@wtfalch/foundry 0.37.0 → 0.39.0

package/dist/plan/platform-providers.d.ts

@@ -17,6 +17,7 @@ import { type FilesKeysMinted, type ProjectSource, type ServiceNetwork, type Ser
 import type { PlatformDriftedSteps, PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
 import { type BrokerDeployRecord, PLATFORM_ZITADEL_ORG_SCOPE_KEY } from './platform-diff.js';
 import type { PlatformOwnerInput } from './platform-org.js';
+import type { SigninDbBackupPort } from './signin-db-backup.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
@@ -132,7 +133,9 @@ export interface PlatformAuthSmtp {
 export interface PlatformAuthDeps {
     /** Overrides the Lettermint SMTP relay ZITADEL is given. Absent, Lettermint exactly as before. */
     smtp?: PlatformAuthSmtp;
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'> & 
+    /** An own org's sign-in database needs a volume and the CA file mount (#746); the platform's does not. */
+    Partial<Pick<CoolifyPort, 'listStorages' | 'createPersistentStorage' | 'createFileStorage'>>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -172,7 +175,16 @@ export interface PlatformAuthDeps {
      */
     heldKeys?: {
         resolve(ref: string): Promise<string | null>;
+        /** An own org's sign-in database CA and certificate are stored through this (#746). Without it a new company's sign-in step is blocked. */
+        put?(ref: string, value: string): Promise<void>;
     };
+    /**
+     * The bucket and storage key ports a company's sign-in database backup uses (#746): its own bucket and
+     * a key scoped to it. For an own org the executor fills this from the files host's `r2Buckets` and
+     * `r2Keys`; the platform's backup key is never used. Without it a company's sign-in database is not
+     * created and an existing one is not moved.
+     */
+    signinDbBackup?: SigninDbBackupPort;
     /** Clock, sleep and fetch for the readiness wait and delivery retries; real ones by default. */
     runtime?: PlatformAuthRuntime;
 }
@@ -190,6 +202,14 @@ export interface PlatformAuthRuntime {
     readyRequestTimeoutMs?: number;
     /** Told of every secret the sign-in step reads or mints, so the host can scrub it from logs and audit rows. */
     onSecret?: (value: string) => void;
+    /** How long a new or redeployed sign-in database may take to report healthy (default 5 minutes). */
+    signinDbTimeoutMs?: number;
+    /** How long ZITADEL may take to report stopped before a sign-in database move copies (default 2 minutes). */
+    signinDbStopTimeoutMs?: number;
+    /** How long the copy job of a sign-in database move may run (default 30 minutes). */
+    signinDbMoveTimeoutMs?: number;
+    /** Pause between polls of the copy job (default 10 seconds). */
+    signinDbMovePollMs?: number;
 }
 /**
  * An own org's scheduler only: the app's uuid, recorded and persisted before
@@ -354,6 +374,10 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
             access: boolean;
             vars: string;
         };
+        uptimeChat?: {
+            pending: boolean;
+            blocked?: string;
+        };
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
         archonIdTokenUserinfo?: boolean;
@@ -454,6 +478,7 @@ export declare const AUTH_LOGIN_PORT = "3000";
  * everything else, including the root).
  */
 export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
+export declare const PLATFORM_AUTH_DB_SCOPE_KEY = "coolify_platform_auth_database";
 export declare const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = "coolify_platform_auth_zitadel_app";
 export declare const PLATFORM_AUTH_LOGIN_SCOPE_KEY = "coolify_platform_auth_login_app";
 /**
@@ -606,6 +631,16 @@ export interface PlatformMailAdminPort {
             issuerUrl: string;
             audience: string;
         };
+        /**
+         * Where Stalwart keeps its data: a Postgres reached at `host:port`. The password is not here:
+         * Stalwart reads it from the env var {@link MAIL_DATABASE_PASSWORD_ENV}.
+         */
+        dataStore: {
+            host: string;
+            port: number;
+            database: string;
+            user: string;
+        };
     }): Promise<'restart' | undefined>;
     /**
      * `StalwartClient.createApiKey`'s own signature. The key belongs to a real
@@ -642,7 +677,7 @@ export declare function defaultStalwartForInstance(input: {
  * own shape.
  */
 export interface PlatformMailDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'raw' | 'listStorages' | 'createPersistentStorage' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'restart' | 'getDeployment'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'listDatabases' | 'deleteApplication' | 'raw' | 'listStorages' | 'createPersistentStorage' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'restart' | 'getDeployment'>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -684,6 +719,8 @@ export interface PlatformMailRuntime {
     readyIntervalMs?: number;
     /** Tries at handing the admin key to the host (default 3). */
     deliverAttempts?: number;
+    /** Called with the mail database's password, so the host can keep it out of every message it writes. */
+    onSecret?: (value: string) => void;
 }
 /**
  * What {@link provisionMailServer} reads besides the target's names: the
@@ -701,6 +738,12 @@ export interface MailServerInput {
     mailHost: string;
     /** The Stalwart image tag. */
     imageTag: string;
+    /**
+     * The plan's confirmed switch of a volume-backed server to Postgres: delete the Stalwart app and its
+     * volume, clear the ids that describe it, then provision as usual. Without it a server still on its
+     * volume is refused before any write.
+     */
+    switchStore?: boolean;
     /** `host:container` list; empty publishes no host port. */
     hostPorts: string;
     /** The sign-in the server's directory trusts; its `mail` project's id is the audience. */
@@ -1150,6 +1193,25 @@ export declare function createAiManagementKeyMinter(options: {
     fetchImpl?: typeof fetch;
     now?: () => number;
 }): AiManagementKeyMinter;
+export declare function resolvePlatformServer(coolify: Pick<CoolifyPort, 'listServers'>): Promise<{
+    uuid: string;
+    ip?: string;
+}>;
+/**
+ * `executor.ts`'s `coolifyCalls`/`findOrCreateCallsApp`, restated here rather
+ * than imported: that method is private to `FoundryStepExecutor`, and this
+ * file holds no instance of that class to call it on. `running` says whether
+ * the app was already running or starting; the caller deploys it when not.
+ */
+export declare function findOrCreatePlatformApp(coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication'>, name: string, environment: {
+    id: number;
+}, create: () => Promise<{
+    uuid: string;
+}>): Promise<{
+    appId: string;
+    justCreated: boolean;
+    running: boolean;
+}>;
 /**
  * #211: names of the envs the platform's sign-in broker (`wtfalch/auth`'s
  * `broker/server.ts`) refuses to start without -- `ZITADEL_SERVICE_USER_TOKEN`/
@@ -1196,6 +1258,11 @@ export declare function brokerDeployNeeded(missingInputs: readonly string[], bro
  * wrote there. Paired with {@link brokerDeployNeeded}, which reads it back.
  */
 export declare function brokerDeployRecordValue(brokerAppId: string, authAppsRaw: string | undefined): string;
+/** Whether any desired env is missing from the app, or set to another value. */
+export declare function envsDiffer(coolify: Pick<CoolifyPort, 'listEnvs'>, appId: string, desired: Array<{
+    key: string;
+    value: string;
+}>): Promise<boolean>;
 /**
  * #171: everything {@link provisionPlatformFiles} needs beyond
  * {@link PlatformStepExecutionContext}, bundled for the same reason as