@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/store/postgres.js

@@ -1,5 +1,5 @@
 import { and, asc, desc, eq, inArray, isNull, ne, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBlueGreen, validateBuyerIdentity, validateCalls, validateCustomers, validateDomain, validateDomainClaim, validateHosting, validateMail, validateOwners, validateServices, validateSignIn, validateSite, validateVersionPin, } from '../org.js';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, refuseCustomers, refuseHosting, validateBlueGreen, validateBuyerIdentity, validateCalls, validateDomain, validateDomainClaim, validateMail, validateOwners, validateServices, validateSignIn, validateSite, validateVersionPin, } from '../org.js';
 import { hostingNames } from '../plan/locked-hostnames.js';
 import { findNameClashes, nameClashMessage } from '../plan/org-names.js';
 import { validatePlatform } from '../platform.js';
@@ -77,9 +77,16 @@ export function uniqueViolationConstraint(error) {
  * is that throw.
  */
 export class DeclaredOrgError extends Error {
-    constructor(message) {
+    /** Set when a hosting or customers validator refused the write: which rule, and where in the org. */
+    code;
+    path;
+    constructor(message, refusal) {
         super(message);
         this.name = 'DeclaredOrgError';
+        if (refusal) {
+            this.code = refusal.code;
+            this.path = refusal.path;
+        }
     }
 }
 /**
@@ -357,9 +364,9 @@ export function createPostgresDeclaredOrgStore(db) {
     // #71: same place `requireValidBuyer` checks the buyer identity (#67), on
     // both `create` and the merged result of `update`.
     function requireValidHosting(org) {
-        const reason = validateHosting(org.hosting, hostingNames(org, []));
-        if (reason)
-            throw new DeclaredOrgError(`hosting invalid: ${reason} (#71)`);
+        const refusal = refuseHosting(org.hosting, hostingNames(org, []));
+        if (refusal)
+            throw new DeclaredOrgError(`hosting invalid: ${refusal.message} (#71)`, refusal);
     }
     // #101: same place `requireValidHosting` checks hosting, on both `create`
     // and the merged result of `update`.
@@ -411,9 +418,10 @@ export function createPostgresDeclaredOrgStore(db) {
         const signInReason = validateSignIn(org);
         if (signInReason)
             throw new DeclaredOrgError(`signIn invalid: ${signInReason}`);
-        const customersReason = validateCustomers(org);
-        if (customersReason)
-            throw new DeclaredOrgError(`customers invalid: ${customersReason}`);
+        const customersRefusal = refuseCustomers(org);
+        if (customersRefusal) {
+            throw new DeclaredOrgError(`customers invalid: ${customersRefusal.message}`, customersRefusal);
+        }
         const slot = org.services?.sfuSlot ?? null;
         if (slot === null)
             return;
@@ -855,6 +863,10 @@ function rowToRequestedChange(row) {
         requestedBy: row.requestedBy,
         createdAt: row.createdAt.toISOString(),
         state: row.state,
+        requester: row.requester ?? null,
+        idempotencyKey: row.idempotencyKey ?? null,
+        reason: row.reason ?? null,
+        updatedAt: row.updatedAt.toISOString(),
     };
 }
 /**
@@ -885,6 +897,53 @@ export function createPostgresRequestedChangeStore(db) {
                 throw new RequestedChangeError('insert returned no row');
             return rowToRequestedChange(row);
         },
+        async createOrGet({ orgId, value, requestedBy, requester, idempotencyKey }) {
+            if (value.field !== 'app' && value.field !== 'build') {
+                throw new RequestedChangeError(`'${value.field}' is not an app or build request`);
+            }
+            if (idempotencyKey === '')
+                throw new RequestedChangeError('an idempotency key is required');
+            const [inserted] = await db
+                .insert(foundryRequestedChanges)
+                .values({
+                orgId,
+                field: value.field,
+                value: requestedChangePayload(value),
+                requestedBy,
+                state: 'applying',
+                requester: { ...requester },
+                idempotencyKey,
+            })
+                .onConflictDoNothing()
+                .returning();
+            if (inserted)
+                return { request: rowToRequestedChange(inserted), created: true };
+            const [existing] = await db
+                .select()
+                .from(foundryRequestedChanges)
+                .where(and(eq(foundryRequestedChanges.orgId, orgId), eq(foundryRequestedChanges.idempotencyKey, idempotencyKey)))
+                .limit(1);
+            if (!existing)
+                throw new RequestedChangeError('insert returned no row');
+            return { request: rowToRequestedChange(existing), created: false };
+        },
+        async transition(id, from, to, reason) {
+            const [row] = await db
+                .update(foundryRequestedChanges)
+                .set({ state: to, reason: reason ? { ...reason } : null, updatedAt: new Date() })
+                .where(and(eq(foundryRequestedChanges.id, id), inArray(foundryRequestedChanges.state, [...from])))
+                .returning();
+            return row ? rowToRequestedChange(row) : null;
+        },
+        async openForApp(orgId, key) {
+            const [row] = await db
+                .select()
+                .from(foundryRequestedChanges)
+                .where(and(eq(foundryRequestedChanges.orgId, orgId), eq(foundryRequestedChanges.state, 'applying'), inArray(foundryRequestedChanges.field, ['app', 'build']), sql `${foundryRequestedChanges.value} ->> 'key' = ${key}`))
+                .orderBy(desc(foundryRequestedChanges.id))
+                .limit(1);
+            return row ? rowToRequestedChange(row) : null;
+        },
         async get(id) {
             const [row] = await db
                 .select()

package/dist/store/schema.d.ts

@@ -2470,6 +2470,78 @@ export declare const foundryRequestedChanges: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        requester: import("drizzle-orm/pg-core").PgColumn<{
+            name: "requester";
+            tableName: "foundry_requested_changes";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        idempotencyKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "idempotency_key";
+            tableName: "foundry_requested_changes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "foundry_requested_changes";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "foundry_requested_changes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;

package/dist/store/schema.js

@@ -234,6 +234,10 @@ export const foundryRequestedChanges = pgTable('foundry_requested_changes', {
     requestedBy: text('requested_by').notNull(),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
     state: text('state').notNull().default('needs_approval'),
+    requester: jsonb('requester').$type(),
+    idempotencyKey: text('idempotency_key'),
+    reason: jsonb('reason').$type(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
 });
 /** Mirrors `migrations/0055_release_requests.sql`: an operator's release action, consumed once by the runner. */
 export const foundryReleaseRequests = pgTable('foundry_release_requests', {

package/dist/store.d.ts

@@ -1,6 +1,6 @@
 import type { DeclaredOrg, OrgId } from './org.js';
 import type { DeclaredPlatform } from './platform.js';
-import type { RequestedChange, RequestedChangeValue } from './requested-changes.js';
+import type { RequestedBy, RequestedChange, RequestedChangeState, RequestedChangeValue } from './requested-changes.js';
 import type { AppliedState } from './state.js';
 /** `DeclaredOrgStore.update`'s options (#351). */
 export interface UpdateOptions {
@@ -190,6 +190,29 @@ export interface RequestedChangeStore {
         value: RequestedChangeValue;
         requestedBy: string;
     }): Promise<RequestedChange>;
+    /**
+     * Stores an `app` or `build` request in `applying`, or returns the one already stored under the
+     * same (orgId, idempotencyKey) with `created: false` and writes nothing. Safe under a race.
+     * Throws `RequestedChangeError` for any other kind.
+     */
+    createOrGet(input: {
+        orgId: OrgId;
+        org: DeclaredOrg;
+        value: RequestedChangeValue;
+        requestedBy: string;
+        requester: RequestedBy;
+        idempotencyKey: string;
+    }): Promise<{
+        request: RequestedChange;
+        created: boolean;
+    }>;
+    /**
+     * Compare-and-set: moves request `id` to `to` only when it is in one of `from`, and returns the
+     * new row; null when it was not (or does not exist). `reason` is stored (null when omitted).
+     */
+    transition(id: number, from: readonly RequestedChangeState[], to: RequestedChangeState, reason?: RequestedChange['reason']): Promise<RequestedChange | null>;
+    /** The `applying` app or build request for entry `key` of that org, or null. */
+    openForApp(orgId: OrgId, key: string): Promise<RequestedChange | null>;
     get(id: number): Promise<RequestedChange | null>;
     /** Every request an org has made, oldest first. */
     listForOrg(orgId: OrgId): Promise<RequestedChange[]>;

package/dist/worker-app-config.d.ts

@@ -117,13 +117,19 @@ export declare function validateArtifact(at: string, artifactUrl: string, sha256
  * The one exact name a Worker app is served at: `<host>.<domain>` or the apex
  * on the org's own domain, else `<slug>-<key>.oikos.host` (one label under
  * `oikos.host`, so the free Universal certificate covers it), and
- * `<slug>.oikos.host` for the entry keyed `app`.
+ * `<slug>.oikos.host` for the main entry.
  */
 export declare function workerAppHostnameOf(org: {
     slug: string;
     domain: string | null;
     usesDomain: boolean;
-}, key: string, host: string): string;
+}, entry: Pick<HostingEntry, 'key' | 'main'>, host: string): string;
+/**
+ * A Worker app declared before its first build has an empty `artifactUrl` and an empty
+ * `artifactSha256`. It validates, and the planner deploys nothing until both are set. One empty
+ * and one set is still refused.
+ */
+export declare function workerAppHasBuild(app: Pick<WorkerAppConfig, 'artifactUrl' | 'artifactSha256'>): boolean;
 /**
  * The Durable Object classes the migrations leave behind, folded in order:
  * created, then removed, then renamed. A rename of a class that does not exist

package/dist/worker-app-config.js

@@ -106,12 +106,24 @@ export function validateArtifact(at, artifactUrl, sha256, repo = null) {
  * The one exact name a Worker app is served at: `<host>.<domain>` or the apex
  * on the org's own domain, else `<slug>-<key>.oikos.host` (one label under
  * `oikos.host`, so the free Universal certificate covers it), and
- * `<slug>.oikos.host` for the entry keyed `app`.
+ * `<slug>.oikos.host` for the main entry.
  */
-export function workerAppHostnameOf(org, key, host) {
+export function workerAppHostnameOf(org, entry, host) {
     if (org.usesDomain && org.domain)
         return host === '@' ? org.domain : `${host}.${org.domain}`;
-    return key === 'app' ? `${org.slug}.oikos.host` : `${org.slug}-${key}.oikos.host`;
+    return isMain(entry) ? `${org.slug}.oikos.host` : `${org.slug}-${entry.key}.oikos.host`;
+}
+/** `org.ts`'s `isMainEntry`, restated: that file imports this one. */
+function isMain(entry) {
+    return entry.main ?? entry.key === 'app';
+}
+/**
+ * A Worker app declared before its first build has an empty `artifactUrl` and an empty
+ * `artifactSha256`. It validates, and the planner deploys nothing until both are set. One empty
+ * and one set is still refused.
+ */
+export function workerAppHasBuild(app) {
+    return app.artifactUrl !== '' || app.artifactSha256 !== '';
 }
 /** True for a real calendar date written `YYYY-MM-DD`. */
 function isCalendarDate(value) {
@@ -197,7 +209,9 @@ export function validateEntryWorkerApp(entry, hosting, names) {
     if (entry.key.length > WORKER_NAME_MAX_LENGTH - WORKER_NAME_FIXED_LENGTH) {
         return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "${WORKER_APP_NAME_SUFFIX}") must fit Cloudflare's ${WORKER_NAME_MAX_LENGTH}-character limit`;
     }
-    const invalidArtifact = validateArtifact(at, app.artifactUrl, app.artifactSha256, entry.repo);
+    const invalidArtifact = workerAppHasBuild(app)
+        ? validateArtifact(at, app.artifactUrl, app.artifactSha256, entry.repo)
+        : null;
     if (invalidArtifact)
         return invalidArtifact;
     if (app.compatibilityDate !== undefined && !isCalendarDate(app.compatibilityDate)) {
@@ -224,14 +238,14 @@ export function validateEntryWorkerApp(entry, hosting, names) {
                 slug: names.slug,
                 domain: names.domain,
                 usesDomain: hosting.usesDomain,
-            }, entry.key, app.host);
+            }, entry, app.host);
             if (names.locked.has(served))
                 return `${at} host is a name foundry owns: ${served}`;
             // Without a domain the name is `<slug>-<key>.oikos.host`, the shape of
             // every environment and service host of the org (`-auth`, `-agora`,
             // `-boule`, `-stage`, `-pr-<n>`, ...). `slug.ts` already refuses a slug
             // that ends in one of those suffixes, so the same check refuses the key.
-            if (!domain && entry.key !== 'app' && validateSlug(`${names.slug}-${entry.key}`)) {
+            if (!domain && !isMain(entry) && validateSlug(`${names.slug}-${entry.key}`)) {
                 return `${at} entry key '${entry.key}' would serve ${served}, a name foundry reserves for the org's own services and environments`;
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.45.1",
+  "version": "0.47.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -38,15 +38,15 @@
     "status": "node scripts/status.mjs"
   },
   "peerDependencies": {
-    "@wtfalch/providers": ">=0.10.0",
+    "@wtfalch/providers": ">=0.12.0",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
     "@wtfalch/audit": "0.6.0",
-    "@wtfalch/auth": "0.16.0",
-    "@wtfalch/edge": "0.13.0",
+    "@wtfalch/auth": "^0.26.0",
+    "@wtfalch/edge": "0.15.1",
     "@wtfalch/email": "^0.20.0",
-    "@wtfalch/providers": "0.10.0",
+    "@wtfalch/providers": "0.12.0",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },