@wtfalch/foundry 0.76.0 → 0.77.0

package/dist/audit/host.js

@@ -0,0 +1,294 @@
+import { z } from 'zod';
+import { appsOn } from '../org.js';
+import { createAuditEvidence } from './evidence.js';
+import { auditLedgerPasswordRef, companyAuditLedgers, } from './host-store.js';
+import { appLedgerName, describeRetention, registeredAppLedgers, } from './registry.js';
+import { AUDIT_SIGNER_REF, signerFromSeed } from './signer.js';
+export const AUDIT_HOST_MAX_LEDGERS = 500;
+export const AUDIT_HOST_MAX_BUNDLE_BYTES = 10_000_000;
+const MAX_BODY_BYTES = 16_384;
+const APP = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const PG_NAME = /^[A-Za-z_][A-Za-z0-9_$-]{0,62}$/;
+const HOST = /^[A-Za-z0-9]([A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$|^\[[0-9A-Fa-f:.]+\]$/;
+const registrationSchema = z
+    .object({
+    copy: z.literal('live'),
+    database: z
+        .object({
+        host: z.string().regex(HOST),
+        port: z.number().int().min(1).max(65535),
+        database: z.string().regex(PG_NAME),
+        user: z.string().regex(PG_NAME),
+        password: z.string().min(16).max(1024),
+        sslmode: z
+            .enum(['disable', 'allow', 'prefer', 'require', 'verify-ca', 'verify-full'])
+            .optional(),
+    })
+        .strict(),
+})
+    .strict();
+const answer = (status, body) => new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
+});
+const refuse = (status, code, message) => answer(status, { error: { code, message } });
+const NO_LOG = 'There is no audit log for this app.';
+const BAD_KEY = 'This key does not open an audit log.';
+/** The fields of a registration that did not fit, by name only: a value is never echoed. */
+function badFields(error) {
+    const names = [...new Set(error.issues.map((issue) => issue.path.join('.') || 'body'))];
+    return `These fields are missing or not right: ${names.slice(0, 6).join(', ')}.`;
+}
+function bearer(request) {
+    const header = request.headers.get('authorization') ?? '';
+    const match = /^Bearer ([^\s]+)$/.exec(header.trim());
+    return match?.[1] ?? null;
+}
+function wholeFrom1(value) {
+    if (value === null)
+        return undefined;
+    if (!/^[1-9][0-9]{0,15}$/.test(value))
+        return null;
+    const n = Number(value);
+    return Number.isSafeInteger(n) ? n : null;
+}
+async function readBody(request) {
+    const length = Number(request.headers.get('content-length'));
+    if (Number.isFinite(length) && length > MAX_BODY_BYTES)
+        return 'too_big';
+    let text;
+    try {
+        text = await request.text();
+    }
+    catch {
+        return 'unreadable';
+    }
+    if (Buffer.byteLength(text) > MAX_BODY_BYTES)
+        return 'too_big';
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return 'unreadable';
+    }
+}
+/** The handler a host mounts: a web `Request` in, a `Response` out (a Next.js route handler, a Worker, `node:http` through an adapter). */
+export function createAuditHostHandler(options) {
+    const log = options.log ?? ((line) => console.info(line));
+    const now = options.now ?? (() => new Date());
+    const base = (options.basePath ?? '').replace(/\/+$/, '');
+    async function signerPublicKey() {
+        try {
+            const seed = await options.heldKeys.resolve(AUDIT_SIGNER_REF);
+            return seed ? signerFromSeed(seed).publicKey : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async function company(request) {
+        const key = bearer(request);
+        if (!key)
+            return refuse(401, 'unauthorized', BAD_KEY);
+        let orgId;
+        try {
+            orgId = await options.store.companyOfKey(key);
+        }
+        catch {
+            log('audit host: a key could not be checked');
+            return refuse(503, 'unavailable', 'The audit log service could not check the key. Try again in a minute.');
+        }
+        if (!orgId)
+            return refuse(401, 'unauthorized', BAD_KEY);
+        const org = await options.orgs.get(orgId).catch(() => null);
+        if (!org)
+            return refuse(403, 'forbidden', BAD_KEY);
+        return { org };
+    }
+    async function ledgersOf(org) {
+        const recorded = (await options.orgs.getAppliedState(org.id))?.serviceIds ?? {};
+        return companyAuditLedgers(org, recorded, options.policy, options.store);
+    }
+    async function register(org, app, request) {
+        const body = await readBody(request);
+        if (body === 'too_big')
+            return refuse(413, 'invalid_request', 'The request is too large.');
+        if (body === 'unreadable')
+            return refuse(400, 'invalid_request', 'The request is not JSON.');
+        const parsed = registrationSchema.safeParse(body);
+        if (!parsed.success)
+            return refuse(400, 'invalid_request', badFields(parsed.error));
+        const { database } = parsed.data;
+        options.secret?.(database.password);
+        if (!appsOn(org)) {
+            return refuse(403, 'forbidden', 'This company does not run apps in Boule, so it registers no log.');
+        }
+        const recorded = (await options.orgs.getAppliedState(org.id))?.serviceIds ?? {};
+        if (registeredAppLedgers(org, recorded, options.policy).some((l) => l.entryKey === app)) {
+            return refuse(409, 'conflict', "This app's log is already sealed by the company's own plan.");
+        }
+        const passwordRef = auditLedgerPasswordRef(org.id, app);
+        try {
+            // The password first: a row never names a ref with nothing held. A repeat PUT replaces both.
+            await options.heldKeys.put(passwordRef, database.password);
+        }
+        catch {
+            log(`audit host: the sealing password for ${org.slug}/${app} could not be held`);
+            return refuse(503, 'unavailable', 'The log could not be registered. Try again in a minute.');
+        }
+        let kept;
+        try {
+            kept = await options.store.putRegistration({
+                orgId: org.id,
+                entryKey: app,
+                copy: 'live',
+                database: {
+                    host: database.host,
+                    port: database.port,
+                    database: database.database,
+                    ...(database.sslmode ? { sslmode: database.sslmode } : {}),
+                },
+                user: database.user,
+                passwordRef,
+            });
+        }
+        catch {
+            log(`audit host: the registration of ${org.slug}/${app} could not be kept`);
+            return refuse(503, 'unavailable', 'The log could not be registered. Try again in a minute.');
+        }
+        log(`audit host: ${org.slug}/${app} registered for sealing (${kept})`);
+        return answer(kept === 'created' ? 201 : 200, { ledger: appLedgerName(org, app) });
+    }
+    async function read(org, app, tail, url) {
+        const ledger = (await ledgersOf(org)).find((l) => l.entryKey === app);
+        if (!ledger)
+            return refuse(404, 'not_found', NO_LOG);
+        const publicKey = await signerPublicKey();
+        if (!publicKey) {
+            log('audit host: the platform signer key is not held');
+            return refuse(503, 'unavailable', 'The log cannot be read yet. Try again later.');
+        }
+        const evidence = createAuditEvidence({
+            connector: options.connector,
+            signerPublicKey: publicKey,
+        });
+        const unavailable = (why) => refuse(503, 'unavailable', why);
+        switch (tail) {
+            case 'status': {
+                const status = await evidence.status(ledger);
+                if (!status.ok)
+                    return unavailable(status.why);
+                let seals = [];
+                try {
+                    seals = await options.store.seals(org.id, app, now());
+                }
+                catch {
+                    log(`audit host: the seals of ${org.slug}/${app} could not be read`);
+                }
+                return answer(200, { ...status.value, seals });
+            }
+            case 'checkpoints': {
+                const checkpoints = await evidence.checkpoints(ledger);
+                return checkpoints.ok
+                    ? answer(200, { checkpoints: checkpoints.value })
+                    : unavailable(checkpoints.why);
+            }
+            case 'anchors': {
+                const anchors = await evidence.anchors(ledger);
+                return anchors.ok ? answer(200, { anchors: anchors.value }) : unavailable(anchors.why);
+            }
+            case 'bundle': {
+                const from = wholeFrom1(url.searchParams.get('from'));
+                const to = wholeFrom1(url.searchParams.get('to'));
+                if (from === null || to === null || (from !== undefined && to !== undefined && from > to)) {
+                    return refuse(400, 'invalid_request', 'Pick whole numbers from 1 for the range, the first no larger than the last.');
+                }
+                const bundle = await evidence.bundle(ledger, {
+                    ...(from === undefined ? {} : { from }),
+                    ...(to === undefined ? {} : { to }),
+                });
+                if (!bundle.ok) {
+                    return bundle.refused
+                        ? refuse(400, 'invalid_request', bundle.why)
+                        : unavailable(bundle.why);
+                }
+                const bytes = Object.values(bundle.value.files).reduce((n, text) => n + Buffer.byteLength(text), 0);
+                if (bytes > AUDIT_HOST_MAX_BUNDLE_BYTES) {
+                    return refuse(400, 'invalid_request', 'This export is too large to give out in one piece. Pick a narrower range of entries and try again.');
+                }
+                return answer(200, { format: bundle.value.format, files: bundle.value.files });
+            }
+            default:
+                return refuse(404, 'not_found', NO_LOG);
+        }
+    }
+    return async (request) => {
+        let url;
+        try {
+            url = new URL(request.url);
+        }
+        catch {
+            return refuse(400, 'invalid_request', 'The address is not readable.');
+        }
+        const path = url.pathname;
+        if (base !== '' && !(path === base || path.startsWith(`${base}/`))) {
+            return refuse(404, 'not_found', 'There is nothing here.');
+        }
+        const rest = path
+            .slice(base.length)
+            .split('/')
+            .filter((part) => part !== '');
+        if (rest[0] !== 'v1' || rest[1] !== 'audit' || rest[2] !== 'ledgers' || rest.length > 5) {
+            return refuse(404, 'not_found', 'There is nothing here.');
+        }
+        const [, , , app, tail] = rest;
+        const method = request.method.toUpperCase();
+        const allowed = app === undefined || tail !== undefined ? ['GET'] : ['PUT'];
+        if (!allowed.includes(method)) {
+            return new Response(JSON.stringify({
+                error: { code: 'method_not_allowed', message: 'This address does not take that.' },
+            }), {
+                status: 405,
+                headers: {
+                    'content-type': 'application/json; charset=utf-8',
+                    'cache-control': 'no-store',
+                    allow: allowed.join(', '),
+                },
+            });
+        }
+        const who = await company(request);
+        if (who instanceof Response)
+            return who;
+        const { org } = who;
+        try {
+            if (app === undefined) {
+                const ledgers = (await ledgersOf(org)).slice(0, AUDIT_HOST_MAX_LEDGERS);
+                return answer(200, {
+                    ledgers: ledgers.map((l) => ({
+                        app: l.entryKey,
+                        ledger: l.ledger,
+                        retention: describeRetention(l.retention),
+                        retentionMonths: l.retention.months,
+                        legalHold: l.retention.legalHold,
+                    })),
+                });
+            }
+            let decoded;
+            try {
+                decoded = decodeURIComponent(app);
+            }
+            catch {
+                return refuse(404, 'not_found', NO_LOG);
+            }
+            if (!APP.test(decoded) || decoded !== app)
+                return refuse(404, 'not_found', NO_LOG);
+            if (tail === undefined)
+                return await register(org, decoded, request);
+            return await read(org, decoded, tail, url);
+        }
+        catch {
+            log(`audit host: a request for ${org.slug} failed`);
+            return refuse(503, 'unavailable', 'The audit log service could not answer. Try again in a minute.');
+        }
+    };
+}

package/dist/audit/index.d.ts

@@ -1,5 +1,7 @@
 export * from './connector.js';
 export * from './evidence.js';
+export * from './host.js';
+export * from './host-store.js';
 export * from './registry.js';
 export * from './seal.js';
 export * from './sealer-role.js';

package/dist/audit/index.js

@@ -1,5 +1,7 @@
 export * from './connector.js';
 export * from './evidence.js';
+export * from './host.js';
+export * from './host-store.js';
 export * from './registry.js';
 export * from './seal.js';
 export * from './sealer-role.js';

package/dist/audit/registry.d.ts

@@ -27,6 +27,20 @@ export interface AppLedger {
     retention: LedgerRetention;
     /** The database role the sealing service connects as (`audit/sealer-role.ts`), once the apply recorded it. */
     sealerRole?: string;
+    /**
+     * Only for a ledger a company's Boule registered at the audit host (`PUT /v1/audit/ledgers/:app`): where its
+     * database is. A ledger of foundry's own plan has none; the host knows that database itself.
+     */
+    database?: LedgerAddress;
+    /** The held-key ref of the sealing password, when it is not `auditSealerRef(orgId, entryKey)` (a registered ledger). */
+    passwordRef?: string;
+}
+/** Where a registered ledger's database is. No credential. */
+export interface LedgerAddress {
+    host: string;
+    port: number;
+    database: string;
+    sslmode?: string;
 }
 /** What the host knows about retention. The plan's period is the host's (billing) to say; foundry holds no default. */
 export interface AuditPolicy {

package/dist/audit/sealer-role.d.ts

@@ -29,5 +29,17 @@ export interface SealerRoleSql {
  * insert into the checkpoint, signing-key and anchor tables and run the sealing functions (leaves, key retirement, pending erasures, erasure sealing), and holds nothing
  * else. The grants are listed here and in `AUDIT_SEALER_GRANTS`; `audit/sealer-role.test.ts` runs a real
  * checkpoint as this role to prove the list is enough.
+ *
+ * It runs as an owner that is not a superuser (foundry#1110, found by boule#656). PostgreSQL 16 lets only a
+ * superuser name SUPERUSER or BYPASSRLS in `ALTER ROLE`, even to turn them off, so the role is made without any
+ * attribute (`CREATE ROLE` defaults to none of them), only LOGIN, INHERIT and the password are set, and the
+ * attributes are then read back: a role that is a superuser, bypasses row security, may create databases or
+ * roles, replicates, inherits or is a member of another role is refused before it gets a grant, naming the role
+ * and nothing else.
  */
 export declare function sealerRoleSql(user: string, password: string): SealerRoleSql;
+/**
+ * The read-back of {@link sealerRoleSql}: raises when the role can do more than seal. Its message names the
+ * role only, never the password.
+ */
+export declare function sealerRoleCheckSql(user: string): string;

package/dist/audit/sealer-role.js

@@ -39,14 +39,22 @@ const literal = (value) => `'${value.replace(/'/g, "''")}'`;
  * insert into the checkpoint, signing-key and anchor tables and run the sealing functions (leaves, key retirement, pending erasures, erasure sealing), and holds nothing
  * else. The grants are listed here and in `AUDIT_SEALER_GRANTS`; `audit/sealer-role.test.ts` runs a real
  * checkpoint as this role to prove the list is enough.
+ *
+ * It runs as an owner that is not a superuser (foundry#1110, found by boule#656). PostgreSQL 16 lets only a
+ * superuser name SUPERUSER or BYPASSRLS in `ALTER ROLE`, even to turn them off, so the role is made without any
+ * attribute (`CREATE ROLE` defaults to none of them), only LOGIN, INHERIT and the password are set, and the
+ * attributes are then read back: a role that is a superuser, bypasses row security, may create databases or
+ * roles, replicates, inherits or is a member of another role is refused before it gets a grant, naming the role
+ * and nothing else.
  */
 export function sealerRoleSql(user, password) {
     const role = ident(user);
     const tables = AUDIT_SEALER_INSERT_TABLES.map(ident).join(', ');
     return {
         statements: [
-            `do $$ begin if not exists (select from pg_roles where rolname = ${literal(user)}) then create role ${role} login; end if; end $$`,
-            `alter role ${role} with login password ${literal(password)} nosuperuser nocreatedb nocreaterole noinherit nobypassrls`,
+            `do $$ begin if not exists (select from pg_roles where rolname = ${literal(user)}) then create role ${role} with login noinherit; end if; end $$`,
+            `alter role ${role} with login noinherit password ${literal(password)}`,
+            sealerRoleCheckSql(user),
             `grant usage on schema public to ${role}`,
             `grant select, insert on ${tables} to ${role}`,
             `revoke update, delete, truncate on ${tables} from ${role}`,
@@ -54,3 +62,19 @@ export function sealerRoleSql(user, password) {
         ],
     };
 }
+/**
+ * The read-back of {@link sealerRoleSql}: raises when the role can do more than seal. Its message names the
+ * role only, never the password.
+ */
+export function sealerRoleCheckSql(user) {
+    const name = literal(user);
+    return [
+        'do $$ begin if exists (select from pg_roles r where r.rolname = ',
+        name,
+        ' and (r.rolsuper or r.rolbypassrls or r.rolcreatedb or r.rolcreaterole or r.rolreplication',
+        ' or r.rolinherit or not r.rolcanlogin',
+        ' or exists (select from pg_auth_members m where m.member = r.oid))) then',
+        ` raise exception 'the sealing role % can do more than seal; make it again without other rights', ${name};`,
+        ' end if; end $$',
+    ].join('');
+}

package/dist/audit/tick.d.ts

@@ -1,12 +1,13 @@
 import type { DeclaredOrg } from '../org.js';
 import type { LedgerConnector } from './connector.js';
-import { type AuditPolicy } from './registry.js';
+import { type AuditHostStore } from './host-store.js';
+import type { AuditPolicy } from './registry.js';
 import { type SealResult, type TimestampAuthority } from './seal.js';
 /**
  * The scheduled sealing run (foundry#929). Foundry has no scheduler: the host calls
  * `FoundryPlanApply.runAuditSealTick()` every {@link AUDIT_SEAL_EVERY_MINUTES} minutes, the way it calls
  * `runReleaseTick()` every 10, and that runs this for every declared org. It seals the ledgers the `audit:ledger`
- * step registered, nothing else, and writes one log line per ledger that says what happened and, when nothing did,
+ * step registered and the ones a company's Boule registered at the audit host, nothing else, and writes one log line per ledger that says what happened and, when nothing did,
  * why (a ledger with no new entries, an unreachable database, no timestamp authority).
  */
 /** What the host gives `FoundryPlanApply` to run the tick. */
@@ -24,6 +25,13 @@ export interface AuditSealingOptions {
     fetch?: typeof fetch;
     /** One plain line per ledger and per skipped step. Defaults to `console.info`. */
     log?: (line: string) => void;
+    /**
+     * The audit host's store (`createPostgresAuditHostStore`, foundry#1110). With it the ledgers a company's Boule
+     * registered (`PUT /v1/audit/ledgers/:app`) are sealed too, and every result of the tick is kept there for
+     * `SEAL_RESULTS_KEPT_HOURS`, which `GET .../status` shows. A store that cannot be written is one log line; the
+     * seals stand.
+     */
+    hostStore?: Pick<AuditHostStore, 'registrations' | 'recordSeals'>;
 }
 export interface AuditSealTickDeps extends AuditSealingOptions {
     orgs: readonly DeclaredOrg[];

package/dist/audit/tick.js

@@ -1,10 +1,23 @@
 import { AUDIT_SIGNER_PUBLIC_KEY_SCOPE_KEY } from '../plan/entry-audit.js';
-import { registeredAppLedgers } from './registry.js';
+import { companyAuditLedgers } from './host-store.js';
 import { sealLedgers, } from './seal.js';
 import { AUDIT_SIGNER_REF, signerFromSeed } from './signer.js';
 export const NO_AUTHORITY_LINE = 'audit sealing: no timestamp authority is configured, so checkpoints are sealed and not anchored';
 const describe = (r) => `audit seal ${r.ledger}: ${r.outcome}${r.reason ? `, ${r.reason}` : ''}`;
 export async function runAuditSealTick(deps) {
+    const log = deps.log ?? ((line) => console.info(line));
+    const results = await sealAll(deps);
+    if (deps.hostStore && results.length > 0) {
+        try {
+            await deps.hostStore.recordSeals(results, (deps.now ?? (() => new Date()))());
+        }
+        catch {
+            log('audit sealing: the results could not be kept for status; the seals stand');
+        }
+    }
+    return results;
+}
+async function sealAll(deps) {
     const log = deps.log ?? ((line) => console.info(line));
     const now = deps.now ?? (() => new Date());
     const results = [];
@@ -25,7 +38,7 @@ export async function runAuditSealTick(deps) {
     const due = [];
     for (const org of deps.orgs) {
         try {
-            const ledgers = registeredAppLedgers(org, await deps.recorded(org), deps.policy);
+            const ledgers = await companyAuditLedgers(org, await deps.recorded(org), deps.policy, deps.hostStore);
             if (ledgers.length > 0)
                 due.push({ org, ledgers });
         }

package/dist/catalogue/copy-en.js

@@ -82,6 +82,11 @@ const INTEGRATION_COPY = {
         summary: 'We count how many people visit the app and which pages they open, for each release.',
         ours: 'Run by us',
     },
+    reporting: {
+        name: 'Report errors',
+        summary: 'We keep the errors the app runs into, so you can see what went wrong and when.',
+        ours: 'Run by us',
+    },
     organisations: {
         name: 'Sign-in for organisations',
         summary: 'Companies sign their own people in to the app.',

package/dist/catalogue/integrations.js

@@ -81,6 +81,11 @@ const EXTRA = {
         price: { class: 'free', meters: [] },
         advanced: [],
     },
+    reporting: {
+        providers: [ours('reporting')],
+        price: { class: 'free', meters: [] },
+        advanced: [],
+    },
     organisations: {
         providers: [ours('organisations')],
         price: { class: 'free', meters: [] },

package/dist/entry-rules.d.ts

@@ -64,3 +64,38 @@ export declare const WORKER_APP_CRONS_MAX = 3;
  * first 40 characters of the input. Cloudflare's extensions (`L`, `W`, `#`) are refused.
  */
 export declare function workerAppCronProblem(expression: unknown): string | null;
+/**
+ * #1116: the settings of the Files, Jobs and Email modules. The module fields (`modules/files.ts`,
+ * `modules/jobs.ts`, `modules/email.ts`) and the org validator (`validateEntryFiles`,
+ * `validateEntryMailJobs`) read the same bounds from here, so a value the form accepts is one the org accepts.
+ * Absent from the entry means the default.
+ */
+/**
+ * How many days a new share link works: one of these, or `null` for links that never stop. The files service
+ * refuses a share link more than a year ahead, so 365 is the most.
+ */
+export declare const FILES_SHARE_LINK_DAYS: readonly [1, 7, 30, 90, 365];
+export declare const FILES_SHARE_LINK_DAYS_DEFAULT = 7;
+/** The share of the space used, in percent, at which the owners are emailed. */
+export declare const FILES_SPACE_ALERT_DEFAULT = 80;
+export declare const PERCENT_MIN = 1;
+export declare const PERCENT_MAX = 100;
+/** The jobs scheduler tries a delivery 5 times today (`DEFAULT_MAX_ATTEMPTS` in wtfalch/jobs), so 4 retries. */
+export declare const JOBS_RETRIES_DEFAULT = 4;
+export declare const JOBS_RETRIES_MAX = 10;
+export declare const JOBS_PAUSE_AFTER_DEFAULT = 5;
+export declare const JOBS_PAUSE_AFTER_MAX = 100;
+export declare const MAIL_BOUNCES_DEFAULT = 3;
+export declare const MAIL_BOUNCES_MAX = 10;
+export declare const MAIL_BOUNCE_ALERT_DEFAULT = 5;
+/**
+ * A sender name: no control character and none of `< > " , ; \`, which `@wtfalch/mailer` would put
+ * unquoted into `Name <address>`. Leading and trailing spaces are refused by the validator.
+ */
+export declare const MAIL_FROM_NAME: RegExp;
+export declare const MAIL_FROM_NAME_MAX = 64;
+/** A reply-to address: one plain mailbox, no display name. */
+export declare const MAIL_REPLY_TO: RegExp;
+export declare const MAIL_REPLY_TO_MAX = 254;
+/** A whole number from `min` to `max`. */
+export declare const wholeIn: (value: unknown, min: number, max: number) => value is number;

package/dist/entry-rules.js

@@ -145,3 +145,38 @@ export function workerAppCronProblem(expression) {
     }
     return null;
 }
+/**
+ * #1116: the settings of the Files, Jobs and Email modules. The module fields (`modules/files.ts`,
+ * `modules/jobs.ts`, `modules/email.ts`) and the org validator (`validateEntryFiles`,
+ * `validateEntryMailJobs`) read the same bounds from here, so a value the form accepts is one the org accepts.
+ * Absent from the entry means the default.
+ */
+/**
+ * How many days a new share link works: one of these, or `null` for links that never stop. The files service
+ * refuses a share link more than a year ahead, so 365 is the most.
+ */
+export const FILES_SHARE_LINK_DAYS = [1, 7, 30, 90, 365];
+export const FILES_SHARE_LINK_DAYS_DEFAULT = 7;
+/** The share of the space used, in percent, at which the owners are emailed. */
+export const FILES_SPACE_ALERT_DEFAULT = 80;
+export const PERCENT_MIN = 1;
+export const PERCENT_MAX = 100;
+/** The jobs scheduler tries a delivery 5 times today (`DEFAULT_MAX_ATTEMPTS` in wtfalch/jobs), so 4 retries. */
+export const JOBS_RETRIES_DEFAULT = 4;
+export const JOBS_RETRIES_MAX = 10;
+export const JOBS_PAUSE_AFTER_DEFAULT = 5;
+export const JOBS_PAUSE_AFTER_MAX = 100;
+export const MAIL_BOUNCES_DEFAULT = 3;
+export const MAIL_BOUNCES_MAX = 10;
+export const MAIL_BOUNCE_ALERT_DEFAULT = 5;
+/**
+ * A sender name: no control character and none of `< > " , ; \`, which `@wtfalch/mailer` would put
+ * unquoted into `Name <address>`. Leading and trailing spaces are refused by the validator.
+ */
+export const MAIL_FROM_NAME = /^[^\p{Cc}<>",;\\]+$/u;
+export const MAIL_FROM_NAME_MAX = 64;
+/** A reply-to address: one plain mailbox, no display name. */
+export const MAIL_REPLY_TO = /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/u;
+export const MAIL_REPLY_TO_MAX = 254;
+/** A whole number from `min` to `max`. */
+export const wholeIn = (value, min, max) => typeof value === 'number' && Number.isInteger(value) && value >= min && value <= max;

package/dist/hosted-label.js

@@ -1,5 +1,5 @@
 import { checkName } from '@wtfalch/auth/names';
-import { FOUNDRY_SERVICE_LABELS } from './service-labels.js';
+import { FOUNDRY_SERVICE_LABELS, PLATFORM_APP_LABELS } from './service-labels.js';
 import { RESERVED_SLUGS, RESERVED_SLUG_PREFIX, hasBarredSlugSuffix } from './slug.js';
 /** The first-label prefix of every workspace host (`work-<slug>-<key>`). */
 export const WORKSPACE_HOST_PREFIX = 'work-';
@@ -51,6 +51,7 @@ export function hostedLabelRefusal(label) {
         };
     }
     if (FOUNDRY_SERVICE_LABELS.has(label) ||
+        PLATFORM_APP_LABELS.has(label) ||
         RESERVED_SLUGS.has(label) ||
         label.startsWith(RESERVED_SLUG_PREFIX)) {
         return {

package/dist/index.d.ts

@@ -1,9 +1,14 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingGithub, BlueGreenConfig, OrgBuiltinApp, BouleApp, KosmosApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, SecondFactorMode, SignInMethod, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, EntryWorkspace, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
-export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingGithub, BlueGreenConfig, OrgBuiltinApp, BouleApp, KosmosApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAudience, EntryAuth, EntryAuthRoom, SecondFactorMode, SignInMethod, EntryFiles, EntryMail, EntryJobs, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, EntryWorkspace, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, FILES_SETTINGS_ENV_NAMES, MAIL_SETTINGS_ENV_NAMES, entrySettingsEnv, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, entryAudiences, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, signsInBoth, signsInCustomers, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
+export type { PlatformAppCanary } from './platform.js';
+export { appCanaryArtifactUrl } from './platform.js';
+export { APP_CANARY_WORKER_SHA256, APP_CANARY_WORKER_SOURCE, appCanaryShippedPin, fetchAppCanaryArtifact, } from './app-canary-worker.js';
+export { PLATFORM_APP_CANARY_HOSTNAME, PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY, PLATFORM_APP_CANARY_KEY, PLATFORM_APP_CANARY_LABEL, PLATFORM_APP_CANARY_SCRIPT_NAME, } from './plan/app-canary.js';
+export type { PlatformAppCanaryDeps } from './plan/app-canary-apply.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
 export type { PinnedVersions };
 export declare const PINNED_VERSIONS: Readonly<PinnedVersions>;
@@ -65,7 +70,7 @@ export type { FilesHostInput, JobsHostDeps, JobsHostInput, OwnAuthInstance, Plan
 export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
 export type { PlanOwnSfuOptions, SfuAppDeps, SfuAppInput } from './plan/index.js';
 export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuCompose, } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, KeysRegistrarPort, AnalyticsPort, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, KeysRegistrarPort, AnalyticsPort, ReportingPort, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export type { StageProbePort, ReleasePreviewMembers } from './plan/stage-guards.js';
 export type { StageCopyHostConfig } from './plan/stage-copy-host.js';
@@ -78,6 +83,9 @@ export type { EnsureSignInOrgOptions } from './plan/index.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { httpAnalytics } from './plan/index.js';
+export { httpReporting } from './plan/index.js';
+export { httpRegistrarApi } from './plan/index.js';
+export type { RegistrarApiPort } from './plan/index.js';
 export { httpKeysRegistrar, keysRegistrarFromConfig, KEYS_PLATFORM_TOKEN_ENV, KEYS_SERVICE_URL_ENV, } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';

package/dist/index.js

@@ -1,7 +1,10 @@
-export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, FILES_SETTINGS_ENV_NAMES, MAIL_SETTINGS_ENV_NAMES, entrySettingsEnv, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, entryAudiences, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, signsInBoth, signsInCustomers, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
+export { appCanaryArtifactUrl } from './platform.js';
+export { APP_CANARY_WORKER_SHA256, APP_CANARY_WORKER_SOURCE, appCanaryShippedPin, fetchAppCanaryArtifact, } from './app-canary-worker.js';
+export { PLATFORM_APP_CANARY_HOSTNAME, PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY, PLATFORM_APP_CANARY_KEY, PLATFORM_APP_CANARY_LABEL, PLATFORM_APP_CANARY_SCRIPT_NAME, } from './plan/app-canary.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
 // object, not a copy.
@@ -43,6 +46,8 @@ export { hostedLabelRefusal } from './hosted-label.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { httpAnalytics } from './plan/index.js';
+export { httpReporting } from './plan/index.js';
+export { httpRegistrarApi } from './plan/index.js';
 export { httpKeysRegistrar, keysRegistrarFromConfig, KEYS_PLATFORM_TOKEN_ENV, KEYS_SERVICE_URL_ENV, } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';