@wtfalch/foundry 0.45.1 → 0.46.0

package/dist/plan/sign-in-bindings.js

@@ -36,6 +36,16 @@ export async function editSignInBindings(coolify, input) {
         ...doc.bindings.filter((b) => !touched.has(b.host)),
         ...(input.upsert ?? []).map((b) => ({ ...b, clientIds: [...b.clientIds].sort() })),
     ].sort((a, b) => (a.host < b.host ? -1 : 1));
+    const orgs = input.clientOrganizations;
+    if (orgs && (Object.keys(orgs.upsert ?? {}).length > 0 || (orgs.remove ?? []).length > 0)) {
+        const merged = { ...doc.clientOrganizations, ...orgs.upsert };
+        const gone = new Set(orgs.remove ?? []);
+        const sorted = Object.fromEntries(Object.entries(merged)
+            .filter(([id]) => !gone.has(id))
+            .sort(([a], [b]) => (a < b ? -1 : 1)));
+        // An empty map is left out of the document, as it was before the first write.
+        doc.clientOrganizations = Object.keys(sorted).length > 0 ? sorted : undefined;
+    }
     const next = JSON.stringify(doc);
     if (live?.value === next)
         return;

package/dist/plan/sign-in-org.d.ts

@@ -7,6 +7,12 @@ export declare const ZITADEL_ORG_DOMAIN_SCOPE_KEY = "zitadel_org_domain";
  * names another org, the company plan holds the close step and no owner invite.
  */
 export declare const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_org_registration_closed";
+/**
+ * Scope id: the id of the customers org whose self-registration foundry
+ * closed, recorded only after `closeSelfRegistration` returned. Foundry closes
+ * once and never opens: a company that turns sign-up on keeps it on.
+ */
+export declare const ZITADEL_CUSTOMERS_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_customers_registration_closed";
 /** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
 export declare function closeSignInOrgRegistration(zitadel: Pick<ZitadelPort, 'closeSelfRegistration'>, orgId: string, recordScopeId: (key: string, id: string) => void, scopeKey?: string): Promise<void>;
 /** Scope id: the domain the sign-in server still refused to make primary after foundry set its domain policy and added the domain again. Set instead of failing; the planner reports it and plans the domain again. */
@@ -27,12 +33,17 @@ export declare function signInOrgDomain(org: {
     slug: string;
     domain: string | null;
 }): string;
+/** The fixed text for a domain the sign-in server already holds on another organisation. */
+export declare function signInDomainTakenText(domain: string): string;
 /**
- * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
- * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
- * A domain added while the policy still wanted proof stays unverified, so it
- * is removed and added again. A failure after the add leaves the domain on
- * the org but not primary, and nothing is recorded, so the next run repeats.
+ * Adds `domain` to the ZITADEL org, sets the server's domain policy
+ * ({@link SIGN_IN_DOMAIN_POLICY}) and makes the domain primary. Every call is
+ * idempotent. The add comes first, so foundry holds the domain before the
+ * policy stops asking for proof of ownership. A domain added while the policy
+ * still wanted proof stays unverified, so it is removed and added again (the
+ * remove-and-add gap: the domain is off the org for up to five seconds; known,
+ * left as is). A failure after the add leaves the domain on the org but not
+ * primary, and nothing is recorded, so the next run repeats.
  */
 export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
 /**
@@ -41,7 +52,7 @@ export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'ensureD
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */
-export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string): Promise<boolean>;
+export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string, sleep?: (ms: number) => Promise<void>): Promise<boolean>;
 export interface EnsureSignInOrgOptions {
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'closeSelfRegistration'>;
     /** Where the successful close is recorded (the org id). Absent: not recorded; the caller closes on every run. */
@@ -60,6 +71,8 @@ export interface EnsureSignInOrgOptions {
     orgScopeKey?: string;
     /** Defaults to {@link ZITADEL_ORG_DOMAIN_SCOPE_KEY}. */
     domainScopeKey?: string;
+    /** Waits between tries of the domain calls; a test passes a no-op. */
+    sleep?: (ms: number) => Promise<void>;
 }
 /**
  * Finds or creates the company's sign-in organisation by name, registers

package/dist/plan/sign-in-org.js

@@ -6,6 +6,12 @@ export const ZITADEL_ORG_DOMAIN_SCOPE_KEY = 'zitadel_org_domain';
  * names another org, the company plan holds the close step and no owner invite.
  */
 export const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = 'zitadel_org_registration_closed';
+/**
+ * Scope id: the id of the customers org whose self-registration foundry
+ * closed, recorded only after `closeSelfRegistration` returned. Foundry closes
+ * once and never opens: a company that turns sign-up on keeps it on.
+ */
+export const ZITADEL_CUSTOMERS_REGISTRATION_CLOSED_SCOPE_KEY = 'zitadel_customers_registration_closed';
 /** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
 export async function closeSignInOrgRegistration(zitadel, orgId, recordScopeId, scopeKey = ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY) {
     await zitadel.closeSelfRegistration(orgId);
@@ -51,16 +57,35 @@ async function untilListed(work, retry, sleep) {
         }
     }
 }
+/** The fixed text for a domain the sign-in server already holds on another organisation. */
+export function signInDomainTakenText(domain) {
+    return `the sign-in domain ${domain} already exists on another organisation of the sign-in server, so foundry cannot add it; remove it there and apply again`;
+}
+/** Adds the domain; an "already exists" answer becomes {@link signInDomainTakenText}, which holds no cause. */
+async function addDomain(zitadel, orgId, domain) {
+    try {
+        await zitadel.addOrgDomain(orgId, domain);
+    }
+    catch (error) {
+        if (error instanceof Error && /already[ .]?exists/i.test(error.message)) {
+            throw new Error(signInDomainTakenText(domain));
+        }
+        throw error;
+    }
+}
 /**
- * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
- * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
- * A domain added while the policy still wanted proof stays unverified, so it
- * is removed and added again. A failure after the add leaves the domain on
- * the org but not primary, and nothing is recorded, so the next run repeats.
+ * Adds `domain` to the ZITADEL org, sets the server's domain policy
+ * ({@link SIGN_IN_DOMAIN_POLICY}) and makes the domain primary. Every call is
+ * idempotent. The add comes first, so foundry holds the domain before the
+ * policy stops asking for proof of ownership. A domain added while the policy
+ * still wanted proof stays unverified, so it is removed and added again (the
+ * remove-and-add gap: the domain is off the org for up to five seconds; known,
+ * left as is). A failure after the add leaves the domain on the org but not
+ * primary, and nothing is recorded, so the next run repeats.
  */
 export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    await addDomain(zitadel, orgId, domain);
     await zitadel.ensureDomainPolicy(SIGN_IN_DOMAIN_POLICY);
-    await zitadel.addOrgDomain(orgId, domain);
     // The sign-in server lists a domain a moment after it accepts the add, and
     // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
     try {
@@ -75,7 +100,7 @@ export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms)
     // Until the server lists the removal, the add sees the old unverified
     // domain and skips: both answers are a moment late, so ask again.
     await untilListed(async () => {
-        await zitadel.addOrgDomain(orgId, domain);
+        await addDomain(zitadel, orgId, domain);
         await zitadel.setPrimaryOrgDomain(orgId, domain);
     }, (error) => isDomainNotListed(error) || isPrimaryDomainRefused(error), sleep);
 }
@@ -85,9 +110,9 @@ export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms)
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */
-export async function registerSignInDomainOrBlock(zitadel, orgId, domain, recordScopeId, blockedScopeKey = ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY) {
+export async function registerSignInDomainOrBlock(zitadel, orgId, domain, recordScopeId, blockedScopeKey = ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, sleep) {
     try {
-        await registerSignInDomain(zitadel, orgId, domain);
+        await registerSignInDomain(zitadel, orgId, domain, sleep);
         return true;
     }
     catch (error) {
@@ -115,7 +140,7 @@ export async function ensureSignInOrg(options) {
     if (options.registrationClosedScopeKey) {
         recordScopeId(options.registrationClosedScopeKey, org.id);
     }
-    const registered = await registerSignInDomainOrBlock(zitadel, org.id, domain, recordScopeId, options.domainBlockedScopeKey);
+    const registered = await registerSignInDomainOrBlock(zitadel, org.id, domain, recordScopeId, options.domainBlockedScopeKey, options.sleep);
     if (!registered)
         return { orgId: org.id, created, domainBlocked: true };
     recordScopeId(options.domainScopeKey ?? ZITADEL_ORG_DOMAIN_SCOPE_KEY, domain);

package/dist/plan/sign-in.d.ts

@@ -31,10 +31,13 @@ export declare const SIGN_IN_LOGIN_APP_SCOPE_KEY = "coolify_platform_auth_login_
  * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
  * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
  * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
- *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
- *    the app's client id off the company's binding at the same write: that write and the base URI are the only
- *    moment the old path can fail, and they are the last two calls.
- * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). From auth 0.28.0 (one client may sit in two bindings of one company)
+ *    this is three writes: the app host's binding with the client id kept on the company's, the base URI, then
+ *    the company's binding without the id; sign-in works at every point. Before that release the login refuses
+ *    a client id held by two bindings, so one write moves the id off the company's binding: that write and the
+ *    base URI are the only moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host (0.28.0 and
+ * later: the company binding takes the id first and the app binding goes after the base URI); the app
  * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
  */
 /**
@@ -70,7 +73,11 @@ export declare const SIGN_IN_RATE_LIMIT_EXPRESSION = "(starts_with(http.request.
  * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
  */
 export declare function inAppSignIn(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): boolean;
-/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+/**
+ * True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed.
+ * Accepted behaviour: a `SIGNIN_UPSTREAM` added by hand on Agora or Boule is drift like any other env foundry
+ * owns, so the next apply removes it. Foundry writes the value itself (`signInUpstream`) while the switch is on.
+ */
 export declare function staleSignInUpstream(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): boolean;
 /** The build argument (a build-time env in Coolify) that fixes the login's base path. */
 export declare const SIGN_IN_BUILD_ARG_ENV = "NEXT_PUBLIC_BASE_PATH";

package/dist/plan/sign-in.js

@@ -31,10 +31,13 @@ export const SIGN_IN_LOGIN_APP_SCOPE_KEY = 'coolify_platform_auth_login_sign_in_
  * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
  * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
  * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
- *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
- *    the app's client id off the company's binding at the same write: that write and the base URI are the only
- *    moment the old path can fail, and they are the last two calls.
- * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). From auth 0.28.0 (one client may sit in two bindings of one company)
+ *    this is three writes: the app host's binding with the client id kept on the company's, the base URI, then
+ *    the company's binding without the id; sign-in works at every point. Before that release the login refuses
+ *    a client id held by two bindings, so one write moves the id off the company's binding: that write and the
+ *    base URI are the only moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host (0.28.0 and
+ * later: the company binding takes the id first and the app binding goes after the base URI); the app
  * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
  */
 /**
@@ -76,7 +79,11 @@ export const SIGN_IN_RATE_LIMIT_EXPRESSION = '(starts_with(http.request.uri.path
 export function inAppSignIn(org) {
     return org.signIn?.inApp === true && Boolean(org.domain) && org.issuer.usesDomain;
 }
-/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+/**
+ * True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed.
+ * Accepted behaviour: a `SIGNIN_UPSTREAM` added by hand on Agora or Boule is drift like any other env foundry
+ * owns, so the next apply removes it. Foundry writes the value itself (`signInUpstream`) while the switch is on.
+ */
 export function staleSignInUpstream(desired, live) {
     const held = live[SIGN_IN_UPSTREAM_ENV];
     return desired[SIGN_IN_UPSTREAM_ENV] === undefined && held !== undefined && held !== '';

package/dist/plan/signin-db-move.js

@@ -1,4 +1,5 @@
 import { pinnedRef } from '../bootstrap/versions.js';
+import { JobFailure, waitForJob as waitForJobApp } from './job-app.js';
 import { PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, findOrCreatePlatformApp, } from './platform-providers.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY, SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_NAME, SIGNIN_DB_PORT, SIGNIN_DB_USER, boundedCall, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
@@ -94,41 +95,16 @@ export function signinDbMoveNewUrl(host, password, database) {
 class MoveFailure extends Error {
 }
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/** Polls of an `exited` job with no `running` seen before it counts as a stop (an `exited` read can be the container before the deploy). */
-const JOB_EXITED_POLLS = 6;
-/**
- * Waits for the copy job to report healthy, which it does only after the counts match. The job never
- * exits on success, so any exit is final: `restarting` at once, `exited` once the job was seen running
- * or stayed exited for {@link JOB_EXITED_POLLS} polls. It has failed too at the deadline. A healthy
- * status read before any other could be the container before the stop, so it counts only after a
- * different status was seen.
- */
+/** Waits for the copy job to report healthy, which it does only after the counts match. */
 async function waitForJob(coolify, appId, runtime) {
-    const now = runtime.now ?? Date.now;
-    const sleep = runtime.sleep ?? defaultSleep;
-    const timeout = runtime.signinDbMoveTimeoutMs ?? 1_800_000;
-    const interval = runtime.signinDbMovePollMs ?? 10_000;
-    const deadline = now() + timeout;
-    let left = false;
-    let running = false;
-    let exitedPolls = 0;
-    for (;;) {
-        const { status } = await coolify.getApplication(appId);
-        if (status === 'running:healthy' && left)
-            return;
-        if (status !== 'running:healthy')
-            left = true;
-        if (status?.startsWith('running'))
-            running = true;
-        exitedPolls = status?.startsWith('exited') ? exitedPolls + 1 : 0;
-        if (status?.startsWith('restarting') ||
-            (status?.startsWith('exited') && (running || exitedPolls >= JOB_EXITED_POLLS))) {
-            throw new MoveFailure('the copy job stopped before the row counts matched');
-        }
-        if (now() >= deadline) {
-            throw new MoveFailure(`the copy job did not finish within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'})`);
-        }
-        await sleep(interval);
+    try {
+        await waitForJobApp(coolify, appId, runtime, {
+            job: 'the copy job',
+            stopped: 'the copy job stopped before the row counts matched',
+        });
+    }
+    catch (error) {
+        throw error instanceof JobFailure ? new MoveFailure(error.message) : error;
     }
 }
 /** Coolify queues a stop. Waits until it reports the app stopped; `pg_dump` must not run while ZITADEL can still write. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.45.1",
+  "version": "0.46.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -38,15 +38,15 @@
     "status": "node scripts/status.mjs"
   },
   "peerDependencies": {
-    "@wtfalch/providers": ">=0.10.0",
+    "@wtfalch/providers": ">=0.12.0",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
     "@wtfalch/audit": "0.6.0",
-    "@wtfalch/auth": "0.16.0",
-    "@wtfalch/edge": "0.13.0",
+    "@wtfalch/auth": "^0.26.0",
+    "@wtfalch/edge": "0.15.1",
     "@wtfalch/email": "^0.20.0",
-    "@wtfalch/providers": "0.10.0",
+    "@wtfalch/providers": "0.12.0",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },