@wtfalch/foundry 0.28.0 → 0.30.0

package/dist/plan/executor.d.ts

@@ -712,6 +712,39 @@ export interface CallsSfuPort {
         apiSecret: string;
     } | null>;
 }
+/**
+ * #463: the cross-homeserver copy chat's forward re-key needs (design note,
+ * `docs/chat-rekey-design.md`, Option 1) -- copies every room, member and
+ * message from the org's platform-named homeserver onto its newly
+ * provisioned, domain-named one, inviting members under their new ids, so
+ * history reads continuous once the chat service is repointed
+ * (`coolifyChatRekey`).
+ *
+ * Optional on {@link FoundryStepExecutorPorts}, the same shape as
+ * `jobsScheduler`/`edge`/`mailCopy`: nothing in the estate has proven this
+ * mechanism against a real Synapse and MAS pair yet (issue #463's own Human
+ * step), so a host without one builds the executor without it and
+ * `coolify:chat`'s forward re-key throws `NotBuiltError` naming the gap,
+ * rather than running a copy nobody has watched work.
+ *
+ * Idempotent by `fromServerName`/`toServerName`: a room or message the
+ * implementation already copied for this pair is skipped, so a retried or
+ * resumed copy never duplicates history. Never returns or throws a secret,
+ * token or credential -- same rule as every other port here.
+ */
+export interface ChatRekeyPort {
+    copyHomeserver(input: {
+        orgSlug: string;
+        fromServerName: string;
+        fromInternalHost: string;
+        toServerName: string;
+        toInternalHost: string;
+        /** Aborted when foundry stops waiting for the copy. */
+        signal: AbortSignal;
+    }): Promise<{
+        roomsCopied: number;
+    }>;
+}
 /**
  * The ZITADEL calls this executor makes. `findOrCreateOrg`/`findOrCreateProject`
  * already exist on `@wtfalch/providers/zitadel`'s `ZitadelClient` (returning
@@ -871,6 +904,16 @@ export interface ZitadelPort {
     allowSelfRegistration(orgId: string): Promise<{
         changed: boolean;
     }>;
+    /**
+     * Forces the org's login policy to `allowRegister: false`, writing the org
+     * its own policy even when it only inherits the instance default.
+     * Idempotent: a custom policy that already forbids registration is no
+     * write. `@wtfalch/providers` can only turn registration on, so
+     * `zitadel-login-policy.ts` is the real implementation.
+     */
+    closeSelfRegistration(orgId: string): Promise<{
+        changed: boolean;
+    }>;
     /** Grants another ZITADEL org access to a project (plan gap A9). Idempotent. */
     findOrCreateProjectGrant(orgId: string, projectId: string, grantedOrgId: string): Promise<{
         created: boolean;
@@ -1010,6 +1053,14 @@ export interface ZitadelPort {
      * the binding holds; `zitadelApp` never sets it at creation.
      */
     updateOidcAppLoginBaseUri(orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;
+    /**
+     * Occupies `userName` in `orgId` with a machine user that has no role and
+     * no token, so nobody can register under that name. Idempotent: a user
+     * already holding the name, however it was made, is returned unchanged.
+     */
+    reserveUserName(orgId: string, userName: string): Promise<{
+        userId: string;
+    }>;
     /**
      * Switches on "user info inside the ID token" for an already-created app,
      * read-modify-write (`@wtfalch/providers`' `ZitadelClient.
@@ -1405,6 +1456,13 @@ export interface FoundryStepExecutorPorts {
      * compilation over one dependency nothing else needs.
      */
     mailCopy?: MailCopyPort;
+    /**
+     * #463: the cross-homeserver copy chat's forward re-key needs -- see
+     * {@link ChatRekeyPort}'s own doc comment. Optional the same way
+     * `mailCopy` is: without it `coolify:chat`'s forward re-key throws
+     * `NotBuiltError` naming the gap instead of running an unproven copy.
+     */
+    chatRekey?: ChatRekeyPort;
     /** Flat, not a factory: `organisationId` is an explicit argument on every method of both ports (see each port's own doc comment; #177 dropped the `filesLimitsFor`/`aiLimitsFor` factories this used to need). */
     filesOrganisation?: FilesOrganisationPort;
     aiOrganisation?: AiOrganisationPort;
@@ -1957,6 +2015,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * domain restricted to them before any old project is deleted, so the
      * restriction list never becomes empty.
      *
+     * #654: the non-platform-apex part now lives in {@link ensureOrgAppMailToken},
+     * shared with Boule, which holds the same token; the rule below is its rule
+     * with the consumers read from the hosted app and Boule.
+     *
      * Mint rule ("Credential model"): the project is healthy when the app env
      * holds `LETTERMINT_API_TOKEN` and Lettermint lists exactly one project
      * named `<slug>-app` -- unlike the earlier provider's key, a Lettermint project's name
@@ -2003,6 +2065,31 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * this field existed (review round 2, finding 3).
      */
     private ensureAppLettermintMail;
+    /**
+     * The one mint rule for the org's `<slug>-app` Lettermint token, shared by
+     * the hosted app (`ensureAppLettermintMail`) and Boule
+     * (`ensureBouleMail`), which hold the same token. Lettermint shows a
+     * token once, so the token lives only in those apps' envs: the rule reads
+     * every consumer that is recorded (the hosted app first, Boule second).
+     * The project is healthy when Lettermint lists exactly one `<slug>-app`
+     * project and some consumer holds a token. A healthy rule gives `self` that
+     * token (the app's wins) when it lacks it or holds another; a peer gets it
+     * in its own step. An
+     * unhealthy one mints a fresh project and writes its token to every
+     * consumer, restarting those that run, before any other `<slug>-app`
+     * project is deleted. Either role may run first: an app added after Boule
+     * adopts Boule's token instead of deleting its project.
+     *
+     * The token goes straight to `bulkUpsertEnvs` and nowhere else: never
+     * returned, recorded, logged or interpolated into an error. Returns
+     * whether `self`'s own token changed and whether it was restarted here.
+     *
+     * A peer recorded but gone from Coolify (404) is no consumer. A healthy
+     * company's step writes only its own env; a re-mint writes every live
+     * consumer, restarts the running ones, restricts the domain, then deletes
+     * the old projects.
+     */
+    private ensureOrgAppMailToken;
     /**
      * #149: mints this org's own Lettermint relay credential and writes it to
      * Stalwart via `MailPort.applyOrgRelay`, the same mint rule
@@ -2309,6 +2396,26 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * No secret reaches an error: errors name the org and the missing input only.
      */
     private coolifyChat;
+    /**
+     * `coolifyChat`'s forward re-key (#463, design note
+     * `docs/chat-rekey-design.md` Option 1): a live chat recorded, and
+     * `org.chat.usesDomain` flipped on. Provisions a second Synapse+MAS pair
+     * named for the org's own domain (`chatRekeyedInternalNames`), copies
+     * every room, member and message across through
+     * {@link FoundryStepExecutorPorts.chatRekey}, repoints the existing chat
+     * service at the new pair, and parks -- never deletes, so a stalled
+     * migration can be rolled back by simply restarting them -- the original
+     * Synapse and MAS apps. The chat service and its own database are never
+     * re-created; only the Matrix half of the stack moves.
+     *
+     * Idempotent on recorded ids: new resources are found by name before they
+     * are created, the new MAS's secrets are read back from its own envs, and
+     * the copy, the repoint and the park each run once
+     * ({@link CHAT_REKEY_COPIED_SCOPE_KEY}, {@link CHAT_REKEY_REPOINTED_SCOPE_KEY}).
+     * The original pair keeps serving until the chat service is healthy on the
+     * new one; a failure before that leaves it running.
+     */
+    private coolifyChatRekey;
     /**
      * `plan/diff.ts`'s `planCallsService`: the org's own calls service --
      * `wtfalch/calls`'s `packages/service`, wired to the calls Matrix stack
@@ -2323,6 +2430,21 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * 1); its own database is never touched from that branch.
      */
     private coolifyCallsService;
+    /**
+     * `plan/diff.ts`'s `planCallsChat`: the one internal token that lets the
+     * calls service ask chat who is in a room, and the chat address. The token
+     * is `CHAT_INTERNAL_TOKEN` on chat-service and `CALLS_CHAT_TOKEN` on the
+     * calls service, which gets `CALLS_CHAT_URL` in the same write: it refuses
+     * to boot on one without the other. Chat-service's env is the only memory
+     * of the token across a run, the way {@link ensureCallsMatrixSecrets} keeps
+     * the MAS secrets on the MAS app, so it is generated only when that env has
+     * none. Its id is recorded and persisted before either app holds it, and the
+     * guard after both do (platform rule 1). Both apps are redeployed last; the
+     * applied marker is recorded after that, so a run that fails in between is
+     * planned and finished again. `remove` (chat is off) deletes both vars from
+     * the calls service and restarts it.
+     */
+    private coolifyCallsChat;
     /**
      * The seven ZITADEL token env vars the calls service needs to accept
      * Agora's sign-in token (`calls/docs/member-auth.md`). Only called with all
@@ -2443,6 +2565,16 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * shape {@link coolifyAgora}'s own doc comment explains.
      */
     private coolifyBoule;
+    /**
+     * Gives Boule `LETTERMINT_API_TOKEN`: the platform's held key for an org on
+     * the platform's own apex, else the org's `<slug>-app` token through the
+     * shared mint rule ({@link ensureOrgAppMailToken}), which mints that project
+     * when no hosted app made it yet. `MAIL_FROM` is written with the rest of
+     * Boule's env. Returns whether Boule's token changed, so the caller
+     * restarts a running Boule, unless `restarted`: the shared rule then already
+     * restarted it (`running`), before it deleted the old project.
+     */
+    private ensureBouleMail;
     /**
      * `plan/diff.ts`'s `planJobsRegistration`: registers the org's own app with
      * the platform's jobs scheduler (`JobsSchedulerPort.registerProject`, the