@wtfalch/foundry 0.14.0 → 0.16.0

package/dist/plan/proxy-labels.d.ts

@@ -0,0 +1,42 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+/**
+ * What an entry's Traefik label set is built from. `wildcardDomain` is the
+ * org's domain when the entry declares `'*'`, else `null`.
+ */
+export interface EntryLabelSpec {
+    names: string[];
+    wildcardDomain: string | null;
+    port: number;
+}
+/**
+ * The scope key holding the hash of the label set last patched onto an
+ * entry's app. Present only for an entry that has had a custom label set.
+ */
+export declare function appLabelsAppliedScopeKey(entryKey: string): string;
+/**
+ * The label set an entry's app needs, or `null` when it needs none. Coolify
+ * replaces the labels it generates from `domains` once `custom_labels` is
+ * set, so an entry with `'*'` carries its exact `Host` rules as well. An entry
+ * that already has a custom set (`hadLabels`) keeps one, without the wildcard
+ * rule, so a removed `'*'` stops matching and a later name change still
+ * reaches the app: an empty `custom_labels` is refused by Coolify's API.
+ * Coolify's default port for an app is 80.
+ */
+export declare function entryLabelSpec(org: DeclaredOrg, entry: HostingEntry, hadLabels: boolean): EntryLabelSpec | null;
+/** A short digest of the spec; the same spec always gives the same hash. */
+export declare function entryLabelHash(spec: EntryLabelSpec): string;
+/**
+ * The Traefik labels for an entry's app, one per line. Coolify reaches an app
+ * through its http entrypoint here (the tunnel dials `coolify-proxy:80`), so
+ * each name gets the same http router Coolify generates for a plain domain:
+ * `Host(name) && PathPrefix(/)`, default priority. The wildcard is one
+ * `HostRegexp` router at `priority=1`, so any exact name, this app's or
+ * another's, wins over it. The regex matches one label (`[a-z0-9-]+`), the
+ * same depth Cloudflare's Universal certificate covers.
+ */
+export declare function entryProxyLabels(appUuid: string, spec: EntryLabelSpec): string;
+/**
+ * Whether two label sets hold the same labels. Order and the `coolify.*`
+ * lines Coolify adds and strips itself do not count.
+ */
+export declare function sameLabelSets(a: string, b: string): boolean;

package/dist/plan/proxy-labels.js

@@ -0,0 +1,73 @@
+import { createHash } from 'node:crypto';
+import { entryHostnames, wildcardHostname } from './hostnames.js';
+/**
+ * The scope key holding the hash of the label set last patched onto an
+ * entry's app. Present only for an entry that has had a custom label set.
+ */
+export function appLabelsAppliedScopeKey(entryKey) {
+    return `app_labels_applied.${entryKey}`;
+}
+/**
+ * The label set an entry's app needs, or `null` when it needs none. Coolify
+ * replaces the labels it generates from `domains` once `custom_labels` is
+ * set, so an entry with `'*'` carries its exact `Host` rules as well. An entry
+ * that already has a custom set (`hadLabels`) keeps one, without the wildcard
+ * rule, so a removed `'*'` stops matching and a later name change still
+ * reaches the app: an empty `custom_labels` is refused by Coolify's API.
+ * Coolify's default port for an app is 80.
+ */
+export function entryLabelSpec(org, entry, hadLabels) {
+    const wildcard = entry.hostnames.includes('*') ? wildcardHostname(org) : null;
+    if (!wildcard && !hadLabels)
+        return null;
+    return {
+        names: entryHostnames(org, entry),
+        wildcardDomain: wildcard ? wildcard.slice(2) : null,
+        port: entry.buildPack === 'static' ? 80 : (entry.port ?? 80),
+    };
+}
+/** A short digest of the spec; the same spec always gives the same hash. */
+export function entryLabelHash(spec) {
+    return createHash('sha256').update(JSON.stringify(spec)).digest('hex').slice(0, 16);
+}
+/**
+ * The Traefik labels for an entry's app, one per line. Coolify reaches an app
+ * through its http entrypoint here (the tunnel dials `coolify-proxy:80`), so
+ * each name gets the same http router Coolify generates for a plain domain:
+ * `Host(name) && PathPrefix(/)`, default priority. The wildcard is one
+ * `HostRegexp` router at `priority=1`, so any exact name, this app's or
+ * another's, wins over it. The regex matches one label (`[a-z0-9-]+`), the
+ * same depth Cloudflare's Universal certificate covers.
+ */
+export function entryProxyLabels(appUuid, spec) {
+    const labels = [];
+    const route = (id, rule, priority) => {
+        const router = `traefik.http.routers.${id}`;
+        labels.push(`${router}.rule=${rule}`, `${router}.entryPoints=http`, `${router}.service=${id}`, `${router}.middlewares=gzip`, `traefik.http.services.${id}.loadbalancer.server.port=${spec.port}`);
+        if (priority !== undefined)
+            labels.push(`${router}.priority=${priority}`);
+    };
+    spec.names.forEach((name, i) => {
+        route(`http-${i}-${appUuid}`, `Host(\`${name}\`) && PathPrefix(\`/\`)`);
+    });
+    if (spec.wildcardDomain) {
+        const domain = spec.wildcardDomain.replace(/\./g, '[.]');
+        route(`http-wildcard-${appUuid}`, `HostRegexp(\`^[a-z0-9-]+[.]${domain}$\`)`, 1);
+    }
+    if (labels.length === 0)
+        return 'traefik.enable=false';
+    labels.push('traefik.enable=true', 'traefik.http.middlewares.gzip.compress=true');
+    return labels.sort().join('\n');
+}
+/**
+ * Whether two label sets hold the same labels. Order and the `coolify.*`
+ * lines Coolify adds and strips itself do not count.
+ */
+export function sameLabelSets(a, b) {
+    const lines = (set) => set
+        .split(/\r\n|\n|\r/)
+        .filter((line) => line !== '' && !line.startsWith('coolify.'))
+        .sort()
+        .join('\n');
+    return lines(a) === lines(b);
+}

package/dist/plan/zitadel-machine-user.d.ts

@@ -49,7 +49,11 @@ import type { ZitadelPort } from './executor.js';
  */
 export declare class ZitadelHttpError extends Error {
     readonly status: number;
-    constructor(status: number, message: string);
+    /** ZITADEL's own gRPC-style error code from the body (6 is AlreadyExists), when it sent one. */
+    readonly code?: number | undefined;
+    constructor(status: number, message: string, 
+    /** ZITADEL's own gRPC-style error code from the body (6 is AlreadyExists), when it sent one. */
+    code?: number | undefined);
 }
 /**
  * #216: thrown by {@link createZitadelAdminMinter}'s `mintLoginClientMachineUser`

package/dist/plan/zitadel-machine-user.js

@@ -48,9 +48,13 @@
  */
 export class ZitadelHttpError extends Error {
     status;
-    constructor(status, message) {
+    code;
+    constructor(status, message, 
+    /** ZITADEL's own gRPC-style error code from the body (6 is AlreadyExists), when it sent one. */
+    code) {
         super(message);
         this.status = status;
+        this.code = code;
         this.name = 'ZitadelHttpError';
     }
 }

package/dist/plan/zitadel-project-roles.d.ts

@@ -0,0 +1,25 @@
+import type { ZitadelPort } from './executor.js';
+export interface ZitadelProjectRolesOptions {
+    /** The ZITADEL instance's base URL. */
+    url: string;
+    /** Bearer token allowed to manage projects and user grants. */
+    token: string;
+    fetchImpl?: typeof fetch;
+    instanceHost?: string;
+}
+/**
+ * The real {@link ZitadelPort.ensureProjectRole} and
+ * {@link ZitadelPort.grantProjectRoles}. `@wtfalch/providers` has no
+ * project-role API, so this speaks ZITADEL's v1 management API directly, with
+ * the request shape `createZitadelAdminMinter` uses. The calls follow
+ * ZITADEL's published API reference and have not been run against a live
+ * instance.
+ *
+ *  1. `POST /management/v1/projects/{id}/roles` adds the role; a 409 means it
+ *     exists already.
+ *  2. `POST /management/v1/users/grants/_search` finds the user's grant on the
+ *     project; `PUT /management/v1/users/{id}/grants/{grantId}` adds the
+ *     missing roles to it, or `POST /management/v1/users/{id}/grants` creates
+ *     the grant.
+ */
+export declare function createZitadelProjectRoles(options: ZitadelProjectRolesOptions): Pick<ZitadelPort, 'ensureProjectRole' | 'grantProjectRoles'>;

package/dist/plan/zitadel-project-roles.js

@@ -0,0 +1,104 @@
+import { ZitadelHttpError } from './zitadel-machine-user.js';
+/**
+ * The real {@link ZitadelPort.ensureProjectRole} and
+ * {@link ZitadelPort.grantProjectRoles}. `@wtfalch/providers` has no
+ * project-role API, so this speaks ZITADEL's v1 management API directly, with
+ * the request shape `createZitadelAdminMinter` uses. The calls follow
+ * ZITADEL's published API reference and have not been run against a live
+ * instance.
+ *
+ *  1. `POST /management/v1/projects/{id}/roles` adds the role; a 409 means it
+ *     exists already.
+ *  2. `POST /management/v1/users/grants/_search` finds the user's grant on the
+ *     project; `PUT /management/v1/users/{id}/grants/{grantId}` adds the
+ *     missing roles to it, or `POST /management/v1/users/{id}/grants` creates
+ *     the grant.
+ */
+export function createZitadelProjectRoles(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    async function call(method, path, orgId, body) {
+        const response = await fetchImpl(`${options.url}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${options.token}`,
+                'content-type': 'application/json',
+                'x-zitadel-orgid': orgId,
+                ...(options.instanceHost
+                    ? {
+                        'x-zitadel-instance-host': options.instanceHost,
+                        'x-forwarded-host': options.instanceHost,
+                        'x-forwarded-proto': 'https',
+                    }
+                    : {}),
+            },
+            body: JSON.stringify(body),
+        });
+        const text = await response.text();
+        let data = {};
+        try {
+            data = text ? JSON.parse(text) : {};
+        }
+        catch {
+            throw new ZitadelHttpError(response.status, `non-JSON response from ${path}`);
+        }
+        if (!response.ok) {
+            throw new ZitadelHttpError(response.status, String(data.message ?? response.statusText), typeof data.code === 'number' ? data.code : undefined);
+        }
+        return data;
+    }
+    return {
+        async ensureProjectRole(orgId, projectId, role) {
+            try {
+                await call('POST', `/management/v1/projects/${projectId}/roles`, orgId, {
+                    roleKey: role.key,
+                    displayName: role.displayName,
+                });
+                return { created: true };
+            }
+            catch (e) {
+                // Only AlreadyExists (gRPC code 6, or its name in the message) means the
+                // role is there; any other 409 is a real failure.
+                if (e instanceof ZitadelHttpError &&
+                    e.status === 409 &&
+                    (e.code === 6 || /already.?exists/i.test(e.message))) {
+                    return { created: false };
+                }
+                throw e;
+            }
+        },
+        async grantProjectRoles(orgId, userId, projectId, roleKeys) {
+            // This project's own grant for this user: not one inherited through a
+            // project grant from another org. Paged, so a user with many grants
+            // cannot hide it.
+            const pageSize = 100;
+            let existing;
+            for (let offset = 0; !existing; offset += pageSize) {
+                const found = await call('POST', '/management/v1/users/grants/_search', orgId, {
+                    query: { offset: String(offset), limit: pageSize },
+                    queries: [{ userIdQuery: { userId } }, { projectIdQuery: { projectId } }],
+                });
+                const page = found.result ?? [];
+                existing = page.find((g) => (g.userId === undefined || g.userId === userId) &&
+                    (g.projectId === undefined || g.projectId === projectId) &&
+                    !g.projectGrantId);
+                if (page.length < pageSize)
+                    break;
+            }
+            if (!existing) {
+                await call('POST', `/management/v1/users/${userId}/grants`, orgId, {
+                    projectId,
+                    roleKeys,
+                });
+                return { changed: true };
+            }
+            const held = existing.roleKeys ?? [];
+            const missing = roleKeys.filter((k) => !held.includes(k));
+            if (missing.length === 0)
+                return { changed: false };
+            await call('PUT', `/management/v1/users/${userId}/grants/${existing.id}`, orgId, {
+                roleKeys: [...held, ...missing],
+            });
+            return { changed: true };
+        },
+    };
+}

package/dist/store/postgres.js

@@ -1,5 +1,5 @@
 import { and, asc, eq, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateDomain, validateHosting, validateMail, validateOwner, validateSite, } from '../org.js';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
@@ -99,7 +99,7 @@ function rowToOrg(row) {
         adoptedApp: row.adoptedAppForm
             ? { form: row.adoptedAppForm }
             : null,
-        owner: rowToOwner(row),
+        owners: row.owners ?? [],
         test: row.isTest,
     };
 }
@@ -142,9 +142,7 @@ function orgToRow(org) {
         vatRegistered: org.buyer.vatRegistered,
         bespokeAppRepo: org.bespokeAppRepo,
         adoptedAppForm: org.adoptedApp?.form ?? null,
-        ownerEmail: org.owner?.email ?? null,
-        ownerGivenName: org.owner?.givenName ?? null,
-        ownerFamilyName: org.owner?.familyName ?? null,
+        owners: org.owners,
         isTest: org.test,
     };
 }
@@ -173,17 +171,6 @@ function rowToBuyer(row) {
         vatRegistered: row.vatRegistered,
     };
 }
-/**
- * Reassembles `DeclaredOrg.owner` from the row's three separate nullable
- * columns -- present only when all three are, same "all parts or none"
- * pattern {@link rowToBuyer} uses for the buyer's address.
- */
-function rowToOwner(row) {
-    const { ownerEmail, ownerGivenName, ownerFamilyName } = row;
-    if (ownerEmail === null || ownerGivenName === null || ownerFamilyName === null)
-        return null;
-    return { email: ownerEmail, givenName: ownerGivenName, familyName: ownerFamilyName };
-}
 /**
  * `DeclaredOrgStore` (`../store.ts`) on Postgres, for #18: create, read and
  * edit a {@link DeclaredOrg}, and read and write the {@link AppliedState}
@@ -272,7 +259,7 @@ export function createPostgresDeclaredOrgStore(db) {
     // Same place `requireValidHosting` checks hosting, on both `create` and
     // the merged result of `update`.
     function requireValidOwner(org) {
-        const reason = validateOwner(org.owner);
+        const reason = validateOwners(org.owners);
         if (reason)
             throw new DeclaredOrgError(`owner invalid: ${reason}`);
     }

package/dist/store/schema.d.ts

@@ -1,4 +1,4 @@
-import type { AppEnvSource, HostingEntry, IssuerApp } from '../org.js';
+import type { AppEnvSource, HostingEntry, IssuerApp, OwnerIdentity } from '../org.js';
 import type { Plan } from '../plan.js';
 import type { Checkpoint } from '../state.js';
 /**
@@ -754,57 +754,25 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        ownerEmail: import("drizzle-orm/pg-core").PgColumn<{
-            name: "owner_email";
+        owners: import("drizzle-orm/pg-core").PgColumn<{
+            name: "owners";
             tableName: "foundry_declared_orgs";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        ownerGivenName: import("drizzle-orm/pg-core").PgColumn<{
-            name: "owner_given_name";
-            tableName: "foundry_declared_orgs";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        ownerFamilyName: import("drizzle-orm/pg-core").PgColumn<{
-            name: "owner_family_name";
-            tableName: "foundry_declared_orgs";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: OwnerIdentity[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
+        }, {}, {
+            $type: OwnerIdentity[];
+        }>;
         isTest: import("drizzle-orm/pg-core").PgColumn<{
             name: "is_test";
             tableName: "foundry_declared_orgs";

package/dist/store/schema.js

@@ -27,7 +27,7 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     // MailConfig.roleMailboxes (org.ts, #230). Local parts of the role mailboxes
     // pre-created on the org's mail domain; empty by default.
     roleMailboxes: jsonb('role_mailboxes').notNull().default([]).$type(),
-    chatEnabled: boolean('chat_enabled').notNull().default(false),
+    chatEnabled: boolean('chat_enabled').notNull().default(true),
     chatUsesDomain: boolean('chat_uses_domain').notNull().default(false),
     callsEnabled: boolean('calls_enabled').notNull().default(false),
     callsUsesDomain: boolean('calls_uses_domain').notNull().default(false),
@@ -78,13 +78,10 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     vatRegistered: boolean('vat_registered'),
     bespokeAppRepo: text('bespoke_app_repo'),
     adoptedAppForm: text('adopted_app_form'),
-    // OwnerIdentity (org.ts): the org's owner, invited by ZITADEL email. All
-    // three nullable -- a brand new org has none of them, reassembled as one
-    // object only once all three are non-null (same shape as BuyerIdentity's
-    // own contact fields above).
-    ownerEmail: text('owner_email'),
-    ownerGivenName: text('owner_given_name'),
-    ownerFamilyName: text('owner_family_name'),
+    // OwnerIdentity[] (org.ts): the org's current owners, in order (the first
+    // is the primary). jsonb, like `hosting_entries`: an ordered list read and
+    // written whole with the org, never queried by owner.
+    owners: jsonb('owners').notNull().default([]).$type(),
     // `test: boolean` (org.ts): only a test org can be destroyed. A brand new
     // org defaults to real (false).
     isTest: boolean('is_test').notNull().default(false),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -42,7 +42,7 @@
   "dependencies": {
     "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
-    "@wtfalch/email": "0.15.0",
+    "@wtfalch/email": "^0.17.0",
     "@wtfalch/providers": "0.6.0",
     "ssh2": "1.17.0",
     "zod": "4.6.5"