@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/plan-apply.d.ts

@@ -7,10 +7,12 @@ import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
 import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js';
 import { type AgoraHostPort } from './agora.js';
+import { type MoveGatePorts } from './backup-gate.js';
 import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
-import { type EdgePortName, type HeldKeyResolver } from './platform-org.js';
+import { type LoginHostDiscoveryPort } from './login-host.js';
+import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
@@ -123,6 +125,11 @@ export interface AuthzGate {
  */
 export interface StepExecutionContext {
     readonly org: DeclaredOrg;
+    /**
+     * True when `org` is the platform's own company (`DeclaredPlatform.ownerOrgId`). It stays on the
+     * platform's Docker network, not on `co-<slug>`, so Archon reaches its database. Absent: false.
+     */
+    readonly ownerCompany?: boolean;
     /**
      * Every id foundry has recorded for this org so far — both `system:kind:key`
      * resource ids (`runSteps` records these itself from `execute`'s own return
@@ -172,6 +179,39 @@ export interface StepExecutor {
      * an executor without it supplies none.
      */
     ownEdgePorts?(): Partial<Record<EdgePortName, boolean>>;
+    /**
+     * What the executor's own files dependencies supply (`ownServices.provision.files`):
+     * valid keys worker settings, and a bucket port. The planner blocks an own
+     * org's files host until both are true. Optional: an executor without it supplies neither.
+     */
+    ownFilesDeps?(): {
+        keys: boolean;
+        bucket: boolean;
+    };
+    /**
+     * Which ports an own org's files storage key step needs this executor has: the R2 key port, and
+     * `storeR2Credentials` on the org's files-organisation port. Optional: an executor without it
+     * leaves the step unplanned.
+     */
+    ownFilesR2Ports?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<{
+        r2Keys: boolean;
+        storeR2Credentials: boolean;
+    }>;
+    /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
+    ownMailKeyMintable?(): boolean;
+    /**
+     * Whether the host's scoped ports for this own org include a files-organisation
+     * port. The planner plans no `files:organisation` step for an own org while
+     * this says false. Optional: an executor without it is taken to have the port.
+     */
+    ownFilesOrganisationPort?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /**
+     * Whether the host's scoped ports for this own org include a broker port, the company's own
+     * broker. An own org's broker entries are planned on this answer, not on
+     * {@link FoundryPlanApplyOptions.broker}, which names the shared broker. Optional: an executor
+     * without it leaves the option as the answer.
+     */
+    ownBrokerPort?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
     /**
      * Every secret this executor minted or read so far (peer password, bridge
      * secret, invite code and link). The host's run adds them to its redactor
@@ -192,6 +232,8 @@ export interface StepExecutor {
  */
 export interface PlatformStepExecutionContext {
     readonly platform: DeclaredPlatform;
+    /** The owner company's own sign-in and files host, when applied. Archon and the Access provider read them. */
+    readonly owner?: PlatformOwnerInput;
     /** {@link StepExecutionContext.recordedIds}, for the platform's own run. */
     recordedIds(): Readonly<Record<string, string>>;
     /** {@link StepExecutionContext.recordScopeId}, for the platform's own run. */
@@ -227,7 +269,7 @@ export interface PlatformStepExecutor {
      * unmanaged item and plans no step for it, the way a blocked Agora is
      * reported, instead of planning a step that throws on every apply.
      */
-    blockedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<{
+    blockedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<{
         auth?: string;
         /** #211 round 6: see `PlanPlatformOptions.blocked.authExecutorMissing`. */
         authExecutorMissing?: boolean;
@@ -238,8 +280,12 @@ export interface PlatformStepExecutor {
         ai?: string;
         archon?: string;
         mail?: string;
+        /** See `PlanPlatformOptions.blocked.relay` (`platform-diff.ts`). */
+        relay?: string;
         /** #604: see `PlanPlatformOptions.blocked.accessProvider` (`platform-diff.ts`). */
         accessProvider?: string;
+        /** See `PlanPlatformOptions.blocked.oikosIngress` (`platform-diff.ts`). */
+        oikosIngress?: string;
         /** #257: see `PlanPlatformOptions.blocked.backupExecutorMissing` (`platform-diff.ts`). */
         backupExecutorMissing?: boolean;
         /** #540: see `PlanPlatformOptions.blocked.hc` (`platform-diff.ts`). */
@@ -262,7 +308,7 @@ export interface PlatformStepExecutor {
      * the token and the edge step does not clear the flag, so the host must stop
      * reporting it once edge holds the new token and the old one is gone.
      */
-    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<PlatformDriftedSteps>;
+    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<PlatformDriftedSteps>;
     /**
      * Gives the platform files runner a changed share-domain set and touches
      * nothing else. Returns the scope ids to record (only the share-domains
@@ -382,6 +428,14 @@ export interface FoundryPlanApplyOptions {
      * before zitadel-login's binding can be written.
      */
     loginHostBindings?: boolean;
+    /**
+     * Reads `GET https://<login host>/.well-known/openid-configuration` for a
+     * company's login host (5 s limit). Optional, and without it every company's
+     * Agora keeps the platform issuer and the plan carries a blocked line for the
+     * switch. The host must route the company's login host to a login app that
+     * serves discovery (https://github.com/wtfalch/auth/pull/233).
+     */
+    loginHostDiscovery?: LoginHostDiscoveryPort;
     /**
      * True when the host's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`
      * (`@wtfalch/providers` at the version that has it). Optional, and false
@@ -420,6 +474,23 @@ export interface FoundryPlanApplyOptions {
      * reported blocked instead of planned to fail.
      */
     edge?: boolean;
+    /**
+     * The executor was built with an `ownServices` port. Without it, an org
+     * that runs its own services (`services.own`) is reported blocked and none of
+     * its steps run.
+     */
+    ownServices?: boolean;
+    /**
+     * Says whether an own org's media server slot has its ports open on the
+     * Coolify server. Foundry opens none, so without this the plan keeps a
+     * fixed line naming them. A call that fails or takes over five seconds
+     * counts as not open.
+     */
+    sfuPortsOpen?: (range: {
+        udpStart: number;
+        udpEnd: number;
+        tcp: number;
+    }) => Promise<boolean>;
     /**
      * Narrows every org plan to the steps `step` accepts, and its blocked items
      * to the keys `blocked` accepts, so a plan, its stale check and its apply
@@ -459,6 +530,15 @@ export interface FoundryPlanApplyOptions {
      * every existing caller of this constructor is unaffected.
      */
     appliedVersions?: AppliedVersionsStore;
+    /**
+     * F6: the Coolify slice that reads a company database's backups. With it, an
+     * org's databases get backup steps and a confirmed stateful upgrade is
+     * refused without a fresh finished dump (`backup-gate.ts`). Without it
+     * neither happens, so an existing caller is unaffected.
+     */
+    backupGate?: {
+        coolify: MoveGatePorts['coolify'];
+    };
     /**
      * #167: dependencies for planning/applying the shared platform (#166)
      * alongside an org. Optional so an org-only caller — every #19-era caller,
@@ -487,12 +567,6 @@ export interface FoundryPlanApplyOptions {
         heldKeys?: HeldKeyResolver;
     };
 }
-/**
- * The #19 implementation of {@link PlanApply}: computes a plan against live
- * state, and refuses to apply one that has gone stale, one that touches a
- * destructive or migrating step without the org's name typed, or one the
- * actor is not authorized to run.
- */
 export declare class FoundryPlanApply implements PlanApply {
     private readonly store;
     private readonly readers;
@@ -504,6 +578,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly agora;
     private readonly jobsScheduler;
     private readonly loginHostBindings;
+    private readonly loginHostDiscovery;
     private readonly zitadelIdTokenUserinfo;
     private readonly broker;
     private readonly edgeWorkers;
@@ -511,10 +586,13 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly hostFiles;
     private readonly hostAi;
     private readonly hostEdge;
+    private readonly hostOwnServices;
+    private readonly sfuPortsOpen;
     private readonly onlySteps;
     private readonly now;
     private readonly leaseTtlMs;
     private readonly appliedVersions;
+    private readonly backupGate;
     private readonly platformDeps;
     private readonly runner;
     constructor(options: FoundryPlanApplyOptions);
@@ -653,6 +731,8 @@ export declare class FoundryPlanApply implements PlanApply {
     private refusePlatform;
     private refuseDestroy;
     private runSteps;
+    /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
+    private readSfuPortsOpen;
     private computeFreshPlan;
     /**
      * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
@@ -669,12 +749,31 @@ export declare class FoundryPlanApply implements PlanApply {
      * org step that needs one is blocked.
      */
     private orgPlatformReadiness;
+    /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
+    private ownMailKeyHeld;
+    /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
+    private ownResumableRefs;
+    /**
+     * The host port an own org's Stalwart publishes for the relay: the one it already has recorded, else
+     * the lowest port in the range no other org has recorded. Two plans made at the same moment could pick
+     * the same port; the second Stalwart then fails to bind it and the step fails, with nothing recorded.
+     */
+    private ownMailSmtpPort;
+    /** The relay is declared and has recorded the routes it last applied: port 25 reaches the mail servers. */
+    private mailRelayApplied;
+    /**
+     * The relay's last applied routes (a fingerprint, recorded when it deploys) are the routes the
+     * orgs' recorded SMTP addresses give now, and one of them is this org's mail domain.
+     */
+    private mailRelayHoldsRoute;
+    private sharedPlatformReadiness;
     /**
      * #177: `AgoraHostValues` from the applied platform, the same
      * `platformDeps` {@link orgPlatformReadiness} reads -- but only when the
      * host supplies no `agora` port of its own. An explicit `agora` (#164)
      * always wins, unchanged, so a host that already has its own values
-     * (perhaps not yet wired to this platform) keeps them.
+     * (perhaps not yet wired to this platform) keeps them. An org that owns its
+     * services never takes the host's values: they belong to the shared services.
      */
     private orgAgoraHost;
     /**
@@ -690,6 +789,18 @@ export declare class FoundryPlanApply implements PlanApply {
     /** #167: `FoundryPlanApplyOptions.platform`, or a plain `Error` naming what's missing. */
     private requirePlatformDeps;
     private computeFreshPlatformPlan;
+    /** The owner company's own sign-in and files host, read from its applied ids; `null` members until applied. */
+    private platformOwnerInput;
+    /**
+     * What the shared mail relay needs from the orgs. A route exists for an org
+     * that owns its services, serves mail on its own domain and has recorded its
+     * mail server's SMTP address (`mail_smtp_internal`, written by the company
+     * mail step), on its mail domain: its own domain, or `<slug>.oikos.host`.
+     * There is no platform mail server: a domain with no route is refused. An org
+     * that owns its services but has no mail server yet has no route, so the
+     * relay refuses its mail until the server exists.
+     */
+    private mailRelayInputs;
     private sfuBlockedReason;
     /**
      * {@link runSteps}, for the platform. The ids the steps return are recorded