@wtfalch/foundry 0.50.0 → 0.51.0

package/dist/migrations/0061_org_signin_in_app_nullable.sql

@@ -0,0 +1,20 @@
+-- @wtfalch/foundry: `signin_in_app` says "absent" again. In-app sign-in is on by default, so NULL
+-- (the field is not declared) means on, false is a declared off, true a declared on. Every stored
+-- false so far was the old column default, never a choice: it becomes NULL. Runs once: a later run
+-- finds the column already nullable and leaves the declared values alone.
+-- Mirrors src/store/schema.ts's `declaredOrgs`.
+
+do $$
+begin
+  if exists (
+    select 1 from information_schema.columns
+    where table_schema = current_schema()
+      and table_name = 'foundry_declared_orgs'
+      and column_name = 'signin_in_app'
+      and is_nullable = 'NO'
+  ) then
+    alter table foundry_declared_orgs alter column signin_in_app drop not null;
+    alter table foundry_declared_orgs alter column signin_in_app drop default;
+    update foundry_declared_orgs set signin_in_app = null where signin_in_app = false;
+  end if;
+end $$;

package/dist/org.d.ts

@@ -725,7 +725,7 @@ export interface ServicesConfig {
 }
 export declare const SFU_SLOT_MAX = 20;
 /**
- * Per-company sign-in placement. `inApp` (default off) moves the people's sign-in from the
+ * Per-company sign-in placement. `inApp` (default on: absent means on, `false` turns it off) moves the people's sign-in from the
  * company's login host onto each app's own address (`/sign-in` on agora.<domain>, boule.<domain>),
  * through the login that serves that path. Read through `plan/sign-in.ts`'s `inAppSignIn`.
  */
@@ -1053,7 +1053,7 @@ export interface DeclaredOrg {
     hosting: HostingConfig;
     /** Absent means `{ own: false }`. Optional so every existing literal and test fixture compiles unchanged, as `calls.versionPin` and `MailConfig.mailApps` do. */
     services?: ServicesConfig;
-    /** Absent means `{ inApp: false }`. Optional so every existing literal and fixture compiles unchanged. */
+    /** Absent means `{ inApp: true }`. Optional so every existing literal and fixture compiles unchanged. */
     signIn?: SignInConfig;
     /** The company's Boule. Absent means no blue/green. */
     boule?: OrgBuiltinApp;

package/dist/plan/platform-providers.js

@@ -4016,8 +4016,8 @@ async function switchOnArchonIdTokenUserinfo(context, deps) {
     try {
         done = await zitadel.updateOidcAppIdTokenUserinfoAssertion(orgId, projectId, appId);
     }
-    catch {
-        throw new Error(`platform:archon: switching on user info in the ID token failed for the sign-in client ${appId}`);
+    catch (error) {
+        throw new Error(`platform:archon: switching on user info in the ID token failed for the sign-in client ${appId}${zitadelRefusal(error)}`);
     }
     // A client that answers every property (`packages/local`) resolves to something else: no marker.
     if (typeof done !== 'boolean')
@@ -4052,13 +4052,29 @@ async function updateArchonPostLogoutUris(context, deps) {
     try {
         await zitadel.updateOidcAppPostLogoutRedirectUris(orgId, projectId, appId, uris);
     }
-    catch {
-        throw new Error(`platform:archon: updating the post-logout addresses failed for the sign-in client ${appId}`);
+    catch (error) {
+        throw new Error(`platform:archon: updating the post-logout addresses failed for the sign-in client ${appId}${zitadelRefusal(error)}`);
     }
     context.recordScopeId(PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, postLogoutAppliedValue(appId, uris));
     await context.persist?.();
     return {};
 }
+/**
+ * What ZITADEL answered, for an error about one of Archon's sign-in client repairs: its HTTP status,
+ * gRPC code and own message (ZITADEL's error ids, never a token or a request body), capped. Empty for
+ * anything that is not a ZITADEL answer, so a network failure names no cause it cannot vouch for.
+ */
+function zitadelRefusal(error) {
+    if (!(error instanceof Error) || error.name !== 'ZitadelError')
+        return '';
+    const { status, code } = error;
+    const parts = [
+        typeof status === 'number' ? `HTTP ${status}` : '',
+        typeof code === 'number' ? `code ${code}` : '',
+    ];
+    const said = error.message.slice(0, 200);
+    return ` (ZITADEL answered ${[...parts.filter(Boolean), said].join(', ')})`;
+}
 /**
  * #339: registers `/auth/desktop/callback` on Archon's sign-in client
  * (`zitadel:desktop-callback` keyed {@link PLATFORM_ARCHON_KEY}), keeping the
@@ -4089,8 +4105,8 @@ async function registerArchonDesktopCallback(context, deps) {
             await zitadel.updateOidcAppRedirectUris(orgId, projectId, appId, union);
         }
     }
-    catch {
-        throw new Error(`platform:archon: registering the desktop callback failed for the sign-in client ${appId}`);
+    catch (error) {
+        throw new Error(`platform:archon: registering the desktop callback failed for the sign-in client ${appId}${zitadelRefusal(error)}`);
     }
     context.recordScopeId(PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, appId);
     await context.persist?.();

package/dist/plan/sign-in.d.ts

@@ -68,7 +68,7 @@ export declare const SIGN_IN_RATE_LIMIT_SCOPE_KEY = "ratelimit_in_app";
 export declare const SIGN_IN_RATE_LIMIT_DESCRIPTION = "foundry: rate limit sign-in paths (in-app)";
 export declare const SIGN_IN_RATE_LIMIT_EXPRESSION = "(starts_with(http.request.uri.path, \"/auth/\")) or (starts_with(http.request.uri.path, \"/sign-in/\") and not starts_with(http.request.uri.path, \"/sign-in/_next/\"))";
 /**
- * True when the company has the switch on and it applies: a company domain whose login host is
+ * True when the company has the switch on (absent counts as on; only `inApp: false` turns it off) and it applies: a company domain whose login host is
  * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
  * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
  */

package/dist/plan/sign-in.js

@@ -72,12 +72,12 @@ export const SIGN_IN_RATE_LIMIT_SCOPE_KEY = 'ratelimit_in_app';
 export const SIGN_IN_RATE_LIMIT_DESCRIPTION = 'foundry: rate limit sign-in paths (in-app)';
 export const SIGN_IN_RATE_LIMIT_EXPRESSION = '(starts_with(http.request.uri.path, "/auth/")) or (starts_with(http.request.uri.path, "/sign-in/") and not starts_with(http.request.uri.path, "/sign-in/_next/"))';
 /**
- * True when the company has the switch on and it applies: a company domain whose login host is
+ * True when the company has the switch on (absent counts as on; only `inApp: false` turns it off) and it applies: a company domain whose login host is
  * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
  * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
  */
 export function inAppSignIn(org) {
-    return org.signIn?.inApp === true && Boolean(org.domain) && org.issuer.usesDomain;
+    return org.signIn?.inApp !== false && Boolean(org.domain) && org.issuer.usesDomain;
 }
 /**
  * True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed.

package/dist/store/postgres.js

@@ -154,8 +154,8 @@ function rowToOrg(row) {
                 },
             }
             : {}),
-        // Omitted while off.
-        ...(row.signInInApp ? { signIn: { inApp: true } } : {}),
+        // NULL is an absent field (on by default); false and true are declared.
+        ...(row.signInInApp === null ? {} : { signIn: { inApp: row.signInInApp } }),
         // Omitted while off.
         ...(row.customersEnabled || row.customersSignUp
             ? { customers: { enabled: row.customersEnabled, signUp: row.customersSignUp } }
@@ -226,7 +226,7 @@ function orgToRow(org) {
         callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
         callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
-        signInInApp: org.signIn?.inApp ?? false,
+        signInInApp: org.signIn?.inApp ?? null,
         customersEnabled: org.customers?.enabled ?? false,
         customersSignUp: org.customers?.signUp ?? false,
         bouleBlueGreen: org.boule?.blueGreen ?? null,

package/dist/store/schema.d.ts

@@ -362,8 +362,8 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             columnType: "PgBoolean";
             data: boolean;
             driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;

package/dist/store/schema.js

@@ -38,8 +38,8 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     // ServicesConfig (org.ts): false and null are the platform's shared services.
     servicesOwn: boolean('services_own').notNull().default(false),
     servicesSfuSlot: integer('services_sfu_slot'),
-    // SignInConfig.inApp (org.ts); migrations/0054.
-    signInInApp: boolean('signin_in_app').notNull().default(false),
+    // SignInConfig.inApp (org.ts); migrations/0054, nullable in 0061: NULL is an absent field (on).
+    signInInApp: boolean('signin_in_app'),
     // CustomersConfig (org.ts); migrations/0057.
     customersEnabled: boolean('customers_enabled').notNull().default(false),
     customersSignUp: boolean('customers_sign_up').notNull().default(false),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",