@wtfalch/foundry 0.33.1 → 0.34.0

package/dist/plan/sign-in-org.d.ts

@@ -23,7 +23,7 @@ export declare function signInOrgDomain(org: {
  * idempotent. A failure after the add leaves the domain on the org but not
  * primary, and nothing is recorded, so the next run repeats both.
  */
-export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string): Promise<void>;
+export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain
  * primary (the sign-in server's domain policy wants proof) is recorded under

package/dist/plan/sign-in-org.js

@@ -21,6 +21,12 @@ export function signInDomainBlockedText(orgName, domain) {
 function isPrimaryDomainRefused(error) {
     return error instanceof Error && /is not verified/.test(error.message);
 }
+/** True for the providers' "domain is not on org" answer of `setPrimaryOrgDomain`. */
+function isDomainNotListed(error) {
+    return error instanceof Error && /is not on org/.test(error.message);
+}
+const DOMAIN_LISTED_TRIES = 10;
+const DOMAIN_LISTED_WAIT_MS = 500;
 /** The domain an org's owners sign in on: its own, or `<slug>.oikos.host` when it has none. */
 export function signInOrgDomain(org) {
     return (org.domain ?? `${org.slug}.oikos.host`).toLowerCase();
@@ -30,9 +36,21 @@ export function signInOrgDomain(org) {
  * idempotent. A failure after the add leaves the domain on the org but not
  * primary, and nothing is recorded, so the next run repeats both.
  */
-export async function registerSignInDomain(zitadel, orgId, domain) {
+export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
     await zitadel.addOrgDomain(orgId, domain);
-    await zitadel.setPrimaryOrgDomain(orgId, domain);
+    // The sign-in server lists a domain a moment after it accepts the add, and
+    // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await zitadel.setPrimaryOrgDomain(orgId, domain);
+            return;
+        }
+        catch (error) {
+            if (attempt >= DOMAIN_LISTED_TRIES || !isDomainNotListed(error))
+                throw error;
+            await sleep(DOMAIN_LISTED_WAIT_MS);
+        }
+    }
 }
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain

package/dist/plan/zitadel-login-policy.js

@@ -74,7 +74,7 @@ export function createZitadelLoginPolicy(options) {
             const data = await call('GET', orgId, undefined);
             const policy = data.policy ?? {};
             const isDefault = data.isDefault === true || policy.isDefault === true;
-            if (!isDefault && policy.allowRegister === false) {
+            if (!isDefault && policy.allowRegister !== true) {
                 return { changed: false };
             }
             const settings = {};

package/dist/plan/zitadel-system-api.d.ts

@@ -36,13 +36,32 @@ export declare class CreateInstanceError extends Error {
     constructor(kind: 'rejected' | 'exists' | 'uncertain', message: string);
 }
 /** What a person does when an instance exists without a delivered bearer. Nothing is deleted automatically. */
-export declare function instanceWithoutBearerMessage(hostname: string, detail: string): string;
+export declare function instanceWithoutBearerMessage(hostname: string, detail: string, label?: string): string;
 export interface CreateInstanceRuntime {
     fetch?: typeof fetch;
     now: () => number;
     /** Fetch timeout for the one create call (default 30s). */
     timeoutMs?: number;
 }
+/**
+ * Waits until ZITADEL's system API answers, before the one create call. `/debug/healthz` and `/debug/ready`
+ * answer as soon as the HTTP server listens, but the gateway behind the system API reaches its gRPC server a
+ * moment later and answers 503 until then (seen: `POST /instances/_create` 503 about 100 ms after "server is
+ * listening"). A 503 on the create leaves the instance marked as possibly created, so the wait asks first with a
+ * read that changes nothing: `POST /system/v1/instances/_search`. Any answer other than a failed request or a
+ * 5xx counts (a 401 is the key being refused, which the create reports itself). Times out with an error that
+ * names the last answer.
+ */
+export declare function waitForSystemApi(input: {
+    customDomain: string;
+    privateKey: string;
+    label?: string;
+}, runtime: CreateInstanceRuntime & {
+    sleep: (ms: number) => Promise<void>;
+    timeoutMs?: number;
+    intervalMs?: number;
+    requestTimeoutMs?: number;
+}): Promise<void>;
 /**
  * Creates the platform's ZITADEL instance on `customDomain` with one machine
  * owner and returns its id and the owner's PAT. Sends exactly one request,
@@ -54,6 +73,8 @@ export declare function createZitadelInstance(input: {
     privateKey: string;
     instanceName: string;
     firstOrgName: string;
+    /** Names the target in error texts (default `platform:auth`). */
+    label?: string;
     owner: {
         userName: string;
         name: string;

package/dist/plan/zitadel-system-api.js

@@ -61,8 +61,48 @@ export class CreateInstanceError extends Error {
     }
 }
 /** What a person does when an instance exists without a delivered bearer. Nothing is deleted automatically. */
-export function instanceWithoutBearerMessage(hostname, detail) {
-    return `platform:auth: a ZITADEL instance may already exist for ${hostname} without a delivered bearer (${detail}). To recover, delete the instance with the system API (DELETE /system/v1/instances/{id}) or redeploy the ZITADEL database, remove the recorded key zitadel_platform_instance_undelivered, then apply again`;
+export function instanceWithoutBearerMessage(hostname, detail, label = 'platform:auth') {
+    return `${label}: a ZITADEL instance may already exist for ${hostname} without a delivered bearer (${detail}). To recover, delete the instance with the system API (DELETE /system/v1/instances/{id}) or redeploy the ZITADEL database, remove the recorded key zitadel_platform_instance_undelivered, then apply again`;
+}
+/**
+ * Waits until ZITADEL's system API answers, before the one create call. `/debug/healthz` and `/debug/ready`
+ * answer as soon as the HTTP server listens, but the gateway behind the system API reaches its gRPC server a
+ * moment later and answers 503 until then (seen: `POST /instances/_create` 503 about 100 ms after "server is
+ * listening"). A 503 on the create leaves the instance marked as possibly created, so the wait asks first with a
+ * read that changes nothing: `POST /system/v1/instances/_search`. Any answer other than a failed request or a
+ * 5xx counts (a 401 is the key being refused, which the create reports itself). Times out with an error that
+ * names the last answer.
+ */
+export async function waitForSystemApi(input, runtime) {
+    const fetchImpl = runtime.fetch ?? globalThis.fetch;
+    const url = `https://${input.customDomain}`;
+    const timeout = runtime.timeoutMs ?? 300_000;
+    const interval = runtime.intervalMs ?? 2_000;
+    const deadline = runtime.now() + timeout;
+    let last = 'no answer';
+    for (;;) {
+        try {
+            const response = await fetchImpl(`${url}/system/v1/instances/_search`, {
+                method: 'POST',
+                signal: AbortSignal.timeout(runtime.requestTimeoutMs ?? 10_000),
+                headers: {
+                    authorization: `Bearer ${signSystemApiJwt(input.privateKey, url, runtime.now())}`,
+                    'content-type': 'application/json',
+                },
+                body: '{}',
+            });
+            if (response.status < 500)
+                return;
+            last = `HTTP ${response.status}`;
+        }
+        catch {
+            last = 'the request failed';
+        }
+        if (runtime.now() >= deadline) {
+            throw new Error(`${input.label ?? 'platform:auth'}: ZITADEL's system API did not answer at ${url} within ${Math.round(timeout / 1000)}s (${last}); nothing was created, retry this apply`);
+        }
+        await runtime.sleep(interval);
+    }
 }
 /**
  * Creates the platform's ZITADEL instance on `customDomain` with one machine
@@ -73,6 +113,7 @@ export function instanceWithoutBearerMessage(hostname, detail) {
 export async function createZitadelInstance(input, runtime) {
     const fetchImpl = runtime.fetch ?? globalThis.fetch;
     const url = `https://${input.customDomain}`;
+    const label = input.label ?? 'platform:auth';
     let response;
     try {
         response = await fetchImpl(`${url}/system/v1/instances/_create`, {
@@ -97,19 +138,19 @@ export async function createZitadelInstance(input, runtime) {
         });
     }
     catch {
-        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the create request timed out or failed'));
+        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the create request timed out or failed', label));
     }
     if (response.status === 401) {
-        throw new CreateInstanceError('rejected', 'platform:auth: system API key rejected (HTTP 401); nothing was created');
+        throw new CreateInstanceError('rejected', `${label}: system API key rejected (HTTP 401); nothing was created`);
     }
     if (response.status === 409) {
-        throw new CreateInstanceError('exists', instanceWithoutBearerMessage(input.customDomain, 'ZITADEL answered 409, already exists'));
+        throw new CreateInstanceError('exists', instanceWithoutBearerMessage(input.customDomain, 'ZITADEL answered 409, already exists', label));
     }
     if (!response.ok) {
         // A 4xx is a refusal before anything was created; a 5xx may not be.
         throw new CreateInstanceError(response.status < 500 ? 'rejected' : 'uncertain', response.status < 500
-            ? `platform:auth: ZITADEL refused to create the instance (HTTP ${response.status}); nothing was created`
-            : instanceWithoutBearerMessage(input.customDomain, `ZITADEL answered HTTP ${response.status}`));
+            ? `${label}: ZITADEL refused to create the instance (HTTP ${response.status}); nothing was created`
+            : instanceWithoutBearerMessage(input.customDomain, `ZITADEL answered HTTP ${response.status}`, label));
     }
     let body = {};
     try {
@@ -119,7 +160,7 @@ export async function createZitadelInstance(input, runtime) {
         // Handled below.
     }
     if (!body.instanceId || !body.pat) {
-        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the answer had no instance id or token'));
+        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the answer had no instance id or token', label));
     }
     return { instanceId: body.instanceId, pat: body.pat };
 }

package/dist/platform.d.ts

@@ -31,6 +31,14 @@ export interface PlatformSfuService extends PlatformService {
  */
 export interface PlatformMailService extends PlatformService {
     lettermintProjectId?: string | null;
+    /**
+     * true: one shared relay container owns host port 25 and routes each
+     * message by recipient domain to a company's own mail server or to the
+     * platform's; the platform Stalwart then stops publishing port 25.
+     * false or unset (the default): the platform Stalwart binds host port 25
+     * directly, as it always has.
+     */
+    relay?: boolean;
 }
 /**
  * The uptime Worker (foundry#542): the outside prober Archon publishes as a

package/dist/slug.js

@@ -42,6 +42,7 @@ const RESERVED_ESTATE_SERVICES = [
     'manage',
     'boule',
     'operator',
+    'platform',
     'mailbox',
     'oikos',
     'cms',

package/dist/store/postgres.js

@@ -1,6 +1,7 @@
-import { and, asc, desc, eq, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
+import { and, asc, desc, eq, ne, sql } from 'drizzle-orm';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateHosting, validateMail, validateOwners, validateServices, validateSite, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
+import { findNameClashes, nameClashMessage } from '../plan/org-names.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
@@ -29,6 +30,7 @@ async function writeFenced(db, fence, write) {
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
 const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
+const SFU_SLOT_UNIQUE_INDEX = 'foundry_declared_orgs_sfu_slot_idx';
 /** #27: a bigint-safe decimal string of a non-negative integer -- no sign, no decimal point, no leading zeros (so "010" never diffs against a live "10"). */
 const NON_NEGATIVE_INTEGER = /^(0|[1-9]\d*)$/;
 /**
@@ -135,6 +137,15 @@ function rowToOrg(row) {
                 : {}),
         },
         issuer: { usesDomain: row.issuerUsesDomain },
+        // Omitted while shared, as `calls.versionPin` is.
+        ...(row.servicesOwn || row.servicesSfuSlot !== null
+            ? {
+                services: {
+                    own: row.servicesOwn,
+                    ...(row.servicesSfuSlot !== null ? { sfuSlot: row.servicesSfuSlot } : {}),
+                },
+            }
+            : {}),
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
             enabled: row.hostingEnabled,
@@ -177,6 +188,8 @@ function orgToRow(org) {
         callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
         callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
+        servicesOwn: org.services?.own ?? false,
+        servicesSfuSlot: org.services?.sfuSlot ?? null,
         siteEnabled: org.site.enabled,
         siteUsesDomain: org.site.usesDomain,
         hostingEnabled: org.hosting.enabled,
@@ -345,6 +358,30 @@ export function createPostgresDeclaredOrgStore(db) {
         if (reason)
             throw new DeclaredOrgError(`calls invalid: ${reason} (#259)`);
     }
+    // Own-service rules, on `create` and on the merged result of `update`; no
+    // two orgs share an `sfuSlot` (the unique index catches the race this misses).
+    async function requireValidServices(org) {
+        const reason = validateServices(org);
+        if (reason)
+            throw new DeclaredOrgError(`services invalid: ${reason}`);
+        const slot = org.services?.sfuSlot ?? null;
+        if (slot === null)
+            return;
+        const [taken] = await db
+            .select({ id: declaredOrgs.id })
+            .from(declaredOrgs)
+            .where(and(eq(declaredOrgs.servicesSfuSlot, slot), ne(declaredOrgs.id, org.id)))
+            .limit(1);
+        if (taken)
+            throw new DeclaredOrgError(`services invalid: sfuSlot ${slot} is already taken by another org`);
+    }
+    // No name foundry derives for this org may be one another org or the platform derives.
+    async function requireNoNameClash(org) {
+        const rows = await db.select().from(declaredOrgs).where(ne(declaredOrgs.id, org.id));
+        const [clash] = findNameClashes(org, rows.map(rowToOrg));
+        if (clash)
+            throw new DeclaredOrgError(nameClashMessage(org.slug, clash));
+    }
     // `as`: `update` is overloaded in the interface (#351), which one object-literal method cannot express.
     return {
         async create(org) {
@@ -357,6 +394,8 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidOwner(org);
             requireValidMail(org);
             requireValidCalls(org);
+            await requireValidServices(org);
+            await requireNoNameClash(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
@@ -371,6 +410,9 @@ export function createPostgresDeclaredOrgStore(db) {
                 if (constraint === DOMAIN_UNIQUE_INDEX) {
                     throw new DeclaredOrgError(`domain '${org.domain}' is already taken by another org (#131)`);
                 }
+                if (constraint === SFU_SLOT_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`services invalid: sfuSlot ${org.services?.sfuSlot} is already taken by another org`);
+                }
                 if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${org.slug}' is already taken by another org`);
                 }
@@ -461,6 +503,8 @@ export function createPostgresDeclaredOrgStore(db) {
             const wasTier2 = current.domain !== null && current.mail.mode === 'received';
             requireValidMail(next, { allowExistingTier2: wasTier2 });
             requireValidCalls(next);
+            await requireValidServices(next);
+            await requireNoNameClash(next);
             try {
                 // #351: with `expectedVersion` the version check is part of this one
                 // statement, so an edit that lands after the read above makes it match
@@ -489,6 +533,9 @@ export function createPostgresDeclaredOrgStore(db) {
                 if (constraint === DOMAIN_UNIQUE_INDEX) {
                     throw new DeclaredOrgError(`domain '${next.domain}' is already taken by another org (#131)`);
                 }
+                if (constraint === SFU_SLOT_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`services invalid: sfuSlot ${next.services?.sfuSlot} is already taken by another org`);
+                }
                 if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${next.slug}' is already taken by another org`);
                 }
@@ -605,6 +652,7 @@ function rowToPlatform(row) {
             hostname: row.mailHostname,
             gitRef: row.mailGitRef,
             ...(row.mailLettermintProjectId ? { lettermintProjectId: row.mailLettermintProjectId } : {}),
+            ...(row.mailRelay ? { relay: true } : {}),
         },
         sfu: {
             enabled: row.sfuEnabled,
@@ -656,6 +704,7 @@ function platformToRow(platform) {
         mailHostname: platform.mail.hostname,
         mailGitRef: platform.mail.gitRef,
         mailLettermintProjectId: platform.mail.lettermintProjectId ?? null,
+        mailRelay: platform.mail.relay === true,
         sfuEnabled: platform.sfu.enabled,
         sfuHostname: platform.sfu.hostname,
         sfuGitRef: platform.sfu.gitRef,

package/dist/store/schema.d.ts

@@ -321,6 +321,40 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        servicesOwn: import("drizzle-orm/pg-core").PgColumn<{
+            name: "services_own";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        servicesSfuSlot: import("drizzle-orm/pg-core").PgColumn<{
+            name: "services_sfu_slot";
+            tableName: "foundry_declared_orgs";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         siteEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "site_enabled";
             tableName: "foundry_declared_orgs";
@@ -1592,6 +1626,23 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        mailRelay: import("drizzle-orm/pg-core").PgColumn<{
+            name: "mail_relay";
+            tableName: "foundry_declared_platform";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         sfuEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sfu_enabled";
             tableName: "foundry_declared_platform";

package/dist/store/schema.js

@@ -35,6 +35,9 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     callsVersionPinSynapse: text('calls_version_pin_synapse'),
     callsVersionPinMas: text('calls_version_pin_mas'),
     issuerUsesDomain: boolean('issuer_uses_domain').notNull().default(false),
+    // ServicesConfig (org.ts): false and null are the platform's shared services.
+    servicesOwn: boolean('services_own').notNull().default(false),
+    servicesSfuSlot: integer('services_sfu_slot'),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.
     siteEnabled: boolean('site_enabled').notNull().default(false),
     siteUsesDomain: boolean('site_uses_domain').notNull().default(false),
@@ -162,6 +165,8 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     mailGitRef: text('mail_git_ref').notNull().default(''),
     /** #491, `migrations/0044_platform_mail_lettermint_project.sql`. Declared, never discovered. */
     mailLettermintProjectId: text('mail_lettermint_project_id'),
+    /** `migrations/0052_platform_mail_relay.sql`. */
+    mailRelay: boolean('mail_relay').notNull().default(false),
     sfuEnabled: boolean('sfu_enabled').notNull().default(false),
     sfuHostname: text('sfu_hostname').notNull(),
     sfuGitRef: text('sfu_git_ref').notNull().default(''),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.33.1",
+  "version": "0.34.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",

package/versions.json

@@ -5,5 +5,7 @@
   "livekit": "v1.13.7",
   "cloudflared": "2026.9.3",
   "stalwart": "v0.16.24",
-  "hc": "v4.4"
+  "hc": "v4.4",
+  "alpine": "3.22.1",
+  "busybox": "1.37.0-musl"
 }