@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/org.d.ts

@@ -548,6 +548,22 @@ export declare function validateSite(org: DeclaredOrg): string | null;
  * reason to pin at all.
  */
 export declare function validateCalls(org: DeclaredOrg): string | null;
+/** A company with a domain runs its own sign-in, mail, files, jobs and calls SFU in its own containers. */
+export interface ServicesConfig {
+    /** true: own copies of the services. false (default): the platform's shared ones. */
+    own: boolean;
+    /**
+     * Which slice of the server's SFU ports this company's media server takes.
+     * Required when `own` and `calls.enabled`. 1 to {@link SFU_SLOT_MAX}.
+     * Slice n holds UDP (50000 + (n-1)*500) .. (50000 + n*500 - 1) and TCP 7881 + n.
+     */
+    sfuSlot?: number | null;
+}
+export declare const SFU_SLOT_MAX = 20;
+/** The only reader of `services.own`: an org without `services` runs the platform's shared services. */
+export declare function ownsServices(org: Pick<DeclaredOrg, 'services'>): boolean;
+/** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
+export declare function validateServices(org: DeclaredOrg): string | null;
 /**
  * Per-org SSO. Decided to exist in #14 ("Also in scope") and its resolved
  * research #3 ("per-org SSO code exists unused"); nothing about its
@@ -674,8 +690,12 @@ export declare function validateBuyerIdentity(buyer: BuyerIdentity): string | nu
  * recorded invited user id, not on this declared value, so editing an owner
  * after the invite has gone out does not send a second one.
  *
- * `mailboxAddress` is the owner's own mailbox, when mail is on. The first
- * owner falls back to `mail.ownerMailboxAddress` when it is unset.
+ * `email` is the owner's personal address: it receives the first-sign-in link
+ * and is kept as the user's `personal_email` metadata. `mailboxAddress` is the
+ * owner's work address; the owner signs in as its local part on the org's domain.
+ * The first owner falls back to `mail.ownerMailboxAddress` when it is unset. An
+ * owner with neither is a blocked item in the plan, not refused here, because a
+ * stored owner from before this rule has none.
  */
 export interface OwnerIdentity {
     email: string;
@@ -818,6 +838,8 @@ export interface DeclaredOrg {
     site: SiteConfig;
     /** `enabled: false`, `issuerApps: []` by default -- a brand new org has no hosted app (#71). */
     hosting: HostingConfig;
+    /** Absent means `{ own: false }`. Optional so every existing literal and test fixture compiles unchanged, as `calls.versionPin` and `MailConfig.mailApps` do. */
+    services?: ServicesConfig;
     sso: SsoConfig;
     guests: GuestsConfig;
     solo: SoloConfig;

package/dist/org.js

@@ -706,6 +706,32 @@ export function validateCalls(org) {
     }
     return null;
 }
+export const SFU_SLOT_MAX = 20;
+/** The only reader of `services.own`: an org without `services` runs the platform's shared services. */
+export function ownsServices(org) {
+    return org.services?.own === true;
+}
+/** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
+export function validateServices(org) {
+    const slot = org.services?.sfuSlot ?? null;
+    if (!ownsServices(org)) {
+        return slot === null ? null : 'services.sfuSlot needs services.own';
+    }
+    if (org.domain === null) {
+        return "services.own needs the org's own domain: the issuer is auth.<domain>";
+    }
+    if (!org.issuer.usesDomain) {
+        return 'services.own needs issuer.usesDomain: the issuer is auth.<domain>';
+    }
+    if (org.mail.mode !== 'off' && !org.mail.usesDomain) {
+        return "services.own needs mail.usesDomain: the company's mail server serves its own domain";
+    }
+    if (org.calls.enabled &&
+        (slot === null || !Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX)) {
+        return `services.sfuSlot must be an integer from 1 to ${SFU_SLOT_MAX} when calls are enabled`;
+    }
+    return null;
+}
 const ORG_NUMBER_PATTERN = /^\d{9}$/;
 /**
  * `null` when `buyer` is valid; otherwise the reason it is not, for a caller
@@ -746,6 +772,7 @@ const OWNER_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 export function validateOwners(owners) {
     const seen = new Set();
     const boxes = new Set();
+    const names = new Set();
     for (const owner of owners) {
         if (!OWNER_EMAIL_PATTERN.test(owner.email)) {
             return `owner email '${owner.email}' is not a valid email address`;
@@ -762,6 +789,12 @@ export function validateOwners(owners) {
             if (boxes.has(box))
                 return `owner mailboxAddress '${owner.mailboxAddress}' is listed more than once`;
             boxes.add(box);
+            // One sign-in account per local part: the account's username is the part before the @.
+            const name = box.slice(0, box.indexOf('@'));
+            if (names.has(name)) {
+                return `owner work addresses must have different names before the @: '${name}' is used twice`;
+            }
+            names.add(name);
         }
         const key = owner.email.toLowerCase();
         if (seen.has(key))
@@ -814,6 +847,15 @@ function validateOwnerMailboxes(org) {
         const address = owner.mailboxAddress;
         if (address === undefined || !OWNER_EMAIL_PATTERN.test(address))
             continue;
+        // Only an owner with a work address is checked: a stored owner without one predates the
+        // rule, and refusing it would stop every later update of its org.
+        if (org.domain && OWNER_EMAIL_PATTERN.test(owner.email)) {
+            const personalDomain = owner.email.slice(owner.email.indexOf('@') + 1).toLowerCase();
+            const orgDomain = org.domain.toLowerCase();
+            if (personalDomain === orgDomain || personalDomain.endsWith(`.${orgDomain}`)) {
+                return `owner ${owner.email} personal address must not be on ${org.domain} or a subdomain of it`;
+            }
+        }
         if (mail.usesDomain && org.domain) {
             const addressDomain = address.slice(address.indexOf('@') + 1).toLowerCase();
             if (addressDomain !== org.domain.toLowerCase()) {

package/dist/plan/boule.d.ts

@@ -28,6 +28,14 @@ export declare const BOULE_DATABASE_SCOPE_KEY = "coolify_boule_database";
  * sat built but never started, and `restart` cannot fix that.
  */
 export declare const BOULE_DEPLOYED_SCOPE_KEY = "coolify_boule_deployed";
+/**
+ * Recorded once the platform's own Boule was restarted (or deployed) after its
+ * peer password and bridge secret were written. Boule creates its people-store
+ * role from the password only at boot, so a password written without that
+ * restart is useless; without this marker a failed restart was never repeated,
+ * because the next run finds the secrets present and mints and changes nothing.
+ */
+export declare const BOULE_SECRETS_RESTARTED_SCOPE_KEY = "coolify_boule_secrets_restarted";
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s
@@ -56,8 +64,23 @@ export declare function bouleMailFrom(org: DeclaredOrg, mailDomain: string): str
  * values in memory only; the result names nothing secret.
  */
 export declare function bouleMailTokenDrift(liveToken: string | undefined, appToken: string | undefined): boolean;
+/**
+ * The password of the Postgres role Archon connects to the owner company's
+ * people store with. Minted once, only for the platform's own org, and held in
+ * Boule's env; the plan compares its presence in memory and never plans with
+ * its value. Not in {@link desiredBouleEnv}: it is a secret.
+ */
+export declare const BOULE_PEER_PASSWORD_ENV = "AUTHZ_PEER_PASSWORD_OPERATOR";
+/**
+ * The secret Archon sends to Boule's invite route as a bearer token. Minted
+ * once, only for the platform's own org, held in Boule's env and in Archon's
+ * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
+ */
+export declare const BOULE_BRIDGE_SECRET_ENV = "ARCHON_BRIDGE_SECRET";
+/** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
+export declare const BOULE_PEER_ROLE = "authz_operator_rt";
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a

package/dist/plan/boule.js

@@ -28,6 +28,14 @@ export const BOULE_DATABASE_SCOPE_KEY = 'coolify_boule_database';
  * sat built but never started, and `restart` cannot fix that.
  */
 export const BOULE_DEPLOYED_SCOPE_KEY = 'coolify_boule_deployed';
+/**
+ * Recorded once the platform's own Boule was restarted (or deployed) after its
+ * peer password and bridge secret were written. Boule creates its people-store
+ * role from the password only at boot, so a password written without that
+ * restart is useless; without this marker a failed restart was never repeated,
+ * because the next run finds the secrets present and mints and changes nothing.
+ */
+export const BOULE_SECRETS_RESTARTED_SCOPE_KEY = 'coolify_boule_secrets_restarted';
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s
@@ -66,6 +74,21 @@ export function bouleMailFrom(org, mailDomain) {
 export function bouleMailTokenDrift(liveToken, appToken) {
     return !liveToken || (Boolean(appToken) && appToken !== liveToken);
 }
+/**
+ * The password of the Postgres role Archon connects to the owner company's
+ * people store with. Minted once, only for the platform's own org, and held in
+ * Boule's env; the plan compares its presence in memory and never plans with
+ * its value. Not in {@link desiredBouleEnv}: it is a secret.
+ */
+export const BOULE_PEER_PASSWORD_ENV = 'AUTHZ_PEER_PASSWORD_OPERATOR';
+/**
+ * The secret Archon sends to Boule's invite route as a bearer token. Minted
+ * once, only for the platform's own org, held in Boule's env and in Archon's
+ * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
+ */
+export const BOULE_BRIDGE_SECRET_ENV = 'ARCHON_BRIDGE_SECRET';
+/** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
+export const BOULE_PEER_ROLE = 'authz_operator_rt';
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
 export const BOULE_MANAGED_ENV_KEYS = [
     'APP_URL',
@@ -74,9 +97,12 @@ export const BOULE_MANAGED_ENV_KEYS = [
     'AUTH_CLIENT_ID',
     'BOULE_ORG_NAME',
     'AUTHZ_BOOTSTRAP_OPERATOR',
+    'AUTHZ_FIRST_OWNER',
     'ARCHON_URL',
     'MAIL_FROM',
     BOULE_MAIL_TOKEN_ENV,
+    BOULE_PEER_PASSWORD_ENV,
+    BOULE_BRIDGE_SECRET_ENV,
 ];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
@@ -129,8 +155,10 @@ export function desiredBouleEnv(org, recorded, issuer, archonUrl, mailWanted = f
     const ownerUserId = owner
         ? recorded[`zitadel:owner:${org.id}:${owner.email.toLowerCase()}`]
         : undefined;
-    if (ownerUserId)
+    if (ownerUserId) {
         env.AUTHZ_BOOTSTRAP_OPERATOR = ownerUserId;
+        env.AUTHZ_FIRST_OWNER = ownerUserId;
+    }
     const mailDomain = recorded[MAIL_DOMAIN_RECORDED_KEY];
     if (mailWanted && mailDomain)
         env.MAIL_FROM = bouleMailFrom(org, mailDomain);

package/dist/plan/calls-matrix.d.ts

@@ -47,6 +47,15 @@
 export declare const SYNAPSE_IMAGE = "ghcr.io/element-hq/synapse";
 export declare const SYNAPSE_TAG: string;
 export declare const MAS_IMAGE: string;
+/** MAS listens here in both the calls and the chat config (`http.listeners[0].binds`). */
+export declare const MAS_PORT = 8080;
+/**
+ * The inline Dockerfile of a MAS app: the published image plus its entry command. That image is distroless: no
+ * shell and no HTTP client, so Coolify's own check (always `sh -c`) cannot run in it. A static busybox is copied in
+ * and an exec-form HEALTHCHECK asks MAS's `/health` (a `SELECT 1` on its database). Coolify keeps a Dockerfile's
+ * HEALTHCHECK when its own check is off (`health_check_enabled: false`).
+ */
+export declare function masDockerfile(): string;
 /** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
 export declare const MAS_TAG: string;
 /**

package/dist/plan/calls-matrix.js

@@ -49,6 +49,23 @@ import { VERSIONS } from '../bootstrap/versions.js';
 export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
 export const SYNAPSE_TAG = VERSIONS.synapse;
 export const MAS_IMAGE = `ghcr.io/element-hq/matrix-authentication-service:${VERSIONS.mas}`;
+/** MAS listens here in both the calls and the chat config (`http.listeners[0].binds`). */
+export const MAS_PORT = 8080;
+/**
+ * The inline Dockerfile of a MAS app: the published image plus its entry command. That image is distroless: no
+ * shell and no HTTP client, so Coolify's own check (always `sh -c`) cannot run in it. A static busybox is copied in
+ * and an exec-form HEALTHCHECK asks MAS's `/health` (a `SELECT 1` on its database). Coolify keeps a Dockerfile's
+ * HEALTHCHECK when its own check is off (`health_check_enabled: false`).
+ */
+export function masDockerfile() {
+    return [
+        `FROM busybox:${VERSIONS.busybox} AS busybox`,
+        `FROM ${MAS_IMAGE}`,
+        'COPY --from=busybox /bin/busybox /busybox',
+        'CMD ["server", "--config", "/config/config.yaml"]',
+        `HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 CMD ["/busybox", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:${MAS_PORT}/health"]`,
+    ].join('\n');
+}
 /** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
 export const MAS_TAG = VERSIONS.mas;
 /**

package/dist/plan/cloudflared-connector.d.ts

@@ -7,6 +7,12 @@ import type { CoolifyPort } from './executor.js';
  * `versions.json` (#247).
  */
 export declare const CLOUDFLARED_IMAGE_REF: string;
+/**
+ * Where the connector serves its metrics, which include `/ready` (200 with at least one edge connection, else 503).
+ * The image is distroless, so its check is the binary's own `tunnel ready` in exec form: a Dockerfile HEALTHCHECK,
+ * kept by Coolify while its own check is off. The port is not published; only the container network reaches it.
+ */
+export declare const CLOUDFLARED_METRICS_PORT = 20241;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -24,7 +30,7 @@ export declare function cloudflaredDockerfile(): string;
  * archon) calls this once with its own app name and scope key.
  */
 export interface EnsureCloudflaredConnectorInput {
-    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
+    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
     tunnels: Pick<TunnelPort, 'getTunnelToken'>;
     /** The Cloudflare tunnel this connector dials into (already created and configured by the caller). */
     tunnelId: string;

package/dist/plan/cloudflared-connector.js

@@ -7,6 +7,12 @@ import { isNotFoundError } from './executor.js';
  * `versions.json` (#247).
  */
 export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
+/**
+ * Where the connector serves its metrics, which include `/ready` (200 with at least one edge connection, else 503).
+ * The image is distroless, so its check is the binary's own `tunnel ready` in exec form: a Dockerfile HEALTHCHECK,
+ * kept by Coolify while its own check is off. The port is not published; only the container network reaches it.
+ */
+export const CLOUDFLARED_METRICS_PORT = 20241;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -17,7 +23,12 @@ export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudfla
  * variable `cloudflared` reads at boot.
  */
 export function cloudflaredDockerfile() {
-    return `FROM ${CLOUDFLARED_IMAGE_REF}\nCMD ["tunnel", "--no-autoupdate", "run"]\n`;
+    return [
+        `FROM ${CLOUDFLARED_IMAGE_REF}`,
+        `CMD ["tunnel", "--no-autoupdate", "--metrics", "0.0.0.0:${CLOUDFLARED_METRICS_PORT}", "run"]`,
+        `HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 CMD ["cloudflared", "tunnel", "--metrics", "127.0.0.1:${CLOUDFLARED_METRICS_PORT}", "ready"]`,
+        '',
+    ].join('\n');
 }
 /**
  * Finds or creates the one Coolify app that runs `cloudflared` for
@@ -79,6 +90,8 @@ export async function ensureCloudflaredConnector(input) {
         });
         appId = created.uuid;
         justCreated = true;
+        // Before the first deploy: Coolify reads the Dockerfile's HEALTHCHECK only while its own check is off.
+        await coolify.updateApplication(appId, { health_check_enabled: false });
     }
     if (appId !== input.recordedConnectorAppId)
         await input.recordAppId(appId);

package/dist/plan/diff.d.ts

@@ -43,6 +43,8 @@ export interface DraftStep {
 export interface PlanOrgOptions {
     /** #267: the executor was built with a `loginHostBindings` port. */
     loginHostBindings?: boolean;
+    /** A live read said the org's login host serves OIDC discovery as `https://<host>`. Absent: not read, so Agora keeps the platform issuer. */
+    loginHostServesDiscovery?: boolean;
     /** The executor's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`; without it `planIdTokenUserinfo` plans nothing. */
     zitadelIdTokenUserinfo?: boolean;
     /** F5: the executor was built with a `broker` port. */
@@ -55,8 +57,37 @@ export interface PlanOrgOptions {
     archonUrl?: string | null;
     /** #318: the executor was built with a `WorkersPort`, read by `planWorkers`. */
     edgeWorkers?: boolean;
+    /** The executor was built with an `ownerInviteMail` port; without it each owner's invite is blocked. */
+    ownerInviteMail?: boolean;
     /** The platform's own service hostnames: `edgeReservedLabels` reserves them under the org's domain, and a wildcard Worker route (`planWorkers`) keeps them out. */
     platformHostnames?: readonly string[];
+    /** The executor was built with an `ownServices` port. Without it an own org's own-service steps are blocked. */
+    ownServices?: boolean;
+    /** An own org's Lettermint key (`orgTarget(org).refs.brokerMailKey`) is held. */
+    ownMailKeyHeld?: boolean;
+    /** The executor can mint an own org's Lettermint key (`FoundryStepExecutor.ownMailKeyMintable`). */
+    ownMailKeyMintable?: boolean;
+    /** The own jobs admin token's held-key ref holds a value. */
+    ownJobsTokenHeld?: boolean;
+    /** The own media server's key pair ref holds a value. */
+    ownSfuKeysHeld?: boolean;
+    /** The relay is declared and has applied a route list; an own org's mail server waits for it. */
+    mailRelayApplied?: boolean;
+    /** The host confirmed the ports of an own org's media server slot are open on the server. */
+    sfuPortsOpen?: boolean;
+    /** What the executor's own files dependencies supply: valid keys worker settings, and a bucket port. Absent counts as neither. */
+    ownFilesDeps?: {
+        keys: boolean;
+        bucket: boolean;
+    };
+    /**
+     * Which ports the own files storage key step needs the host supplied. Absent: the executor was not
+     * asked, and the step is neither planned nor reported.
+     */
+    ownFilesR2Ports?: {
+        r2Keys: boolean;
+        storeR2Credentials: boolean;
+    };
 }
 export interface PlanDetail {
     orgId: OrgId;
@@ -134,7 +165,7 @@ export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
-export declare function isPlatformOwnOrg(org: DeclaredOrg, platformApex: string | null): boolean;
+export declare function isPlatformOwnOrg(org: Pick<DeclaredOrg, 'id'>, platformOwnerOrgId: string | null): boolean;
 /**
  * What {@link planOrgPostgres} reports about the org's one shared Postgres
  * server and its fixed schema topology (#444a, "manifest-and-plan-only"):