@wtfalch/foundry 0.16.8 → 0.16.9

package/dist/plan/diff.js

@@ -1,6 +1,6 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
-import { CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
+import { CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
@@ -1003,6 +1003,15 @@ function notReadyReason(service, keyName, missingKeyRef, noKeyReader) {
  * #177: blocked, not planned, while `filesReady` is false -- the platform's
  * own files host (#171) is off or not yet applied, so there is nothing here
  * for `FilesOrganisationPort.provisionOrganisation` to reach.
+ *
+ * #273: `desired.agoraOrigin` is every org's own Agora origin (#164's
+ * `agoraHostnameFor`, always on, never blocked on anything this step
+ * doesn't already wait for) -- `executor.ts`'s `filesOrganisation` adds it
+ * to the files host's CORS allowlist alongside provisioning. Known gap: a
+ * later domain change that moves Agora's hostname is not replanned here,
+ * since this step (like `planIssuer`) has nothing to diff once the org's
+ * Files organisation already exists -- the old origin is left allowed
+ * rather than silently dropped.
  */
 function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false) {
     const key = resourceKey('files', 'organisation', org.id);
@@ -1023,7 +1032,12 @@ function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, n
                 system: 'files',
                 kind: 'organisation',
                 key: org.id,
-                desired: { provision: true, ceilingBytes: null, ceilingMicros: null },
+                desired: {
+                    provision: true,
+                    ceilingBytes: null,
+                    ceilingMicros: null,
+                    agoraOrigin: `https://${agoraHostnameFor(org)}`,
+                },
             },
             step: {
                 description: `provision ${org.slug}'s own organisation on Files`,

package/dist/plan/executor.d.ts

@@ -1114,6 +1114,20 @@ export interface FilesOrganisationPort {
         name: string;
         created: boolean;
     }>;
+    /**
+     * #273: adds `origin` to the files host's `FILES_ALLOWED_ORIGINS`
+     * allowlist (`wtfalch/files#109`) -- additively, never removing another
+     * organisation's entry already there. That list is a Coolify env var on
+     * the files runner app, not a database row the files management API
+     * reports back (files#109's own reasoning: a database round trip on the
+     * unauthenticated CORS preflight is both a hot-path cost and a new way to
+     * fail closed), so there is nothing here to diff against a live value --
+     * the host decides how `origin` actually reaches that env var, the same
+     * way every other method on this port decides how to speak the service's
+     * protocol. Safely repeatable: calling it again with an origin already on
+     * the list is a no-op.
+     */
+    ensureAllowedOrigin(organisationId: string, origin: string): Promise<void>;
 }
 /**
  * Provisions one org's organisation on AI and switches its AI use on (#80),
@@ -2345,6 +2359,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * safely repeatable on its own (`FilesOrganisationPort`'s doc comment), so
      * this is called every time regardless of whether it already ran --
      * idempotent by find-or-create, not by checking `recordedIds` first.
+     *
+     * #273: also ensures the org's Agora origin is on the files host's CORS
+     * allowlist (`FilesOrganisationPort.ensureAllowedOrigin`), the same
+     * repeat-is-a-no-op shape as `provisionOrganisation` itself -- every org
+     * gets an Agora (#164), so `diff.ts`'s `planFilesOrganisation` always sets
+     * `desired.agoraOrigin`.
      */
     private filesOrganisation;
     /**

package/dist/plan/executor.js

@@ -3970,6 +3970,12 @@ export class FoundryStepExecutor {
      * safely repeatable on its own (`FilesOrganisationPort`'s doc comment), so
      * this is called every time regardless of whether it already ran --
      * idempotent by find-or-create, not by checking `recordedIds` first.
+     *
+     * #273: also ensures the org's Agora origin is on the files host's CORS
+     * allowlist (`FilesOrganisationPort.ensureAllowedOrigin`), the same
+     * repeat-is-a-no-op shape as `provisionOrganisation` itself -- every org
+     * gets an Agora (#164), so `diff.ts`'s `planFilesOrganisation` always sets
+     * `desired.agoraOrigin`.
      */
     async filesOrganisation(action, org, context) {
         const files = await this.filesPort();
@@ -3985,6 +3991,9 @@ export class FoundryStepExecutor {
             ceilingMicros: action.desired.ceilingMicros ?? null,
             ...(owner ? { name: org.displayName, owner } : {}),
         });
+        const agoraOrigin = action.desired.agoraOrigin;
+        if (agoraOrigin)
+            await files.ensureAllowedOrigin(org.id, agoraOrigin);
         // Recorded now, so the org key is minted below the member files made.
         if (owner && provisioned.created)
             context.recordScopeId(FILES_ORG_OWNER_SCOPE_KEY, owner);

package/dist/plan/platform-providers.d.ts

@@ -250,7 +250,8 @@ export declare const PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION = "foundry:platform:adm
  * ({@link PlatformMailDeps.stalwartForInstance}), the same way
  * `zitadelForInstance` is built from a freshly issued instance's issuer URL.
  * {@link defaultStalwartForInstance} is the real implementation, wrapping
- * `@wtfalch/email/postmaster`'s `openInstance`, `applyObjects` with
+ * `@wtfalch/email/postmaster`'s `openInstance`, `Bootstrap/set` while the
+ * server is still in bootstrap mode, `applyObjects` with
  * `platformMailSettingsObjects` (see `provisionPlatformMail`'s own doc
  * comment for why not `mailObjects`) and `StalwartClient.createApiKey`.
  */
@@ -258,7 +259,8 @@ export interface PlatformMailAdminPort {
     /**
      * Sets the instance's default hostname and its OIDC directory
      * (`x:SystemSettings`/`x:Directory`/`x:Domain`/`x:Authentication`) --
-     * idempotent, safe to call on every apply once the instance is up.
+     * idempotent, safe to call on every apply once the instance is up. A fresh
+     * instance is first taken out of bootstrap mode.
      */
     applySettings(input: {
         mailHost: string;

package/dist/plan/platform-providers.js

@@ -1413,7 +1413,20 @@ const STALWART_PORTS_EXPOSES = [STALWART_HTTP_PORT, ...STALWART_SMTP_PORTS].join
  * ZITADEL/login apps.
  */
 const STALWART_PORTS_MAPPINGS = STALWART_SMTP_PORTS.map((p) => `${p}:${p}`).join(',');
-const STALWART_DATA_MOUNT = '/opt/stalwart';
+/**
+ * The v0.16 image's two VOLUMEs (its Dockerfile): the data store, and the
+ * `config.json` Stalwart writes when bootstrap completes. The pre-0.16 image
+ * used `/opt/stalwart`, which v0.16 does not use. Each is a Coolify
+ * persistent storage (a Docker named volume, not a host path), so Docker
+ * seeds it from the image on first use and keeps the image's UID 2000
+ * ownership, which the container needs to write it.
+ */
+// Suffixes differ from the pre-0.16 storage's `-data` (still attached at
+// /opt/stalwart on apps created before), so a new storage never shares its name.
+const STALWART_STORAGES = [
+    { suffix: 'var-lib', mount_path: '/var/lib/stalwart' },
+    { suffix: 'etc', mount_path: '/etc/stalwart' },
+];
 /** `STALWART_RECOVERY_ADMIN=<user>:<password>` -- the fixed recovery account name; only the password half is generated. */
 const STALWART_RECOVERY_USER = 'admin';
 /**
@@ -1474,6 +1487,20 @@ export function defaultStalwartForInstance(input) {
     });
     return {
         async applySettings({ mailHost, apex, oidc }) {
+            // A fresh Stalwart (0.16) is in bootstrap mode and refuses every write
+            // but the `Bootstrap` object, so complete that first. A server already
+            // past it skips this. `update` drops the response, which carries the
+            // generated `admin@<apex>` secret: this step signs in with the
+            // recovery admin and never needs it.
+            if ((await instance.client.probe()) === 'bootstrap') {
+                await instance.client.update('Bootstrap', 'singleton', {
+                    serverHostname: mailHost,
+                    defaultDomain: apex,
+                    // The server sits behind a tunnel; no ACME challenge can reach it.
+                    requestTlsCertificate: false,
+                });
+                await instance.client.waitFor('ready');
+            }
             await applyObjects(instance.client, platformMailSettingsObjects({ apex, mailHost, oidc }), () => { });
         },
         createApiKey: (description, permissions) => instance.client.createApiKey(description, permissions),
@@ -1608,12 +1635,19 @@ async function provisionPlatformMail(context, deps) {
     await record(PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, `http://${PLATFORM_MAIL_INTERNAL_NAME}:${STALWART_HTTP_PORT}`);
     // ---- storage ---------------------------------------------------------------
     const storages = await deps.coolify.listStorages(appId);
-    const hasDataVolume = (storages.persistent_storages ?? []).some((s) => s.mount_path === STALWART_DATA_MOUNT);
-    if (!hasDataVolume) {
+    // An app made before this release only has the old `/opt/stalwart` volume.
+    // That one is left in place (empty and unused; detaching it needs a call this
+    // step has no port for) and the two real ones are added.
+    let storagesAdded = false;
+    for (const wanted of STALWART_STORAGES) {
+        if ((storages.persistent_storages ?? []).some((st) => st.mount_path === wanted.mount_path)) {
+            continue;
+        }
         await deps.coolify.createPersistentStorage(appId, {
-            name: `${PLATFORM_MAIL_APP_NAME}-data`,
-            mount_path: STALWART_DATA_MOUNT,
+            name: `${PLATFORM_MAIL_APP_NAME}-${wanted.suffix}`,
+            mount_path: wanted.mount_path,
         });
+        storagesAdded = true;
     }
     // ---- env ---------------------------------------------------------------------
     // Generated once; unlike ZITADEL's masterkey this is never re-derived from
@@ -1630,7 +1664,8 @@ async function provisionPlatformMail(context, deps) {
     await deps.coolify.bulkUpsertEnvs(appId, envs);
     const declaredChanged = recorded[PLATFORM_MAIL_DEPLOYED_HOSTNAME_SCOPE_KEY] !== hostname ||
         recorded[PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY] !== imageTag;
-    if (app.justCreated || !app.running || envsChanged || declaredChanged) {
+    // A new storage binds into the container only at its next start.
+    if (app.justCreated || !app.running || envsChanged || declaredChanged || storagesAdded) {
         // A container still up from before would answer the readiness probe with
         // the old deployment's health. Stop it and see it stopped first, so the
         // wait below only ever reads the new deployment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.8",
+  "version": "0.16.9",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",