@wtfalch/foundry 0.29.0 → 0.31.0

package/dist/calls-sfu-ssh-client.d.ts

@@ -18,12 +18,14 @@ interface SshStream {
     stderr: {
         on(event: string, listener: (...args: never[]) => void): unknown;
     };
+    close(): void;
 }
 interface SshSftp {
     writeFile(path: string, contents: string, options: {
         mode: number;
     } | undefined, cb: (err?: Error | null) => void): void;
     chmod(path: string, mode: number, cb: (err?: Error | null) => void): void;
+    end(): void;
 }
 interface SshClient {
     on(event: string, listener: (...args: never[]) => void): SshClient;
@@ -41,6 +43,15 @@ export interface CallsSfuSshConnectOptions {
     /** `SHA256:...`. Without it every host key is refused. */
     sshHostFingerprint: string | undefined;
 }
+/** `docker compose up -d` pulls images, so a command gets two minutes. */
+export declare const SSH_COMMAND_TIMEOUT_MS = 120000;
+/** One SFTP write (open, write, chmod) of a small config file. */
+export declare const SSH_WRITE_TIMEOUT_MS = 30000;
+/** Handshake limit; ssh2's default is 20 s, set here so it is explicit. */
+export declare const SSH_READY_TIMEOUT_MS = 20000;
+/** A dead link ends the session after 3 missed keepalives, 10 s apart. */
+export declare const SSH_KEEPALIVE_INTERVAL_MS = 10000;
+export declare const SSH_KEEPALIVE_COUNT_MAX = 3;
 export declare function connectCallsSfuSsh(options: CallsSfuSshConnectOptions, deps?: {
     Client?: SshClientConstructor;
 }): Promise<CallsSfuSshSession & {

package/dist/calls-sfu-ssh-client.js

@@ -13,36 +13,87 @@
  * hands in a fake and never opens a socket.
  */
 import { verifyHostKey } from './calls-sfu-deploy-support.js';
-function sshExec(conn, command) {
+/** `docker compose up -d` pulls images, so a command gets two minutes. */
+export const SSH_COMMAND_TIMEOUT_MS = 120_000;
+/** One SFTP write (open, write, chmod) of a small config file. */
+export const SSH_WRITE_TIMEOUT_MS = 30_000;
+/** Handshake limit; ssh2's default is 20 s, set here so it is explicit. */
+export const SSH_READY_TIMEOUT_MS = 20_000;
+/** A dead link ends the session after 3 missed keepalives, 10 s apart. */
+export const SSH_KEEPALIVE_INTERVAL_MS = 10_000;
+export const SSH_KEEPALIVE_COUNT_MAX = 3;
+/** `sshExec` keeps the last 64 KiB of each of stdout and stderr. */
+const SSH_OUTPUT_MAX_CHARS = 64 * 1024;
+// The timeout messages name the command or the file path and nothing else.
+// Every caller passes a fixed command or a fixed path (`calls-sfu.ts`,
+// `calls-sfu-ssh-adapter.ts`); the cloudflared token and the LiveKit keys
+// only ever travel as file contents, which are never named here.
+function sshExec(conn, command, timeoutMs = SSH_COMMAND_TIMEOUT_MS) {
     return new Promise((resolve, reject) => {
-        conn.exec(command, (err, stream) => {
-            if (err)
+        let stream;
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            stream?.close();
+            reject(new Error(`ssh command timed out after ${timeoutMs / 1000}s: ${command}`));
+        }, timeoutMs);
+        conn.exec(command, (err, execStream) => {
+            if (timedOut)
+                return execStream?.close();
+            if (err) {
+                clearTimeout(timer);
                 return reject(err);
+            }
+            stream = execStream;
             let stdout = '';
             let stderr = '';
-            stream.on('close', (code) => resolve({ exitCode: code ?? 0, stdout, stderr }));
+            stream.on('close', (code) => {
+                clearTimeout(timer);
+                resolve({ exitCode: code ?? 0, stdout, stderr });
+            });
+            stream.on('error', (streamErr) => {
+                clearTimeout(timer);
+                reject(streamErr);
+            });
             stream.on('data', (chunk) => {
-                stdout += chunk;
+                stdout = (stdout + chunk).slice(-SSH_OUTPUT_MAX_CHARS);
             });
             stream.stderr.on('data', (chunk) => {
-                stderr += chunk;
+                stderr = (stderr + chunk).slice(-SSH_OUTPUT_MAX_CHARS);
             });
         });
     });
 }
-function sshWriteFile(conn, path, contents, mode) {
+function sshWriteFile(conn, path, contents, mode, timeoutMs = SSH_WRITE_TIMEOUT_MS) {
     return new Promise((resolve, reject) => {
+        let session;
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            session?.end();
+            reject(new Error(`sftp write timed out after ${timeoutMs / 1000}s: ${path}`));
+        }, timeoutMs);
+        const settle = (err) => {
+            clearTimeout(timer);
+            if (err)
+                reject(err);
+            else
+                resolve();
+        };
         conn.sftp((err, sftp) => {
+            if (timedOut)
+                return sftp?.end();
             if (err)
-                return reject(err);
+                return settle(err);
+            session = sftp;
             sftp.writeFile(path, contents, mode ? { mode } : undefined, (writeErr) => {
                 if (writeErr)
-                    return reject(writeErr);
+                    return settle(writeErr);
                 // `mode` on writeFile only applies when the file is created; chmod
                 // repairs a file that already existed with looser permissions.
                 if (!mode)
-                    return resolve();
-                sftp.chmod(path, mode, (chmodErr) => (chmodErr ? reject(chmodErr) : resolve()));
+                    return settle();
+                sftp.chmod(path, mode, settle);
             });
         });
     });
@@ -64,6 +115,9 @@ export async function connectCallsSfuSsh(options, deps = {}) {
             port: options.sshPort,
             username: options.sshUser,
             privateKey: options.sshPrivateKey,
+            readyTimeout: SSH_READY_TIMEOUT_MS,
+            keepaliveInterval: SSH_KEEPALIVE_INTERVAL_MS,
+            keepaliveCountMax: SSH_KEEPALIVE_COUNT_MAX,
             // One argument: ssh2 treats the return value as the verdict.
             hostVerifier: (key) => {
                 hostKey = key;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
@@ -18,7 +18,7 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
-export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
+export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
@@ -33,14 +33,14 @@ export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './plan/index.js';
-export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export type { ZitadelListAppsRawApp } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
@@ -60,6 +60,8 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
+export type { OrgAppVersionRef, OrgAppVersionStatus, WtfalchPackageDrift, PlatformVersionStatus, ReadPlatformVersionStatusOptions, StatusCoolifyPort, StatusGithubPort, StatusGhExec, } from './plan/index.js';
+export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
 export type { RunnerDb } from './runner/db.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
@@ -19,11 +19,11 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
-export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
@@ -36,5 +36,6 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 // imports nothing else.
 export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
+export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';

package/dist/org.d.ts

@@ -843,3 +843,91 @@ export interface DeclaredOrg {
      */
     test: boolean;
 }
+/**
+ * The one Postgres server an org's own service schemas and roles live on
+ * (#444) — the settled replacement for today's one-container-per-service
+ * model: `plan/executor.ts`'s `coolifyDatabase` mints Archon's/lokessmie's
+ * own database, `ensureCmsDatabase` mints CMS's, and `ensureCallsDatabase`
+ * mints Boule's and chat's and calls' own Synapse, matrix-authentication-
+ * service and service databases, each as its own Coolify Postgres resource
+ * today. Not a field on {@link DeclaredOrg}: an operator never picks a
+ * server, the same way nobody picks an invited owner's ZITADEL user id
+ * (`plan/diff.ts`'s `planOwners`, idempotent on a *recorded* resource id
+ * rather than a declared field) — there is exactly one per org, and this is
+ * the single flat key it is recorded under once `plan/executor.ts`
+ * provisions it (444b). 444a (this slice) only ever reads this key through
+ * `recordedIds`; nothing here writes it.
+ */
+export declare const ORG_POSTGRES_SERVER_SCOPE_KEY = "org_postgres_server";
+/**
+ * One service's own slice of the org's shared Postgres server (#444): a
+ * dedicated schema, an owner role that runs its migrations and owns every
+ * object inside it, and a restricted runtime role the service's own app
+ * connects as day to day and cannot create or drop anything with. The `_rt`
+ * suffix on {@link OrgServiceSchema.runtimeRole} is the one this estate
+ * already uses for exactly this role, everywhere a service splits an owner
+ * connection from a runtime one — every `package-template`-descended repo's
+ * own `CLAUDE.md` names it "the runtime role `<database>_rt`" — just scoped
+ * to a schema instead of a whole database, now that several schemas share
+ * one server. `scopeKey` is where `plan/diff.ts` and, later, 444b's
+ * `plan/executor.ts` record the schema's existence, the same derived-lookup
+ * shape {@link OwnerMailbox.scopeKey} already uses: nothing here is itself
+ * stored, {@link ORG_SERVICE_SCHEMAS} is rebuilt fresh every time it is read.
+ *
+ * Every field below is the **target** name 444b provisions under, not what
+ * is live today: today there is no schema at all (each service gets its own
+ * whole database), its "owner" is really whatever superuser Coolify's
+ * database-creation call happened to name, and a database's role is scoped
+ * to that whole database, never to a schema within it. The live runtime
+ * role names already in production do not all match {@link runtimeRole}'s
+ * `<schema>_rt` shape either — CMS's does (`cms_rt`), but chat's own service
+ * connects as `chat_rt`, Boule as `<slug>_boule_db_rt`, and calls' own
+ * service as `<dbName>_rt`. 444b must not rename a role a password was
+ * already minted for; it maps each of these live names onto the matching
+ * target below rather than provisioning a second, differently-named role
+ * beside it.
+ */
+export interface OrgServiceSchema {
+    /** The service this schema belongs to, for a plan step's or an error's own wording — never part of an identifier. */
+    service: string;
+    /** The schema's target name on the org's one Postgres server. Unique by construction: {@link ORG_SERVICE_SCHEMAS} names each service's schema exactly once. */
+    schema: string;
+    /** The target role that owns {@link schema} and runs its migrations — this estate's `DATABASE_URL_OWNER` connection, scoped to one schema rather than a whole database. No live role matches this name yet (see this interface's own doc comment). */
+    ownerRole: string;
+    /** The target restricted role the service's own app connects as day to day — this estate's `DATABASE_URL` connection. Several services' live runtime roles already carry this exact name; others 444b must map onto it (see this interface's own doc comment). */
+    runtimeRole: string;
+    /** Where this schema's existence is recorded, once provisioned. */
+    scopeKey: string;
+}
+/**
+ * The full, fixed schema topology every org's shared Postgres server
+ * settles into (#444's acceptance: "the documented service schema/role
+ * descriptors") — not a per-org choice, so unlike {@link ownerMailboxes}
+ * this takes no `DeclaredOrg` at all. One entry per Postgres database
+ * `plan/executor.ts` mints today as its own container, confirmed by reading
+ * it rather than assumed from the issue or any triage comment: Boule's own
+ * (`coolifyBoule`'s `ensureCallsDatabase` call) and CMS's own
+ * (`ensureCmsDatabase`) are each one; chat's and calls' own Matrix stacks
+ * are each three — `coolifyChat`/`coolifyCalls` each mint a Synapse and a
+ * matrix-authentication-service database, and `coolifyChat`/
+ * `coolifyCallsService` each mint a third for the service app beside them
+ * — eight; plus the org's own app database, `coolifyDatabase`'s `<slug>-db`,
+ * for the one hosting entry that declares `database: true` (Archon's or
+ * lokessmie's own data) — nine in total.
+ *
+ * Boule's own entry is provisioned unconditionally — `validateHosting`
+ * already refuses an `issuerApps` entry named `boule` because "every org
+ * gets" one — so it, and this constant as a whole, name the *full* topology
+ * regardless of which feature switches are on, the same way `ORG_ENTRY_KEY`
+ * names `app` whether or not an org has one. Which of these schemas
+ * `plan/diff.ts`'s `planOrgPostgres` actually reports as missing on a given
+ * org is a narrower question than what this list contains — CMS's,
+ * chat's and calls' entries sit alongside their own feature's on/off switch
+ * ({@link SiteConfig.enabled}, {@link ChatConfig.enabled},
+ * {@link CallsConfig.enabled}) and the app entry beside whether any hosting
+ * entry declares `database: true`; `planOrgPostgres`'s own doc comment says
+ * which. A schema nothing needs yet simply is not reported missing, the
+ * same way an org with no app entry (foundry#447) has no app schema to
+ * create.
+ */
+export declare const ORG_SERVICE_SCHEMAS: readonly OrgServiceSchema[];

package/dist/org.js

@@ -930,3 +930,71 @@ export function validateMail(org, opts) {
     }
     return null;
 }
+/**
+ * The one Postgres server an org's own service schemas and roles live on
+ * (#444) — the settled replacement for today's one-container-per-service
+ * model: `plan/executor.ts`'s `coolifyDatabase` mints Archon's/lokessmie's
+ * own database, `ensureCmsDatabase` mints CMS's, and `ensureCallsDatabase`
+ * mints Boule's and chat's and calls' own Synapse, matrix-authentication-
+ * service and service databases, each as its own Coolify Postgres resource
+ * today. Not a field on {@link DeclaredOrg}: an operator never picks a
+ * server, the same way nobody picks an invited owner's ZITADEL user id
+ * (`plan/diff.ts`'s `planOwners`, idempotent on a *recorded* resource id
+ * rather than a declared field) — there is exactly one per org, and this is
+ * the single flat key it is recorded under once `plan/executor.ts`
+ * provisions it (444b). 444a (this slice) only ever reads this key through
+ * `recordedIds`; nothing here writes it.
+ */
+export const ORG_POSTGRES_SERVER_SCOPE_KEY = 'org_postgres_server';
+/** Builds one {@link OrgServiceSchema}: its owner role, runtime role and scope key all follow from {@link schema} alone, so every caller gets the same shape. */
+function orgServiceSchema(service, schema) {
+    return {
+        service,
+        schema,
+        ownerRole: `${schema}_owner`,
+        runtimeRole: `${schema}_rt`,
+        scopeKey: `org_postgres_schema.${schema}`,
+    };
+}
+/**
+ * The full, fixed schema topology every org's shared Postgres server
+ * settles into (#444's acceptance: "the documented service schema/role
+ * descriptors") — not a per-org choice, so unlike {@link ownerMailboxes}
+ * this takes no `DeclaredOrg` at all. One entry per Postgres database
+ * `plan/executor.ts` mints today as its own container, confirmed by reading
+ * it rather than assumed from the issue or any triage comment: Boule's own
+ * (`coolifyBoule`'s `ensureCallsDatabase` call) and CMS's own
+ * (`ensureCmsDatabase`) are each one; chat's and calls' own Matrix stacks
+ * are each three — `coolifyChat`/`coolifyCalls` each mint a Synapse and a
+ * matrix-authentication-service database, and `coolifyChat`/
+ * `coolifyCallsService` each mint a third for the service app beside them
+ * — eight; plus the org's own app database, `coolifyDatabase`'s `<slug>-db`,
+ * for the one hosting entry that declares `database: true` (Archon's or
+ * lokessmie's own data) — nine in total.
+ *
+ * Boule's own entry is provisioned unconditionally — `validateHosting`
+ * already refuses an `issuerApps` entry named `boule` because "every org
+ * gets" one — so it, and this constant as a whole, name the *full* topology
+ * regardless of which feature switches are on, the same way `ORG_ENTRY_KEY`
+ * names `app` whether or not an org has one. Which of these schemas
+ * `plan/diff.ts`'s `planOrgPostgres` actually reports as missing on a given
+ * org is a narrower question than what this list contains — CMS's,
+ * chat's and calls' entries sit alongside their own feature's on/off switch
+ * ({@link SiteConfig.enabled}, {@link ChatConfig.enabled},
+ * {@link CallsConfig.enabled}) and the app entry beside whether any hosting
+ * entry declares `database: true`; `planOrgPostgres`'s own doc comment says
+ * which. A schema nothing needs yet simply is not reported missing, the
+ * same way an org with no app entry (foundry#447) has no app schema to
+ * create.
+ */
+export const ORG_SERVICE_SCHEMAS = [
+    orgServiceSchema('Boule', 'boule'),
+    orgServiceSchema('CMS', 'cms'),
+    orgServiceSchema("chat's Synapse homeserver", 'chat_synapse'),
+    orgServiceSchema("chat's matrix-authentication-service", 'chat_mas'),
+    orgServiceSchema("chat's own service", 'chat_service'),
+    orgServiceSchema("calls' Synapse homeserver", 'calls_synapse'),
+    orgServiceSchema("calls' matrix-authentication-service", 'calls_mas'),
+    orgServiceSchema("calls' own service", 'calls_service'),
+    orgServiceSchema("the org's own app", 'app'),
+];

package/dist/plan/agora.d.ts

@@ -167,6 +167,19 @@ export declare const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_calls_
  */
 export declare const CHAT_INTROSPECTION_SCOPE_KEY = "zitadel_chat_introspection_app";
 export declare const CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_chat_introspection_undelivered";
+/**
+ * The one internal token per org that lets the calls service ask chat who is
+ * in a room: `CHAT_INTERNAL_TOKEN` on chat-service, `CALLS_CHAT_TOKEN` on the
+ * calls service (platform rule 1). The first holds the token's id once both
+ * apps carry it; the second is recorded and persisted before either does.
+ * The third is `<id> <chat address>`, recorded once both apps run with it. No
+ * `:` in any.
+ */
+export declare const CHAT_CALLS_TOKEN_SCOPE_KEY = "coolify_chat_calls_token";
+export declare const CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY = "coolify_chat_calls_token_undelivered";
+export declare const CHAT_CALLS_APPLIED_SCOPE_KEY = "coolify_chat_calls_applied";
+/** The value {@link CHAT_CALLS_APPLIED_SCOPE_KEY} holds once the token and address are live on both apps. */
+export declare function chatCallsApplied(tokenId: string, chatUrl: string): string;
 /** The chat service's introspection API app name; one per org, exact match only. */
 export declare function chatIntrospectionAppName(org: DeclaredOrg): string;
 /** What the plan hands the calls service step: the two host values the token env needs. */

package/dist/plan/agora.js

@@ -179,6 +179,21 @@ export const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_calls_introspe
  */
 export const CHAT_INTROSPECTION_SCOPE_KEY = 'zitadel_chat_introspection_app';
 export const CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_chat_introspection_undelivered';
+/**
+ * The one internal token per org that lets the calls service ask chat who is
+ * in a room: `CHAT_INTERNAL_TOKEN` on chat-service, `CALLS_CHAT_TOKEN` on the
+ * calls service (platform rule 1). The first holds the token's id once both
+ * apps carry it; the second is recorded and persisted before either does.
+ * The third is `<id> <chat address>`, recorded once both apps run with it. No
+ * `:` in any.
+ */
+export const CHAT_CALLS_TOKEN_SCOPE_KEY = 'coolify_chat_calls_token';
+export const CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY = 'coolify_chat_calls_token_undelivered';
+export const CHAT_CALLS_APPLIED_SCOPE_KEY = 'coolify_chat_calls_applied';
+/** The value {@link CHAT_CALLS_APPLIED_SCOPE_KEY} holds once the token and address are live on both apps. */
+export function chatCallsApplied(tokenId, chatUrl) {
+    return `${tokenId} ${chatUrl}`;
+}
 /** The chat service's introspection API app name; one per org, exact match only. */
 export function chatIntrospectionAppName(org) {
     return `chat-introspection-${org.slug}`;

package/dist/plan/chat-matrix.d.ts

@@ -47,6 +47,20 @@ export declare function chatUpstreams(orgSlug: string): {
     matrix: string;
     mas: string;
 };
+/**
+ * Internal names for the org's re-keyed homeserver pair (#463, design note
+ * `docs/chat-rekey-design.md` Option 1): a second Synapse and MAS,
+ * provisioned beside the original pair under `chatInternalNames` so both
+ * ends of the copy are live at once. The chat service and its own database
+ * are never re-created — same app, repointed once the copy is done and the
+ * original pair is parked.
+ */
+export declare function chatRekeyedInternalNames(orgSlug: string): {
+    synapse: string;
+    mas: string;
+    synapseDb: string;
+    masDb: string;
+};
 /**
  * Never resolved by DNS and never federates; the identifier Synapse, MAS and
  * the chat service agree on. A level-1 org's chat lives on this name until a
@@ -54,13 +68,26 @@ export declare function chatUpstreams(orgSlug: string): {
  * not collide with a hostname some org owns.
  */
 export declare function chatServerName(orgSlug: string): string;
-/** The Matrix user the chat service acts as (`chat/apps/chat-service/src/workspace.ts`). */
-export declare function chatAdminUser(orgSlug: string): string;
+/**
+ * The Matrix user the chat service acts as
+ * (`chat/apps/chat-service/src/workspace.ts`). `serverName` defaults to the
+ * org's level-1 `chatServerName`; a re-key (#463) passes the new one so the
+ * gate module's `admin_user` matches the homeserver it is loaded into.
+ */
+export declare function chatAdminUser(orgSlug: string, serverName?: string): string;
+/** A re-key's `server_name` is a lowercase DNS name with at least two labels; anything else would be written into both configs. */
+export declare function assertChatServerName(serverName: string): void;
 export interface ChatSynapseHomeserverInput {
     orgSlug: string;
     db: CallsDbConnection;
     masHost: string;
     masSharedSecret: string;
+    /**
+     * #463: the `server_name` this homeserver answers to. Defaults to the
+     * org's level-1 `chatServerName` so every existing caller is unaffected;
+     * a re-key's new Synapse passes the org's own domain instead.
+     */
+    serverName?: string;
 }
 /** `homeserver.yaml`: federation off, presence on (stable Synapse features only -- no MSC3026 `busy`, foundry#41), MAS for auth, the chat gate module on. */
 export declare function chatSynapseHomeserverYaml(input: ChatSynapseHomeserverInput): string;
@@ -76,6 +103,8 @@ export interface ChatMasConfigInput {
     encryptionKey: string;
     rsaKeyPem: string;
     ecKeyPem: string;
+    /** #463: see {@link ChatSynapseHomeserverInput.serverName} -- the two must agree. */
+    serverName?: string;
 }
 /** MAS `config.yaml`: password login and registration off; the chat service is the one client, with admin. */
 export declare function chatMasConfigYaml(input: ChatMasConfigInput): string;

package/dist/plan/chat-matrix.js

@@ -29,6 +29,22 @@ export function chatUpstreams(orgSlug) {
         mas: `http://${names.mas}:${CHAT_MAS_PORT}`,
     };
 }
+/**
+ * Internal names for the org's re-keyed homeserver pair (#463, design note
+ * `docs/chat-rekey-design.md` Option 1): a second Synapse and MAS,
+ * provisioned beside the original pair under `chatInternalNames` so both
+ * ends of the copy are live at once. The chat service and its own database
+ * are never re-created — same app, repointed once the copy is done and the
+ * original pair is parked.
+ */
+export function chatRekeyedInternalNames(orgSlug) {
+    return {
+        synapse: `${orgSlug}-chat-synapse-2`,
+        mas: `${orgSlug}-chat-mas-2`,
+        synapseDb: `${orgSlug}-chat-synapse-2-db`,
+        masDb: `${orgSlug}-chat-mas-2-db`,
+    };
+}
 /**
  * Never resolved by DNS and never federates; the identifier Synapse, MAS and
  * the chat service agree on. A level-1 org's chat lives on this name until a
@@ -38,18 +54,33 @@ export function chatUpstreams(orgSlug) {
 export function chatServerName(orgSlug) {
     return `chat-${orgSlug}.internal`;
 }
-/** The Matrix user the chat service acts as (`chat/apps/chat-service/src/workspace.ts`). */
-export function chatAdminUser(orgSlug) {
-    return `@chat-admin:${chatServerName(orgSlug)}`;
+/**
+ * The Matrix user the chat service acts as
+ * (`chat/apps/chat-service/src/workspace.ts`). `serverName` defaults to the
+ * org's level-1 `chatServerName`; a re-key (#463) passes the new one so the
+ * gate module's `admin_user` matches the homeserver it is loaded into.
+ */
+export function chatAdminUser(orgSlug, serverName = chatServerName(orgSlug)) {
+    return `@chat-admin:${serverName}`;
 }
 const q = (value) => JSON.stringify(value);
+const SERVER_NAME_PATTERN = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/** A re-key's `server_name` is a lowercase DNS name with at least two labels; anything else would be written into both configs. */
+export function assertChatServerName(serverName) {
+    if (serverName.length > 253 || !SERVER_NAME_PATTERN.test(serverName)) {
+        throw new Error('chat server_name must be a lowercase domain name');
+    }
+}
 /** `homeserver.yaml`: federation off, presence on (stable Synapse features only -- no MSC3026 `busy`, foundry#41), MAS for auth, the chat gate module on. */
 export function chatSynapseHomeserverYaml(input) {
+    const serverName = input.serverName ?? chatServerName(input.orgSlug);
+    if (input.serverName !== undefined)
+        assertChatServerName(serverName);
     return [
         '# Generated by @wtfalch/foundry (executor.ts, coolify:chat). Do not edit',
         '# by hand; re-run apply instead -- it will not rotate secrets that exist.',
         '',
-        `server_name: ${q(chatServerName(input.orgSlug))}`,
+        `server_name: ${q(serverName)}`,
         'pid_file: /data/homeserver.pid',
         'report_stats: false',
         '',
@@ -106,13 +137,16 @@ export function chatSynapseHomeserverYaml(input) {
         'modules:',
         '  - module: wtfalch_chat_gate.ChatGate',
         '    config:',
-        `      admin_user: ${q(chatAdminUser(input.orgSlug))}`,
+        `      admin_user: ${q(chatAdminUser(input.orgSlug, serverName))}`,
         '      allow_encrypted_channels: false',
         '',
     ].join('\n');
 }
 /** MAS `config.yaml`: password login and registration off; the chat service is the one client, with admin. */
 export function chatMasConfigYaml(input) {
+    const serverName = input.serverName ?? chatServerName(input.orgSlug);
+    if (input.serverName !== undefined)
+        assertChatServerName(serverName);
     const indentKey = (pem, spaces) => pem
         .trimEnd()
         .split('\n')
@@ -150,7 +184,7 @@ export function chatMasConfigYaml(input) {
         '',
         'matrix:',
         '  kind: synapse',
-        `  homeserver: ${q(chatServerName(input.orgSlug))}`,
+        `  homeserver: ${q(serverName)}`,
         `  endpoint: ${q(`http://${input.synapseHost}:${CHAT_SYNAPSE_PORT}`)}`,
         `  secret: ${q(input.sharedSecret)}`,
         '',

package/dist/plan/diff.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg, OrgId } from '../org.js';
+import type { DeclaredOrg, OrgId, OrgServiceSchema } from '../org.js';
 import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.js';
 import { type AgoraHostReading } from './agora.js';
 import type { LiveResource } from './live.js';
@@ -64,6 +64,8 @@ export interface PlanDetail {
     unmanaged: UnmanagedItem[];
     /** #251: see `VersionChangeItem` (`../plan.ts`). Never folded into `plannedSteps`. */
     versionChanges: VersionChangeItem[];
+    /** #444a: see {@link OrgPostgresPlan}. Never folded into `plannedSteps`, for the same reason `versionChanges` above is not. */
+    orgPostgres: OrgPostgresPlan;
 }
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export declare function toPlan(detail: PlanDetail): Plan;
@@ -110,7 +112,12 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * app-creating step below: {@link planLoginHost}, the org's own company
  * login host -- also idempotent on the *recorded* resource id, since
  * `live` has no notion of a ZITADEL trusted domain or a login binding
- * either. Everything
+ * either. #444a adds one more fact, in a different shape from every other
+ * addition here: {@link planOrgPostgres}, the org's one shared Postgres
+ * server plus whichever of `org.ts`'s `ORG_SERVICE_SCHEMAS` (nine today)
+ * this org actually runs and has not yet recorded -- idempotent on the
+ * *recorded* resource id like {@link planOwners}, but never folded into
+ * `plannedSteps`: its own {@link OrgPostgresPlan} field says why. Everything
  * else in `live` that none of these eighteen singletons and however many
  * declared issuer apps claim is unmanaged. The full field-by-field provisioning surface (SSO,
  * guests, calls on the org's own domain, adopted/bespoke apps, the actual
@@ -128,6 +135,42 @@ export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]
  * its login host equal to the shared ZITADEL instance's own.
  */
 export declare function isPlatformOwnOrg(org: DeclaredOrg, platformApex: string | null): boolean;
+/**
+ * What {@link planOrgPostgres} reports about the org's one shared Postgres
+ * server and its fixed schema topology (#444a, "manifest-and-plan-only"):
+ * missing only, nothing applied. Deliberately **not** folded into
+ * `plannedSteps` -- the same reason {@link VersionChangeItem} (`../plan.ts`)
+ * never is, restated in `computePlanDetail`'s own doc comment below, but
+ * sharper here: `plan-apply.ts`'s `runSteps` executes every
+ * `detail.plannedSteps` entry through `StepExecutor.execute`, which
+ * switches on `` `${system}:${kind}` `` and throws on anything it has no
+ * case for. `plan/executor.ts` is untouched this slice (444a's own
+ * acceptance line), so a `'coolify:postgres-server'`/`'coolify:postgres-
+ * schema'` entry in `plannedSteps` would not sit there harmlessly the way
+ * an unapplied field does -- the next real `apply()` would reach it and
+ * throw `FoundryStepExecutor has no dispatch for coolify:postgres-server`,
+ * for every org, immediately. This field is how 444a reports the same
+ * "missing" fact to a caller of `computePlanDetail` directly without that
+ * happening; wiring it into the public `Plan` (`toPlan` below) and into
+ * real `plannedSteps` entries is 444b's job, once `plan/executor.ts` has a
+ * dispatch for them.
+ */
+export interface OrgPostgresPlan {
+    /** True until the org's one shared Postgres server is recorded under {@link ORG_POSTGRES_SERVER_SCOPE_KEY}. */
+    serverMissing: boolean;
+    /**
+     * Every `org.ts` {@link ORG_SERVICE_SCHEMAS} entry this org actually runs
+     * and has not yet recorded under its own `scopeKey`, in that constant's
+     * own order -- see {@link orgServiceSchemaEnabled} for which entries that
+     * is. Boule's is always included, the same way `ORG_SERVICE_SCHEMAS`
+     * itself always carries it; CMS's, chat's and calls' sit behind their own
+     * feature switch, and the app schema behind whether any hosting entry
+     * declares a database. A schema this org does not run yet is never
+     * reported missing, even though {@link ORG_SERVICE_SCHEMAS} still names
+     * it as part of the full topology.
+     */
+    missingSchemas: readonly OrgServiceSchema[];
+}
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */