@wtfalch/foundry 0.13.0 → 0.14.0

package/dist/plan/agora.d.ts

@@ -106,6 +106,50 @@ export declare const CALLS_SERVICE_NAME_SCOPE_KEY = "coolify_calls_service_inter
 export declare function callsServiceInternalName(org: DeclaredOrg): string;
 /** Whether the recorded marker says the calls service carries the name the org's current slug gives it. */
 export declare function callsServiceHasName(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
+/**
+ * Recorded once the calls service app carries the seven ZITADEL token env
+ * vars (`CALLS_ISSUER` ... `CALLS_INTROSPECTION_CLIENT_SECRET`,
+ * `calls/docs/member-auth.md`). Its value is {@link callsTokenEnvMarker}, so a
+ * changed issuer, audience or organisation plans the step again. The same
+ * marker-and-one-restart mechanism as {@link CALLS_SERVICE_NAME_SCOPE_KEY}.
+ */
+export declare const CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY = "coolify_calls_service_token_env";
+/**
+ * The introspection API app minted for the calls service (once), and the
+ * undelivered key recorded before its secret leaves the executor
+ * (`foundry/CLAUDE.md`, platform rule 1). No `:` in either, as that rule says.
+ */
+export declare const CALLS_INTROSPECTION_SCOPE_KEY = "zitadel_calls_introspection_app";
+export declare const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_calls_introspection_undelivered";
+/** What the plan hands the calls service step: the two host values the token env needs. */
+export interface CallsTokenHost {
+    issuer: string;
+    messagingProjectId: string;
+}
+/**
+ * The token env's inputs, or null while any is missing: the host's issuer and
+ * messaging project id (`AgoraHostValues`) and the org's recorded ZITADEL org
+ * id. Null means write none of the seven, never a partial set: the calls
+ * service refuses to boot on one.
+ */
+export declare function callsTokenHostFrom(host: AgoraHostValues): CallsTokenHost | null;
+/** The value {@link CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY} holds once the env is in place; null when it cannot be written yet. */
+export declare function callsTokenEnvMarker(host: CallsTokenHost | null, recorded: Readonly<Record<string, string>>): string | null;
+/**
+ * The calls service's introspection API app, in the messaging project. One per
+ * org: the project is shared by every org, so the name carries the slug (a DNS
+ * label, at most 63 characters) and only an exact match is ever deleted.
+ */
+export declare function callsIntrospectionAppName(org: DeclaredOrg): string;
+/**
+ * The block shown, and thrown, when the messaging project or the ZITADEL org
+ * differs from what the token env was written for: the recorded client
+ * belongs to the old project, and foundry does not replace or delete it. Null
+ * when nothing is recorded, or only the issuer differs (the client is kept).
+ */
+export declare function callsTokenEnvMovedMessage(org: DeclaredOrg, host: CallsTokenHost | null, recorded: Readonly<Record<string, string>>): string | null;
+/** True when there is nothing to write yet, or the recorded marker says it was written. */
+export declare function callsServiceHasTokenEnv(host: CallsTokenHost | null, recorded: Readonly<Record<string, string>>): boolean;
 /**
  * The env vars an org's Agora app should carry, and every input still
  * missing to build them. `AGORA_CONFIG` is present only when `missing` is

package/dist/plan/agora.js

@@ -109,6 +109,69 @@ export function callsServiceInternalName(org) {
 export function callsServiceHasName(org, recorded) {
     return recorded[CALLS_SERVICE_NAME_SCOPE_KEY] === callsServiceInternalName(org);
 }
+/**
+ * Recorded once the calls service app carries the seven ZITADEL token env
+ * vars (`CALLS_ISSUER` ... `CALLS_INTROSPECTION_CLIENT_SECRET`,
+ * `calls/docs/member-auth.md`). Its value is {@link callsTokenEnvMarker}, so a
+ * changed issuer, audience or organisation plans the step again. The same
+ * marker-and-one-restart mechanism as {@link CALLS_SERVICE_NAME_SCOPE_KEY}.
+ */
+export const CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY = 'coolify_calls_service_token_env';
+/**
+ * The introspection API app minted for the calls service (once), and the
+ * undelivered key recorded before its secret leaves the executor
+ * (`foundry/CLAUDE.md`, platform rule 1). No `:` in either, as that rule says.
+ */
+export const CALLS_INTROSPECTION_SCOPE_KEY = 'zitadel_calls_introspection_app';
+export const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_calls_introspection_undelivered';
+/**
+ * The token env's inputs, or null while any is missing: the host's issuer and
+ * messaging project id (`AgoraHostValues`) and the org's recorded ZITADEL org
+ * id. Null means write none of the seven, never a partial set: the calls
+ * service refuses to boot on one.
+ */
+export function callsTokenHostFrom(host) {
+    if (!host.issuer || !host.messagingProjectId)
+        return null;
+    return { issuer: host.issuer, messagingProjectId: host.messagingProjectId };
+}
+/** The value {@link CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY} holds once the env is in place; null when it cannot be written yet. */
+export function callsTokenEnvMarker(host, recorded) {
+    const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    if (!host || !zitadelOrgId)
+        return null;
+    return `${host.issuer} ${host.messagingProjectId} ${zitadelOrgId}`;
+}
+/**
+ * The calls service's introspection API app, in the messaging project. One per
+ * org: the project is shared by every org, so the name carries the slug (a DNS
+ * label, at most 63 characters) and only an exact match is ever deleted.
+ */
+export function callsIntrospectionAppName(org) {
+    return `calls-introspection-${org.slug}`;
+}
+/**
+ * The block shown, and thrown, when the messaging project or the ZITADEL org
+ * differs from what the token env was written for: the recorded client
+ * belongs to the old project, and foundry does not replace or delete it. Null
+ * when nothing is recorded, or only the issuer differs (the client is kept).
+ */
+export function callsTokenEnvMovedMessage(org, host, recorded) {
+    const wanted = callsTokenEnvMarker(host, recorded);
+    const written = recorded[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY];
+    if (!wanted || !written || !recorded[CALLS_INTROSPECTION_SCOPE_KEY])
+        return null;
+    const [, oldProject, oldOrg] = written.split(' ');
+    const [, newProject, newOrg] = wanted.split(' ');
+    if (oldProject === newProject && oldOrg === newOrg)
+        return null;
+    return `${org.slug}'s calls service is blocked, not changed: the messaging project or ZITADEL org differs from the one its token env was written for (project ${oldProject} -> ${newProject}, org ${oldOrg} -> ${newOrg}); retire the ZITADEL app ${callsIntrospectionAppName(org)} (${recorded[CALLS_INTROSPECTION_SCOPE_KEY]}) in the old project by hand, then remove the recorded keys ${CALLS_INTROSPECTION_SCOPE_KEY} and ${CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY}`;
+}
+/** True when there is nothing to write yet, or the recorded marker says it was written. */
+export function callsServiceHasTokenEnv(host, recorded) {
+    const marker = callsTokenEnvMarker(host, recorded);
+    return marker === null || recorded[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY] === marker;
+}
 /**
  * The env vars an org's Agora app should carry, and every input still
  * missing to build them. `AGORA_CONFIG` is present only when `missing` is

package/dist/plan/diff.js

@@ -1,6 +1,6 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
-import { NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, callsServiceHasName, desiredAgoraEnv, } from './agora.js';
+import { CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, } from './agora.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
@@ -117,7 +117,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // (`executor.ts`'s `coolifyCallsService`) reads the Synapse/MAS addresses
     // and MAS client credentials `coolifyCalls` just recorded, the same
     // ordering `planOwner` relies on for `zitadel:issuer`.
-    const callsService = planCallsService(org, byKey, claimed, platformReadiness.callsReady, recordedIds, calls.blocked !== null);
+    const callsService = planCallsService(org, byKey, claimed, platformReadiness.callsReady, recordedIds, calls.blocked !== null, 'error' in agoraHost ? null : callsTokenHostFrom(agoraHost));
     if (callsService.step)
         plannedSteps.push(callsService.step);
     // #251: same mechanism as the platform's own version-change lines -- see
@@ -275,6 +275,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     }
     if (calls.blocked)
         unmanaged.push({ description: calls.blocked, key: 'coolify:calls' });
+    if (callsService.blocked) {
+        unmanaged.push({ description: callsService.blocked, key: 'coolify:calls-service' });
+    }
     if (filesOrganisation.blocked) {
         unmanaged.push({ description: filesOrganisation.blocked, key: 'files:organisation' });
     }
@@ -831,25 +834,55 @@ function planCalls(org, byKey, claimed, callsReady) {
  * stack it rides beside is itself blocked on `callsReady` -- {@link planCalls}
  * already reports the platform's shared SFU as missing once.
  */
-function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlocked) {
+function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlocked, tokenHost) {
     const key = resourceKey('coolify', 'calls-service', org.id);
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return { step: null, blocked: null };
     }
+    // The introspection secret is shown once. One minted but never written to
+    // the app is lost, so this reports it and mints no second (platform rule 1).
+    const undelivered = recordedIds[CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
+    if (org.calls.enabled &&
+        undelivered &&
+        !recordedIds[CALLS_INTROSPECTION_SCOPE_KEY] &&
+        byKey.has(key)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls service is blocked, not planned: its introspection client secret (ZITADEL app ${undelivered}) was minted but never written to the app and cannot be shown again; remove the recorded key ${CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY} (and delete the ZITADEL client) to mint a new one`,
+        };
+    }
+    const moved = org.calls.enabled && byKey.has(key)
+        ? callsTokenEnvMovedMessage(org, tokenHost, recordedIds)
+        : null;
+    if (moved)
+        return { step: null, blocked: moved };
     const toggle = planHostingToggle('coolify', 'calls-service', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls service`, () => `park ${org.slug}'s calls service (stops serving; data is retained, not deleted -- #7 corrections 1)`);
+    // The host values ride in the step, as Agora's do, so the env written is
+    // the env the plan showed. Only while enabled: a park step carries none.
+    const withHost = (step) => tokenHost && org.calls.enabled
+        ? {
+            ...step,
+            action: {
+                ...step.action,
+                desired: { ...step.action.desired, host: tokenHost },
+            },
+        }
+        : step;
     if (toggle)
-        return { step: toggle, blocked: null };
-    // A live, enabled app made before the internal name existed (or under an
-    // old slug) has no step from the toggle, yet Agora's address needs the
-    // name. Run the step again until the executor has recorded the marker, but
-    // only while it can succeed: the SFU ready and the Matrix stack not blocked.
+        return { step: withHost(toggle), blocked: null };
+    // A live, enabled app made before the internal name or the token env
+    // existed has no step from the toggle. Run the step again until the
+    // executor has recorded both markers, but only while it can succeed: the
+    // SFU ready and the Matrix stack not blocked.
+    const missingName = !callsServiceHasName(org, recordedIds);
+    const missingTokenEnv = !callsServiceHasTokenEnv(tokenHost, recordedIds);
     if (org.calls.enabled &&
         callsReady &&
         !callsBlocked &&
         byKey.has(key) &&
-        !callsServiceHasName(org, recordedIds)) {
+        (missingName || missingTokenEnv)) {
         return {
-            step: {
+            step: withHost({
                 action: {
                     system: 'coolify',
                     kind: 'calls-service',
@@ -857,11 +890,13 @@ function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlo
                     desired: { enabled: true },
                 },
                 step: {
-                    description: `set the calls service's internal name for ${org.slug}`,
+                    description: missingName
+                        ? `set the calls service's internal name for ${org.slug}`
+                        : `set the calls service's ZITADEL token env for ${org.slug}`,
                     destroys: false,
                     migrates: false,
                 },
-            },
+            }),
             blocked: null,
         };
     }

package/dist/plan/executor.d.ts

@@ -1767,6 +1767,21 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * 1); its own database is never touched from that branch.
      */
     private coolifyCallsService;
+    /**
+     * The seven ZITADEL token env vars the calls service needs to accept
+     * Agora's sign-in token (`calls/docs/member-auth.md`). Only called with all
+     * inputs present, so the set is whole or absent.
+     *
+     * The introspection client is an API app in the messaging project (the
+     * audience the token carries), minted once the way `platform-providers.ts`
+     * mints the files one: its id is recorded under an undelivered key and
+     * persisted before the secret leaves this method, the secret goes to
+     * `deliverSecret` with retries and to the app's env, never to a log, error
+     * or return value, and the guard is recorded by the caller after the env
+     * write. A re-run reads the client id and secret back from the app's own
+     * env and mints nothing.
+     */
+    private callsTokenEnvs;
     /**
      * Reads back the calls Matrix stack's MAS client id/secret from the MAS
      * app's own envs ({@link CALLS_SECRET_ENV_KEYS}) -- never mints: minting

package/dist/plan/executor.js

@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry } from '../org.js';
-import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, agoraHostnameFor, callsServiceHasName, callsServiceInternalName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
@@ -2452,21 +2452,118 @@ export class FoundryStepExecutor {
             { key: 'SYNAPSE_URL', value: `http://${synapseHost}:8008` },
             { key: 'CALLS_ORIGIN', value: `https://${agoraHostnameFor(org)}` },
             { key: 'CALLS_HOST_ADAPTER', value: 'production' },
+            // Deliberately kept as it was, not widened: the calls service refuses to
+            // boot with no `CALLS_TRUSTED_IP_HEADER` (`config.mjs` has no default),
+            // so unsetting it would stop the service. It keys the refused-bearer
+            // limiter, which is only as honest as the proxy in front overwriting
+            // this header (https://github.com/wtfalch/calls/issues/82).
             { key: 'CALLS_TRUSTED_IP_HEADER', value: 'cf-connecting-ip' },
             { key: 'PORT', value: CALLS_SERVICE_PORT },
         ];
         if (bindingSecret)
             envs.push({ key: 'CALLS_BINDING_SECRET', value: bindingSecret });
+        // The seven ZITADEL token vars, all or none (the service refuses to boot
+        // on a partial set). Deliberately absent: `CALLS_CHAT_URL` and
+        // `CALLS_CHAT_TOKEN`. Foundry does not deploy chat
+        // (https://github.com/wtfalch/chat/issues/40), so with both unset the
+        // calls service admits only `event:` rooms.
+        const tokenHost = action.desired.host;
+        const tokenMarker = callsTokenEnvMarker(tokenHost ?? null, context.recordedIds());
+        const token = tokenHost && tokenMarker
+            ? await this.callsTokenEnvs(org, app.appId, tokenHost, context)
+            : null;
+        if (token)
+            envs.push(...token.envs);
         await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        // Recorded after the write, so a failure before it leaves the app
+        // unguarded and the planner reports the lost secret instead of minting again.
+        if (token)
+            context.recordScopeId(CALLS_INTROSPECTION_SCOPE_KEY, token.appId);
         // A container reads its name and env only at start, so a running app is
-        // restarted once, when this run is the one that gave it its name (the same
-        // rule `coolifyApp` follows when an existing app's env changed).
-        if (app.existed && !callsServiceHasName(org, context.recordedIds())) {
+        // restarted once, when this run is the one that gave it its name or its
+        // token env (the same rule `coolifyApp` follows when an existing app's
+        // env changed).
+        const givesTokenEnv = token !== null && context.recordedIds()[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY] !== tokenMarker;
+        if (app.existed && (!callsServiceHasName(org, context.recordedIds()) || givesTokenEnv)) {
             await this.ports.coolify.restart(app.appId);
         }
         context.recordScopeId(CALLS_SERVICE_NAME_SCOPE_KEY, name);
+        if (token && tokenMarker)
+            context.recordScopeId(CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, tokenMarker);
         return { resourceId: app.appId };
     }
+    /**
+     * The seven ZITADEL token env vars the calls service needs to accept
+     * Agora's sign-in token (`calls/docs/member-auth.md`). Only called with all
+     * inputs present, so the set is whole or absent.
+     *
+     * The introspection client is an API app in the messaging project (the
+     * audience the token carries), minted once the way `platform-providers.ts`
+     * mints the files one: its id is recorded under an undelivered key and
+     * persisted before the secret leaves this method, the secret goes to
+     * `deliverSecret` with retries and to the app's env, never to a log, error
+     * or return value, and the guard is recorded by the caller after the env
+     * write. A re-run reads the client id and secret back from the app's own
+     * env and mints nothing.
+     */
+    async callsTokenEnvs(org, appId, host, context) {
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+        const scope = (clientId, clientSecret) => [
+            { key: 'CALLS_ISSUER', value: host.issuer },
+            { key: 'CALLS_AUDIENCE', value: host.messagingProjectId },
+            { key: 'CALLS_ORGANISATION_ID', value: zitadelOrgId },
+            // Chat's own scope (`apps/chat-service`): the audience, and `estate`.
+            { key: 'CALLS_APPLICATION_ID', value: host.messagingProjectId },
+            { key: 'CALLS_PLATFORM_ID', value: 'estate' },
+            { key: 'CALLS_INTROSPECTION_CLIENT_ID', value: clientId },
+            { key: 'CALLS_INTROSPECTION_CLIENT_SECRET', value: clientSecret },
+        ];
+        const done = recorded[CALLS_INTROSPECTION_SCOPE_KEY];
+        const undelivered = recorded[CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
+        if (undelivered && !done) {
+            throw new Error(`coolify:calls-service for ${org.slug}: the introspection client secret (ZITADEL app ${undelivered}) was minted but never written; remove the recorded key ${CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+        }
+        // A changed project or org is never replaced here (see the message); an
+        // issuer-only change keeps the client and rewrites the env below.
+        const moved = callsTokenEnvMovedMessage(org, host, recorded);
+        if (moved)
+            throw new Error(`coolify:calls-service: ${moved}`);
+        if (done) {
+            const envs = await this.ports.coolify.listEnvs(appId);
+            const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+            const clientId = read('CALLS_INTROSPECTION_CLIENT_ID');
+            const clientSecret = read('CALLS_INTROSPECTION_CLIENT_SECRET');
+            if (!clientId || !clientSecret) {
+                throw new Error(`coolify:calls-service for ${org.slug}: the introspection client (ZITADEL app ${done}) is recorded but its id or secret is no longer on the app; remove the recorded keys ${CALLS_INTROSPECTION_SCOPE_KEY} and ${CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY}, and delete the ZITADEL client, to mint a new one`);
+            }
+            return { envs: scope(clientId, clientSecret), appId: done };
+        }
+        // An app by this name with no recorded secret is a crash between create
+        // and record: nothing was delivered, so it is deleted and made again.
+        const stale = (await this.ports.zitadel.listApps(zitadelOrgId, host.messagingProjectId)).apps.filter((app) => app.name === callsIntrospectionAppName(org) && app.state !== 'APP_STATE_REMOVED');
+        for (const app of stale) {
+            try {
+                await this.ports.zitadel.deleteApp(zitadelOrgId, host.messagingProjectId, app.id);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        const client = await this.ports.zitadel.createApiApp(zitadelOrgId, host.messagingProjectId, {
+            name: callsIntrospectionAppName(org),
+        });
+        context.recordScopeId(CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, client.appId);
+        await context.persistScopeIds();
+        if (!(await this.deliverWithRetry(`zitadel:calls:${org.slug}:introspection`, client.clientSecret))) {
+            throw new Error(`coolify:calls-service for ${org.slug}: the introspection client secret (ZITADEL app ${client.appId}) could not be delivered after ${JOBS_DELIVERY_ATTEMPTS} attempts`);
+        }
+        return {
+            envs: scope(client.clientId, client.clientSecret),
+            appId: client.appId,
+        };
+    }
     /**
      * Reads back the calls Matrix stack's MAS client id/secret from the MAS
      * app's own envs ({@link CALLS_SECRET_ENV_KEYS}) -- never mints: minting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",