@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/plan/own-limits.js

@@ -1,16 +1,55 @@
+import { hasCapabilities, withCapabilities } from './run-options.js';
 /**
- * The hard limits every container of a company that runs its own services
- * gets: one flat default. Field names are Coolify's (`PATCH /applications/{uuid}`
+ * The hard limits of every container foundry creates, per step (`LIMITS`). Field names are Coolify's (`PATCH /applications/{uuid}`
  * and `PATCH /databases/{uuid}`: `limits_memory`, `limits_cpus`). Coolify has
  * no field for a process limit, and its `custom_docker_run_options` parser drops
  * `--pids-limit`, so 512 processes cannot be set through Coolify.
  */
 export const OWN_LIMITS_MEMORY = '1g';
 export const OWN_LIMITS_CPUS = '1';
-const OWN_LIMITS = { limits_memory: OWN_LIMITS_MEMORY, limits_cpus: OWN_LIMITS_CPUS };
+const profile = (memory, dbMemory = memory, autoDeploy = false, capabilities = 'A') => ({ memory, dbMemory, autoDeploy, capabilities });
+/**
+ * The one table of memory limits, per step. Every container foundry creates
+ * is in a step named here. The five `own*` rows are the flat 1g the own
+ * services already ran with. A Node or Next app gets 1g, a small Postgres
+ * 512m, the Go-sized helpers (relay, boule, edge, hc) less.
+ */
+export const LIMITS = {
+    ownAuth: profile('1g'),
+    ownJobs: profile('1g'),
+    ownFiles: profile('1g'),
+    ownMail: profile('1g'),
+    ownSfu: profile('1g'),
+    /** A customer's hosting entry: capability tier B, unless the entry declares `capabilities: 'standard'`. */
+    companyApp: profile('1g', '1g', 'declared', 'B'),
+    companyAppStandard: profile('1g', '1g', 'declared'),
+    brokerEntry: profile('1g', '1g', 'declared'),
+    cms: profile('1g', '512m'),
+    chat: profile('1g', '512m'),
+    calls: profile('1g', '512m'),
+    agora: profile('1g', '512m'),
+    boule: profile('512m'),
+    companyOther: profile('1g', '512m'),
+    platformArchon: profile('1g'),
+    platformAi: profile('1g'),
+    platformIntegrations: profile('1g', '512m'),
+    platformMailRelay: profile('256m'),
+    platformIngress: profile('256m'),
+    connector: profile('256m'),
+    platformFiles: profile('1g'),
+    platformEdge: profile('512m'),
+    platformHc: profile('512m'),
+    platformMail: profile('1g'),
+    platformAuth: profile('1g'),
+    platformJobs: profile('1g'),
+};
 /** The same bound the neighbouring Coolify calls in this package use for a call that may hang. */
 export const OWN_LIMITS_TIMEOUT_MS = 60_000;
-const lacks = (r) => Boolean(r) && (r?.limits_memory !== OWN_LIMITS_MEMORY || r?.limits_cpus !== OWN_LIMITS_CPUS);
+const appLimits = (p) => ({ limits_memory: p.memory, limits_cpus: OWN_LIMITS_CPUS });
+const dbLimits = (p) => ({ limits_memory: p.dbMemory, limits_cpus: OWN_LIMITS_CPUS });
+const lacks = (r, want) => Boolean(r) && (r?.limits_memory !== want.limits_memory || r?.limits_cpus !== OWN_LIMITS_CPUS);
+const capsLack = (r, p) => Boolean(r) &&
+    !hasCapabilities(typeof r?.custom_docker_run_options === 'string' ? r.custom_docker_run_options : null, p.capabilities);
 async function bounded(work, what) {
     let timer;
     try {
@@ -25,72 +64,158 @@ async function bounded(work, what) {
         clearTimeout(timer);
     }
 }
+const wrapped = new WeakSet();
 /**
- * The Coolify port an own-services step uses, with the limits set on every
+ * The Coolify port a step uses, with the profile's memory limit set on every
  * application and database it creates, and set again on one it finds without
- * them, so a company provisioned before the limits existed converges on its
- * next apply. A failed limits call fails the calling step before it records
- * its applied marker; the next run finds the resource and sets them.
+ * it, so a company provisioned before the limits existed converges on its
+ * next apply. With `autoDeploy: false` a git application is created with
+ * auto-deploy off, and one found or updated with it on is switched off. A
+ * failed limits call fails the calling step before it records its applied
+ * marker; the next run finds the resource and sets them.
+ *
+ * `scope` is a profile, or a function that gives the profile of the step now
+ * running (none: the port is used as it is).
+ *
+ * Every limits call has a 60 second timeout. A step that creates a resource
+ * and then fails on the limits call leaves a resource without limits; the
+ * next run finds it by name and sets them.
  */
-export function limited(coolify) {
-    const patchApp = (uuid) => {
+export function limited(coolify, scope = LIMITS.ownAuth) {
+    if (wrapped.has(coolify))
+        return coolify;
+    const current = () => (typeof scope === 'function' ? scope() : scope);
+    // `existing`: the application as just read, or the options just sent on its create. Absent, it is read
+    // here, because the capability options are written together with the `--entrypoint` already on the app.
+    const patchApp = async (uuid, p, autoDeploy, existing) => {
         if (!coolify.updateApplication)
             throw new Error('own limits: the Coolify port has no updateApplication');
-        return bounded(coolify.updateApplication(uuid, OWN_LIMITS), `application ${uuid}`);
+        const current = existing ??
+            (coolify.getApplication
+                ? await bounded(coolify.getApplication(uuid), `application ${uuid}`)
+                : undefined);
+        const options = current === undefined
+            ? {}
+            : {
+                custom_docker_run_options: withCapabilities(typeof current?.custom_docker_run_options === 'string'
+                    ? current.custom_docker_run_options
+                    : null, p.capabilities),
+            };
+        return bounded(coolify.updateApplication(uuid, {
+            ...appLimits(p),
+            ...options,
+            ...(autoDeploy ? { is_auto_deploy_enabled: false } : {}),
+        }), `application ${uuid}`);
     };
-    const patchDb = (uuid) => {
+    const patchDb = (uuid, p) => {
         if (!coolify.raw)
             throw new Error('own limits: the Coolify port has no raw');
-        return bounded(coolify.raw('PATCH', `/databases/${uuid}`, OWN_LIMITS), `database ${uuid}`);
+        return bounded(coolify.raw('PATCH', `/databases/${uuid}`, dbLimits(p)), `database ${uuid}`);
     };
-    const afterCreate = (create, patch) => async (input) => {
-        const created = await create.call(coolify, input);
-        await patch(created.uuid);
+    const afterCreate = (method, git) => async (input) => {
+        const p = current();
+        const noDeploy = git && p?.autoDeploy === false && input.is_auto_deploy_enabled === undefined
+            ? { ...input, is_auto_deploy_enabled: false }
+            : input;
+        const sent = p
+            ? {
+                ...noDeploy,
+                custom_docker_run_options: withCapabilities(typeof input.custom_docker_run_options === 'string'
+                    ? input.custom_docker_run_options
+                    : null, p.capabilities),
+            }
+            : noDeploy;
+        const create = coolify[method];
+        const created = await create.call(coolify, sent);
+        if (p) {
+            await patchApp(created.uuid, p, false, {
+                custom_docker_run_options: sent
+                    .custom_docker_run_options,
+            });
+            settled.add(created.uuid);
+        }
         return created;
     };
     const over = {};
     if (coolify.createGithubAppApplication)
-        over.createGithubAppApplication = afterCreate(coolify.createGithubAppApplication, patchApp);
+        over.createGithubAppApplication = afterCreate('createGithubAppApplication', true);
     if (coolify.createDockerImageApplication)
-        over.createDockerImageApplication = afterCreate(coolify.createDockerImageApplication, patchApp);
+        over.createDockerImageApplication = afterCreate('createDockerImageApplication', false);
     if (coolify.createDockerfileApplication)
-        over.createDockerfileApplication = afterCreate(coolify.createDockerfileApplication, patchApp);
+        over.createDockerfileApplication = afterCreate('createDockerfileApplication', false);
     if (coolify.createPostgresDatabase) {
-        const create = coolify.createPostgresDatabase;
         over.createPostgresDatabase = async (input) => {
-            const created = await create.call(coolify, input);
-            await patchDb(created.uuid);
+            const created = await coolify.createPostgresDatabase.call(coolify, input);
+            const p = current();
+            if (p)
+                await patchDb(created.uuid, p);
             return created;
         };
     }
     const getApplication = coolify.getApplication;
+    const update = coolify.updateApplication;
+    // Applications already brought to the profile by this port: no second patch for them.
+    const settled = new Set();
+    const settle = async (uuid, p, app, git) => {
+        if (settled.has(uuid))
+            return;
+        const deploys = git && p.autoDeploy === false && app?.is_auto_deploy_enabled !== false;
+        if (!app || lacks(app, appLimits(p)) || capsLack(app, p) || deploys) {
+            await patchApp(uuid, p, deploys, app);
+        }
+        settled.add(uuid);
+    };
+    if (update) {
+        over.updateApplication = async (uuid, patch) => {
+            const p = current();
+            // A step that sends its own run options (the entrypoint) must not take the capability options off.
+            const sent = p && typeof patch.custom_docker_run_options === 'string'
+                ? {
+                    ...patch,
+                    custom_docker_run_options: withCapabilities(patch.custom_docker_run_options, p.capabilities),
+                }
+                : patch;
+            const out = await coolify.updateApplication?.call(coolify, uuid, sent);
+            if (p) {
+                const git = 'git_branch' in patch || 'is_auto_deploy_enabled' in patch;
+                await settle(uuid, p, null, git);
+            }
+            return out;
+        };
+    }
     if (getApplication) {
         over.getApplication = async (uuid) => {
-            const app = await getApplication.call(coolify, uuid);
-            if (lacks(app))
-                await patchApp(uuid);
+            const app = await coolify.getApplication?.call(coolify, uuid);
+            const p = current();
+            if (p && app)
+                await settle(uuid, p, app, Boolean(app.git_repository));
             return app;
         };
     }
     const find = coolify.findApplicationByName;
     if (find && getApplication) {
         over.findApplicationByName = async (...args) => {
-            const found = await find.apply(coolify, args);
-            if (found && lacks(await getApplication.call(coolify, found.uuid)))
-                await patchApp(found.uuid);
+            const found = await coolify.findApplicationByName?.apply(coolify, args);
+            const p = current();
+            if (found && p) {
+                const app = await coolify.getApplication?.call(coolify, found.uuid);
+                if (app)
+                    await settle(found.uuid, p, app, Boolean(app.git_repository));
+            }
             return found;
         };
     }
     const getDatabase = coolify.getDatabase;
     if (getDatabase) {
         over.getDatabase = async (uuid) => {
-            const db = await getDatabase.call(coolify, uuid);
-            if (lacks(db))
-                await patchDb(uuid);
+            const db = await coolify.getDatabase?.call(coolify, uuid);
+            const p = current();
+            if (p && lacks(db, dbLimits(p)))
+                await patchDb(uuid, p);
             return db;
         };
     }
-    return new Proxy(coolify, {
+    const proxy = new Proxy(coolify, {
         get(target, prop) {
             if (typeof prop === 'string' && prop in over)
                 return over[prop];
@@ -98,4 +223,10 @@ export function limited(coolify) {
             return typeof value === 'function' ? value.bind(target) : value;
         },
     });
+    wrapped.add(proxy);
+    return proxy;
+}
+/** The deps of a step with their Coolify port limited by `profile`. */
+export function limitedDeps(deps, profile) {
+    return { ...deps, coolify: limited(deps.coolify, profile) };
 }

package/dist/plan/own-services.js

@@ -1,3 +1,4 @@
+import { NO_DOMAIN_ZONE } from './own-hostnames.js';
 import { apexZoneKey, exactZone, platformDns, platformTunnels } from './platform-providers.js';
 /** The key the org's zone step records its Cloudflare zone id under. */
 const ORG_ZONE_SCOPE_KEY = 'cloudflare_zone';
@@ -143,7 +144,8 @@ export function orgNetwork(ports, scope, step) {
             return ports.tunnels;
         },
         zoneId: async (apex) => {
-            const recorded = scope.recordedIds()[ORG_ZONE_SCOPE_KEY];
+            // The recorded zone is the company's own; `oikos.host` is never it.
+            const recorded = apex === NO_DOMAIN_ZONE ? undefined : scope.recordedIds()[ORG_ZONE_SCOPE_KEY];
             if (recorded)
                 return recorded;
             return ports.zones ? (await exactZone(ports.zones, apex))?.id : undefined;

package/dist/plan/own-sfu.js

@@ -1,3 +1,4 @@
+import { pinnedTagFor } from '../bootstrap/versions.js';
 import { mintLivekitCredentials } from '../calls-sfu-keys.js';
 import { LIVEKIT_SIGNALLING_PORT, sfuSlotPorts } from '../calls-sfu.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
@@ -105,7 +106,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             docker_registry_image_name: OWN_SFU_IMAGE,
-            docker_registry_image_tag: input.version,
+            docker_registry_image_tag: pinnedTagFor('livekit', input.version),
             ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
             ports_mappings: sfuPortsMappings(input.slot),
             name: target.names.sfuApp,
@@ -121,7 +122,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
     // Set on every run: a declared version or slot reaches an existing app here.
     await coolify.updateApplication(appId, {
         custom_internal_name: target.internal.sfu,
-        docker_registry_image_tag: input.version,
+        docker_registry_image_tag: pinnedTagFor('livekit', input.version),
         ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
         ports_mappings: sfuPortsMappings(input.slot),
         ...healthCheckSettings('/', LIVEKIT_SIGNALLING_PORT),

package/dist/plan/plan-apply.d.ts

@@ -7,11 +7,12 @@ import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
 import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js';
 import { type AgoraHostPort } from './agora.js';
+import { type MoveGatePorts } from './backup-gate.js';
 import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
-import { type EdgePortName, type HeldKeyResolver } from './platform-org.js';
+import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
@@ -124,6 +125,11 @@ export interface AuthzGate {
  */
 export interface StepExecutionContext {
     readonly org: DeclaredOrg;
+    /**
+     * True when `org` is the platform's own company (`DeclaredPlatform.ownerOrgId`). It stays on the
+     * platform's Docker network, not on `co-<slug>`, so Archon reaches its database. Absent: false.
+     */
+    readonly ownerCompany?: boolean;
     /**
      * Every id foundry has recorded for this org so far — both `system:kind:key`
      * resource ids (`runSteps` records these itself from `execute`'s own return
@@ -199,6 +205,13 @@ export interface StepExecutor {
      * this says false. Optional: an executor without it is taken to have the port.
      */
     ownFilesOrganisationPort?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /**
+     * Whether the host's scoped ports for this own org include a broker port, the company's own
+     * broker. An own org's broker entries are planned on this answer, not on
+     * {@link FoundryPlanApplyOptions.broker}, which names the shared broker. Optional: an executor
+     * without it leaves the option as the answer.
+     */
+    ownBrokerPort?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
     /**
      * Every secret this executor minted or read so far (peer password, bridge
      * secret, invite code and link). The host's run adds them to its redactor
@@ -219,6 +232,8 @@ export interface StepExecutor {
  */
 export interface PlatformStepExecutionContext {
     readonly platform: DeclaredPlatform;
+    /** The owner company's own sign-in and files host, when applied. Archon and the Access provider read them. */
+    readonly owner?: PlatformOwnerInput;
     /** {@link StepExecutionContext.recordedIds}, for the platform's own run. */
     recordedIds(): Readonly<Record<string, string>>;
     /** {@link StepExecutionContext.recordScopeId}, for the platform's own run. */
@@ -254,7 +269,7 @@ export interface PlatformStepExecutor {
      * unmanaged item and plans no step for it, the way a blocked Agora is
      * reported, instead of planning a step that throws on every apply.
      */
-    blockedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<{
+    blockedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<{
         auth?: string;
         /** #211 round 6: see `PlanPlatformOptions.blocked.authExecutorMissing`. */
         authExecutorMissing?: boolean;
@@ -269,6 +284,8 @@ export interface PlatformStepExecutor {
         relay?: string;
         /** #604: see `PlanPlatformOptions.blocked.accessProvider` (`platform-diff.ts`). */
         accessProvider?: string;
+        /** See `PlanPlatformOptions.blocked.oikosIngress` (`platform-diff.ts`). */
+        oikosIngress?: string;
         /** #257: see `PlanPlatformOptions.blocked.backupExecutorMissing` (`platform-diff.ts`). */
         backupExecutorMissing?: boolean;
         /** #540: see `PlanPlatformOptions.blocked.hc` (`platform-diff.ts`). */
@@ -291,7 +308,7 @@ export interface PlatformStepExecutor {
      * the token and the edge step does not clear the flag, so the host must stop
      * reporting it once edge holds the new token and the old one is gone.
      */
-    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<PlatformDriftedSteps>;
+    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<PlatformDriftedSteps>;
     /**
      * Gives the platform files runner a changed share-domain set and touches
      * nothing else. Returns the scope ids to record (only the share-domains
@@ -513,6 +530,15 @@ export interface FoundryPlanApplyOptions {
      * every existing caller of this constructor is unaffected.
      */
     appliedVersions?: AppliedVersionsStore;
+    /**
+     * F6: the Coolify slice that reads a company database's backups. With it, an
+     * org's databases get backup steps and a confirmed stateful upgrade is
+     * refused without a fresh finished dump (`backup-gate.ts`). Without it
+     * neither happens, so an existing caller is unaffected.
+     */
+    backupGate?: {
+        coolify: MoveGatePorts['coolify'];
+    };
     /**
      * #167: dependencies for planning/applying the shared platform (#166)
      * alongside an org. Optional so an org-only caller — every #19-era caller,
@@ -566,6 +592,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly now;
     private readonly leaseTtlMs;
     private readonly appliedVersions;
+    private readonly backupGate;
     private readonly platformDeps;
     private readonly runner;
     constructor(options: FoundryPlanApplyOptions);
@@ -726,8 +753,19 @@ export declare class FoundryPlanApply implements PlanApply {
     private ownMailKeyHeld;
     /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
     private ownResumableRefs;
+    /**
+     * The host port an own org's Stalwart publishes for the relay: the one it already has recorded, else
+     * the lowest port in the range no other org has recorded. Two plans made at the same moment could pick
+     * the same port; the second Stalwart then fails to bind it and the step fails, with nothing recorded.
+     */
+    private ownMailSmtpPort;
     /** The relay is declared and has recorded the routes it last applied: port 25 reaches the mail servers. */
     private mailRelayApplied;
+    /**
+     * The relay's last applied routes (a fingerprint, recorded when it deploys) are the routes the
+     * orgs' recorded SMTP addresses give now, and one of them is this org's mail domain.
+     */
+    private mailRelayHoldsRoute;
     private sharedPlatformReadiness;
     /**
      * #177: `AgoraHostValues` from the applied platform, the same
@@ -751,14 +789,16 @@ export declare class FoundryPlanApply implements PlanApply {
     /** #167: `FoundryPlanApplyOptions.platform`, or a plain `Error` naming what's missing. */
     private requirePlatformDeps;
     private computeFreshPlatformPlan;
+    /** The owner company's own sign-in and files host, read from its applied ids; `null` members until applied. */
+    private platformOwnerInput;
     /**
      * What the shared mail relay needs from the orgs. A route exists for an org
      * that owns its services, serves mail on its own domain and has recorded its
      * mail server's SMTP address (`mail_smtp_internal`, written by the company
-     * mail step). Every other org with mail on its own domain, the platform
-     * apex and the shared no-domain apex are platform domains: the platform's Stalwart receives them. An org
-     * that owns its services but has no mail server yet appears in neither list,
-     * so the relay refuses its mail until the server exists.
+     * mail step), on its mail domain: its own domain, or `<slug>.oikos.host`.
+     * There is no platform mail server: a domain with no route is refused. An org
+     * that owns its services but has no mail server yet has no route, so the
+     * relay refuses its mail until the server exists.
      */
     private mailRelayInputs;
     private sfuBlockedReason;