@wtfalch/foundry 0.61.0 → 0.62.0

package/dist/plan/diff.js

@@ -1,5 +1,5 @@
-import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, heldEnvRef, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, } from '../org.js';
+import { VERSIONS } from '../bootstrap/versions.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, heldEnvRef, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, entryClientIdScopeKey, withRecordedMessagingProject, } from './agora.js';
 import { planAppsDbRoute } from './apps-db-route.js';
@@ -26,6 +26,7 @@ import { gateIdRecordKey, hasWildcardGate, planGates } from './gates.js';
 import { githubSourceResourceKey, planGithubSource } from './github-source.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { planKeysRegistrar } from './keys-registrar.js';
+import { desiredKosmosEnv, kosmosEnvDrift } from './kosmos.js';
 import { APP_GONE_KIND } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, agoraIssuerHostFor, clientOrganizationsState, companyLoginTunnelHost, customersClientOrganizations, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, ownCustomersAppState, pendingRemovalHosts, } from './login-host.js';
@@ -351,7 +352,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     const chat = planChat(org, byKey, claimed, recordedIds, agoraHost, issuer.step !== null);
     if (chat.step)
         plannedSteps.push(chat.step);
-    const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady, versionPin?.calls);
+    const calls = planCalls(org, byKey, claimed);
     if (calls.step)
         plannedSteps.push(calls.step);
     // An own org's media server, before the calls service that reads its addresses.
@@ -711,7 +712,16 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     }, customerGrantsShape);
     if (boule.step)
         plannedSteps.push(boule.step);
-    // Boule's and Agora's blue/green: after their own steps, which make the app it copies.
+    // foundry#949: the company's kosmos, only once it turns it on. Its fixed ZITADEL client first, the same
+    // reason Boule's and Agora's do: `coolifyKosmos` reads this step's recorded client id.
+    const kosmosClient = planKosmosClient(org, byKey, claimed);
+    const kosmosGuarded = guardApp(kosmosClient);
+    if (kosmosGuarded)
+        plannedSteps.push(kosmosGuarded);
+    const kosmos = planKosmos(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? []);
+    if (kosmos.step)
+        plannedSteps.push(kosmos.step);
+    // Boule's, Agora's and kosmos's blue/green: after their own steps, which make the app it copies.
     plannedSteps.push(...blueGreen.steps.filter((x) => x.phase === 'last').map(blueGreenDraft()));
     // Boule owners, after the Boule step: needs the app deployed and the seeding secret in its env.
     const bouleOwners = planBouleOwners(org, recordedIds, (byKey.get(resourceKey('coolify', 'boule', org.id))?.config.env ?? null));
@@ -977,6 +987,8 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     if (boule.mailBlocked) {
         unmanaged.push({ description: boule.mailBlocked, key: 'coolify:boule:mail' });
     }
+    if (kosmos.blocked)
+        unmanaged.push({ description: kosmos.blocked, key: 'coolify:kosmos' });
     // Same for an ai key minted but never delivered: planning a new mint would
     // orphan a second live key.
     if (aiKey.blocked)
@@ -1769,8 +1781,8 @@ function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned)
  * actually need it -- CMS's, chat's and calls' entries follow their own
  * on/off switch, the same ones this file already gates their own
  * `coolify:*` steps on (`org.ts`'s `SiteConfig.enabled`, `ChatConfig.enabled`,
- * `CallsConfig.enabled`); Boule's is unconditional, matching `org.ts`'s own
- * "every org gets one" rule; the app schema follows whether any
+ * `CallsConfig.enabled`); kosmos follows its own switch too (`KosmosApp.enabled`, foundry#949); Boule's is
+ * unconditional, matching `org.ts`'s own "every org gets one" rule; the app schema follows whether any
  * `hosting.entries` entry declares `database: true` (`coolifyDatabase`'s own
  * gate) rather than `hosting.enabled` alone, since a hosting org with no
  * database-bearing entry has nothing for this schema to hold.
@@ -1778,6 +1790,8 @@ function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned)
 function orgServiceSchemaEnabled(org, schema) {
     if (schema.schema === 'cms')
         return org.site.enabled;
+    if (schema.schema === 'kosmos')
+        return kosmosOn(org);
     if (schema.schema.startsWith('chat_'))
         return org.chat.enabled;
     if (schema.schema.startsWith('calls_'))
@@ -2197,75 +2211,47 @@ function planChat(org, byKey, claimed, recordedIds, reading, issuerPlanned) {
  * matrix-authentication-service, entirely separate from chat's
  * (`plan/calls-matrix.ts`'s own top doc comment: a call guest must never gain
  * chat membership). Unlike chat, off by default: `org.ts`'s
- * `CallsConfig.enabled` doc comment. Same on/off, park-not-delete shape as
- * {@link planApp}/{@link planDatabase}/{@link planTunnel} below
- * (`planHostingToggle`, #7 corrections 1) -- turning it off parks Synapse and
- * MAS, never either database (`executor.ts`'s `coolifyCalls`).
+ * `CallsConfig.enabled` doc comment.
  *
- * #177: a first-ever provision (no live resource yet) is blocked, not
- * planned, while `platformReadiness.callsReady` is false -- an org's own
- * Matrix stack is wired to the shared calls SFU (#122/#127), so there is
- * nothing for it to authenticate calls against until the platform's own
- * `sfu:livekit` step is declared. Parking, and an already-provisioned stack,
- * are unaffected.
+ * #430: calls run transit-only now (calls#93's `CALLS_ENCRYPTION=transit`),
+ * so the calls service no longer talks to a per-org Matrix stack and this
+ * never provisions a new one, nor re-provisions a parked one -- the live
+ * resource is still claimed, so it is never reported unmanaged. An org
+ * whose stack is already live and enabled is left exactly as it is;
+ * removing it is a separate, human-confirmed step. Turning `calls.enabled`
+ * off still parks an already-live stack unchanged (`executor.ts`'s
+ * `coolifyCalls`, #7 corrections 1): data is retained, not deleted.
  */
-function planCalls(org, byKey, claimed, callsReady, synapseTag) {
+function planCalls(org, byKey, claimed) {
     const key = resourceKey('coolify', 'calls', org.id);
-    if (org.calls.enabled && !byKey.get(key) && !callsReady) {
-        return {
-            step: null,
-            blocked: ownsServices(org)
-                ? `${org.slug}'s calls Matrix stack is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`
-                : `${org.slug}'s calls Matrix stack is blocked, not planned: the platform owner's calls SFU (the platform's) is off`,
-        };
-    }
-    // #248: the two images this stack's own apply would run, checked the same
-    // way the platform's SFU checks LiveKit/cloudflared and ZITADEL checks its
-    // own tag -- a re-apply of the same declaration must not silently run a
-    // different version with no diff shown anywhere.
-    if (org.calls.enabled && !byKey.get(key)) {
-        const synapseBlocked = floatingTagBlocked('Synapse', synapseTag ?? VERSIONS.synapse, 'v1.161.0');
-        if (synapseBlocked) {
-            return {
-                step: null,
-                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${synapseBlocked}`,
-            };
-        }
-        const masBlocked = floatingTagBlocked('matrix-authentication-service', VERSIONS.mas, '1.24.0');
-        if (masBlocked) {
-            return {
-                step: null,
-                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${masBlocked}`,
-            };
-        }
-    }
+    const live = byKey.get(key);
+    if (live)
+        claimed.add(key);
+    const liveEnabled = live !== undefined && live.config.enabled !== false;
+    if (org.calls.enabled && !liveEnabled)
+        return { step: null, blocked: null };
     const toggle = planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`);
-    // A held Synapse tag rides in the provisioning step; a parking step carries none.
-    if (toggle && synapseTag && toggle.action.desired.enabled === true) {
-        toggle.action.desired = { ...toggle.action.desired, synapseTag };
-    }
     return { step: toggle, blocked: null };
 }
 /**
  * The org's own calls service (#145, part 2 of #128) -- `wtfalch/calls`'s
- * `packages/service`, deployed alongside the calls Matrix stack {@link planCalls}
- * provisions and wired to it and to the shared LiveKit SFU (foundry#122/#127).
- * Gated on the same `org.calls.enabled` flag as the Matrix stack, not a flag
- * of its own: a calls service with no Matrix stack behind it has nothing to
- * authenticate a guest against, and a Matrix stack alone answers no browser,
- * so the two are declared as one on/off switch even though they are two
- * planner steps. Same on/off, park-not-delete shape as {@link planCalls}
- * (`planHostingToggle`, #7 corrections 1) -- turning it off parks the app,
- * never its database (`executor.ts`'s `coolifyCallsService`).
+ * `packages/service`, wired to the shared LiveKit SFU (foundry#122/#127).
+ * Same on/off shape as {@link planCalls} (`planHostingToggle`, #7
+ * corrections 1) -- turning it off parks the app, never its database
+ * (`executor.ts`'s `coolifyCallsService`).
  *
- * #177: silently plans nothing (no second blocked message) while the Matrix
- * stack it rides beside is itself blocked on `callsReady` -- {@link planCalls}
- * already reports the platform's shared SFU as missing once.
+ * #430: calls run transit-only (calls#93), so this no longer rides behind
+ * the Matrix stack {@link planCalls} used to provision -- there is none to
+ * ride behind any more -- and reports the shared SFU as missing itself
+ * (#177) rather than relying on `planCalls`'s now-removed report.
  */
 function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlocked, tokenHost) {
     const key = resourceKey('coolify', 'calls-service', org.id);
-    if (org.calls.enabled && !byKey.get(key) && !callsReady) {
-        return { step: null, blocked: null };
+    if (org.calls.enabled && !byKey.get(key) && !callsReady && !ownsServices(org)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls service is blocked, not planned: the platform owner's calls SFU (the platform's) is off`,
+        };
     }
     // An own org's service names its own media server, so it waits for it even when already provisioned.
     if (org.calls.enabled && ownsServices(org) && !callsReady) {
@@ -3081,6 +3067,137 @@ function planBouleClient(org, byKey, claimed) {
         },
     };
 }
+/**
+ * foundry#949: the fixed ZITADEL web client `kosmos`, once the company turns kosmos on. The same shape as
+ * {@link planBouleClient} and {@link planAgoraClient}; `kosmosOn(org)` is false before any client is planned.
+ */
+function planKosmosClient(org, byKey, claimed) {
+    if (!kosmosOn(org))
+        return null;
+    const key = resourceKey('zitadel', 'app', 'kosmos');
+    const live = byKey.get(key);
+    if (live)
+        claimed.add(key);
+    const desired = { appType: 'web' };
+    if (!live) {
+        return {
+            action: { system: 'zitadel', kind: 'app', key: 'kosmos', desired },
+            step: {
+                description: `provision the web ZITADEL app 'kosmos' for ${org.slug}'s kosmos sign-in`,
+                destroys: false,
+                migrates: false,
+            },
+        };
+    }
+    if (live.config.appType === 'web')
+        return null;
+    return {
+        action: {
+            system: 'zitadel',
+            kind: 'app',
+            key: 'kosmos',
+            desired: { ...desired, recreate: true },
+        },
+        step: {
+            description: `recreate ZITADEL app 'kosmos' for ${org.slug} as web (was ${String(live.config.appType)})`,
+            destroys: true,
+            migrates: false,
+        },
+    };
+}
+/**
+ * foundry#949: the org's own kosmos, a per-org singleton keyed by the org id under its own `kosmos` kind, built
+ * from https://github.com/wtfalch/kosmos's root Dockerfile (`executor.ts`'s `coolifyKosmos`), with a database of
+ * its own. Unlike Boule and Agora, kosmos is set up only once the company turns it on (`kosmosOn(org)`); while
+ * it is off, an org that never had it plans nothing, and a live app is parked (stopped, database kept), the
+ * same rule a switched-off service always follows here.
+ *
+ * Once live, a step is planned again whenever the live app's sign-in env lacks a desired key or holds a
+ * different value (`kosmos.ts`'s `desiredKosmosEnv`, the function the executor writes from). The only host
+ * value is the issuer address (the one Agora and Boule sign in at); without it kosmos is blocked, not planned,
+ * so every other step still applies.
+ */
+function planKosmos(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
+    if (!kosmosOn(org)) {
+        // Switched off: park a live app (stop it, keep the database), like CMS and calls. A stopped app is
+        // already parked, so the plan reaches empty.
+        const parked = planHostingToggle('coolify', 'kosmos', false, org, byKey, claimed, () => `provision ${org.slug}'s kosmos`, () => `park ${org.slug}'s kosmos (stops serving; its database is retained, not deleted)`, org.id, (live) => !/^(exited|stopped)/.test(String(live.config.status ?? '')));
+        return { step: parked, blocked: null };
+    }
+    const key = resourceKey('coolify', 'kosmos', org.id);
+    const live = byKey.get(key);
+    if (live)
+        claimed.add(key);
+    // Never truncated: Postgres cuts an identifier at 63 bytes, and a DNS label
+    // over 63 is refused by Coolify and Cloudflare -- the same check `planBoule` makes.
+    const tooLong = [
+        [`${org.slug}-kosmos`, 'the kosmos host label and app name'],
+        [`${org.slug}_kosmos_db_rt`, 'the kosmos database role'],
+    ].filter(([name]) => name.length > 63);
+    if (tooLong.length > 0) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s kosmos is blocked, not planned: ${tooLong.map(([n, what]) => `${what} '${n}' is over 63 characters`).join(', ')}; shorten the slug`,
+        };
+    }
+    if (otherSlugs.includes(`${org.slug}-kosmos`)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s kosmos is blocked, not planned: another declared org has the slug '${org.slug}-kosmos', which is this kosmos's hostname`,
+        };
+    }
+    if (!issuer) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s kosmos is blocked, not planned: the host supplies no issuer`,
+        };
+    }
+    const action = {
+        system: 'coolify',
+        kind: 'kosmos',
+        key: org.id,
+        desired: { issuer },
+    };
+    if (!live) {
+        return {
+            step: {
+                action,
+                step: { description: `provision ${org.slug}'s kosmos`, destroys: false, migrates: false },
+            },
+            blocked: null,
+        };
+    }
+    const liveEnv = (live.config.env ?? {});
+    const { env } = desiredKosmosEnv(org, recordedIds, issuer);
+    const drift = kosmosEnvDrift(env, liveEnv);
+    // Switched back on while the app is still stopped: the step starts it (`coolifyKosmos` starts a stopped app).
+    if (/^(exited|stopped)/.test(String(live.config.status ?? ''))) {
+        return {
+            step: {
+                action,
+                step: {
+                    description: `start ${org.slug}'s kosmos again (it was parked)`,
+                    destroys: false,
+                    migrates: false,
+                },
+            },
+            blocked: null,
+        };
+    }
+    if (drift.length === 0)
+        return { step: null, blocked: null };
+    return {
+        step: {
+            action,
+            step: {
+                description: `update ${org.slug}'s kosmos config (${drift.join(', ')} missing or different)`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
 /**
  * C3: which credentials the org's Boule is given, and why one is not. Archon's credential goes to every
  * Boule the host can mint it for; the customers directory credential only while `customers.enabled`. Each

package/dist/plan/edge-access.js

@@ -35,6 +35,7 @@ export function createEdgeAccess(client, options = {}) {
         createGate: (input) => retrying(() => client.createGate(input)),
         replaceGateHostnames: (id, input) => retrying(() => client.replaceGateHostnames(id, input)),
         deleteGate: (id) => retrying(() => client.deleteGate(id)),
+        setGatePeople: (id, input) => retrying(() => client.setGatePeople(id, input)),
     };
     const writeSlot = options.writeSlot ?? limiter(EDGE_DNS_WRITE_CONCURRENCY);
     /** app id -> a seen live app with no edge row yet. */

package/dist/plan/executor.d.ts

@@ -1966,6 +1966,15 @@ export declare const BOULE_REPO = "wtfalch/boule";
 export declare const BOULE_APP_DOCKERFILE = "/Dockerfile";
 /** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
 export declare const BOULE_PORT = 3000;
+/**
+ * foundry#949: kosmos (https://github.com/wtfalch/kosmos), bootstrapped from the same `wtfalch/package-template`
+ * service shape Boule is, with its own Dockerfile at the repository root, serving on 3000 (`EXPOSE 3000`) and
+ * running its migrations through `apps/host/scripts/migrate.mjs` before it serves, the same shape Boule's
+ * `migrate-and-start.sh` follows.
+ */
+export declare const KOSMOS_REPO = "wtfalch/kosmos";
+export declare const KOSMOS_APP_DOCKERFILE = "/Dockerfile";
+export declare const KOSMOS_PORT = 3000;
 export declare const LOG_DIR = "/app/logs";
 /** The company's Coolify destination (its Docker network `co-<slug>`), recorded when its first resource is created. */
 export declare const COOLIFY_DESTINATION_SCOPE_KEY = "coolify_destination";
@@ -3145,16 +3154,18 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private coolifyChatRekey;
     /**
      * `plan/diff.ts`'s `planCallsService`: the org's own calls service --
-     * `wtfalch/calls`'s `packages/service`, wired to the calls Matrix stack
-     * {@link coolifyCalls} provisions and the shared LiveKit SFU (#122/#127).
-     * Static config checks run first, before any Coolify call (#128's own
-     * carried-over PR 344 review fix, restated in #145's own issue body): the
-     * calls Matrix stack must already be recorded, its MAS app must already
-     * carry its client id/secret, and the shared SFU's LiveKit credentials must
-     * already be resolvable -- none of the three is minted or guessed here.
-     * Park stops the app only, the same park-not-delete rule
-     * {@link coolifyCalls}/{@link coolifyApp} already follow (#7 corrections
-     * 1); its own database is never touched from that branch.
+     * `wtfalch/calls`'s `packages/service`, wired to the shared LiveKit SFU
+     * (#122/#127). #430: calls run transit-only (calls#93's
+     * `CALLS_ENCRYPTION=transit`), so this no longer waits on or wires a
+     * per-org Matrix stack at all -- an org whose stack is already live from
+     * before this keeps running it, unused, until a human removes it
+     * separately. Static config checks run first, before any Coolify call
+     * (#128's own carried-over PR 344 review fix, restated in #145's own
+     * issue body): the shared SFU's LiveKit credentials must already be
+     * resolvable -- not minted or guessed here. Park stops the app only, the
+     * same park-not-delete rule {@link coolifyCalls}/{@link coolifyApp}
+     * already follow (#7 corrections 1); its own database is never touched
+     * from that branch.
      */
     private coolifyCallsService;
     /**
@@ -3187,14 +3198,6 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * env and mints nothing.
      */
     private callsTokenEnvs;
-    /**
-     * Reads back the calls Matrix stack's MAS client id/secret from the MAS
-     * app's own envs ({@link CALLS_SECRET_ENV_KEYS}) -- never mints: minting
-     * either is {@link ensureCallsMatrixSecrets}'s own job, and a missing value
-     * here means that stack has not finished provisioning yet, not something
-     * this step can fix on its own.
-     */
-    private readCallsMasClientCredentials;
     /**
      * `null` once the calls service app already has a `CALLS_BINDING_SECRET` --
      * never rotated, the same rule {@link ensureAuthCookieSecret} follows for
@@ -3327,6 +3330,25 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * shape {@link coolifyAgora}'s own doc comment explains.
      */
     private coolifyBoule;
+    /**
+     * `plan/diff.ts`'s `planKosmos`: provisions the org's own kosmos
+     * (https://github.com/wtfalch/kosmos) as one more Coolify application, from
+     * that repo's root Dockerfile ({@link KOSMOS_REPO}), with a database of its
+     * own, and pushes its sign-in env. The same shape as {@link coolifyBoule},
+     * trimmed: kosmos is opt-in (`kosmosOn(org)` guards every caller, so this is
+     * never reached while it is off), has no mail, no owner seeding and no
+     * Archon credential.
+     *
+     * The sign-in env comes from `plan/kosmos.ts`'s `desiredKosmosEnv`, the same
+     * function the plan compares the live app against; it never writes a
+     * partial set. The database is `<slug>-kosmos-db`, split the same way
+     * Boule's is: the superuser URL as `DATABASE_URL_OWNER` and a `<dbName>_rt`
+     * role's URL as `DATABASE_URL`, both through `pushDatabaseUrl`.
+     *
+     * #504 (same reason {@link coolifyBoule}'s own comment gives): a brand new
+     * app is never restarted, but it is deployed once ({@link KOSMOS_DEPLOYED_SCOPE_KEY}).
+     */
+    private coolifyKosmos;
     /**
      * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
      * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is