@wtfalch/foundry 0.27.0 → 0.29.0

package/dist/plan/platform-sfu.js

@@ -35,9 +35,48 @@
  * live outside this package. `calls-sfu-ssh-adapter.ts`'s {@link CallsSfuSshSession} is the narrow shape
  * a test fakes instead.
  */
+import { createHash } from 'node:crypto';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { mintLivekitCredentials } from '../calls-sfu-keys.js';
 import { applyCallsSfuOverSession } from '../calls-sfu-ssh-adapter.js';
+import { CALLS_SFU_FIREWALL_COMMANDS, CALLS_SFU_SSH_RULE_COMMAND, CALLS_SFU_UP_COMMAND, cloudflaredEnvFile, dockerComposeYaml, livekitConfigYaml, } from '../calls-sfu.js';
+/**
+ * Hash of what `applyCallsSfu` writes and runs, rendered from placeholder
+ * values so no secret is involved: a change to the compose file, the
+ * `livekit.yaml` template, the env file template or a command changes it.
+ */
+function callsSfuFilesVersion() {
+    const placeholder = {
+        address: 'address',
+        livekitKeys: { key: 'secret' },
+        cloudflaredTunnelToken: 'token',
+    };
+    return createHash('sha256')
+        .update(JSON.stringify([
+        dockerComposeYaml(),
+        livekitConfigYaml(placeholder),
+        cloudflaredEnvFile(placeholder.cloudflaredTunnelToken),
+        CALLS_SFU_UP_COMMAND,
+        CALLS_SFU_SSH_RULE_COMMAND,
+        CALLS_SFU_FIREWALL_COMMANDS,
+    ]))
+        .digest('hex');
+}
+/**
+ * What the last successful `sfu` apply is recorded as
+ * (`PLATFORM_SFU_APPLIED_SCOPE_KEY`): a SHA-256 hex digest of foundry's calls
+ * files, the sorted distinct org slugs and the connection revision. It holds
+ * no secret and does not depend on slug order or duplicates.
+ */
+export function callsSfuAppliedFingerprint(input) {
+    return createHash('sha256')
+        .update(JSON.stringify([
+        callsSfuFilesVersion(),
+        [...new Set(input.orgSlugs)].sort(),
+        input.connectionRevision ?? '',
+    ]))
+        .digest('hex');
+}
 /**
  * The key id the platform's own LiveKit pair is held under, alongside every
  * org's own pair, in the same {@link CallsSfuKeysPort} (#152 round 2 review:

package/dist/plan/providers-readers.d.ts

@@ -1,7 +1,7 @@
 import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import type { CoolifyClient } from '@wtfalch/providers/coolify';
 import { type ZitadelClient } from '@wtfalch/providers/zitadel';
-import type { OrgId } from '../org.js';
+import { type OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import type { AiReader, CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
 /** The `CoolifyClient` methods the readers call, so a host's own implementation needs no cast. */

package/dist/plan/providers-readers.js

@@ -1,5 +1,6 @@
 import { ZitadelError } from '@wtfalch/providers/zitadel';
-import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
+import { APP_ENTRY_KEY } from '../org.js';
+import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
  * — the one place foundry records a provider's own id for an org today,
@@ -247,7 +248,7 @@ async function withAgoraEnvConfig(client, resource, recorded) {
  * `executor.ts` would write. Gated and failing exactly like
  * {@link withAgoraEnvConfig}.
  */
-async function withBouleEnvConfig(client, resource, recorded) {
+async function withBouleEnvConfig(client, resource, recorded, liveKeys) {
     if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('boule:')) {
         return resource;
     }
@@ -257,7 +258,20 @@ async function withBouleEnvConfig(client, resource, recorded) {
         if (!e.is_preview && managed.includes(e.key))
             env[e.key] = e.value;
     }
-    return { ...resource, config: { ...resource.config, env } };
+    // The hosted app's Lettermint token, as `config.appMailToken`: the one
+    // Boule must hold too. In memory only, compared by `planBoule` and never
+    // written to a step, description or log.
+    const orgId = recorded[resource.key]?.slice('boule:'.length);
+    const appUuid = Object.entries(recorded).find(([, value]) => value === `app:${orgId}:${APP_ENTRY_KEY}`)?.[0];
+    // A recorded app that is not in the live listing is gone: no app token, and
+    // no read of its envs. A listed app whose read fails fails like any read.
+    const appToken = appUuid && liveKeys.has(appUuid)
+        ? (await client.listEnvs(appUuid)).find((e) => !e.is_preview && e.key === BOULE_MAIL_TOKEN_ENV)?.value
+        : undefined;
+    return {
+        ...resource,
+        config: { ...resource.config, env, ...(appToken ? { appMailToken: appToken } : {}) },
+    };
 }
 /** `@wtfalch/providers`' own `LiveResource` (`resource.ts`) has no `system` field — foundry's adds it at this boundary. */
 function toFoundryResources(system, resources) {
@@ -290,7 +304,8 @@ export class ProvidersCoolifyReader {
         const withEnvNames = await Promise.all(withHealthCheck.map((r) => withEnvNamesConfig(this.client, r, recorded)));
         const withDbUrl = await Promise.all(withEnvNames.map((r) => withDatabaseUrlConfig(this.client, r, recorded)));
         const withAgoraConfig = await Promise.all(withDbUrl.map((r) => withAgoraEnvConfig(this.client, r, recorded)));
-        const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded)));
+        const liveKeys = new Set(withAgoraConfig.map((r) => r.key));
+        const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded, liveKeys)));
         return applyRecordedIds(withBouleConfig, recorded);
     }
     /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */

package/dist/platform.d.ts

@@ -12,6 +12,14 @@ export interface PlatformService {
     hostname: string;
     gitRef: string;
 }
+/**
+ * `sfu`'s own extra field. A host that changes what the SFU VM is reached
+ * with (its SSH key, host key or tunnel token) sets a new `connectionRevision`
+ * so the platform plan shows the `sfu` step again; foundry never reads it.
+ */
+export interface PlatformSfuService extends PlatformService {
+    connectionRevision?: string;
+}
 /**
  * #491: `mail`'s own extra field, on top of every other service's shape.
  * Company Included (or whichever org's mail domain is the platform's own
@@ -76,7 +84,7 @@ export interface DeclaredPlatform {
     serverIpv4?: string | null;
     auth: PlatformService;
     mail: PlatformMailService;
-    sfu: PlatformService;
+    sfu: PlatformSfuService;
     files: PlatformService;
     ai: PlatformService;
     jobs: PlatformService;
@@ -116,6 +124,8 @@ export declare function defaultPlatformHostname(service: PlatformServiceKey, ape
  * - `serverIpv4`, when declared, is a dotted-quad IPv4 address.
  * - Every service's `hostname` is the apex itself or a subdomain of it -- a
  *   platform service does not live outside the platform's own apex.
+ * - `sfu.connectionRevision`, when declared, is at most 64 characters of
+ *   `A-Za-z0-9:.-`.
  * - Every service's `gitRef` is non-empty once that service is `enabled` --
  *   an enabled service with nothing to deploy is not yet declared.
  */

package/dist/platform.js

@@ -32,6 +32,8 @@ function serviceOf(platform, key) {
  * - `serverIpv4`, when declared, is a dotted-quad IPv4 address.
  * - Every service's `hostname` is the apex itself or a subdomain of it -- a
  *   platform service does not live outside the platform's own apex.
+ * - `sfu.connectionRevision`, when declared, is at most 64 characters of
+ *   `A-Za-z0-9:.-`.
  * - Every service's `gitRef` is non-empty once that service is `enabled` --
  *   an enabled service with nothing to deploy is not yet declared.
  */
@@ -54,6 +56,10 @@ export function validatePlatform(platform) {
             return `${key}.gitRef must not be empty once ${key}.enabled is true`;
         }
     }
+    const revision = platform.sfu.connectionRevision;
+    if (revision != null && !/^[A-Za-z0-9:.-]{0,64}$/.test(revision)) {
+        return 'sfu.connectionRevision must be at most 64 characters of A-Z, a-z, 0-9, ":", "." and "-"';
+    }
     const { uptime } = platform;
     if (Boolean(uptime.tag.trim()) !== Boolean(uptime.sha256.trim())) {
         return 'uptime.tag and uptime.sha256 must be set together: a pin is both';

package/dist/store/postgres.js

@@ -606,7 +606,12 @@ function rowToPlatform(row) {
             gitRef: row.mailGitRef,
             ...(row.mailLettermintProjectId ? { lettermintProjectId: row.mailLettermintProjectId } : {}),
         },
-        sfu: { enabled: row.sfuEnabled, hostname: row.sfuHostname, gitRef: row.sfuGitRef },
+        sfu: {
+            enabled: row.sfuEnabled,
+            hostname: row.sfuHostname,
+            gitRef: row.sfuGitRef,
+            ...(row.sfuConnectionRevision ? { connectionRevision: row.sfuConnectionRevision } : {}),
+        },
         files: { enabled: row.filesEnabled, hostname: row.filesHostname, gitRef: row.filesGitRef },
         ai: { enabled: row.aiEnabled, hostname: row.aiHostname, gitRef: row.aiGitRef },
         jobs: { enabled: row.jobsEnabled, hostname: row.jobsHostname, gitRef: row.jobsGitRef },
@@ -654,6 +659,7 @@ function platformToRow(platform) {
         sfuEnabled: platform.sfu.enabled,
         sfuHostname: platform.sfu.hostname,
         sfuGitRef: platform.sfu.gitRef,
+        sfuConnectionRevision: platform.sfu.connectionRevision ?? null,
         filesEnabled: platform.files.enabled,
         filesHostname: platform.files.hostname,
         filesGitRef: platform.files.gitRef,

package/dist/store/schema.d.ts

@@ -1643,6 +1643,23 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        sfuConnectionRevision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sfu_connection_revision";
+            tableName: "foundry_declared_platform";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         filesEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "files_enabled";
             tableName: "foundry_declared_platform";

package/dist/store/schema.js

@@ -165,6 +165,8 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     sfuEnabled: boolean('sfu_enabled').notNull().default(false),
     sfuHostname: text('sfu_hostname').notNull(),
     sfuGitRef: text('sfu_git_ref').notNull().default(''),
+    /** `migrations/0050_platform_sfu_connection_revision.sql`. Declared; null means unset. */
+    sfuConnectionRevision: text('sfu_connection_revision'),
     filesEnabled: boolean('files_enabled').notNull().default(false),
     filesHostname: text('files_hostname').notNull(),
     filesGitRef: text('files_git_ref').notNull().default(''),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",