@wtfalch/foundry 0.37.0 → 0.39.0

package/dist/plan/own-diff.d.ts

@@ -45,6 +45,12 @@ export interface PlanOwnAuthOptions {
     mailKeyHeld: boolean;
     /** The host can mint that key itself (a Lettermint port and a held-key reader): the step plans without it. */
     mailKeyMintable?: boolean;
+    /** The clock for the sign-in database certificate's renewal window (#746). Default `Date.now`. */
+    now?: number;
+    /** The held keys can store the sign-in database's CA and certificate. Default true. */
+    signinDbKeysPuttable?: boolean;
+    /** The host supplies the backup bucket the sign-in database dumps into. Default true. */
+    signinDbBackupConfigured?: boolean;
 }
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
@@ -59,6 +65,26 @@ export declare function planOwnAuth(options: PlanOwnAuthOptions): {
     step: DraftStep | null;
     blocked: string | null;
 };
+/** `unmanaged` key of the one line `planSigninDbMove` reports. */
+export declare const OWN_SIGNIN_DB_MOVE_BLOCKED_KEY = "own-signin-db-move";
+export interface PlanSigninDbMoveOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    /** The held keys can store the sign-in database's CA and certificate. Default true. */
+    signinDbKeysPuttable?: boolean;
+    /** The host supplies the backup bucket the sign-in database dumps into. Default true. */
+    signinDbBackupConfigured?: boolean;
+}
+/**
+ * One step for an own org whose sign-in is applied and whose ZITADEL still uses the Coolify database
+ * (#746): `signin-db-move.ts` copies it to foundry's TLS image. Never planned for a company on the TLS
+ * database, a new one, or one whose sign-in is not applied. The apply refuses it without a fresh
+ * backup of the old database (`backup-gate.ts`).
+ */
+export declare function planSigninDbMove(options: PlanSigninDbMoveOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
 /** `unmanaged` key of the one line `planOwnMail` reports. */
 export declare const OWN_MAIL_BLOCKED_KEY = "own-mail";
 export interface PlanOwnMailOptions {

package/dist/plan/own-diff.js

@@ -6,12 +6,16 @@ import { brokerEntryAppliedScopeKey } from './broker-entries.js';
 import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
+import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
-import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { signinDbBackupMissing } from './signin-db-backup.js';
+import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, signinDbCertDue } from './signin-db-tls.js';
+import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db.js';
 /** `unmanaged` key of the one line `planOwnJobs` reports. */
 export const OWN_JOBS_BLOCKED_KEY = 'own-jobs';
 /**
@@ -129,6 +133,15 @@ export function planOwnAuth(options) {
     if (!options.mailKeyHeld && !options.mailKeyMintable) {
         return blocked(`the held key ${orgTarget(org).refs.brokerMailKey} is not held yet`);
     }
+    // A company still on the Coolify database keeps running without the keys until it moves.
+    if (!recordedIds[PLATFORM_AUTH_DB_SCOPE_KEY]) {
+        if (options.signinDbKeysPuttable === false && !recordedIds[SIGNIN_DB_TLS_SCOPE_KEY]) {
+            return blocked('the host cannot store the sign-in database certificate (held keys have no put)');
+        }
+        if (options.signinDbBackupConfigured === false) {
+            return blocked('the host supplies no backup bucket for the sign-in database');
+        }
+    }
     const hostname = names.auth;
     // The broker starts only on a valid `AUTH_APPS`, and the login client is minted only once it does:
     // the first broker entry is what lets this step finish, as the platform's first registration does.
@@ -148,7 +161,11 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_SMTP_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
-        (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry)) {
+        (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry) &&
+        !signinDbCertDue(recordedIds, options.now ?? Date.now()) &&
+        !signinDbBackupMissing(recordedIds) &&
+        // ZITADEL was started on the TLS database and never seen healthy there: the step starts it again.
+        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY]) {
         return { step: null, blocked: null };
     }
     return {
@@ -168,6 +185,47 @@ export function planOwnAuth(options) {
         },
     };
 }
+/** `unmanaged` key of the one line `planSigninDbMove` reports. */
+export const OWN_SIGNIN_DB_MOVE_BLOCKED_KEY = 'own-signin-db-move';
+/**
+ * One step for an own org whose sign-in is applied and whose ZITADEL still uses the Coolify database
+ * (#746): `signin-db-move.ts` copies it to foundry's TLS image. Never planned for a company on the TLS
+ * database, a new one, or one whose sign-in is not applied. The apply refuses it without a fresh
+ * backup of the old database (`backup-gate.ts`).
+ */
+export function planSigninDbMove(options) {
+    const { org, recordedIds } = options;
+    if (!ownsServices(org) ||
+        !ownAuthApplied(org, recordedIds) ||
+        !recordedIds[PLATFORM_AUTH_DB_SCOPE_KEY] ||
+        !recordedIds[PLATFORM_AUTH_ZITADEL_SCOPE_KEY] ||
+        recordedIds[SIGNIN_DB_TLS_SCOPE_KEY]) {
+        return { step: null, blocked: null };
+    }
+    if (options.signinDbKeysPuttable === false) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s sign-in database move is blocked, not planned: the host cannot store the sign-in database certificate (held keys have no put)`,
+        };
+    }
+    if (options.signinDbBackupConfigured === false) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s sign-in database move is blocked, not planned: the host supplies no backup bucket for the sign-in database`,
+        };
+    }
+    return {
+        blocked: null,
+        step: {
+            action: { system: 'coolify', kind: 'own-auth-db-move', key: org.id, desired: {} },
+            step: {
+                description: `move ${org.slug}'s sign-in database to foundry's TLS image: ZITADEL is stopped while the data is copied, the old database is kept`,
+                destroys: false,
+                migrates: true,
+            },
+        },
+    };
+}
 /** `unmanaged` key of the one line `planOwnMail` reports. */
 export const OWN_MAIL_BLOCKED_KEY = 'own-mail';
 /**
@@ -212,7 +270,9 @@ export function planOwnMail(options) {
     const smtpPort = options.smtpPort ?? OWN_MAIL_SMTP_PORT_BASE;
     if (!isOwnMailSmtpPort(smtpPort))
         return blocked('its mail port is outside the range foundry uses');
-    if (recordedIds[`coolify:own-mail:${org.id}`] &&
+    const storeSwitch = mailStoreIsLegacy(recordedIds);
+    if (!storeSwitch &&
+        recordedIds[`coolify:own-mail:${org.id}`] &&
         recordedIds[OWN_MAIL_SMTP_PORT_SCOPE_KEY] === String(smtpPort) &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
@@ -227,11 +287,19 @@ export function planOwnMail(options) {
                 system: 'coolify',
                 kind: 'own-mail',
                 key: org.id,
-                desired: { hostname, gitRef, mailHost: platformMailMxHost(platformApex), smtpPort },
+                desired: {
+                    hostname,
+                    gitRef,
+                    mailHost: platformMailMxHost(platformApex),
+                    smtpPort,
+                    ...(storeSwitch ? { switchMailStore: true } : {}),
+                },
             },
             step: {
-                description: `provision ${org.slug}'s own mail server`,
-                destroys: false,
+                description: storeSwitch
+                    ? mailStoreSwitchDescription(org.slug)
+                    : `provision ${org.slug}'s own mail server`,
+                destroys: storeSwitch,
                 migrates: false,
             },
         },

package/dist/plan/own-services.d.ts

@@ -20,12 +20,17 @@ export interface ServiceTarget {
     readonly kind: 'platform' | 'org';
     readonly names: {
         authDb: string;
+        /** The sign-in database as foundry's own TLS image (#746). Only an org uses it; the platform's value is never read. */
+        signinDb: string;
+        /** The one-shot job that copies the old database into it (#746). */
+        signinDbMove: string;
         authZitadel: string;
         authLogin: string;
         authBroker: string;
         authTunnel: string;
         authCloudflared: string;
         mailApp: string;
+        mailDb: string;
         mailTunnel: string;
         mailCloudflared: string;
         filesDb: string;
@@ -33,6 +38,8 @@ export interface ServiceTarget {
         filesRunner: string;
         /** An own org's R2 bucket. The platform's is host-supplied (`PlatformFilesDeps.r2`), so its value here is never read. */
         filesBucket: string;
+        /** An own org's sign-in database backup bucket (#746): its own bucket, never the files bucket. */
+        signinBackupBucket: string;
         jobsApp: string;
         jobsDb: string;
         sfuApp: string;
@@ -40,6 +47,8 @@ export interface ServiceTarget {
         sfuCloudflared: string;
     };
     readonly internal: {
+        /** The hostname ZITADEL connects to, and the one name the database's certificate carries. */
+        signinDb: string;
         authZitadel: string;
         authLogin: string;
         authBroker: string;
@@ -61,6 +70,8 @@ export interface ServiceTarget {
         keysCredential: string;
         /** The public half the host verifies with (`KEYS_VERIFY_KEYS`). */
         keysVerifyKeys: string;
+        /** The sign-in database's server certificate and key, held as JSON `{ cert, key }` (#746). */
+        signinDbServer: string;
     };
 }
 /** The platform's shared services, with the literals the platform steps use today. */

package/dist/plan/own-services.js

@@ -11,18 +11,22 @@ export function platformTarget() {
         kind: 'platform',
         names: {
             authDb: 'platform-auth-db',
+            signinDb: 'platform-signin-db',
+            signinDbMove: 'platform-signin-db-move',
             authZitadel: 'platform-auth-zitadel',
             authLogin: 'platform-auth-login',
             authBroker: 'platform-auth-broker',
             authTunnel: 'platform-auth-tunnel',
             authCloudflared: 'platform-auth-cloudflared',
             mailApp: 'platform-mail-stalwart',
+            mailDb: 'platform-mail-postgres',
             mailTunnel: 'platform-mail-tunnel',
             mailCloudflared: 'platform-mail-cloudflared',
             filesDb: 'platform-files-db',
             filesMigrate: 'files-migrate',
             filesRunner: 'files',
             filesBucket: 'platform-files',
+            signinBackupBucket: 'platform-signin-backups',
             jobsApp: 'jobs',
             jobsDb: 'jobs-scheduler-db',
             sfuApp: 'platform-sfu',
@@ -30,6 +34,7 @@ export function platformTarget() {
             sfuCloudflared: 'platform-sfu-cloudflared',
         },
         internal: {
+            signinDb: 'platform-signin-db',
             authZitadel: 'platform-auth-zitadel',
             authLogin: 'platform-auth-login',
             authBroker: 'platform-auth-broker',
@@ -49,6 +54,7 @@ export function platformTarget() {
             livekitKeys: 'livekit:platform:keys',
             keysCredential: 'keys:platform:credential',
             keysVerifyKeys: 'keys:platform:verifyKeys',
+            signinDbServer: 'signin-db:platform:server',
         },
     };
 }
@@ -60,18 +66,22 @@ export function orgTarget(org) {
         kind: 'org',
         names: {
             authDb: `${s}-auth-db`,
+            signinDb: `${s}-signin-db`,
+            signinDbMove: `${s}-signin-db-move`,
             authZitadel: `${s}-auth-zitadel`,
             authLogin: `${s}-auth-login`,
             authBroker: `${s}-auth-broker`,
             authTunnel: `${s}-auth-tunnel`,
             authCloudflared: `${s}-auth-cloudflared`,
             mailApp: `${s}-mail-stalwart`,
+            mailDb: `${s}-mail-postgres`,
             mailTunnel: `${s}-mail-tunnel`,
             mailCloudflared: `${s}-mail-cloudflared`,
             filesDb: `${s}-files-db`,
             filesMigrate: `${s}-files-migrate`,
             filesRunner: `${s}-files`,
             filesBucket: `${s}-files`,
+            signinBackupBucket: `${s}-signin-backups`,
             jobsApp: `${s}-jobs`,
             jobsDb: `${s}-jobs-db`,
             sfuApp: `${s}-sfu`,
@@ -79,6 +89,7 @@ export function orgTarget(org) {
             sfuCloudflared: `${s}-sfu-cloudflared`,
         },
         internal: {
+            signinDb: `${s}-signin-db`,
             authZitadel: `${s}-auth-zitadel`,
             authLogin: `${s}-auth-login`,
             authBroker: `${s}-auth-broker`,
@@ -98,6 +109,7 @@ export function orgTarget(org) {
             livekitKeys: `livekit:org:${s}:keys`,
             keysCredential: `keys:org:${s}:credential`,
             keysVerifyKeys: `keys:org:${s}:verifyKeys`,
+            signinDbServer: `signin-db:org:${s}:server`,
         },
     };
 }

package/dist/plan/plan-apply.d.ts

@@ -199,6 +199,10 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** Whether the executor's held keys can store the sign-in database's CA and certificate (#746). Absent: true. */
+    ownSigninDbKeysPuttable?(): boolean;
+    /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). Absent: true. */
+    ownSigninDbBackupConfigured?(): boolean;
     /**
      * Whether the host's scoped ports for this own org include a files-organisation
      * port. The planner plans no `files:organisation` step for an own org while

package/dist/plan/plan-apply.js

@@ -7,7 +7,7 @@ import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
-import { NetworkMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
+import { NetworkMoveBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
 import { readLiveBuilds } from './build-record.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
@@ -22,7 +22,7 @@ import { findNameClashes, nameClashMessage } from './org-names.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
@@ -443,6 +443,25 @@ export class FoundryPlanApply {
                     throw e;
                 }
             }
+            // The move of a sign-in database reads the old one, and the old one stays; a fresh dump is the way back.
+            if (detail.plannedSteps.some((s) => s.action.system === 'coolify' && s.action.kind === 'own-auth-db-move')) {
+                try {
+                    if (!this.backupGate)
+                        throw new SigninDbMoveBackupMissingError('no-gate');
+                    await requireFreshBackupForSigninMove({
+                        coolify: this.backupGate.coolify,
+                        orgId,
+                        recordedIds: (await this.store.getAppliedState(orgId))?.serviceIds ?? {},
+                        now: () => this.now().getTime(),
+                    });
+                }
+                catch (e) {
+                    if (e instanceof SigninDbMoveBackupMissingError) {
+                        await this.refuse(plan, 'sign-in database move without a fresh backup');
+                    }
+                    throw e;
+                }
+            }
             if (planNeedsConfirmation(plan.steps) &&
                 confirmedOrgName.trim() !== org.displayName.trim()) {
                 await this.refuse(plan, "destructive or migrating step without the org's name typed correctly");
@@ -1044,6 +1063,8 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
+            ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ...(this.backupGate
                 ? {
                     backupStorageUuid: (await this.platformDeps?.store.getServiceIds())?.[PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY] || null,
@@ -1330,9 +1351,13 @@ export class FoundryPlanApply {
     async platformOwnerInput(platform) {
         const owner = await this.store.get(platform.ownerOrgId);
         if (!owner)
-            return { signIn: null, files: null };
+            return { signIn: null, files: null, chat: null };
         const recorded = (await this.store.getAppliedState(owner.id))?.serviceIds ?? {};
-        return { signIn: ownerSignInFrom(owner, recorded), files: ownerFilesFrom(owner, recorded) };
+        return {
+            signIn: ownerSignInFrom(owner, recorded),
+            files: ownerFilesFrom(owner, recorded),
+            chat: ownerChatFrom(owner, recorded),
+        };
     }
     /**
      * What the shared mail relay needs from the orgs. A route exists for an org
@@ -1686,6 +1711,7 @@ const STEP_FIELDS = {
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
     'coolify:own-auth': 'services.own',
+    'coolify:own-auth-db-move': 'services.own',
     'coolify:own-files': 'services.own',
     'coolify:own-files-r2': 'services.own',
     'coolify:own-jobs': 'services.own',

package/dist/plan/platform-diff.d.ts

@@ -1030,6 +1030,25 @@ export declare const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = "uptime_applied
 export declare const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = "uptime_applied_vars";
 /** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
 export declare const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = "uptime_removed";
+/**
+ * The chat bot's room (`!id:server`), recorded as soon as chat-service names it.
+ * Recorded before the bot's token is held, so a crash between the two leaves the room known.
+ */
+export declare const PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY = "platform_uptime_chat_room_id";
+/**
+ * A random id, recorded and persisted before the chat route is called (it mints the bot's token) and
+ * cleared once that token is held. Set while the token is not held, it means a token was minted that may
+ * be lost, so the next call asks the route to rotate it.
+ */
+export declare const PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY = "platform_uptime_chat_token_undelivered";
+/**
+ * The Worker's plain text variables: the chat homeserver and room foundry made, under whatever the
+ * host configured (a host value that is set wins). Unset values are left out.
+ */
+export declare function uptimeEffectiveVars(hostVars: Readonly<Record<string, string | undefined>> | undefined, chat: {
+    homeserverUrl: string;
+    roomId: string;
+} | null): Record<string, string | undefined>;
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export declare function uptimeVarsDigest(vars?: Readonly<Record<string, string | undefined>>): string;
 /** The Worker secret names the step sets: the three it mints, and each held one. */
@@ -1164,6 +1183,16 @@ export interface PlanPlatformOptions {
             access: boolean;
             vars: string;
         };
+        /**
+         * The uptime Worker's chat bot, when the host wired one. `pending`: the bot's token is not held and
+         * Company Included's chat is applied, so the step makes it. `blocked`: why it cannot yet (a fixed
+         * line, reported without stopping the rest of the Worker). Absent: no bot path, so the plan keeps
+         * asking for a hand-held credential.
+         */
+        uptimeChat?: {
+            pending: boolean;
+            blocked?: string;
+        };
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
         /**
@@ -1279,6 +1308,7 @@ export declare const PLATFORM_BACKUP_DATABASE_SCOPE_KEYS: {
     readonly archon: "coolify_platform_archon_database";
     readonly ai: "coolify_platform_ai_database";
     readonly integrations: "coolify_integrations_database";
+    readonly mail: "coolify_mail_database";
 };
 export type PlatformBackupServiceKey = keyof typeof PLATFORM_BACKUP_DATABASE_SCOPE_KEYS;
 export declare const PLATFORM_BACKUP_SERVICE_KEYS: readonly PlatformBackupServiceKey[];

package/dist/plan/platform-diff.js

@@ -7,6 +7,7 @@ import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
 import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
+import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
 import { signInDomainBlockedText } from './sign-in-org.js';
@@ -1155,6 +1156,28 @@ export const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = 'uptime_applied_secrets
 export const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = 'uptime_applied_vars';
 /** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
 export const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = 'uptime_removed';
+/**
+ * The chat bot's room (`!id:server`), recorded as soon as chat-service names it.
+ * Recorded before the bot's token is held, so a crash between the two leaves the room known.
+ */
+export const PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY = 'platform_uptime_chat_room_id';
+/**
+ * A random id, recorded and persisted before the chat route is called (it mints the bot's token) and
+ * cleared once that token is held. Set while the token is not held, it means a token was minted that may
+ * be lost, so the next call asks the route to rotate it.
+ */
+export const PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY = 'platform_uptime_chat_token_undelivered';
+/**
+ * The Worker's plain text variables: the chat homeserver and room foundry made, under whatever the
+ * host configured (a host value that is set wins). Unset values are left out.
+ */
+export function uptimeEffectiveVars(hostVars, chat) {
+    const host = Object.fromEntries(Object.entries(hostVars ?? {}).filter(([, v]) => Boolean(v)));
+    return {
+        ...(chat ? { CHAT_HOMESERVER_URL: chat.homeserverUrl, CHAT_ROOM_ID: chat.roomId } : {}),
+        ...host,
+    };
+}
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export function uptimeVarsDigest(vars = {}) {
     const set = Object.entries(vars)
@@ -1332,7 +1355,7 @@ export function planPlatform(platform, live, options = {}) {
         plannedSteps.push(heartbeats.step);
     // foundry#542: after Archon is applied (never merely planned): the Worker
     // probes Archon, and Archon's env takes the token this step mints.
-    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld);
+    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld, blocked.uptimeChat);
     if (uptime.step)
         plannedSteps.push(uptime.step);
     if (archon.step && blocked.archonRunsInsideApp)
@@ -1353,6 +1376,9 @@ export function planPlatform(platform, live, options = {}) {
     // read for, is premature, not informational.
     const versionChanges = [];
     for (const change of [
+        mail.blocked || !mail.step?.action.desired.switchMailStore
+            ? null
+            : mailStoreSwitchChange('the platform'),
         mail.blocked
             ? null
             : versionChangeLine('mail', recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY], platform.mail.gitRef, 'image, redeploy'),
@@ -1593,11 +1619,13 @@ export const PLATFORM_BACKUP_DATABASE_SCOPE_KEYS = {
     archon: 'coolify_platform_archon_database',
     ai: 'coolify_platform_ai_database',
     integrations: 'coolify_integrations_database',
+    mail: MAIL_DATABASE_SCOPE_KEY,
 };
 export const PLATFORM_BACKUP_SERVICE_KEYS = [
     'archon',
     'ai',
     'integrations',
+    'mail',
 ];
 /**
  * #257: a nightly backup for each platform database foundry itself creates,
@@ -2047,7 +2075,9 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
     if (!platform.mail.enabled)
         return { step: null, blocked: null };
     const key = resourceKey('coolify', 'app', PLATFORM_MAIL_KEY);
-    if (recordedIds[key] &&
+    const storeSwitch = mailStoreIsLegacy(recordedIds);
+    if (!storeSwitch &&
+        recordedIds[key] &&
         recordedIds[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === platform.mail.hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === platform.mail.gitRef &&
@@ -2083,6 +2113,28 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
             blocked: "the platform's mail server is blocked, not planned: its OIDC directory uses the platform's own sign-in, which is neither applied nor planned",
         };
     }
+    if (storeSwitch) {
+        return {
+            step: {
+                action: {
+                    system: 'coolify',
+                    kind: 'app',
+                    key: PLATFORM_MAIL_KEY,
+                    desired: {
+                        hostname: platform.mail.hostname,
+                        gitRef: platform.mail.gitRef,
+                        switchMailStore: true,
+                    },
+                },
+                step: {
+                    description: mailStoreSwitchDescription('the platform'),
+                    destroys: true,
+                    migrates: false,
+                },
+            },
+            blocked: null,
+        };
+    }
     return {
         step: {
             action: {
@@ -2684,7 +2736,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     token: true,
     access: true,
     vars: '',
-}) {
+}, chat) {
     const { uptime } = platform;
     const deployed = Boolean(recordedIds[resourceKey('cloudflare', 'worker', PLATFORM_UPTIME_KEY)]) &&
         !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
@@ -2733,7 +2785,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     if (executorBlocked)
         return { step: null, blocked: [executorBlocked], notes: [] };
     const notes = [];
-    if (!heldOptional.includes('CHAT_ACCESS_TOKEN')) {
+    if (!chat && !heldOptional.includes('CHAT_ACCESS_TOKEN')) {
         notes.push({
             key: 'uptime:CHAT_ACCESS_TOKEN',
             service: 'uptime',
@@ -2759,9 +2811,12 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
         recordedIds[PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY] === uptime.sha256 &&
         recordedIds[PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
         (recordedIds[PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY] ?? '') === uptimeHeld.vars &&
-        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional);
+        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional) &&
+        !chat?.pending;
+    // Reported beside the step, not instead of it: the Worker deploys without chat alerts meanwhile.
+    const blockedLines = chat?.blocked ? [chat.blocked] : [];
     if (applied)
-        return { step: null, blocked: [], notes };
+        return { step: null, blocked: blockedLines, notes };
     return {
         step: {
             action: action({ hostname, gitRef: uptime.tag, sha256: uptime.sha256 }),
@@ -2771,7 +2826,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
                 migrates: false,
             },
         },
-        blocked: [],
+        blocked: blockedLines,
         notes,
     };
 }

package/dist/plan/platform-org.d.ts

@@ -304,10 +304,23 @@ export interface OwnerFiles {
     organisationId: string;
     managementKeyRef: string;
 }
+/**
+ * The owner company's chat once `coolify:chat` has applied: where the uptime
+ * Worker's bot is made and which people join its room.
+ */
+export interface OwnerChat {
+    /** The chat-service app (Coolify uuid), whose env holds `CHAT_INTERNAL_TOKEN`. */
+    appId: string;
+    /** The company's Agora host: the public origin of the bot route and the Matrix homeserver. */
+    agoraHost: string;
+    /** ZITADEL subjects of the owner company's owners whose invite is recorded. */
+    subjects: readonly string[];
+}
 /** What the platform plan reads about the owner company. */
 export interface PlatformOwnerInput {
     signIn?: OwnerSignIn | null;
     files?: OwnerFiles | null;
+    chat?: OwnerChat | null;
 }
 /**
  * The owner's sign-in from its declared org and the ids its own steps recorded.
@@ -326,3 +339,5 @@ export declare function ownerSignInFrom(owner: DeclaredOrg | null, recorded: Rea
 export declare function platformOwnerUserIdFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): string | null;
 /** The owner's files host once its own files step has applied; `null` before. */
 export declare function ownerFilesFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): OwnerFiles | null;
+/** The owner's chat once its `coolify:chat` step has applied; `null` before, and when chat is off. */
+export declare function ownerChatFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): OwnerChat | null;

package/dist/plan/platform-org.js

@@ -1,5 +1,5 @@
 import { ownsServices } from '../org.js';
-import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor } from './agora.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
@@ -352,3 +352,19 @@ export function ownerFilesFrom(owner, recorded) {
         managementKeyRef: orgTarget(owner).refs.filesManagement,
     };
 }
+/** The recorded id of the chat-service app (`coolify_chat_service`, set by the `coolify:chat` step). */
+const CHAT_SERVICE_APP_SCOPE_KEY = 'coolify_chat_service';
+/** The owner's chat once its `coolify:chat` step has applied; `null` before, and when chat is off. */
+export function ownerChatFrom(owner, recorded) {
+    const appId = recorded[CHAT_SERVICE_APP_SCOPE_KEY];
+    if (!owner || !owner.chat.enabled || !appId || !recorded[`coolify:chat:${owner.id}`])
+        return null;
+    return {
+        appId,
+        agoraHost: agoraHostnameFor(owner),
+        subjects: owner.owners.flatMap((o) => {
+            const id = recorded[`zitadel:owner:${owner.id}:${o.email.toLowerCase()}`];
+            return id ? [id] : [];
+        }),
+    };
+}