@wtfalch/foundry 0.29.0 → 0.30.0

package/dist/plan/diff.js

@@ -1,9 +1,9 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, } from '../org.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
-import { chatInternalNames } from './chat-matrix.js';
+import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
@@ -145,7 +145,12 @@ function liveResourceName(r) {
  * app-creating step below: {@link planLoginHost}, the org's own company
  * login host -- also idempotent on the *recorded* resource id, since
  * `live` has no notion of a ZITADEL trusted domain or a login binding
- * either. Everything
+ * either. #444a adds one more fact, in a different shape from every other
+ * addition here: {@link planOrgPostgres}, the org's one shared Postgres
+ * server plus whichever of `org.ts`'s `ORG_SERVICE_SCHEMAS` (nine today)
+ * this org actually runs and has not yet recorded -- idempotent on the
+ * *recorded* resource id like {@link planOwners}, but never folded into
+ * `plannedSteps`: its own {@link OrgPostgresPlan} field says why. Everything
  * else in `live` that none of these eighteen singletons and however many
  * declared issuer apps claim is unmanaged. The full field-by-field provisioning surface (SSO,
  * guests, calls on the org's own domain, adopted/bespoke apps, the actual
@@ -164,7 +169,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady, isPlatformOrg);
     if (issuer.step)
         plannedSteps.push(issuer.step);
-    plannedSteps.push(...planOwners(org, recordedIds, platformReadiness.authReady, 'error' in agoraHost ? null : agoraHost.issuer));
+    plannedSteps.push(...planOwners(org, recordedIds, platformReadiness.authReady, platformReadiness.authIssuer));
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
@@ -176,6 +181,11 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     platformAuthHostnameFrom('error' in agoraHost ? null : agoraHost.issuer), isPlatformOrg);
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
+    // #444a: the org's one shared Postgres server and its fixed schema
+    // topology -- dependent on nothing else planned here, but its own
+    // `OrgPostgresPlan`, never `plannedSteps` ({@link OrgPostgresPlan}'s own
+    // doc comment says why).
+    const orgPostgres = planOrgPostgres(org, recordedIds);
     // Planned ahead of everything that needs the zone live (#238); its own step
     // is pushed just below, before mail.
     const zone = planZone(org, byKey, claimed);
@@ -230,6 +240,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         : callsTokenHostFrom(withRecordedMessagingProject(agoraHost, recordedIds)));
     if (callsService.step)
         plannedSteps.push(callsService.step);
+    // After both apps it writes to: chat's token and the calls service's chat address.
+    const callsChat = planCallsChat(org, recordedIds, chat.step !== null || callsService.step !== null, chat.blocked !== null || calls.blocked !== null || callsService.blocked !== null);
+    if (callsChat.step)
+        plannedSteps.push(callsChat.step);
     // #251: same mechanism as the platform's own version-change lines -- see
     // `planPlatform`'s own block in `platform-diff.ts`. Synapse and MAS never
     // patch a running app's image tag once created, so this is
@@ -507,6 +521,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         unmanaged.push({ description: calls.blocked, key: 'coolify:calls' });
     if (chat.blocked)
         unmanaged.push({ description: chat.blocked, key: 'coolify:chat' });
+    if (callsChat.blocked) {
+        unmanaged.push({ description: callsChat.blocked, key: 'coolify:calls-chat' });
+    }
     if (callsService.blocked) {
         unmanaged.push({ description: callsService.blocked, key: 'coolify:calls-service' });
     }
@@ -541,6 +558,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         plannedSteps: plannedSteps.map(withStepSystem),
         unmanaged,
         versionChanges,
+        orgPostgres,
     };
 }
 /**
@@ -641,12 +659,20 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
         };
     }
     claimed.add(key);
+    // #517: both sides on the domain says nothing about which domain. The live
+    // issuer's recorded host differing from the declared domain's login host is
+    // a domain change, and moves the issuer too.
+    const liveHost = typeof live.config.host === 'string' ? live.config.host : null;
+    const domainMoved = Boolean(live.config.usesDomain) &&
+        desiredUsesDomain &&
+        Boolean(org.domain) &&
+        liveHost !== null &&
+        liveHost !== loginHostnameFor(org);
     // The platform's own org already signs in on the shared host: no move. A
-    // live issuer that does not say (the reader never does: foundry v1 never
-    // moves one) is not read as a different one either.
+    // live issuer that does not say is not read as a different one either.
     if (isPlatformOrg ||
         live.config.usesDomain === undefined ||
-        Boolean(live.config.usesDomain) === desiredUsesDomain) {
+        (Boolean(live.config.usesDomain) === desiredUsesDomain && !domainMoved)) {
         return { step: null, blocked: null };
     }
     const domain = org.domain ?? 'the org domain';
@@ -925,6 +951,50 @@ function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned)
     }
     return null;
 }
+/**
+ * Whether `org` runs the service {@link schema} belongs to, so
+ * {@link planOrgPostgres} reports a schema missing only once the org would
+ * actually need it -- CMS's, chat's and calls' entries follow their own
+ * on/off switch, the same ones this file already gates their own
+ * `coolify:*` steps on (`org.ts`'s `SiteConfig.enabled`, `ChatConfig.enabled`,
+ * `CallsConfig.enabled`); Boule's is unconditional, matching `org.ts`'s own
+ * "every org gets one" rule; the app schema follows whether any
+ * `hosting.entries` entry declares `database: true` (`coolifyDatabase`'s own
+ * gate) rather than `hosting.enabled` alone, since a hosting org with no
+ * database-bearing entry has nothing for this schema to hold.
+ */
+function orgServiceSchemaEnabled(org, schema) {
+    if (schema.schema === 'cms')
+        return org.site.enabled;
+    if (schema.schema.startsWith('chat_'))
+        return org.chat.enabled;
+    if (schema.schema.startsWith('calls_'))
+        return org.calls.enabled;
+    if (schema.schema === 'app')
+        return org.hosting.entries.some((entry) => entry.database);
+    return true;
+}
+/**
+ * #444a: reports the org's one shared Postgres server as missing until
+ * `recordedIds` says otherwise, and its fixed schema topology as missing for
+ * whichever schemas this org actually runs and has not yet recorded (see
+ * {@link orgServiceSchemaEnabled}) -- see {@link OrgPostgresPlan}'s own doc
+ * comment for why this is a `PlanDetail` field rather than `plannedSteps`
+ * entries. Nothing here is ever blocked (rule 2 does not apply: unlike chat
+ * or calls, the server and its schemas need no issuer, no ZITADEL org and no
+ * platform readiness to exist), and the server being missing never gates a
+ * schema being reported missing too -- a fresh org with every feature on
+ * reports both the same way #444a's own acceptance line asks for ("a fresh
+ * org plans one server and N schemas"), since nothing here actually depends
+ * on the server existing yet; that ordering is 444b's concern, once
+ * `plan/executor.ts` has something to run.
+ */
+function planOrgPostgres(org, recordedIds) {
+    return {
+        serverMissing: !recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY],
+        missingSchemas: ORG_SERVICE_SCHEMAS.filter((schema) => orgServiceSchemaEnabled(org, schema) && !recordedIds[schema.scopeKey]),
+    };
+}
 /** #230: restated from `executor.ts`'s `MAIL_ROLE_MAILBOXES_SCOPE_KEY`, same rule: comma-joined local parts already created. */
 const MAIL_ROLE_MAILBOXES_SCOPE_KEY = 'mail_role_mailboxes';
 /** Restated from `executor.ts`, the same rule: the app id of the org tunnel's cloudflared connector. */
@@ -1260,13 +1330,22 @@ function planChat(org, byKey, claimed, recordedIds, reading, issuerPlanned) {
         }
         return none;
     }
-    const domain = org.domain ?? 'its domain';
     if (!liveUsesDomain && desiredUsesDomain) {
+        // #463: `usesDomain` is never fired by `domain` alone (#7 amendment 1),
+        // but it can still be turned on with no domain recorded -- the step
+        // itself has nowhere to re-key onto, so this is blocked rather than
+        // planned (rule 2), not left for `coolifyChatRekey` to throw on.
+        if (!org.domain) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s chat is blocked, not planned: usesDomain is on but the org has no domain to re-key onto`,
+            };
+        }
         return {
             step: {
                 action: { system: 'coolify', kind: 'chat', key: org.id, desired: { usesDomain: true } },
                 step: {
-                    description: `re-key ${org.slug}'s chat onto ${domain}, copying rooms and messages so history reads continuous`,
+                    description: `re-key ${org.slug}'s chat onto ${org.domain}, copying rooms and messages so history reads continuous`,
                     destroys: true,
                     migrates: true,
                 },
@@ -1431,6 +1510,79 @@ function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlo
     }
     return { step: null, blocked: null };
 }
+/**
+ * The token that lets the org's calls service ask its chat who is in a room
+ * (`executor.ts`'s `coolifyCallsChat`). Chat off: nothing, unless the calls
+ * service still carries the address, which is then removed so it does not
+ * point at a chat that is gone. Both on: planned until the token is delivered
+ * and both apps run with it, also for an org whose chat and calls service
+ * already exist. An undelivered token is reported, never minted again (rule 1).
+ * Silent while chat or the calls service is itself planned or blocked: they
+ * report their own.
+ */
+function planCallsChat(org, recordedIds, upstreamPlanned, upstreamBlocked) {
+    const none = { step: null, blocked: null };
+    if (!org.calls.enabled)
+        return none;
+    const action = (desired) => ({
+        system: 'coolify',
+        kind: 'calls-chat',
+        key: org.id,
+        desired,
+    });
+    const callsServiceId = recordedIds[`coolify:calls-service:${org.id}`];
+    if (!org.chat.enabled) {
+        if (!callsServiceId || !recordedIds[CHAT_CALLS_APPLIED_SCOPE_KEY])
+            return none;
+        return {
+            step: {
+                action: action({ remove: true }),
+                step: {
+                    description: `remove the chat address and token from ${org.slug}'s calls service (chat is off) and restart it`,
+                    destroys: false,
+                    migrates: false,
+                },
+            },
+            blocked: null,
+        };
+    }
+    const tokenId = recordedIds[CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY];
+    if (tokenId && !recordedIds[CHAT_CALLS_TOKEN_SCOPE_KEY]) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls-to-chat token is blocked, not planned: token ${tokenId} was minted but never written to both apps; remove the recorded key ${CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY} to write it again (chat-service's copy is reused, none is minted)`,
+        };
+    }
+    const guard = recordedIds[CHAT_CALLS_TOKEN_SCOPE_KEY];
+    if (guard &&
+        recordedIds[CHAT_CALLS_APPLIED_SCOPE_KEY] ===
+            chatCallsApplied(guard, chatUpstreams(org.slug).chat)) {
+        return none;
+    }
+    const ready = chatHasUpstreams(org, recordedIds) &&
+        callsServiceId &&
+        callsServiceHasName(org, recordedIds) &&
+        recordedIds[CALLS_SERVICE_DEPLOYED_SCOPE_KEY];
+    if (!ready && upstreamBlocked)
+        return none;
+    if (!ready && !upstreamPlanned) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls-to-chat token is blocked, not planned: chat or the calls service is not provisioned yet (apply them first)`,
+        };
+    }
+    return {
+        step: {
+            action: action({}),
+            step: {
+                description: `give ${org.slug}'s chat service and calls service one internal token, point the calls service at chat, and redeploy both`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
 /**
  * Deduped `ai.*` permissions offered to every organisation by default
  * (Decision, this campaign's report): the minimum set that lets an org

package/dist/plan/executor.d.ts

@@ -712,6 +712,39 @@ export interface CallsSfuPort {
         apiSecret: string;
     } | null>;
 }
+/**
+ * #463: the cross-homeserver copy chat's forward re-key needs (design note,
+ * `docs/chat-rekey-design.md`, Option 1) -- copies every room, member and
+ * message from the org's platform-named homeserver onto its newly
+ * provisioned, domain-named one, inviting members under their new ids, so
+ * history reads continuous once the chat service is repointed
+ * (`coolifyChatRekey`).
+ *
+ * Optional on {@link FoundryStepExecutorPorts}, the same shape as
+ * `jobsScheduler`/`edge`/`mailCopy`: nothing in the estate has proven this
+ * mechanism against a real Synapse and MAS pair yet (issue #463's own Human
+ * step), so a host without one builds the executor without it and
+ * `coolify:chat`'s forward re-key throws `NotBuiltError` naming the gap,
+ * rather than running a copy nobody has watched work.
+ *
+ * Idempotent by `fromServerName`/`toServerName`: a room or message the
+ * implementation already copied for this pair is skipped, so a retried or
+ * resumed copy never duplicates history. Never returns or throws a secret,
+ * token or credential -- same rule as every other port here.
+ */
+export interface ChatRekeyPort {
+    copyHomeserver(input: {
+        orgSlug: string;
+        fromServerName: string;
+        fromInternalHost: string;
+        toServerName: string;
+        toInternalHost: string;
+        /** Aborted when foundry stops waiting for the copy. */
+        signal: AbortSignal;
+    }): Promise<{
+        roomsCopied: number;
+    }>;
+}
 /**
  * The ZITADEL calls this executor makes. `findOrCreateOrg`/`findOrCreateProject`
  * already exist on `@wtfalch/providers/zitadel`'s `ZitadelClient` (returning
@@ -871,6 +904,16 @@ export interface ZitadelPort {
     allowSelfRegistration(orgId: string): Promise<{
         changed: boolean;
     }>;
+    /**
+     * Forces the org's login policy to `allowRegister: false`, writing the org
+     * its own policy even when it only inherits the instance default.
+     * Idempotent: a custom policy that already forbids registration is no
+     * write. `@wtfalch/providers` can only turn registration on, so
+     * `zitadel-login-policy.ts` is the real implementation.
+     */
+    closeSelfRegistration(orgId: string): Promise<{
+        changed: boolean;
+    }>;
     /** Grants another ZITADEL org access to a project (plan gap A9). Idempotent. */
     findOrCreateProjectGrant(orgId: string, projectId: string, grantedOrgId: string): Promise<{
         created: boolean;
@@ -1010,6 +1053,14 @@ export interface ZitadelPort {
      * the binding holds; `zitadelApp` never sets it at creation.
      */
     updateOidcAppLoginBaseUri(orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;
+    /**
+     * Occupies `userName` in `orgId` with a machine user that has no role and
+     * no token, so nobody can register under that name. Idempotent: a user
+     * already holding the name, however it was made, is returned unchanged.
+     */
+    reserveUserName(orgId: string, userName: string): Promise<{
+        userId: string;
+    }>;
     /**
      * Switches on "user info inside the ID token" for an already-created app,
      * read-modify-write (`@wtfalch/providers`' `ZitadelClient.
@@ -1405,6 +1456,13 @@ export interface FoundryStepExecutorPorts {
      * compilation over one dependency nothing else needs.
      */
     mailCopy?: MailCopyPort;
+    /**
+     * #463: the cross-homeserver copy chat's forward re-key needs -- see
+     * {@link ChatRekeyPort}'s own doc comment. Optional the same way
+     * `mailCopy` is: without it `coolify:chat`'s forward re-key throws
+     * `NotBuiltError` naming the gap instead of running an unproven copy.
+     */
+    chatRekey?: ChatRekeyPort;
     /** Flat, not a factory: `organisationId` is an explicit argument on every method of both ports (see each port's own doc comment; #177 dropped the `filesLimitsFor`/`aiLimitsFor` factories this used to need). */
     filesOrganisation?: FilesOrganisationPort;
     aiOrganisation?: AiOrganisationPort;
@@ -2338,6 +2396,26 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * No secret reaches an error: errors name the org and the missing input only.
      */
     private coolifyChat;
+    /**
+     * `coolifyChat`'s forward re-key (#463, design note
+     * `docs/chat-rekey-design.md` Option 1): a live chat recorded, and
+     * `org.chat.usesDomain` flipped on. Provisions a second Synapse+MAS pair
+     * named for the org's own domain (`chatRekeyedInternalNames`), copies
+     * every room, member and message across through
+     * {@link FoundryStepExecutorPorts.chatRekey}, repoints the existing chat
+     * service at the new pair, and parks -- never deletes, so a stalled
+     * migration can be rolled back by simply restarting them -- the original
+     * Synapse and MAS apps. The chat service and its own database are never
+     * re-created; only the Matrix half of the stack moves.
+     *
+     * Idempotent on recorded ids: new resources are found by name before they
+     * are created, the new MAS's secrets are read back from its own envs, and
+     * the copy, the repoint and the park each run once
+     * ({@link CHAT_REKEY_COPIED_SCOPE_KEY}, {@link CHAT_REKEY_REPOINTED_SCOPE_KEY}).
+     * The original pair keeps serving until the chat service is healthy on the
+     * new one; a failure before that leaves it running.
+     */
+    private coolifyChatRekey;
     /**
      * `plan/diff.ts`'s `planCallsService`: the org's own calls service --
      * `wtfalch/calls`'s `packages/service`, wired to the calls Matrix stack
@@ -2352,6 +2430,21 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * 1); its own database is never touched from that branch.
      */
     private coolifyCallsService;
+    /**
+     * `plan/diff.ts`'s `planCallsChat`: the one internal token that lets the
+     * calls service ask chat who is in a room, and the chat address. The token
+     * is `CHAT_INTERNAL_TOKEN` on chat-service and `CALLS_CHAT_TOKEN` on the
+     * calls service, which gets `CALLS_CHAT_URL` in the same write: it refuses
+     * to boot on one without the other. Chat-service's env is the only memory
+     * of the token across a run, the way {@link ensureCallsMatrixSecrets} keeps
+     * the MAS secrets on the MAS app, so it is generated only when that env has
+     * none. Its id is recorded and persisted before either app holds it, and the
+     * guard after both do (platform rule 1). Both apps are redeployed last; the
+     * applied marker is recorded after that, so a run that fails in between is
+     * planned and finished again. `remove` (chat is off) deletes both vars from
+     * the calls service and restarts it.
+     */
+    private coolifyCallsChat;
     /**
      * The seven ZITADEL token env vars the calls service needs to accept
      * Agora's sign-in token (`calls/docs/member-auth.md`). Only called with all