@wtfalch/foundry 0.57.0 → 0.59.0

package/dist/plan/desktop-callback.d.ts

@@ -11,15 +11,27 @@ export declare function desktopCallbackUri(host: string): string;
 /** The URIs to add to an app's current list: current first, then each wanted one it lacks. */
 export declare function unionRedirectUris(current: readonly string[], wanted: readonly string[]): string[];
 /**
- * The ZITADEL app id of company app `appKey` once its desktop callback was
- * registered. `planDesktopCallbacks` names an app while its recorded id
- * differs, so an app made before the callback existed, or made again under a
- * new id, is repaired once.
+ * The redirect URIs a company web app signs in with: `/auth/callback` and the
+ * desktop callback on each of its hosts. Agora's own client holds only its
+ * `/callback`. `zitadelApp` creates the app with this list, and
+ * `zitadelDesktopCallback` adds what an existing app lacks.
+ */
+export declare function signInRedirectUris(org: DeclaredOrg, appKey: string): string[];
+/**
+ * The marker value for an app: its ZITADEL id and the URIs it must hold, in a
+ * fixed order. A changed hostname or a re-created app gives a different
+ * value, so the next plan names the app again.
+ */
+export declare function signInCallbackAppliedValue(appId: string, uris: readonly string[]): string;
+/**
+ * Marker of company app `appKey`: `signInCallbackAppliedValue` once its
+ * sign-in callbacks were registered. A marker holding only the app id (the
+ * desktop-only form of #339) differs, so such an app is repaired once.
  */
 export declare function zitadelAppDesktopCallbackAppliedScopeKey(appKey: string): string;
 /**
  * One `zitadel:desktop-callback` step names every live web sign-in app whose
- * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * marker differs from the one its recorded id and wanted URIs give. Plans nothing when the host's ZITADEL
  * client lacks the two redirect URI calls (`wired`), before the org and
  * project are recorded, or while the platform's sign-in is not ready.
  */

package/dist/plan/desktop-callback.js

@@ -1,3 +1,6 @@
+import { agoraHostnameFor } from './agora.js';
+import { bouleHostnameFor } from './boule.js';
+import { appHostname, cmsStudioHostnameFor, entryHostnames } from './hostnames.js';
 /**
  * #339: the desktop app signs in through the company's web app, so every
  * `@wtfalch/auth` web client foundry makes registers this path beside
@@ -12,19 +15,48 @@ export function unionRedirectUris(current, wanted) {
     return [...new Set([...current, ...wanted])];
 }
 /**
- * The ZITADEL app id of company app `appKey` once its desktop callback was
- * registered. `planDesktopCallbacks` names an app while its recorded id
- * differs, so an app made before the callback existed, or made again under a
- * new id, is repaired once.
+ * The redirect URIs a company web app signs in with: `/auth/callback` and the
+ * desktop callback on each of its hosts. Agora's own client holds only its
+ * `/callback`. `zitadelApp` creates the app with this list, and
+ * `zitadelDesktopCallback` adds what an existing app lacks.
+ */
+export function signInRedirectUris(org, appKey) {
+    if (appKey === 'agora')
+        return [`https://${agoraHostnameFor(org)}/callback`];
+    const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
+    const hosts = authEntry
+        ? entryHostnames(org, authEntry)
+        : [
+            appKey === 'cms' && org.site.enabled
+                ? cmsStudioHostnameFor(org)
+                : appKey === 'boule'
+                    ? bouleHostnameFor(org)
+                    : appHostname(org),
+        ];
+    return [
+        ...hosts.map((host) => `https://${host}/auth/callback`),
+        ...hosts.map(desktopCallbackUri),
+    ];
+}
+/**
+ * The marker value for an app: its ZITADEL id and the URIs it must hold, in a
+ * fixed order. A changed hostname or a re-created app gives a different
+ * value, so the next plan names the app again.
+ */
+export function signInCallbackAppliedValue(appId, uris) {
+    return `${appId} ${[...uris].sort().join(' ')}`;
+}
+/**
+ * Marker of company app `appKey`: `signInCallbackAppliedValue` once its
+ * sign-in callbacks were registered. A marker holding only the app id (the
+ * desktop-only form of #339) differs, so such an app is repaired once.
  */
 export function zitadelAppDesktopCallbackAppliedScopeKey(appKey) {
     return `zitadel_app_desktop_callback_applied.${appKey}`;
 }
-/** The fixed Agora client keeps its own `/callback`; it is not built on `@wtfalch/auth`. */
-const NO_DESKTOP_CALLBACK_APPS = new Set(['agora']);
 /**
  * One `zitadel:desktop-callback` step names every live web sign-in app whose
- * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * marker differs from the one its recorded id and wanted URIs give. Plans nothing when the host's ZITADEL
  * client lacks the two redirect URI calls (`wired`), before the org and
  * project are recorded, or while the platform's sign-in is not ready.
  */
@@ -32,10 +64,7 @@ export function planDesktopCallbacks(org, live, recordedIds, plannedSteps, authR
     if (!wired || !authReady || !recordedIds.zitadel_org || !recordedIds.zitadel_project)
         return null;
     const apps = live
-        .filter((r) => r.system === 'zitadel' &&
-        r.kind === 'app' &&
-        r.config.appType === 'web' &&
-        !NO_DESKTOP_CALLBACK_APPS.has(r.key))
+        .filter((r) => r.system === 'zitadel' && r.kind === 'app' && r.config.appType === 'web')
         .map((r) => r.key)
         // An app this plan recreates gets its marker when it is made.
         .filter((appKey) => !plannedSteps.some((s) => s.action.system === 'zitadel' &&
@@ -44,14 +73,16 @@ export function planDesktopCallbacks(org, live, recordedIds, plannedSteps, authR
         s.action.desired.recreate === true))
         .filter((appKey) => {
         const appId = recordedIds[`zitadel:app:${appKey}`];
-        return (Boolean(appId) && recordedIds[zitadelAppDesktopCallbackAppliedScopeKey(appKey)] !== appId);
+        return (Boolean(appId) &&
+            recordedIds[zitadelAppDesktopCallbackAppliedScopeKey(appKey)] !==
+                signInCallbackAppliedValue(appId, signInRedirectUris(org, appKey)));
     });
     if (apps.length === 0)
         return null;
     return {
         action: { system: 'zitadel', kind: 'desktop-callback', key: org.id, desired: { apps } },
         step: {
-            description: `register the desktop sign-in callback for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
+            description: `register the sign-in callbacks for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
             destroys: false,
             migrates: false,
         },

package/dist/plan/executor.d.ts

@@ -2212,20 +2212,16 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private zitadelPostLogoutUris;
     /**
-     * #339: registers `/auth/desktop/callback` on each live web sign-in app the
-     * planner named, keeping every redirect URI the app already holds (the
-     * union of the current list and the wanted one; a write only when the
-     * union is larger). An app's marker (its ZITADEL app id) is recorded and
+     * #339: registers the sign-in callbacks (`signInRedirectUris`: `/auth/callback`
+     * and `/auth/desktop/callback` per host, Agora's `/callback`) on each live web
+     * sign-in app the planner named, keeping every redirect URI the app already
+     * holds (the union of the current list and the wanted ones; a write only when
+     * the union is larger). An app's marker (its app id and wanted URIs) is recorded and
      * persisted only after its read and write resolved, so a failure leaves no
      * marker and the next plan names the app again. The error names ids only,
      * never the cause.
      */
     private zitadelDesktopCallback;
-    /**
-     * The hostnames a company web app signs in at: the same rule `zitadelApp`
-     * uses for the redirect URIs it creates the app with.
-     */
-    private signInHostnames;
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted

package/dist/plan/executor.js

@@ -22,7 +22,7 @@ import { previewsOn } from './coolify-previews.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_DOCKERFILE, DESKTOP_AUTH_HOME, DESKTOP_AUTH_ORIGIN_SCOPE_KEY, DESKTOP_AUTH_READY_PATH, DESKTOP_AUTH_READY_SCOPE_KEY, DESKTOP_AUTH_REDIRECT_SCOPE_KEY, DESKTOP_AUTH_REVISION_SCOPE_KEY, desktopAuthCallbackUri, desktopAuthEnv, desktopAuthInputs, desktopAuthRedirectUnsupported, desktopAuthRevision, } from './desktop-auth.js';
-import { desktopCallbackUri, unionRedirectUris, zitadelAppDesktopCallbackAppliedScopeKey, } from './desktop-callback.js';
+import { signInCallbackAppliedValue, signInRedirectUris, unionRedirectUris, zitadelAppDesktopCallbackAppliedScopeKey, } from './desktop-callback.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
 import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
@@ -1967,10 +1967,11 @@ export class FoundryStepExecutor {
         return {};
     }
     /**
-     * #339: registers `/auth/desktop/callback` on each live web sign-in app the
-     * planner named, keeping every redirect URI the app already holds (the
-     * union of the current list and the wanted one; a write only when the
-     * union is larger). An app's marker (its ZITADEL app id) is recorded and
+     * #339: registers the sign-in callbacks (`signInRedirectUris`: `/auth/callback`
+     * and `/auth/desktop/callback` per host, Agora's `/callback`) on each live web
+     * sign-in app the planner named, keeping every redirect URI the app already
+     * holds (the union of the current list and the wanted ones; a write only when
+     * the union is larger). An app's marker (its app id and wanted URIs) is recorded and
      * persisted only after its read and write resolved, so a failure leaves no
      * marker and the next plan names the app again. The error names ids only,
      * never the cause.
@@ -1991,7 +1992,7 @@ export class FoundryStepExecutor {
             const appId = recorded[`zitadel:app:${appKey}`];
             if (!appId)
                 continue;
-            const wanted = this.signInHostnames(org, appKey).map(desktopCallbackUri);
+            const wanted = signInRedirectUris(org, appKey);
             try {
                 const current = await read(zitadelOrgId, projectId, appId);
                 const union = unionRedirectUris(current, wanted);
@@ -1999,27 +2000,13 @@ export class FoundryStepExecutor {
                     await write(zitadelOrgId, projectId, appId, union);
             }
             catch {
-                throw new Error(`zitadel:desktop-callback for ${org.slug}: registering the desktop callback failed for app '${appKey}' (${appId})`);
+                throw new Error(`zitadel:desktop-callback for ${org.slug}: registering the sign-in callbacks failed for app '${appKey}' (${appId})`);
             }
-            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(appKey), appId);
+            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(appKey), signInCallbackAppliedValue(appId, wanted));
             await context.persistScopeIds();
         }
         return {};
     }
-    /**
-     * The hostnames a company web app signs in at: the same rule `zitadelApp`
-     * uses for the redirect URIs it creates the app with.
-     */
-    signInHostnames(org, appKey) {
-        const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
-        if (appKey === 'cms' && org.site.enabled)
-            return [cmsHostnameFor(org)];
-        if (appKey === 'boule')
-            return [bouleHostnameFor(org)];
-        if (authEntry)
-            return entryHostnames(org, authEntry);
-        return [appHostname(org)];
-    }
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted
@@ -2701,55 +2688,24 @@ export class FoundryStepExecutor {
             await this.ports.deliverSecret(`zitadel:app:${org.slug}:${action.key}`, created.clientSecret);
             return { resourceId: created.appId };
         }
-        // #139: the fixed `cms` client (`diff.ts`'s `planCmsClient`) signs
-        // people into the cms studio at `cmsHostnameFor(org)` -- `cms.<domain>`,
-        // or `<slug>-cms.oikos.host` for a company without a domain -- not the
-        // org's own app hostname. #164: the fixed `agora` client (`diff.ts`'s
-        // `planAgoraClient`) is the same shape, always -- there is no
-        // `org.site.enabled`-style guard to check, since Agora is always on.
         // The Agora client stays `appType: 'web'`: providers' `createOidcApp`
         // makes every non-native app a public client (authorization code + PKCE,
         // `OIDC_AUTH_METHOD_TYPE_NONE`, no secret), which is what Agora's browser
         // SPA needs. Providers cannot create ZITADEL's `USER_AGENT` app kind.
-        // #161: the fixed `boule` client signs people into the org's Boule at its
-        // own hostname, on the standard `/auth/callback` path (Boule is built on
-        // `@wtfalch/auth` like every other web app here).
-        const hostname = isCmsClient
-            ? cmsHostnameFor(org)
-            : isAgoraClient
-                ? agoraHostnameFor(org)
-                : isBouleClient
-                    ? bouleHostnameFor(org)
-                    : appHostname(org);
         // Native apps sign in via device code, with no redirect of their own
         // (auth/scripts/provision.mjs:475-497, prior art cited in the decisions
         // file) -- empty arrays rather than a web app's callback/logout URLs.
-        // #164: Agora's own callback path is `/callback`, not `/auth/callback`
-        // (agora/apps/agora/README.md, "Deploying an Agora": "The issuer's OAuth
-        // client needs `https://<agora address>/callback` as a redirect URI") --
-        // Agora is not built on `@wtfalch/auth`'s `NextAuth` mount the way every
-        // other web app this file provisions is.
-        const redirectUri = isAgoraClient
-            ? `https://${hostname}/callback`
-            : `https://${hostname}/auth/callback`;
-        // An entry with `uses.auth` signs in at its own exact hostnames, one pair
-        // of addresses each; a `*` adds none (`entryHostnames`).
-        const hosts = authEntry ? entryHostnames(org, authEntry) : null;
+        // `signInRedirectUris` holds each web app's hosts and callback paths (the
+        // cms, Agora, Boule and entry hostnames; Agora's `/callback`).
         const postLogoutUris = appType === 'native' ? [] : companyAppPostLogoutUris(org, action.key);
-        // #339: every `@wtfalch/auth` web client also takes the desktop callback (Agora's own client does not).
-        const desktopCallbacks = appType === 'web' && !isAgoraClient ? (hosts ?? [hostname]).map(desktopCallbackUri) : [];
+        // The same rule the repair step uses (`signInRedirectUris`).
+        const signInUris = appType === 'web' ? signInRedirectUris(org, action.key) : [];
         const created = await this.ports.zitadel.createOidcApp(zitadelOrgId, projectId, {
             name: action.key,
             appType,
             redirectUris: appType === 'native'
                 ? []
-                : hosts
-                    ? [
-                        ...hosts.map((host) => `https://${host}/auth/callback`),
-                        ...desktopCallbacks,
-                        ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : []),
-                    ]
-                    : [redirectUri, ...desktopCallbacks],
+                : [...signInUris, ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : [])],
             postLogoutRedirectUris: postLogoutUris,
             ...(authEntry?.uses?.auth?.mcp ? { accessTokenType: 'jwt' } : {}),
         });
@@ -2769,8 +2725,8 @@ export class FoundryStepExecutor {
         if (appType === 'web') {
             context.recordScopeId(zitadelAppPostLogoutAppliedScopeKey(action.key), postLogoutAppliedValue(created.appId, postLogoutUris));
         }
-        if (desktopCallbacks.length > 0) {
-            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(action.key), created.appId);
+        if (appType === 'web') {
+            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(action.key), signInCallbackAppliedValue(created.appId, signInUris));
         }
         return { resourceId: created.appId };
     }

package/dist/plan/worker-app.d.ts

@@ -107,6 +107,11 @@ export interface WorkerAppUpload {
     migrations?: WorkerAppMigrations;
     /** Durable Object classes the upload marks container-enabled; absent when the entry declares no container. */
     containers?: string[];
+    /** Workers Logs: always on, every request sampled. The adapter sends it as the upload metadata's `observability`. */
+    observability: {
+        enabled: true;
+        head_sampling_rate: 1;
+    };
 }
 export interface WorkerAppContainer {
     className: string;

package/dist/plan/worker-app.js

@@ -526,6 +526,7 @@ export async function applyWorkerApp(deps, org, action, context) {
                 ? [{ type: 'hyperdrive', name: WORKER_APP_HYPERDRIVE_BINDING, id: hyperdriveId }]
                 : []),
         ],
+        observability: { enabled: true, head_sampling_rate: 1 },
         ...(migrations ? { migrations } : {}),
         ...(want.containers.length > 0
             ? { containers: want.containers.map((c) => c.className) }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",