@wtfalch/foundry 0.16.16 → 0.17.0

package/dist/plan/diff.js

@@ -1,6 +1,6 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
-import { CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
@@ -12,6 +12,7 @@ import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_
 import { DEFAULT_ORG_PLATFORM_READINESS } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
+import { withStepSystem } from './step-system.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export function toPlan(detail) {
     return {
@@ -42,9 +43,8 @@ function resourceKey(system, kind, key) {
  * `hosting.issuerApps[]` entry rather than a single singleton, since an org
  * can declare more than one ZITADEL app. #80 adds two more singletons,
  * modeled on {@link planIssuer}: `planFilesOrganisation` and
- * `planAiOrganisation`, each planned before its own system's limit step
- * ({@link planStorage}, {@link planAiBudget}) so an org has somewhere for a
- * limit to land, and AI use is switched on, before either limit is ever set.
+ * `planAiOrganisation`, the second planned before {@link planAiBudget} so AI
+ * use is switched on before its own limit is ever set.
  * `planOwners` below adds one more singleton, in a different shape from the
  * rest: the org's owner, invited by ZITADEL email, idempotent on the
  * *recorded* resource id (`recordedIds`, sourced from
@@ -142,9 +142,6 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader);
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
-    const storage = planStorage(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader);
-    if (storage.step)
-        plannedSteps.push(storage.step);
     const aiOrganisation = planAiOrganisation(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader);
     if (aiOrganisation.step)
         plannedSteps.push(aiOrganisation.step);
@@ -313,8 +310,6 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     if (aiOrganisation.blocked) {
         unmanaged.push({ description: aiOrganisation.blocked, key: 'ai:organisation' });
     }
-    if (storage.blocked)
-        unmanaged.push({ description: storage.blocked, key: 'files:storage' });
     if (aiBudget.blocked)
         unmanaged.push({ description: aiBudget.blocked, key: 'ai:budget' });
     // #238: a pending zone, reported here with its nameservers rather than
@@ -326,7 +321,12 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...app.blocked);
     unmanaged.push(...brokerEntries.blocked);
     unmanaged.push(...bouleBroker.blocked);
-    return { orgId: org.id, plannedSteps, unmanaged, versionChanges };
+    return {
+        orgId: org.id,
+        plannedSteps: plannedSteps.map(withStepSystem),
+        unmanaged,
+        versionChanges,
+    };
 }
 /**
  * The org's own ZITADEL org (issuer), a per-org singleton like every other
@@ -990,11 +990,8 @@ function notReadyReason(service, keyName, missingKeyRef, noKeyReader) {
         : `the platform's ${service} host is off or not yet applied`;
 }
 /**
- * #80: every org's own organisation on Files, a per-org singleton resource
- * planned before {@link planStorage} -- `setQuota`/`setBudget` 404 against an
- * org Files has never provisioned (`files/packages/sdk/src/client.ts`'s
- * tenant routes need the row `provisionOrganisation` creates). Modeled on
- * {@link planIssuer}: nothing to diff once it exists -- Files' own
+ * #80: every org's own organisation on Files, a per-org singleton resource.
+ * Modeled on {@link planIssuer}: nothing to diff once it exists -- Files' own
  * `provisionOrganisation` is safely repeatable (`executor.ts`'s
  * `filesOrganisation` calls it every time regardless), so the only planned
  * state is "not provisioned yet". The operator-driven `ceilingBytes`/
@@ -1117,53 +1114,9 @@ function planAiOrganisation(org, byKey, claimed, aiReady, missingKeyRef, noKeyRe
         blocked: null,
     };
 }
-/**
- * #27: the org's own spend limit on Files, a per-org singleton resource in
- * the same shape as issuer/mail/chat above. Setting a limit is a config
- * write, never destructive or migrating (#27 "Notes": "safe, idempotent and
- * reversible"). A missing live resource reads as uncapped (`null`), the same
- * value a freshly-declared org's `storage` starts at, so a brand new org with
- * no limits declared produces no step.
- *
- * #177: silently plans nothing while there is no organisation to size a limit
- * on yet and `filesReady` is false -- {@link planFilesOrganisation} already
- * reports the platform's files host as missing once.
- */
-function planStorage(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false) {
-    const key = resourceKey('files', 'storage', org.id);
-    const live = byKey.get(key);
-    if (live)
-        claimed.add(key);
-    if (!filesReady && !live)
-        return { step: null, blocked: null };
-    const desired = { limitBytes: org.storage.limitBytes, limitMicros: org.storage.limitMicros };
-    const liveLimitBytes = live ? (live.config.limitBytes ?? null) : null;
-    const liveLimitMicros = live ? (live.config.limitMicros ?? null) : null;
-    if (liveLimitBytes === desired.limitBytes && liveLimitMicros === desired.limitMicros) {
-        return { step: null, blocked: null };
-    }
-    // A live resource with drift needs the platform's key to change; blocked, not planned to throw at apply.
-    if (!filesReady) {
-        return {
-            step: null,
-            blocked: `${org.slug}'s storage limit change is blocked, not planned: ${notReadyReason('files', 'files management key', missingKeyRef, noKeyReader)}`,
-        };
-    }
-    return {
-        blocked: null,
-        step: {
-            action: { system: 'files', kind: 'storage', key: org.id, desired },
-            step: {
-                description: `set ${org.slug}'s storage limit to ${desired.limitBytes ?? 'uncapped'} bytes / ${desired.limitMicros ?? 'uncapped'} micros`,
-                destroys: false,
-                migrates: false,
-            },
-        },
-    };
-}
 /**
  * #27: the org's own spend limit on AI, a per-org singleton resource in the
- * same shape as {@link planStorage}. Planned after {@link planAiOrganisation}
+ * same singleton shape as issuer/mail/chat above. Planned after {@link planAiOrganisation}
  * (#80), which already seeds a brand new org's first budget row from this
  * same `org.ai.limitMicros` -- this planner only fires again once that row's
  * live value has drifted from what is declared.
@@ -1469,13 +1422,25 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
     if (liveEnv.AGORA_CONFIG === undefined && !drift.includes('AGORA_CONFIG')) {
         drift.push('AGORA_CONFIG');
     }
-    if (drift.length === 0)
+    // #442: `drift` alone, once this step has ever run, is comparing `env`
+    // against Coolify's own env store -- which the executor's `bulkUpsertEnvs`
+    // leaves matching `env` the moment the write succeeds, restarted or not.
+    // So once applied, drift reads empty forever even if the running process
+    // was never restarted onto it (a crash between the write and the restart,
+    // or simply never restarting at all). `AGORA_ACTIVATED_ENV_SCOPE_KEY` is
+    // the executor's own record that a restart confirmed the process is
+    // actually serving this exact `env`; while it disagrees, the step stays
+    // planned no matter what Coolify's env store already shows.
+    const activated = recordedIds[AGORA_ACTIVATED_ENV_SCOPE_KEY] === agoraEnvRevision(env);
+    if (drift.length === 0 && activated)
         return { step: null, blocked: null };
     return {
         step: {
             action,
             step: {
-                description: `update ${org.slug}'s Agora config (${drift.join(', ')} missing or different)`,
+                description: drift.length > 0
+                    ? `update ${org.slug}'s Agora config (${drift.join(', ')} missing or different)`
+                    : `activate ${org.slug}'s Agora config -- written but not yet confirmed restarted`,
                 destroys: false,
                 migrates: false,
             },

package/dist/plan/entry-ai-key.d.ts

@@ -1,5 +1,5 @@
 import { type DeclaredOrg, type HostingEntry } from '../org.js';
-import type { PlannedStep } from './diff.js';
+import type { DraftStep } from './diff.js';
 import type { OrgPlatformReadiness } from './platform-org.js';
 /**
  * F6a: one ai key per entry with `uses.ai`, minted below the org's own ai key
@@ -49,8 +49,8 @@ export type EntryAiMode = 'mint' | 'renew' | 'settings' | 'finish' | 'retire';
  * entry's app or the ai address is not recorded, or after a mint whose
  * delivery failed: a second mint would leave two live keys.
  */
-export declare function planEntryAiKeys(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly PlannedStep[], readiness: OrgPlatformReadiness, now: number): {
-    steps: PlannedStep[];
+export declare function planEntryAiKeys(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], readiness: OrgPlatformReadiness, now: number): {
+    steps: DraftStep[];
     blocked: Array<{
         description: string;
         key: string;

package/dist/plan/entry-files-key.d.ts

@@ -1,5 +1,5 @@
 import { type DeclaredOrg, type HostingEntry } from '../org.js';
-import type { PlannedStep } from './diff.js';
+import type { DraftStep } from './diff.js';
 import type { OrgPlatformReadiness } from './platform-org.js';
 /**
  * F6b: the org's own files key, minted below the files organisation's
@@ -77,8 +77,8 @@ type Blocked = Array<{
  * it by its own `renew` step, and only then does `revoke-previous` revoke the
  * old org key, which revokes everything still below it.
  */
-export declare function planFilesKeys(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly PlannedStep[], readiness: OrgPlatformReadiness, now: number): {
-    steps: PlannedStep[];
+export declare function planFilesKeys(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], readiness: OrgPlatformReadiness, now: number): {
+    steps: DraftStep[];
     blocked: Blocked;
 };
 export {};

package/dist/plan/executor.d.ts

@@ -183,10 +183,19 @@ export interface CoolifyPort {
      * `is_preview === false` the same way a deployed-config reader must.
      */
     listEnvs(applicationUuid: string): Promise<Array<{
+        uuid?: string;
         key: string;
         value: string;
         is_preview: boolean;
     }>>;
+    /**
+     * #436 round 2: removes one environment variable row by the `uuid`
+     * `listEnvs` names it under -- `bulkUpsertEnvs` only adds or updates, so
+     * this is the only way to make a var foundry wrote in an earlier release
+     * actually go away, rather than leaving it set to a value nothing reads
+     * any more (`provisionPlatformArchon`'s stale `FILES_MANAGEMENT_KEY`).
+     */
+    deleteEnv(applicationUuid: string, envUuid: string): Promise<unknown>;
     /** Escape hatch (`CoolifyClient.raw`) — used for stop/start, which have no typed method yet. */
     raw(method: string, path: string, body?: unknown): Promise<unknown>;
     /**
@@ -1049,16 +1058,6 @@ export interface ZitadelListAppsRawApp {
  * `signManagementRequest`/`AssertionTrust`). A host can construct this without
  * any human session: it only needs the Ed25519 private key (`SigningIdentity`)
  * an operator's `MANAGEMENT_PUBLIC_KEYS`/`MANAGEMENT_ISSUER` pins.
- *
- * #177: `setQuota`/`setBudget` (`files/packages/sdk/src/client.ts:154-166`)
- * used to live on a separate `FilesOrgLimits` a host built per org through a
- * `filesLimitsFor(orgId)` factory on `FoundryStepExecutorPorts` — ceremony
- * left over from nothing but currying an id this port's own callers already
- * have in hand. The signed claim's `organisation` field selects the org per
- * call, so one shared keypair signs for every org already, the same signer
- * `provisionOrganisation` uses; there was never a per-org client to build,
- * only an org id to pass. Both methods now take it explicitly, like
- * `provisionOrganisation` always did, and `filesLimitsFor` is gone.
  */
 export interface FilesOrganisationPort {
     provisionOrganisation(input: {
@@ -1088,9 +1087,6 @@ export interface FilesOrganisationPort {
             secret: string;
         };
     }>;
-    /** #27, #177: the org's own spend limit on Files -- see this interface's own doc comment for why `organisationId` is explicit here. */
-    setQuota(organisationId: string, limitBytes: string | null): Promise<unknown>;
-    setBudget(organisationId: string, limitMicros: string | null): Promise<unknown>;
     /**
      * F6b: mints the organisation's own key, matching files'
      * `POST /v1/manage/organisations/:organisationId/keys` (SDK
@@ -1251,10 +1247,10 @@ export interface AiOrganisationPort {
      * `ai/packages/sdk/src/client.ts:94-101`'s `updateBudget` (`UpdateBudget`
      * from `ai/packages/sdk/src/types.ts:134-137`). Used to live on a separate
      * `AiOrgLimits` a host built per org through an `aiLimitsFor(orgId)`
-     * factory on `FoundryStepExecutorPorts` -- the same dead currying
-     * {@link FilesOrganisationPort}'s own doc comment explains for
-     * `setQuota`/`setBudget`. `organisationId` is explicit here now, like
-     * every other method on this port.
+     * factory on `FoundryStepExecutorPorts` -- ceremony left over from nothing
+     * but currying an id this port's own callers already have in hand.
+     * `organisationId` is explicit here now, like every other method on this
+     * port.
      */
     updateBudget(organisationId: string, input: {
         keyId: string | null;
@@ -1594,6 +1590,20 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private findRecreatedApp;
     private ensureZitadelProject;
     private ensureCoolifyProject;
+    /**
+     * #445: one company lands on one Coolify server. The first call for an
+     * org picks a usable, reachable server and records it
+     * ({@link COOLIFY_SERVER_SCOPE_KEY}); every later call -- this apply, or a
+     * later one -- reads that recording back and returns the same server,
+     * regardless of what the pool's order or health looks like by then. A
+     * recorded server that has gone unusable or unreachable is reported
+     * blocked (never silently replaced with a second host, which would split
+     * the org's resources across servers and break their internal container
+     * URLs); a recorded server no longer registered at all is the same.
+     * Deliberately no fallback to `servers[0]` when nothing is usable: an
+     * unusable server picked blind is not a server anyone's resources could
+     * actually be created on.
+     */
     private resolveServer;
     private coolifyApp;
     /**
@@ -1938,6 +1948,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * `coolifyApp`'s own analogous gap (it never restarted a found-but-stopped
      * app either) has since closed the same way, inline in that method (#130);
      * this method is `cmsSite`'s only caller.
+     *
+     * `repo` (#245) lets the site app build from an org's own skin repo
+     * (`org.site.repo`) instead of the shared `CMS_REPO`; `cmsSite` always
+     * passes `CMS_REPO` for the cms admin app, which is never org-specific.
      */
     private findOrCreateCmsApp;
     /**
@@ -2091,6 +2105,19 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * pushed once calls are on and this org's calls service app carries its
      * internal name (`desiredAgoraEnv` reads that marker from the recorded ids,
      * not the host values).
+     *
+     * #442: a found-but-already-running app's container binds env only at
+     * start, so writing it alone leaves that process on its old config --
+     * restarted (never redeployed: no new image, so `restart` is the same
+     * primitive `ensureLogVolume`'s own restart uses) whenever the live env
+     * actually differs, or whenever the last restart this step confirmed
+     * ({@link AGORA_ACTIVATED_ENV_SCOPE_KEY}) is not this exact env (an org
+     * applied before this existed, whose live env already matched desired
+     * with nothing ever confirmed running it). A brand new app has nothing
+     * running yet to restart. The activation marker is recorded last, after
+     * the restart (if any) returns without throwing, so a failed restart
+     * leaves it stale and the next plan replans this step even though
+     * Coolify's own env store already matches desired.
      */
     private coolifyAgora;
     /**
@@ -2395,11 +2422,11 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private ensureLettermintDmarcRecord;
     /**
-     * #80: provisions the org's own organisation on Files, before
-     * {@link filesStorage} can set its spend limit. `provisionOrganisation` is
-     * safely repeatable on its own (`FilesOrganisationPort`'s doc comment), so
-     * this is called every time regardless of whether it already ran --
-     * idempotent by find-or-create, not by checking `recordedIds` first.
+     * #80: provisions the org's own organisation on Files.
+     * `provisionOrganisation` is safely repeatable on its own
+     * (`FilesOrganisationPort`'s doc comment), so this is called every time
+     * regardless of whether it already ran -- idempotent by find-or-create,
+     * not by checking `recordedIds` first.
      *
      * F6b: `action.desired.shareHost` (`diff.ts`'s `planFilesOrganisation`) is
      * passed through every time, even though `entry-files-key.ts` reports the
@@ -2412,6 +2439,14 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * repeat-is-a-no-op shape as `provisionOrganisation` itself -- every org
      * gets an Agora (#164), so `diff.ts`'s `planFilesOrganisation` always sets
      * `desired.agoraOrigin`.
+     *
+     * #437: the owner member/name, the core ZITADEL files project and the core
+     * collection (`core-files.ts`) are no longer conditioned on a hosting entry
+     * declaring `uses.files` -- the core bundle (Agora's own uploads) needs
+     * all three just as much as a bespoke entry does, and withholding them
+     * until one existed is why a plain Agora/Boule org never got a usable
+     * Files setup at all. Both the project and the collection are idempotent
+     * by name, so a re-run that already created either finds it instead.
      */
     private filesOrganisation;
     /**
@@ -2422,7 +2457,6 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * that fails revokes the key again instead of leaving a live key nobody holds.
      */
     private deliverFilesAgoraKey;
-    private filesStorage;
     /**
      * #80: provisions the org's own organisation on AI and switches its AI use
      * on, before {@link aiBudget} can set its own spend limit. Both