@wtfalch/foundry 0.1.0 → 0.3.0

package/dist/slug.js

@@ -1,3 +1,4 @@
+import { checkName } from '@wtfalch/auth/names';
 /**
  * The declared org's slug: a pure validator, no I/O, no store access.
  *
@@ -139,3 +140,68 @@ export function validateSlug(slug) {
     }
     return null;
 }
+/** Letters a plain accent strip gets wrong, mostly Norwegian. */
+const SPELLED_OUT = {
+    æ: 'ae',
+    ø: 'o',
+    å: 'a',
+    ß: 'ss',
+    œ: 'oe',
+    þ: 'th',
+    ð: 'd',
+    ı: 'i',
+    ł: 'l',
+    đ: 'd',
+};
+/** Room left for `-xxxx` after the base, so a suffixed slug stays one DNS label. */
+const BASE_MAX = 58;
+function randomSuffix() {
+    const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
+    let out = '';
+    for (let i = 0; i < 4; i++)
+        out += alphabet[Math.floor(Math.random() * alphabet.length)];
+    return out;
+}
+/**
+ * The sign-in broker's name check, with the length and character rules
+ * loosened: a display name has spaces and accents, and a slug may be 63 long.
+ * Only its `reserved` and `disallowed` verdicts apply here.
+ */
+const ANY_TEXT = { minLength: 0, maxLength: Number.MAX_SAFE_INTEGER, pattern: /^/ };
+/**
+ * The slug for a new org, derived from its first display name (William,
+ * 2026-09-26): "Good Company" becomes `good-company`, and `good-company.oikos.host`
+ * is its address. When that slug is taken, reserved or has an environment
+ * suffix, a short random suffix is added: `bruh-7k3q`. The display name stays
+ * separate, so an org can rename itself without moving its address.
+ *
+ * An offensive name is refused outright, by the same check the sign-in broker
+ * runs on usernames (https://github.com/wtfalch/foundry/issues/103, N1b). A
+ * name that could pass as infra (`admin`, `help`) only costs the slug a suffix.
+ */
+export async function slugFromName(name, slugTaken, suffix = randomSuffix) {
+    const base = name
+        .toLowerCase()
+        .replace(/[æøåßœþðıłđ]/g, (c) => SPELLED_OUT[c] ?? c)
+        .normalize('NFKD')
+        .replace(/\p{M}/gu, '')
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, BASE_MAX)
+        .replace(/-+$/, '') || 'org';
+    const nameVerdict = checkName(name, ANY_TEXT);
+    const baseVerdict = checkName(base, ANY_TEXT);
+    if ((!nameVerdict.ok && nameVerdict.reason === 'disallowed') ||
+        (!baseVerdict.ok && baseVerdict.reason === 'disallowed')) {
+        throw new Error(`org name '${name}' is not allowed`);
+    }
+    const free = async (slug) => validateSlug(slug) === null && checkName(slug, ANY_TEXT).ok && !(await slugTaken(slug));
+    if (await free(base))
+        return base;
+    for (let attempt = 0; attempt < 10; attempt++) {
+        const candidate = `${base}-${suffix()}`;
+        if (await free(candidate))
+            return candidate;
+    }
+    throw new Error(`no free slug found for '${name}' after 10 tries`);
+}

package/dist/state.d.ts

@@ -34,17 +34,38 @@ export interface LastApplied {
 export interface AppliedState {
     orgId: OrgId;
     /**
-     * One id per service that takes jobs from many orgs (Files, AI,
-     * integrations — https://github.com/wtfalch/foundry/issues/14's resolved
-     * research #4) plus the per-org services (chat, mail), each keyed by that
-     * service's own name for the org.
+     * One id per resource `plan/plan-apply.ts`'s `runSteps` has made true,
+     * keyed `system:kind:key` — the same resource key `plan/diff.ts` plans
+     * against (e.g. `coolify:app:<orgId>`, `zitadel:app:<name>`), so two
+     * resources that share a `kind` (an org's several declared ZITADEL apps,
+     * #71) never overwrite each other's id the way a bare `kind` key did.
+     * `plan/providers-readers.ts`'s `storeRecordedIds` reads this map back to
+     * match a live provider resource to the foundry resource it was recorded
+     * for, instead of reporting it unmanaged (design:
+     * `.claude/campaign/2026-09-24-keys-and-memberships.md`, "Design for
+     * (1)").
+     *
+     * A provider *scope* id — `coolify_project`, `zitadel_org`,
+     * `zitadel_project`, a Cloudflare zone id (`plan/providers-readers.ts`'s
+     * `ScopeResolver`, https://github.com/wtfalch/foundry/issues/14's resolved
+     * research #4) — is a different id space and keeps its own plain key; a
+     * scope key has no `:` in it, so it can never collide with the
+     * `system:kind:key` form. `plan/executor.ts`'s `FoundryStepExecutor` is
+     * what writes these today, through `plan-apply.ts`'s
+     * `StepExecutionContext.recordScopeId` — backed by the very `serviceIds`
+     * map `runSteps` builds here and persists in one write at the end of a
+     * run, not a separate store write of its own (`StepExecutionContext`'s doc
+     * comment explains why: a second writer would race `runSteps`' own final
+     * one).
      */
     serviceIds: Record<string, string>;
     /** Checkpoints from the current or most recent apply. */
     checkpoints: Checkpoint[];
     /**
      * The name of every {@link DeclaredOrg} field the most recent apply could
-     * not make true, because nothing implements it yet.
+     * not make true: because nothing implements it yet, or because its step
+     * had not completed when the apply failed. `apply` recomputes it every
+     * time (#25), in `plan/plan-apply.ts`'s `failedFields`.
      *
      * Decision (#18): this field did not exist on the type this ticket found.
      * #7 ("Shape") and #18's "Done when" both require `apply` to "fail loudly

package/dist/store/audit.d.ts

@@ -0,0 +1,8 @@
+import type { AuditLog } from '../plan/plan-apply.js';
+import type { FoundryStoreDb } from './postgres.js';
+/**
+ * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
+ * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
+ * attached archon reads the same table. It only inserts.
+ */
+export declare function createPostgresAuditLog(db: FoundryStoreDb): AuditLog;

package/dist/store/audit.js

@@ -0,0 +1,43 @@
+import { foundryAuditEvents } from './schema.js';
+/**
+ * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
+ * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
+ * attached archon reads the same table. It only inserts.
+ */
+export function createPostgresAuditLog(db) {
+    return {
+        async recordPlan({ actor, orgId, plan, at }) {
+            await db.insert(foundryAuditEvents).values({
+                at,
+                kind: 'plan',
+                actorId: actor.id,
+                actorDisplay: actor.display,
+                orgId,
+                plan,
+            });
+        },
+        async recordApply({ actor, orgId, plan, outcome, reason, at }) {
+            await db.insert(foundryAuditEvents).values({
+                at,
+                kind: 'apply',
+                actorId: actor.id,
+                actorDisplay: actor.display,
+                orgId,
+                outcome,
+                reason: reason ?? null,
+                plan,
+            });
+        },
+        async recordDestroy({ actor, orgId, outcome, reason, at }) {
+            await db.insert(foundryAuditEvents).values({
+                at,
+                kind: 'destroy',
+                actorId: actor.id,
+                actorDisplay: actor.display,
+                orgId,
+                outcome,
+                reason: reason ?? null,
+            });
+        },
+    };
+}

package/dist/store/postgres.d.ts

@@ -34,7 +34,9 @@ export declare class DeclaredOrgError extends Error {
  * on both `create` and `update`. #27 adds a third, narrower rule: storage and
  * AI spend limits are bigint-safe decimal strings of non-negative integers
  * (or `null` for uncapped), checked the same way on both `create` and the
- * merged result of `update`. The broader "combinations foundry knows are
+ * merged result of `update`. #67 adds a fourth (`org.ts`'s
+ * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
+ * checked the same way. The broader "combinations foundry knows are
  * impossible are rejected with a reason" line needs a ruleset (domain
  * requirements per service, `adoptedApp.form`, mail-level transitions…)
  * that later tickets, not #18, #27 or #28, decide; `update` still merges and

package/dist/store/postgres.js

@@ -1,5 +1,5 @@
 import { eq, sql } from 'drizzle-orm';
-import { validateBuyerIdentity } from '../org.js';
+import { validateBuyerIdentity, validateHosting, validateOwner, validateSite } from '../org.js';
 import { validateSlug } from '../slug.js';
 import { declaredOrgs, foundryAppliedState, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
@@ -50,6 +50,16 @@ function rowToOrg(row) {
         calls: { usesDomain: row.callsUsesDomain },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
+        hosting: {
+            enabled: row.hostingEnabled,
+            usesDomain: row.hostingUsesDomain,
+            database: row.hostingDatabase,
+            tunnel: row.hostingTunnel,
+            gitBranch: row.hostingGitBranch,
+            buildPack: row.hostingBuildPack,
+            issuerApps: row.hostingIssuerApps,
+            accessEmails: row.hostingAccessEmails,
+        },
         sso: { enabled: row.ssoEnabled },
         guests: { enabled: row.guestsEnabled },
         solo: { enabled: row.soloEnabled },
@@ -60,6 +70,8 @@ function rowToOrg(row) {
         adoptedApp: row.adoptedAppForm
             ? { form: row.adoptedAppForm }
             : null,
+        owner: rowToOwner(row),
+        test: row.isTest,
     };
 }
 function orgToRow(org) {
@@ -75,6 +87,14 @@ function orgToRow(org) {
         issuerUsesDomain: org.issuer.usesDomain,
         siteEnabled: org.site.enabled,
         siteUsesDomain: org.site.usesDomain,
+        hostingEnabled: org.hosting.enabled,
+        hostingUsesDomain: org.hosting.usesDomain,
+        hostingDatabase: org.hosting.database,
+        hostingTunnel: org.hosting.tunnel,
+        hostingGitBranch: org.hosting.gitBranch,
+        hostingBuildPack: org.hosting.buildPack,
+        hostingIssuerApps: org.hosting.issuerApps,
+        hostingAccessEmails: org.hosting.accessEmails,
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,
@@ -90,6 +110,10 @@ function orgToRow(org) {
         vatRegistered: org.buyer.vatRegistered,
         bespokeAppRepo: org.bespokeAppRepo,
         adoptedAppForm: org.adoptedApp?.form ?? null,
+        ownerEmail: org.owner?.email ?? null,
+        ownerGivenName: org.owner?.givenName ?? null,
+        ownerFamilyName: org.owner?.familyName ?? null,
+        isTest: org.test,
     };
 }
 /**
@@ -117,6 +141,17 @@ function rowToBuyer(row) {
         vatRegistered: row.vatRegistered,
     };
 }
+/**
+ * Reassembles `DeclaredOrg.owner` from the row's three separate nullable
+ * columns -- present only when all three are, same "all parts or none"
+ * pattern {@link rowToBuyer} uses for the buyer's address.
+ */
+function rowToOwner(row) {
+    const { ownerEmail, ownerGivenName, ownerFamilyName } = row;
+    if (ownerEmail === null || ownerGivenName === null || ownerFamilyName === null)
+        return null;
+    return { email: ownerEmail, givenName: ownerGivenName, familyName: ownerFamilyName };
+}
 /**
  * `DeclaredOrgStore` (`../store.ts`) on Postgres, for #18: create, read and
  * edit a {@link DeclaredOrg}, and read and write the {@link AppliedState}
@@ -129,7 +164,9 @@ function rowToBuyer(row) {
  * on both `create` and `update`. #27 adds a third, narrower rule: storage and
  * AI spend limits are bigint-safe decimal strings of non-negative integers
  * (or `null` for uncapped), checked the same way on both `create` and the
- * merged result of `update`. The broader "combinations foundry knows are
+ * merged result of `update`. #67 adds a fourth (`org.ts`'s
+ * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
+ * checked the same way. The broader "combinations foundry knows are
  * impossible are rejected with a reason" line needs a ruleset (domain
  * requirements per service, `adoptedApp.form`, mail-level transitions…)
  * that later tickets, not #18, #27 or #28, decide; `update` still merges and
@@ -169,11 +206,35 @@ export function createPostgresDeclaredOrgStore(db) {
         if (reason)
             throw new DeclaredOrgError(`buyer identity invalid: ${reason} (#67)`);
     }
+    // #71: same place `requireValidBuyer` checks the buyer identity (#67), on
+    // both `create` and the merged result of `update`.
+    function requireValidHosting(org) {
+        const reason = validateHosting(org.hosting);
+        if (reason)
+            throw new DeclaredOrgError(`hosting invalid: ${reason} (#71)`);
+    }
+    // #101: same place `requireValidHosting` checks hosting, on both `create`
+    // and the merged result of `update`.
+    function requireValidSite(org) {
+        const reason = validateSite(org);
+        if (reason)
+            throw new DeclaredOrgError(`site invalid: ${reason} (#101)`);
+    }
+    // Same place `requireValidHosting` checks hosting, on both `create` and
+    // the merged result of `update`.
+    function requireValidOwner(org) {
+        const reason = validateOwner(org.owner);
+        if (reason)
+            throw new DeclaredOrgError(`owner invalid: ${reason}`);
+    }
     return {
         async create(org) {
             requireValidSlug(org.slug);
             requireValidLimits(org);
             requireValidBuyer(org);
+            requireValidHosting(org);
+            requireValidSite(org);
+            requireValidOwner(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
@@ -192,6 +253,14 @@ export function createPostgresDeclaredOrgStore(db) {
             const [row] = await db.select().from(declaredOrgs).where(eq(declaredOrgs.id, id)).limit(1);
             return row ? rowToOrg(row) : null;
         },
+        async slugTaken(slug) {
+            const [row] = await db
+                .select({ id: declaredOrgs.id })
+                .from(declaredOrgs)
+                .where(eq(declaredOrgs.slug, slug))
+                .limit(1);
+            return row !== undefined;
+        },
         async update(id, patch) {
             const current = rowToOrg(await requireRow(id));
             // The slug freeze (#7 corrections 3): once mail exists, the mail
@@ -212,6 +281,9 @@ export function createPostgresDeclaredOrgStore(db) {
             const next = { ...current, ...patch, id: current.id };
             requireValidLimits(next);
             requireValidBuyer(next);
+            requireValidHosting(next);
+            requireValidSite(next);
+            requireValidOwner(next);
             try {
                 await db
                     .update(declaredOrgs)
@@ -263,5 +335,15 @@ export function createPostgresDeclaredOrgStore(db) {
                 .values(values)
                 .onConflictDoUpdate({ target: foundryAppliedState.orgId, set: values });
         },
+        async delete(id) {
+            // Applied state first: `0002_applied_state.sql`'s
+            // `foundry_applied_state_org_fkey` references the declared org with no
+            // cascade, so deleting the org first would fail while its applied
+            // state row still points at it. Both deletes are no-ops (idempotent)
+            // when the row is already gone, matching this method's own doc
+            // comment on `../store.ts`.
+            await db.delete(foundryAppliedState).where(eq(foundryAppliedState.orgId, id));
+            await db.delete(declaredOrgs).where(eq(declaredOrgs.id, id));
+        },
     };
 }