+        // never run concurrently — see the Recreate strategy)
+        WEB_CONCURRENCY: '1',
+        // Deterministic parts inlined; password arrives via PGPASSWORD
+        DATABASE_URL: `postgresql://${name}:$(PGPASSWORD)@${dbHost}:5432/${name}`,
+        // Outline (Sequelize) cannot do SSL to the in-cluster CNPG service
+        PGSSLMODE: 'disable',
+        SECRET_KEY: '$(SECRET_KEY)',
+        UTILS_SECRET: '$(UTILS_SECRET)',
+        URL: `https://${host}`,
+        FORCE_HTTPS: 'true',
+        RATE_LIMITER_ENABLED: 'true',
+        // Self-hosted: no in-app upgrade prompts (image is pinned + deliberate)
+        ENABLE_UPDATES: 'false',
+        LOG_LEVEL: 'info',
+        ...(cache ? { REDIS_URL: `redis://${name}-redis:6379` } : {}),
+        ...(objectStorage
+            ? {
+                FILE_STORAGE: 's3',
+                AWS_REGION: objectStorage.region ?? 'us-east-1',
+                // Facit semantics: this is the ENDPOINT only, not endpoint/bucket
+                AWS_S3_UPLOAD_BUCKET_URL: objectStorage.endpoint,
+                AWS_S3_UPLOAD_BUCKET_NAME: objectStorage.bucket,
+                AWS_S3_FORCE_PATH_STYLE: 'true',
+                AWS_S3_ACL: 'private',
+            }
+            : {}),
+        ...(sso
+            ? {
+                OIDC_DISPLAY_NAME: sso.displayName ?? 'SSO',
+                OIDC_USERNAME_CLAIM: sso.usernameClaim ?? 'preferred_username',
+                OIDC_ISSUER: sso.issuer,
+                // OIDC_CLIENT_ID/SECRET arrive via secretKeyRef (below) unless a
+                // literal clientId is given — no duplicating expansion vars
+                ...(sso.clientId ? { OIDC_CLIENT_ID: sso.clientId } : {}),
+                OIDC_SCOPES: sso.scopes ?? 'openid email profile',
+                OIDC_AUTH_URI: '$(OIDC_ISSUER)/protocol/openid-connect/auth',
+                OIDC_TOKEN_URI: '$(OIDC_ISSUER)/protocol/openid-connect/token',
+                OIDC_USERINFO_URI: '$(OIDC_ISSUER)/protocol/openid-connect/userinfo',
+                ...(sso.logoutUri ? { OIDC_LOGOUT_URI: sso.logoutUri } : {}),
+            }
+            : {}),
+        ...extraEnv,
+    };
+    // Credentials delivered via secretKeyRef (runtime injection). OIDC reads
+    // from the bundle unless an explicit clientSecretRef is given (a
+    // user-supplied secretsName Secret is expected to carry the same keys).
+    const secrets = {
+        SECRET_KEY: { secret: platformSecretsName, key: 'SECRET_KEY' },
+        UTILS_SECRET: { secret: platformSecretsName, key: 'UTILS_SECRET' },
+        PGPASSWORD: { secret: dbCredentialsName, key: 'password' },
+        ...(objectStorage
+            ? {
+                AWS_ACCESS_KEY_ID: { secret: objectStorage.credentialsSecret, key: 'accessKey' },
+                AWS_SECRET_ACCESS_KEY: { secret: objectStorage.credentialsSecret, key: 'secretKey' },
+            }
+            : {}),
+        ...(sso
+            ? {
+                OIDC_CLIENT_SECRET: sso.clientSecretRef ?? {
+                    secret: platformSecretsName,
+                    key: 'OIDC_CLIENT_SECRET',
+                },
+                ...(!sso.clientId
+                    ? { OIDC_CLIENT_ID: { secret: platformSecretsName, key: 'OIDC_CLIENT_ID' } }
+                    : {}),
+            }
+            : {}),
+    };
+    // --- Database + app + endpoint ------------------------------------------------
+    // Database wraps the app so credentials stay consistent with the r8s
+    // Database recipe (CNPG dedicated cluster provisions the secret).
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        name,
+        namespace,
+        storage,
+        instances,
+        ...(backup ? { backup } : {}),
+        children: ((0, jsx_runtime_1.jsx)(recipes_1.WebService, { name: name, namespace: namespace, image: `docker.getoutline.com/outlinewiki/outline:${version}`, port: 3000, replicas: replicas, 
+            // DB migrations run at boot — never run two migrating pods at once
+            strategy: "Recreate", resources: resources, probes: {
+                // Outline boots slowly (assets + migrations): facit probe timings
+                readiness: { tcp: true, initialDelaySeconds: 30, failureThreshold: 6 },
+                liveness: { tcp: true, initialDelaySeconds: 90, periodSeconds: 30 },
+            }, env: env, secrets: secrets })),
+    }));
+    resources_.push((0, jsx_runtime_1.jsx)(recipes_1.Endpoint, { name: `${name}-endpoint`, namespace: namespace, host: host, serviceName: name, servicePort: 3000, tls: tls, annotations: {
+            // Websockets keep realtime-collab connections open — facit sets 1h
+            'nginx.ingress.kubernetes.io/proxy-read-timeout': '3600',
+            'nginx.ingress.kubernetes.io/proxy-send-timeout': '3600',
+            ...endpointAnnotations,
+        } }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AAyJA,0BAwQC;;AAjaD,oCAAqD;AACrD,iDAAgE;AAChE,0CAUqB;AAuGrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,SAAgB,OAAO,CAAC,KAAmB;IACzC,MAAM,EACJ,IAAI,GAAG,SAAS,EAChB,SAAS,EAAE,aAAa,EACxB,OAAO,GAAG,OAAO,EACjB,IAAI,EACJ,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,CAAC,EACb,MAAM,EACN,QAAQ,GAAG,CAAC,EACZ,KAAK,GAAG,IAAI,EACZ,KAAK,GAAG,EAAE,EACV,aAAa,EACb,GAAG,EACH,WAAW,EACX,SAAS,GAAG;QACV,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;QAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;KACxC,EACD,GAAG,EAAE,QAAQ,GAAG,EAAE,EAClB,mBAAmB,GAAG,EAAE,EACxB,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACvE,GAAG,KAAK,CAAA;IAET,MAAM,eAAe,GAAG,IAAA,sBAAY,GAAE,CAAA;IACtC,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,CAAA;IAC3B,MAAM,iBAAiB,GAAG,GAAG,IAAI,iBAAiB,CAAA;IAClD,MAAM,mBAAmB,GAAG,WAAW,IAAI,GAAG,IAAI,cAAc,CAAA;IAEhE,6EAA6E;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,SAAS,EACT,IAAI,EACJ,gDAAgD,EAChD;gBACE,QAAQ,EAAE,aAAa;gBACvB,YAAY,EAAE,GAAG,IAAI,cAAc;gBACnC,IAAI,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC;aACrC,CACF,CAAA;QACH,CAAC;QAED,mEAAmE;QACnE,2EAA2E;QAC3E,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,UAAU;YACvB,SAAS;YACT,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM;YAClD,UAAU,EAAE,mBAAmB;YAC/B,qEAAqE;YACrE,iEAAiE;YACjE,YAAY,EAAE,OAAO;YACrB,IAAI,EAAE;gBACJ,UAAU,EAAE,YAAY;gBACxB,YAAY,EAAE,cAAc;gBAC5B,GAAG,CAAC,GAAG;oBACL,CAAC,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;oBAChF,CAAC,CAAC,EAAE,CAAC;aACR;YACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CACH,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,IAAI,CAAC,GAAG,IAAA,uBAAa,EAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAA;IACtE,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,qEAAqE;IACrE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAA;QACvC,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,OAAO,EAAE;YACX,UAAU,EAAE,oCAAoC;YAChD,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,IAAI,QAAQ;gBACrB,SAAS;gBACT,oEAAoE;gBACpE,GAAG,CAAC,QAAQ;oBACV,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,sBAAsB,EAAE,MAAM;4BAC9B,oBAAoB,EAAE,MAAM;yBAC7B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,IAAI,EAAE;gBACJ,gBAAgB,EAAE;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,cAAc;oBACpC,eAAe,EAAE,cAAc;oBAC/B,SAAS,EAAE;wBACT,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;wBAC1C,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;qBACzC;iBACF;gBACD,OAAO,EAAE;oBACP,mBAAmB,EAAE;wBACnB,IAAI,EAAE;4BACJ,WAAW,EAAE,CAAC,eAAe,CAAC;4BAC9B,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,EAAE,EAAE;4BAC5D,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACxE;qBACF;iBACF;gBACD,GAAG,CAAC,QAAQ;oBACV,CAAC,CAAC;wBACE,aAAa,EAAE;4BACb,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE,wCAAwC;4BAC/C,SAAS,EAAE;gCACT,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;gCACxC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;6BACzC;yBACF;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,MAAM,GAAG,GAA2B;QAClC,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,uEAAuE;QACvE,uEAAuE;QACvE,sDAAsD;QACtD,eAAe,EAAE,GAAG;QACpB,+DAA+D;QAC/D,YAAY,EAAE,gBAAgB,IAAI,kBAAkB,MAAM,SAAS,IAAI,EAAE;QACzE,mEAAmE;QACnE,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,GAAG,EAAE,WAAW,IAAI,EAAE;QACtB,WAAW,EAAE,MAAM;QACnB,oBAAoB,EAAE,MAAM;QAC5B,wEAAwE;QACxE,cAAc,EAAE,OAAO;QACvB,SAAS,EAAE,MAAM;QACjB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,aAAa;YACf,CAAC,CAAC;gBACE,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,aAAa,CAAC,MAAM,IAAI,WAAW;gBAC/C,kEAAkE;gBAClE,wBAAwB,EAAE,aAAa,CAAC,QAAQ;gBAChD,yBAAyB,EAAE,aAAa,CAAC,MAAM;gBAC/C,uBAAuB,EAAE,MAAM;gBAC/B,UAAU,EAAE,SAAS;aACtB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG;YACL,CAAC,CAAC;gBACE,iBAAiB,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;gBAC3C,mBAAmB,EAAE,GAAG,CAAC,aAAa,IAAI,oBAAoB;gBAC9D,WAAW,EAAE,GAAG,CAAC,MAAM;gBACvB,iEAAiE;gBACjE,4DAA4D;gBAC5D,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,WAAW,EAAE,GAAG,CAAC,MAAM,IAAI,sBAAsB;gBACjD,aAAa,EAAE,6CAA6C;gBAC5D,cAAc,EAAE,8CAA8C;gBAC9D,iBAAiB,EAAE,iDAAiD;gBACpE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,QAAQ;KACZ,CAAA;IAED,yEAAyE;IACzE,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,OAAO,GAAuC;QAClD,UAAU,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,EAAE;QAC9D,YAAY,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,EAAE;QAClE,UAAU,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,UAAU,EAAE;QAC1D,GAAG,CAAC,aAAa;YACf,CAAC,CAAC;gBACE,iBAAiB,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,WAAW,EAAE;gBAChF,qBAAqB,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,WAAW,EAAE;aACrF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG;YACL,CAAC,CAAC;gBACE,kBAAkB,EAAE,GAAG,CAAC,eAAe,IAAI;oBACzC,MAAM,EAAE,mBAAmB;oBAC3B,GAAG,EAAE,oBAAoB;iBAC1B;gBACD,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACf,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;oBAC5E,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,iFAAiF;IACjF,qEAAqE;IACrE,kEAAkE;IAClE,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI;QACJ,SAAS;QACT,OAAO;QACP,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,QAAQ,EAAE,CACR,uBAAC,oBAAU,IACT,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,6CAA6C,OAAO,EAAE,EAC7D,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ;YAClB,mEAAmE;YACnE,QAAQ,EAAC,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE;gBACN,kEAAkE;gBAClE,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;gBACtE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;aACpE,EACD,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,GAChB,CACH;KACF,CAAC,CACH,CAAA;IAED,UAAU,CAAC,IAAI,CACb,uBAAC,kBAAQ,IACP,IAAI,EAAE,GAAG,IAAI,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,IAAI,EACjB,WAAW,EAAE,IAAI,EACjB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;YACX,mEAAmE;YACnE,gDAAgD,EAAE,MAAM;YACxD,gDAAgD,EAAE,MAAM;YACxD,GAAG,mBAAmB;SACvB,GACD,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/outline",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Outline wiki — Postgres persistence, Redis queue, S3 attachments, OIDC SSO via Keycloak",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -37,5 +37,8 @@
   "devDependencies": {
     "typescript": "^5.3.0",
     "vitest": "^1.0.0"
-  }
+  },
+  "files": [
+    "dist"
+  ]
 }

package/__tests__/outline.test.ts

@@ -1,213 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { render, jsx } from '@r8s/core'
-import { OperatorContext, SecretContext, RoutingContext } from '@r8s/core/defaults'
-import { runGuardrails, noPlaintextSecrets, validateResource } from '@r8s/core'
-import { operators } from '@r8s/crds'
-import type { r8sElement } from '@r8s/core'
-
-// Outline recipe tests:
-//   1. Operator declarations (deduped via OperatorContext)
-//   2. Rendering: defaults, all props, gateway/ingress adaptation
-//   3. Security: no plaintext credentials in rendered output
-import { Outline } from '../src/index'
-
-const openbao = { backend: 'openbao', mount: 'kv', path: 'test' }
-
-/** Render Outline inside a Platform-like secrets backend (OpenBao). */
-function renderOutline(props: Record<string, unknown>): ReturnType<typeof render> {
-  return render(
-    jsx(SecretContext.Provider, {
-      value: openbao as never,
-      children: jsx(Outline, props as never),
-    })
-  )
-}
-
-/** Wrap Outline in an OperatorContext (no secrets backend). */
-function elementWithContext(ops: any[], props: Record<string, unknown>): r8sElement {
-  return jsx(OperatorContext.Provider, {
-    value: ops,
-    children: jsx(Outline, props as never),
-  })
-}
-
-const objectStorage = {
-  endpoint: 'https://s3.internal.example.com',
-  bucket: 'wiki-attachments',
-  credentialsSecret: 'wiki-attachments-credentials',
-}
-
-const sso = {
-  issuer: 'https://keycloak.example.com/realms/platform',
-  clientId: 'outline',
-  clientSecretRef: { secret: 'outline-sso', key: 'clientSecret' },
-}
-
-describe('operator declarations', () => {
-  it('declares the redis operator when cache is enabled', () => {
-    const result = renderOutline({ host: 'wiki.example.com' })
-    expect(result.operators.some((op) => op.name === 'redis-operator')).toBe(true)
-  })
-
-  it('declares the cnpg operator via the Database recipe', () => {
-    const result = renderOutline({ host: 'wiki.example.com' })
-    expect(result.operators.some((op) => op.name === 'cnpg')).toBe(true)
-  })
-
-  it('skips the redis operator when cache is disabled', () => {
-    const result = renderOutline({ host: 'wiki.example.com', cache: false })
-    expect(result.operators.some((op) => op.name === 'redis-operator')).toBe(false)
-  })
-
-  it('deduplicates operators provided via context', () => {
-    const result = render(
-      elementWithContext([operators['redis-operator'](), operators['cnpg']()], {
-        host: 'wiki.example.com',
-        secretsName: 'existing-secrets',
-      })
-    )
-    const names = result.operators.map((op) => op.name)
-    expect(names.filter((n) => n === 'redis-operator')).toHaveLength(1)
-    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
-  })
-})
-
-describe('rendering defaults', () => {
-  it('renders deployment, service, ingress, database and redis', () => {
-    const result = renderOutline({ host: 'wiki.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('Deployment')
-    expect(kinds).toContain('Service')
-    expect(kinds).toContain('Ingress')
-    expect(kinds).toContain('Cluster')
-    expect(kinds).toContain('RedisReplication')
-  })
-
-  it('renders gateway resources when platform uses gateway routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'gateway', gatewayClassName: 'eg' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(Outline, { host: 'wiki.example.com' }),
-        }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('HTTPRoute')
-  })
-
-  it('renders a valid Ingress when platform uses ingress routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'ingress' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(Outline, { host: 'wiki.example.com' }),
-        }),
-      })
-    )
-    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
-    expect(ingress).toBeDefined()
-    expect(ingress.spec.rules[0].host).toBe('wiki.example.com')
-  })
-
-  it('passes resource validation', () => {
-    const result = renderOutline({
-      host: 'wiki.example.com',
-      objectStorage,
-      sso,
-    })
-    for (const resource of result.resources) {
-      expect(validateResource(resource)).toEqual([])
-    }
-  })
-})
-
-describe('rendering with all props', () => {
-  it('accepts the full prop surface', () => {
-    const result = renderOutline({
-      name: 'wiki',
-      namespace: 'docs',
-      version: '0.78.0',
-      host: 'docs.example.com',
-      replicas: 3,
-      objectStorage: { ...objectStorage, bucket: 'docs' },
-      sso,
-      resources: {
-        requests: { memory: '1Gi', cpu: '500m' },
-        limits: { memory: '4Gi', cpu: '2000m' },
-      },
-      tls: { secretName: 'docs-tls', clusterIssuer: 'letsencrypt-prod' },
-    })
-
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'wiki'
-    ) as any
-    expect(app).toBeDefined()
-    expect(app.spec.replicas).toBe(3)
-    expect(app.spec.template.spec.containers[0].image).toContain('0.78.0')
-    expect(app.spec.template.spec.containers[0].resources.limits.memory).toBe('4Gi')
-  })
-
-  it('wires S3 and SSO on the app when configured', () => {
-    const result = renderOutline({
-      host: 'wiki.example.com',
-      objectStorage,
-      sso,
-    })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'outline'
-    ) as any
-    const env = app.spec.template.spec.containers[0].env
-    expect(env.find((e: any) => e.name === 'AWS_S3_UPLOAD_BUCKET_NAME').value).toBe(
-      'wiki-attachments'
-    )
-    expect(env.find((e: any) => e.name === 'OIDC_ISSUER').value).toBe(sso.issuer)
-  })
-})
-
-describe('secrets handling', () => {
-  it('provisions app secrets through a secrets backend', () => {
-    const result = renderOutline({ host: 'wiki.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('OpenBaoStaticSecret')
-  })
-
-  it('throws when no secrets backend and no secretsName', () => {
-    expect(() => render(jsx(Outline, { host: 'wiki.example.com' }))).toThrow(/application secrets/)
-  })
-
-  it('accepts an existing secretsName without a backend', () => {
-    expect(() =>
-      render(jsx(Outline, { host: 'wiki.example.com', secretsName: 'existing-secrets' }))
-    ).not.toThrow()
-  })
-
-  it('wires credentials via secretKeyRef (never plaintext env)', () => {
-    const result = renderOutline({ host: 'wiki.example.com', secretsName: 'existing-secrets' })
-    const app = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'outline'
-    ) as any
-    const env = app.spec.template.spec.containers[0].env
-    const secretKey = env.find((e: any) => e.name === 'SECRET_KEY')
-    const pgPassword = env.find((e: any) => e.name === 'PGPASSWORD')
-    expect(secretKey.valueFrom.secretKeyRef.name).toBe('existing-secrets')
-    expect(pgPassword.valueFrom.secretKeyRef.name).toBe('outline-db-credentials')
-    expect(secretKey.value).toBeUndefined()
-    expect(pgPassword.value).toBeUndefined()
-  })
-
-  it('renders no plaintext credentials anywhere', () => {
-    const result = renderOutline({
-      host: 'wiki.example.com',
-      objectStorage,
-      sso,
-    })
-    const { passed, errors } = runGuardrails(result.resources as any[], [noPlaintextSecrets])
-    if (!passed) {
-      console.error('Plaintext credential violations:', errors)
-    }
-    expect(passed).toBe(true)
-  })
-})

package/examples/basic.tsx

@@ -1,21 +0,0 @@
-import { Platform } from '@r8s/recipes'
-import { Outline } from '@r8s/outline'
-
-export default (
-  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
-    <Outline
-      name="wiki"
-      host="wiki.example.com"
-      objectStorage={{
-        endpoint: 'https://s3.internal.example.com',
-        bucket: 'wiki-attachments',
-        credentialsSecret: 'wiki-attachments-credentials',
-      }}
-      sso={{
-        issuer: 'https://keycloak.example.com/realms/platform',
-        clientId: 'outline',
-        clientSecretRef: { secret: 'outline-sso', key: 'clientSecret' },
-      }}
-    />
-  </Platform>
-)

package/src/index.tsx

@@ -1,289 +0,0 @@
-import { jsx, Fragment, useContext, declareOperator } from '@r8s/core'
-import { Namespace, OperatorContext, SecretContext } from '@r8s/core/defaults'
-import { operators } from '@r8s/crds'
-import { Database, WebService, Endpoint } from '@r8s/recipes'
-import { RedisReplicationComponent } from '@r8s/crds/redis'
-import type { SecretRef } from '@r8s/recipes'
-
-export interface OutlineProps {
-  /** Resource name (defaults to 'outline') */
-  name?: string
-  /** Kubernetes namespace (defaults to 'default') */
-  namespace?: string
-  /** Container image tag (defaults to 'latest' — pin a version in production) */
-  version?: string
-  /** Public hostname for the wiki */
-  host: string
-  /** Storage request for the CNPG Postgres cluster (defaults to '10Gi') */
-  storage?: string
-  /** Number of replicas (Outline is stateless — scale freely) */
-  replicas?: number
-  /** Provision a Redis cluster for the queue and rate limiting (default: true) */
-  cache?: boolean
-  /**
-   * S3-compatible object storage for attachments (RustFS in the platform).
-   * Reference a bucket whose credentials live in a Secret provisioned by
-   * the secrets backend (keys: accessKey, secretKey) — never plaintext.
-   */
-  objectStorage?: {
-    /** S3 endpoint URL, e.g. https://s3.internal.example.com */
-    endpoint: string
-    /** Bucket name for attachments */
-    bucket: string
-    /** Name of the Secret holding accessKey / secretKey */
-    credentialsSecret: string
-    /** Region string for Outline's S3 client (defaults to 'us-east-1') */
-    region?: string
-  }
-  /**
-   * OIDC SSO client — register Outline as a client in Keycloak (the
-   * Auth recipe) and reference the client secret through the backend.
-   */
-  sso?: {
-    issuer: string
-    clientId: string
-    clientSecretRef: SecretRef
-    scopes?: string
-  }
-  /**
-   * Name of an existing Secret holding `secretKey` and `utilsSecret`.
-   * Required unless a secrets backend (openbao/vault) is configured on
-   * the surrounding Platform — the backend then provisions them.
-   */
-  secretsName?: string
-  /** Requested resources */
-  resources?: {
-    requests?: { cpu?: string; memory?: string }
-    limits?: { cpu?: string; memory?: string }
-  }
-  /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
-  tls?: {
-    secretName: string
-    clusterIssuer: string
-  }
-}
-
-const OPERATOR_REDIS = 'redis-operator'
-
-/**
- * Outline — team wiki with Postgres, Redis, S3 attachments and OIDC SSO.
- *
- * @title Outline
- * @category Knowledge & Documentation
- *
- * Composes:
- * - CNPG Postgres cluster (documents, revisions, users)
- * - Redis cluster for queue + rate limiting (default on)
- * - Outline Deployment + Service + Endpoint
- * - S3/RustFS bucket reference for attachments
- * - SECRET_KEY / UTILS_SECRET provisioned by the Platform secrets
- *   backend (openbao / vault), or referenced from an existing Secret
- * - OIDC SSO against the Keycloak `Auth` recipe
- *
- * @example
- * import { Platform } from '@r8s/recipes'
- * import { Outline } from '@r8s/outline'
- *
- * export default (
- *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
- *     <Outline
- *       name="wiki"
- *       host="wiki.example.com"
- *       objectStorage={{
- *         endpoint: 'https://s3.internal.example.com',
- *         bucket: 'wiki-attachments',
- *         credentialsSecret: 'wiki-attachments-credentials',
- *       }}
- *       sso={{
- *         issuer: 'https://keycloak.example.com/realms/platform',
- *         clientId: 'outline',
- *         clientSecretRef: { secret: 'outline-sso', key: 'clientSecret' },
- *       }}
- *     />
- *   </Platform>
- * )
- */
-export function Outline(props: OutlineProps) {
-  const {
-    name = 'outline',
-    namespace: namespaceProp,
-    version = 'latest',
-    host,
-    storage = '10Gi',
-    replicas = 1,
-    cache = true,
-    objectStorage,
-    sso,
-    secretsName,
-    resources = {
-      requests: { memory: '512Mi', cpu: '250m' },
-      limits: { memory: '2Gi', cpu: '1000m' },
-    },
-    tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' },
-  } = props
-
-  const sharedOperators = useContext(OperatorContext)
-  const secretProvider = useContext(SecretContext)
-  // Inherit namespace from <Platform> context — mirrors recipes/database.tsx
-  const contextNamespace = useContext(Namespace)
-  const namespace =
-    namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default'
-  const resources_: ReturnType<typeof jsx>[] = []
-
-  const dbHost = `${name}-rw`
-  const dbCredentialsName = `${name}-db-credentials`
-  const platformSecretsName = secretsName ?? `${name}-app-secrets`
-
-  // --- App secrets (SECRET_KEY / UTILS_SECRET) ------------------------------
-  if (!secretsName) {
-    if (
-      !secretProvider ||
-      (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')
-    ) {
-      throw new Error(
-        `Outline "${name}" requires application secrets (SECRET_KEY, UTILS_SECRET).\n` +
-          `\n` +
-          `These must not be rendered as plaintext.\n` +
-          `\n` +
-          `Fix: configure a secrets backend on the Platform:\n` +
-          `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
-          `    <Outline name="${name}" host="${host}" />\n` +
-          `  </Platform>\n` +
-          `\n` +
-          `Or reference a pre-created Secret (keys: secretKey, utilsSecret):\n` +
-          `  <Outline name="${name}" host="${host}" secretsName="${name}-app-secrets" />`
-      )
-    }
-
-    const spec = {
-      ...(secretProvider.backend === 'vault'
-        ? { vaultAuthRef: secretProvider.authRef }
-        : { openbaoAuthRef: secretProvider.authRef }),
-      mount: secretProvider.mount,
-      type: 'kv-v2' as const,
-      path: `${secretProvider.path ?? name}/${name}/secrets`,
-      destination: { create: true, name: platformSecretsName },
-    }
-    resources_.push(
-      secretProvider.backend === 'vault'
-        ? jsx('VaultStaticSecret', {
-            apiVersion: 'secrets.hashicorp.com/v1beta1',
-            kind: 'VaultStaticSecret',
-            metadata: { name: `${name}-secrets`, namespace },
-            spec,
-          })
-        : jsx('OpenBaoStaticSecret', {
-            apiVersion: 'secrets.openbao.org/v1beta1',
-            kind: 'OpenBaoStaticSecret',
-            metadata: { name: `${name}-secrets`, namespace },
-            spec,
-          })
-    )
-  }
-
-  // --- Operators -------------------------------------------------------------
-  if (cache && !sharedOperators.some((op) => op.name === OPERATOR_REDIS)) {
-    resources_.push(declareOperator(operators[OPERATOR_REDIS]()))
-  }
-
-  // Redis — queue + rate limiting (OT-Container-Kit operator)
-  if (cache) {
-    resources_.push(
-      RedisReplicationComponent({
-        metadata: { name: `${name}-redis`, namespace },
-        spec: {
-          clusterSize: 3,
-          kubernetesConfig: { image: 'redis:7.2-alpine' },
-        },
-      })
-    )
-  }
-
-  // --- Env wiring --------------------------------------------------------------
-  // Every credential is referenced with $(VAR) expansion or secretKeyRef —
-  // no plaintext in the manifest. The WebService declares secret-backed
-  // vars before plain env vars, so dependent expansion resolves.
-  const env: Record<string, string> = {
-    PORT: '3000',
-    // Deterministic parts inlined; password arrives via PGPASSWORD
-    DATABASE_URL: `postgresql://${name}:$(PGPASSWORD)@${dbHost}:5432/${name}`,
-    SECRET_KEY: '$(SECRET_KEY)',
-    UTILS_SECRET: '$(UTILS_SECRET)',
-    URL: `https://${host}`,
-    APP_URL: `https://${host}`,
-    PROXY_HEADERS_TRUSTED: 'true',
-    ...(cache ? { REDIS_URL: `redis://${name}-redis:6379` } : {}),
-    ...(objectStorage
-      ? {
-          FILE_STORAGE: 's3',
-          AWS_REGION: objectStorage.region ?? 'us-east-1',
-          AWS_S3_UPLOAD_BUCKET_URL: `${objectStorage.endpoint}/${objectStorage.bucket}`,
-          AWS_S3_UPLOAD_BUCKET_NAME: objectStorage.bucket,
-          AWS_S3_FORCE_PATH_STYLE: 'true',
-          AWS_S3_ACL: 'private',
-        }
-      : {}),
-    ...(sso
-      ? {
-          OIDC_ISSUER: sso.issuer,
-          OIDC_CLIENT_ID: sso.clientId,
-          OIDC_CLIENT_SECRET: '$(OIDC_CLIENT_SECRET)',
-          OIDC_SCOPES: sso.scopes ?? 'openid email profile',
-          OIDC_AUTH_URI: '$(OIDC_ISSUER)/protocol/openid-connect/auth',
-          OIDC_TOKEN_URI: '$(OIDC_ISSUER)/protocol/openid-connect/token',
-          OIDC_USERINFO_URI: '$(OIDC_ISSUER)/protocol/openid-connect/userinfo',
-        }
-      : {}),
-  }
-
-  // Credentials delivered via secretKeyRef (runtime injection)
-  const secrets: Record<string, SecretRef | string> = {
-    SECRET_KEY: { secret: platformSecretsName, key: 'secretKey' },
-    UTILS_SECRET: { secret: platformSecretsName, key: 'utilsSecret' },
-    PGPASSWORD: { secret: dbCredentialsName, key: 'password' },
-    ...(objectStorage
-      ? {
-          AWS_ACCESS_KEY_ID: { secret: objectStorage.credentialsSecret, key: 'accessKey' },
-          AWS_SECRET_ACCESS_KEY: { secret: objectStorage.credentialsSecret, key: 'secretKey' },
-        }
-      : {}),
-    ...(sso ? { OIDC_CLIENT_SECRET: sso.clientSecretRef } : {}),
-  }
-
-  // --- Database + app + endpoint ------------------------------------------------
-  // Database wraps the app so credentials stay consistent with the r8s
-  // Database recipe (CNPG dedicated cluster provisions the secret).
-  resources_.push(
-    jsx(Database, {
-      name,
-      namespace,
-      storage,
-      children: (
-        <WebService
-          name={name}
-          namespace={namespace}
-          image={`outlinewiki/outline:${version}`}
-          port={3000}
-          replicas={replicas}
-          resources={resources}
-          probes={{ liveness: { tcp: true }, readiness: { tcp: true, initialDelaySeconds: 15 } }}
-          env={env}
-          secrets={secrets}
-        />
-      ),
-    })
-  )
-
-  resources_.push(
-    <Endpoint
-      name={`${name}-endpoint`}
-      namespace={namespace}
-      host={host}
-      serviceName={name}
-      servicePort={3000}
-      tls={tls}
-    />
-  )
-
-  return jsx(Fragment, { children: resources_ })
-}

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": true
-  },
-  "include": ["src/**/*"],
-  "references": [
-    { "path": "../core" },
-    { "path": "../k8s-types" },
-    { "path": "../crds" },
-    { "path": "../recipes" }
-  ]
-}