feat: no-piggyback program (P0–P7) + hardening H1–H7 - #56
Merged
Conversation
Complete Phase 0 on feat/the-big-update-p0: full program plan (D1–D22), ADR 0001, org-create/deploy/FE inventories, PR template channel checks, ENVSYNC_DEPLOYMENT_MODE and ENVSYNC_MAX_ORGS reserved without behavior change, and AGENTS/CONTRIBUTING links for the rollout track.
Implement ENVSYNC_DEPLOYMENT_MODE policy with hosted vs selfhosted channel matrix: public signup and dashboard create-org are hosted-only; self-host web always gets ORG_CREATE_CHANNEL_FORBIDDEN. Deploy runtime env sets selfhosted + max_orgs=1; system status and whoami expose policy flags; UI hides create-organization on self-host.
Add operator-only POST /api/setup/org and GET /api/setup/status authenticated with X-EnvSync-Setup-Token (selfhosted only). Deploy CLI generates /etc/envsync/setup.token, injects ENVSYNC_SETUP_TOKEN, and exposes `org create` / `org status`. Bootstrap prompts for first org on TTY; health reports first_org.ready. Documents flow in SELFHOSTING.md.
Move user-invite accept UX to envsync-web, point self-host invite emails and clipboard links at DASHBOARD_URL, and omit landing from self-host deploy topology/traefik by default. Hosted keeps landing for public signup and org invite accept.
Bundle full lifecycle into @envsync-cloud/deploy with forced OSS edition (no monorepo spawn). Rename deploy-cli npm package to @envsync-cloud/deploy-enterprise with bin envsync-deploy-enterprise and private GitHub Packages publish. OSS images use envsync-web-oss-static; SELFHOSTING documents the public OSS package.
Introduce verified entitlement JWTs as authority for self-host enterprise features and max_orgs claims. Wire requireFeature-style guards on EE routes, grace after expiry, certificate claim apply, and unit tests with fixture keys. Hosted continues to bypass customer license files; OSS remains hard-deny.
…raph Introduce envsync-kernel (MIT errors/types) and envsync-enterprise (proprietary management module registry). Management API process depends on workspace packages by name instead of relative envsync-api/src imports. Core loadApiModules never imports enterprise; CI boundary checks enforced.
Move enterprise integrations pages, components, and management UI hooks into packages/envsync-enterprise-web. Shell Vite alias injects the package for enterprise builds and an empty stub for OSS so EE routes are not first-class in-tree sources anymore.
Port license activate/verify and org-level sync diagnostics into envsync-enterprise-web modules under the dashboard shell. Remove apps/envsync-management-web, the dist/manage merge script, and turbo dev task for the second SPA (D11).
…ation API Finalize PostHog-style dual LICENSE, EDITIONING dual-license monorepo, CONTRIBUTING proprietary terms, and SUPPORT matrix. Prefer POST /auth/create-organization with create-workspace as deprecated alias. Polish dashboard copy to Organization (not workspace multi-org alias).
Remove POST /auth/create-workspace (create-organization only). Gate ENVSYNC_MAX_ORGS behind support override so multi-org needs entitlement claims. Delete ~740 lines of unused duplicate render helpers in deploy-cli. Document management network policy example and root CHANGELOG.
Cloudflare deploy-fe now builds envsync-web with build:hosted so EE modules ship. Path filter includes envsync-enterprise-web. Public TS/Go SDKs call POST /api/auth/create-organization; createWorkspace is a deprecated wrapper. Boundary checks enforce both ship blockers.
Rename WorkspaceProvisioningService to OrganizationProvisioningService, saga createOrganizationForExistingIdentity, CreateOrganizationDialog, and e2e organizations.spec. Keep thin deprecated re-exports for transition.
…ialog Complete H2 naming: organization-provisioning service, auth controller wiring, CreateOrganizationDialog, Go CreateOrganizationRequest type, and phase-h2 docs. Deprecation shims retained for old import paths.
Physically own enterprise-sync, integration, provider, provider-sync, and certificate-verifier under the proprietary package. API keeps thin re-export shims without a production package.json dependency. Sync worker background entry is registered from envsync-enterprise modules.
Document Hosted vs self-host license install (LICENSE-RUNBOOK). Extend LicenseVerificationResponse with entitlement_alg. Add unit tests that license-server-shaped EdDSA JWTs unlock features under enforcement. Private license-server EdDSA issuer patch notes under phase-h4 (package is gitignored for private deployment).
Introduce MIT packages/envsync-ui with shared CSS variables and Tailwind preset. Dashboard and landing import tokens instead of forked :root blocks.
API E2E covers hosted create-org, selfhost deny, removed create-workspace, and cookie-session requirement. UI E2E loads EE org routes and asserts no management SPA; regression route surface includes EE paths.
getMaxOrgsForChannel collapsed hosted null max_orgs to 1 via ?? 1, blocking UI harness bootstrap after the first org. Hosted (non-single-org) now returns unlimited for all channels including cli_bootstrap.
Remove envsync-enterprise from envsync-api devDependencies. EE code is reached only via monorepo-relative re-export shims; the reverse edge caused turbo test:mock to fail with a cyclic package graph. Boundary CI now forbids any package.json edge api → enterprise.
rotation.service lived in envsync-api and imported ./secret.service; after H7 move the relative path broke envsync-management-api esbuild. Use @/services/secret.service so the management-api alias plugin resolves core.
- OSS deploy owns the engine (src/cli.ts); EE deploy-cli is a thin entry that depends on @envsync-cloud/deploy (open-core direction EE→OSS). - Enterprise background uses envsync-api/license public export; CA PEM ships under envsync-enterprise assets (no ../../envsync-api paths). - Boundary CI enforces these edges. Management/UI/full EE @/* debt remains P1+.
Routes, controllers, and validators for license, enterprise integrations, OIDC, SAML, rotation, dynamic secrets, and log-forwarding now live under envsync-enterprise. Management modules load local routes; core loaders only keep shared onboarding/system. Management-api owns create-app wrap.
- Add envsync-api/ports public re-exports (db, errors, logger, env, middlewares, helpers, services, validators); enterprise no longer path-maps @/* into api src. - Codemod all enterprise @/ deep imports to package ports. - Grow envsync-ui with cn, Button, Badge, Card, Input; web re-exports for compat. - Boundary CI enforces no enterprise @/ and presence of ports + UI primitives.
Serve Enterprise manage routes at /api/v1/manage on the single API process, remove envsync-management-api and separate management SDKs, regenerate core TS/Go clients, rewire CLI and enterprise-web, update CI and product docs, and stop tracking local docs/ in git.
…-manage-api feat: unify manage API on core and collapse management SDKs
Bump monorepo product packages and TS SDK to 0.20.0, expand release:bump coverage, document multi-edition deploy (DEPLOY.md), and align OpenAPI/SDK version strings for the cut.
- Build API images from monorepo root so workspace:* (kernel, sdks) resolve - Copy packages+sdks+apps for enterprise and OSS API Dockerfiles - Rewrite deploy/deploy-cli workspace deps to semver before npm publish - Use Node 22 in release workflow (Node 20 deprecation on Actions)
Contributor
Author
|
@b68-pilot summary |
Contributor
|
PR #56: feat: no-piggyback program (P0–P7) + hardening H1–H7 533 file(s) changed, +20906 / -22334 By file type: Changed files:
New files: 3 |
Contributor
Author
|
@b68-pilot approve |
Contributor
|
Approved. |
![b68-pilot[bot]](https://avatars.githubusercontent.com/in/770361?s=60&v=4){kind=small}
Contributor
Author
|
@b68-pilot merge |
Contributor
|
Merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ships the no-piggyback product architecture on
feat/the-big-update: dual-license monorepo, deployment-mode org-create matrix, enterprise package seams, entitlement gates, Hosted FE enterprise build, and post-program hardening (H1–H7).Program (P0–P7)
ENVSYNC_DEPLOYMENT_MODE, org-create channel policy, self-host setup-token pathenvsync-kernel+envsync-enterprise+envsync-enterprise-web; kill management SPAPOST /auth/create-organizationonly; max_orgs from claimsHardening (H1–H7)
build:hosted(not OSS); SDKs call create-organizationenvsync-enterprise(API re-export shims)envsync-uidesign tokenscheck:hosted-cutover, LICENSE-SERVER-DEPLOY.mdPlans
Test plan
bun run check:boundariesbun run check:hosted-cutover(repo invariants)build:hosted(EE chunks present)docs/HOSTED-CUTOVER.mdHOSTED_SMOKE_BASE_URL+ tokenbuild:oss(release matrix)Ops notes (post-merge)
create-workspacebuild:hosteddocs/HOSTED-CUTOVER.md