@zaaxch/tailframe 4.0.5 → 4.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zaaxch/tailframe",
-	"version": "4.0.5",
+	"version": "4.0.7",
 	"description": "Tailframe architecture toolkit: validates the Tailframe structure, import-boundary, and file-convention contracts. The package version is the contract version.",
 	"type": "module",
 	"bin": {

package/src/new.mjs

@@ -269,6 +269,10 @@ add(`${svc}/.env.example`, `NODE_ENV=development\nPORT=3000\nCORS_ORIGIN=https:/
 add(`${svc}/.env.infrastructure.example`, `ECR_IMAGE=<account>.dkr.ecr.<region>.amazonaws.com/${options.name}
 IMAGE_TAG=<product-sha>
 APP_ENV_FILE=/opt/${options.name}/shared/.env.production
+CADDY_ORIGIN_CERTIFICATE=/opt/${options.name}/shared/caddy/origin.pem
+CADDY_ORIGIN_KEY=/opt/${options.name}/shared/caddy/origin-key.pem
+CADDY_DATA_DIR=/opt/${options.name}/shared/caddy/data
+CADDY_CONFIG_DIR=/opt/${options.name}/shared/caddy/config
 ${postgres ? `POSTGRES_DATA_DIR=/opt/${options.name}/shared/postgres/data
 POSTGRES_ROOT_PASSWORD=<uri-safe-random-value>
 POSTGRES_APP_PASSWORD=<different-uri-safe-random-value>
@@ -292,7 +296,7 @@ export const env = {
 	firebaseServiceAccountPath: process.env.FIREBASE_SERVICE_ACCOUNT_PATH,` : ""}
 	${postgres ? `postgresUri: process.env.POSTGRES_URI ?? "postgresql://${options.name}-app:development@localhost:5432/${databaseName}",` : `mongodbUri: process.env.MONGODB_URI ?? "mongodb://localhost:27017/?replicaSet=rs0&directConnection=true",
 	mongodbDbName: process.env.MONGODB_DB_NAME ?? "${databaseName}",`}
-	${options.redis ? `redisUrl: process.env.REDIS_URL ?? "redis://localhost:6379",` : ""}
+	${options.redis ? `redisUrl: process.env.REDIS_URL ?? "redis://localhost:6379"` : ""}
 };`);
 const databaseSource = postgres ? `import { Pool } from "pg";
 import { env } from "@/platform/config/env";
@@ -358,15 +362,36 @@ if (options.worker) add(`${svc}/src/worker.ts`, `import "reflect-metadata";\nimp
 add(`${svc}/src/modules/health/__tests__/GetHealth.test.ts`, getHealthTestSource);
 add(`${svc}/src/modules/health/__tests__/GetReadiness.test.ts`, getReadinessTestSource);
 add(`${svc}/src/__tests__/testDb.ts`, postgres ? `import { Pool } from "pg";
-const pool = new Pool({ connectionString: process.env.TEST_POSTGRES_URI ?? "postgresql://postgres:postgres@localhost:5433/${databaseName}_test" });
-export async function openTestDatabase() { await pool.query("SELECT 1"); return pool; }
-export async function resetTestDatabase() { await pool.query("DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public"); return pool; }
-export async function closeTestDatabase() { await pool.end(); }
+const pool = new Pool({
+	connectionString: process.env.TEST_POSTGRES_URI ?? "postgresql://postgres:postgres@localhost:5433/${databaseName}_test"
+});
+export async function openTestDatabase() {
+	await pool.query("SELECT 1");
+	return pool;
+}
+export async function resetTestDatabase() {
+	await pool.query("DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public");
+	return pool;
+}
+export async function closeTestDatabase() {
+	await pool.end();
+}
 ` : `import { MongoClient } from "mongodb";
-const client = new MongoClient(process.env.TEST_MONGODB_URI ?? "mongodb://localhost:27018/?replicaSet=rs0&directConnection=true");
-export async function openTestDatabase() { await client.connect(); return client.db(process.env.TEST_MONGODB_DB_NAME ?? "${options.name.replaceAll("-", "_")}_test"); }
-export async function resetTestDatabase() { const database = await openTestDatabase(); await database.dropDatabase(); return database; }
-export async function closeTestDatabase() { await client.close(); }
+const client = new MongoClient(
+	process.env.TEST_MONGODB_URI ?? "mongodb://localhost:27018/?replicaSet=rs0&directConnection=true"
+);
+export async function openTestDatabase() {
+	await client.connect();
+	return client.db(process.env.TEST_MONGODB_DB_NAME ?? "${options.name.replaceAll("-", "_")}_test");
+}
+export async function resetTestDatabase() {
+	const database = await openTestDatabase();
+	await database.dropDatabase();
+	return database;
+}
+export async function closeTestDatabase() {
+	await client.close();
+}
 `);
 add(`${svc}/docker-compose.test.yml`, postgres ? `name: ${options.name}-test
 services:
@@ -468,13 +493,20 @@ ${csrf ? `
 ` : ""}${options.ui ? `
 	it("serves the production SPA without falling through for API paths", async () => {
 		const app = createApplication({ production: true, publicPath: path.join(__dirname, "fixtures/public") });
-		await request(app).get("/dashboard").expect(200).expect(({ text }) => expect(text).toContain("boundary-test-spa"));
+		await request(app)
+			.get("/dashboard")
+			.expect(200)
+			.expect(({ text }) => expect(text).toContain("boundary-test-spa"));
 		await request(app).get("/api/v1/does-not-exist").expect(404);
-	});
-` : ""}
+	});` : ""}
 });
 `);
-if (options.ui) add(`${svc}/src/app/__tests__/fixtures/public/index.html`, `<!doctype html><html><body><div id="app">boundary-test-spa</div></body></html>`);
+if (options.ui) add(`${svc}/src/app/__tests__/fixtures/public/index.html`, `<!doctype html>
+<html>
+	<body>
+		<div id="app">boundary-test-spa</div>
+	</body>
+</html>`);
 add(`${svc}/AGENTS.md`, `# ${title} service guidance
 
 ## Scope
@@ -659,8 +691,22 @@ import NotificationHost from "@/app/components/NotificationHost.vue";
 </script>`);
 add(`${ui}/src/app/startApplication.ts`, `import { createApp } from "vue";\nimport { createPinia } from "pinia";\nimport PrimeVue from "primevue/config";\nimport App from "@/app/App.vue";\n${options.auth === "firebase" ? 'import { configureHttp } from "@/app/configureHttp";\n' : ""}import router from "@/app/router";\nimport "@/app/styles.css";\nexport function startApplication() {\n\tconst app = createApp(App);\n\tconst pinia = createPinia();\n\tapp.use(pinia).use(PrimeVue).use(router);\n\t${options.auth === "firebase" ? "configureHttp(pinia);\n\t" : ""}app.mount("#app");\n}\n`);
 add(`${ui}/src/main.ts`, `import { startApplication } from "@/app/startApplication";\nstartApplication();\n`);
-add(`${ui}/src/app/styles.css`, `@import "tailwindcss";\n:root { font-family: Inter, ui-sans-serif, system-ui; color: #17221c; background: #f5f3ec; }\nbody { margin: 0; }`);
-add(`${ui}/src/app/__tests__/App.spec.ts`, `import { mount } from "@vue/test-utils";\nimport App from "@/app/App.vue";\ndescribe("App", () => { it("renders a router view", () => { expect(mount(App, { global: { stubs: ["RouterView", "NotificationHost"] } }).exists()).toBe(true); }); });`);
+add(`${ui}/src/app/styles.css`, `@import "tailwindcss";
+:root {
+	font-family: Inter, ui-sans-serif, system-ui;
+	color: #17221c;
+	background: #f5f3ec;
+}
+body {
+	margin: 0;
+}`);
+add(`${ui}/src/app/__tests__/App.spec.ts`, `import { mount } from "@vue/test-utils";
+import App from "@/app/App.vue";
+describe("App", () => {
+	it("renders a router view", () => {
+		expect(mount(App, { global: { stubs: ["RouterView", "NotificationHost"] } }).exists()).toBe(true);
+	});
+});`);
 add(`${ui}/AGENTS.md`, `# ${title} UI guidance
 
 ## Scope
@@ -1148,6 +1194,9 @@ configured. No push or merge deploys production automatically.
 Configure the ECR repository with immutable image tags. The release-only role may publish; the distinct deployment
 role is pull-only. Record the full commit SHA and ECR digest; deployment and product migrations use that release image.
 
+Production ingress is a required Caddy reverse proxy in every generated service deployment. The application container remains
+internal; Caddy is the only edge surface and must own 80/443 exposure.
+
 The host separates replaceable artifacts from persistent state:
 
 \`\`\`text
@@ -1159,6 +1208,12 @@ The host separates replaceable artifacts from persistent state:
 └── shared/
     ├── .env.production
     ├── .env.infrastructure
+    ├── caddy/
+    │   ├── certs/
+    │   │   ├── origin.pem
+    │   │   └── origin-key.pem
+    │   ├── config/
+    │   └── data/
 ${options.auth === "firebase" ? `    ├── secrets/firebase-service-account.json
 ` : ""}${postgres ? `    ├── postgres/data/
 ` : `    ├── mongo/config/keyfile
@@ -1173,6 +1228,8 @@ Actions may replace \`current/\` and must never replace \`shared/\`. The server
 - \`.env.production\` contains Node application behavior and provider credentials.
 - \`.env.infrastructure\` contains Compose paths, image identity, and infrastructure passwords. Start from
   \`.env.infrastructure.example\` and replace every placeholder.
+- \`.env.infrastructure\` is also the host-owned control plane for Caddy certificate paths and runtime directories; keep TLS
+  key material under shared storage and rotate it independently from application images.
 - Compose \`environment:\` owns fixed production wiring: \`NODE_ENV\`, internal database/cache URLs, and mounted
   credential paths.
 ${options.ui && options.auth === "firebase" ? `- The UI application's build-time \`.env.production\` comes from the GitHub \`UI_ENV_PRODUCTION\` secret and is unrelated to the service runtime file above.
@@ -1183,9 +1240,11 @@ Do not inject \`.env.infrastructure\` into Node. Make both host environment file
 
 1. Install Docker Engine and Docker Compose.
 ${postgres
-	? `2. Create \`/opt/${options.name}/current/deploy/postgres\` and \`/opt/${options.name}/shared/postgres/data\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`
+	? `2. Create \`/opt/${options.name}/current/deploy/postgres\`, \`/opt/${options.name}/shared/postgres/data\`,
+   \`/opt/${options.name}/shared/caddy/certs\`, \`/opt/${options.name}/shared/caddy/data\`, \`/opt/${options.name}/shared/caddy/config\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`
 	: `2. Create \`/opt/${options.name}/current/deploy/mongo\`, \`/opt/${options.name}/shared/mongo/config\`, and
-   \`/opt/${options.name}/shared/mongo/data\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`}
+   \`/opt/${options.name}/shared/mongo/data\`, \`/opt/${options.name}/shared/caddy/certs\`,
+   \`/opt/${options.name}/shared/caddy/data\`, \`/opt/${options.name}/shared/caddy/config\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`}
 3. Install \`.env.production\` and a completed \`.env.infrastructure\` under \`shared/\`.
 ${postgres ? "" : `4. Generate the MongoDB replica key with \`openssl rand -base64 756\`, make it owned by UID/GID \`999:999\`, and
    mode \`0400\`.
@@ -1289,6 +1348,34 @@ const developmentEnvironment = [
 ];
 const developmentEnvironmentBlock = `\n    environment:\n${developmentEnvironment.join("\n")}`;
 const volumeBlock = serviceVolumes.length ? `\n    volumes:\n${serviceVolumes.join("\n")}` : "";
+const caddyService = `
+  caddy:
+    image: caddy:2-alpine
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - \${CADDY_ORIGIN_CERTIFICATE:?Set CADDY_ORIGIN_CERTIFICATE}:/etc/caddy/certs/origin.pem:ro
+      - \${CADDY_ORIGIN_KEY:?Set CADDY_ORIGIN_KEY}:/etc/caddy/certs/origin-key.pem:ro
+      - \${CADDY_DATA_DIR:?Set CADDY_DATA_DIR}:/data
+      - \${CADDY_CONFIG_DIR:?Set CADDY_CONFIG_DIR}:/config
+    depends_on:
+      ${options.name}:
+        condition: service_healthy
+    networks:
+      - backend
+    restart: unless-stopped`;
+add(`${svc}/Caddyfile`, `{
+    auto_https off
+}
+:80 {
+    redir https://{host}{uri} 308
+}
+:443 {
+    tls /etc/caddy/certs/origin.pem /etc/caddy/certs/origin-key.pem
+    reverse_proxy ${options.name}:3000
+}`);
 const workerService = options.worker ? `\n  worker:
     image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:?Set IMAGE_TAG}
     env_file:
@@ -1431,8 +1518,7 @@ services:
     image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:?Set IMAGE_TAG}
     env_file:
       - \${APP_ENV_FILE:-.env.production}
-    ports:
-      - "3000:3000"${productionEnvironmentBlock}${volumeBlock}${dependsBlock}
+${productionEnvironmentBlock}${volumeBlock}${dependsBlock}
     healthcheck:
       test:
         - CMD-SHELL
@@ -1448,7 +1534,7 @@ services:
     stop_grace_period: 2m
     networks:
       - backend
-    restart: unless-stopped${workerService}${schemaInitService}${databaseService}${redisService}
+    restart: unless-stopped${workerService}${schemaInitService}${databaseService}${redisService}${caddyService}
 networks:
   backend:
     driver: bridge

package/src/owned-sources.mjs

@@ -80,7 +80,10 @@ const errorTranslationTestSource = `import { AppError, type FailureKind } from "
 import { errorHandler } from "@/platform/http/errors";
 import { logger } from "@/platform/logging/logger";
 
-jest.mock("@/platform/logging/logger", () => ({ logger: { log: jest.fn() }, serializeError: (error: unknown) => error }));
+jest.mock("@/platform/logging/logger", () => ({
+	logger: { log: jest.fn() },
+	serializeError: (error: unknown) => error
+}));
 
 const log = logger.log as jest.MockedFunction<typeof logger.log>;
 
@@ -104,13 +107,15 @@ it.each(statuses)("translates %s to HTTP %i", (kind, status) => {
 	errorHandler(new AppError({ code: "CODE", message: "message", kind }), request, response, jest.fn());
 	expect((response as { status: jest.Mock }).status).toHaveBeenCalledWith(status);
 	expect(json).toHaveBeenCalledWith({ error: { code: "CODE", message: "message" } });
-	expect(log).toHaveBeenCalledWith(expect.objectContaining({
-		level: status >= 500 ? "error" : "warn",
-		event: "http.request.failed",
-		requestId: "request-1",
-		code: "CODE",
-		kind
-	}));
+	expect(log).toHaveBeenCalledWith(
+		expect.objectContaining({
+			level: status >= 500 ? "error" : "warn",
+			event: "http.request.failed",
+			requestId: "request-1",
+			code: "CODE",
+			kind
+		})
+	);
 });
 
 it("logs an unknown failure without exposing it to the client", () => {
@@ -120,11 +125,13 @@ it("logs an unknown failure without exposing it to the client", () => {
 	const error = new Error("database disconnected");
 	errorHandler(error, { method: "POST", path: "/health.get" } as never, response, jest.fn());
 	expect(json).toHaveBeenCalledWith({ error: { code: "INTERNAL", message: "Internal server error" } });
-	expect(log).toHaveBeenCalledWith(expect.objectContaining({
-		level: "error",
-		code: "INTERNAL",
-		error: expect.objectContaining({ message: "database disconnected" })
-	}));
+	expect(log).toHaveBeenCalledWith(
+		expect.objectContaining({
+			level: "error",
+			code: "INTERNAL",
+			error: expect.objectContaining({ message: "database disconnected" })
+		})
+	);
 });
 
 it("logs a preserved application-error cause", () => {
@@ -138,9 +145,13 @@ it("logs a preserved application-error cause", () => {
 		response,
 		jest.fn()
 	);
-	expect(log).toHaveBeenCalledWith(expect.objectContaining({
-		error: expect.objectContaining({ cause: expect.objectContaining({ message: "Firebase token verification failed" }) })
-	}));
+	expect(log).toHaveBeenCalledWith(
+		expect.objectContaining({
+			error: expect.objectContaining({
+				cause: expect.objectContaining({ message: "Firebase token verification failed" })
+			})
+		})
+	);
 });
 `;
 

package/src/service-templates.mjs

@@ -417,7 +417,15 @@ export function createRateLimiter(client: RedisClientType, policy: RateLimitPoli
 			if (error instanceof RateLimiterRes)
 				next(new AppError({ code: "RATE_LIMITED", message: "Too many requests", kind: "rate_limited" }));
 			else if (error instanceof AppError) next(error);
-			else next(new AppError({ code: "RATE_LIMIT_UNAVAILABLE", message: "Request protection unavailable", kind: "unavailable", cause: error }));
+			else
+				next(
+					new AppError({
+						code: "RATE_LIMIT_UNAVAILABLE",
+						message: "Request protection unavailable",
+						kind: "unavailable",
+						cause: error
+					})
+				);
 		}
 	};
 }
@@ -499,7 +507,12 @@ export class GetReadiness implements UseCase<Record<string, never>, ReadinessRes
 			await Promise.all(this.probes.map((probe) => probe.check()));
 			return { status: "ready" };
 		} catch (error) {
-			throw new AppError({ code: "NOT_READY", message: "Service is not ready", kind: "unavailable", cause: error });
+			throw new AppError({
+				code: "NOT_READY",
+				message: "Service is not ready",
+				kind: "unavailable",
+				cause: error
+			});
 		}
 	}
 }