create-flowdular 0.2.6 → 0.3.1

package/template/default/infra/docker/compose.yaml

@@ -0,0 +1,158 @@
+services:
+  postgres-tls:
+    image: postgres:17
+    entrypoint: ['/bin/bash', '/tls-init.sh']
+    volumes:
+      - ./postgres/tls-init.sh:/tls-init.sh:ro
+      - flowdular-postgres-tls:/tls
+    restart: 'no'
+
+  postgres:
+    image: postgres:17
+    depends_on:
+      postgres-tls:
+        condition: service_completed_successfully
+    environment:
+      POSTGRES_DB: flowdular
+      POSTGRES_PASSWORD: ${FD_POSTGRES_SUPERUSER_PASSWORD:?Set FD_POSTGRES_SUPERUSER_PASSWORD in infra/docker/.env (openssl rand -base64 32)}
+      FD_DATABASE_MIGRATOR_PASSWORD: ${FD_DATABASE_MIGRATOR_PASSWORD:?Set FD_DATABASE_MIGRATOR_PASSWORD in infra/docker/.env (openssl rand -base64 32)}
+      FD_DATABASE_RUNTIME_PASSWORD: ${FD_DATABASE_RUNTIME_PASSWORD:?Set FD_DATABASE_RUNTIME_PASSWORD in infra/docker/.env (openssl rand -base64 32)}
+      FD_DATABASE_BACKGROUND_PASSWORD: ${FD_DATABASE_BACKGROUND_PASSWORD:?Set FD_DATABASE_BACKGROUND_PASSWORD in infra/docker/.env (openssl rand -base64 32)}
+    command:
+      - postgres
+      - -c
+      - ssl=on
+      - -c
+      - ssl_cert_file=/tls/server.crt
+      - -c
+      - ssl_key_file=/tls/server.key
+    volumes:
+      - flowdular-postgres:/var/lib/postgresql/data
+      - flowdular-postgres-tls:/tls:ro
+      - ./postgres/10-roles.sh:/docker-entrypoint-initdb.d/10-roles.sh:ro
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U postgres -d flowdular']
+      interval: 10s
+      timeout: 3s
+      retries: 10
+      start_period: 15s
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+
+  # Rollout gate. Each module applies its own migrations on first use through a
+  # migration lease, so this one-shot run does not apply anything: it reports
+  # what is pending and fails the rollout when an applied migration no longer
+  # matches the checksum of the code being deployed. It needs the workspace and
+  # the CLI, so it runs the builder stage rather than the runtime image.
+  migration-check:
+    build:
+      context: ../..
+      dockerfile: infra/docker/Dockerfile
+      target: builder
+    image: flowdular-app-builder:local
+    depends_on:
+      postgres:
+        condition: service_healthy
+    command: ['pnpm', 'flowdular', 'migration', 'status', '--json']
+    environment:
+      FD_DATABASE_ADAPTER: postgresql
+      FD_DATABASE_URL: postgresql://coreloom_runtime:${FD_DATABASE_RUNTIME_PASSWORD}@postgres:5432/flowdular
+      FD_DATABASE_MIGRATOR_URL: postgresql://coreloom_migrator:${FD_DATABASE_MIGRATOR_PASSWORD}@postgres:5432/flowdular
+      FD_DATABASE_TLS: verify-full
+      FD_DATABASE_TLS_CA_FILE: /tls/server.crt
+    volumes:
+      - flowdular-postgres-tls:/tls:ro
+    security_opt:
+      - no-new-privileges:true
+    restart: 'no'
+
+  app:
+    build:
+      context: ../..
+      dockerfile: infra/docker/Dockerfile
+    image: flowdular-app:local
+    depends_on:
+      postgres:
+        condition: service_healthy
+      migration-check:
+        condition: service_completed_successfully
+    environment:
+      NODE_ENV: production
+      PORT: 3000
+      # Every module reads and writes through the platform provider; the
+      # deployment has one database and no per-module files.
+      FD_DATABASE_ADAPTER: postgresql
+      FD_DATABASE_URL: postgresql://coreloom_runtime:${FD_DATABASE_RUNTIME_PASSWORD}@postgres:5432/flowdular
+      FD_DATABASE_MIGRATOR_URL: postgresql://coreloom_migrator:${FD_DATABASE_MIGRATOR_PASSWORD}@postgres:5432/flowdular
+      # Cross-tenant reads (the scheduler poll) run as this role. It carries no
+      # blanket grant: a migration hands it named columns under its own policy.
+      FD_DATABASE_BACKGROUND_URL: postgresql://coreloom_background:${FD_DATABASE_BACKGROUND_PASSWORD}@postgres:5432/flowdular
+      FD_DATABASE_TLS: verify-full
+      FD_DATABASE_TLS_CA_FILE: /tls/server.crt
+      FD_AUTH_ALLOW_SIGN_UP: 'false'
+      # TLS terminates in front of this container. Only a plain-HTTP run on a
+      # workstation may set FD_AUTH_SECURE_COOKIE=false in .env.
+      FD_AUTH_SECURE_COOKIE: ${FD_AUTH_SECURE_COOKIE:-true}
+      # Every key comes from infra/docker/.env (copy the root .env.example).
+      # Compose refuses to start without them; the owning module would refuse at
+      # boot anyway.
+      FD_AGENT_CREDENTIAL_KEY: ${FD_AGENT_CREDENTIAL_KEY:?Set FD_AGENT_CREDENTIAL_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_AGENT_RUN_GRANT_KEY: ${FD_AGENT_RUN_GRANT_KEY:?Set FD_AGENT_RUN_GRANT_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_AUTOMATIONS_CREDENTIAL_KEY: ${FD_AUTOMATIONS_CREDENTIAL_KEY:?Set FD_AUTOMATIONS_CREDENTIAL_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_NOTIFICATIONS_SECRET_KEY: ${FD_NOTIFICATIONS_SECRET_KEY:?Set FD_NOTIFICATIONS_SECRET_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_WORKFLOWS_PAYLOAD_KEY: ${FD_WORKFLOWS_PAYLOAD_KEY:?Set FD_WORKFLOWS_PAYLOAD_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_WORKFLOWS_CURSOR_KEY: ${FD_WORKFLOWS_CURSOR_KEY:?Set FD_WORKFLOWS_CURSOR_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_STORAGE_ENCRYPTION_KEY: ${FD_STORAGE_ENCRYPTION_KEY:?Set FD_STORAGE_ENCRYPTION_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_CONNECTORS_SECRET_KEY: ${FD_CONNECTORS_SECRET_KEY:?Set FD_CONNECTORS_SECRET_KEY in infra/docker/.env (openssl rand -base64 32)}
+      FD_AUDIT_ANCHOR_KEY: ${FD_AUDIT_ANCHOR_KEY:?Set FD_AUDIT_ANCHOR_KEY in infra/docker/.env (openssl rand -base64 32)}
+      # Object storage. Production refuses the local adapter, so the app writes
+      # to an S3-compatible bucket and encrypts every object under
+      # FD_STORAGE_ENCRYPTION_KEY before it leaves the process. The named volume
+      # below is the writable path the local adapter needs when this stack is
+      # run outside production for a demonstration.
+      FD_STORAGE_ADAPTER: ${FD_STORAGE_ADAPTER:-s3}
+      FD_STORAGE_LOCAL_DIRECTORY: /var/lib/flowdular/storage
+      FD_STORAGE_S3_BUCKET: ${FD_STORAGE_S3_BUCKET:-}
+      FD_STORAGE_S3_REGION: ${FD_STORAGE_S3_REGION:-}
+      FD_STORAGE_S3_ENDPOINT: ${FD_STORAGE_S3_ENDPOINT:-}
+      FD_STORAGE_S3_ACCESS_KEY_ID: ${FD_STORAGE_S3_ACCESS_KEY_ID:-}
+      FD_STORAGE_S3_SECRET_ACCESS_KEY: ${FD_STORAGE_S3_SECRET_ACCESS_KEY:-}
+      FD_STORAGE_S3_FORCE_PATH_STYLE: ${FD_STORAGE_S3_FORCE_PATH_STYLE:-false}
+      # Optional: without it the app runs and only MFA enrollment is unavailable.
+      FD_AUTH_MFA_KEY: ${FD_AUTH_MFA_KEY:-}
+      # Outgoing mail. With none, invitations and password resets are refused.
+      FD_AUTH_MAIL_TRANSPORT: ${FD_AUTH_MAIL_TRANSPORT:-none}
+      FD_TRUST_PROXY: ${FD_TRUST_PROXY:-false}
+      FD_METRICS: ${FD_METRICS:-false}
+      FD_METRICS_TOKEN: ${FD_METRICS_TOKEN:-}
+      FD_AUTH_SMTP_URL: ${FD_AUTH_SMTP_URL:-}
+      FD_AUTH_MAIL_FROM: ${FD_AUTH_MAIL_FROM:-}
+    ports:
+      - '${FD_PORT:-3000}:3000'
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:3000/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 10s
+    init: true
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    volumes:
+      - flowdular-postgres-tls:/tls:ro
+      - flowdular-storage:/var/lib/flowdular/storage
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+
+volumes:
+  flowdular-postgres:
+  flowdular-postgres-tls:
+  # Only the local adapter writes here; a production run uses the S3 bucket.
+  flowdular-storage:

package/template/default/infra/docker/postgres/10-roles.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# Runs once, during first cluster initialization. The migrator owns the schema;
+# the runtime and background roles hold neither SUPERUSER nor BYPASSRLS, so the
+# row-level security every tenant table forces actually binds the application.
+# The background role exists for the cross-tenant scheduler poll only. It gets
+# no blanket table grant here: each migration grants it the exact columns its
+# poll reads, under a policy of that table's own.
+set -euo pipefail
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<SQL
+CREATE ROLE coreloom_migrator LOGIN PASSWORD '${FD_DATABASE_MIGRATOR_PASSWORD}'
+	NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
+CREATE ROLE coreloom_runtime LOGIN PASSWORD '${FD_DATABASE_RUNTIME_PASSWORD}'
+	NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
+CREATE ROLE coreloom_background LOGIN PASSWORD '${FD_DATABASE_BACKGROUND_PASSWORD}'
+	NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
+
+REVOKE CONNECT ON DATABASE "$POSTGRES_DB" FROM PUBLIC;
+GRANT CONNECT ON DATABASE "$POSTGRES_DB" TO coreloom_migrator, coreloom_runtime, coreloom_background;
+
+ALTER SCHEMA public OWNER TO coreloom_migrator;
+REVOKE ALL ON SCHEMA public FROM PUBLIC;
+GRANT USAGE ON SCHEMA public TO coreloom_runtime, coreloom_background;
+
+-- Every table the migrator creates later is reachable by the runtime role
+-- without a second grant step after each migration.
+ALTER DEFAULT PRIVILEGES FOR ROLE coreloom_migrator IN SCHEMA public
+	GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO coreloom_runtime;
+ALTER DEFAULT PRIVILEGES FOR ROLE coreloom_migrator IN SCHEMA public
+	GRANT USAGE, SELECT ON SEQUENCES TO coreloom_runtime;
+SQL

package/template/default/infra/docker/postgres/tls-init.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Generates the server certificate Postgres presents and the app verifies.
+# Idempotent: an existing pair is kept so a restart does not invalidate a
+# certificate the app already trusts.
+set -euo pipefail
+
+certificate=/tls/server.crt
+key=/tls/server.key
+
+if [ -s "$certificate" ] && [ -s "$key" ]; then
+	echo "PostgreSQL TLS material is already present."
+	exit 0
+fi
+
+# The common name and SAN must be the compose service name, because the app
+# connects to host "postgres" under FD_DATABASE_TLS=verify-full.
+openssl req -new -x509 -nodes -days 3650 \
+	-newkey rsa:2048 \
+	-subj '/CN=postgres' \
+	-addext 'subjectAltName=DNS:postgres' \
+	-keyout "$key" \
+	-out "$certificate"
+
+# Postgres refuses to start when the private key is group or world readable.
+chown 999:999 "$key" "$certificate"
+chmod 600 "$key"
+chmod 644 "$certificate"
+echo "Generated a self-signed PostgreSQL server certificate for CN=postgres."

package/template/default/infra/kubernetes/database-secret.example.yaml

@@ -0,0 +1,15 @@
+# The deployment reads one database through three roles. The migrator owns the
+# schema, the runtime role holds neither SUPERUSER nor BYPASSRLS so forced row
+# level security binds it, and the background role serves the cross-tenant
+# scheduler poll with no blanket table grant.
+#
+# Create the real Secret out of band; this file documents the shape.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: flowdular-database
+type: Opaque
+stringData:
+  migratorUrl: postgresql://coreloom_migrator:CHANGE_ME@postgres:5432/flowdular
+  runtimeUrl: postgresql://coreloom_runtime:CHANGE_ME@postgres:5432/flowdular
+  backgroundUrl: postgresql://coreloom_background:CHANGE_ME@postgres:5432/flowdular

package/template/default/infra/kubernetes/deployment.yaml

@@ -0,0 +1,211 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: flowdular-app
+  labels:
+    app.kubernetes.io/name: flowdular-app
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: flowdular-app
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: flowdular-app
+      annotations:
+        prometheus.io/scrape: 'true'
+        prometheus.io/path: /api/metrics
+        prometheus.io/port: '3000'
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: 1001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: app
+          # Replace with the image you publish; kustomization.yaml pins the tag.
+          image: ghcr.io/OWNER/REPOSITORY:0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: PORT
+              value: '3000'
+            - name: FD_DATABASE_ADAPTER
+              value: postgresql
+            - name: FD_DATABASE_TLS
+              value: verify-full
+            # One database for the whole deployment. The runtime role holds
+            # neither SUPERUSER nor BYPASSRLS, the migrator owns the schema, and
+            # the background role serves the cross-tenant scheduler poll.
+            - name: FD_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-database
+                  key: runtimeUrl
+            - name: FD_DATABASE_MIGRATOR_URL
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-database
+                  key: migratorUrl
+            - name: FD_DATABASE_BACKGROUND_URL
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-database
+                  key: backgroundUrl
+            - name: FD_AUTH_ALLOW_SIGN_UP
+              value: 'false'
+            - name: FD_AUTH_SECURE_COOKIE
+              value: 'true'
+            # With none, invitations and password resets are refused. The smtp
+            # transport also needs FD_AUTH_SMTP_URL, which carries the relay
+            # password and belongs in a Secret, and FD_AUTH_MAIL_FROM.
+            # The Service and any ingress sit in front of this port. Set true
+            # only when that ingress overwrites x-forwarded-for.
+            - name: FD_TRUST_PROXY
+              value: 'false'
+            - name: FD_METRICS
+              value: 'true'
+            # Without a token /api/metrics answers any client that can reach the
+            # application port. Optional so a cluster that keeps the port on a
+            # scrape-only network can decide to leave it unset.
+            - name: FD_METRICS_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: metricsToken
+                  optional: true
+            # Outgoing mail. none refuses workspace invitations and delivers no
+            # password reset message. Switch to smtp once the Secret carries
+            # smtpUrl and set the sender the relay accepts.
+            - name: FD_AUTH_MAIL_TRANSPORT
+              value: 'none'
+            # agents.core, automations.core and workflows.core refuse to boot in
+            # production without their key. See secrets.example.yaml.
+            - name: FD_AGENT_CREDENTIAL_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: agentCredentialKey
+            - name: FD_AGENT_RUN_GRANT_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: agentRunGrantKey
+            - name: FD_AUTOMATIONS_CREDENTIAL_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: automationsCredentialKey
+            - name: FD_NOTIFICATIONS_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: notificationsSecretKey
+            - name: FD_WORKFLOWS_PAYLOAD_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: workflowsPayloadKey
+            - name: FD_WORKFLOWS_CURSOR_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: workflowsCursorKey
+            # Object storage. Production refuses the local adapter, so every object
+            # goes to an S3-compatible bucket, encrypted under
+            # FD_STORAGE_ENCRYPTION_KEY before it leaves the pod.
+            - name: FD_STORAGE_ADAPTER
+              value: s3
+            - name: FD_STORAGE_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: storageEncryptionKey
+            - name: FD_CONNECTORS_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: connectorsSecretKey
+            - name: FD_AUDIT_ANCHOR_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: auditAnchorKey
+            - name: FD_STORAGE_S3_BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: storageBucket
+            - name: FD_STORAGE_S3_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: storageRegion
+            # Empty for AWS. MinIO and R2 set their own endpoint, and most
+            # self-hosted gateways also need FD_STORAGE_S3_FORCE_PATH_STYLE.
+            - name: FD_STORAGE_S3_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: storageEndpoint
+                  optional: true
+            - name: FD_STORAGE_S3_FORCE_PATH_STYLE
+              value: 'false'
+            - name: FD_STORAGE_S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: storageAccessKeyId
+            - name: FD_STORAGE_S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: storageSecretAccessKey
+            # Optional: without it only MFA enrollment is unavailable.
+            - name: FD_AUTH_MFA_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: flowdular-secrets
+                  key: authMfaKey
+                  optional: true
+          # Readiness also proves the database answers and that the runtime role
+          # holds neither SUPERUSER nor BYPASSRLS; liveness stays static.
+          readinessProbe:
+            httpGet:
+              path: /api/ready
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi

package/template/default/infra/kubernetes/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml
+images:
+  # Replace with the image you publish.
+  - name: ghcr.io/OWNER/REPOSITORY
+    newTag: 0.1.0

package/template/default/infra/kubernetes/secrets.example.yaml

@@ -0,0 +1,52 @@
+# Example only: not listed in kustomization.yaml. Create the real Secret out of
+# band, for example:
+#   kubectl create secret generic flowdular-secrets \
+#     --from-literal=agentCredentialKey="$(openssl rand -base64 32)" \
+#     --from-literal=agentRunGrantKey="$(openssl rand -base64 32)" \
+#     --from-literal=automationsCredentialKey="$(openssl rand -base64 32)" \
+#     --from-literal=notificationsSecretKey="$(openssl rand -base64 32)" \
+#     --from-literal=workflowsPayloadKey="$(openssl rand -base64 32)" \
+#     --from-literal=workflowsCursorKey="$(openssl rand -base64 32)" \
+#     --from-literal=storageEncryptionKey="$(openssl rand -base64 32)" \
+#     --from-literal=connectorsSecretKey="$(openssl rand -base64 32)" \
+#     --from-literal=auditAnchorKey="$(openssl rand -base64 32)" \
+#     --from-literal=storageBucket="flowdular-objects" \
+#     --from-literal=storageRegion="eu-central-1" \
+#     --from-literal=storageAccessKeyId="..." \
+#     --from-literal=storageSecretAccessKey="..."
+# storageEndpoint is optional: leave it unset for AWS, set it for MinIO or R2:
+#     --from-literal=storageEndpoint="https://minio.internal:9000"
+#
+# Rotating agentCredentialKey invalidates every stored provider credential.
+# Rotating workflowsPayloadKey makes retained execution payloads unreadable.
+#
+# metricsToken is optional and is the bearer token a /api/metrics scrape must
+# present. Without it the endpoint answers any client that reaches the port:
+#   --from-literal=metricsToken="$(openssl rand -base64 32)"
+apiVersion: v1
+kind: Secret
+metadata:
+  name: flowdular-secrets
+  labels:
+    app.kubernetes.io/name: flowdular-app
+type: Opaque
+stringData:
+  agentCredentialKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  agentRunGrantKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  automationsCredentialKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  notificationsSecretKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  workflowsPayloadKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  workflowsCursorKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  storageEncryptionKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  connectorsSecretKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  auditAnchorKey: REPLACE_WITH_BASE64_32_BYTE_KEY
+  storageBucket: REPLACE_WITH_OBJECT_BUCKET
+  storageRegion: REPLACE_WITH_OBJECT_REGION
+  storageAccessKeyId: REPLACE_WITH_OBJECT_ACCESS_KEY_ID
+  storageSecretAccessKey: REPLACE_WITH_OBJECT_SECRET_ACCESS_KEY
+  # Optional: leave unset for AWS, set it for MinIO or R2.
+  storageEndpoint: REPLACE_WITH_OBJECT_ENDPOINT_OR_REMOVE
+  # Optional, base64url encoded.
+  authMfaKey: REPLACE_WITH_BASE64URL_32_BYTE_KEY
+  # Optional.
+  metricsToken: REPLACE_WITH_SCRAPE_TOKEN_OR_REMOVE

package/template/default/infra/kubernetes/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: flowdular-app
+  labels:
+    app.kubernetes.io/name: flowdular-app
+spec:
+  selector:
+    app.kubernetes.io/name: flowdular-app
+  ports:
+    - name: http
+      port: 80
+      targetPort: http

package/template/default/modules/example/module.json

@@ -4,6 +4,7 @@
 	"id": "example.core",
 	"package": "@app/module-example",
 	"version": "0.1.0",
+	"platformApi": "^0.1.0",
 	"profile": "full",
 	"capabilities": ["api", "database", "client", "translations"],
 	"platform": {
@@ -13,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "auth.core",
-			"range": "0.10.0"
+			"range": "^0.13.0"
 		}
 	],
 	"tenancy": "required",

package/template/default/modules/example/package.json

@@ -16,7 +16,7 @@
 	"dependencies": {
 		"octane": "0.1.51",
 		"segment-state": "0.2.1",
-		"@flowdular/sdk": "0.2.4"
+		"@flowdular/sdk": "0.3.1"
 	},
 	"devDependencies": {
 		"@tsrx/typescript-plugin": "0.3.120",

package/template/default/modules/example/spec/module.yaml

@@ -12,7 +12,7 @@ capabilities:
   - translations
 dependencies:
   - id: auth.core
-    range: 0.10.0
+    range: ^0.13.0
 tenancy: required
 locales:
   - en

package/template/default/modules/example/src/services/database-repository.ts

@@ -1,5 +1,5 @@
 import type { DatabaseHandle } from '@flowdular/sdk/database';
-import { runDatabaseMigrations } from '@flowdular/sdk/database';
+import { integer, runDatabaseMigrations } from '@flowdular/sdk/database';
 import type { Note } from '../domain/types.ts';
 import { databaseMigrations } from './migration.ts';
 import type { NoteRepository } from './repository.ts';
@@ -23,23 +23,13 @@ const CREATE = `INSERT INTO example_notes
 			 (tenant_id, id, title, body, created_at)
 			 VALUES ($1, $2, $3, $4, $5)`;
 
-/* PostgreSQL returns BIGINT as a string, so every numeric read is normalized
-   before it reaches the domain. */
-function integer(value: NoteRow['created_at']): number {
-	const normalized = Number(value);
-	if (!Number.isSafeInteger(normalized) || normalized < 0) {
-		throw new Error('The example database returned an invalid timestamp.');
-	}
-	return normalized;
-}
-
 function fromRow(row: NoteRow): Note {
 	return {
 		tenantId: row.tenant_id,
 		id: row.id,
 		title: row.title,
 		body: row.body,
-		createdAt: integer(row.created_at),
+		createdAt: integer(row.created_at, 'created_at', { min: 0 }),
 	};
 }
 

package/template/default/package.json

@@ -9,6 +9,7 @@
 	},
 	"scripts": {
 		"dev": "node --env-file-if-exists=.env platform/scripts/dev.mjs",
+		"sandbox": "npx @flowdular/sandbox",
 		"typecheck": "pnpm -r --if-present typecheck",
 		"test": "pnpm -r --if-present test",
 		"format": "prettier --write .",
@@ -16,7 +17,7 @@
 		"flowdular": "flowdular",
 		"cl": "flowdular",
 		"doctor": "flowdular doctor",
-		"verify": "pnpm rules:check && pnpm typecheck && pnpm test && flowdular module validate && pnpm format:check",
+		"verify": "pnpm rules:check && pnpm typecheck && pnpm test && flowdular spec validate --all && flowdular module validate && pnpm format:check",
 		"rules:generate": "rulesync generate",
 		"rules:check": "rulesync generate --check",
 		"build": "flowdular module sync --apply && pnpm --filter @app/platform build"
@@ -24,7 +25,7 @@
 	"devDependencies": {
 		"@tsrx/prettier-plugin": "0.3.120",
 		"prettier": "3.6.2",
-		"flowdular": "0.2.4",
+		"flowdular": "0.3.1",
 		"rulesync": "16.21.0"
 	}
 }