@wtfalch/foundry 0.28.0 → 0.30.0

package/dist/calls-sfu-ssh-client.d.ts

@@ -18,12 +18,14 @@ interface SshStream {
     stderr: {
         on(event: string, listener: (...args: never[]) => void): unknown;
     };
+    close(): void;
 }
 interface SshSftp {
     writeFile(path: string, contents: string, options: {
         mode: number;
     } | undefined, cb: (err?: Error | null) => void): void;
     chmod(path: string, mode: number, cb: (err?: Error | null) => void): void;
+    end(): void;
 }
 interface SshClient {
     on(event: string, listener: (...args: never[]) => void): SshClient;
@@ -41,6 +43,15 @@ export interface CallsSfuSshConnectOptions {
     /** `SHA256:...`. Without it every host key is refused. */
     sshHostFingerprint: string | undefined;
 }
+/** `docker compose up -d` pulls images, so a command gets two minutes. */
+export declare const SSH_COMMAND_TIMEOUT_MS = 120000;
+/** One SFTP write (open, write, chmod) of a small config file. */
+export declare const SSH_WRITE_TIMEOUT_MS = 30000;
+/** Handshake limit; ssh2's default is 20 s, set here so it is explicit. */
+export declare const SSH_READY_TIMEOUT_MS = 20000;
+/** A dead link ends the session after 3 missed keepalives, 10 s apart. */
+export declare const SSH_KEEPALIVE_INTERVAL_MS = 10000;
+export declare const SSH_KEEPALIVE_COUNT_MAX = 3;
 export declare function connectCallsSfuSsh(options: CallsSfuSshConnectOptions, deps?: {
     Client?: SshClientConstructor;
 }): Promise<CallsSfuSshSession & {

package/dist/calls-sfu-ssh-client.js

@@ -13,36 +13,87 @@
  * hands in a fake and never opens a socket.
  */
 import { verifyHostKey } from './calls-sfu-deploy-support.js';
-function sshExec(conn, command) {
+/** `docker compose up -d` pulls images, so a command gets two minutes. */
+export const SSH_COMMAND_TIMEOUT_MS = 120_000;
+/** One SFTP write (open, write, chmod) of a small config file. */
+export const SSH_WRITE_TIMEOUT_MS = 30_000;
+/** Handshake limit; ssh2's default is 20 s, set here so it is explicit. */
+export const SSH_READY_TIMEOUT_MS = 20_000;
+/** A dead link ends the session after 3 missed keepalives, 10 s apart. */
+export const SSH_KEEPALIVE_INTERVAL_MS = 10_000;
+export const SSH_KEEPALIVE_COUNT_MAX = 3;
+/** `sshExec` keeps the last 64 KiB of each of stdout and stderr. */
+const SSH_OUTPUT_MAX_CHARS = 64 * 1024;
+// The timeout messages name the command or the file path and nothing else.
+// Every caller passes a fixed command or a fixed path (`calls-sfu.ts`,
+// `calls-sfu-ssh-adapter.ts`); the cloudflared token and the LiveKit keys
+// only ever travel as file contents, which are never named here.
+function sshExec(conn, command, timeoutMs = SSH_COMMAND_TIMEOUT_MS) {
     return new Promise((resolve, reject) => {
-        conn.exec(command, (err, stream) => {
-            if (err)
+        let stream;
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            stream?.close();
+            reject(new Error(`ssh command timed out after ${timeoutMs / 1000}s: ${command}`));
+        }, timeoutMs);
+        conn.exec(command, (err, execStream) => {
+            if (timedOut)
+                return execStream?.close();
+            if (err) {
+                clearTimeout(timer);
                 return reject(err);
+            }
+            stream = execStream;
             let stdout = '';
             let stderr = '';
-            stream.on('close', (code) => resolve({ exitCode: code ?? 0, stdout, stderr }));
+            stream.on('close', (code) => {
+                clearTimeout(timer);
+                resolve({ exitCode: code ?? 0, stdout, stderr });
+            });
+            stream.on('error', (streamErr) => {
+                clearTimeout(timer);
+                reject(streamErr);
+            });
             stream.on('data', (chunk) => {
-                stdout += chunk;
+                stdout = (stdout + chunk).slice(-SSH_OUTPUT_MAX_CHARS);
             });
             stream.stderr.on('data', (chunk) => {
-                stderr += chunk;
+                stderr = (stderr + chunk).slice(-SSH_OUTPUT_MAX_CHARS);
             });
         });
     });
 }
-function sshWriteFile(conn, path, contents, mode) {
+function sshWriteFile(conn, path, contents, mode, timeoutMs = SSH_WRITE_TIMEOUT_MS) {
     return new Promise((resolve, reject) => {
+        let session;
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            session?.end();
+            reject(new Error(`sftp write timed out after ${timeoutMs / 1000}s: ${path}`));
+        }, timeoutMs);
+        const settle = (err) => {
+            clearTimeout(timer);
+            if (err)
+                reject(err);
+            else
+                resolve();
+        };
         conn.sftp((err, sftp) => {
+            if (timedOut)
+                return sftp?.end();
             if (err)
-                return reject(err);
+                return settle(err);
+            session = sftp;
             sftp.writeFile(path, contents, mode ? { mode } : undefined, (writeErr) => {
                 if (writeErr)
-                    return reject(writeErr);
+                    return settle(writeErr);
                 // `mode` on writeFile only applies when the file is created; chmod
                 // repairs a file that already existed with looser permissions.
                 if (!mode)
-                    return resolve();
-                sftp.chmod(path, mode, (chmodErr) => (chmodErr ? reject(chmodErr) : resolve()));
+                    return settle();
+                sftp.chmod(path, mode, settle);
             });
         });
     });
@@ -64,6 +115,9 @@ export async function connectCallsSfuSsh(options, deps = {}) {
             port: options.sshPort,
             username: options.sshUser,
             privateKey: options.sshPrivateKey,
+            readyTimeout: SSH_READY_TIMEOUT_MS,
+            keepaliveInterval: SSH_KEEPALIVE_INTERVAL_MS,
+            keepaliveCountMax: SSH_KEEPALIVE_COUNT_MAX,
             // One argument: ssh2 treats the return value as the verdict.
             hostVerifier: (key) => {
                 hostKey = key;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
@@ -18,7 +18,7 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
-export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
+export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
@@ -33,14 +33,14 @@ export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './plan/index.js';
-export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export type { ZitadelListAppsRawApp } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
@@ -60,6 +60,8 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
+export type { OrgAppVersionRef, OrgAppVersionStatus, WtfalchPackageDrift, PlatformVersionStatus, ReadPlatformVersionStatusOptions, StatusCoolifyPort, StatusGithubPort, StatusGhExec, } from './plan/index.js';
+export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
 export type { RunnerDb } from './runner/db.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
@@ -19,11 +19,11 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
-export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
@@ -36,5 +36,6 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 // imports nothing else.
 export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
+export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';

package/dist/org.d.ts

@@ -843,3 +843,91 @@ export interface DeclaredOrg {
      */
     test: boolean;
 }
+/**
+ * The one Postgres server an org's own service schemas and roles live on
+ * (#444) — the settled replacement for today's one-container-per-service
+ * model: `plan/executor.ts`'s `coolifyDatabase` mints Archon's/lokessmie's
+ * own database, `ensureCmsDatabase` mints CMS's, and `ensureCallsDatabase`
+ * mints Boule's and chat's and calls' own Synapse, matrix-authentication-
+ * service and service databases, each as its own Coolify Postgres resource
+ * today. Not a field on {@link DeclaredOrg}: an operator never picks a
+ * server, the same way nobody picks an invited owner's ZITADEL user id
+ * (`plan/diff.ts`'s `planOwners`, idempotent on a *recorded* resource id
+ * rather than a declared field) — there is exactly one per org, and this is
+ * the single flat key it is recorded under once `plan/executor.ts`
+ * provisions it (444b). 444a (this slice) only ever reads this key through
+ * `recordedIds`; nothing here writes it.
+ */
+export declare const ORG_POSTGRES_SERVER_SCOPE_KEY = "org_postgres_server";
+/**
+ * One service's own slice of the org's shared Postgres server (#444): a
+ * dedicated schema, an owner role that runs its migrations and owns every
+ * object inside it, and a restricted runtime role the service's own app
+ * connects as day to day and cannot create or drop anything with. The `_rt`
+ * suffix on {@link OrgServiceSchema.runtimeRole} is the one this estate
+ * already uses for exactly this role, everywhere a service splits an owner
+ * connection from a runtime one — every `package-template`-descended repo's
+ * own `CLAUDE.md` names it "the runtime role `<database>_rt`" — just scoped
+ * to a schema instead of a whole database, now that several schemas share
+ * one server. `scopeKey` is where `plan/diff.ts` and, later, 444b's
+ * `plan/executor.ts` record the schema's existence, the same derived-lookup
+ * shape {@link OwnerMailbox.scopeKey} already uses: nothing here is itself
+ * stored, {@link ORG_SERVICE_SCHEMAS} is rebuilt fresh every time it is read.
+ *
+ * Every field below is the **target** name 444b provisions under, not what
+ * is live today: today there is no schema at all (each service gets its own
+ * whole database), its "owner" is really whatever superuser Coolify's
+ * database-creation call happened to name, and a database's role is scoped
+ * to that whole database, never to a schema within it. The live runtime
+ * role names already in production do not all match {@link runtimeRole}'s
+ * `<schema>_rt` shape either — CMS's does (`cms_rt`), but chat's own service
+ * connects as `chat_rt`, Boule as `<slug>_boule_db_rt`, and calls' own
+ * service as `<dbName>_rt`. 444b must not rename a role a password was
+ * already minted for; it maps each of these live names onto the matching
+ * target below rather than provisioning a second, differently-named role
+ * beside it.
+ */
+export interface OrgServiceSchema {
+    /** The service this schema belongs to, for a plan step's or an error's own wording — never part of an identifier. */
+    service: string;
+    /** The schema's target name on the org's one Postgres server. Unique by construction: {@link ORG_SERVICE_SCHEMAS} names each service's schema exactly once. */
+    schema: string;
+    /** The target role that owns {@link schema} and runs its migrations — this estate's `DATABASE_URL_OWNER` connection, scoped to one schema rather than a whole database. No live role matches this name yet (see this interface's own doc comment). */
+    ownerRole: string;
+    /** The target restricted role the service's own app connects as day to day — this estate's `DATABASE_URL` connection. Several services' live runtime roles already carry this exact name; others 444b must map onto it (see this interface's own doc comment). */
+    runtimeRole: string;
+    /** Where this schema's existence is recorded, once provisioned. */
+    scopeKey: string;
+}
+/**
+ * The full, fixed schema topology every org's shared Postgres server
+ * settles into (#444's acceptance: "the documented service schema/role
+ * descriptors") — not a per-org choice, so unlike {@link ownerMailboxes}
+ * this takes no `DeclaredOrg` at all. One entry per Postgres database
+ * `plan/executor.ts` mints today as its own container, confirmed by reading
+ * it rather than assumed from the issue or any triage comment: Boule's own
+ * (`coolifyBoule`'s `ensureCallsDatabase` call) and CMS's own
+ * (`ensureCmsDatabase`) are each one; chat's and calls' own Matrix stacks
+ * are each three — `coolifyChat`/`coolifyCalls` each mint a Synapse and a
+ * matrix-authentication-service database, and `coolifyChat`/
+ * `coolifyCallsService` each mint a third for the service app beside them
+ * — eight; plus the org's own app database, `coolifyDatabase`'s `<slug>-db`,
+ * for the one hosting entry that declares `database: true` (Archon's or
+ * lokessmie's own data) — nine in total.
+ *
+ * Boule's own entry is provisioned unconditionally — `validateHosting`
+ * already refuses an `issuerApps` entry named `boule` because "every org
+ * gets" one — so it, and this constant as a whole, name the *full* topology
+ * regardless of which feature switches are on, the same way `ORG_ENTRY_KEY`
+ * names `app` whether or not an org has one. Which of these schemas
+ * `plan/diff.ts`'s `planOrgPostgres` actually reports as missing on a given
+ * org is a narrower question than what this list contains — CMS's,
+ * chat's and calls' entries sit alongside their own feature's on/off switch
+ * ({@link SiteConfig.enabled}, {@link ChatConfig.enabled},
+ * {@link CallsConfig.enabled}) and the app entry beside whether any hosting
+ * entry declares `database: true`; `planOrgPostgres`'s own doc comment says
+ * which. A schema nothing needs yet simply is not reported missing, the
+ * same way an org with no app entry (foundry#447) has no app schema to
+ * create.
+ */
+export declare const ORG_SERVICE_SCHEMAS: readonly OrgServiceSchema[];

package/dist/org.js

@@ -930,3 +930,71 @@ export function validateMail(org, opts) {
     }
     return null;
 }
+/**
+ * The one Postgres server an org's own service schemas and roles live on
+ * (#444) — the settled replacement for today's one-container-per-service
+ * model: `plan/executor.ts`'s `coolifyDatabase` mints Archon's/lokessmie's
+ * own database, `ensureCmsDatabase` mints CMS's, and `ensureCallsDatabase`
+ * mints Boule's and chat's and calls' own Synapse, matrix-authentication-
+ * service and service databases, each as its own Coolify Postgres resource
+ * today. Not a field on {@link DeclaredOrg}: an operator never picks a
+ * server, the same way nobody picks an invited owner's ZITADEL user id
+ * (`plan/diff.ts`'s `planOwners`, idempotent on a *recorded* resource id
+ * rather than a declared field) — there is exactly one per org, and this is
+ * the single flat key it is recorded under once `plan/executor.ts`
+ * provisions it (444b). 444a (this slice) only ever reads this key through
+ * `recordedIds`; nothing here writes it.
+ */
+export const ORG_POSTGRES_SERVER_SCOPE_KEY = 'org_postgres_server';
+/** Builds one {@link OrgServiceSchema}: its owner role, runtime role and scope key all follow from {@link schema} alone, so every caller gets the same shape. */
+function orgServiceSchema(service, schema) {
+    return {
+        service,
+        schema,
+        ownerRole: `${schema}_owner`,
+        runtimeRole: `${schema}_rt`,
+        scopeKey: `org_postgres_schema.${schema}`,
+    };
+}
+/**
+ * The full, fixed schema topology every org's shared Postgres server
+ * settles into (#444's acceptance: "the documented service schema/role
+ * descriptors") — not a per-org choice, so unlike {@link ownerMailboxes}
+ * this takes no `DeclaredOrg` at all. One entry per Postgres database
+ * `plan/executor.ts` mints today as its own container, confirmed by reading
+ * it rather than assumed from the issue or any triage comment: Boule's own
+ * (`coolifyBoule`'s `ensureCallsDatabase` call) and CMS's own
+ * (`ensureCmsDatabase`) are each one; chat's and calls' own Matrix stacks
+ * are each three — `coolifyChat`/`coolifyCalls` each mint a Synapse and a
+ * matrix-authentication-service database, and `coolifyChat`/
+ * `coolifyCallsService` each mint a third for the service app beside them
+ * — eight; plus the org's own app database, `coolifyDatabase`'s `<slug>-db`,
+ * for the one hosting entry that declares `database: true` (Archon's or
+ * lokessmie's own data) — nine in total.
+ *
+ * Boule's own entry is provisioned unconditionally — `validateHosting`
+ * already refuses an `issuerApps` entry named `boule` because "every org
+ * gets" one — so it, and this constant as a whole, name the *full* topology
+ * regardless of which feature switches are on, the same way `ORG_ENTRY_KEY`
+ * names `app` whether or not an org has one. Which of these schemas
+ * `plan/diff.ts`'s `planOrgPostgres` actually reports as missing on a given
+ * org is a narrower question than what this list contains — CMS's,
+ * chat's and calls' entries sit alongside their own feature's on/off switch
+ * ({@link SiteConfig.enabled}, {@link ChatConfig.enabled},
+ * {@link CallsConfig.enabled}) and the app entry beside whether any hosting
+ * entry declares `database: true`; `planOrgPostgres`'s own doc comment says
+ * which. A schema nothing needs yet simply is not reported missing, the
+ * same way an org with no app entry (foundry#447) has no app schema to
+ * create.
+ */
+export const ORG_SERVICE_SCHEMAS = [
+    orgServiceSchema('Boule', 'boule'),
+    orgServiceSchema('CMS', 'cms'),
+    orgServiceSchema("chat's Synapse homeserver", 'chat_synapse'),
+    orgServiceSchema("chat's matrix-authentication-service", 'chat_mas'),
+    orgServiceSchema("chat's own service", 'chat_service'),
+    orgServiceSchema("calls' Synapse homeserver", 'calls_synapse'),
+    orgServiceSchema("calls' matrix-authentication-service", 'calls_mas'),
+    orgServiceSchema("calls' own service", 'calls_service'),
+    orgServiceSchema("the org's own app", 'app'),
+];

package/dist/plan/agora.d.ts

@@ -167,6 +167,19 @@ export declare const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_calls_
  */
 export declare const CHAT_INTROSPECTION_SCOPE_KEY = "zitadel_chat_introspection_app";
 export declare const CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_chat_introspection_undelivered";
+/**
+ * The one internal token per org that lets the calls service ask chat who is
+ * in a room: `CHAT_INTERNAL_TOKEN` on chat-service, `CALLS_CHAT_TOKEN` on the
+ * calls service (platform rule 1). The first holds the token's id once both
+ * apps carry it; the second is recorded and persisted before either does.
+ * The third is `<id> <chat address>`, recorded once both apps run with it. No
+ * `:` in any.
+ */
+export declare const CHAT_CALLS_TOKEN_SCOPE_KEY = "coolify_chat_calls_token";
+export declare const CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY = "coolify_chat_calls_token_undelivered";
+export declare const CHAT_CALLS_APPLIED_SCOPE_KEY = "coolify_chat_calls_applied";
+/** The value {@link CHAT_CALLS_APPLIED_SCOPE_KEY} holds once the token and address are live on both apps. */
+export declare function chatCallsApplied(tokenId: string, chatUrl: string): string;
 /** The chat service's introspection API app name; one per org, exact match only. */
 export declare function chatIntrospectionAppName(org: DeclaredOrg): string;
 /** What the plan hands the calls service step: the two host values the token env needs. */

package/dist/plan/agora.js

@@ -179,6 +179,21 @@ export const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_calls_introspe
  */
 export const CHAT_INTROSPECTION_SCOPE_KEY = 'zitadel_chat_introspection_app';
 export const CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_chat_introspection_undelivered';
+/**
+ * The one internal token per org that lets the calls service ask chat who is
+ * in a room: `CHAT_INTERNAL_TOKEN` on chat-service, `CALLS_CHAT_TOKEN` on the
+ * calls service (platform rule 1). The first holds the token's id once both
+ * apps carry it; the second is recorded and persisted before either does.
+ * The third is `<id> <chat address>`, recorded once both apps run with it. No
+ * `:` in any.
+ */
+export const CHAT_CALLS_TOKEN_SCOPE_KEY = 'coolify_chat_calls_token';
+export const CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY = 'coolify_chat_calls_token_undelivered';
+export const CHAT_CALLS_APPLIED_SCOPE_KEY = 'coolify_chat_calls_applied';
+/** The value {@link CHAT_CALLS_APPLIED_SCOPE_KEY} holds once the token and address are live on both apps. */
+export function chatCallsApplied(tokenId, chatUrl) {
+    return `${tokenId} ${chatUrl}`;
+}
 /** The chat service's introspection API app name; one per org, exact match only. */
 export function chatIntrospectionAppName(org) {
     return `chat-introspection-${org.slug}`;

package/dist/plan/boule.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg } from '../org.js';
+import { type DeclaredOrg } from '../org.js';
 import type { BrokerEntryInput, BrokerEntryWant } from './broker-entries.js';
 /**
  * #161 (Boule part): what both the planner (`diff.ts`) and the executor
@@ -36,8 +36,28 @@ export declare const BOULE_DEPLOYED_SCOPE_KEY = "coolify_boule_deployed";
  * issuer.
  */
 export declare function bouleHostnameFor(org: DeclaredOrg): string;
+/** The env name Boule reads its Lettermint token from (boule#266). */
+export declare const BOULE_MAIL_TOKEN_ENV = "LETTERMINT_API_TOKEN";
+/**
+ * Whether Boule should mail invites: the org's mail is hosted and
+ * `coolify:mail` has recorded its domain. Mail off, received, or no domain
+ * yet: no mail env at all, and Boule shows the invite link on screen.
+ */
+export declare function bouleMailWanted(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
+/**
+ * Boule's `MAIL_FROM`: the org's no-reply address on its recorded mail
+ * domain. The local part falls back to `DEFAULT_NO_REPLY_LOCAL_PART`, the
+ * same default the hosted app's `MAIL_FROM` uses and the store column holds.
+ */
+export declare function bouleMailFrom(org: DeclaredOrg, mailDomain: string): string;
+/**
+ * Whether the live Boule's mail token needs writing: it holds none, or the
+ * org's hosted app holds a different one (the app's token wins). Compares
+ * values in memory only; the result names nothing secret.
+ */
+export declare function bouleMailTokenDrift(liveToken: string | undefined, appToken: string | undefined): boolean;
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "ARCHON_URL"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a
@@ -55,11 +75,15 @@ export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER",
  * absent: Boule has no platform wired in every test and every org-only
  * caller, same as `issuer` before #177.
  *
+ * `mailWanted` (see {@link bouleMailWanted}) adds `MAIL_FROM`. The Lettermint
+ * token is never here: it is a secret the executor writes and the plan
+ * compares in memory ({@link bouleMailTokenDrift}).
+ *
  * Not here, and written by the executor instead: the database URLs
  * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
  * (generated once, never rotated).
  */
-export declare function desiredBouleEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null, archonUrl: string | null): {
+export declare function desiredBouleEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null, archonUrl: string | null, mailWanted?: boolean): {
     env: Record<string, string>;
     missing: string[];
 };

package/dist/plan/boule.js

@@ -1,3 +1,4 @@
+import { DEFAULT_NO_REPLY_LOCAL_PART } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 /**
  * #161 (Boule part): what both the planner (`diff.ts`) and the executor
@@ -37,6 +38,34 @@ export const BOULE_DEPLOYED_SCOPE_KEY = 'coolify_boule_deployed';
 export function bouleHostnameFor(org) {
     return org.domain ? `boule.${org.domain}` : `${org.slug}-boule.oikos.host`;
 }
+/** The env name Boule reads its Lettermint token from (boule#266). */
+export const BOULE_MAIL_TOKEN_ENV = 'LETTERMINT_API_TOKEN';
+/** The scope id `coolify:mail` records the org's resolved mail domain under. */
+const MAIL_DOMAIN_RECORDED_KEY = 'mail_domain';
+/**
+ * Whether Boule should mail invites: the org's mail is hosted and
+ * `coolify:mail` has recorded its domain. Mail off, received, or no domain
+ * yet: no mail env at all, and Boule shows the invite link on screen.
+ */
+export function bouleMailWanted(org, recorded) {
+    return org.mail.mode === 'hosted' && Boolean(recorded[MAIL_DOMAIN_RECORDED_KEY]);
+}
+/**
+ * Boule's `MAIL_FROM`: the org's no-reply address on its recorded mail
+ * domain. The local part falls back to `DEFAULT_NO_REPLY_LOCAL_PART`, the
+ * same default the hosted app's `MAIL_FROM` uses and the store column holds.
+ */
+export function bouleMailFrom(org, mailDomain) {
+    return `${org.mail.noReplyLocalPart || DEFAULT_NO_REPLY_LOCAL_PART}@${mailDomain}`;
+}
+/**
+ * Whether the live Boule's mail token needs writing: it holds none, or the
+ * org's hosted app holds a different one (the app's token wins). Compares
+ * values in memory only; the result names nothing secret.
+ */
+export function bouleMailTokenDrift(liveToken, appToken) {
+    return !liveToken || (Boolean(appToken) && appToken !== liveToken);
+}
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
 export const BOULE_MANAGED_ENV_KEYS = [
     'APP_URL',
@@ -46,6 +75,8 @@ export const BOULE_MANAGED_ENV_KEYS = [
     'BOULE_ORG_NAME',
     'AUTHZ_BOOTSTRAP_OPERATOR',
     'ARCHON_URL',
+    'MAIL_FROM',
+    BOULE_MAIL_TOKEN_ENV,
 ];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
@@ -64,11 +95,15 @@ export const BOULE_MANAGED_ENV_KEYS = [
  * absent: Boule has no platform wired in every test and every org-only
  * caller, same as `issuer` before #177.
  *
+ * `mailWanted` (see {@link bouleMailWanted}) adds `MAIL_FROM`. The Lettermint
+ * token is never here: it is a secret the executor writes and the plan
+ * compares in memory ({@link bouleMailTokenDrift}).
+ *
  * Not here, and written by the executor instead: the database URLs
  * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
  * (generated once, never rotated).
  */
-export function desiredBouleEnv(org, recorded, issuer, archonUrl) {
+export function desiredBouleEnv(org, recorded, issuer, archonUrl, mailWanted = false) {
     const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
     const clientId = recorded[BOULE_CLIENT_ID_SCOPE_KEY];
     const missing = [];
@@ -96,6 +131,9 @@ export function desiredBouleEnv(org, recorded, issuer, archonUrl) {
         : undefined;
     if (ownerUserId)
         env.AUTHZ_BOOTSTRAP_OPERATOR = ownerUserId;
+    const mailDomain = recorded[MAIL_DOMAIN_RECORDED_KEY];
+    if (mailWanted && mailDomain)
+        env.MAIL_FROM = bouleMailFrom(org, mailDomain);
     return { env, missing };
 }
 /** The `AUTH_APPS` name of an org's Boule broker entry, and the scope key suffix it records under. */

package/dist/plan/chat-matrix.d.ts

@@ -47,6 +47,20 @@ export declare function chatUpstreams(orgSlug: string): {
     matrix: string;
     mas: string;
 };
+/**
+ * Internal names for the org's re-keyed homeserver pair (#463, design note
+ * `docs/chat-rekey-design.md` Option 1): a second Synapse and MAS,
+ * provisioned beside the original pair under `chatInternalNames` so both
+ * ends of the copy are live at once. The chat service and its own database
+ * are never re-created — same app, repointed once the copy is done and the
+ * original pair is parked.
+ */
+export declare function chatRekeyedInternalNames(orgSlug: string): {
+    synapse: string;
+    mas: string;
+    synapseDb: string;
+    masDb: string;
+};
 /**
  * Never resolved by DNS and never federates; the identifier Synapse, MAS and
  * the chat service agree on. A level-1 org's chat lives on this name until a
@@ -54,13 +68,26 @@ export declare function chatUpstreams(orgSlug: string): {
  * not collide with a hostname some org owns.
  */
 export declare function chatServerName(orgSlug: string): string;
-/** The Matrix user the chat service acts as (`chat/apps/chat-service/src/workspace.ts`). */
-export declare function chatAdminUser(orgSlug: string): string;
+/**
+ * The Matrix user the chat service acts as
+ * (`chat/apps/chat-service/src/workspace.ts`). `serverName` defaults to the
+ * org's level-1 `chatServerName`; a re-key (#463) passes the new one so the
+ * gate module's `admin_user` matches the homeserver it is loaded into.
+ */
+export declare function chatAdminUser(orgSlug: string, serverName?: string): string;
+/** A re-key's `server_name` is a lowercase DNS name with at least two labels; anything else would be written into both configs. */
+export declare function assertChatServerName(serverName: string): void;
 export interface ChatSynapseHomeserverInput {
     orgSlug: string;
     db: CallsDbConnection;
     masHost: string;
     masSharedSecret: string;
+    /**
+     * #463: the `server_name` this homeserver answers to. Defaults to the
+     * org's level-1 `chatServerName` so every existing caller is unaffected;
+     * a re-key's new Synapse passes the org's own domain instead.
+     */
+    serverName?: string;
 }
 /** `homeserver.yaml`: federation off, presence on (stable Synapse features only -- no MSC3026 `busy`, foundry#41), MAS for auth, the chat gate module on. */
 export declare function chatSynapseHomeserverYaml(input: ChatSynapseHomeserverInput): string;
@@ -76,6 +103,8 @@ export interface ChatMasConfigInput {
     encryptionKey: string;
     rsaKeyPem: string;
     ecKeyPem: string;
+    /** #463: see {@link ChatSynapseHomeserverInput.serverName} -- the two must agree. */
+    serverName?: string;
 }
 /** MAS `config.yaml`: password login and registration off; the chat service is the one client, with admin. */
 export declare function chatMasConfigYaml(input: ChatMasConfigInput): string;