@wtfalch/foundry 0.37.0 → 0.39.0

package/dist/plan/signin-db.js

@@ -0,0 +1,255 @@
+import { randomBytes } from 'node:crypto';
+import { pinnedRef } from '../bootstrap/versions.js';
+import { envsDiffer, findOrCreatePlatformApp, resolvePlatformServer, } from './platform-providers.js';
+import { SIGNIN_DB_BACKUP_ENV, SIGNIN_DB_BACKUP_KEY_SCOPE_KEY, SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY, SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, ensureSigninDbBackupTarget, ensureSigninDbBackupTask, signinDbBackupEnvs, } from './signin-db-backup.js';
+import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, ensureSigninDbCa, ensureSigninDbServerCert, } from './signin-db-tls.js';
+/**
+ * A company's sign-in database as foundry's own image (#746). Coolify 4.4.2
+ * cannot turn on a database's TLS and mounts files root-owned, so Postgres
+ * would refuse a mounted key. The database is therefore a Dockerfile app: the
+ * pinned `postgres` image, an entrypoint that writes the certificate and key
+ * from env to files owned by `postgres` with mode 0600, and Postgres started
+ * with `ssl=on`. ZITADEL connects with `sslmode=verify-full` and the CA.
+ */
+export { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY };
+export const SIGNIN_DB_PORT = '5432';
+export const SIGNIN_DB_USER = 'zitadel';
+export const SIGNIN_DB_NAME = 'zitadel';
+/** Where the official image keeps its data (`PGDATA`); the volume is mounted here. */
+export const SIGNIN_DB_DATA_DIR = '/var/lib/postgresql/data';
+/** Where ZITADEL's container finds the CA (a Coolify file mount: the CA is public, and its image has no shell to write it). */
+export const SIGNIN_DB_CA_MOUNT = '/etc/signin-db/ca.crt';
+/** Inside the database container: the certificate, key and host rules the entrypoint writes. */
+const TLS_DIR = '/etc/signin-db';
+export const SIGNIN_DB_ENV = {
+    user: 'POSTGRES_USER',
+    password: 'POSTGRES_PASSWORD',
+    database: 'POSTGRES_DB',
+    cert: 'SIGNIN_DB_TLS_CERT_B64',
+    key: 'SIGNIN_DB_TLS_KEY_B64',
+};
+/** How long one Coolify call of these steps may take: the client has no timeout of its own. */
+export const SIGNIN_DB_CALL_TIMEOUT_MS = 60_000;
+/** `work`, or an error naming `what` after {@link SIGNIN_DB_CALL_TIMEOUT_MS}. The call itself is not cancelled. */
+export async function boundedCall(work, what) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${what} did not answer within ${SIGNIN_DB_CALL_TIMEOUT_MS / 1000}s`)), SIGNIN_DB_CALL_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** The port with every method bounded by {@link boundedCall}. */
+export function withCallTimeout(port) {
+    return new Proxy(port, {
+        get(target, prop) {
+            const value = Reflect.get(target, prop, target);
+            if (typeof value !== 'function')
+                return value;
+            return (...args) => boundedCall(Promise.resolve(value.apply(target, args)), `Coolify ${String(prop)}`);
+        },
+    });
+}
+/** How long a new or redeployed database may take to report healthy. */
+const DB_READY_TIMEOUT_MS = 300_000;
+const DB_READY_INTERVAL_MS = 5_000;
+/**
+ * The entrypoint, one line each. No line holds a single quote: the Dockerfile
+ * writes each one inside single quotes. The key file is written by `printf` to
+ * a path only root can reach and then handed to `postgres` with mode 0600, the
+ * check Postgres makes before it loads a key.
+ */
+export function signinDbStartScript() {
+    const files = `${TLS_DIR}/server.crt ${TLS_DIR}/server.key ${TLS_DIR}/pg_hba.conf`;
+    return [
+        '#!/bin/sh',
+        'set -eu',
+        `mkdir -p ${TLS_DIR}`,
+        `printf %s "$${SIGNIN_DB_ENV.cert}" | base64 -d > ${TLS_DIR}/server.crt`,
+        `printf %s "$${SIGNIN_DB_ENV.key}" | base64 -d > ${TLS_DIR}/server.key`,
+        `printf "%s\\n" "local all all trust" "hostssl all all all scram-sha-256" > ${TLS_DIR}/pg_hba.conf`,
+        `chown postgres:postgres ${files}`,
+        `chmod 0600 ${files}`,
+        `exec docker-entrypoint.sh postgres -c ssl=on -c ssl_min_protocol_version=TLSv1.2 -c ssl_cert_file=${TLS_DIR}/server.crt -c ssl_key_file=${TLS_DIR}/server.key -c hba_file=${TLS_DIR}/pg_hba.conf`,
+    ];
+}
+/**
+ * The inline Dockerfile. `local` connections stay trusted (inside the container only, as in the
+ * official image); every network connection must be TLS with a password, so a client that skips
+ * TLS is refused by the server, not only by the client's own setting.
+ */
+export function signinDbDockerfile() {
+    const lines = signinDbStartScript();
+    if (lines.some((l) => l.includes("'")))
+        throw new Error('signin-db entrypoint holds a quote');
+    return [
+        `FROM postgres:${pinnedRef('postgres')}`,
+        // curl signs and puts the nightly dump into the backup bucket (`signin-db-backup.ts`).
+        'RUN apk add --no-cache curl',
+        `RUN printf '%s\\n' \\\n${lines.map((l) => `  '${l}'`).join(' \\\n')} > /usr/local/bin/signin-db-start \\\n  && chmod 0755 /usr/local/bin/signin-db-start`,
+        `EXPOSE ${SIGNIN_DB_PORT}`,
+        'ENTRYPOINT ["/usr/local/bin/signin-db-start"]',
+        `HEALTHCHECK --interval=10s --timeout=5s --start-period=60s --retries=5 CMD ["pg_isready", "-U", "${SIGNIN_DB_USER}", "-d", "${SIGNIN_DB_NAME}"]`,
+    ].join('\n');
+}
+/** ZITADEL's DSN: the whole chain is checked, host name included. A secret (it holds the password). */
+export function signinDbDsn(host, password) {
+    return `postgres://${SIGNIN_DB_USER}:${password}@${host}:${SIGNIN_DB_PORT}/${SIGNIN_DB_NAME}?sslmode=verify-full&sslrootcert=${SIGNIN_DB_CA_MOUNT}`;
+}
+/** The volume and file-mount calls, or an error naming the step: a host that cannot mount cannot run this database. */
+function storageCalls(coolify, label) {
+    const { listStorages, createPersistentStorage, createFileStorage } = coolify;
+    if (!listStorages || !createPersistentStorage || !createFileStorage) {
+        throw new Error(`${label}: the host's Coolify port cannot mount the sign-in database's volume`);
+    }
+    return {
+        listStorages: listStorages.bind(coolify),
+        createPersistentStorage: createPersistentStorage.bind(coolify),
+        createFileStorage: createFileStorage.bind(coolify),
+    };
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Polls until Coolify reports the app `running:healthy`. A healthy status read before the app was
+ * ever seen leaving it could be the container being replaced, so it counts only after two polls in
+ * a row. Throws at the deadline; the message names the app and its last status.
+ */
+export async function waitHealthy(coolify, appId, runtime, label, what = 'the sign-in database') {
+    const now = runtime.now ?? Date.now;
+    const sleep = runtime.sleep ?? defaultSleep;
+    const timeout = runtime.signinDbTimeoutMs ?? DB_READY_TIMEOUT_MS;
+    const deadline = now() + timeout;
+    let left = false;
+    let healthyPolls = 0;
+    for (;;) {
+        const { status } = await coolify.getApplication(appId);
+        if (status === 'running:healthy') {
+            healthyPolls += 1;
+            if (left || healthyPolls >= 2)
+                return;
+        }
+        else {
+            left = true;
+            healthyPolls = 0;
+        }
+        if (now() >= deadline) {
+            throw new Error(`${label}: ${what} (${appId}) did not report healthy within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'}); check its logs and apply again`);
+        }
+        await sleep(DB_READY_INTERVAL_MS);
+    }
+}
+/** Makes a Dockerfile app on the first usable server, without a domain: the caller's `create`. */
+export function dockerfileAppCreator(coolify, o) {
+    return async (dockerfile) => {
+        const server = await resolvePlatformServer(coolify);
+        return coolify.createDockerfileApplication({
+            project_uuid: o.projectUuid,
+            server_uuid: server.uuid,
+            environment_name: o.environment.name,
+            environment_uuid: o.environment.uuid,
+            dockerfile,
+            name: o.name,
+            description: o.description,
+            instant_deploy: false,
+            autogenerate_domain: false,
+        });
+    };
+}
+/**
+ * Brings the TLS database up and returns ZITADEL's DSN: the CA and server certificate (held in
+ * keys), the app with its data volume and no domain, its env (the password minted once and read
+ * back after), and a deploy when the app is new, stopped or its env changed. Returns after the
+ * database reports healthy. A secret (password, key) goes only to the app's env and to
+ * `runtime.onSecret`.
+ */
+export async function provisionSigninDb(input) {
+    const { runtime, label } = input;
+    const coolify = withCallTimeout(input.coolify);
+    if (!input.keys?.put) {
+        throw new Error(`${label}: the host's held keys cannot store the sign-in database certificate`);
+    }
+    if (!input.backup) {
+        throw new Error(`${label}: the host supplies no backup bucket for the sign-in database`);
+    }
+    const ca = await ensureSigninDbCa(input.keys, runtime, Boolean(input.recorded[SIGNIN_DB_TLS_SCOPE_KEY] ||
+        input.recorded[SIGNIN_DB_APP_SCOPE_KEY] ||
+        input.recorded[SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY]));
+    const server = await ensureSigninDbServerCert(input.keys, ca, input.serverCertRef, input.internalHost, runtime);
+    const app = await findOrCreatePlatformApp(coolify, input.name, input.environment, () => boundedCall(input.create(signinDbDockerfile()), 'Coolify createDockerfileApplication'));
+    await input.record(SIGNIN_DB_APP_SCOPE_KEY, app.appId);
+    // No `ports_mappings` and no `domains`: only the Docker network reaches the port.
+    await coolify.updateApplication(app.appId, {
+        custom_internal_name: input.internalHost,
+        ports_exposes: SIGNIN_DB_PORT,
+        health_check_enabled: false,
+    });
+    const calls = storageCalls(coolify, label);
+    const storages = await calls.listStorages(app.appId);
+    if (!(storages.persistent_storages ?? []).some((s) => s.mount_path === SIGNIN_DB_DATA_DIR)) {
+        await calls.createPersistentStorage(app.appId, {
+            name: input.volumeName,
+            mount_path: SIGNIN_DB_DATA_DIR,
+        });
+    }
+    // The password is minted once: the data directory keeps the one it was started with.
+    const heldEnvs = await coolify.listEnvs(app.appId);
+    const existing = heldEnvs.find((e) => e.key === SIGNIN_DB_ENV.password && !e.is_preview && e.value);
+    const heldValue = (key) => heldEnvs.find((e) => e.key === key && !e.is_preview && e.value)?.value;
+    const password = existing?.value ?? randomBytes(24).toString('base64url');
+    runtime.onSecret?.(password);
+    // The company's own bucket and a key that reaches it alone, never the platform's.
+    const backup = await ensureSigninDbBackupTarget(input.backup, {
+        bucketName: input.backupBucket,
+        label,
+        recorded: input.recorded,
+        held: {
+            keyId: heldValue(SIGNIN_DB_BACKUP_ENV.keyId),
+            secret: heldValue(SIGNIN_DB_BACKUP_ENV.secret),
+        },
+        record: input.record,
+        onSecret: runtime.onSecret,
+    });
+    const b64 = (pem) => Buffer.from(pem, 'utf8').toString('base64');
+    runtime.onSecret?.(b64(server.keyPem));
+    const envs = [
+        { key: SIGNIN_DB_ENV.user, value: SIGNIN_DB_USER },
+        { key: SIGNIN_DB_ENV.password, value: password },
+        { key: SIGNIN_DB_ENV.database, value: SIGNIN_DB_NAME },
+        { key: SIGNIN_DB_ENV.cert, value: b64(server.certPem) },
+        { key: SIGNIN_DB_ENV.key, value: b64(server.keyPem) },
+        ...signinDbBackupEnvs(backup.target, input.slug),
+    ];
+    const changed = await envsDiffer(coolify, app.appId, envs);
+    await coolify.bulkUpsertEnvs(app.appId, envs);
+    if (backup.fresh) {
+        await input.record(SIGNIN_DB_BACKUP_KEY_SCOPE_KEY, backup.tokenId);
+        await input.record(SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY, '');
+    }
+    if (app.justCreated || !app.running || changed) {
+        await coolify.deploy(app.appId);
+        await waitHealthy(coolify, app.appId, runtime, label);
+    }
+    await input.record(SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY, String(server.notAfter));
+    // The database is not used, and ZITADEL is not stopped for a move, until its nightly dump is scheduled.
+    await input.record(SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, await ensureSigninDbBackupTask(coolify, app.appId, label, {
+        user: SIGNIN_DB_USER,
+        database: SIGNIN_DB_NAME,
+    }));
+    const dsn = signinDbDsn(input.internalHost, password);
+    runtime.onSecret?.(dsn);
+    return { appId: app.appId, dsn, ca: ca.certPem, password };
+}
+/** Mounts the CA on ZITADEL's app, once. The CA is public and never changes, so an existing mount is left alone. */
+export async function ensureSigninDbCaFile(port, zitadelAppId, caPem, label) {
+    const calls = storageCalls(withCallTimeout(port), label);
+    const storages = await calls.listStorages(zitadelAppId);
+    if ((storages.file_storages ?? []).some((s) => s.mount_path === SIGNIN_DB_CA_MOUNT))
+        return;
+    await calls.createFileStorage(zitadelAppId, { mount_path: SIGNIN_DB_CA_MOUNT, content: caPem });
+}

package/dist/plan/uptime-worker.d.ts

@@ -1,5 +1,6 @@
 import type { AccessPort } from './edge-access.js';
 import type { PlatformWorkersPort } from './edge-workers.js';
+import type { CoolifyPort } from './executor.js';
 import type { PlatformStepExecutionContext } from './plan-apply.js';
 /** The optional plain text variables the Worker reads, supplied by the host (not secrets). */
 export declare const UPTIME_OPTIONAL_VARS: readonly ["CHAT_HOMESERVER_URL", "CHAT_ROOM_ID", "ALERT_EMAIL_FROM", "ALERT_EMAIL_TO"];
@@ -9,6 +10,19 @@ export type PlatformWorkersFactory = (edgeUrl: string) => PlatformWorkersPort |
 export type PlatformUptimeAccessPort = Pick<AccessPort, 'createServiceToken' | 'removeServiceToken' | 'findServiceTokenByName'>;
 /** Builds the Access port at edge's recorded address, the {@link PlatformWorkersFactory} way. */
 export type PlatformUptimeAccessFactory = (edgeUrl: string) => PlatformUptimeAccessPort | Promise<PlatformUptimeAccessPort>;
+/**
+ * What the uptime step needs to make its chat bot through chat-service. The bearer for
+ * `/_chat/internal/*` is `CHAT_INTERNAL_TOKEN` on Company Included's chat-service app, read here and
+ * never held, logged or put in an error.
+ */
+export interface PlatformUptimeChatDeps {
+    /** Reads that app's env (`OwnerChat.appId`). */
+    coolify: Pick<CoolifyPort, 'listEnvs'>;
+    /** The HTTP client; the global `fetch` by default. */
+    fetch?: typeof fetch;
+    /** Milliseconds one call may take (default 10 seconds). */
+    timeoutMs?: number;
+}
 /**
  * Dependencies of the uptime Worker step. `deliverSecret` and `heldKeys` are
  * the host's: the minted token goes only to `deliverSecret`, and every secret
@@ -26,8 +40,13 @@ export interface PlatformUptimeDeps {
     heldKeys: {
         resolve(ref: string): Promise<string | null>;
     };
-    /** Host config for the Worker's optional plain text variables; an absent one is left unset. */
+    /**
+     * Host config for the Worker's optional plain text variables; an absent one is left unset. A set
+     * `CHAT_HOMESERVER_URL` or `CHAT_ROOM_ID` overrides the one foundry made.
+     */
     vars?: Partial<Record<(typeof UPTIME_OPTIONAL_VARS)[number], string>>;
+    /** Makes the Worker's chat bot and its token. Absent: the chat credential is held by hand. */
+    chat?: PlatformUptimeChatDeps;
 }
 /**
  * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping

package/dist/plan/uptime-worker.js

@@ -1,7 +1,7 @@
 import { randomBytes, randomUUID } from 'node:crypto';
 import { EdgeApiError } from '@wtfalch/edge';
 import { uptimeArtifactUrl } from '../platform.js';
-import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_CHAT_TOKEN_REF, PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
 /** The Worker's cron trigger, from Archon's `workers/uptime/manifest.json`. */
 const UPTIME_CRONS = ['* * * * *'];
 /** The date Archon's own Worker config used. */
@@ -15,6 +15,84 @@ export const UPTIME_OPTIONAL_VARS = [
     'ALERT_EMAIL_FROM',
     'ALERT_EMAIL_TO',
 ];
+/** How long one call to read chat-service's token or to ask it for the bot may take. */
+const CHAT_CALL_TIMEOUT_MS = 10_000;
+/** The bot's localpart in chat-service (`@uptime-bot:<server>`). */
+const CHAT_BOT_LOCALPART = 'uptime-bot';
+/** Runs `work` and gives up after `ms`; the error names `what` only. */
+async function withinMs(ms, what, work) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`platform:uptime: ${what} did not answer within ${ms / 1000}s`)), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * `PUT /_chat/internal/bots/uptime-bot` on the company's Agora host. Idempotent on the chat-service
+ * side: a repeat returns the room and no token unless `rotate` is set, so calling with `rotate` again
+ * revokes the previous token. Every message here is fixed text: the response body, the bearer and the
+ * token never reach an error.
+ */
+async function callChatBot(chat, owner, rotate) {
+    const timeoutMs = chat.timeoutMs ?? CHAT_CALL_TIMEOUT_MS;
+    let envs;
+    try {
+        envs = await withinMs(timeoutMs, 'reading the chat-service app', chat.coolify.listEnvs(owner.appId));
+    }
+    catch {
+        // The cause can carry a response body.
+        throw new Error('platform:uptime: the chat-service app could not be read');
+    }
+    const bearer = envs.find((e) => e.key === 'CHAT_INTERNAL_TOKEN' && !e.is_preview)?.value;
+    if (typeof bearer !== 'string' || !/^\S{32,}$/.test(bearer)) {
+        throw new Error('platform:uptime: chat-service holds no usable CHAT_INTERNAL_TOKEN');
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await (chat.fetch ?? fetch)(`https://${owner.agoraHost}/_chat/internal/bots/${CHAT_BOT_LOCALPART}`, {
+            method: 'PUT',
+            headers: { authorization: `Bearer ${bearer}`, 'content-type': 'application/json' },
+            body: JSON.stringify({
+                displayName: 'Platform alerts',
+                room: { name: 'platform-alerts' },
+                members: [...owner.subjects],
+                ...(rotate ? { rotate: true } : {}),
+            }),
+            redirect: 'error',
+            signal: controller.signal,
+        });
+        if (response.status !== 200) {
+            throw new Error(`platform:uptime: chat-service refused the bot request (HTTP ${response.status})`);
+        }
+        const body = (await response.json());
+        const { userId, roomId, accessToken } = body ?? {};
+        if (typeof userId !== 'string' ||
+            !userId ||
+            typeof roomId !== 'string' ||
+            !roomId ||
+            (accessToken !== undefined && (typeof accessToken !== 'string' || !accessToken))) {
+            throw new Error('platform:uptime: chat-service answered the bot request with an unusable body');
+        }
+        return { userId, roomId, ...(accessToken ? { accessToken } : {}) };
+    }
+    catch (error) {
+        // Our own messages pass; anything else (a network error, a bad JSON body) is replaced.
+        if (error instanceof Error && error.message.startsWith('platform:uptime: '))
+            throw error;
+        throw new Error('platform:uptime: chat-service did not answer the bot request');
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping
  * URL that works as a capability, so a secret too), name to value. Callers
@@ -108,11 +186,51 @@ export async function provisionPlatformUptime(context, deps) {
     }
     const hostname = platform.archon.hostname;
     const held = await heldUptimeValues(deps);
+    // The chat bot comes before the upload: its room is one of the Worker's variables. A call that fails
+    // stops the step here, and the next apply makes it again (the marker below says whether a token may
+    // already have been minted).
+    const ownerChat = context.owner?.chat ?? null;
+    let chatRoomId = recorded[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY] || '';
+    if (deps.chat && ownerChat && ownerChat.subjects.length > 0) {
+        const lost = recorded[PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY];
+        if (held.CHAT_ACCESS_TOKEN) {
+            if (lost) {
+                context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, '');
+                await context.persist?.();
+            }
+        }
+        else {
+            // Recorded and persisted before the route is called, because the call is what mints the token.
+            if (!lost) {
+                context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, randomUUID());
+                await context.persist?.();
+            }
+            // A marker, or a room already made, means the bot exists and its token is not held: rotate.
+            const rotate = Boolean(lost) || Boolean(chatRoomId);
+            let bot = await callChatBot(deps.chat, ownerChat, rotate);
+            if (!bot.accessToken && !rotate)
+                bot = await callChatBot(deps.chat, ownerChat, true);
+            const chatToken = bot.accessToken;
+            if (!chatToken) {
+                throw new Error('platform:uptime: chat-service returned no token for the bot, even when asked to rotate it');
+            }
+            chatRoomId = bot.roomId;
+            context.recordScopeId(PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, chatRoomId);
+            await context.persist?.();
+            await attempt('holding the chat bot token', () => deps.deliverSecret(PLATFORM_UPTIME_CHAT_TOKEN_REF, chatToken));
+            context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, '');
+            await context.persist?.();
+            held.CHAT_ACCESS_TOKEN = chatToken;
+        }
+    }
+    const workerVars = uptimeEffectiveVars(deps.vars, deps.chat && ownerChat && chatRoomId
+        ? { homeserverUrl: `https://${ownerChat.agoraHost}`, roomId: chatRoomId }
+        : null);
     const bindings = [
         { type: 'kv_namespace', name: 'UPTIME_KV', title: PLATFORM_UPTIME_KV_TITLE },
         { type: 'plain_text', name: 'ARCHON_BASE_URL', text: `https://${hostname}` },
         ...UPTIME_OPTIONAL_VARS.flatMap((name) => {
-            const text = deps.vars?.[name];
+            const text = workerVars[name];
             return text ? [{ type: 'plain_text', name, text }] : [];
         }),
     ];
@@ -223,7 +341,7 @@ export async function provisionPlatformUptime(context, deps) {
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, uptime.tag);
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, uptime.sha256);
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
-    context.recordScopeId(PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, uptimeVarsDigest(deps.vars));
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, uptimeVarsDigest(workerVars));
     context.recordScopeId(PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, uptimeSecretNames(Object.keys(held)));
     return { resourceId: PLATFORM_UPTIME_SCRIPT_NAME };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",

package/versions.digests.json

@@ -7,5 +7,6 @@
   "stalwart": "sha256:ec011be228596e37e65f41aab17deed573859614430472f7eeb42178c50d87b7",
   "hc": "sha256:aa08a61b0dcfd83f1332eab195d5cec1b595ae076eb8388cadf8a3d597114f9b",
   "alpine": "sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1",
-  "busybox": "sha256:5cec3fc171c87218698e85a52af7087de727372aae264a787b8112901a5b0092"
+  "busybox": "sha256:5cec3fc171c87218698e85a52af7087de727372aae264a787b8112901a5b0092",
+  "postgres": "sha256:786dab398303b8ce7cb76b407bb21ef2e4dfbbbd4c6abcf3d29b3130467ffdbc"
 }

package/versions.json

@@ -7,5 +7,6 @@
   "stalwart": "v0.16.24",
   "hc": "v4.4",
   "alpine": "3.22.1",
-  "busybox": "1.37.0-musl"
+  "busybox": "1.37.0-musl",
+  "postgres": "16.14-alpine3.22"
 }