@r8s/paperclip 0.2.0 → 0.2.1

package/dist/index.d.ts

@@ -0,0 +1,155 @@
+import { type DatabaseProps } from '@r8s/recipes';
+export interface PaperclipProps {
+    /** Resource name / Instance CR name (defaults to 'paperclip') */
+    name?: string;
+    /** Kubernetes namespace (inherited from <Platform> unless set) */
+    namespace?: string;
+    /**
+     * App image tag (defaults to 'sso-oidc' — the Berget fork branch build
+     * for SSO/OIDC work; a named moving tag, Always-pulled on purpose).
+     */
+    version?: string;
+    /** Image repository (defaults to the Berget fork) */
+    repository?: string;
+    /** Public hostname for the web app and API (required) */
+    host: string;
+    /**
+     * Manual image pull secrets for the private ghcr image (defaults to
+     * ['ghcr-pull-secret'] — a fine-grained PAT read:packages Secret that
+     * is deliberately managed OUTSIDE Flux: rotate it by delete+recreate)
+     */
+    pullSecrets?: string[];
+    /**
+     * Operator chart version for the paperclip-operator (defaults to
+     * '0.19.0'). The operator owns the StatefulSet/PVC/ingress/probes —
+     * the Instance CR is the entire app definition.
+     */
+    operatorVersion?: string;
+    /**
+     * CNPG cluster name holding paperclip's data (defaults to 'paperclip-db').
+     * Credentials are CNPG-managed: the Instance references the generated
+     * `<db>-app` secret's `fqdn-uri` key (requires CNPG ≥ 1.20).
+     */
+    dbName?: string;
+    /** Number of CNPG instances (defaults to 2) */
+    dbInstances?: number;
+    /** CNPG data volume size (defaults to '20Gi') */
+    dbStorage?: string;
+    /** CNPG storage class (defaults to cluster default) */
+    dbStorageClass?: string;
+    /** CNPG backup configuration passed through to the Database recipe (continuous WAL + scheduled base backups to Scaleway in facit) */
+    backup?: DatabaseProps['backup'];
+    /**
+     * App-native database backups (sql dumps on the persistence volume).
+     * Defaults to facit: enabled, hourly, 7 days retention.
+     */
+    appBackup?: {
+        enabled?: boolean;
+        intervalMinutes?: number;
+        retentionDays?: number;
+    } | false;
+    /**
+     * Operator-managed persistence volume at /paperclip (storage dir
+     * /paperclip/storage, native backups /paperclip/backups).
+     * Defaults to 10Gi; storageClass optional.
+     */
+    storage?: {
+        size?: string;
+        storageClass?: string;
+    } | false;
+    /** Heartbeat scheduler (defaults to facit: every 30s) */
+    heartbeat?: {
+        enabled?: boolean;
+        intervalMS?: number;
+    } | false;
+    /**
+     * LLM access via the Berget gateway. `baseUrl` defaults to
+     * https://api.berget.ai/v1. The API key is provisioned through the
+     * Platform secrets backend (path `<path>/<name>/berget-ai`, key
+     * `api-key`) unless `apiKeySecretName` references a pre-created
+     * Secret (key: api-key). Rotation restarts the StatefulSet.
+     */
+    llm?: {
+        baseUrl?: string;
+        path?: string;
+        refreshAfter?: string;
+    };
+    /** Reference a pre-created LLM API key Secret (key: api-key) instead of backend provisioning */
+    apiKeySecretName?: string;
+    /**
+     * Better Auth secret — session signing. Provisioned through the
+     * Platform secrets backend (path `<path>/<name>/app`, key
+     * `better-auth-secret`) unless `secretsName` references a pre-created
+     * Secret (key: better-auth-secret). Rotation restarts the StatefulSet.
+     */
+    auth?: {
+        path?: string;
+        refreshAfter?: string;
+        disableSignUp?: boolean;
+    };
+    /** Reference a pre-created app secrets bundle (key: better-auth-secret) instead of backend provisioning */
+    secretsName?: string;
+    /**
+     * Berget model catalog env vars (OPENCODE_CONFIG_CONTENT +
+     * PAPERCLIP_ADAPTER_MODELS) wiring Paperclip to the Berget gateway.
+     * Defaults to the facit catalog (Kimi K3/K2.6, GLM-5.2/4.7, GPT-OSS
+     * 120B, Mistral Medium/Small, Qwen3.8 27B, Gemma 4 31B). Pass `false`
+     * to omit both vars.
+     */
+    modelCatalog?: {
+        opencodeConfig?: string;
+        adapterModels?: string;
+    } | false;
+    /** Extra ingress annotations merged over the facit defaults (body-size 50m, 300s timeouts, ssl-redirect) */
+    ingressAnnotations?: Record<string, string>;
+    /** Additional hostnames accepted by the deployment (defaults to [host]) */
+    allowedHostnames?: string[];
+    /** Requested resources for the app StatefulSet (defaults to facit: 512Mi/250m → 12Gi/2) */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+    /** TLS secret for ingress (defaults to `${name}-tls` via letsencrypt-prod) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * Paperclip — Berget's agent platform (tasks, documents, agent orchestration),
+ * facit-aligned on the paperclip-operator.
+ *
+ * @title Paperclip
+ * @category Agent Platforms
+ *
+ * The operator owns the workload: app instance → StatefulSet with PVC,
+ * ingress, probes, security context, heartbeat and app-native backups.
+ * This package declares the operator and owns everything AROUND it:
+ * - the external CNPG cluster (`credentialsMode: 'cnpg'` — the Instance
+ *   references the operator-generated `<db>-app` `fqdn-uri` like facit)
+ * - the app secrets (better-auth) + LLM gateway key via the Platform
+ *   secrets backend with rotation restart of the StatefulSet
+ * - the `paperclip.inc/v1alpha1` `Instance` CR with facit spec
+ *
+ * The image is private: `pullSecrets` defaults to `['ghcr-pull-secret']`
+ * — a fine-grained PAT (read:packages) Secret managed manually outside
+ * Flux (rotate by delete+recreate).
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Paperclip } from '@r8s/paperclip'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'paperclip' }}>
+ *     <Paperclip host="paperclip.example.com" />
+ *   </Platform>
+ * )
+ */
+export declare function Paperclip(props: PaperclipProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,cAAc,CAAA;AAGrB,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qIAAqI;IACrI,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC;;;OAGG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;IAC3F;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;IAC1D,yDAAyD;IACzD,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;IAC9D;;;;;;OAMG;IACH,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChE,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACxE,2GAA2G;IAC3G,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;IAC1E,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3C,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,2FAA2F;IAC3F,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,8EAA8E;IAC9E,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,kCAiQ9C"}

package/dist/index.js

@@ -0,0 +1,246 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Paperclip = Paperclip;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+const DEFAULT_RESOURCES = {
+    requests: { memory: '512Mi', cpu: '250m' },
+    limits: { memory: '12Gi', cpu: '2' },
+};
+const DEFAULT_OPENCODE_CONFIG = '{"provider":{"berget":{"npm":"@ai-sdk/openai-compatible","name":"Berget","options":{"baseURL":"https://api.berget.ai/v1","apiKey":"{env:OPENAI_API_KEY}"},"models":{"moonshotai/Kimi-K3":{"name":"Kimi K3"},"moonshotai/Kimi-K2.6":{"name":"Kimi K2.6"},"zai-org/GLM-5.2":{"name":"GLM-5.2"},"zai-org/GLM-4.7-FP8":{"name":"GLM-4.7"},"openai/gpt-oss-120b":{"name":"GPT-OSS 120B"},"mistralai/Mistral-Medium-3.5-128B":{"name":"Mistral Medium 3.5"},"mistralai/Mistral-Small-3.2-24B-Instruct-2506":{"name":"Mistral Small"},"Qwen/Qwen3.8-27B-FP8":{"name":"Qwen3.8 27B"},"google/gemma-4-31B-it":{"name":"Gemma 4 31B"}}}}}';
+const DEFAULT_ADAPTER_MODELS = '{"opencode_local":[{"id":"berget/moonshotai/Kimi-K3","label":"Kimi K3"},{"id":"berget/moonshotai/Kimi-K2.6","label":"Kimi K2.6"},{"id":"berget/zai-org/GLM-5.2","label":"GLM-5.2"},{"id":"berget/zai-org/GLM-4.7-FP8","label":"GLM-4.7"},{"id":"berget/openai/gpt-oss-120b","label":"GPT-OSS 120B"},{"id":"berget/mistralai/Mistral-Medium-3.5-128B","label":"Mistral Medium 3.5"},{"id":"berget/mistralai/Mistral-Small-3.2-24B-Instruct-2506","label":"Mistral Small"},{"id":"berget/Qwen/Qwen3.8-27B-FP8","label":"Qwen3.8 27B"},{"id":"berget/google/gemma-4-31B-it","label":"Gemma 4 31B"}]}';
+/**
+ * Paperclip — Berget's agent platform (tasks, documents, agent orchestration),
+ * facit-aligned on the paperclip-operator.
+ *
+ * @title Paperclip
+ * @category Agent Platforms
+ *
+ * The operator owns the workload: app instance → StatefulSet with PVC,
+ * ingress, probes, security context, heartbeat and app-native backups.
+ * This package declares the operator and owns everything AROUND it:
+ * - the external CNPG cluster (`credentialsMode: 'cnpg'` — the Instance
+ *   references the operator-generated `<db>-app` `fqdn-uri` like facit)
+ * - the app secrets (better-auth) + LLM gateway key via the Platform
+ *   secrets backend with rotation restart of the StatefulSet
+ * - the `paperclip.inc/v1alpha1` `Instance` CR with facit spec
+ *
+ * The image is private: `pullSecrets` defaults to `['ghcr-pull-secret']`
+ * — a fine-grained PAT (read:packages) Secret managed manually outside
+ * Flux (rotate by delete+recreate).
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Paperclip } from '@r8s/paperclip'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'paperclip' }}>
+ *     <Paperclip host="paperclip.example.com" />
+ *   </Platform>
+ * )
+ */
+function Paperclip(props) {
+    const { name = 'paperclip', namespace: namespaceProp, version = 'sso-oidc', repository = 'ghcr.io/berget-ai/paperclip', host, pullSecrets = ['ghcr-pull-secret'], operatorVersion = '0.19.0', dbName = 'paperclip-db', dbInstances = 2, dbStorage = '20Gi', dbStorageClass, backup, appBackup, storage, heartbeat, llm, apiKeySecretName, auth, secretsName, modelCatalog, ingressAnnotations = {}, allowedHostnames, resources = DEFAULT_RESOURCES, tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const sharedOperators = (0, recipes_1.useOperators)();
+    const resources_ = [];
+    // --- Operator declaration (stateful workload owner) -----------------------
+    if (!sharedOperators.some((op) => op.name === 'paperclip-operator')) {
+        const paperclipOperator = {
+            name: 'paperclip-operator',
+            version: operatorVersion,
+            description: 'Paperclip operator — Instance CR → StatefulSet + PVC + ingress',
+            source: {
+                type: 'helm',
+                chart: 'paperclip-operator',
+                repository: 'oci://ghcr.io/paperclipinc/charts',
+                version: operatorVersion,
+                values: {
+                    operator: {
+                        resources: {
+                            limits: { cpu: '500m', memory: '512Mi' },
+                            requests: { cpu: '100m', memory: '128Mi' },
+                        },
+                    },
+                    metrics: { enabled: true, serviceMonitor: { enabled: false } },
+                    leaderElection: { enabled: false },
+                },
+            },
+            crds: ['instances.paperclip.inc'],
+        };
+        resources_.push((0, core_1.declareOperator)(paperclipOperator));
+    }
+    // --- App secrets (better-auth) + LLM key ----------------------------------
+    const appSecretsName = secretsName ?? `${name}-secrets`;
+    const apiKeyName = apiKeySecretName ?? 'berget-api-key';
+    if (!secretsName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Paperclip', name, 'a Better Auth secret — it signs every user session', {
+                propName: 'secretsName',
+                exampleValue: `${name}-secrets`,
+                keys: ['better-auth-secret'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-secrets`,
+            namespace,
+            path: auth?.path ?? `${secretProvider.path ?? name}/${name}/app`,
+            secretName: appSecretsName,
+            refreshAfter: auth?.refreshAfter,
+            keys: ['better-auth-secret'],
+            // The operator-managed workload is a StatefulSet, not a Deployment
+            restart: [{ kind: 'StatefulSet', name }],
+        }));
+    }
+    if (!apiKeySecretName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Paperclip', name, 'an LLM API key for the Berget gateway (agents call models on behalf of users)', {
+                propName: 'apiKeySecretName',
+                exampleValue: 'berget-api-key',
+                keys: ['api-key'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `berget-api-key`,
+            namespace,
+            path: llm?.path ?? `${secretProvider.path ?? name}/${name}/berget-ai`,
+            secretName: apiKeyName,
+            refreshAfter: llm?.refreshAfter ?? '3600s',
+            keys: ['api-key'],
+            restart: [{ kind: 'StatefulSet', name }],
+        }));
+    }
+    // --- External database (CNPG-managed credentials: `<db>-app` fqdn-uri) ----
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        name: dbName,
+        namespace,
+        instances: dbInstances,
+        storage: dbStorage,
+        ...(dbStorageClass ? { storageClass: dbStorageClass } : {}),
+        parameters: { max_connections: '200', effective_cache_size: '768MB' },
+        credentialsMode: 'cnpg',
+        ...(backup ? { backup } : {}),
+    }));
+    // --- App env (facit contract) ----------------------------------------------
+    const llmBaseUrl = llm?.baseUrl ?? 'https://api.berget.ai/v1';
+    const appNative = appBackup === false ? undefined : (appBackup ?? {});
+    const hb = heartbeat === false ? undefined : (heartbeat ?? {});
+    const store = storage === false ? undefined : (storage ?? {});
+    const catalog = modelCatalog === false ? undefined : (modelCatalog ?? {});
+    const env = [
+        { name: 'PAPERCLIP_TELEMETRY_DISABLED', value: '1' },
+        { name: 'OPENAI_BASE_URL', value: llmBaseUrl },
+        {
+            name: 'OPENAI_API_KEY',
+            valueFrom: { secretKeyRef: { name: apiKeyName, key: 'api-key' } },
+        },
+        { name: 'PAPERCLIP_SECRETS_PROVIDER', value: 'local_encrypted' },
+        { name: 'PAPERCLIP_STORAGE_PROVIDER', value: 'local_disk' },
+        { name: 'PAPERCLIP_STORAGE_LOCAL_DIR', value: '/paperclip/storage' },
+        ...(hb?.enabled !== false ? [{ name: 'HEARTBEAT_SCHEDULER_ENABLED', value: 'true' }] : []),
+        ...(appNative?.enabled !== false
+            ? [
+                { name: 'PAPERCLIP_DB_BACKUP_ENABLED', value: 'true' },
+                { name: 'PAPERCLIP_DB_BACKUP_DIR', value: '/paperclip/backups' },
+            ]
+            : []),
+        { name: 'PAPERCLIP_AUTH_BASE_URL_MODE', value: 'explicit' },
+        { name: 'PAPERCLIP_AUTH_PUBLIC_BASE_URL', value: `https://${host}` },
+        ...(catalog
+            ? [
+                {
+                    name: 'OPENCODE_CONFIG_CONTENT',
+                    value: catalog.opencodeConfig ?? DEFAULT_OPENCODE_CONFIG,
+                },
+                {
+                    name: 'PAPERCLIP_ADAPTER_MODELS',
+                    value: catalog.adapterModels ?? DEFAULT_ADAPTER_MODELS,
+                },
+            ]
+            : []),
+    ];
+    // --- Instance CR — the entire app definition (operator-owned) --------------
+    resources_.push((0, core_1.jsx)('Instance', {
+        apiVersion: 'paperclip.inc/v1alpha1',
+        kind: 'Instance',
+        metadata: { name, namespace, labels: { app: name } },
+        spec: {
+            image: {
+                repository,
+                tag: version,
+                pullPolicy: 'Always',
+                pullSecrets: pullSecrets.map((n) => ({ name: n })),
+            },
+            deployment: {
+                mode: 'authenticated',
+                exposure: 'public',
+                publicURL: `https://${host}`,
+                allowedHostnames: allowedHostnames ?? [host],
+            },
+            auth: {
+                disableSignUp: auth?.disableSignUp !== false,
+                secretRef: { name: appSecretsName, key: 'better-auth-secret' },
+            },
+            database: {
+                mode: 'external',
+                externalURLSecretRef: { name: `${dbName}-app`, key: 'fqdn-uri' },
+            },
+            adapters: { apiKeysSecretRef: { name: apiKeyName } },
+            storage: {
+                persistence: {
+                    enabled: storage !== false,
+                    size: store?.size ?? '10Gi',
+                    ...(store?.storageClass ? { storageClass: store.storageClass } : {}),
+                },
+            },
+            resources,
+            networking: {
+                service: { type: 'ClusterIP', port: 3100 },
+                ingress: {
+                    enabled: true,
+                    ingressClassName: 'nginx',
+                    hosts: [host],
+                    tls: [{ hosts: [host], secretName: tls.secretName }],
+                    annotations: {
+                        'cert-manager.io/cluster-issuer': tls.clusterIssuer,
+                        'external-dns.alpha.kubernetes.io/hostname': host,
+                        'nginx.ingress.kubernetes.io/ssl-redirect': 'true',
+                        'nginx.ingress.kubernetes.io/proxy-body-size': '50m',
+                        'nginx.ingress.kubernetes.io/proxy-read-timeout': '300',
+                        'nginx.ingress.kubernetes.io/proxy-send-timeout': '300',
+                        'nginx.ingress.kubernetes.io/proxy-http-version': '1.1',
+                        ...ingressAnnotations,
+                    },
+                },
+            },
+            probes: { type: 'auto' },
+            heartbeat: hb && hb.enabled !== false ? { enabled: true, intervalMS: hb.intervalMS ?? 30000 } : null,
+            backup: appNative && appNative.enabled !== false
+                ? {
+                    appNative: {
+                        enabled: true,
+                        intervalMinutes: appNative.intervalMinutes ?? 60,
+                        retentionDays: appNative.retentionDays ?? 7,
+                    },
+                }
+                : null,
+            security: {
+                networkPolicy: { enabled: false },
+                seLinuxRelabel: false,
+                podSecurityContext: { fsGroup: 1000 },
+                containerSecurityContext: {
+                    // The image runs as root — runAsNonRoot would crash-loop it
+                    allowPrivilegeEscalation: false,
+                    capabilities: { drop: ['ALL'] },
+                    runAsNonRoot: false,
+                    runAsUser: 0,
+                },
+            },
+            env,
+        },
+    }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AAqJA,8BAiQC;AAtZD,oCAAsE;AACtE,iDAAgE;AAChE,0CAOqB;AAmGrB,MAAM,iBAAiB,GAAG;IACxB,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;IAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE;CACrC,CAAA;AAED,MAAM,uBAAuB,GAC3B,imBAAimB,CAAA;AAEnmB,MAAM,sBAAsB,GAC1B,mkBAAmkB,CAAA;AAErkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAgB,SAAS,CAAC,KAAqB;IAC7C,MAAM,EACJ,IAAI,GAAG,WAAW,EAClB,SAAS,EAAE,aAAa,EACxB,OAAO,GAAG,UAAU,EACpB,UAAU,GAAG,6BAA6B,EAC1C,IAAI,EACJ,WAAW,GAAG,CAAC,kBAAkB,CAAC,EAClC,eAAe,GAAG,QAAQ,EAC1B,MAAM,GAAG,cAAc,EACvB,WAAW,GAAG,CAAC,EACf,SAAS,GAAG,MAAM,EAClB,cAAc,EACd,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,GAAG,EACH,gBAAgB,EAChB,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,kBAAkB,GAAG,EAAE,EACvB,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,EAC7B,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACvE,GAAG,KAAK,CAAA;IAET,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,eAAe,GAAG,IAAA,sBAAY,GAAE,CAAA;IACtC,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,6EAA6E;IAC7E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC,EAAE,CAAC;QACpE,MAAM,iBAAiB,GAAa;YAClC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,gEAAgE;YAC7E,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,oBAAoB;gBAC3B,UAAU,EAAE,mCAAmC;gBAC/C,OAAO,EAAE,eAAe;gBACxB,MAAM,EAAE;oBACN,QAAQ,EAAE;wBACR,SAAS,EAAE;4BACT,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;4BACxC,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;yBAC3C;qBACF;oBACD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;oBAC9D,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;iBACnC;aACF;YACD,IAAI,EAAE,CAAC,yBAAyB,CAAC;SAClC,CAAA;QACD,UAAU,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,iBAAiB,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,6EAA6E;IAC7E,MAAM,cAAc,GAAG,WAAW,IAAI,GAAG,IAAI,UAAU,CAAA;IACvD,MAAM,UAAU,GAAG,gBAAgB,IAAI,gBAAgB,CAAA;IAEvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,WAAW,EACX,IAAI,EACJ,oDAAoD,EACpD;gBACE,QAAQ,EAAE,aAAa;gBACvB,YAAY,EAAE,GAAG,IAAI,UAAU;gBAC/B,IAAI,EAAE,CAAC,oBAAoB,CAAC;aAC7B,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,UAAU;YACvB,SAAS;YACT,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM;YAChE,UAAU,EAAE,cAAc;YAC1B,YAAY,EAAE,IAAI,EAAE,YAAY;YAChC,IAAI,EAAE,CAAC,oBAAoB,CAAC;YAC5B,mEAAmE;YACnE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;IACH,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,WAAW,EACX,IAAI,EACJ,+EAA+E,EAC/E;gBACE,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY,EAAE,gBAAgB;gBAC9B,IAAI,EAAE,CAAC,SAAS,CAAC;aAClB,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,gBAAgB;YACtB,SAAS;YACT,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,YAAY;YACrE,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,GAAG,EAAE,YAAY,IAAI,OAAO;YAC1C,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI,EAAE,MAAM;QACZ,SAAS;QACT,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,UAAU,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE;QACrE,eAAe,EAAE,MAAM;QACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CACH,CAAA;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,IAAI,0BAA0B,CAAA;IAC7D,MAAM,SAAS,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,EAAE,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAC9D,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAEzE,MAAM,GAAG,GAAG;QACV,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE;QACpD,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE;QAC9C;YACE,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;SAClE;QACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,iBAAiB,EAAE;QAChE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,YAAY,EAAE;QAC3D,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACpE,GAAG,CAAC,EAAE,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,SAAS,EAAE,OAAO,KAAK,KAAK;YAC9B,CAAC,CAAC;gBACE,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,EAAE;gBACtD,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,oBAAoB,EAAE;aACjE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,UAAU,EAAE;QAC3D,EAAE,IAAI,EAAE,gCAAgC,EAAE,KAAK,EAAE,WAAW,IAAI,EAAE,EAAE;QACpE,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,KAAK,EAAE,OAAO,CAAC,cAAc,IAAI,uBAAuB;iBACzD;gBACD;oBACE,IAAI,EAAE,0BAA0B;oBAChC,KAAK,EAAE,OAAO,CAAC,aAAa,IAAI,sBAAsB;iBACvD;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,8EAA8E;IAC9E,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,UAAU,EAAE;QACd,UAAU,EAAE,wBAAwB;QACpC,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,UAAU;gBACV,GAAG,EAAE,OAAO;gBACZ,UAAU,EAAE,QAAQ;gBACpB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;aACnD;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,WAAW,IAAI,EAAE;gBAC5B,gBAAgB,EAAE,gBAAgB,IAAI,CAAC,IAAI,CAAC;aAC7C;YACD,IAAI,EAAE;gBACJ,aAAa,EAAE,IAAI,EAAE,aAAa,KAAK,KAAK;gBAC5C,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,oBAAoB,EAAE;aAC/D;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,UAAU;gBAChB,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE;aACjE;YACD,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;YACpD,OAAO,EAAE;gBACP,WAAW,EAAE;oBACX,OAAO,EAAE,OAAO,KAAK,KAAK;oBAC1B,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM;oBAC3B,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE;aACF;YACD,SAAS;YACT,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC1C,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,gBAAgB,EAAE,OAAO;oBACzB,KAAK,EAAE,CAAC,IAAI,CAAC;oBACb,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;oBACpD,WAAW,EAAE;wBACX,gCAAgC,EAAE,GAAG,CAAC,aAAa;wBACnD,2CAA2C,EAAE,IAAI;wBACjD,0CAA0C,EAAE,MAAM;wBAClD,6CAA6C,EAAE,KAAK;wBACpD,gDAAgD,EAAE,KAAK;wBACvD,gDAAgD,EAAE,KAAK;wBACvD,gDAAgD,EAAE,KAAK;wBACvD,GAAG,kBAAkB;qBACtB;iBACF;aACF;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACxB,SAAS,EACP,EAAE,IAAI,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;YAC3F,MAAM,EACJ,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,KAAK;gBACtC,CAAC,CAAC;oBACE,SAAS,EAAE;wBACT,OAAO,EAAE,IAAI;wBACb,eAAe,EAAE,SAAS,CAAC,eAAe,IAAI,EAAE;wBAChD,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,CAAC;qBAC5C;iBACF;gBACH,CAAC,CAAC,IAAI;YACV,QAAQ,EAAE;gBACR,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACjC,cAAc,EAAE,KAAK;gBACrB,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBACrC,wBAAwB,EAAE;oBACxB,4DAA4D;oBAC5D,wBAAwB,EAAE,KAAK;oBAC/B,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;oBAC/B,YAAY,EAAE,KAAK;oBACnB,SAAS,EAAE,CAAC;iBACb;aACF;YACD,GAAG;SACJ;KACF,CAAC,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/paperclip",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Paperclip — Berget's agent platform (tasks, documents, agent orchestration)",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -37,5 +37,8 @@
   "devDependencies": {
     "typescript": "^5.3.0",
     "vitest": "^1.0.0"
-  }
+  },
+  "files": [
+    "dist"
+  ]
 }

package/__tests__/paperclip.test.ts

@@ -1,450 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { render, jsx } from '@r8s/core'
-import { Namespace, OperatorContext, SecretContext, RoutingContext } from '@r8s/core/defaults'
-import { runGuardrails, noPlaintextSecrets, validateResource } from '@r8s/core'
-import { operators } from '@r8s/crds'
-import type { r8sElement } from '@r8s/core'
-
-// Paperclip recipe tests:
-//   1. Operator declarations (cnpg via Database, deduped via OperatorContext)
-//   2. Rendering: defaults, sandbox agents (hardened sandbox, TCP probes),
-//      all props, gateway/ingress adaptation
-//   3. Namespace inheritance from the Platform context
-//   4. Security: no plaintext credentials in rendered output
-import { Paperclip } from '../src/index'
-
-/** Render Paperclip inside a Platform-like secrets backend (OpenBao). */
-function renderPaperclip(props: Record<string, unknown>): ReturnType<typeof render> {
-  return render(
-    jsx(SecretContext.Provider, {
-      value: { backend: 'openbao', mount: 'kv', path: 'test' },
-      children: jsx(Paperclip, props as never),
-    })
-  )
-}
-
-/** Render Paperclip inside a Platform-like Namespace context (no explicit namespace prop). */
-function renderPaperclipInNamespace(
-  namespaceValue: string,
-  props: Record<string, unknown>
-): ReturnType<typeof render> {
-  return render(
-    jsx(Namespace.Provider, {
-      value: namespaceValue,
-      children: jsx(SecretContext.Provider, {
-        value: { backend: 'openbao', mount: 'kv', path: 'test' },
-        children: jsx(Paperclip, props as never),
-      }),
-    })
-  )
-}
-
-/** Render Paperclip wrapped only in an OperatorContext (no secrets backend). */
-function renderPaperclipWithContext(operators_: any[], props: Record<string, unknown>): r8sElement {
-  return jsx(OperatorContext.Provider, {
-    value: operators_,
-    children: jsx(Paperclip, props as never),
-  })
-}
-
-const openbao = { backend: 'openbao', mount: 'kv', path: 'test' }
-
-describe('operator declarations', () => {
-  it('declares the cnpg operator via the Database recipe', () => {
-    const result = renderPaperclip({ host: 'paperclip.example.com' })
-    expect(result.operators.some((op) => op.name === 'cnpg')).toBe(true)
-  })
-
-  it('declares cnpg exactly once even with sandbox agents (no redis for paperclip)', () => {
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: { sandboxReplicas: 3 },
-    })
-    const names = result.operators.map((op) => op.name)
-    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).not.toContain('RedisCluster')
-  })
-
-  it('deduplicates operators provided via context', () => {
-    const result = render(
-      renderPaperclipWithContext([operators['cnpg']()], {
-        host: 'paperclip.example.com',
-        secretsName: 'existing-secrets',
-      })
-    )
-    const names = result.operators.map((op) => op.name)
-    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
-  })
-
-  it('allows version overrides through context operators', () => {
-    const result = render(
-      renderPaperclipWithContext([operators['cnpg']('1.25.0')], {
-        host: 'paperclip.example.com',
-        secretsName: 'existing-secrets',
-      })
-    )
-    const cnpg = result.operators.filter((op) => op.name === 'cnpg')
-    expect(cnpg).toHaveLength(1)
-    expect(cnpg[0].version).toBe('1.25.0')
-  })
-})
-
-describe('rendering defaults', () => {
-  it('renders main deployment, service, database and endpoint', () => {
-    const result = renderPaperclip({ host: 'paperclip.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('Deployment')
-    expect(kinds).toContain('Service')
-    expect(kinds).toContain('Ingress')
-    expect(kinds).toContain('Cluster')
-  })
-
-  it('renders the main app with the paperclip image on port 3000', () => {
-    const result = renderPaperclip({ host: 'paperclip.example.com' })
-    const main = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip'
-    ) as any
-    expect(main).toBeDefined()
-    const container = main.spec.template.spec.containers[0]
-    expect(container.image).toBe('ghcr.io/berget-ai/paperclip:latest')
-    expect(container.ports[0].containerPort).toBe(3000)
-    expect(main.spec.replicas).toBe(2)
-  })
-
-  it('probes both workloads with TCP sockets (unknown HTTP health contract)', () => {
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: { sandboxReplicas: 2 },
-    })
-    for (const name of ['paperclip', 'paperclip-agent-sandbox']) {
-      const deployment = result.resources.find(
-        (r: any) => r.kind === 'Deployment' && r.metadata.name === name
-      ) as any
-      const container = deployment.spec.template.spec.containers[0]
-      expect(container.livenessProbe.tcpSocket).toEqual({ port: 3000 })
-      expect(container.readinessProbe.tcpSocket).toEqual({ port: 3000 })
-      expect(container.livenessProbe.httpGet).toBeUndefined()
-      expect(container.readinessProbe.httpGet).toBeUndefined()
-    }
-  })
-
-  it('renders no sandbox deployment when agents is not set', () => {
-    const result = renderPaperclip({ host: 'paperclip.example.com' })
-    const names = result.resources
-      .filter((r) => r.kind === 'Deployment')
-      .map((d: any) => d.metadata.name)
-    expect(names).toEqual(['paperclip'])
-  })
-
-  it('renders the sandbox agent deployment when agents is set', () => {
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: { sandboxReplicas: 3 },
-    })
-    const sandbox = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip-agent-sandbox'
-    ) as any
-    expect(sandbox).toBeDefined()
-    expect(sandbox.spec.replicas).toBe(3)
-    expect(sandbox.spec.template.spec.containers[0].image).toBe(
-      'ghcr.io/berget-ai/paperclip:latest'
-    )
-    expect(sandbox.spec.template.spec.containers[0].command).toEqual([
-      'paperclip',
-      'agent',
-      '--sandbox',
-    ])
-  })
-
-  it('hardens the sandbox with a locked-down securityContext', () => {
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: {},
-    })
-    const sandbox = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip-agent-sandbox'
-    ) as any
-    const podSpec = sandbox.spec.template.spec
-    expect(podSpec.securityContext).toEqual({ seccompProfile: { type: 'RuntimeDefault' } })
-    const securityContext = podSpec.containers[0].securityContext
-    expect(securityContext.runAsNonRoot).toBe(true)
-    expect(securityContext.allowPrivilegeEscalation).toBe(false)
-    expect(securityContext.seccompProfile).toEqual({ type: 'RuntimeDefault' })
-    expect(securityContext.capabilities.drop).toEqual(['ALL'])
-  })
-
-  it('gives the sandbox explicit resources by default and honours overrides', () => {
-    const defaults = renderPaperclip({ host: 'paperclip.example.com', agents: {} })
-    const defaultSandbox = defaults.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip-agent-sandbox'
-    ) as any
-    const defaultContainer = defaultSandbox.spec.template.spec.containers[0]
-    expect(defaultContainer.resources.requests).toEqual({ cpu: '250m', memory: '256Mi' })
-    expect(defaultContainer.resources.limits).toEqual({ cpu: '1000m', memory: '2Gi' })
-
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: {
-        sandboxReplicas: 1,
-        resources: {
-          requests: { cpu: '500m', memory: '1Gi' },
-          limits: { cpu: '2000m', memory: '4Gi' },
-        },
-      },
-    })
-    const sandbox = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip-agent-sandbox'
-    ) as any
-    const container = sandbox.spec.template.spec.containers[0]
-    expect(container.resources.requests).toEqual({ cpu: '500m', memory: '1Gi' })
-    expect(container.resources.limits).toEqual({ cpu: '2000m', memory: '4Gi' })
-  })
-
-  it('defaults sandbox replicas to 2', () => {
-    const result = renderPaperclip({ host: 'paperclip.example.com', agents: {} })
-    const sandbox = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip-agent-sandbox'
-    ) as any
-    expect(sandbox.spec.replicas).toBe(2)
-  })
-
-  it('renders gateway resources when platform uses gateway routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'gateway', gatewayClassName: 'eg' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(Paperclip, { host: 'paperclip.example.com' }),
-        }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('HTTPRoute')
-  })
-
-  it('renders a valid Ingress when platform uses ingress routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'ingress' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(Paperclip, { host: 'paperclip.example.com' }),
-        }),
-      })
-    )
-    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
-    expect(ingress).toBeDefined()
-    expect(ingress.spec.rules[0].host).toBe('paperclip.example.com')
-  })
-
-  it('passes resource validation', () => {
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: { sandboxReplicas: 2 },
-    })
-    for (const resource of result.resources) {
-      expect(validateResource(resource)).toEqual([])
-    }
-  })
-})
-
-describe('namespace inheritance', () => {
-  it('inherits namespace from the Platform context when namespace prop is not set', () => {
-    const result = renderPaperclipInNamespace('agents', {
-      host: 'paperclip.example.com',
-      agents: { sandboxReplicas: 1 },
-    })
-    for (const kind of ['Deployment', 'Service', 'Cluster', 'Ingress']) {
-      const resource = result.resources.find((r: any) => r.kind === kind)
-      expect(resource).toBeDefined()
-      expect(resource.metadata.namespace).toBe('agents')
-    }
-  })
-
-  it('explicit namespace prop wins over the Platform context', () => {
-    const result = renderPaperclipInNamespace('agents', {
-      host: 'paperclip.example.com',
-      namespace: 'paperclip-ns',
-    })
-    const main = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip'
-    ) as any
-    expect(main.metadata.namespace).toBe('paperclip-ns')
-  })
-
-  it('falls back to default when no Platform namespace is present', () => {
-    const result = renderPaperclip({ host: 'paperclip.example.com' })
-    const main = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip'
-    ) as any
-    expect(main.metadata.namespace).toBe('default')
-  })
-})
-
-describe('rendering with all props', () => {
-  it('accepts the full prop surface', () => {
-    const result = renderPaperclip({
-      name: 'agents',
-      namespace: 'agents',
-      version: '0.4.0',
-      host: 'agents.example.com',
-      replicas: 3,
-      dbStorage: '20Gi',
-      websockets: true,
-      agents: { sandboxReplicas: 4 },
-      resources: {
-        requests: { memory: '1Gi', cpu: '500m' },
-        limits: { memory: '4Gi', cpu: '2000m' },
-      },
-      tls: { secretName: 'agents-tls', clusterIssuer: 'letsencrypt-prod' },
-    })
-    expect(result.resources.length).toBeGreaterThan(0)
-
-    const main = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'agents'
-    ) as any
-    const container = main.spec.template.spec.containers[0]
-    expect(container.image).toBe('ghcr.io/berget-ai/paperclip:0.4.0')
-    expect(main.spec.replicas).toBe(3)
-    expect(container.resources.limits.memory).toBe('4Gi')
-    const websockets = container.env.find((e: any) => e.name === 'WEBSOCKETS_ENABLED')
-    expect(websockets.value).toBe('true')
-
-    const sandbox = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'agents-agent-sandbox'
-    ) as any
-    expect(sandbox.spec.replicas).toBe(4)
-
-    const cluster = result.resources.find((r) => r.kind === 'Cluster') as any
-    expect(cluster.spec.storage.size).toBe('20Gi')
-  })
-
-  it('renders unique env var names (k8s rejects duplicates)', () => {
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: { sandboxReplicas: 1 },
-    })
-    for (const name of ['paperclip', 'paperclip-agent-sandbox']) {
-      const deployment = result.resources.find(
-        (r: any) => r.kind === 'Deployment' && r.metadata.name === name
-      ) as any
-      const env = deployment.spec.template.spec.containers[0].env as Array<{ name: string }>
-      const names = env.map((e) => e.name)
-      expect(new Set(names).size).toBe(names.length)
-    }
-  })
-})
-
-describe('secrets handling', () => {
-  it('provisions the model API key through a secrets backend', () => {
-    const result = renderPaperclip({ host: 'paperclip.example.com' })
-    const bundle = result.resources.find(
-      (r: any) => r.kind === 'OpenBaoStaticSecret' && r.metadata.name === 'paperclip-secrets'
-    ) as any
-    expect(bundle).toBeDefined()
-    expect(bundle.spec.path).toBe('test/paperclip/secrets')
-    expect(bundle.spec.destination).toEqual({
-      create: true,
-      name: 'paperclip-secrets',
-    })
-  })
-
-  it('provisions the model API key through Vault', () => {
-    const result = render(
-      jsx(SecretContext.Provider, {
-        value: { backend: 'vault', mount: 'kv', path: 'apps' },
-        children: jsx(Paperclip, { host: 'paperclip.example.com' }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('VaultStaticSecret')
-  })
-
-  it('accepts an explicit secretsName without a backend', () => {
-    const result = render(
-      jsx(Paperclip, { host: 'paperclip.example.com', secretsName: 'existing-secrets' })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).not.toContain('OpenBaoStaticSecret')
-    expect(kinds).not.toContain('VaultStaticSecret')
-    expect(result.resources.length).toBeGreaterThan(0)
-  })
-
-  it('wires credentials via secretKeyRef (never plaintext env)', () => {
-    const result = render(
-      jsx(Paperclip, { host: 'paperclip.example.com', secretsName: 'existing-secrets' })
-    )
-    const main = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip'
-    ) as any
-    const env = main.spec.template.spec.containers[0].env
-    const modelApiKey = env.find((e: any) => e.name === 'MODEL_API_KEY')
-    const dbPassword = env.find((e: any) => e.name === 'PGPASSWORD')
-    expect(modelApiKey.valueFrom.secretKeyRef).toEqual({
-      name: 'existing-secrets',
-      key: 'modelApiKey',
-    })
-    expect(dbPassword.valueFrom.secretKeyRef).toEqual({
-      name: 'paperclip-db-credentials',
-      key: 'password',
-    })
-    expect(modelApiKey.value).toBeUndefined()
-    expect(dbPassword.value).toBeUndefined()
-    const databaseUrl = env.find((e: any) => e.name === 'DATABASE_URL')
-    expect(databaseUrl.value).toContain('$(PGPASSWORD)')
-  })
-
-  it('sandbox workers share the same secrets bundle', () => {
-    const result = render(
-      jsx(SecretContext.Provider, {
-        value: openbao as never,
-        children: jsx(Paperclip, {
-          host: 'paperclip.example.com',
-          agents: { sandboxReplicas: 2 },
-        }),
-      })
-    )
-    const sandbox = result.resources.find(
-      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'paperclip-agent-sandbox'
-    ) as any
-    const env = sandbox.spec.template.spec.containers[0].env
-    const modelApiKey = env.find((e: any) => e.name === 'MODEL_API_KEY')
-    const dbPassword = env.find((e: any) => e.name === 'PGPASSWORD')
-    expect(modelApiKey.valueFrom.secretKeyRef.name).toBe('paperclip-secrets')
-    expect(modelApiKey.valueFrom.secretKeyRef.key).toBe('modelApiKey')
-    expect(dbPassword.valueFrom.secretKeyRef.name).toBe('paperclip-db-credentials')
-    expect(modelApiKey.value).toBeUndefined()
-  })
-
-  it('renders no plaintext credentials anywhere', () => {
-    const result = renderPaperclip({
-      host: 'paperclip.example.com',
-      agents: { sandboxReplicas: 2 },
-    })
-    const { passed, errors } = runGuardrails(result.resources as any[], [noPlaintextSecrets])
-    if (!passed) {
-      console.error('Plaintext credential violations:', errors)
-    }
-    expect(passed).toBe(true)
-  })
-})
-
-describe('validation errors', () => {
-  it('throws when no secrets backend and no model key secret', () => {
-    expect(() => render(jsx(Paperclip, { host: 'paperclip.example.com' }))).toThrow(
-      /model api key/i
-    )
-  })
-
-  it('throws for unknown secrets backends', () => {
-    expect(() =>
-      render(
-        jsx(SecretContext.Provider, {
-          value: { backend: 'unknown' as never },
-          children: jsx(Paperclip, { host: 'paperclip.example.com' }),
-        })
-      )
-    ).toThrow(/model api key/i)
-  })
-})

package/examples/basic.tsx

@@ -1,8 +0,0 @@
-import { Platform } from '@r8s/recipes'
-import { Paperclip } from '@r8s/paperclip'
-
-export default (
-  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
-    <Paperclip name="paperclip" host="paperclip.example.com" agents={{ sandboxReplicas: 3 }} />
-  </Platform>
-)

package/src/index.tsx

@@ -1,278 +0,0 @@
-import { jsx, Fragment, useContext } from '@r8s/core'
-import { Namespace, SecretContext } from '@r8s/core/defaults'
-import { Database, WebService, Endpoint } from '@r8s/recipes'
-import type { SecretRef } from '@r8s/recipes'
-
-export interface PaperclipProps {
-  /** Resource name (defaults to 'paperclip') */
-  name?: string
-  /** Kubernetes namespace (defaults to 'default') */
-  namespace?: string
-  /** Container image tag (defaults to 'latest' — pin a version in production) */
-  version?: string
-  /** Public hostname for the web app and API (required) */
-  host: string
-  /** Number of app replicas (defaults to 2) */
-  replicas?: number
-  /** Storage size for the Postgres cluster (defaults to '10Gi') */
-  dbStorage?: string
-  /** Enable websockets for live task and agent updates (defaults to false) */
-  websockets?: boolean
-  /**
-   * Sandbox agent workers. Workers run the same image with a command
-   * override (paperclip agent --sandbox) and share the model API key
-   * and database credentials via secretKeyRef. They run with a hardened
-   * securityContext (non-root, no privilege escalation, RuntimeDefault
-   * seccomp, all capabilities dropped) by default.
-   */
-  agents?: {
-    /** Number of sandbox agent replicas (defaults to 2) */
-    sandboxReplicas?: number
-    /** Sandbox container resources (defaults to requests 256Mi/250m, limits 2Gi/1000m) */
-    resources?: {
-      requests?: { cpu?: string; memory?: string }
-      limits?: { cpu?: string; memory?: string }
-    }
-  }
-  /**
-   * Name of an existing Secret containing key `modelApiKey`. Paperclip
-   * uses this key to call LLM providers on behalf of agents.
-   *
-   * Required unless a secrets backend (openbao/vault) is configured on
-   * the surrounding Platform — the backend then provisions the key
-   * automatically. Plaintext keys are not supported.
-   */
-  secretsName?: string
-  /** Requested app resources */
-  resources?: {
-    requests?: { cpu?: string; memory?: string }
-    limits?: { cpu?: string; memory?: string }
-  }
-  /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
-  tls?: {
-    secretName: string
-    clusterIssuer: string
-  }
-}
-
-/**
- * Paperclip — Berget's agent platform (tasks, documents, agent orchestration).
- *
- * @title Paperclip
- * @category Agent Platforms
- *
- * Composes:
- * - CNPG Postgres cluster (tasks, documents, agent state; size via
- *   `dbStorage`)
- * - Paperclip Deployment + Service + Endpoint
- * - Optional sandbox agent workers (same image, command override) sharing
- *   the model API key via secretKeyRef — hardened with a non-root,
- *   no-privilege-escalation securityContext, RuntimeDefault seccomp and
- *   all capabilities dropped, with explicit resources by default
- * - Model API key provisioned through the Platform secrets backend
- *   (openbao / vault), or referenced from an existing Secret
- * - Optional websockets support (WEBSOCKETS_ENABLED)
- *
- * Probing: the Paperclip image contract does not publish HTTP health
- * endpoints, so both workloads default to TCP socket probes on the
- * container port (3000) to avoid crash-looping on unknown /health /ready
- * paths. If your image serves HTTP /health and /ready — or another
- * readiness endpoint — override `probes` on the workload for stricter
- * checks.
- *
- * The namespace is inherited from the surrounding `<Platform>` (via the
- * Namespace context) unless set explicitly.
- *
- * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
- * the MODEL_API_KEY is provisioned for you. Without a backend you must
- * point `secretsName` at a pre-created Secret.
- *
- * @example
- * import { Platform } from '@r8s/recipes'
- * import { Paperclip } from '@r8s/paperclip'
- *
- * export default (
- *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
- *     <Paperclip
- *       name="paperclip"
- *       host="paperclip.example.com"
- *       agents={{ sandboxReplicas: 3 }}
- *     />
- *   </Platform>
- * )
- *
- * @example
- * // Existing Secret holding the model API key (key: modelApiKey)
- * import { Paperclip } from '@r8s/paperclip'
- *
- * export default (
- *   <Paperclip name="paperclip" host="paperclip.example.com" secretsName="paperclip-secrets" />
- * )
- */
-export function Paperclip(props: PaperclipProps) {
-  const {
-    name = 'paperclip',
-    namespace: namespaceProp,
-    version = 'latest',
-    host,
-    replicas = 2,
-    dbStorage = '10Gi',
-    websockets = false,
-    agents,
-    secretsName,
-    resources = {
-      requests: { memory: '512Mi', cpu: '250m' },
-      limits: { memory: '2Gi', cpu: '1000m' },
-    },
-    tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' },
-  } = props
-
-  // Inherit namespace from <Platform> context if not explicitly set
-  const contextNamespace = useContext(Namespace)
-  const namespace =
-    namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default'
-
-  const secretProvider = useContext(SecretContext)
-  const resources_: ReturnType<typeof jsx>[] = []
-
-  const image = `ghcr.io/berget-ai/paperclip:${version}`
-  const appSecretsName = secretsName ?? `${name}-secrets`
-  const sandboxReplicas = agents?.sandboxReplicas ?? 2
-  // Sandbox workers run untrusted code — never let them float without
-  // explicit container resources.
-  const sandboxResources = agents?.resources ?? {
-    requests: { cpu: '250m', memory: '256Mi' },
-    limits: { cpu: '1000m', memory: '2Gi' },
-  }
-  // The internal image's probe contract is unknown — probe the TCP port
-  // so pods don't crash-loop on missing HTTP /health /ready endpoints.
-  const tcpProbes = {
-    liveness: { tcp: true } as const,
-    readiness: { tcp: true } as const,
-  }
-
-  // --- Secret provisioning -------------------------------------------------
-  // The model API key lets Paperclip call LLM providers — never render
-  // it as plaintext. With a secrets backend it is provisioned through the
-  // backend (key `modelApiKey`); otherwise reference a pre-created Secret.
-  if (!secretsName) {
-    if (
-      !secretProvider ||
-      (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')
-    ) {
-      throw new Error(
-        `Paperclip "${name}" requires a model API key (MODEL_API_KEY).\n` +
-          `\n` +
-          `Paperclip calls LLM providers with a model API key — ` +
-          `it must not be rendered as plaintext.\n` +
-          `\n` +
-          `Fix: configure a secrets backend on the Platform:\n` +
-          `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
-          `    <Paperclip name="${name}" host="${host}" />\n` +
-          `  </Platform>\n` +
-          `\n` +
-          `Or reference a pre-created Secret (key: modelApiKey):\n` +
-          `  <Paperclip name="${name}" host="${host}" secretsName="${name}-secrets" />`
-      )
-    }
-
-    const spec = {
-      ...(secretProvider.backend === 'vault'
-        ? { vaultAuthRef: secretProvider.authRef }
-        : { openbaoAuthRef: secretProvider.authRef }),
-      mount: secretProvider.mount,
-      type: 'kv-v2' as const,
-      path: `${secretProvider.path ?? name}/${name}/secrets`,
-      destination: { create: true, name: appSecretsName },
-    }
-    resources_.push(
-      secretProvider.backend === 'vault'
-        ? jsx('VaultStaticSecret', {
-            apiVersion: 'secrets.hashicorp.com/v1beta1',
-            kind: 'VaultStaticSecret',
-            metadata: { name: `${name}-secrets`, namespace },
-            spec,
-          })
-        : jsx('OpenBaoStaticSecret', {
-            apiVersion: 'secrets.openbao.org/v1beta1',
-            kind: 'OpenBaoStaticSecret',
-            metadata: { name: `${name}-secrets`, namespace },
-            spec,
-          })
-    )
-  }
-
-  // --- Env wiring ------------------------------------------------------------
-  // Every credential is referenced via secretKeyRef (declared before plain
-  // env vars by WebService, so dependent $(VAR) expansion resolves).
-  // DATABASE_URL is auto-wired from DatabaseContext inside the wrapper.
-  const appEnv: Record<string, string> = {
-    PORT: '3000',
-    ...(websockets ? { WEBSOCKETS_ENABLED: 'true' } : {}),
-  }
-
-  const appSecrets: Record<string, SecretRef> = {
-    MODEL_API_KEY: { secret: appSecretsName, key: 'modelApiKey' },
-  }
-
-  // --- Database (CNPG) + app + sandbox agents --------------------------------
-  // Database wraps both the main app and the sandbox workers so database
-  // credentials stay consistent with the r8s Database recipe (CNPG dedicated
-  // cluster provisions the secret).
-  resources_.push(
-    jsx(Database, {
-      name,
-      namespace,
-      storage: dbStorage,
-      children: (
-        <>
-          <WebService
-            name={name}
-            namespace={namespace}
-            image={image}
-            port={3000}
-            replicas={replicas}
-            probes={tcpProbes}
-            resources={resources}
-            env={appEnv}
-            secrets={appSecrets}
-          />
-          {agents ? (
-            <WebService
-              name={`${name}-agent-sandbox`}
-              namespace={namespace}
-              image={image}
-              port={3000}
-              replicas={sandboxReplicas}
-              command={['paperclip', 'agent', '--sandbox']}
-              probes={tcpProbes}
-              secrets={appSecrets}
-              securityContext={{
-                runAsNonRoot: true,
-                allowPrivilegeEscalation: false,
-                seccompProfile: { type: 'RuntimeDefault' },
-                capabilities: { drop: ['ALL'] },
-              }}
-              podSecurityContext={{ seccompProfile: { type: 'RuntimeDefault' } }}
-              resources={sandboxResources}
-            />
-          ) : null}
-        </>
-      ),
-    })
-  )
-
-  // --- Endpoint ---------------------------------------------------------------
-  resources_.push(
-    <Endpoint
-      name={`${name}-endpoint`}
-      namespace={namespace}
-      host={host}
-      serviceName={name}
-      servicePort={3000}
-      tls={tls}
-    />
-  )
-
-  return jsx(Fragment, { children: resources_ })
-}

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": true
-  },
-  "include": ["src/**/*"],
-  "references": [
-    { "path": "../core" },
-    { "path": "../k8s-types" },
-    { "path": "../crds" },
-    { "path": "../recipes" }
-  ]
-}