create-flowdular 0.2.6 → 0.3.1

package/template/default/platform/octane.config.ts

@@ -1,19 +1,30 @@
 import {
 	assertRouteConflicts,
+	createModuleMetrics,
 	createModuleWebRoutes,
 	createApplicationRoutes,
+	serverTracer,
 	validateApplicationPath,
+	createMailPort,
+	mailConfigFromEnvironment,
 } from '@flowdular/sdk/server';
+import {
+	createDataClassRegistry,
+	PLATFORM_SETTINGS_TENANT,
+} from '@flowdular/sdk/kernel';
 import { resolve } from 'node:path';
 import { defineConfig, RenderRoute } from '@octanejs/vite-plugin';
 import {
 	authRuntimeOptionsFromEnvironment,
 	createAuthRoutes,
+	isTokenPrincipal,
+	mfaEnrolmentSatisfied,
 	principalFromContext,
 	createAuthRuntime,
 	createPlatformAgentRegistry,
 	createPlatformCapabilityRegistry,
 	createPlatformToolRegistry,
+	nodemailerSmtpTransport,
 } from '@flowdular/sdk/modules/auth/server';
 import {
 	composeModuleServer,
@@ -24,6 +35,18 @@ import {
 	createPlatformDatabaseProvider,
 	databaseProviderConfigFromEnvironment,
 } from './src/server/database.ts';
+import {
+	createReadinessEndpoint,
+	healthEndpoint,
+} from './src/server/health.ts';
+import { createMetricsRoutes } from './src/server/metrics.ts';
+import { createPlatformObservability } from './src/server/tracing.ts';
+import {
+	createStorageKeyring,
+	createStoragePort,
+	createStorageRoutes,
+	storageConfigFromEnvironment,
+} from './src/server/storage.ts';
 
 function checkedRoutes<T extends Parameters<typeof assertRouteConflicts>[0]>(
 	routes: T,
@@ -36,19 +59,53 @@ const SHELL = ['App', '/src/App.tsrx'] as const;
 const workspaceRoot = resolve(import.meta.dirname, '..');
 const building = process.env.FD_INTERNAL_BUILD === 'true';
 
+/* Composed first and drained last: a trace or an error report is evidence about
+   the boot that follows it, and both egresses refuse a misconfigured endpoint
+   here rather than at the first request that needed them. */
+const observability = createPlatformObservability({
+	environment: building
+		? { ...process.env, NODE_ENV: 'development' }
+		: process.env,
+});
 const databases = createPlatformDatabaseProvider(
 	databaseProviderConfigFromEnvironment(
 		building ? { ...process.env, NODE_ENV: 'development' } : process.env,
 		workspaceRoot,
 	),
 );
+const storageKeyring = createStorageKeyring(process.env, workspaceRoot);
+const storage = createStoragePort(
+	storageConfigFromEnvironment(
+		building ? { ...process.env, NODE_ENV: 'development' } : process.env,
+		workspaceRoot,
+	),
+	{ keyring: storageKeyring },
+);
 const configuredApplicationPath = validateApplicationPath(
 	process.env.FD_APPLICATION_PATH ?? applicationBasePath,
 );
+/* One outbound transport for the whole deployment. auth.core is only its
+   first sender; the SMTP client comes from that module because it is the one
+   that declares the dependency. */
+const mail = createMailPort(
+	mailConfigFromEnvironment(
+		building ? { ...process.env, NODE_ENV: 'development' } : process.env,
+	),
+	{ createSmtpTransport: nodemailerSmtpTransport },
+);
+/* Created before the auth runtime so auth.core, which composes outside the
+   generated module list, declares its data classes into the same registry. */
+const dataClasses = createDataClassRegistry();
 const authRuntime = createAuthRuntime({
-	...authRuntimeOptionsFromEnvironment(process.env, workspaceRoot),
+	...authRuntimeOptionsFromEnvironment(
+		building ? { ...process.env, NODE_ENV: 'development' } : process.env,
+		workspaceRoot,
+	),
 	applicationPath: configuredApplicationPath,
 	databases,
+	dataClasses,
+	mail,
+	metrics: createModuleMetrics('auth.core'),
 });
 
 /* Module APIs come from the generated composition. Enable or disable modules
@@ -63,17 +120,30 @@ const moduleCompositions = composeModuleServer({
 	agentTools: createPlatformToolRegistry(),
 	agentDefinitions,
 	capabilities: createPlatformCapabilityRegistry(),
+	dataClasses,
 	databases,
+	storage,
+	mail,
+	/* Rebound to the composing module by the generated composition; this binding
+	   is what a series the platform itself records would carry. */
+	metrics: createModuleMetrics('platform'),
+	tracer: serverTracer(),
 });
 for (const composition of moduleCompositions) {
 	if (composition.settings) settings.declare(composition.settings);
 }
 agentDefinitions.seal();
+/* Sealed once every composition has run and before any start hook reads the
+   catalogue, so every reader sees the declarations the modules agreed on. */
+dataClasses.seal();
 
 /* check() proves the runtime role holds neither SUPERUSER nor BYPASSRLS before
    any module reads a row. */
 if (!building) {
 	await databases.check();
+	/* Platform-scoped settings are read by background work before any request
+	   could prime them; a workspace is primed by the authentication middleware. */
+	await settings.prime(PLATFORM_SETTINGS_TENANT);
 	for (const composition of moduleCompositions) await composition.prepare?.();
 	for (const composition of moduleCompositions) composition.start?.();
 }
@@ -87,7 +157,11 @@ const shutdown = async () => {
 		await composition.dispose?.();
 	}
 	await authRuntime.dispose();
+	await storage.dispose();
 	await databases.dispose();
+	/* Last, so the spans and error reports this process queued while it stopped
+	   still leave with it. */
+	await observability.dispose();
 };
 // Bundling needs route declarations without background work or retained leases.
 if (building) {
@@ -106,21 +180,37 @@ export default defineConfig({
 				entry: SHELL,
 				publicRoot: moduleWebMounts.some((site) => site.path === '/'),
 			}),
+			healthEndpoint.serverRoute,
+			createReadinessEndpoint(databases).serverRoute,
+			...createMetricsRoutes({ environment: process.env }),
+			...createStorageRoutes({
+				storage,
+				keyring: storageKeyring,
+				environment: process.env,
+			}),
 			...createAuthRoutes(authRuntime),
 			...moduleCompositions.flatMap((composition) => composition.routes),
 			...createModuleWebRoutes({
 				modules: moduleCompositions,
 				mounts: moduleWebMounts,
 				applicationPath: configuredApplicationPath,
-				resolveIdentity: (context) => {
+				resolveIdentity: async (context) => {
 					const principal = principalFromContext(context);
-					return principal
-						? {
-								subjectId: principal.accountId,
-								tenantId: principal.tenantId,
-								permissions: new Set(principal.scopes),
-							}
-						: null;
+					if (!principal) return null;
+					/* The /api gate does not reach these pages, and a member who
+					   still owes enrolment must not read workspace data from one.
+					   Machine credentials cannot enrol and stay exempt there too. */
+					if (
+						!isTokenPrincipal(context) &&
+						!(await mfaEnrolmentSatisfied(authRuntime, principal))
+					) {
+						return null;
+					}
+					return {
+						subjectId: principal.accountId,
+						tenantId: principal.tenantId,
+						permissions: new Set(principal.scopes),
+					};
 				},
 			}),
 		]),

package/template/default/platform/package.json

@@ -15,7 +15,7 @@
 		"@octanejs/vite-plugin": "0.1.51",
 		"octane": "0.1.51",
 		"pg": "8.23.0",
-		"@flowdular/sdk": "0.2.4"
+		"@flowdular/sdk": "0.3.1"
 	},
 	"devDependencies": {
 		"@octanejs/app-core": "0.0.47",

package/template/default/platform/src/generated/modules.client.ts

@@ -7,12 +7,24 @@ import type {
 } from '@flowdular/sdk/client';
 import { createClientContribution as system_core } from '@flowdular/sdk/modules/system/client';
 import { createClientContribution as auth_core } from '@flowdular/sdk/modules/auth/client';
+import { createClientContribution as access_core } from '@flowdular/sdk/modules/access/client';
+import { createClientContribution as reports_core } from '@flowdular/sdk/modules/reports/client';
+import { createClientContribution as metering_core } from '@flowdular/sdk/modules/metering/client';
 import { createClientContribution as agents_core } from '@flowdular/sdk/modules/agents/client';
-import { createClientContribution as automations_core } from '@flowdular/sdk/modules/automations/client';
+import { createClientContribution as approvals_core } from '@flowdular/sdk/modules/approvals/client';
+import { createClientContribution as audit_core } from '@flowdular/sdk/modules/audit/client';
 import { createClientContribution as workflows_core } from '@flowdular/sdk/modules/workflows/client';
+import { createClientContribution as automations_core } from '@flowdular/sdk/modules/automations/client';
+import { createClientContribution as connectors_core } from '@flowdular/sdk/modules/connectors/client';
+import { createClientContribution as directory_core } from '@flowdular/sdk/modules/directory/client';
+import { createClientContribution as documents_core } from '@flowdular/sdk/modules/documents/client';
 import { createClientContribution as example_core } from '@app/module-example/client';
+import { createClientContribution as exports_core } from '@flowdular/sdk/modules/exports/client';
+import { createClientContribution as import_core } from '@flowdular/sdk/modules/import/client';
+import { createClientContribution as notifications_core } from '@flowdular/sdk/modules/notifications/client';
 import { createClientContribution as profile_core } from '@flowdular/sdk/modules/profile/client';
 import { createClientContribution as sandbox_core } from '@flowdular/sdk/modules/sandbox/client';
+import { createClientContribution as search_core } from '@flowdular/sdk/modules/search/client';
 import { createClientContribution as users_core } from '@flowdular/sdk/modules/users/client';
 
 export function createModuleClientContributions(
@@ -21,12 +33,24 @@ export function createModuleClientContributions(
 	return [
 		system_core(context),
 		auth_core(context),
+		access_core(context),
+		reports_core(context),
+		metering_core(context),
 		agents_core(context),
-		automations_core(context),
+		approvals_core(context),
+		audit_core(context),
 		workflows_core(context),
+		automations_core(context),
+		connectors_core(context),
+		directory_core(context),
+		documents_core(context),
 		example_core(context),
+		exports_core(context),
+		import_core(context),
+		notifications_core(context),
 		profile_core(context),
 		sandbox_core(context),
+		search_core(context),
 		users_core(context),
 	];
 }

package/template/default/platform/src/generated/modules.server.ts

@@ -5,14 +5,26 @@ import type {
 	PlatformServerContext,
 } from '@flowdular/sdk/modules/auth/server';
 import type { WebMount } from '@flowdular/sdk/server';
+import { createModuleMetrics } from '@flowdular/sdk/server';
 import { createServerComposition as system_core } from '@flowdular/sdk/modules/system/platform';
+import { createServerComposition as access_core } from '@flowdular/sdk/modules/access/platform';
+import { createServerComposition as reports_core } from '@flowdular/sdk/modules/reports/platform';
+import { createServerComposition as metering_core } from '@flowdular/sdk/modules/metering/platform';
 import { createServerComposition as agents_core } from '@flowdular/sdk/modules/agents/platform';
-import { createServerComposition as automations_core } from '@flowdular/sdk/modules/automations/platform';
+import { createServerComposition as approvals_core } from '@flowdular/sdk/modules/approvals/platform';
+import { createServerComposition as audit_core } from '@flowdular/sdk/modules/audit/platform';
 import { createServerComposition as workflows_core } from '@flowdular/sdk/modules/workflows/platform';
-import { createServerComposition as automations_workflows_integration } from '@flowdular/sdk/modules/automations-workflows-integration/platform';
+import { createServerComposition as automations_core } from '@flowdular/sdk/modules/automations/platform';
+import { createServerComposition as connectors_core } from '@flowdular/sdk/modules/connectors/platform';
+import { createServerComposition as directory_core } from '@flowdular/sdk/modules/directory/platform';
+import { createServerComposition as documents_core } from '@flowdular/sdk/modules/documents/platform';
 import { createServerComposition as example_core } from '@app/module-example/platform';
+import { createServerComposition as exports_core } from '@flowdular/sdk/modules/exports/platform';
+import { createServerComposition as import_core } from '@flowdular/sdk/modules/import/platform';
+import { createServerComposition as notifications_core } from '@flowdular/sdk/modules/notifications/platform';
 import { createServerComposition as profile_core } from '@flowdular/sdk/modules/profile/platform';
 import { createServerComposition as sandbox_core } from '@flowdular/sdk/modules/sandbox/platform';
+import { createServerComposition as search_core } from '@flowdular/sdk/modules/search/platform';
 import { createServerComposition as users_core } from '@flowdular/sdk/modules/users/platform';
 
 export function composeModuleServer(
@@ -23,51 +35,241 @@ export function composeModuleServer(
 			...system_core({
 				...context,
 				agentDefinitions: context.agentDefinitions.forModule('system.core'),
+				dataClasses: context.dataClasses.forModule('system.core'),
+				capabilities: context.capabilities.forModule('system.core', {
+					provides: [],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('system.core'),
 			}),
 			moduleId: 'system.core',
 		},
+		{
+			...access_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('access.core'),
+				dataClasses: context.dataClasses.forModule('access.core'),
+				capabilities: context.capabilities.forModule('access.core', {
+					provides: [],
+					requires: [{ id: 'exports.lists.v1', optional: true }],
+				}),
+				metrics: createModuleMetrics('access.core'),
+			}),
+			moduleId: 'access.core',
+		},
+		{
+			...reports_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('reports.core'),
+				dataClasses: context.dataClasses.forModule('reports.core'),
+				capabilities: context.capabilities.forModule('reports.core', {
+					provides: ['reports.v1'],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('reports.core'),
+			}),
+			moduleId: 'reports.core',
+		},
+		{
+			...metering_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('metering.core'),
+				dataClasses: context.dataClasses.forModule('metering.core'),
+				capabilities: context.capabilities.forModule('metering.core', {
+					provides: ['metering.meters.v1'],
+					requires: [
+						{ id: 'notifications.publish.v1', optional: true },
+						{ id: 'reports.v1', optional: true },
+					],
+				}),
+				metrics: createModuleMetrics('metering.core'),
+			}),
+			moduleId: 'metering.core',
+		},
 		{
 			...agents_core({
 				...context,
 				agentDefinitions: context.agentDefinitions.forModule('agents.core'),
+				dataClasses: context.dataClasses.forModule('agents.core'),
+				capabilities: context.capabilities.forModule('agents.core', {
+					provides: [
+						'agents.run-queue',
+						'agents.run-execution.v2',
+						'agents.actions.v1',
+					],
+					requires: [
+						{ id: 'notifications.publish.v1', optional: true },
+						{ id: 'metering.meters.v1' },
+						{ id: 'reports.v1', optional: true },
+					],
+				}),
+				metrics: createModuleMetrics('agents.core'),
 			}),
 			moduleId: 'agents.core',
 		},
+		{
+			...approvals_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('approvals.core'),
+				dataClasses: context.dataClasses.forModule('approvals.core'),
+				capabilities: context.capabilities.forModule('approvals.core', {
+					provides: ['approvals.requests.v1'],
+					requires: [{ id: 'notifications.publish.v1', optional: true }],
+				}),
+				metrics: createModuleMetrics('approvals.core'),
+			}),
+			moduleId: 'approvals.core',
+		},
+		{
+			...audit_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('audit.core'),
+				dataClasses: context.dataClasses.forModule('audit.core'),
+				capabilities: context.capabilities.forModule('audit.core', {
+					provides: ['audit.erasure.v1'],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('audit.core'),
+			}),
+			moduleId: 'audit.core',
+		},
+		{
+			...workflows_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('workflows.core'),
+				dataClasses: context.dataClasses.forModule('workflows.core'),
+				capabilities: context.capabilities.forModule('workflows.core', {
+					provides: ['workflows.execution.v1'],
+					requires: [
+						{ id: 'agents.run-execution.v2' },
+						{ id: 'agents.actions.v1' },
+						{ id: 'notifications.publish.v1', optional: true },
+						{ id: 'approvals.requests.v1', optional: true },
+					],
+				}),
+				metrics: createModuleMetrics('workflows.core'),
+			}),
+			moduleId: 'workflows.core',
+		},
 		{
 			...automations_core({
 				...context,
 				agentDefinitions:
 					context.agentDefinitions.forModule('automations.core'),
+				dataClasses: context.dataClasses.forModule('automations.core'),
+				capabilities: context.capabilities.forModule('automations.core', {
+					provides: ['automations.targets.v1', 'automations.execution.v1'],
+					requires: [
+						{ id: 'agents.run-queue' },
+						{ id: 'workflows.execution.v1', optional: true },
+					],
+				}),
+				metrics: createModuleMetrics('automations.core'),
 			}),
 			moduleId: 'automations.core',
 		},
 		{
-			...workflows_core({
+			...connectors_core({
 				...context,
-				agentDefinitions: context.agentDefinitions.forModule('workflows.core'),
+				agentDefinitions: context.agentDefinitions.forModule('connectors.core'),
+				dataClasses: context.dataClasses.forModule('connectors.core'),
+				capabilities: context.capabilities.forModule('connectors.core', {
+					provides: ['connectors.definitions.v1', 'connectors.calls.v1'],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('connectors.core'),
 			}),
-			moduleId: 'workflows.core',
+			moduleId: 'connectors.core',
 		},
 		{
-			...automations_workflows_integration({
+			...directory_core({
 				...context,
-				agentDefinitions: context.agentDefinitions.forModule(
-					'automations-workflows.integration',
-				),
+				agentDefinitions: context.agentDefinitions.forModule('directory.core'),
+				dataClasses: context.dataClasses.forModule('directory.core'),
+				capabilities: context.capabilities.forModule('directory.core', {
+					provides: [],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('directory.core'),
 			}),
-			moduleId: 'automations-workflows.integration',
+			moduleId: 'directory.core',
+		},
+		{
+			...documents_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('documents.core'),
+				dataClasses: context.dataClasses.forModule('documents.core'),
+				capabilities: context.capabilities.forModule('documents.core', {
+					provides: ['documents.attachments.v1'],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('documents.core'),
+			}),
+			moduleId: 'documents.core',
 		},
 		{
 			...example_core({
 				...context,
 				agentDefinitions: context.agentDefinitions.forModule('example.core'),
+				dataClasses: context.dataClasses.forModule('example.core'),
+				capabilities: context.capabilities.forModule('example.core', {
+					provides: [],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('example.core'),
 			}),
 			moduleId: 'example.core',
 		},
+		{
+			...exports_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('exports.core'),
+				dataClasses: context.dataClasses.forModule('exports.core'),
+				capabilities: context.capabilities.forModule('exports.core', {
+					provides: ['exports.lists.v1'],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('exports.core'),
+			}),
+			moduleId: 'exports.core',
+		},
+		{
+			...import_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('import.core'),
+				dataClasses: context.dataClasses.forModule('import.core'),
+				capabilities: context.capabilities.forModule('import.core', {
+					provides: ['import.ports.v1'],
+					requires: [{ id: 'documents.attachments.v1' }],
+				}),
+				metrics: createModuleMetrics('import.core'),
+			}),
+			moduleId: 'import.core',
+		},
+		{
+			...notifications_core({
+				...context,
+				agentDefinitions:
+					context.agentDefinitions.forModule('notifications.core'),
+				dataClasses: context.dataClasses.forModule('notifications.core'),
+				capabilities: context.capabilities.forModule('notifications.core', {
+					provides: ['notifications.publish.v1'],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('notifications.core'),
+			}),
+			moduleId: 'notifications.core',
+		},
 		{
 			...profile_core({
 				...context,
 				agentDefinitions: context.agentDefinitions.forModule('profile.core'),
+				dataClasses: context.dataClasses.forModule('profile.core'),
+				capabilities: context.capabilities.forModule('profile.core', {
+					provides: [],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('profile.core'),
 			}),
 			moduleId: 'profile.core',
 		},
@@ -75,13 +277,42 @@ export function composeModuleServer(
 			...sandbox_core({
 				...context,
 				agentDefinitions: context.agentDefinitions.forModule('sandbox.core'),
+				dataClasses: context.dataClasses.forModule('sandbox.core'),
+				capabilities: context.capabilities.forModule('sandbox.core', {
+					provides: [],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('sandbox.core'),
 			}),
 			moduleId: 'sandbox.core',
 		},
+		{
+			...search_core({
+				...context,
+				agentDefinitions: context.agentDefinitions.forModule('search.core'),
+				dataClasses: context.dataClasses.forModule('search.core'),
+				capabilities: context.capabilities.forModule('search.core', {
+					provides: ['search.providers.v1'],
+					requires: [],
+				}),
+				metrics: createModuleMetrics('search.core'),
+			}),
+			moduleId: 'search.core',
+		},
 		{
 			...users_core({
 				...context,
 				agentDefinitions: context.agentDefinitions.forModule('users.core'),
+				dataClasses: context.dataClasses.forModule('users.core'),
+				capabilities: context.capabilities.forModule('users.core', {
+					provides: [],
+					requires: [
+						{ id: 'search.providers.v1', optional: true },
+						{ id: 'import.ports.v1', optional: true },
+						{ id: 'exports.lists.v1', optional: true },
+					],
+				}),
+				metrics: createModuleMetrics('users.core'),
 			}),
 			moduleId: 'users.core',
 		},

package/template/default/platform/src/server/health.ts

@@ -0,0 +1,47 @@
+import { defineEndpoint } from '@flowdular/sdk/server';
+import type { ConfiguredDatabaseProvider } from '@flowdular/sdk/database';
+
+/* Liveness only: it proves the process answers and touches nothing else, so a
+   container probe never fails because the database is busy. */
+export const healthEndpoint = defineEndpoint({
+	id: 'system.health',
+	path: '/api/health',
+	methods: ['GET'],
+	access: { kind: 'public' },
+	handler: ({ requestId }) =>
+		Response.json(
+			{ status: 'ok', service: 'flowdular', requestId },
+			{ headers: { 'cache-control': 'no-store' } },
+		),
+});
+
+export function createReadinessEndpoint(databases: ConfiguredDatabaseProvider) {
+	return defineEndpoint({
+		id: 'system.ready',
+		path: '/api/ready',
+		methods: ['GET'],
+		access: { kind: 'public' },
+		handler: async ({ requestId }) => {
+			try {
+				const database = await databases.check();
+				return Response.json(
+					{ status: 'ready', service: 'flowdular', requestId, database },
+					{ headers: { 'cache-control': 'no-store' } },
+				);
+			} catch {
+				return Response.json(
+					{
+						status: 'unavailable',
+						service: 'flowdular',
+						requestId,
+						database: { adapter: databases.adapter, status: 'unavailable' },
+					},
+					{
+						status: 503,
+						headers: { 'cache-control': 'no-store', 'retry-after': '1' },
+					},
+				);
+			}
+		},
+	});
+}