@styleflow.app/flowpress-deploy 1.0.0-beta.1 → 1.0.0-beta.11

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## 1.0.0-beta.11
+
+- Resolve platform server and panel references from the canonical infrastructure inventory.
+- Reuse an existing CMS image by commit SHA; refuse ambiguous registry failures instead of overwriting a release.
+- Verify status against the image configured in Coolify after CI deployments.
+
+
+## 1.0.0-beta.10
+
+- Keep local HTTP origins out of remote WordPress frontend registries.
+- Read the shared engine administrator secret from the operator configuration; never silently replace a missing pool password.
+
+
+## 1.0.0-beta.9
+
+- Keep editorial pages under /media/ available in static deployments; proxy only media files. Verify the behavior against a real Caddy runtime.
+
+
+## 1.0.0-beta.8
+
+- Exclude private backup files from media snapshots and reject them before uploads. Deny HTTP access to SQL dumps and migration backup directories.
+- Preserve existing schema backup bindings across repeated provisioning.
+
+
+## 1.0.0-beta.7
+
+- Preserve the local backend selection and explicit environment overrides used by isolated build fixtures. Stored environment URLs still defer to the manifest.
+
+
+## 1.0.0-beta.6
+
+- Encode MariaDB configuration for the Coolify API and preserve robot level when extending Harbor pull permissions.
+- Retain current and previous deployment aliases without changing immutable release tags.
+
+
+## 1.0.0-beta.5 — 2026-10-19
+
+- Use individually scoped system robots for repeatable Harbor provisioning; pass content build IDs to SSR health checks.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-piattaforma-container-flowpress.md).
+
+## 1.0.0-beta.4 — 2026-10-19
+
+- Add published FlowPress Ops CLI, readable deployment manifests, shared MariaDB bindings, reusable container runtimes, isolated environment loading, immutable releases, backup verification and on-demand preview.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-piattaforma-container-flowpress.md).
+
+## Unreleased
+
+- Agent rules only, no runtime or API change: `AGENTS.md` names the canonical
+  docs vault path (2026-10-18) and requires every published change to be
+  merged into `main`, with its branches, worktrees and stashes removed in the
+  same task.
+  [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-branch-residui-e-regole-di-chiusura.md).
+
+## 1.0.0-beta.3 — 2026-10-14
+
+- Queue complete builds for term-only changes to published content, including withdrawal after a visibility change. Keep unchanged assignments idle and avoid private data in the queue.
+- Verified public → private → public on disposable WordPress with all outbound HTTP intercepted.
+- [Canonical integration report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md).
+
+## 1.0.0-beta.2 — 2026-10-14
+
+- Automatic debounced editorial builds and public asset validation/history.
+- Use public taxonomy hooks for scheduled builds and export portable link, asset-history and Worker validation tools.
+- [Canonical integration report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md).
+
+
 ## 1.0.0-beta.1
 
 - Added the automatically selected `flowpress-deploy` Core queue provider.

package/README.md

@@ -1,34 +1,11 @@
 # FlowPress Deploy
 
-Installable npm/Composer feature pack for revision-safe editorial queues and
-safe full/partial build orchestration. WordPress owns a durable queue per
-frontend target; frontend workflows keep the existing `batchId`, `target`,
-`mode`, `paths` and `deletedPaths` wire contract.
+Official npm/Composer integration for FlowPress.
 
-The public API validates paths and `_routes.json`, merges partial artifacts
-without traversal or case collisions, regenerates sitemaps, selects Pages for
-static targets and Workers for dev, requires `ASTRO_KEY` for protected batches,
-and acknowledges the CMS queue only after deploy and smoke test. Failed
-batches are released for retry.
+- [Canonical guide](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/flowpress-routing-deploy.md)
+- [Release and verification report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md)
 
-## WordPress queue
+- [Container platform and FlowPress Ops](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/piattaforma-container-flowpress.md)
 
-When the Composer package is installed, Deploy automatically becomes the
-FlowPress Core queue provider. It fingerprints content at the end of the
-request, groups WPML translations, keeps current and previous URIs and stores
-a revision snapshot for every dispatched batch. A callback acknowledges only
-the dispatched revision; concurrent editorial changes remain pending.
-
-Editors can use **Aggiungi alla build queue** from edit screens and list rows.
-Administrators operate the queue in **Strumenti → FlowPress Deploy**.
-
-## Documentation
-
-Start with [docs/README.md](docs/README.md). It links configuration, queue
-semantics, frontend integration, operations, recovery and troubleshooting.
-
-## WordPress Core v1
-
-The `1.0.0-beta.x` line requires FlowPress WordPress Core v1. It does not
-provide a v0.x compatibility constraint or adapter; canary applications pin
-the selected Core prerelease exactly.
+The npm package also provides the flowpress-ops binary, reusable container
+recipes and the ./ops/environment API. Run flowpress-ops --help for commands.

package/containers/cms/Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1.7
+# The reusable PHP runtime is built once by platform build-base.
+ARG FLOWPRESS_PHP_IMAGE
+FROM $FLOWPRESS_PHP_IMAGE AS build
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
+WORKDIR /srv/cms
+COPY apps/cms/ ./
+RUN --mount=type=secret,id=composer_auth,required=true \
+    --mount=type=cache,target=/root/.composer/cache \
+    COMPOSER_AUTH="$(cat /run/secrets/composer_auth)" \
+    composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader --no-progress
+COPY --from=flowpress /cms/install-languages.sh /usr/local/bin/install-languages
+RUN sh /usr/local/bin/install-languages /srv/cms/web
+ARG WP_CLI_VERSION=2.12.0
+ARG WP_CLI_SHA256=ce34ddd838f7351d6759068d09793f26755463b4a4610a5a5c0a97b68220d85c
+RUN curl -fsSL "https://github.com/wp-cli/wp-cli/releases/download/v$WP_CLI_VERSION/wp-cli-$WP_CLI_VERSION.phar" -o /wp-cli.phar \
+ && echo "$WP_CLI_SHA256  /wp-cli.phar" | sha256sum -c - && chmod 755 /wp-cli.phar
+FROM $FLOWPRESS_PHP_IMAGE
+WORKDIR /srv/cms
+COPY --from=build /srv/cms/ ./
+COPY --from=build /wp-cli.phar /usr/local/bin/wp
+COPY --from=flowpress /cms/wp-cli.yml /srv/cms/wp-cli.yml
+COPY --from=flowpress /cms/healthz.php /srv/cms/web/healthz.php
+COPY --from=flowpress /cms/smtp.php /usr/local/share/flowpress-smtp.php
+RUN mkdir -p web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && chown -R www-data:www-data web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && echo 'auto_prepend_file=/usr/local/share/flowpress-smtp.php' > /usr/local/etc/php/conf.d/zz-smtp.ini
+ARG RELEASE_SHA=unknown
+ENV RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER www-data
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 CMD curl -fsS http://127.0.0.1:8080/healthz.php > /dev/null || exit 1
+CMD ["apache2-foreground"]

package/containers/cms/Dockerfile.dockerignore

@@ -0,0 +1,20 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+.styleflow
+apps/web
+packages
+docs
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web/wp
+apps/cms/web/app/plugins
+apps/cms/web/app/uploads
+apps/cms/web/app/webp-express
+apps/cms/web/app/cache
+apps/cms/web/app/upgrade
+apps/cms/web/app/mu-plugins/flowpress-*
+apps/cms/web/app/mu-plugins/flowpress-core

package/containers/cms/healthz.php

@@ -0,0 +1,17 @@
+<?php
+declare(strict_types=1);
+header('Content-Type: application/json');
+header('Cache-Control: no-store');
+try {
+    define('SHORTINIT', true);
+    require __DIR__ . '/wp/wp-load.php';
+    global $wpdb;
+    $installed = $wpdb->get_var("SELECT option_value FROM {$wpdb->options} WHERE option_name = 'siteurl'");
+    if (!$installed || !is_readable(__DIR__ . '/app/mu-plugins/flowpress-core/flowpress-core.php')) {
+        throw new RuntimeException('CMS not initialized.');
+    }
+    echo json_encode(['status' => 'ok', 'environment' => getenv('APP_ENV'), 'release' => getenv('RELEASE_SHA')]);
+} catch (Throwable $error) {
+    http_response_code(503);
+    echo json_encode(['status' => 'error', 'release' => getenv('RELEASE_SHA')]);
+}

package/containers/cms/install-languages.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Installs the Italian WordPress core translation matching the installed core.
+# Languages are gitignored and DISALLOW_FILE_MODS blocks installing them at
+# runtime, so they are part of the image.
+set -eu
+web_root="$1"
+version="$(php -r "include '$web_root/wp/wp-includes/version.php'; echo \$wp_version;")"
+package="$(curl -fsSL "https://api.wordpress.org/translations/core/1.0/?version=$version" \
+  | php -r '$d = json_decode(stream_get_contents(STDIN), true);
+            foreach ($d["translations"] ?? [] as $t) { if ($t["language"] === "it_IT") { echo $t["package"]; exit; } }
+            exit(1);')"
+mkdir -p "$web_root/app/languages"
+curl -fsSL "$package" -o /tmp/it_IT.zip
+unzip -oq /tmp/it_IT.zip -d "$web_root/app/languages"
+rm /tmp/it_IT.zip
+echo "Installed it_IT core translation for WordPress $version."

package/containers/cms/mpm.conf

@@ -0,0 +1,10 @@
+# Sized for a 1536m container limit: 8 workers at up to 256M PHP memory each,
+# typical WordPress requests use far less.
+<IfModule mpm_prefork_module>
+    StartServers             2
+    MinSpareServers          2
+    MaxSpareServers          4
+    ServerLimit              8
+    MaxRequestWorkers        8
+    MaxConnectionsPerChild 500
+</IfModule>

package/containers/cms/php.ini

@@ -0,0 +1,16 @@
+expose_php = Off
+display_errors = Off
+log_errors = On
+error_log = /proc/self/fd/2
+memory_limit = 256M
+upload_max_filesize = 64M
+post_max_size = 68M
+max_execution_time = 120
+max_input_vars = 3000
+session.save_path = /tmp
+; Code is immutable inside the image: never stat files for changes.
+opcache.enable = 1
+opcache.validate_timestamps = 0
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 16
+opcache.max_accelerated_files = 20000

package/containers/cms/sanitize.php

@@ -0,0 +1,37 @@
+<?php
+// Executed only against a disposable copy, never against the source.
+declare(strict_types=1);
+if (getenv('FLOWPRESS_RUNTIME_POLICY') !== 'container' || getenv('APP_ENV') === 'production') {
+    throw new RuntimeException('Refusing to sanitize a production database.');
+}
+global $wpdb;
+foreach (get_users(['fields' => 'ID']) as $user_id) {
+    $wpdb->update($wpdb->users, ['user_pass' => wp_hash_password(wp_generate_password(64, true, true)), 'user_activation_key' => ''], ['ID' => $user_id]);
+    delete_user_meta((int) $user_id, 'session_tokens');
+    delete_user_meta((int) $user_id, '_application_passwords');
+}
+$plugins = get_option('active_plugins', []);
+update_option('active_plugins', array_values(array_filter($plugins, static fn (string $plugin): bool
+    => !preg_match('~^(advanced-media-offloader|wp-mail-smtp|wp-migrate-db-pro)/~', $plugin))));
+foreach (['advmo_settings', 'wp_mail_smtp', 'cron'] as $option) {
+    delete_option($option);
+}
+update_option('home', getenv('WP_HOME'));
+update_option('siteurl', getenv('WP_SITEURL'));
+update_option('blog_public', '0');
+$wpdb->query("DELETE FROM {$wpdb->options} WHERE option_name LIKE 'flowpress%queue%' OR option_name LIKE '%_transient_%'");
+$attachments = get_posts(['post_type' => 'attachment', 'post_status' => 'any', 'numberposts' => -1, 'fields' => 'ids']);
+foreach ($attachments as $id) {
+    $relative = get_post_meta($id, '_wp_attached_file', true);
+    if (is_string($relative) && $relative !== '' && !str_contains($relative, '..') && !str_contains($relative, '://')) {
+        $wpdb->update($wpdb->posts, ['guid' => rtrim(getenv('WP_HOME'), '/') . '/app/uploads/' . ltrim($relative, '/')], ['ID' => $id]);
+    }
+    foreach (array_keys(get_post_meta($id)) as $key) {
+        if (preg_match('/advmo|offload/i', $key)) delete_post_meta($id, $key);
+    }
+}
+echo json_encode([
+    'tables' => count($wpdb->get_col($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($wpdb->prefix) . '%'))),
+    'published' => (int) $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->posts} WHERE post_status='publish'"),
+    'attachments' => count($attachments),
+]) . "\n";

package/containers/cms/smtp.php

@@ -0,0 +1,13 @@
+<?php
+// Runs before Bedrock without reading any project file or persisted option.
+if (getenv('FLOWPRESS_RUNTIME_POLICY') === 'container' && getenv('FLOWPRESS_MAIL_MODE') === 'smtp' && getenv('APP_ENV') === 'production') {
+    foreach ([
+        'WPMS_ON' => true, 'WPMS_MAILER' => 'smtp',
+        'WPMS_SMTP_HOST' => getenv('SMTP_HOST'), 'WPMS_SMTP_PORT' => (int) getenv('SMTP_PORT'),
+        'WPMS_SMTP_SSL' => getenv('SMTP_ENCRYPTION'), 'WPMS_SMTP_AUTH' => true,
+        'WPMS_SMTP_USER' => getenv('SMTP_USER'), 'WPMS_SMTP_PASS' => getenv('SMTP_PASSWORD'),
+        'WPMS_MAIL_FROM' => getenv('SMTP_FROM'), 'WPMS_MAIL_FROM_NAME' => getenv('SMTP_FROM_NAME'),
+    ] as $key => $value) {
+        if (!defined($key)) define($key, $value);
+    }
+}

package/containers/cms/vhost.conf

@@ -0,0 +1,61 @@
+# Apache vhost for the container CMS. .htaccess files are ignored
+# (AllowOverride None): every rule WordPress needs is declared here.
+<VirtualHost *:8080>
+    ServerName localhost
+    DocumentRoot /srv/cms/web
+
+    <Directory /srv/cms/web>
+        AllowOverride None
+        Options +FollowSymLinks -Indexes
+        Require all granted
+        DirectoryIndex index.php
+
+        RewriteEngine On
+        # Application Passwords (cms:template) and Bearer callbacks need the
+        # Authorization header inside PHP.
+        RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+        RewriteRule ^index\.php$ - [L]
+        RewriteCond %{REQUEST_FILENAME} !-f
+        RewriteCond %{REQUEST_FILENAME} !-d
+        RewriteRule . /index.php [L]
+    </Directory>
+
+    # Uploaded files are data, never code.
+    <Directory /srv/cms/web/app/uploads>
+        <FilesMatch "(?i)\.(php[0-9]?|phtml|phar|pht|sql|sql\.gz|env|bak)$">
+            Require all denied
+        </FilesMatch>
+    </Directory>
+    <Directory /srv/cms/web/app/uploads/wp-migrate-db>
+        Require all denied
+    </Directory>
+    <FilesMatch "^\.|^(auth\.json|composer\.(json|lock)|wp-cli\.yml)$">
+        Require all denied
+    </FilesMatch>
+    <Files "xmlrpc.php">
+        Require all denied
+    </Files>
+
+    # Traefik (Docker network) sits in front; Cloudflare adds CF-Connecting-IP.
+    # Only the private proxy hop is trusted, see docs/wiki/deploy/07-sicurezza-e-accessi.md.
+    RemoteIPHeader CF-Connecting-IP
+    RemoteIPInternalProxy 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+    SetEnvIfNoCase X-Forwarded-Proto "^https$" HTTPS=on
+
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresByType image/webp "access plus 30 days"
+        ExpiresByType image/avif "access plus 30 days"
+        ExpiresByType image/jpeg "access plus 30 days"
+        ExpiresByType image/png "access plus 30 days"
+        ExpiresByType image/svg+xml "access plus 30 days"
+        ExpiresByType font/woff2 "access plus 1 year"
+    </IfModule>
+
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+
+    LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" container
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 container
+</VirtualHost>

package/containers/cms/wp-cli.yml

@@ -0,0 +1 @@
+path: web/wp

package/containers/php-runtime/Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1.7
+FROM php:8.3-apache-bookworm
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates curl default-mysql-client libicu-dev libjpeg62-turbo-dev \
+    libpng-dev libwebp-dev libzip-dev unzip webp \
+ && docker-php-ext-configure gd --with-jpeg --with-webp \
+ && docker-php-ext-install exif gd intl mysqli opcache pdo_mysql zip \
+ && a2enmod expires headers remoteip rewrite \
+ && rm -rf /var/lib/apt/lists/*
+COPY cms/vhost.conf /etc/apache2/sites-available/000-default.conf
+COPY cms/mpm.conf /etc/apache2/mods-available/mpm_prefork.conf
+COPY cms/php.ini /usr/local/etc/php/conf.d/zz-container.ini
+RUN sed -i 's/^Listen 80$/Listen 8080/' /etc/apache2/ports.conf \
+ && sed -i '/Listen 443/d' /etc/apache2/ports.conf \
+ && echo 'ServerName localhost' > /etc/apache2/conf-available/servername.conf \
+ && a2enconf servername \
+ && mkdir -p /tmp/apache2 \
+ && chown www-data:www-data /tmp/apache2 \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+ENV APACHE_RUN_DIR=/tmp/apache2 APACHE_PID_FILE=/tmp/apache2/apache2.pid APACHE_LOCK_DIR=/tmp/apache2
+EXPOSE 8080

package/containers/web-ssr/Dockerfile

@@ -0,0 +1,25 @@
+# syntax=docker/dockerfile:1.7
+FROM node:22-bookworm-slim AS dependencies
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+WORKDIR /workspace
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+COPY apps/web/package.json apps/web/package.json
+COPY apps/cms/package.json apps/cms/package.json
+COPY packages/ui packages/ui
+ARG WEB_PACKAGE
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm --filter $WEB_PACKAGE --prod deploy /deploy
+FROM node:22-bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl \
+ && rm -rf /var/lib/apt/lists/* \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+WORKDIR /srv/web
+COPY --from=dependencies /deploy/node_modules ./node_modules
+ARG DIST_DIR
+COPY $DIST_DIR/ ./dist/
+ARG RELEASE_SHA=unknown
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=8080 RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER node
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD curl -fsS http://127.0.0.1:8080/healthz.json > /dev/null || exit 1
+CMD ["node", "dist/server/entry.mjs"]

package/containers/web-ssr/Dockerfile.dockerignore

@@ -0,0 +1,10 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web
+docs

package/containers/web-static/Caddyfile

@@ -0,0 +1,40 @@
+# Static production frontend. Cloudflare terminates TLS and caches at the edge;
+# Traefik forwards plain HTTP to port 8080.
+{
+	admin off
+	auto_https off
+	persist_config off
+	servers {
+		trusted_proxies static private_ranges
+	}
+}
+
+:8080 {
+	header X-Content-Type-Options nosniff
+	header Referrer-Policy strict-origin-when-cross-origin
+	@internal path /.container* /.flowpress* /.env* /server/*
+	respond @internal 404
+	root * /srv/site
+	encode zstd gzip
+
+	# Redirects, headers and media proxies generated from the Astro build.
+	import /srv/site/.container/routes.caddy
+
+	header /healthz.json Cache-Control "no-store"
+	header /_astro/* Cache-Control "public, max-age=31536000, immutable"
+	# HTML revalidates in browsers; Cloudflare keeps it at the edge until the
+	# deploy purge (see docs/wiki/deploy/06-cloudflare.md).
+	@html path / *.html */
+	header @html Cache-Control "public, max-age=0, must-revalidate"
+
+	file_server {
+		hide .container .flowpress-baseline.json .flowpress-fingerprint _redirects _headers _routes.json
+	}
+
+	handle_errors 404 {
+		header Cache-Control "no-store"
+		header CDN-Cache-Control "no-store"
+		rewrite * /404.html
+		file_server
+	}
+}

package/containers/web-static/Dockerfile

@@ -0,0 +1,15 @@
+# syntax=docker/dockerfile:1.7
+FROM caddy:2.10-alpine
+RUN apk add --no-cache libcap && setcap -r /usr/bin/caddy && apk del libcap \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+COPY --from=flowpress /web-static/Caddyfile /etc/caddy/Caddyfile
+ARG DIST_DIR
+COPY $DIST_DIR/ /srv/site/
+RUN test -f /srv/site/.container/routes.caddy && caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+ARG RELEASE_SHA=unknown
+ENV RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER 65534:65534
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz.json || exit 1
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/containers/web-static/Dockerfile.dockerignore

@@ -0,0 +1,7 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+apps/cms
+docs

package/dist/frontend-assets.d.ts

@@ -0,0 +1,2 @@
+export function retainFrontendAssets(output: any, baselineDirectories: any): Promise<number>;
+//# sourceMappingURL=frontend-assets.d.ts.map

package/dist/frontend-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-assets.d.ts","sourceRoot":"","sources":["../src/frontend-assets.js"],"names":[],"mappings":"AAUA,6FA4BC"}

package/dist/frontend-assets.js

@@ -0,0 +1,44 @@
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { frontendFiles } from "./frontend-links.js";
+const manifestName = ".flowpress-asset-generations.json";
+const clientDirectory = output => existsSync(resolve(output, "client")) ? resolve(output, "client") : output;
+// Keep three distinct sets of immutable assets so pages opened before a deploy
+// can still load their styles, scripts and deferred imports. Never retain HTML.
+export async function retainFrontendAssets(output, baselineDirectories) {
+    const client = clientDirectory(output);
+    const current = (await frontendFiles(client)).filter(path => path.startsWith("/_astro/")).sort();
+    const generations = [current];
+    const sources = new Map();
+    for (const baseline of baselineDirectories.filter(existsSync)) {
+        const baselineClient = clientDirectory(baseline);
+        const previousFiles = (await frontendFiles(baselineClient)).filter(path => path.startsWith("/_astro/"));
+        for (const path of previousFiles)
+            if (!sources.has(path))
+                sources.set(path, resolve(baselineClient, path.slice(1)));
+        const manifest = await readFile(resolve(baseline, manifestName), "utf8").then(JSON.parse).catch(() => null);
+        for (const generation of manifest?.generations ?? [previousFiles.sort()]) {
+            if (!generations.some(existing => JSON.stringify(existing) === JSON.stringify(generation)))
+                generations.push(generation);
+        }
+    }
+    const retained = generations.slice(0, 3);
+    let copied = 0;
+    for (const path of new Set(retained.flat())) {
+        if (!/^\/_astro\/[A-Za-z0-9_./@-]+$/.test(path) || path.split("/").some(part => part === ".." || part === "."))
+            throw new Error(`Invalid retained asset: ${path}`);
+        const destination = resolve(client, path.slice(1));
+        if (existsSync(destination))
+            continue;
+        const source = sources.get(path);
+        if (!source)
+            throw new Error(`Baseline is missing retained asset ${path}`);
+        await mkdir(dirname(destination), { recursive: true });
+        await copyFile(source, destination);
+        copied++;
+    }
+    await writeFile(resolve(output, manifestName), `${JSON.stringify({ generations: retained }, null, 2)}\n`);
+    return copied;
+}
+//# sourceMappingURL=frontend-assets.js.map

package/dist/frontend-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-assets.js","sourceRoot":"","sources":["../src/frontend-assets.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,YAAY,GAAG,mCAAmC,CAAC;AACzD,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAE7G,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAM,EAAE,mBAAmB;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,CAAC,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACxG,KAAK,MAAM,IAAI,IAAI,aAAa;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5G,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,WAAW,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;QACnK,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC;IACX,CAAC;IACD,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/frontend-links.d.ts

@@ -0,0 +1,14 @@
+export function frontendFiles(directory: any): Promise<any[]>;
+export function htmlReferences(html: any): any[];
+export function inspectFrontendLinks(directory: any, { origins, workerPatterns }?: {
+    origins?: never[] | undefined;
+    workerPatterns?: never[] | undefined;
+}): Promise<{
+    paths: string[];
+    broken: {
+        source: any;
+        path: string;
+    }[];
+    pages: number;
+}>;
+//# sourceMappingURL=frontend-links.d.ts.map

package/dist/frontend-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-links.d.ts","sourceRoot":"","sources":["../src/frontend-links.js"],"names":[],"mappings":"AAIA,8DAWC;AAED,iDAWC;AAED;;;;;;;;;;GAwCC"}

package/dist/frontend-links.js

@@ -0,0 +1,82 @@
+import { readFile, readdir } from "node:fs/promises";
+import { relative, resolve, sep } from "node:path";
+import { invokesWorkerFirst } from "./worker-assets.js";
+export async function frontendFiles(directory) {
+    const files = [];
+    async function visit(current) {
+        for (const entry of await readdir(current, { withFileTypes: true })) {
+            const absolute = resolve(current, entry.name);
+            if (entry.isDirectory())
+                await visit(absolute);
+            if (entry.isFile())
+                files.push(`/${relative(directory, absolute).split(sep).join("/")}`);
+        }
+    }
+    await visit(directory);
+    return files;
+}
+export function htmlReferences(html) {
+    const references = [];
+    for (const tag of html.matchAll(/<(?:a|link|script|img|source|video|audio|iframe|form)\b[^>]*>/gi)) {
+        for (const attribute of tag[0].matchAll(/\s(href|src|poster|action|srcset)\s*=\s*(?:"([^"]*)"|'([^']*)')/gi)) {
+            const value = (attribute[2] ?? attribute[3]).replaceAll("&amp;", "&");
+            if (attribute[1].toLowerCase() === "srcset") {
+                if (!value.startsWith("data:"))
+                    references.push(...value.split(",").map(item => item.trim().split(/\s+/)[0]));
+            }
+            else
+                references.push(value);
+        }
+    }
+    return references;
+}
+export async function inspectFrontendLinks(directory, { origins = [], workerPatterns = [] } = {}) {
+    const files = await frontendFiles(directory);
+    const existing = new Set(files);
+    const redirectsText = await readFile(resolve(directory, "_redirects"), "utf8").catch(() => "");
+    const redirects = new Map(redirectsText.split("\n").filter(line => line.trim() && !line.startsWith("#")).map(line => {
+        const [source, target] = line.trim().split(/\s+/);
+        return [source, target];
+    }));
+    const origin = origins[0] || "https://frontend.test";
+    const localOrigins = new Set([origin, ...origins]);
+    const paths = new Set(["/"]);
+    for (const file of files.filter(file => file.startsWith("/_astro/")))
+        paths.add(file);
+    const broken = [];
+    const hasRoute = path => existing.has(path) || existing.has(`${path.replace(/\/$/, "")}/index.html`) || existing.has(`${path}.html`) || invokesWorkerFirst(workerPatterns, path);
+    function resolves(path, seen = new Set()) {
+        if (seen.has(path))
+            return false;
+        seen.add(path);
+        if (redirects.has(path)) {
+            const target = new URL(redirects.get(path), origin);
+            return !localOrigins.has(target.origin) || resolves(decodeURIComponent(target.pathname), seen);
+        }
+        return hasRoute(path);
+    }
+    for (const file of files.filter(file => file.endsWith(".html") && file !== "/404.html")) {
+        const route = file.replace(/index\.html$/, "").replace(/\.html$/, "");
+        paths.add(route || "/");
+        for (const reference of htmlReferences(await readFile(resolve(directory, file.slice(1)), "utf8"))) {
+            if (!reference || reference.startsWith("#"))
+                continue;
+            const url = new URL(reference, `${origin}${route}`);
+            if (!["https:", "http:"].includes(url.protocol) || !localOrigins.has(url.origin))
+                continue;
+            const path = decodeURIComponent(url.pathname);
+            if (!resolves(path))
+                broken.push({ source: file, path });
+            else if (!invokesWorkerFirst(workerPatterns, path))
+                paths.add(path);
+        }
+    }
+    for (const [source] of redirects) {
+        if (!resolves(source))
+            broken.push({ source: "_redirects", path: source });
+        else
+            paths.add(source);
+    }
+    return { paths: [...paths].sort(), broken, pages: files.filter(file => file.endsWith(".html") && file !== "/404.html").length };
+}
+//# sourceMappingURL=frontend-links.js.map