@wtfalch/foundry 0.19.0 → 0.19.1

package/dist/plan/agora.d.ts

@@ -151,6 +151,17 @@ export declare const CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY = "coolify_calls_service_
  */
 export declare const CALLS_INTROSPECTION_SCOPE_KEY = "zitadel_calls_introspection_app";
 export declare const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_calls_introspection_undelivered";
+/**
+ * The introspection API app minted for the org's chat service (once), in the
+ * messaging project, and the undelivered key recorded before its secret
+ * leaves the executor (platform rule 1). The first doubles as the marker
+ * `planChat` reads: recorded after the service's env carries the client. No
+ * `:` in either.
+ */
+export declare const CHAT_INTROSPECTION_SCOPE_KEY = "zitadel_chat_introspection_app";
+export declare const CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_chat_introspection_undelivered";
+/** The chat service's introspection API app name; one per org, exact match only. */
+export declare function chatIntrospectionAppName(org: DeclaredOrg): string;
 /** What the plan hands the calls service step: the two host values the token env needs. */
 export interface CallsTokenHost {
     issuer: string;

package/dist/plan/agora.js

@@ -163,6 +163,19 @@ export const CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY = 'coolify_calls_service_token_en
  */
 export const CALLS_INTROSPECTION_SCOPE_KEY = 'zitadel_calls_introspection_app';
 export const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_calls_introspection_undelivered';
+/**
+ * The introspection API app minted for the org's chat service (once), in the
+ * messaging project, and the undelivered key recorded before its secret
+ * leaves the executor (platform rule 1). The first doubles as the marker
+ * `planChat` reads: recorded after the service's env carries the client. No
+ * `:` in either.
+ */
+export const CHAT_INTROSPECTION_SCOPE_KEY = 'zitadel_chat_introspection_app';
+export const CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_chat_introspection_undelivered';
+/** The chat service's introspection API app name; one per org, exact match only. */
+export function chatIntrospectionAppName(org) {
+    return `chat-introspection-${org.slug}`;
+}
 /**
  * The token env's inputs, or null while any is missing: the host's issuer and
  * messaging project id (`AgoraHostValues`) and the org's recorded ZITADEL org

package/dist/plan/chat-matrix.d.ts

@@ -90,6 +90,9 @@ export interface ChatServiceEnvInput {
     agoraHost: string;
     masClientId: string;
     masClientSecret: string;
+    /** The ZITADEL API app the service introspects Agora's opaque tokens as. */
+    introspectionClientId: string;
+    introspectionClientSecret: string;
 }
 /** Every variable `chat/apps/chat-service/src/config.ts` requires, plus the internal Synapse address and port. */
 export declare function chatServiceEnvs(input: ChatServiceEnvInput): Array<{

package/dist/plan/chat-matrix.js

@@ -195,6 +195,8 @@ export function chatServiceEnvs(input) {
         { key: 'MAS_URL', value: upstreams.mas },
         { key: 'MAS_CLIENT_ID', value: input.masClientId },
         { key: 'MAS_CLIENT_SECRET', value: input.masClientSecret },
+        { key: 'CHAT_INTROSPECTION_CLIENT_ID', value: input.introspectionClientId },
+        { key: 'CHAT_INTROSPECTION_CLIENT_SECRET', value: input.introspectionClientSecret },
         // DATABASE_URL_OWNER/DATABASE_URL are pushed by executor.ts's
         // pushDatabaseUrl instead, not here (the same split coolifyApp and
         // cmsSite follow, #239) -- that call mints a distinct <dbName>_rt

package/dist/plan/diff.js

@@ -1,6 +1,6 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
@@ -964,6 +964,27 @@ function planChat(org, byKey, claimed, recordedIds, reading, issuerPlanned) {
                 blocked: null,
             };
         }
+        // A live chat made before its service had an introspection client
+        // answers every Agora sign-in with `token_invalid`. The marker is the
+        // client's app id, recorded after the service's env carries it.
+        if (!recordedIds[CHAT_INTROSPECTION_SCOPE_KEY]) {
+            return {
+                step: {
+                    action: {
+                        system: 'coolify',
+                        kind: 'chat',
+                        key: org.id,
+                        desired: { usesDomain: liveUsesDomain, refreshIntrospection: true },
+                    },
+                    step: {
+                        description: `give ${org.slug}'s chat service its token introspection client and redeploy it`,
+                        destroys: false,
+                        migrates: false,
+                    },
+                },
+                blocked: null,
+            };
+        }
         return none;
     }
     const domain = org.domain ?? 'its domain';

package/dist/plan/executor.d.ts

@@ -2228,6 +2228,18 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * so an existing one is always re-written.
      */
     private ensureCallsFileStorage;
+    /**
+     * The chat service's introspection client: an API app in the org's
+     * messaging project (the audience Agora's token carries), so ZITADEL's
+     * introspection accepts it. The chat service authenticates as it with
+     * `client_secret_basic`. Minted once, the way {@link callsTokenEnvs} does:
+     * the id is recorded under an undelivered key and persisted before the
+     * secret leaves, the secret goes to `deliverSecret` and to the caller's env
+     * write, never to a log, error or return beyond that. A re-run reads the id
+     * and secret back from the service's own env and mints nothing. `changed`
+     * is true only for a fresh mint.
+     */
+    private ensureChatIntrospection;
     /**
      * Creates the `chat.admin` role on the org's messaging project and grants
      * it to each owner whose invite is recorded (`zitadel:owner:<orgId>:<email>`,

package/dist/plan/executor.js

@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
@@ -3079,6 +3079,74 @@ export class FoundryStepExecutor {
         }
     }
     // ---- chat -----------------------------------------------------------------
+    /**
+     * The chat service's introspection client: an API app in the org's
+     * messaging project (the audience Agora's token carries), so ZITADEL's
+     * introspection accepts it. The chat service authenticates as it with
+     * `client_secret_basic`. Minted once, the way {@link callsTokenEnvs} does:
+     * the id is recorded under an undelivered key and persisted before the
+     * secret leaves, the secret goes to `deliverSecret` and to the caller's env
+     * write, never to a log, error or return beyond that. A re-run reads the id
+     * and secret back from the service's own env and mints nothing. `changed`
+     * is true only for a fresh mint.
+     */
+    async ensureChatIntrospection(org, zitadelOrgId, projectId, serviceAppId, context) {
+        const recorded = context.recordedIds();
+        const done = recorded[CHAT_INTROSPECTION_SCOPE_KEY];
+        const undelivered = recorded[CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
+        if (done) {
+            const envs = await this.ports.coolify.listEnvs(serviceAppId);
+            const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+            const clientId = read('CHAT_INTROSPECTION_CLIENT_ID');
+            const clientSecret = read('CHAT_INTROSPECTION_CLIENT_SECRET');
+            if (!clientId || !clientSecret) {
+                throw new Error(`coolify:chat for ${org.slug}: the introspection client (ZITADEL app ${done}) is recorded but its id or secret is no longer on the service; remove the recorded keys ${CHAT_INTROSPECTION_SCOPE_KEY} and ${CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY}, and delete the ZITADEL client, to mint a new one`);
+            }
+            return { clientId, clientSecret, appId: done, changed: false };
+        }
+        if (undelivered) {
+            // A minted client with no marker: a crash or failure after the mint.
+            // Both values on the service mean the write landed and only the marker
+            // was lost; otherwise nothing usable was delivered, and the app is
+            // deleted below and made again.
+            const envs = await this.ports.coolify.listEnvs(serviceAppId);
+            const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+            const clientId = read('CHAT_INTROSPECTION_CLIENT_ID');
+            const clientSecret = read('CHAT_INTROSPECTION_CLIENT_SECRET');
+            if (clientId && clientSecret) {
+                return { clientId, clientSecret, appId: undelivered, changed: false };
+            }
+        }
+        // An app by this name with no recorded secret is a crash between create
+        // and record: nothing was delivered, so it is deleted and made again.
+        const stale = (await this.ports.zitadel.listApps(zitadelOrgId, projectId)).apps.filter((app) => app.name === chatIntrospectionAppName(org) && app.state !== 'APP_STATE_REMOVED');
+        const staleIds = new Set(stale.map((app) => app.id));
+        if (undelivered)
+            staleIds.add(undelivered);
+        for (const id of staleIds) {
+            try {
+                await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, id);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        const client = await this.ports.zitadel.createApiApp(zitadelOrgId, projectId, {
+            name: chatIntrospectionAppName(org),
+        });
+        context.recordScopeId(CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, client.appId);
+        await context.persistScopeIds();
+        if (!(await this.deliverWithRetry(`zitadel:chat:${org.slug}:introspection`, client.clientSecret))) {
+            throw new Error(`coolify:chat for ${org.slug}: the introspection client secret (ZITADEL app ${client.appId}) could not be delivered after ${JOBS_DELIVERY_ATTEMPTS} attempts`);
+        }
+        return {
+            clientId: client.clientId,
+            clientSecret: client.clientSecret,
+            appId: client.appId,
+            changed: true,
+        };
+    }
     /**
      * Creates the `chat.admin` role on the org's messaging project and grants
      * it to each owner whose invite is recorded (`zitadel:owner:<orgId>:<email>`,
@@ -3147,6 +3215,29 @@ export class FoundryStepExecutor {
                 context.recordScopeId(markerKey, '1');
                 return { resourceId: serviceAppId };
             }
+            // `planChat` plans this for a live chat whose service has no
+            // introspection client: mint it once, push only its two env vars and
+            // redeploy. Never the re-key paths or a fresh provision.
+            if (action.desired.refreshIntrospection === true) {
+                const serviceAppId = recorded[CHAT_SERVICE_SCOPE_KEY];
+                const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+                const projectId = recorded[ZITADEL_MESSAGING_PROJECT_SCOPE_KEY];
+                if (!serviceAppId || !zitadelOrgId || !projectId) {
+                    throw new Error(`coolify:chat introspection for ${org.slug}: the chat service app, the ZITADEL org or the messaging project is not recorded yet`);
+                }
+                const hadMarker = Boolean(recorded[CHAT_INTROSPECTION_SCOPE_KEY]);
+                const client = await this.ensureChatIntrospection(org, zitadelOrgId, projectId, serviceAppId, context);
+                await this.ports.coolify.bulkUpsertEnvs(serviceAppId, [
+                    { key: 'CHAT_INTROSPECTION_CLIENT_ID', value: client.clientId },
+                    { key: 'CHAT_INTROSPECTION_CLIENT_SECRET', value: client.clientSecret },
+                ]);
+                // Deploy first, marker last: a failed deploy leaves the marker unset,
+                // so the next plan still carries this step and the container gets the env.
+                if (client.changed || !hadMarker)
+                    await this.ports.coolify.deploy(serviceAppId);
+                context.recordScopeId(CHAT_INTROSPECTION_SCOPE_KEY, client.appId);
+                return { resourceId: serviceAppId };
+            }
             if (action.desired.usesDomain === false) {
                 throw new NotBuiltError(`coolify:chat reverse re-key for ${org.slug}`, 'moving its chat back onto the original server_name is not built (#7 amendment 3)');
             }
@@ -3280,6 +3371,7 @@ export class FoundryStepExecutor {
             rsaKeyPem: secrets.value.masRsaKeyPem,
             ecKeyPem: secrets.value.masEcKeyPem,
         }));
+        const introspection = await this.ensureChatIntrospection(org, zitadelOrgId, project.id, service.appId, context);
         await this.ports.coolify.bulkUpsertEnvs(service.appId, chatServiceEnvs({
             orgSlug: org.slug,
             companyName: org.displayName,
@@ -3289,6 +3381,8 @@ export class FoundryStepExecutor {
             agoraHost,
             masClientId: secrets.value.masClientId,
             masClientSecret: secrets.value.masClientSecret,
+            introspectionClientId: introspection.clientId,
+            introspectionClientSecret: introspection.clientSecret,
         }));
         // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
         // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
@@ -3306,11 +3400,14 @@ export class FoundryStepExecutor {
         for (const app of [mas, synapse, service]) {
             if (!app.existed ||
                 secrets.changed ||
-                (app === service && serviceDbPush.changed) ||
+                (app === service && (serviceDbPush.changed || introspection.changed)) ||
                 !isRunningOrStarting((await this.ports.coolify.getApplication(app.appId)).status)) {
                 await this.ports.coolify.deploy(app.appId);
             }
         }
+        // After the write and the deploys, so a failure before them leaves the
+        // marker unset and the next apply repeats the step.
+        context.recordScopeId(CHAT_INTROSPECTION_SCOPE_KEY, introspection.appId);
         // #456: recorded here too, not only on the `refreshDatabaseSplit` replan
         // path above -- without it a fresh provision's very first apply never
         // sets this marker, so `planChat` (`!recordedIds[serviceDbEnvAppliedScopeKey('chat')]`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",