openship 0.6.5 → 0.6.7

package/dist/index.js

@@ -7,18 +7,13 @@ import {
   RELEASES,
   RELEASES_DIR,
   assetUrl,
-  bootstrapAdmin,
-  detectPublicIp,
   downloadToFile,
   ensureDashboard,
-  ensureInternalToken,
   expectedSha256,
   fetchSidecar,
   formatBytes,
   hashFile,
   headlessProvision,
-  internalGet,
-  internalPost,
   normalizeUrl,
   parseSha256,
   readCliInstall,
@@ -30,24 +25,8 @@ import {
   startService,
   stop,
   upCommand,
-  waitDashboard,
-  waitHealthy,
   writeCliInstall
-} from "./chunk-7S4USQYF.js";
-import {
-  importMigratedSites
-} from "./chunk-6HOA5JT7.js";
-import {
-  completeHostEdge,
-  confirmEdgeAction,
-  diagnoseEdge,
-  planAndApplyHostEdge,
-  remediateUnreachableStaticRoots,
-  renderEdgeConflict,
-  repairEdgeConflict,
-  rollbackHostEdge
-} from "./chunk-HPXP6LXZ.js";
-import "./chunk-XRNRT37W.js";
+} from "./chunk-DDFUESPJ.js";
 import {
   composeDown,
   composeInternalToken,
@@ -79,16 +58,40 @@ import {
   saveInstanceUrl,
   shortSha,
   sourceBuildDir,
-  startUnitHint,
   storedApiPort,
   storedDashboardPort
-} from "./chunk-QLX7NBEA.js";
+} from "./chunk-PPEBIY5F.js";
+import {
+  bootstrapAdmin,
+  detectPublicIp,
+  importMigratedSites,
+  internalFetch,
+  internalGet,
+  internalPost,
+  internalTokenRejectedProblem,
+  waitDashboard,
+  waitHealthy
+} from "./chunk-RDXT4BQB.js";
+import {
+  startUnitHint
+} from "./chunk-VQM6JHJB.js";
 import "./chunk-QWHBRY2K.js";
+import {
+  completeHostEdge,
+  confirmEdgeAction,
+  diagnoseEdge,
+  planAndApplyHostEdge,
+  remediateUnreachableStaticRoots,
+  renderEdgeConflict,
+  repairEdgeConflict,
+  rollbackHostEdge
+} from "./chunk-J2XM3QSP.js";
 import {
   DATA_DIR,
   LOG_DIR,
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
+import "./chunk-FYPFEDPZ.js";
 import "./chunk-ONKEYSMY.js";
 import "./chunk-XZYFZ6A5.js";
 import "./chunk-PDW4L3NV.js";
@@ -97,37 +100,42 @@ import "./chunk-42WQABXM.js";
 import "./chunk-DRK3MEDS.js";
 import "./chunk-3NQQXMDR.js";
 import "./chunk-ZWLDLTJP.js";
-import "./chunk-6JELW75A.js";
-import "./chunk-3ZAGC5NT.js";
-import "./chunk-WNWQBB7F.js";
-import "./chunk-2GWYYHOR.js";
-import "./chunk-RXQBD4ZY.js";
-import "./chunk-XVOBL7BC.js";
+import "./chunk-J3K6XABC.js";
+import "./chunk-CIJV43LH.js";
 import {
   detectInstalledProxy,
   scanImportableSites
-} from "./chunk-7334NSJL.js";
-import "./chunk-VLQ3UIVO.js";
+} from "./chunk-ZPJ74LXE.js";
+import "./chunk-NRTJRNAE.js";
+import "./chunk-QHMDCYZ3.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-VDESJSG6.js";
-import "./chunk-LFCSC4IU.js";
-import "./chunk-GRTXMUHA.js";
-import "./chunk-MSZUCNPV.js";
-import "./chunk-TM2IQPYU.js";
-import "./chunk-VHMOQL5Y.js";
-import "./chunk-5OUWIPOB.js";
+import "./chunk-WNWQBB7F.js";
+import "./chunk-2GWYYHOR.js";
+import "./chunk-RXQBD4ZY.js";
+import "./chunk-LHFXSC36.js";
+import "./chunk-XWHWTHEL.js";
+import "./chunk-S6B2Z3OO.js";
+import "./chunk-MEE6OZFP.js";
+import "./chunk-WU54BXFE.js";
+import "./chunk-H4FS5BED.js";
+import "./chunk-GGIAIGUL.js";
+import "./chunk-R4VDPFLS.js";
+import "./chunk-2ANV5ZQ5.js";
+import "./chunk-5T4UVOM3.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
-import "./chunk-RFWJE7ZN.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
+} from "./chunk-E2X26PXR.js";
+import "./chunk-PVP4RGWT.js";
+import "./chunk-BLEXTYRK.js";
+import "./chunk-FZ6QCF6B.js";
+import "./chunk-H3WT3A6R.js";
+import "./chunk-GIPJNNI5.js";
+import "./chunk-VSTFHUCV.js";
+import "./chunk-UWEV6XTS.js";
+import "./chunk-N5YZMO33.js";
 import {
   CLOUD_DASHBOARD_URL,
+  HOST_CHANNEL_AUTH_REJECTED_SHORT,
   HOST_CHANNEL_PROVISION_COMMAND,
   LOCAL_API_URL,
   LOCAL_DASHBOARD_URL,
@@ -142,7 +150,7 @@ import {
   parseOpenshipConfigJson,
   resolveCliUpdatePlan,
   summarizeHostChannelCause
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 import "./chunk-PXKCZB2I.js";
 
 // src/index.ts
@@ -301,7 +309,7 @@ function getDashboardUrl(name) {
 }
 
 // src/lib/api-client.ts
-var USER_AGENT = `openship-cli/${true ? "0.6.5" : "dev"}`;
+var USER_AGENT = `openship-cli/${true ? "0.6.7" : "dev"}`;
 function getApiUrl2() {
   return `${getApiUrl()}/api`;
 }
@@ -1008,16 +1016,11 @@ function ensure(value) {
   return value;
 }
 async function internalGet2(path2, timeoutMs = 8e3) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${storedApiPort()}${path2}`, {
-      headers: { "X-Internal-Token": ensureInternalToken() },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null;
-  }
+  const call = await internalFetch(String(storedApiPort()), path2, {
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (call.kind !== "response" || !call.res.ok) return null;
+  return await call.res.json().catch(() => null);
 }
 async function apiReachable() {
   try {
@@ -1102,7 +1105,7 @@ function dockerNameRunning(nameFilter) {
   return r.stdout.trim().length > 0;
 }
 async function hostControlCheck(api) {
-  const { checkHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+  const { checkHostChannel } = await import("./host-channel-preflight-QTDNGLCK.js");
   return hostControlRow(await checkHostChannel().catch(() => null), api);
 }
 var NEVER_PROVISIONED_DETAIL = `never provisioned \u2014 run \`${HOST_CHANNEL_PROVISION_COMMAND}\``;
@@ -1127,6 +1130,11 @@ function hostControlRow(res, api) {
       case "key_unreadable":
       case "unreachable":
         return row2("fail", `${api.state.replace(/_/g, " ")} \u2014 see the api container's boot log`);
+      // Its own case, NOT grouped above: this is the one fault here an operator can act
+      // on without the withheld address, and #527 is what happens when the only thing
+      // we tell them is to go read a log.
+      case "auth_rejected":
+        return row2("fail", HOST_CHANNEL_AUTH_REJECTED_SHORT);
       // `disabled` (a hardening choice) and `not_applicable` (a bare install) are the
       // same non-event the local path returns null for. Whitelisted rather than derived
       // from `ok === false`, which `disabled` also is.
@@ -1502,7 +1510,7 @@ async function interactiveDoctor() {
       continue;
     }
     if (action2 === "host-control") {
-      const { verifyHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+      const { verifyHostChannel } = await import("./host-channel-preflight-QTDNGLCK.js");
       const report3 = await verifyHostChannel().catch(() => null);
       if (report3?.status === "fixed") log2.success("Host control is reachable now.");
       else if (report3?.status === "ok") log2.success("Host control was already reachable.");
@@ -1609,8 +1617,6 @@ async function deployFolder(opts) {
       tarball,
       "--exclude=./node_modules",
       "--exclude=./.git",
-      "--exclude=./dist",
-      "--exclude=./.next",
       "--exclude=./.DS_Store",
       "-C",
       cwd,
@@ -1678,7 +1684,11 @@ async function deployFolder(opts) {
     })
   });
   if (!dep.deployment_id) throw new Error(dep.error || "Failed to start deployment");
-  return { deploymentId: dep.deployment_id, projectId: dep.project_id };
+  return {
+    deploymentId: dep.deployment_id,
+    projectId: dep.project_id,
+    ...scan.configDiagnostics && { configDiagnostics: scan.configDiagnostics }
+  };
 }
 
 // src/lib/sse.ts
@@ -1867,8 +1877,18 @@ var deployCommand = new Command11("deploy").description("Trigger a deployment fo
         }
       });
       deploymentId = result2.deploymentId;
-      payload = { success: true, deployment_id: result2.deploymentId, project_id: result2.projectId };
+      payload = {
+        success: true,
+        deployment_id: result2.deploymentId,
+        project_id: result2.projectId,
+        ...result2.configDiagnostics && { configDiagnostics: result2.configDiagnostics }
+      };
       spinner5?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
+      if (result2.configDiagnostics?.wholeFile) {
+        err("  \u2717 openship.json was ignored entirely \u2014 deployed with detected settings:");
+      }
+      for (const e of result2.configDiagnostics?.errors ?? []) err(`    \u2022 ${e}`);
+      for (const w of result2.configDiagnostics?.warnings ?? []) info(`    \u26A0 ${w}`);
     } catch (e) {
       spinner5?.fail("Folder deploy failed");
       err(e instanceof ApiError ? e.message : String(e));
@@ -2949,16 +2969,36 @@ ${mapErrors.join("\n")}`
   }
 });
 function containerActionCommand(action2) {
-  return stackCommand(action2).description(`${action2[0].toUpperCase()}${action2.slice(1)} a service's container`).argument("<service>", "Service name or id").action(async (service, opts) => {
+  const cmd = stackCommand(action2).description(
+    action2 === "restart" ? "Bounce a service's container (does NOT apply changed env \u2014 use `deploy --refresh` for that)" : `${action2[0].toUpperCase()}${action2.slice(1)} a service's container`
+  ).argument("<service>", "Service name or id");
+  if (action2 === "restart") {
+    cmd.option("--force", "Bounce even with pending env changes (they will NOT be applied)");
+  }
+  return cmd.action(async (service, opts) => {
     requireAuth();
+    let serviceId = "";
     try {
       const projectId = await resolveProject(opts.project);
       const svc = await resolveService(projectId, service);
-      await apiRequest(`/projects/${projectId}/services/${svc.id}/${action2}`, {
+      serviceId = svc.id;
+      const query2 = action2 === "restart" && opts.force ? "?force=true" : "";
+      await apiRequest(`/projects/${projectId}/services/${svc.id}/${action2}${query2}`, {
         method: "POST"
       });
       ok(`  ${action2}ed "${svc.name}".`);
     } catch (e) {
+      const body = e instanceof ApiError ? e.body : null;
+      if (body?.code === "SERVICE_CONFIG_STALE") {
+        const keys = Array.isArray(body.staleEnvKeys) ? body.staleEnvKeys : [];
+        err(`  Restart refused: "${body.serviceName ?? service}" has pending environment changes.`);
+        if (keys.length > 0) info(`  Pending: ${keys.join(", ")}`);
+        info(
+          `  Apply them:  openship deploy --refresh --service-ids ${serviceId} -p ${opts.project}`
+        );
+        info(`  Bounce anyway (changes NOT applied):  add --force`);
+        process.exit(1);
+      }
       fail(e);
     }
   });
@@ -3459,7 +3499,7 @@ async function runRepair2(mode) {
   requireLinux();
   const sp = spin2(mode === "migrate" ? "Migrating the existing proxy's sites into the edge\u2026" : "Taking over :80/:443\u2026");
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-ES6FH4JK.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-MXERVAMG.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     reportRepair(res);
@@ -3608,7 +3648,7 @@ async function panelStatus() {
 async function panelRepair(mode) {
   const sp = spin2(mode === "migrate" ? "Migrating the existing proxy's sites\u2026" : "Taking over :80/:443\u2026");
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-ES6FH4JK.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-MXERVAMG.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     renderRepair(res);
@@ -4450,7 +4490,7 @@ function printMonitoringNextSteps() {
   info("    openship edge analytics -p <project>            per-domain analytics");
 }
 async function runMonitoringInstall(opts) {
-  const up = await import("./up-XEO3SR6Z.js");
+  const up = await import("./up-QXTOOVXC.js");
   let adminName = opts.adminName;
   let adminEmail = opts.adminEmail;
   let adminPassword = opts.adminPassword;
@@ -6152,21 +6192,26 @@ var resetAdminCommand = new Command24("reset-admin-password").description("Reset
     pw = entered;
   }
   const port = String(opts.port || storedApiPort());
-  let res;
-  try {
-    res = await fetch(`http://127.0.0.1:${port}/api/system/reset-admin-password`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-Internal-Token": ensureInternalToken() },
-      body: JSON.stringify({ password: pw, email: opts.email, name: opts.name })
-    });
-  } catch {
+  const call = await internalFetch(port, "/api/system/reset-admin-password", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password: pw, email: opts.email, name: opts.name })
+  });
+  if (call.kind === "unreachable") {
     log4.error(`Couldn't reach the Openship API on port ${port}. Is it running? (openship status)`);
     log4.info("If it's listening on another port, pass --port <n>.");
     process.exit(1);
   }
+  if (call.kind === "no-token") {
+    log4.error(`Reset failed \u2014 ${call.detail}`);
+    process.exit(1);
+  }
+  const res = call.res;
   const data = await res.json().catch(() => ({}));
   if (!res.ok || !data.ok) {
-    log4.error(`Reset failed: ${data.error || res.statusText}`);
+    log4.error(
+      `Reset failed: ${call.tokenRejected ? internalTokenRejectedProblem() : data.error || res.statusText}`
+    );
     process.exit(1);
   }
   outro3(chalk18.green(`Password reset. Log in as ${data.email} with your new password.`));
@@ -6602,7 +6647,7 @@ function applyOnlyArgv(selfArgs, json) {
 // src/commands/update.ts
 async function verifyHostChannelAfterUpdate() {
   if (isJsonMode()) return;
-  const { verifyHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+  const { verifyHostChannel } = await import("./host-channel-preflight-QTDNGLCK.js");
   await verifyHostChannel().catch(() => {
   });
 }
@@ -6679,7 +6724,7 @@ async function runSourceUpdate(source, opts) {
 }
 var REINSTALL_HINT = "curl -fsSL https://get.openship.io | sh";
 async function runTarballUpdate(install, opts) {
-  const current = "0.6.5";
+  const current = "0.6.7";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6763,7 +6808,7 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
   if (source) return runSourceUpdate(source, opts);
   const cliInstall = readCliInstall();
   if (cliInstall?.method === "tarball") return runTarballUpdate(cliInstall, opts);
-  const current = "0.6.5";
+  const current = "0.6.7";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -7023,10 +7068,11 @@ async function streamProvision(port, sessionId, s) {
   let ok3 = false;
   let detail;
   try {
-    const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
-      headers: { "X-Internal-Token": ensureInternalToken() },
+    const call = await internalFetch(port, `/api/system/self-register/stream?id=${sessionId}`, {
       signal: AbortSignal.timeout(3e5)
     });
+    if (call.kind !== "response") return { ok: false, detail: call.detail };
+    const res = call.res;
     if (!res.ok || !res.body) return { ok: false };
     const reader = res.body.getReader();
     const decoder = new TextDecoder();
@@ -7370,7 +7416,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.6.5"}`;
+  const uiTag = `v${"0.6.7"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7430,7 +7476,7 @@ async function runWizard() {
     const dashboardPort = String(ports.dashboard);
     const moved = portMoveNotice(ports, composeTrustedOriginUrls());
     if (moved.length) log5.info(moved.join("\n"));
-    if (!pinnedImagesReady({ version: "0.6.5" })) {
+    if (!pinnedImagesReady({ version: "0.6.7" })) {
       cancel4("The pinned Openship image tag isn't in the registry yet \u2014 nothing on this box was changed.");
       process.exit(1);
     }
@@ -7454,7 +7500,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.6.5",
+      version: "0.6.7",
       noHostControl: !allowHostControl
     });
     if (!fetched.ok) {
@@ -7483,7 +7529,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.6.5",
+      version: "0.6.7",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7538,9 +7584,10 @@ async function runWizard() {
         migratedCertPems,
         migratedStaticRootOverrides
       );
-      if (!imported.ok) {
+      const missed = migratedSites.length - imported.registered.length;
+      if (missed > 0) {
         log5.warn(
-          `Your ${migratedSites.length} existing site${migratedSites.length === 1 ? "" : "s"} aren't served yet \u2014 re-run \`openship up\` to retry the import.`
+          `${missed} of your ${migratedSites.length} existing site${migratedSites.length === 1 ? "" : "s"} ${missed === 1 ? "isn't" : "aren't"} served yet \u2014 see the import output above.`
         );
       }
     }
@@ -7583,7 +7630,7 @@ async function runWizard() {
     if (result.liveUrl) liveUrl2 = result.liveUrl;
     else if (!result.domainRegistered) liveUrl2 = `http://localhost:${started.dashPort}`;
     for (const w of result.warnings) log5.warn(w);
-    const { verifyHostChannel } = await import("./host-channel-preflight-MUXE3KZU.js");
+    const { verifyHostChannel } = await import("./host-channel-preflight-QTDNGLCK.js");
     await verifyHostChannel().catch(() => {
     });
     finishSetup({
@@ -7862,7 +7909,7 @@ function attachCompletion(program2) {
 
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.6.5").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.6.7").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";

package/dist/{local-executor-WOFZD72X.js → local-executor-ODC6RANU.js}

@@ -4,8 +4,9 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
-import "./chunk-ZFJXPCQP.js";
+} from "./chunk-E2X26PXR.js";
+import "./chunk-H3WT3A6R.js";
+import "./chunk-2VSW6Q6C.js";
 import "./chunk-PXKCZB2I.js";
 export {
   LocalExecutor

package/dist/{nginx-NSAHWGJV.js → nginx-KLFF43TC.js}

@@ -8,20 +8,24 @@ import {
   VHOST_GENERATION,
   acmeKeyArgs,
   assertValidChallengeToken,
+  isAcmePortBindFailure,
   readVhostGeneration,
   renderGeoEntries,
   renderProxyOptions,
   renderProxyTlsOptions,
   summarizeCertbotFailure
-} from "./chunk-VLQ3UIVO.js";
+} from "./chunk-NRTJRNAE.js";
+import "./chunk-QHMDCYZ3.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
+import "./chunk-R4VDPFLS.js";
+import "./chunk-BLEXTYRK.js";
+import "./chunk-FZ6QCF6B.js";
+import "./chunk-H3WT3A6R.js";
+import "./chunk-GIPJNNI5.js";
+import "./chunk-VSTFHUCV.js";
+import "./chunk-UWEV6XTS.js";
+import "./chunk-N5YZMO33.js";
+import "./chunk-2VSW6Q6C.js";
 import "./chunk-PXKCZB2I.js";
 export {
   MANAGED_STATIC_BASE,
@@ -29,6 +33,7 @@ export {
   VHOST_GENERATION,
   acmeKeyArgs,
   assertValidChallengeToken,
+  isAcmePortBindFailure,
   readVhostGeneration,
   renderGeoEntries,
   renderProxyOptions,

package/dist/{openresty-lua-DR4D3EZ6.js → openresty-lua-VKWUV4GB.js}

@@ -10,6 +10,7 @@ import {
   EDGE_CHALLENGE_LOCATION,
   EDGE_CHALLENGE_ROOT,
   EDGE_CHALLENGE_URL_PREFIX,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_CONTAINER_MOUNTS,
   EDGE_DEFAULT_CERT_CN,
   EDGE_DEFAULT_CERT_DIRNAME,
@@ -39,11 +40,12 @@ import {
   ensureOpenRestyConfig,
   luaSourceAvailable,
   parseNginxVersion
-} from "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
+} from "./chunk-QHMDCYZ3.js";
+import "./chunk-BLEXTYRK.js";
+import "./chunk-FZ6QCF6B.js";
+import "./chunk-H3WT3A6R.js";
+import "./chunk-N5YZMO33.js";
+import "./chunk-2VSW6Q6C.js";
 import "./chunk-PXKCZB2I.js";
 export {
   ACME_CHALLENGE_LOCATION,
@@ -53,6 +55,7 @@ export {
   EDGE_CHALLENGE_LOCATION,
   EDGE_CHALLENGE_ROOT,
   EDGE_CHALLENGE_URL_PREFIX,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_CONTAINER_MOUNTS,
   EDGE_DEFAULT_CERT_CN,
   EDGE_DEFAULT_CERT_DIRNAME,

package/dist/{privilege-YTVI4SKF.js → privilege-7D3SSOL3.js}

@@ -6,11 +6,12 @@ import {
   privilegedExecutor,
   rootChecked,
   rootOrDegrade
-} from "./chunk-RFWJE7ZN.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
+} from "./chunk-PVP4RGWT.js";
+import "./chunk-BLEXTYRK.js";
+import "./chunk-FZ6QCF6B.js";
+import "./chunk-H3WT3A6R.js";
+import "./chunk-N5YZMO33.js";
+import "./chunk-2VSW6Q6C.js";
 import "./chunk-PXKCZB2I.js";
 export {
   privilegedExecutor,

package/dist/server/engine/samples/amavisd/amavisd.conf

@@ -477,6 +477,31 @@ $bad_header_quarantine_to = 'bad-header-quarantine';
 #$undecipherable_subject_tag = '***UNCHECKED*** ';  # undef disables it
 $undecipherable_subject_tag = undef;
 
+# ─── What happens when NO virus scanner can be reached (GH-565) ──────────────
+#
+# With the settings above and @av_scanners_backup = () earlier in this file, a
+# message that no scanner could examine is DELIVERED, with no subject tag and no
+# admin notification. That is amavis' default and it is a deliberate choice here:
+# clamd's signature load is memory-hungry and its socket is the most fragile part
+# of the stack, so failing OPEN keeps mail flowing on small VPSes.
+#
+# It is a real trade-off, so know which side you are on. Note that amavis still
+# adds its `X-Virus-Scanned` header on this path — the header records that amavis
+# processed the message, NOT that a scanner passed it, and it must not be read as
+# proof of a clean scan. The Emails → Health tab is the honest signal: it reports
+# ClamAV as Crashed/Failed and says mail is being delivered without scanning.
+#
+# To fail CLOSED instead — mail queues (4xx tempfail) until a scanner is back,
+# rather than arriving unscanned — uncomment ONE of these:
+#
+#   $virus_scanners_failure_is_fatal = 1;   # scanner failure => tempfail
+#   $final_unchecked_destiny = D_TEMPFAIL;  # same, via the destiny table
+#
+# Before you do: while clamd is down this defers EVERY inbound message, and a
+# queue that outlives the sender's retry window loses mail. Pair it with the
+# subject tag above if you would rather label than defer.
+# ─────────────────────────────────────────────────────────────────────────────
+
 # Hope to fix 'nested MAIL command' issue on high load server.
 $smtp_connection_cache_enable = 0;
 

package/dist/server/engine/samples/postfix/master.cf

@@ -24,12 +24,26 @@ mlmmj   unix  -       n       n       -       -       pipe
     flags=ORhu user=PH_SYS_USER_MLMMJ:PH_SYS_GROUP_MLMMJ argv=PH_CMD_MLMMJ_AMIME_RECEIVE -L PH_MLMMJ_SPOOL_DIR/${nexthop}
 
 # Amavisd integration.
+#
+# smtp_tls_security_level=none is REQUIRED, not an optimisation (GH-392). This
+# is an smtp CLIENT service, so it inherits the global smtp_tls_security_level
+# — and amavisd's :10024 listener does not offer STARTTLS. With the global set
+# to `encrypt` every inbound message defers with "TLS is required, but was not
+# offered": a complete INBOUND outage, from a setting that only looks like it
+# concerns outbound delivery. Saving an outbound relay with scope "all" sets
+# exactly that (apps/api/src/modules/mail/admin/outbound-relay.service.ts), and
+# so does an operator hardening TLS by hand.
+#
+# TLS here would be meaningless anyway: the hop is loopback to a content filter
+# on the same host. Pinning it at the transport keeps the guarantee local to the
+# thing that needs it, instead of depending on every writer of the global.
 smtp-amavis unix -  -   n   -   PH_AMAVISD_MAX_SERVERS  smtp
     -o syslog_name=postfix/amavis
     -o local_header_rewrite_clients=
     -o smtp_data_done_timeout=1200
     -o smtp_send_xforward_command=yes
     -o smtp_dns_support_level=disabled
+    -o smtp_tls_security_level=none
     -o max_use=20
 
 # smtp port used by Amavisd to re-inject scanned email back to Postfix