@wtfalch/foundry 0.16.14 → 0.16.15

package/dist/plan/platform-providers.d.ts

@@ -259,6 +259,14 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private executeSfu;
     private coolifyJobs;
 }
+/**
+ * Every ZITADEL OIDC/management/console/asset path -- `deploy/proxy/Caddyfile`'s
+ * own explicit list, restated here as one regex since the tunnel routes by a
+ * single `path` per ingress rule rather than a set. Anything not matching
+ * falls through to the login app's own ingress rule below (login v2 answers
+ * everything else, including the root).
+ */
+export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
 /**
  * #283: the ref the new instance's IAM_OWNER machine token (a PAT) is
  * delivered under, once. A host reads it back to build `zitadelForInstance`

package/dist/plan/platform-providers.js

@@ -550,7 +550,11 @@ const AUTH_BROKER_PORT = '3000';
  * falls through to the login app's own ingress rule below (login v2 answers
  * everything else, including the root).
  */
-const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known)(/|$)';
+// `v2`, `v2beta` and `zitadel.<service>` are ZITADEL's v2 REST and connect
+// APIs (providers' `inviteOrgOwner` calls `POST /v2/users`); without them those
+// calls reach the login app and answer 404. The login app itself lives under
+// `/ui/v2/login`, which none of these match.
+export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)';
 /**
  * `@wtfalch/auth`'s own `brokerUrl` default, `<issuer>/api`
  * (`packages/auth/src/config.ts`) -- `deploy/proxy/Caddyfile`'s own
@@ -1423,8 +1427,12 @@ async function provisionPlatformAuth(context, deps, owners = []) {
             });
             await record(PLATFORM_AUTH_SMTP_SCOPE_KEY, smtp.id);
         }
-        catch {
-            throw new Error(`platform:auth: could not configure ZITADEL's SMTP provider for ${hostname}; the cause is left out because it can carry the Lettermint key`);
+        catch (error) {
+            // The cause, with the Lettermint key redacted, so a failure says why.
+            const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
+                mailToken,
+            ]);
+            throw new Error(`platform:auth: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
         }
         if (!context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY]) {
             const owner = owners[0];
@@ -1444,8 +1452,14 @@ async function provisionPlatformAuth(context, deps, owners = []) {
                         email: owner.email,
                     }));
                 }
-                catch {
-                    throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerOrgId}; the cause is left out because it can carry the owner's email`);
+                catch (error) {
+                    // The cause, with the owner's email and the Lettermint key redacted, so a failure says why.
+                    const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
+                        owner.email,
+                        owner.email.toLowerCase(),
+                        mailToken,
+                    ]);
+                    throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerOrgId}: ${cause}`);
                 }
                 await record(PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, invitedUserId);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.14",
+  "version": "0.16.15",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",