@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/platform-org.d.ts

@@ -1,5 +1,6 @@
+import { type DeclaredOrg, type VersionPin } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
-import type { AgoraHostValues } from './agora.js';
+import { type AgoraHostValues } from './agora.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -75,8 +76,8 @@ export interface OrgPlatformReadiness {
     /** The AI host (#172), the same always-on shape as {@link filesReady}. */
     aiReady: boolean;
     /**
-     * The AI host's internal address, which an entry with `uses.ai` gets as
-     * `AI_URL`. `null` or absent until the platform has recorded it.
+     * The AI host's public origin (`https://<platform.ai.hostname>`), which an entry with `uses.ai`
+     * gets as `AI_URL`. `null` or absent until the platform has applied the AI host.
      */
     aiUrl?: string | null;
     /**
@@ -86,8 +87,30 @@ export interface OrgPlatformReadiness {
      * read, so "applied" has no separate check.
      */
     callsReady: boolean;
+    /** The shared oikos.host ingress (tunnel, wildcard record, rate limit) is applied. Absent reads as false. */
+    oikosIngressApplied?: boolean;
+    /**
+     * The broker app Archon last registered on (`PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY`). The
+     * owner's own sign-in counts that registration as its broker's first entry: the broker starts
+     * on it and the login client is minted once it is there. Absent or `null` when Archon has not
+     * registered.
+     */
+    archonBrokerAppId?: string | null;
+    /**
+     * The ZITADEL project and client ids the platform made in the owner company's own ZITADEL
+     * (Archon's and the Access provider's). The owner company's page counts them as the
+     * platform's, not as strangers. Absent when none is recorded.
+     */
+    platformZitadelIds?: readonly string[];
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
+    /**
+     * The host of the platform's own shared sign-in when its Coolify app is still recorded
+     * (`coolify:app:platform:auth`), whether or not this build declares it. Absent on a platform
+     * built from empty. The owner company's own sign-in takes the same name on the apex, so it
+     * waits while this is set.
+     */
+    platformAuthRecordedHost?: string;
     /** `https://<platform.auth.hostname>`, the platform's own sign-in issuer; `null` until {@link authReady}. The owner invite reads its issuer here, never from Agora's host config. */
     authIssuer: string | null;
     /** The Access provider id the platform recorded (`ACCESS_PROVIDER_RECORD_KEY`), which every gate requires. `null` or absent until the platform has recorded it. */
@@ -141,7 +164,7 @@ export interface OrgPlatformReadiness {
     };
     /**
      * The platform's Lettermint key (`PLATFORM_AUTH_BROKER_MAIL_KEY_REF`) is held,
-     * so an entry env from `platformMailKey` can be filled. Absent reads as not held.
+     * so the owner company's mail can be planned. Absent reads as not held.
      */
     mailKeyHeld?: boolean;
     /** The host's held keys can `put`, so an entry env from `sharedSecret` can be filled. Absent reads as false. */
@@ -151,6 +174,19 @@ export interface OrgPlatformReadiness {
      * A missing key is then reported as "no reader given" instead of "not held".
      */
     noKeyReader?: boolean;
+    /** The platform's declared git ref for each service, which an own org's services deploy. */
+    serviceGitRefs?: {
+        auth: string;
+        mail: string;
+        files: string;
+        jobs: string;
+    };
+    /**
+     * The user id an own org's files host takes as `AUTHZ_BOOTSTRAP_OPERATOR`: the owner company's
+     * owner in the owner company's own ZITADEL ({@link platformOwnerUserIdFrom}), or `'none'` when
+     * the owner company has no owner to invite. `null` or absent until recorded.
+     */
+    platformOwnerUserId?: string | null;
 }
 /**
  * What an org's plan reads when no platform is declared: nothing is ready, so
@@ -207,6 +243,26 @@ heldRefs?: ReadonlySet<string>,
 noKeyReader?: boolean, 
 /** #317: true when the host's executor was built with an `EdgePort` ({@link OrgPlatformReadiness.edgeReady}). */
 edgePortPresent?: boolean): OrgPlatformReadiness;
+/** The git refs the platform declares for the services an own org deploys; a company's `pin` wins per part. */
+export declare function serviceGitRefsOf(platform: DeclaredPlatform, pin?: VersionPin | null): {
+    auth: string;
+    mail: string;
+    files: string;
+    jobs: string;
+};
+/** The runner app both the platform's and an own org's files step record. */
+export declare const OWN_FILES_RUNNER_SCOPE_KEY = "coolify_platform_files_runner_app";
+/**
+ * An own org (`services.own`) plans against its own services, so its readiness
+ * reads only its own recorded ids and its own held keys; nothing the shared
+ * services recorded reaches it. AI, edge and Access stay shared and come from
+ * `base`. Any other org gets `base` back unchanged.
+ */
+export declare function orgPlatformReadinessFor(org: DeclaredOrg, base: OrgPlatformReadiness, orgRecordedIds: Readonly<Record<string, string>>, heldRefs: ReadonlySet<string>): OrgPlatformReadiness;
+/** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
+export declare function heldOwnKeyRefs(heldKeys: HeldKeyResolver, org: Pick<DeclaredOrg, 'slug'>): Promise<Set<string>>;
+/** {@link agoraHostValuesFromPlatform}'s counterpart for an own org: every value is the org's own, null until recorded. */
+export declare function agoraHostValuesForOwn(org: DeclaredOrg, orgRecordedIds: Readonly<Record<string, string>>): AgoraHostValues;
 /**
  * #177: {@link AgoraHostValues} derived from the same platform state, rather
  * than requiring a bespoke host-supplied `AgoraHostPort` for values the
@@ -223,3 +279,50 @@ edgePortPresent?: boolean): OrgPlatformReadiness;
  * host-supplied `agora` port overrides it.
  */
 export declare function agoraHostValuesFromPlatform(platform: DeclaredPlatform, platformRecordedIds: Readonly<Record<string, string>>): AgoraHostValues;
+/**
+ * The owner company's own sign-in, as the platform plan reads it. `null` (the
+ * platform plan's input) until the owner's own sign-in step and its ZITADEL
+ * organisation are applied. `bearerRef` is a held-key reference, never a value.
+ */
+export interface OwnerSignIn {
+    issuerUrl: string;
+    organisationId: string;
+    brokerAppId: string;
+    bearerRef: string;
+    hostname: string;
+    /**
+     * The company's first owner in its own organisation (the CI-side half of
+     * Archon's first-owner link): the recorded user id, `'none'` when no owner
+     * is declared, absent while the owner step has recorded nothing.
+     */
+    firstOwnerUserId?: string | null;
+}
+/** The owner company's own files host, as Archon's `FILES_*` env reads it. */
+export interface OwnerFiles {
+    internalUrl: string;
+    audience: string;
+    organisationId: string;
+    managementKeyRef: string;
+}
+/** What the platform plan reads about the owner company. */
+export interface PlatformOwnerInput {
+    signIn?: OwnerSignIn | null;
+    files?: OwnerFiles | null;
+}
+/**
+ * The owner's sign-in from its declared org and the ids its own steps recorded.
+ * The host and issuer are the host the own-auth step last applied, and only
+ * while that is the declared `ownHostnames(org).auth`: a domain edit gives
+ * `null` until the step has applied the new host, so the owner's instance
+ * token is never sent to a host the step has not set up.
+ */
+export declare function ownerSignInFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): OwnerSignIn | null;
+/**
+ * The platform's operator identity for a company's files host: the owner company's first owner,
+ * as the owner's `zitadel:owner` step recorded it in the owner company's own ZITADEL. `'none'`
+ * when the owner company declares no owner; `null` until the step has recorded the id, and
+ * when there is no owner company running its own services.
+ */
+export declare function platformOwnerUserIdFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): string | null;
+/** The owner's files host once its own files step has applied; `null` before. */
+export declare function ownerFilesFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): OwnerFiles | null;

package/dist/plan/platform-org.js

@@ -1,6 +1,12 @@
+import { ownsServices } from '../org.js';
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
-import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
-import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
+import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
+import { oikosIngressApplied } from './oikos-ingress.js';
+import { ownHostnames } from './own-hostnames.js';
+import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
+import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -132,11 +138,27 @@ edgePortPresent = false) {
             ? (platformRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] ?? null)
             : null,
         aiReady: aiApplied && missingKeys.ai === null,
-        aiUrl: aiApplied ? (platformRecordedIds[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY] ?? null) : null,
+        // An entry runs on its company's own network and cannot dial the platform's container name, so it
+        // is given the host's public origin.
+        // Only once the route (tunnel, connector, DNS record) is recorded: before it the hostname answers nothing.
+        aiUrl: aiApplied && platformRecordedIds[PLATFORM_AI_TUNNEL_SCOPE_KEY]
+            ? `https://${platform.ai.hostname}`
+            : null,
         callsReady: platform.sfu.enabled,
+        oikosIngressApplied: oikosIngressApplied(platformRecordedIds),
+        archonBrokerAppId: platformRecordedIds[PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY] ?? null,
+        platformZitadelIds: [
+            PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY,
+            PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY,
+            PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY,
+            PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY,
+        ].flatMap((key) => platformRecordedIds[key] || []),
         ...(platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY]
             ? { accessProviderId: platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY] }
             : {}),
+        ...(coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY)
+            ? { platformAuthRecordedHost: platform.auth.hostname }
+            : {}),
         authReady,
         authIssuer: authReady ? `https://${platform.auth.hostname}` : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
@@ -147,6 +169,100 @@ edgePortPresent = false) {
         ...(noKeyReader ? { noKeyReader } : {}),
     };
 }
+/** The git refs the platform declares for the services an own org deploys; a company's `pin` wins per part. */
+export function serviceGitRefsOf(platform, pin) {
+    return {
+        auth: pin?.auth ?? platform.auth.gitRef,
+        mail: pin?.mail ?? platform.mail.gitRef,
+        files: pin?.files ?? platform.files.gitRef,
+        jobs: pin?.jobs ?? platform.jobs.gitRef,
+    };
+}
+/** The runner app both the platform's and an own org's files step record. */
+export const OWN_FILES_RUNNER_SCOPE_KEY = 'coolify_platform_files_runner_app';
+const OWN_MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+/** Resource id of an own-service step, in `AppliedState.serviceIds`' `system:kind:key` form. */
+function ownStepRecorded(ids, org, kind) {
+    return Boolean(ids[`coolify:${kind}:${org.id}`]);
+}
+/**
+ * The own org's sign-in is up: applied, so its ZITADEL answers. The broker and the login client
+ * come after the org's first broker entry, as the platform's do after its first registration, so
+ * waiting for them here would wait for the very steps this gate lets run.
+ */
+function ownAuthReady(ids) {
+    return Boolean(ids[OWN_SERVICES_APPLIED_SCOPE_KEY]);
+}
+/**
+ * An own org (`services.own`) plans against its own services, so its readiness
+ * reads only its own recorded ids and its own held keys; nothing the shared
+ * services recorded reaches it. AI, edge and Access stay shared and come from
+ * `base`. Any other org gets `base` back unchanged.
+ */
+export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
+    if (!ownsServices(org))
+        return base;
+    const refs = orgTarget(org).refs;
+    const authReady = ownAuthReady(orgRecordedIds);
+    const filesApplied = ownStepRecorded(orgRecordedIds, org, 'own-files') &&
+        Boolean(orgRecordedIds[OWN_FILES_RUNNER_SCOPE_KEY]);
+    const jobsApplied = ownStepRecorded(orgRecordedIds, org, 'own-jobs');
+    const mailApplied = ownStepRecorded(orgRecordedIds, org, 'own-mail') &&
+        Boolean(orgRecordedIds[OWN_MAIL_APP_SCOPE_KEY]);
+    const filesUrl = orgRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY];
+    const jobsUrl = orgRecordedIds[JOBS_INTERNAL_URL_SCOPE_KEY];
+    const missing = (applied, ref) => applied && !heldRefs.has(ref) ? ref : null;
+    const missingKeys = {
+        files: missing(filesApplied, refs.filesManagement),
+        ai: base.missingKeys.ai,
+        jobs: missing(jobsApplied, refs.jobsAdminToken),
+    };
+    const { jobsUrlMissing: _shared, ...rest } = base;
+    return {
+        ...rest,
+        authReady,
+        authIssuer: authReady ? ownHostnames(org).issuerUrl : null,
+        filesReady: filesApplied && filesUrl !== undefined && missingKeys.files === null,
+        filesUrl: filesApplied ? (filesUrl ?? null) : null,
+        jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
+        ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),
+        callsReady: ownStepRecorded(orgRecordedIds, org, 'own-sfu'),
+        // The MX name is the shared relay's, `mx.<platform apex>`: no platform mail step is needed.
+        // The apex is the company's mail zone: its domain when mail runs on it, else oikos.host.
+        mailHost: mailApplied && base.platformApex
+            ? {
+                apex: org.domain && org.mail.usesDomain ? org.domain : NO_DOMAIN_MAIL_APEX,
+                mailHost: platformMailMxHost(base.platformApex),
+            }
+            : null,
+        missingKeys,
+    };
+}
+/** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
+export async function heldOwnKeyRefs(heldKeys, org) {
+    const held = new Set();
+    for (const ref of Object.values(orgTarget(org).refs)) {
+        try {
+            if (await heldKeys.resolve(ref))
+                held.add(ref);
+        }
+        catch {
+            // not held
+        }
+    }
+    return held;
+}
+/** {@link agoraHostValuesFromPlatform}'s counterpart for an own org: every value is the org's own, null until recorded. */
+export function agoraHostValuesForOwn(org, orgRecordedIds) {
+    const authReady = ownAuthReady(orgRecordedIds);
+    return {
+        issuer: authReady ? ownHostnames(org).issuerUrl : null,
+        mailProjectId: orgRecordedIds[PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY] ?? null,
+        messagingProjectId: null,
+        mailUpstream: orgRecordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] ?? null,
+        filesUpstream: orgRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] ?? null,
+    };
+}
 /**
  * #177: {@link AgoraHostValues} derived from the same platform state, rather
  * than requiring a bespoke host-supplied `AgoraHostPort` for values the
@@ -180,3 +296,59 @@ export function agoraHostValuesFromPlatform(platform, platformRecordedIds) {
             : null,
     };
 }
+/**
+ * The owner's sign-in from its declared org and the ids its own steps recorded.
+ * The host and issuer are the host the own-auth step last applied, and only
+ * while that is the declared `ownHostnames(org).auth`: a domain edit gives
+ * `null` until the step has applied the new host, so the owner's instance
+ * token is never sent to a host the step has not set up.
+ */
+export function ownerSignInFrom(owner, recorded) {
+    if (!owner || !ownsServices(owner) || !ownAuthApplied(owner, recorded))
+        return null;
+    const organisationId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    const brokerAppId = recorded[PLATFORM_AUTH_BROKER_SCOPE_KEY];
+    if (!organisationId || !brokerAppId)
+        return null;
+    const applied = recorded[OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY];
+    if (!applied || applied !== ownHostnames(owner).auth)
+        return null;
+    const hostname = applied;
+    return {
+        issuerUrl: `https://${applied}`,
+        organisationId,
+        brokerAppId,
+        bearerRef: orgTarget(owner).refs.instanceBearer,
+        hostname,
+        firstOwnerUserId: platformOwnerUserIdFrom(owner, recorded),
+    };
+}
+/**
+ * The platform's operator identity for a company's files host: the owner company's first owner,
+ * as the owner's `zitadel:owner` step recorded it in the owner company's own ZITADEL. `'none'`
+ * when the owner company declares no owner; `null` until the step has recorded the id, and
+ * when there is no owner company running its own services.
+ */
+export function platformOwnerUserIdFrom(owner, recorded) {
+    if (!owner || !ownsServices(owner))
+        return null;
+    const first = owner.owners[0];
+    if (!first)
+        return 'none';
+    return recorded[`zitadel:owner:${owner.id}:${first.email.toLowerCase()}`] || null;
+}
+/** The owner's files host once its own files step has applied; `null` before. */
+export function ownerFilesFrom(owner, recorded) {
+    if (!owner || !ownsServices(owner) || !recorded[`coolify:own-files:${owner.id}`])
+        return null;
+    const internalUrl = recorded[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY];
+    const hostname = recorded[PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY];
+    if (!internalUrl || !hostname)
+        return null;
+    return {
+        internalUrl,
+        audience: `https://${hostname}`,
+        organisationId: owner.id,
+        managementKeyRef: orgTarget(owner).refs.filesManagement,
+    };
+}