@wtfalch/foundry 0.26.0 → 0.26.2

package/dist/plan/diff.d.ts

@@ -117,6 +117,15 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * against this seam.
  */
 export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>, agoraHost?: AgoraHostReading, jobsAvailable?: boolean, platformReadiness?: OrgPlatformReadiness, options?: PlanOrgOptions): PlanDetail;
+/**
+ * #488: the bare hostname out of an issuer URL (`https://<hostname>`, the
+ * only shape {@link agoraHostValuesFromPlatform} or a host-supplied
+ * `AgoraHostPort` ever hands back), or `null` when there is no issuer to
+ * read one from. What {@link loginHostnameFor} compares the org's own
+ * computed `auth.<domain>` against, so the platform's own org never plans
+ * its login host equal to the shared ZITADEL instance's own.
+ */
+export declare function isPlatformOwnOrg(org: DeclaredOrg, platformApex: string | null): boolean;
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */

package/dist/plan/diff.js

@@ -734,7 +734,7 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
-function isPlatformOwnOrg(org, platformApex) {
+export function isPlatformOwnOrg(org, platformApex) {
     return Boolean(org.domain && platformApex && org.domain.toLowerCase() === platformApex.toLowerCase());
 }
 function platformAuthHostnameFrom(issuer) {

package/dist/plan/executor.d.ts

@@ -135,7 +135,6 @@ export interface CoolifyPort {
         name: string;
         postgres_db: string;
         postgres_user: string;
-        postgres_initdb_args?: string;
     }): Promise<{
         uuid: string;
         internal_db_url: string;
@@ -2220,6 +2219,14 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * `system:kind:key` slot of its own for the same reason.
      */
     private ensureCallsDatabase;
+    /**
+     * Sets `POSTGRES_INITDB_ARGS` on a Postgres database, once: the official
+     * image's entrypoint passes it to `initdb`, which Coolify's own
+     * `postgres_initdb_args` field never does ({@link CALLS_SYNAPSE_DB_INITDB_ARGS}).
+     * `/databases/{uuid}/envs` is not a typed port method yet, so this goes
+     * through `raw`. Nothing here is a secret.
+     */
+    private ensureDatabaseInitdbArgs;
     /**
      * Reads back {@link CALLS_SECRET_ENV_KEYS} from the MAS app's own envs
      * before minting fresh ones -- this stack's only memory across a re-run

package/dist/plan/executor.js

@@ -567,21 +567,17 @@ const CALLS_MAS_DB_SCOPE_KEY = 'coolify_calls_mas_database';
  * Synapse refuses to start against a database whose `LC_COLLATE`/`LC_CTYPE`
  * is not `C` (https://element-hq.github.io/synapse/latest/postgres.html);
  * Coolify's official postgres image otherwise creates one with `en_US.utf8`.
- * `createPostgresDatabase` forwards this to Coolify's own
- * `postgres_initdb_args` field -- but Coolify stores that field and reads it
- * back unchanged without ever handing it to `initdb`: its Postgres start
- * action builds the container's env from `postgres_user`/`postgres_password`/
- * `postgres_db` and runtime envs only
- * (https://github.com/coollabsio/coolify/blob/main/app/Actions/Database/StartPostgresql.php).
- * A database created this way still comes up `en_US.utf8` and crash-loops
- * every Synapse app that reads it; live evidence and the real fix (not yet
- * chosen) are tracked in #494. This constant and the field it feeds stay in
- * place, inert, until that lands -- collation cannot be migrated onto an
- * existing database under any of the candidate fixes either. MAS has no
- * such requirement, so this is passed for the Synapse database only. Not
- * using Synapse's own `allow_unsafe_locale` escape hatch regardless of
- * which fix lands: that trades a loud startup refusal for silent index
- * corruption after a future glibc upgrade.
+ * Coolify's `postgres_initdb_args` field is stored and never handed to
+ * `initdb` (its Postgres start action builds the container's env from
+ * `postgres_user`/`postgres_password`/`postgres_db` and runtime envs only,
+ * https://github.com/coollabsio/coolify/blob/main/app/Actions/Database/StartPostgresql.php),
+ * so foundry no longer sends it (#494). The official `postgres` image's
+ * entrypoint does read the `POSTGRES_INITDB_ARGS` env: `ensureCallsDatabase`
+ * sets it on the Synapse database before that database first starts. It
+ * cannot change a database whose data directory `initdb` already made; MAS
+ * has no such requirement, so the env goes on the Synapse database only. Not
+ * using Synapse's own `allow_unsafe_locale` escape hatch: that trades a loud
+ * startup refusal for silent index corruption after a future glibc upgrade.
  */
 const CALLS_SYNAPSE_DB_INITDB_ARGS = '--locale=C --encoding=UTF8';
 /**
@@ -3298,13 +3294,23 @@ export class FoundryStepExecutor {
      * database, whose {@link CALLS_SERVICE_DB_SCOPE_KEY} has no
      * `system:kind:key` slot of its own for the same reason.
      */
-    async ensureCallsDatabase(org, context, projectUuid, environment, name, postgresDb, scopeKey, postgresInitdbArgs) {
+    async ensureCallsDatabase(org, context, projectUuid, environment, name, postgresDb, scopeKey, initdbArgs) {
+        // A database found by id or name may be one a failed run created and never
+        // started (its env call threw), so the env is checked on every path. It
+        // only takes effect before the first start; the callers start it later
+        // (`getDatabaseStarted`).
         const existing = context.recordedIds()[scopeKey];
-        if (existing)
+        if (existing) {
+            if (initdbArgs)
+                await this.ensureDatabaseInitdbArgs(existing, initdbArgs);
             return existing;
+        }
         const found = (await this.ports.coolify.listDatabases()).find((d) => d.name === name && d.environment_id === environment.id);
-        if (found)
+        if (found) {
+            if (initdbArgs)
+                await this.ensureDatabaseInitdbArgs(found.uuid, initdbArgs);
             return found.uuid;
+        }
         const server = await this.resolveServer(org, context);
         const created = await this.ports.coolify.createPostgresDatabase({
             project_uuid: projectUuid,
@@ -3314,10 +3320,27 @@ export class FoundryStepExecutor {
             name,
             postgres_db: postgresDb,
             postgres_user: postgresDb,
-            ...(postgresInitdbArgs ? { postgres_initdb_args: postgresInitdbArgs } : {}),
         });
+        if (initdbArgs)
+            await this.ensureDatabaseInitdbArgs(created.uuid, initdbArgs);
         return created.uuid;
     }
+    /**
+     * Sets `POSTGRES_INITDB_ARGS` on a Postgres database, once: the official
+     * image's entrypoint passes it to `initdb`, which Coolify's own
+     * `postgres_initdb_args` field never does ({@link CALLS_SYNAPSE_DB_INITDB_ARGS}).
+     * `/databases/{uuid}/envs` is not a typed port method yet, so this goes
+     * through `raw`. Nothing here is a secret.
+     */
+    async ensureDatabaseInitdbArgs(dbId, args) {
+        const envs = (await this.ports.coolify.raw('GET', `/databases/${dbId}/envs`));
+        if (envs.some((e) => e.key === 'POSTGRES_INITDB_ARGS'))
+            return;
+        await this.ports.coolify.raw('POST', `/databases/${dbId}/envs`, {
+            key: 'POSTGRES_INITDB_ARGS',
+            value: args,
+        });
+    }
     /**
      * Reads back {@link CALLS_SECRET_ENV_KEYS} from the MAS app's own envs
      * before minting fresh ones -- this stack's only memory across a re-run

package/dist/plan/health-targets.d.ts

@@ -71,7 +71,9 @@ export interface HealthTarget {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export declare function healthTargets(org: DeclaredOrg): HealthTarget[];
+export declare function healthTargets(org: DeclaredOrg, options?: {
+    platform?: DeclaredPlatform | null;
+}): HealthTarget[];
 /**
  * The seven platform services #541 names (`platform:auth`, `platform:archon`,
  * `platform:mail`, `platform:ai`, `platform:files`, `platform:integrations`,

package/dist/plan/health-targets.js

@@ -1,6 +1,7 @@
 import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
+import { isPlatformOwnOrg } from './diff.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
 import { isBehindGate } from './gates.js';
 import { entryHostnames } from './hostnames.js';
@@ -12,8 +13,6 @@ const DEFAULT_API_HEALTH_PATH = '/api/health';
 const STATIC_PAGE_PATH = '/';
 /** zitadel-login's own readiness route (#541's "Real paths today"). `depth: 'shallow'`, not `'deep'`: login holds no database of its own (`login-host.ts`), whatever its name suggests. */
 const LOGIN_READY_PATH = '/ready';
-/** The broker answers on `platform.auth.hostname` under `AUTH_BROKER_PATH_PATTERN` (`platform-providers.ts`, `'^/api(/|$)'`), so its own health path carries that prefix. */
-const BROKER_HEALTH_PATH = '/api/healthy';
 /** `platform-providers.ts`'s own `waitForInstance` call target (`` `https://${hostname}/debug/healthz}` ``), also the one path `AUTH_ZITADEL_PATH_PATTERN` names by name. */
 const ZITADEL_HEALTH_PATH = '/debug/healthz';
 /**
@@ -26,7 +25,12 @@ const STALWART_READY_PATH = '/healthz/ready';
 const CHAT_SERVICE_HEALTH_PATH = '/_chat/health';
 const CALLS_HEALTH_PATH = '/healthz';
 /** Boule, Agora and the company's own login host: every org gets these, with no flag to check (the "Why" this issue opens with). */
-function alwaysOnTargets(org) {
+function alwaysOnTargets(org, platform) {
+    // The platform's own org signs in on the shared instance host, not its own
+    // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
+    const loginHost = platform && isPlatformOwnOrg(org, platform.apex)
+        ? platform.auth.hostname
+        : loginHostnameFor(org);
     return [
         {
             service: 'boule',
@@ -49,7 +53,7 @@ function alwaysOnTargets(org) {
         },
         {
             service: 'login',
-            url: `https://${loginHostnameFor(org)}${LOGIN_READY_PATH}`,
+            url: `https://${loginHost}${LOGIN_READY_PATH}`,
             expect: okExpect(),
             depth: 'shallow',
             restartSafe: false,
@@ -224,8 +228,8 @@ function appTargets(org) {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export function healthTargets(org) {
-    const targets = alwaysOnTargets(org);
+export function healthTargets(org, options = {}) {
+    const targets = alwaysOnTargets(org, options.platform ?? null);
     const broker = brokerTarget(org);
     if (broker)
         targets.push(broker);
@@ -265,12 +269,18 @@ function authTargets(platform) {
             behindAccess: false,
         },
         {
+            // The broker's only unauthenticated route is `/healthy` at its own root
+            // (auth's `broker/src/server.ts`), but the tunnel hands it only
+            // `AUTH_BROKER_PATH_PATTERN` ('^/api(/|$)') unchanged: `/api/healthy`
+            // reaches the broker and answers 401, and bare `/healthy` reaches
+            // zitadel-login instead, which would read as the broker being up.
             service: 'auth-broker',
-            url: `https://${hostname}${BROKER_HEALTH_PATH}`,
+            url: null,
             expect: okExpect(),
             depth: 'shallow',
             restartSafe: false,
             behindAccess: false,
+            reason: "the broker's health route (/healthy) is not reachable from outside: the tunnel sends it only /api/*, which answers 401 without a session, and /healthy on this host is zitadel-login's",
         },
     ];
 }
@@ -302,11 +312,15 @@ export function platformHealthTargets(platform) {
         ...authTargets(platform),
         {
             service: 'archon',
+            // `provisionPlatformArchon` always puts a Cloudflare Access app in front
+            // of this hostname (it throws with no Access emails), so a prober with no
+            // service token reads a redirect: it proves Access and the tunnel are up,
+            // not that Archon answers.
             url: `https://${platform.archon.hostname}${DEFAULT_API_HEALTH_PATH}`,
             expect: okExpect(),
-            depth: 'deep',
+            depth: 'shallow',
             restartSafe: false,
-            behindAccess: false,
+            behindAccess: true,
         },
         {
             service: 'mail',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",