@wtfalch/foundry 0.62.0 → 0.64.0

package/dist/apps/index.d.ts

@@ -7,3 +7,4 @@ export { type ApplyWorkerAppMigrationsDeps, type ApplyWorkerAppMigrationsInput,
 export { type ReleaseAsset, ReleaseAssetError, fetchReleaseAsset, parseAppRepo, releaseAssetOf, } from './github.js';
 export { type WorkerAppMigrationRunner, migrationsUrl } from '../worker-app-migrations.js';
 export { APPS_CLOUDFLARE_TOKEN_PERMISSIONS, type AppsCloudflare, type HyperdriveConnection, } from './cloudflare.js';
+export { type ServerEntryContext, ServerEntryError, processUrlEnvName, serverEntriesOf, } from './server-entry.js';

package/dist/apps/index.js

@@ -7,3 +7,4 @@ export { RELEASE_MIGRATION_SOURCE, applyWorkerAppMigrations, migrationChecksum,
 export { ReleaseAssetError, fetchReleaseAsset, parseAppRepo, releaseAssetOf, } from './github.js';
 export { migrationsUrl } from '../worker-app-migrations.js';
 export { APPS_CLOUDFLARE_TOKEN_PERMISSIONS, } from './cloudflare.js';
+export { ServerEntryError, processUrlEnvName, serverEntriesOf, } from './server-entry.js';

package/dist/apps/server-entry.d.ts

@@ -0,0 +1,43 @@
+import { type ServerBuildJson } from '../build-json.js';
+import { type AppManifest, type AppModules } from '../modules/index.js';
+import { type EnvValue, type HostingEntry } from '../org.js';
+/** Thrown by {@link serverEntriesOf}. The message is plain words for the company and never carries a secret. */
+export declare class ServerEntryError extends Error {
+    constructor(message: string);
+}
+/** What {@link serverEntriesOf} needs to know about the company and where the app runs. */
+export interface ServerEntryContext {
+    /** The company's slug: an entry reaches another on the company network as `<slug>-<entry key>` (`<slug>` for `app`). */
+    slug: string;
+    /** The platform registry host (`registry.<platform domain>`), with a port when it has one. */
+    registryHost: string;
+    /** The app's repository, `<github owner>/<repo>`. The images must sit at `<registryHost>/<owner>/<repo>[-<process>]`, lowercased. */
+    repo: string;
+    /** The entry key of the app. Default `app`. A process entry is keyed `<appKey>-<process key>`. */
+    appKey?: string;
+    /** The names the app entry is served at (see `HostingEntry.hostnames`). Processes are internal. */
+    hostnames: string[];
+    /** The port the app listens on. */
+    port: number;
+    healthPath?: string | null;
+    /** The app copy's own public origin (`https://host`), which each process gets as `APP_URL` to call the app back. */
+    appUrl: string;
+    /** The manifest `values` as env, resolved by the caller. Every entry gets the same map. */
+    env?: Record<string, EnvValue>;
+    /** The modules with the company's answers applied (`checkManifestAnswers`). Default: the manifest's own. */
+    modules?: AppModules;
+}
+/** `PROCESS_<KEY>_URL`: the key uppercased, `-` as `_`. */
+export declare const processUrlEnvName: (key: string) => string;
+/**
+ * The hosting entries of one server app: the `app` entry and one internal entry per declared process, each
+ * running its image from `build`. Throws {@link ServerEntryError} in plain words when the build does not match
+ * the manifest, when an image is not at the app's own registry path (a company never points at another's
+ * image), or when a module refuses the entry.
+ *
+ * - The app entry is served at `ctx.hostnames`, gets the modules, `ctx.env`, and `PROCESS_<KEY>_URL` for each
+ *   process that has a port (`http://<slug>-<entry key>:<port>`).
+ * - A process entry has no hostnames. It gets the same modules and `ctx.env`, and `APP_URL`. Its `database`
+ *   stays false: foundry allows one database entry per company, so a process cannot hold a second one.
+ */
+export declare function serverEntriesOf(manifest: AppManifest, build: ServerBuildJson, ctx: ServerEntryContext): HostingEntry[];

package/dist/apps/server-entry.js

@@ -0,0 +1,99 @@
+import { checkServerBuild } from '../build-json.js';
+import { applyModules } from '../modules/index.js';
+import { APP_ENTRY_KEY, ENTRY_IMAGE_REPOSITORY } from '../org.js';
+/** Thrown by {@link serverEntriesOf}. The message is plain words for the company and never carries a secret. */
+export class ServerEntryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ServerEntryError';
+    }
+}
+const HOST = /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]{1,5})?$/;
+const SLUG = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+const OWNER_REPO = /^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\/[A-Za-z0-9._-]+$/;
+const ENTRY_KEY_MAX = 63;
+/** `PROCESS_<KEY>_URL`: the key uppercased, `-` as `_`. */
+export const processUrlEnvName = (key) => `PROCESS_${key.toUpperCase().replace(/-/g, '_')}_URL`;
+const refuse = (message) => {
+    throw new ServerEntryError(message);
+};
+/**
+ * The hosting entries of one server app: the `app` entry and one internal entry per declared process, each
+ * running its image from `build`. Throws {@link ServerEntryError} in plain words when the build does not match
+ * the manifest, when an image is not at the app's own registry path (a company never points at another's
+ * image), or when a module refuses the entry.
+ *
+ * - The app entry is served at `ctx.hostnames`, gets the modules, `ctx.env`, and `PROCESS_<KEY>_URL` for each
+ *   process that has a port (`http://<slug>-<entry key>:<port>`).
+ * - A process entry has no hostnames. It gets the same modules and `ctx.env`, and `APP_URL`. Its `database`
+ *   stays false: foundry allows one database entry per company, so a process cannot hold a second one.
+ */
+export function serverEntriesOf(manifest, build, ctx) {
+    if (manifest.runtime !== 'server')
+        refuse('This app does not run on a server.');
+    const processes = manifest.processes ?? [];
+    const problem = checkServerBuild(build, processes);
+    if (problem)
+        refuse(`The build does not match the app: ${problem}`);
+    const appKey = ctx.appKey ?? APP_ENTRY_KEY;
+    if (!SLUG.test(ctx.slug) || !HOST.test(ctx.registryHost) || !OWNER_REPO.test(ctx.repo)) {
+        refuse('The company name, registry or repository for this app is not written the way it must be.');
+    }
+    if (!/^https:\/\/[^/\s]+$/.test(ctx.appUrl)) {
+        refuse('The app address must be an https address with no path.');
+    }
+    const [owner = '', name = ''] = ctx.repo.split('/');
+    const base = `${ctx.registryHost}/${owner.toLowerCase()}/${name.toLowerCase()}`;
+    const imageFor = (processKey, suffix) => {
+        const image = build.images.find((i) => i.process === processKey);
+        if (!image)
+            return refuse(`The build has no image for "${processKey}".`);
+        // Exactly the app's own path: another owner's, another repo's or another host's image is never run.
+        if (image.repository !== `${base}${suffix}` || !ENTRY_IMAGE_REPOSITORY.test(image.repository)) {
+            return refuse(`The image for "${processKey}" is not at this app's own place in the registry, so it is not used.`);
+        }
+        return { repository: image.repository, digest: image.digest };
+    };
+    const internalName = (entryKey) => entryKey === APP_ENTRY_KEY ? ctx.slug : `${ctx.slug}-${entryKey}`;
+    const modules = ctx.modules ?? manifest.modules;
+    const make = (key, image, port, hostnames, env, healthPath) => {
+        if (key.length > ENTRY_KEY_MAX)
+            refuse(`The name "${key}" is too long.`);
+        const base = {
+            key,
+            // The app's source, as metadata: the image is what runs, and `uses.repo` makes its deploy key from this.
+            repo: ctx.repo,
+            folder: null,
+            branch: 'main',
+            buildPack: 'nixpacks',
+            port,
+            healthPath,
+            hostnames,
+            database: false,
+            autoDeploy: false,
+            gates: [],
+            env: { ...(ctx.env ?? {}), ...env },
+            ...(image ? { image } : {}),
+        };
+        return base;
+    };
+    const processEntryKey = (processKey) => `${appKey}-${processKey}`;
+    const processEnv = {};
+    for (const p of processes) {
+        if (p.port !== undefined) {
+            processEnv[processUrlEnvName(p.key)] =
+                `http://${internalName(processEntryKey(p.key))}:${p.port}`;
+        }
+    }
+    const draft = [
+        make(appKey, imageFor('app', ''), ctx.port, ctx.hostnames, processEnv, ctx.healthPath ?? null),
+        ...processes.map((p) => make(processEntryKey(p.key), imageFor(p.key, `-${p.key}`), p.port ?? null, [], { APP_URL: ctx.appUrl }, null)),
+    ];
+    return draft.map((entry, index) => {
+        const applied = applyModules(entry, modules, { runtime: 'server' });
+        if (!applied.ok)
+            return refuse(applied.message);
+        // One database entry per company: a process reaches the app's, never a second one.
+        return index === 0 ? applied.entry : { ...applied.entry, database: false };
+    });
+}

package/dist/bootstrap/declare.js

@@ -53,6 +53,7 @@ const SERVICES_ENABLED_BY_DEFAULT = new Set([
     'archon',
     'edge',
     'hc',
+    'registry',
 ]);
 /**
  * The services every company deploys its own copy of. Their platform entries
@@ -153,7 +154,9 @@ export function declaredPlatformFor(apex, serverIpv4) {
                     ? DEFAULT_MAIL_IMAGE_TAG
                     : key === 'hc'
                         ? DEFAULT_HC_IMAGE_TAG
-                        : DEFAULT_GIT_REF,
+                        : key === 'registry'
+                            ? VERSIONS.registry
+                            : DEFAULT_GIT_REF,
         };
     }
     return {

package/dist/bootstrap/versions.d.ts

@@ -12,6 +12,8 @@ export interface PinnedVersions {
     cloudflared: string;
     stalwart: string;
     hc: string;
+    /** The platform's image registry (`registry:3`, Docker's `distribution`). */
+    registry: string;
     /** The mail relay's base image (an exact Alpine release); Postfix comes from its package repository. */
     alpine: string;
     /** A static busybox, copied into the MAS image so its health check has an HTTP client. */

package/dist/build-json.d.ts

@@ -26,3 +26,28 @@ export declare class BuildJsonError extends Error {
 export declare const buildJsonSchema: z.ZodType<BuildJson>;
 /** Parses a build.json. Throws {@link BuildJsonError} for the first problem. */
 export declare function parseBuildJson(input: unknown): BuildJson;
+/** One image of a server app's build: `process` is `app` or the key of a declared helper process. */
+export interface ServerBuildImage {
+    process: string;
+    repository: string;
+    digest: `sha256:${string}`;
+}
+/** The `build.json` of a server app: the images its GitHub built, chosen by `runtime: 'server'`. */
+export interface ServerBuildJson {
+    runtime: 'server';
+    repo: string;
+    commit: string;
+    images: ServerBuildImage[];
+}
+export declare const serverBuildJsonSchema: z.ZodType<ServerBuildJson>;
+/** Parses a server build.json. Throws {@link BuildJsonError} for the first problem; never carries a value. */
+export declare function parseServerBuildJson(input: unknown): ServerBuildJson;
+/** Parses either shape: `runtime: 'server'` picks the server one, anything else the Worker one. */
+export declare function parseAnyBuildJson(input: unknown): BuildJson | ServerBuildJson;
+/**
+ * Null when the build holds exactly one `app` image and one image per declared process, no more.
+ * Else a plain message naming the process key, never an image value.
+ */
+export declare function checkServerBuild(build: ServerBuildJson, processes: readonly {
+    key: string;
+}[]): string | null;

package/dist/build-json.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { ENTRY_IMAGE_REPOSITORY } from './org.js';
 import { WORKER_APP_COMPATIBILITY_FLAGS, WORKER_APP_INSTANCE_TYPES, WORKER_APP_MAX_INSTANCES, } from './worker-app-config.js';
 /** Thrown by {@link parseBuildJson}. `path` is dotted into the build.json; the message never carries a value. */
 export class BuildJsonError extends Error {
@@ -93,3 +94,63 @@ export function parseBuildJson(input) {
         throw new BuildJsonError('missing_field', path);
     throw new BuildJsonError('wrong_type', path);
 }
+const IMAGE_REPOSITORY = ENTRY_IMAGE_REPOSITORY;
+export const serverBuildJsonSchema = z.strictObject({
+    runtime: z.literal('server'),
+    repo: text,
+    commit: text,
+    images: z.array(z.strictObject({
+        process: z.string().regex(/^[a-z][a-z0-9-]{0,30}$/, { message: 'wrong_type' }),
+        repository: z.string().regex(IMAGE_REPOSITORY, { message: 'wrong_type' }),
+        digest: z.string().regex(DIGEST, { message: 'wrong_type' }),
+    })),
+});
+function refuseBuildJson(input, error) {
+    const issue = error.issues[0];
+    if (!issue)
+        throw new BuildJsonError('wrong_type', '');
+    if (issue.code === 'unrecognized_keys') {
+        const base = dotted(issue.path);
+        const key = issue.keys[0] ?? '';
+        throw new BuildJsonError('unknown_field', base ? `${base}.${key}` : key);
+    }
+    const path = dotted(issue.path);
+    if (valueAt(input, issue.path) === undefined)
+        throw new BuildJsonError('missing_field', path);
+    throw new BuildJsonError('wrong_type', path);
+}
+/** Parses a server build.json. Throws {@link BuildJsonError} for the first problem; never carries a value. */
+export function parseServerBuildJson(input) {
+    const result = serverBuildJsonSchema.safeParse(input);
+    if (result.success)
+        return result.data;
+    return refuseBuildJson(input, result.error);
+}
+/** Parses either shape: `runtime: 'server'` picks the server one, anything else the Worker one. */
+export function parseAnyBuildJson(input) {
+    const runtime = input !== null && typeof input === 'object'
+        ? input.runtime
+        : undefined;
+    return runtime === 'server' ? parseServerBuildJson(input) : parseBuildJson(input);
+}
+/**
+ * Null when the build holds exactly one `app` image and one image per declared process, no more.
+ * Else a plain message naming the process key, never an image value.
+ */
+export function checkServerBuild(build, processes) {
+    const wanted = new Set(['app', ...processes.map((p) => p.key)]);
+    const seen = new Set();
+    for (const image of build.images) {
+        if (!wanted.has(image.process)) {
+            return `the build has an image for "${image.process}", which the app does not declare.`;
+        }
+        if (seen.has(image.process))
+            return `the build has two images for "${image.process}".`;
+        seen.add(image.process);
+    }
+    for (const key of wanted) {
+        if (!seen.has(key))
+            return `the build has no image for "${key}".`;
+    }
+    return null;
+}

package/dist/catalogue/copy-en.js

@@ -82,6 +82,16 @@ const INTEGRATION_COPY = {
         summary: 'Companies sign their own people in to the app.',
         ours: 'Run by us',
     },
+    'customer-grants': {
+        name: 'Permissions for customers',
+        summary: 'Your team gives each customer the permissions they need in the app, and we keep them in step.',
+        ours: 'Run by us',
+    },
+    repository: {
+        name: 'Repository',
+        summary: 'The app reads or updates the files in its repository, such as the pages it keeps there.',
+        ours: 'Run by us',
+    },
 };
 const SHARED_OUTPUTS = {
     app: { url: "The app's web address.", host: "The app's host name.", name: "The app's name." },

package/dist/catalogue/integrations.js

@@ -81,6 +81,16 @@ const EXTRA = {
         price: { class: 'free', meters: [] },
         advanced: [],
     },
+    'customer-grants': {
+        providers: [ours('customer-grants')],
+        price: { class: 'free', meters: [] },
+        advanced: [],
+    },
+    repository: {
+        providers: [ours('repository')],
+        price: { class: 'free', meters: [] },
+        advanced: [],
+    },
 };
 /** Every integration, one per app module, in the order modules are applied. */
 export function integrations() {

package/dist/index.d.ts

@@ -8,15 +8,15 @@ import { type PinnedVersions } from './bootstrap/versions.js';
 export type { PinnedVersions };
 export declare const PINNED_VERSIONS: Readonly<PinnedVersions>;
 export type { RequestableField, CallsChange, CustomersChange, StorageLimitChange, AiLimitChange, DomainChange, MailTierChange, RequestedChangeValue, ChangeClassification, RequestedChangeState, RequestedChange, AppChange, BuildChange, FailureCode, RequestedBy, } from './requested-changes.js';
-export type { BuildJson, BuildJsonErrorCode } from './build-json.js';
-export { buildJsonSchema, parseBuildJson, BuildJsonError } from './build-json.js';
+export type { BuildJson, BuildJsonErrorCode, ServerBuildImage, ServerBuildJson, } from './build-json.js';
+export { buildJsonSchema, parseBuildJson, BuildJsonError, serverBuildJsonSchema, parseServerBuildJson, parseAnyBuildJson, checkServerBuild, } from './build-json.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export type { Checkpoint, LastApplied, AppliedState, DestroyRecord, DestroyStepRecord, } from './state.js';
 export type { PlanStep, UnmanagedItem, PlanNote, Plan, VersionChangeItem } from './plan.js';
-export type { NativeBuildDispatchDeps, NativeBuildKeyEnvPort, } from './native-build.js';
-export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_REF, NATIVE_BUILD_DISPATCH_TIMEOUT_MS, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, NativeBuildDispatchError, dispatchNativeBuild, mintNativeBuildKey, } from './native-build.js';
+export type { NativeBuildDispatchDeps } from './native-build.js';
+export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_REF, NATIVE_BUILD_DISPATCH_TIMEOUT_MS, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, NativeBuildDispatchError, dispatchNativeBuild, } from './native-build.js';
 export type { AppliedVersion, AppliedVersionsStore, DeclaredOrgStore, HeldLease, MutationLease, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
 export { StaleLeaseError } from './store.js';
 export type { PlanApply, DestroyProgress } from './apply.js';
@@ -40,6 +40,8 @@ export { STAGE_COPY_EXCLUDED_TABLES, StageCopyFailedError, StageCopyRefusedError
 export type { StageCopyInput, StageCopyPort, StageCopyProduction, StageCopyRunRecord, UndoStageCopyInput, } from './plan/index.js';
 export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execRunner, } from './plan/index.js';
 export type { Runner, StageCopyPortDeps } from './plan/index.js';
+export type { PlatformRegistryDeps, PlatformRegistryRuntime } from './plan/index.js';
+export { PLATFORM_REGISTRY_PULL_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_USER, platformRegistryPushCredential, } from './plan/index.js';
 export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationBackupMissingError, OrgPostgresMigrationNotConfirmedError, } from './plan/index.js';
 export type { OrgPostgresMigrationConfirmation } from './plan/index.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
@@ -59,6 +61,8 @@ export type { PlanOwnSfuOptions, SfuAppDeps, SfuAppInput } from './plan/index.js
 export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuCompose, } from './plan/index.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, KeysRegistrarPort, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
+export type { StageProbePort, ReleasePreviewMembers } from './plan/stage-guards.js';
+export type { StageCopyHostConfig } from './plan/stage-copy-host.js';
 export { NO_DOMAIN_ZONE, entryMachinePaths, ownHostnames, privatePageGateKey, workspaceHost, } from './plan/index.js';
 export type { PrivatePageScope } from './plan/index.js';
 export type { HostedLabelRefusal } from './hosted-label.js';

package/dist/index.js

@@ -7,10 +7,10 @@ export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, v
 // object, not a copy.
 import { VERSIONS } from './bootstrap/versions.js';
 export const PINNED_VERSIONS = VERSIONS;
-export { buildJsonSchema, parseBuildJson, BuildJsonError } from './build-json.js';
+export { buildJsonSchema, parseBuildJson, BuildJsonError, serverBuildJsonSchema, parseServerBuildJson, parseAnyBuildJson, checkServerBuild, } from './build-json.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
-export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_REF, NATIVE_BUILD_DISPATCH_TIMEOUT_MS, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, NativeBuildDispatchError, dispatchNativeBuild, mintNativeBuildKey, } from './native-build.js';
+export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_REF, NATIVE_BUILD_DISPATCH_TIMEOUT_MS, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, NativeBuildDispatchError, dispatchNativeBuild, } from './native-build.js';
 export { StaleLeaseError } from './store.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
@@ -24,6 +24,7 @@ export { DumpError, dumpNow } from './plan/index.js';
 export { STAGE_SINK_APPLIED_SCOPE_KEY, STAGE_SINK_IMAGE_REF, stageMailEnv, stageSinkAppName, } from './plan/index.js';
 export { STAGE_COPY_EXCLUDED_TABLES, StageCopyFailedError, StageCopyRefusedError, stageCopy, tableExcluded, undoStageCopy, } from './plan/index.js';
 export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execRunner, } from './plan/index.js';
+export { PLATFORM_REGISTRY_PULL_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_USER, platformRegistryPushCredential, } from './plan/index.js';
 export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationBackupMissingError, OrgPostgresMigrationNotConfirmedError, } from './plan/index.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';

package/dist/migrations/0067_requested_changes_kosmos.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: a company's Boule can request `kosmos` (turn `org.kosmos.enabled` on or off).
+alter table foundry_requested_changes
+  drop constraint if exists foundry_requested_changes_field_check;
+alter table foundry_requested_changes
+  add constraint foundry_requested_changes_field_check
+    check (field in ('calls', 'customers', 'storageLimit', 'aiLimit', 'domain', 'mailTier', 'app', 'build', 'bouleApps', 'kosmos'));

package/dist/migrations/0068_platform_registry.sql

@@ -0,0 +1,17 @@
+-- @wtfalch/foundry: the platform's image registry (`registry:3`), declared with the rest of the
+-- platform. Mirrors `src/store/schema.ts`'s `foundryDeclaredPlatform` additions. Off for the
+-- platform that already exists: foundry deploys nothing new until it is declared on. Backfills
+-- `registry_hostname` the way `0047_platform_coolify.sql` backfilled `coolify_hostname`: the
+-- column must not be empty (`src/platform.ts`'s `validatePlatform`).
+
+alter table foundry_declared_platform
+  add column if not exists registry_enabled boolean not null default false,
+  add column if not exists registry_hostname text,
+  add column if not exists registry_git_ref text not null default '';
+
+update foundry_declared_platform
+  set registry_hostname = 'registry.' || apex
+  where registry_hostname is null;
+
+alter table foundry_declared_platform
+  alter column registry_hostname set not null;

package/dist/modules/customer-grants.d.ts

@@ -0,0 +1,3 @@
+import type { AppModule } from './types.js';
+/** `uses.customerGrants`: the company's team gives customers permissions in the app. */
+export declare const customerGrants: AppModule;

package/dist/modules/customer-grants.js

@@ -0,0 +1,28 @@
+import { problem, setUse } from './entry-parts.js';
+/** `uses.customerGrants`: the company's team gives customers permissions in the app. */
+export const customerGrants = {
+    view: {
+        id: 'customer-grants',
+        name: 'Permissions for customers',
+        line: 'Your team gives each customer the permissions they need in the app, and we keep them in step.',
+        category: 'People',
+        icon: 'shield',
+        runtimes: ['server'],
+        requires: ['sign-in'],
+        availability: 'ready',
+        fields: [],
+        adds: [
+            {
+                name: 'Permissions your team manages',
+                hint: 'Your team gives and takes back customer permissions without changing the app.',
+            },
+        ],
+    },
+    toEntry: (entry, values) => setUse(entry, 'customerGrants', values === null ? undefined : true),
+    fromEntry: (entry) => (entry.uses?.customerGrants === true ? {} : null),
+    check(_values, modules) {
+        if (modules['sign-in']?.users === 'customers')
+            return null;
+        return problem(null, 'Permissions for customers are for an app whose customers sign in. Set Sign-in to "Your customers".');
+    },
+};

package/dist/modules/index.js

@@ -2,6 +2,7 @@ import { SECRET_LIKE_NAME, WORKER_APP_ENV_NAME, WORKER_APP_RESERVED_NAMES, } fro
 import { ai } from './ai.js';
 import { assistants } from './assistants.js';
 import { audit } from './audit.js';
+import { customerGrants } from './customer-grants.js';
 import { database } from './database.js';
 import { email } from './email.js';
 import { clone, isProblem } from './entry-parts.js';
@@ -9,6 +10,7 @@ import { files } from './files.js';
 import { jobs } from './jobs.js';
 import { organisations } from './organisations.js';
 import { SECRET_OUTPUTS, referenceProblem } from './outputs.js';
+import { repository } from './repository.js';
 import { signIn } from './sign-in.js';
 import { signedRecords } from './signed-records.js';
 import { workspaces } from './workspaces.js';
@@ -29,6 +31,8 @@ export const MODULES = [
     ai,
     organisations,
     audit,
+    customerGrants,
+    repository,
 ];
 const byId = new Map(MODULES.map((module) => [module.view.id, module]));
 /** The views of every module, JSON-safe, for Boule to render. */
@@ -340,7 +344,7 @@ function manifestV1AsV2(v1) {
     }
     return { v: 2, runtime: v1.runtime, modules: v1.modules, values };
 }
-const MANIFEST_V2_KEYS = ['v', 'runtime', 'modules', 'values', 'access'];
+const MANIFEST_V2_KEYS = ['v', 'runtime', 'modules', 'values', 'access', 'processes'];
 const VALUE_KEYS = {
     generate: ['source', 'kind'],
     reference: ['source', 'to', 'secret'],
@@ -368,11 +372,21 @@ const COPY_KEY = /^[a-z][A-Za-z0-9_-]*(\.[A-Za-z0-9_-]+)+$/;
 const REFERENCE = /^[a-z][a-z0-9-]*\.[A-Za-z][A-Za-z0-9-]*$/;
 const HOST = /^(\*\.)?([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
 const HOST_MAX = 20;
+const PROCESS_MAX = 4;
+const PROCESS_KEY = /^[a-z][a-z0-9-]{0,30}$/;
 const WHY_MAX = 200;
 const CHOICES_MAX = 50;
 const ASKABLE_KINDS = ['text', 'longtext', 'path', 'choice', 'list'];
 const isText = (value, max) => typeof value === 'string' && value.trim() !== '' && value.length <= max;
 /** A plain sentence when `copy` is not a good label, help or copy key, else null. */
+function isProcessFolder(folder) {
+    return (typeof folder === 'string' &&
+        folder.length > 0 &&
+        folder.length <= 200 &&
+        !folder.startsWith('/') &&
+        !folder.startsWith('\\') &&
+        !folder.split(/[\\/]/).includes('..'));
+}
 function copyProblem(name, raw, labelRequired) {
     const { label, help, labelKey, helpKey } = raw;
     if (labelRequired
@@ -670,9 +684,43 @@ function parseManifestV2(json) {
         }
         hosts.push({ host, why });
     }
+    const processes = [];
+    if (json.processes !== undefined) {
+        if (runtime !== 'server') {
+            return refuse('"processes" is only for an app that runs on a server, not a Worker app.');
+        }
+        const raw = json.processes;
+        if (!Array.isArray(raw) || raw.length > PROCESS_MAX) {
+            return refuse(`"processes" must list at most ${PROCESS_MAX} helper processes.`);
+        }
+        const keys = new Set();
+        for (const item of raw) {
+            if (!isRecord(item) ||
+                Object.keys(item).some((k) => k !== 'key' && k !== 'folder' && k !== 'port')) {
+                return refuse('every helper process needs a "key" and a "folder", and may have a "port".');
+            }
+            const { key, folder, port } = item;
+            if (typeof key !== 'string' || !PROCESS_KEY.test(key) || key === 'app') {
+                return refuse('every helper process "key" must be 1 to 31 lowercase letters, digits or dashes, start with a letter, and not be "app".');
+            }
+            if (keys.has(key))
+                return refuse(`"processes" lists the key "${key}" twice.`);
+            keys.add(key);
+            if (!isProcessFolder(folder)) {
+                return refuse(`the "folder" of helper process "${key}" must be a path inside the repository, without "..", and not start with "/" or "\\".`);
+            }
+            if (port !== undefined &&
+                !(Number.isInteger(port) && port >= 1 && port <= 65535)) {
+                return refuse(`the "port" of helper process "${key}" must be a whole number from 1 to 65535.`);
+            }
+            processes.push(port === undefined ? { key, folder } : { key, folder, port: port });
+        }
+    }
     const manifest = { v: 2, runtime, modules: clone(modules), values };
     if (json.access !== undefined)
         manifest.access = { hosts };
+    if (json.processes !== undefined)
+        manifest.processes = processes;
     return { ok: true, manifest };
 }
 /** `company-app.json` (v1 or v2) read and checked: what the app's code asks for. */

package/dist/modules/repository.d.ts

@@ -0,0 +1,6 @@
+import type { AppModule } from './types.js';
+/**
+ * `uses.repo`: the app gets a key for its own repository. The entry's `repo` names the repository (it comes
+ * from the install, not from this module); `access` says whether the app may only read or also push.
+ */
+export declare const repository: AppModule;

package/dist/modules/repository.js

@@ -0,0 +1,40 @@
+import { setUse } from './entry-parts.js';
+/**
+ * `uses.repo`: the app gets a key for its own repository. The entry's `repo` names the repository (it comes
+ * from the install, not from this module); `access` says whether the app may only read or also push.
+ */
+export const repository = {
+    view: {
+        id: 'repository',
+        name: 'Repository',
+        line: 'The app reads or updates the files in its repository, such as the pages it keeps there.',
+        category: 'Data',
+        icon: 'git-branch',
+        runtimes: ['server'],
+        requires: [],
+        availability: 'ready',
+        fields: [
+            {
+                key: 'access',
+                label: 'What the app may do',
+                kind: 'choice',
+                default: 'read',
+                choices: [
+                    { value: 'read', label: 'Read', help: 'The app reads the files.' },
+                    { value: 'write', label: 'Read and update', help: 'The app also saves changes.' },
+                ],
+            },
+        ],
+        adds: [
+            {
+                name: 'A key for the repository',
+                hint: 'Only this app holds it, and it opens only this repository.',
+            },
+        ],
+    },
+    toEntry: (entry, values) => setUse(entry, 'repo', values === null ? undefined : { access: values.access === 'write' ? 'write' : 'read' }),
+    fromEntry(entry) {
+        const used = entry.uses?.repo;
+        return used ? { access: used.access } : null;
+    },
+};

package/dist/modules/types.d.ts

@@ -181,6 +181,12 @@ export interface ManifestHost {
 export interface ManifestAccess {
     hosts: ManifestHost[];
 }
+/** A helper process of a server app: built from `<folder>/Dockerfile`, next to the app itself. */
+export interface ManifestProcess {
+    key: string;
+    folder: string;
+    port?: number;
+}
 /** `company-app.json` v2, and what every manifest (v1 too) is read as. */
 export interface AppManifest {
     v: 2;
@@ -189,6 +195,8 @@ export interface AppManifest {
     values: Record<string, ManifestValue>;
     /** Optional. Absent means the app may connect anywhere. */
     access?: ManifestAccess;
+    /** Optional, server apps only: at most 4 helper processes. */
+    processes?: ManifestProcess[];
 }
 /** An answer to an `ask`: text, or a list of texts for `multiple`. */
 export type ManifestAnswer = string | string[];