@wtfalch/foundry 0.36.1 → 0.38.0

package/dist/plan/platform-providers.js

@@ -17,10 +17,11 @@ import { LIMITS, limited } from './own-limits.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
+import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAIL_DATABASE_SCOPE_KEY, MAIL_STORE_POSTGRES, MAIL_STORE_SCOPE_KEY, mailStoreIsLegacy, } from './mail-store.js';
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
@@ -53,6 +54,23 @@ export async function platformTunnels(deps, recorded, step) {
     }
     return deps.tunnels(edgeUrl);
 }
+/**
+ * Request headers a client can set that ZITADEL reads to pick or name an
+ * instance (auth#241, auth#252). Cloudflare removes them from every inbound
+ * request on a sign-in hostname, because the tunnel routes ZITADEL's paths
+ * straight to ZITADEL and no app code sees them first.
+ */
+export const SIGNIN_STRIPPED_REQUEST_HEADERS = [
+    'X-Zitadel-Instance-Host',
+    'X-Zitadel-Public-Host',
+    'X-Zitadel-Forward-Host',
+    'X-Forwarded-Host',
+];
+/** The request header port for a platform step; undefined when edge is not recorded or the host supplied no factory. */
+export async function platformRequestHeaders(deps, recorded) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    return edgeUrl && deps.requestHeaders ? deps.requestHeaders(edgeUrl) : undefined;
+}
 /** The Access port for a platform step; same address and same reason as {@link platformDns}. */
 async function platformAccess(deps, recorded, step) {
     const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
@@ -355,7 +373,7 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
-        await this.uptimeBlocked(platform, recordedIds, blocked);
+        await this.uptimeBlocked(platform, recordedIds, blocked, owner);
         // #604: only once edge and sign-in are applied (the planner reports
         // that case itself) and no provider is recorded yet.
         if (platform.edge.enabled &&
@@ -423,7 +441,7 @@ export class FoundryPlatformStepExecutor {
      * checks the pin and Archon first, so none of the reads here happens before
      * they hold.
      */
-    async uptimeBlocked(platform, recordedIds, blocked) {
+    async uptimeBlocked(platform, recordedIds, blocked, owner = {}) {
         const deployed = Boolean(recordedIds[`cloudflare:worker:${PLATFORM_UPTIME_KEY}`]) &&
             !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
         if (!platform.uptime.enabled && !uptimeRecorded(recordedIds))
@@ -436,15 +454,41 @@ export class FoundryPlatformStepExecutor {
         }
         if (!platform.uptime.enabled)
             return;
-        blocked.uptimeSecretsHeld = Object.keys(await heldUptimeValues(deps));
+        const heldValues = await heldUptimeValues(deps);
+        blocked.uptimeSecretsHeld = Object.keys(heldValues);
         const accessTokenId = recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY];
         const accessHeld = Boolean((await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF)) &&
             (await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF)));
         blocked.uptimeHeld = {
             token: Boolean(await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF)),
             access: accessHeld,
-            vars: uptimeVarsDigest(deps.vars),
+            vars: uptimeVarsDigest(uptimeEffectiveVars(deps.vars, deps.chat && owner.chat && recordedIds[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY]
+                ? {
+                    homeserverUrl: `https://${owner.chat.agoraHost}`,
+                    roomId: recordedIds[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY],
+                }
+                : null)),
         };
+        if (deps.chat && !heldValues.CHAT_ACCESS_TOKEN) {
+            if (!owner.chat) {
+                blocked.uptimeChat = {
+                    pending: false,
+                    blocked: "the uptime Worker's chat alerts are blocked, not planned: the owner company's chat is not applied yet",
+                };
+            }
+            else if (owner.chat.subjects.length === 0) {
+                blocked.uptimeChat = {
+                    pending: false,
+                    blocked: "the uptime Worker's chat alerts are blocked, not planned: the owner company has no owner with a recorded sign-in user to join the alerts room",
+                };
+            }
+            else {
+                blocked.uptimeChat = { pending: true };
+            }
+        }
+        else if (deps.chat) {
+            blocked.uptimeChat = { pending: false };
+        }
         const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
         // A token of the name with no id recorded cannot be minted over, and
         // foundry does not remove what it did not make. With an id recorded the
@@ -650,7 +694,7 @@ export class FoundryPlatformStepExecutor {
             if (!this.mail) {
                 throw new Error('platform:mail needs FoundryPlatformStepExecutor to be constructed with its mail dependencies (#169)');
             }
-            return provisionPlatformMail(context, this.limitedOnPlatform(this.mail, LIMITS.platformMail));
+            return provisionPlatformMail(context, this.limitedOnPlatform(this.mail, LIMITS.platformMail), action.desired.switchMailStore === true);
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -1701,6 +1745,18 @@ export async function provisionAuthStack(scope, deps, target, input) {
     if (!zoneId) {
         throw new Error(`${label}: no Cloudflare zone for ${apex} to put ${hostname} in`);
     }
+    // Before the DNS record, so the hostname is never published without the rule.
+    const requestHeaders = await network.requestHeaders();
+    if (requestHeaders) {
+        await requestHeaders.ensureRequestHeaderStrip(zoneId, {
+            description: `strip spoofable sign-in headers: ${hostname}`,
+            expression: `(http.host eq "${hostname}")`,
+            headers: SIGNIN_STRIPPED_REQUEST_HEADERS,
+        });
+    }
+    else {
+        console.error(`${label}: no request header port, so the sign-in hostname keeps X-Zitadel-* and X-Forwarded-Host from clients`);
+    }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
     const dns = await network.dns();
     const [dnsRecord] = await dns.findDnsRecord(apex, hostname, 'CNAME');
@@ -2332,7 +2388,7 @@ const STALWART_READY_PATH = '/healthz/ready';
 /** Where the server the app was created on is recorded, so the MX record follows the app, not a later pick. */
 export const PLATFORM_MAIL_SERVER_SCOPE_KEY = 'coolify_platform_mail_server';
 const PLATFORM_MAIL_PROJECT_SCOPE_KEY = 'coolify_project_platform_mail';
-const PLATFORM_MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+const PLATFORM_MAIL_APP_SCOPE_KEY = MAIL_APP_SCOPE_KEY;
 const PLATFORM_MAIL_RELAY_APP_SCOPE_KEY = 'coolify_platform_mail_relay_app';
 const PLATFORM_MAIL_TUNNEL_SCOPE_KEY = 'cloudflare_platform_mail_tunnel';
 /**
@@ -2381,7 +2437,7 @@ export function defaultStalwartForInstance(input) {
         user: input.user,
     });
     return {
-        async applySettings({ mailHost, apex, oidc }) {
+        async applySettings({ mailHost, apex, oidc, dataStore }) {
             // A fresh Stalwart (0.16) is in bootstrap mode and refuses every write
             // but the `Bootstrap` object, and loads that object only on its next
             // start, so write it and hand the restart to the caller. A server
@@ -2389,9 +2445,29 @@ export function defaultStalwartForInstance(input) {
             // carries the generated `admin@<apex>` secret: this step signs in with
             // the recovery admin and never needs it.
             if ((await instance.client.probe()) === 'bootstrap') {
+                if (!dataStore.host ||
+                    !dataStore.database ||
+                    !dataStore.user ||
+                    !Number.isInteger(dataStore.port) ||
+                    dataStore.port < 1 ||
+                    dataStore.port > 65535) {
+                    throw new Error('platform:mail: the mail data store is not a usable Postgres address');
+                }
                 await instance.client.update('Bootstrap', 'singleton', {
                     serverHostname: mailHost,
                     defaultDomain: apex,
+                    // The password is read from the app's env, never written into Stalwart's settings.
+                    dataStore: {
+                        '@type': 'PostgreSql',
+                        host: dataStore.host,
+                        port: dataStore.port,
+                        database: dataStore.database,
+                        authUsername: dataStore.user,
+                        authSecret: {
+                            '@type': 'EnvironmentVariable',
+                            variableName: MAIL_DATABASE_PASSWORD_ENV,
+                        },
+                    },
                     // The server sits behind a tunnel; no ACME challenge can reach it.
                     requestTlsCertificate: false,
                 });
@@ -2506,7 +2582,7 @@ export async function provisionMailServer(scope, deps, target, input) {
     const zone = input.zone ?? apex;
     const label = target.kind === 'org' ? `own step coolify:own-mail for ${target.id}` : 'platform:mail';
     const keyDescription = target.kind === 'org' ? `foundry:org:${target.id}:admin` : PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION;
-    const recorded = scope.recordedIds();
+    let recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const record = async (key, id) => {
@@ -2523,6 +2599,15 @@ export async function provisionMailServer(scope, deps, target, input) {
     const imageTagBlocked = mailImageTagBlocked(imageTag);
     if (imageTagBlocked)
         throw new Error(imageTagBlocked);
+    // A server whose data is still on its volume is never provisioned over: the plan's confirmed switch
+    // deletes it first, and without that this step stops before any write.
+    if (mailStoreIsLegacy(recorded)) {
+        if (!input.switchStore) {
+            throw new Error(`${label}: the mail server still stores its data on a volume; confirm the mail-store switch in the plan before applying`);
+        }
+        await switchMailStoreToPostgres(scope, deps.coolify, target, environment.id, label);
+        recorded = scope.recordedIds();
+    }
     // One server for both the app and the MX record: recorded the first time,
     // read back after, so a later run never points `mx.<apex>` somewhere the
     // app is not.
@@ -2533,6 +2618,32 @@ export async function provisionMailServer(scope, deps, target, input) {
     const serverIpBlocked = mxRecord ? mailServerIpBlocked(server.ip, mxRecord.serverIpv4) : null;
     if (serverIpBlocked)
         throw new Error(serverIpBlocked);
+    // ---- the data store: a Postgres, created and recorded before the app ----------
+    // A crash after the create resumes with the recorded id and never makes a second database. A crash
+    // before the app exists leaves only this empty database behind; the next run uses it.
+    let mailDbId = recorded[MAIL_DATABASE_SCOPE_KEY];
+    if (!mailDbId) {
+        const found = (await deps.coolify.listDatabases()).find((d) => d.name === target.names.mailDb && d.environment_id === environment.id);
+        if (found) {
+            mailDbId = found.uuid;
+        }
+        else {
+            const created = await deps.coolify.createPostgresDatabase({
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                name: target.names.mailDb,
+                postgres_db: MAIL_DATABASE_NAME,
+                postgres_user: MAIL_DATABASE_NAME,
+            });
+            mailDbId = created.uuid;
+        }
+        await record(MAIL_DATABASE_SCOPE_KEY, mailDbId);
+    }
+    const mailDb = await getDatabaseStarted(deps.coolify, mailDbId);
+    const dataStore = mailDataStore(mailDb.internal_db_url, label);
+    runtime.onSecret?.(dataStore.password);
     const app = await findOrCreatePlatformApp(deps.coolify, target.names.mailApp, environment, async () => {
         return deps.coolify.createDockerImageApplication({
             project_uuid: projectUuid,
@@ -2592,6 +2703,7 @@ export async function provisionMailServer(scope, deps, target, input) {
     const recoveryGenerated = await ensureGeneratedEnv(deps.coolify, appId, 'STALWART_RECOVERY_ADMIN', () => `${STALWART_RECOVERY_USER}:${randomBytes(18).toString('base64')}`);
     const envs = [
         { key: 'STALWART_PUBLIC_URL', value: `https://${hostname}` },
+        { key: MAIL_DATABASE_PASSWORD_ENV, value: dataStore.password },
     ];
     if (recoveryGenerated)
         envs.push({ key: 'STALWART_RECOVERY_ADMIN', value: recoveryGenerated });
@@ -2781,13 +2893,15 @@ export async function provisionMailServer(scope, deps, target, input) {
                     mailHost: hostname,
                     apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
+                    dataStore: dataStore.address,
                 },
             });
+            await record(MAIL_STORE_SCOPE_KEY, MAIL_STORE_POSTGRES);
             await record(PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, project.id);
             await record(PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED);
         }
         catch (error) {
-            throw redactedMailError(error, [password]);
+            throw redactedMailError(error, [password, dataStore.password]);
         }
     }
     else if (!recordedProjectId) {
@@ -2822,8 +2936,10 @@ export async function provisionMailServer(scope, deps, target, input) {
                     mailHost: hostname,
                     apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
+                    dataStore: dataStore.address,
                 },
             });
+            await record(MAIL_STORE_SCOPE_KEY, MAIL_STORE_POSTGRES);
             await record(PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED);
             // Recorded and persisted before the secret leaves this function: if
             // delivery fails for good, the next plan reports the lost key rather
@@ -2846,7 +2962,7 @@ export async function provisionMailServer(scope, deps, target, input) {
             await record(PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, appId);
         }
         catch (error) {
-            throw redactedMailError(error, [password]);
+            throw redactedMailError(error, [password, dataStore.password]);
         }
     }
     // Last, after every write the applied values depend on, so a run that
@@ -2855,6 +2971,79 @@ export async function provisionMailServer(scope, deps, target, input) {
     await record(PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, imageTag);
     return { resourceId: appId };
 }
+/**
+ * Where Stalwart reaches its database, and the password it reads from its env. Parsed from Coolify's
+ * `internal_db_url` inside a try: Node's parse error carries the whole input, credential included, so it
+ * is replaced with a fixed message.
+ */
+function mailDataStore(internalDbUrl, label) {
+    if (!internalDbUrl) {
+        throw new Error(`${label}: the mail database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+    }
+    try {
+        const url = new URL(internalDbUrl);
+        const address = {
+            host: url.hostname,
+            port: url.port ? Number(url.port) : 5432,
+            database: decodeURIComponent(url.pathname.replace(/^\//, '')),
+            user: decodeURIComponent(url.username),
+        };
+        const password = decodeURIComponent(url.password);
+        if (!address.host ||
+            !address.database ||
+            !address.user ||
+            !password ||
+            !Number.isInteger(address.port)) {
+            throw new Error('incomplete');
+        }
+        return { address, password };
+    }
+    catch {
+        throw new Error(`${label}: the mail database's internal_db_url could not be parsed`);
+    }
+}
+/**
+ * The recorded ids a recreated Stalwart makes stale: the app and what was deployed or applied to it, and the
+ * admin key minted in it (the new server has none, so it is minted and delivered again). Everything else
+ * stays: the project, the server, the tunnel and its connector, the DNS names, the internal address and the
+ * published ports all describe things the new app reuses.
+ */
+// A function, not a constant: `platform-diff.ts` and this file import each other, so its keys are not
+// all initialised yet when this module is evaluated.
+const mailStoreSwitchClearedKeys = () => [
+    PLATFORM_MAIL_APP_SCOPE_KEY,
+    PLATFORM_MAIL_DEPLOYED_SCOPE_KEY,
+    PLATFORM_MAIL_DEPLOYED_HOSTNAME_SCOPE_KEY,
+    PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY,
+    PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY,
+    PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY,
+    PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY,
+    PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY,
+    PLATFORM_MAIL_ROUTE_SCOPE_KEY,
+];
+/**
+ * Deletes the volume-backed Stalwart app (Coolify's delete removes its volumes) and clears the ids above.
+ * The delete comes first: an app left behind after the ids are cleared would be found by name and reused,
+ * still on its volume. A run that dies between the two finds no app by that name on the next run and only
+ * clears. An app of that name whose uuid is not the recorded one is not deleted.
+ */
+async function switchMailStoreToPostgres(scope, coolify, target, environmentId, label) {
+    const recorded = scope.recordedIds();
+    const live = await coolify.findApplicationByName(target.names.mailApp, {
+        environmentIds: [environmentId],
+    });
+    if (live) {
+        if (live.uuid !== recorded[PLATFORM_MAIL_APP_SCOPE_KEY]) {
+            throw new Error(`${label}: the app named ${target.names.mailApp} is not the recorded mail server; not deleting it`);
+        }
+        await coolify.deleteApplication(live.uuid);
+    }
+    for (const key of mailStoreSwitchClearedKeys()) {
+        if (recorded[key])
+            scope.recordScopeId(key, '');
+    }
+    await scope.persist();
+}
 /** The platform's mail project: the shared `platform` project, its id recorded by the mail step under its own key. */
 const platformMailProject = {
     async ensure(coolify) {
@@ -2863,7 +3052,7 @@ const platformMailProject = {
     },
 };
 /** The platform's mail server: {@link provisionMailServer} with {@link platformTarget} and the platform's own inputs. */
-async function provisionPlatformMail(context, deps) {
+async function provisionPlatformMail(context, deps, switchStore = false) {
     const { platform } = context;
     const scope = scopeFromPlatform(context);
     return provisionMailServer(scope, deps, platformTarget(), {
@@ -2871,6 +3060,7 @@ async function provisionPlatformMail(context, deps) {
         apex: platform.apex,
         mailHost: platformMailMxHost(platform.apex),
         imageTag: platform.mail.gitRef,
+        switchStore,
         hostPorts: platformMailHostPorts(platform),
         issuerUrl: `https://${platform.auth.hostname}`,
         mxRecord: { serverIpv4: platform.serverIpv4 },
@@ -8148,11 +8338,12 @@ const PLATFORM_BACKUP_DEFAULT_FREQUENCY = 'daily';
  * The database a service's schedule must name. A schedule that names none
  * dumps the Coolify resource's first database; Archon's is named here anyway,
  * so a resource whose first database is not {@link ARCHON_POSTGRES_DB} is still
- * dumped right. Every other service runs on its resource's first database and
- * needs no entry.
+ * dumped right. Mail names its database the same way. Every other service runs on its
+ * resource's first database and needs no entry.
  */
 const PLATFORM_BACKUP_DATABASE_NAMES = {
     archon: ARCHON_POSTGRES_DB,
+    mail: MAIL_DATABASE_NAME,
 };
 /**
  * The one schedule both the reader and {@link provisionPlatformBackup} treat

package/dist/plan/uptime-worker.d.ts

@@ -1,5 +1,6 @@
 import type { AccessPort } from './edge-access.js';
 import type { PlatformWorkersPort } from './edge-workers.js';
+import type { CoolifyPort } from './executor.js';
 import type { PlatformStepExecutionContext } from './plan-apply.js';
 /** The optional plain text variables the Worker reads, supplied by the host (not secrets). */
 export declare const UPTIME_OPTIONAL_VARS: readonly ["CHAT_HOMESERVER_URL", "CHAT_ROOM_ID", "ALERT_EMAIL_FROM", "ALERT_EMAIL_TO"];
@@ -9,6 +10,19 @@ export type PlatformWorkersFactory = (edgeUrl: string) => PlatformWorkersPort |
 export type PlatformUptimeAccessPort = Pick<AccessPort, 'createServiceToken' | 'removeServiceToken' | 'findServiceTokenByName'>;
 /** Builds the Access port at edge's recorded address, the {@link PlatformWorkersFactory} way. */
 export type PlatformUptimeAccessFactory = (edgeUrl: string) => PlatformUptimeAccessPort | Promise<PlatformUptimeAccessPort>;
+/**
+ * What the uptime step needs to make its chat bot through chat-service. The bearer for
+ * `/_chat/internal/*` is `CHAT_INTERNAL_TOKEN` on Company Included's chat-service app, read here and
+ * never held, logged or put in an error.
+ */
+export interface PlatformUptimeChatDeps {
+    /** Reads that app's env (`OwnerChat.appId`). */
+    coolify: Pick<CoolifyPort, 'listEnvs'>;
+    /** The HTTP client; the global `fetch` by default. */
+    fetch?: typeof fetch;
+    /** Milliseconds one call may take (default 10 seconds). */
+    timeoutMs?: number;
+}
 /**
  * Dependencies of the uptime Worker step. `deliverSecret` and `heldKeys` are
  * the host's: the minted token goes only to `deliverSecret`, and every secret
@@ -26,8 +40,13 @@ export interface PlatformUptimeDeps {
     heldKeys: {
         resolve(ref: string): Promise<string | null>;
     };
-    /** Host config for the Worker's optional plain text variables; an absent one is left unset. */
+    /**
+     * Host config for the Worker's optional plain text variables; an absent one is left unset. A set
+     * `CHAT_HOMESERVER_URL` or `CHAT_ROOM_ID` overrides the one foundry made.
+     */
     vars?: Partial<Record<(typeof UPTIME_OPTIONAL_VARS)[number], string>>;
+    /** Makes the Worker's chat bot and its token. Absent: the chat credential is held by hand. */
+    chat?: PlatformUptimeChatDeps;
 }
 /**
  * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping

package/dist/plan/uptime-worker.js

@@ -1,7 +1,7 @@
 import { randomBytes, randomUUID } from 'node:crypto';
 import { EdgeApiError } from '@wtfalch/edge';
 import { uptimeArtifactUrl } from '../platform.js';
-import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_CHAT_TOKEN_REF, PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
 /** The Worker's cron trigger, from Archon's `workers/uptime/manifest.json`. */
 const UPTIME_CRONS = ['* * * * *'];
 /** The date Archon's own Worker config used. */
@@ -15,6 +15,84 @@ export const UPTIME_OPTIONAL_VARS = [
     'ALERT_EMAIL_FROM',
     'ALERT_EMAIL_TO',
 ];
+/** How long one call to read chat-service's token or to ask it for the bot may take. */
+const CHAT_CALL_TIMEOUT_MS = 10_000;
+/** The bot's localpart in chat-service (`@uptime-bot:<server>`). */
+const CHAT_BOT_LOCALPART = 'uptime-bot';
+/** Runs `work` and gives up after `ms`; the error names `what` only. */
+async function withinMs(ms, what, work) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`platform:uptime: ${what} did not answer within ${ms / 1000}s`)), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * `PUT /_chat/internal/bots/uptime-bot` on the company's Agora host. Idempotent on the chat-service
+ * side: a repeat returns the room and no token unless `rotate` is set, so calling with `rotate` again
+ * revokes the previous token. Every message here is fixed text: the response body, the bearer and the
+ * token never reach an error.
+ */
+async function callChatBot(chat, owner, rotate) {
+    const timeoutMs = chat.timeoutMs ?? CHAT_CALL_TIMEOUT_MS;
+    let envs;
+    try {
+        envs = await withinMs(timeoutMs, 'reading the chat-service app', chat.coolify.listEnvs(owner.appId));
+    }
+    catch {
+        // The cause can carry a response body.
+        throw new Error('platform:uptime: the chat-service app could not be read');
+    }
+    const bearer = envs.find((e) => e.key === 'CHAT_INTERNAL_TOKEN' && !e.is_preview)?.value;
+    if (typeof bearer !== 'string' || !/^\S{32,}$/.test(bearer)) {
+        throw new Error('platform:uptime: chat-service holds no usable CHAT_INTERNAL_TOKEN');
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await (chat.fetch ?? fetch)(`https://${owner.agoraHost}/_chat/internal/bots/${CHAT_BOT_LOCALPART}`, {
+            method: 'PUT',
+            headers: { authorization: `Bearer ${bearer}`, 'content-type': 'application/json' },
+            body: JSON.stringify({
+                displayName: 'Platform alerts',
+                room: { name: 'platform-alerts' },
+                members: [...owner.subjects],
+                ...(rotate ? { rotate: true } : {}),
+            }),
+            redirect: 'error',
+            signal: controller.signal,
+        });
+        if (response.status !== 200) {
+            throw new Error(`platform:uptime: chat-service refused the bot request (HTTP ${response.status})`);
+        }
+        const body = (await response.json());
+        const { userId, roomId, accessToken } = body ?? {};
+        if (typeof userId !== 'string' ||
+            !userId ||
+            typeof roomId !== 'string' ||
+            !roomId ||
+            (accessToken !== undefined && (typeof accessToken !== 'string' || !accessToken))) {
+            throw new Error('platform:uptime: chat-service answered the bot request with an unusable body');
+        }
+        return { userId, roomId, ...(accessToken ? { accessToken } : {}) };
+    }
+    catch (error) {
+        // Our own messages pass; anything else (a network error, a bad JSON body) is replaced.
+        if (error instanceof Error && error.message.startsWith('platform:uptime: '))
+            throw error;
+        throw new Error('platform:uptime: chat-service did not answer the bot request');
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping
  * URL that works as a capability, so a secret too), name to value. Callers
@@ -108,11 +186,51 @@ export async function provisionPlatformUptime(context, deps) {
     }
     const hostname = platform.archon.hostname;
     const held = await heldUptimeValues(deps);
+    // The chat bot comes before the upload: its room is one of the Worker's variables. A call that fails
+    // stops the step here, and the next apply makes it again (the marker below says whether a token may
+    // already have been minted).
+    const ownerChat = context.owner?.chat ?? null;
+    let chatRoomId = recorded[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY] || '';
+    if (deps.chat && ownerChat && ownerChat.subjects.length > 0) {
+        const lost = recorded[PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY];
+        if (held.CHAT_ACCESS_TOKEN) {
+            if (lost) {
+                context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, '');
+                await context.persist?.();
+            }
+        }
+        else {
+            // Recorded and persisted before the route is called, because the call is what mints the token.
+            if (!lost) {
+                context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, randomUUID());
+                await context.persist?.();
+            }
+            // A marker, or a room already made, means the bot exists and its token is not held: rotate.
+            const rotate = Boolean(lost) || Boolean(chatRoomId);
+            let bot = await callChatBot(deps.chat, ownerChat, rotate);
+            if (!bot.accessToken && !rotate)
+                bot = await callChatBot(deps.chat, ownerChat, true);
+            const chatToken = bot.accessToken;
+            if (!chatToken) {
+                throw new Error('platform:uptime: chat-service returned no token for the bot, even when asked to rotate it');
+            }
+            chatRoomId = bot.roomId;
+            context.recordScopeId(PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, chatRoomId);
+            await context.persist?.();
+            await attempt('holding the chat bot token', () => deps.deliverSecret(PLATFORM_UPTIME_CHAT_TOKEN_REF, chatToken));
+            context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, '');
+            await context.persist?.();
+            held.CHAT_ACCESS_TOKEN = chatToken;
+        }
+    }
+    const workerVars = uptimeEffectiveVars(deps.vars, deps.chat && ownerChat && chatRoomId
+        ? { homeserverUrl: `https://${ownerChat.agoraHost}`, roomId: chatRoomId }
+        : null);
     const bindings = [
         { type: 'kv_namespace', name: 'UPTIME_KV', title: PLATFORM_UPTIME_KV_TITLE },
         { type: 'plain_text', name: 'ARCHON_BASE_URL', text: `https://${hostname}` },
         ...UPTIME_OPTIONAL_VARS.flatMap((name) => {
-            const text = deps.vars?.[name];
+            const text = workerVars[name];
             return text ? [{ type: 'plain_text', name, text }] : [];
         }),
     ];
@@ -223,7 +341,7 @@ export async function provisionPlatformUptime(context, deps) {
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, uptime.tag);
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, uptime.sha256);
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
-    context.recordScopeId(PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, uptimeVarsDigest(deps.vars));
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, uptimeVarsDigest(workerVars));
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, uptimeSecretNames(Object.keys(held)));
     return { resourceId: PLATFORM_UPTIME_SCRIPT_NAME };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.36.1",
+  "version": "0.38.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",