@wtfalch/foundry 0.61.0 → 0.62.0

package/dist/plan/executor.js

@@ -5,7 +5,7 @@ import { EdgeApiError } from '@wtfalch/edge';
 import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { APPS_DOMAIN, APP_ENTRY_KEY, FULL_COMMIT_SHA, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, filesCollectionEnvName, heldEnvRef, isLiveEntry, isMainEntry, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
+import { APPS_DOMAIN, APP_ENTRY_KEY, FULL_COMMIT_SHA, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, filesCollectionEnvName, heldEnvRef, isLiveEntry, isMainEntry, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
 import { APPS_DATABASE_ADMIN_URL_ENV, applyAppsDbRoute, retireAppsDbRoute, } from './apps-db-route.js';
@@ -19,7 +19,7 @@ import { AUTH_REGISTRAR_KEY_ENV, AUTH_REGISTRAR_URL_ENV, REGISTRAR_APPLIED_SCOPE
 import { BROKER_WORKSPACES_DATABASE_SCOPE_KEY, canHoldWorkspacesDatabase, ensureBrokerWorkspacesDatabase, } from './broker-workspaces-database.js';
 import { recordBuiltCommit } from './build-record.js';
 import { CallError, withTimeout as withLabelledTimeout } from './call-timeout.js';
-import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
+import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { BACKUP_POSTGRES_DATABASES_SCOPE_KEY, BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
@@ -50,6 +50,7 @@ import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSett
 import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
 import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, workspaceHost, } from './hostnames.js';
 import { KEYS_REGISTRAR_DELIVERY_ATTEMPTS, KEYS_REGISTRAR_KEY_DAYS, KEYS_REGISTRAR_KEY_ENV, KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY, KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, KEYS_REGISTRAR_URL_ENV, } from './keys-registrar.js';
+import { KOSMOS_CLIENT_ID_SCOPE_KEY, KOSMOS_DATABASE_SCOPE_KEY, KOSMOS_DEPLOYED_SCOPE_KEY, desiredKosmosEnv, kosmosEnvDrift, kosmosHostnameFor, } from './kosmos.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { machineBypassScopeKey } from './machine-paths.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
@@ -392,6 +393,15 @@ export const BOULE_REPO = 'wtfalch/boule';
 export const BOULE_APP_DOCKERFILE = '/Dockerfile';
 /** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
 export const BOULE_PORT = 3000;
+/**
+ * foundry#949: kosmos (https://github.com/wtfalch/kosmos), bootstrapped from the same `wtfalch/package-template`
+ * service shape Boule is, with its own Dockerfile at the repository root, serving on 3000 (`EXPOSE 3000`) and
+ * running its migrations through `apps/host/scripts/migrate.mjs` before it serves, the same shape Boule's
+ * `migrate-and-start.sh` follows.
+ */
+export const KOSMOS_REPO = 'wtfalch/kosmos';
+export const KOSMOS_APP_DOCKERFILE = '/Dockerfile';
+export const KOSMOS_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -657,6 +667,14 @@ const CALLS_SYNAPSE_SCOPE_KEY = 'coolify_calls_synapse';
 const CALLS_MAS_SCOPE_KEY = 'coolify_calls_mas';
 const CALLS_SYNAPSE_DB_SCOPE_KEY = 'coolify_calls_synapse_database';
 const CALLS_MAS_DB_SCOPE_KEY = 'coolify_calls_mas_database';
+/** #430: the calls service's own Matrix/MAS env vars, from before calls#93 (transit-only). Removed from every org's calls service, never written again. */
+const CALLS_MATRIX_ENV_KEYS = [
+    'MAS_URL',
+    'MAS_HOMESERVER',
+    'MAS_CLIENT_ID',
+    'MAS_CLIENT_SECRET',
+    'SYNAPSE_URL',
+];
 /**
  * Synapse refuses to start against a database whose `LC_COLLATE`/`LC_CTYPE`
  * is not `C` (https://element-hq.github.io/synapse/latest/postgres.html);
@@ -947,6 +965,8 @@ function limitProfileOf(action) {
         case 'coolify:boule':
         case 'coolify:boule-broker-entry':
             return LIMITS.boule;
+        case 'coolify:kosmos':
+            return LIMITS.kosmos;
         case 'coolify:broker-registrar':
             return LIMITS.brokerEntry;
         case 'coolify:keys-registrar':
@@ -1380,6 +1400,8 @@ export class FoundryStepExecutor {
                 return this.bouleOwners(org, context);
             case 'coolify:boule-broker-entry':
                 return this.bouleBrokerEntry(org, context);
+            case 'coolify:kosmos':
+                return this.coolifyKosmos(action, org, context);
             case 'coolify:broker-registrar':
                 return this.brokerRegistrar(org, context);
             case 'coolify:keys-registrar':
@@ -2778,6 +2800,7 @@ export class FoundryStepExecutor {
         const isCmsClient = action.key === 'cms' && org.site.enabled;
         const isAgoraClient = action.key === 'agora';
         const isBouleClient = action.key === 'boule';
+        const isKosmosClient = action.key === 'kosmos' && kosmosOn(org);
         const authEntry = org.hosting.entries.find((e) => e.key === action.key && e.uses?.auth);
         // A workspace's own client `<key>-work`, signing in at the workspace host.
         const workspaceEntry = authEntry ? undefined : workspaceAuthEntryOf(org, action.key);
@@ -2787,9 +2810,11 @@ export class FoundryStepExecutor {
                 ? AGORA_CLIENT_ID_SCOPE_KEY
                 : isBouleClient
                     ? BOULE_CLIENT_ID_SCOPE_KEY
-                    : authEntry || workspaceEntry
-                        ? entryClientIdScopeKey(action.key)
-                        : APP_CLIENT_ID_SCOPE_KEY;
+                    : isKosmosClient
+                        ? KOSMOS_CLIENT_ID_SCOPE_KEY
+                        : authEntry || workspaceEntry
+                            ? entryClientIdScopeKey(action.key)
+                            : APP_CLIENT_ID_SCOPE_KEY;
         const priorAppId = recorded[`zitadel:app:${action.key}`];
         // Only a step the planner flagged as destroying (`recreate`, set with
         // `destroys: true` so plan-apply asks for the typed confirmation) may
@@ -4247,6 +4272,8 @@ export class FoundryStepExecutor {
             }
             case 'boule':
                 return { appIds: await byName(`${org.slug}-boule`), template: true };
+            case 'kosmos':
+                return { appIds: await byName(`${org.slug}-kosmos`), template: true };
             case 'chat_service':
                 return { appIds: await byName(chat.service), template: true };
             case 'calls_service':
@@ -6530,16 +6557,18 @@ export class FoundryStepExecutor {
     // ---- calls service (#145, part 2 of #128) -------------------------------
     /**
      * `plan/diff.ts`'s `planCallsService`: the org's own calls service --
-     * `wtfalch/calls`'s `packages/service`, wired to the calls Matrix stack
-     * {@link coolifyCalls} provisions and the shared LiveKit SFU (#122/#127).
-     * Static config checks run first, before any Coolify call (#128's own
-     * carried-over PR 344 review fix, restated in #145's own issue body): the
-     * calls Matrix stack must already be recorded, its MAS app must already
-     * carry its client id/secret, and the shared SFU's LiveKit credentials must
-     * already be resolvable -- none of the three is minted or guessed here.
-     * Park stops the app only, the same park-not-delete rule
-     * {@link coolifyCalls}/{@link coolifyApp} already follow (#7 corrections
-     * 1); its own database is never touched from that branch.
+     * `wtfalch/calls`'s `packages/service`, wired to the shared LiveKit SFU
+     * (#122/#127). #430: calls run transit-only (calls#93's
+     * `CALLS_ENCRYPTION=transit`), so this no longer waits on or wires a
+     * per-org Matrix stack at all -- an org whose stack is already live from
+     * before this keeps running it, unused, until a human removes it
+     * separately. Static config checks run first, before any Coolify call
+     * (#128's own carried-over PR 344 review fix, restated in #145's own
+     * issue body): the shared SFU's LiveKit credentials must already be
+     * resolvable -- not minted or guessed here. Park stops the app only, the
+     * same park-not-delete rule {@link coolifyCalls}/{@link coolifyApp}
+     * already follow (#7 corrections 1); its own database is never touched
+     * from that branch.
      */
     async coolifyCallsService(action, org, context) {
         if (action.desired.enabled === false) {
@@ -6550,18 +6579,8 @@ export class FoundryStepExecutor {
             await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
             return { resourceId: appId };
         }
-        // Refused before anything is created, like the missing-stack refusal below.
+        // Refused before anything is created, like the missing-SFU refusal below.
         const sfuUrls = resolveCallsSfuUrls(this.ports.callsSfuUrls);
-        const recorded = context.recordedIds();
-        const synapseId = recorded[CALLS_SYNAPSE_SCOPE_KEY];
-        const masId = recorded[CALLS_MAS_SCOPE_KEY];
-        if (!synapseId || !masId) {
-            throw new Error(`coolify:calls-service for ${org.slug}: the calls Matrix stack has not been provisioned yet -- coolify:calls must run first`);
-        }
-        const masCredentials = await this.readCallsMasClientCredentials(masId);
-        if (!masCredentials) {
-            throw new Error(`coolify:calls-service for ${org.slug}: the calls Matrix stack's MAS client credentials are not on the MAS app yet -- retry this apply once coolify:calls has minted them`);
-        }
         const sfu = await this.ports.callsSfu.resolveCredentials(org.slug);
         if (!sfu) {
             throw new Error(`coolify:calls-service for ${org.slug}: the shared calls SFU has no LiveKit credentials for this org yet -- see https://github.com/wtfalch/foundry/issues/152`);
@@ -6569,8 +6588,6 @@ export class FoundryStepExecutor {
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const name = callsServiceInternalName(org);
-        const synapseHost = `${org.slug}-calls-synapse`;
-        const masHost = `${org.slug}-calls-mas`;
         const dbName = `${name}-db`;
         const serviceHome = await this.ensureHomeDatabase(org, context, 'calls_service', CALLS_SERVICE_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY));
         if (!(await this.homeOwnerUrl(serviceHome))) {
@@ -6612,17 +6629,25 @@ export class FoundryStepExecutor {
         });
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
+        // #430: an org whose Matrix stack is still live from before this keeps
+        // the Synapse/MAS apps running, unused, until a human removes them
+        // separately -- but its calls service's own env drops their vars on its
+        // next apply, the same as a brand new org that never got them.
+        for (const key of CALLS_MATRIX_ENV_KEYS) {
+            const env = (await this.ports.coolify.listEnvs(app.appId)).find((e) => e.key === key && !e.is_preview);
+            if (env?.uuid)
+                await this.ports.coolify.deleteEnv(app.appId, env.uuid);
+        }
         const bindingSecret = await this.ensureCallsBindingSecret(app.appId);
         const envs = [
             { key: 'LIVEKIT_URL', value: sfuUrls.privateUrl },
             { key: 'LIVEKIT_PUBLIC_URL', value: sfuUrls.publicUrl },
             { key: 'LIVEKIT_API_KEY', value: sfu.apiKey },
             { key: 'LIVEKIT_API_SECRET', value: sfu.apiSecret },
-            { key: 'MAS_URL', value: `http://${masHost}:8080/` },
-            { key: 'MAS_HOMESERVER', value: callsServerName(org.slug) },
-            { key: 'MAS_CLIENT_ID', value: masCredentials.clientId },
-            { key: 'MAS_CLIENT_SECRET', value: masCredentials.clientSecret },
-            { key: 'SYNAPSE_URL', value: `http://${synapseHost}:8008` },
+            // #430 (calls#93): calls are transit-only, so the service never needs
+            // a Matrix/MAS provider -- MAS_URL, MAS_HOMESERVER, MAS_CLIENT_ID,
+            // MAS_CLIENT_SECRET and SYNAPSE_URL are never written.
+            { key: 'CALLS_ENCRYPTION', value: 'transit' },
             { key: 'CALLS_ORIGIN', value: `https://${agoraHostnameFor(org)}` },
             { key: 'CALLS_HOST_ADAPTER', value: 'production' },
             // Deliberately kept as it was, not widened: the calls service refuses to
@@ -6748,6 +6773,9 @@ export class FoundryStepExecutor {
             throw new Error(`${at}: token ${tokenId} is recorded but chat-service no longer holds a usable one; remove the recorded keys ${CHAT_CALLS_TOKEN_SCOPE_KEY} and ${CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
         const token = usable ?? randomBytes(32).toString('hex');
+        // Registered before either write, so a Coolify error body echoing the upsert is scrubbed
+        // from the run record the same way the write loop's own dropped-error fallback intends.
+        this.handledSecrets.add(token);
         if (!tokenId) {
             tokenId = randomBytes(8).toString('hex');
             context.recordScopeId(CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, tokenId);
@@ -6852,22 +6880,6 @@ export class FoundryStepExecutor {
             appId: client.appId,
         };
     }
-    /**
-     * Reads back the calls Matrix stack's MAS client id/secret from the MAS
-     * app's own envs ({@link CALLS_SECRET_ENV_KEYS}) -- never mints: minting
-     * either is {@link ensureCallsMatrixSecrets}'s own job, and a missing value
-     * here means that stack has not finished provisioning yet, not something
-     * this step can fix on its own.
-     */
-    async readCallsMasClientCredentials(masAppId) {
-        const envs = await this.ports.coolify.listEnvs(masAppId);
-        const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
-        const clientId = read(CALLS_SECRET_ENV_KEYS.masClientId);
-        const clientSecret = read(CALLS_SECRET_ENV_KEYS.masClientSecret);
-        if (!clientId || !clientSecret)
-            return null;
-        return { clientId, clientSecret };
-    }
     /**
      * `null` once the calls service app already has a `CALLS_BINDING_SECRET` --
      * never rotated, the same rule {@link ensureAuthCookieSecret} follows for
@@ -7452,6 +7464,98 @@ export class FoundryStepExecutor {
         this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
+    // ---- kosmos (foundry#949) --------------------------------------------------
+    /**
+     * `plan/diff.ts`'s `planKosmos`: provisions the org's own kosmos
+     * (https://github.com/wtfalch/kosmos) as one more Coolify application, from
+     * that repo's root Dockerfile ({@link KOSMOS_REPO}), with a database of its
+     * own, and pushes its sign-in env. The same shape as {@link coolifyBoule},
+     * trimmed: kosmos is opt-in (`kosmosOn(org)` guards every caller, so this is
+     * never reached while it is off), has no mail, no owner seeding and no
+     * Archon credential.
+     *
+     * The sign-in env comes from `plan/kosmos.ts`'s `desiredKosmosEnv`, the same
+     * function the plan compares the live app against; it never writes a
+     * partial set. The database is `<slug>-kosmos-db`, split the same way
+     * Boule's is: the superuser URL as `DATABASE_URL_OWNER` and a `<dbName>_rt`
+     * role's URL as `DATABASE_URL`, both through `pushDatabaseUrl`.
+     *
+     * #504 (same reason {@link coolifyBoule}'s own comment gives): a brand new
+     * app is never restarted, but it is deployed once ({@link KOSMOS_DEPLOYED_SCOPE_KEY}).
+     */
+    async coolifyKosmos(action, org, context) {
+        // Park stops the app only; its database is never touched (#7 corrections 1).
+        if (action.desired.enabled === false) {
+            const appId = context.recordedIds()[`coolify:kosmos:${action.key}`];
+            if (!appId) {
+                throw new Error(`coolify:kosmos for ${org.slug}: no live app recorded, nothing to park`);
+            }
+            await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
+            return { resourceId: appId };
+        }
+        const issuer = action.desired.issuer ?? null;
+        const { env, missing } = desiredKosmosEnv(org, context.recordedIds(), issuer);
+        if (missing.length > 0) {
+            throw new Error(`kosmos for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
+        }
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const name = `${org.slug}-kosmos`;
+        const dbName = `${org.slug}-kosmos-db`.replace(/-/g, '_');
+        // #444: on the company's server there is no Coolify database to make, like Boule's.
+        const kosmosServer = this.homeOnServer(org, context, 'kosmos')
+            ? await this.serverHome(org, context, 'kosmos')
+            : null;
+        const dbId = kosmosServer
+            ? ''
+            : await this.ensureCallsDatabase(org, context, projectUuid, environment, `${org.slug}-kosmos-db`, dbName, KOSMOS_DATABASE_SCOPE_KEY);
+        if (!kosmosServer)
+            context.recordScopeId(KOSMOS_DATABASE_SCOPE_KEY, dbId);
+        const server = await this.resolveServer(org, context);
+        const githubApp = await this.ports.coolify.requireGithubApp();
+        const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            github_app_uuid: githubApp.uuid,
+            git_repository: KOSMOS_REPO,
+            git_branch: 'main',
+            build_pack: 'dockerfile',
+            name,
+            domains: coolifyTunnelDomains([kosmosHostnameFor(org)]),
+            dockerfile_location: KOSMOS_APP_DOCKERFILE,
+        }));
+        // Every app foundry deploys keeps its own logs (#75), reused as-is here.
+        await this.ensureLogVolume(app.appId, org, app.existed);
+        await this.ports.coolify.updateApplication(app.appId, {
+            ...healthCheckSettings('/api/health', KOSMOS_PORT),
+            ...(await this.routedLabels(name, kosmosHostnameFor(org), KOSMOS_PORT)),
+        });
+        const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
+        const liveEnv = Object.fromEntries(liveRows.map((e) => [e.key, e.value]));
+        const envChanged = kosmosEnvDrift(env, liveEnv).length > 0;
+        const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
+        const cookieSecret = await this.ensureAuthCookieSecret(app.appId);
+        if (cookieSecret)
+            envs.push({ key: 'AUTH_COOKIE_SECRET', value: cookieSecret });
+        await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName, kosmosServer ?? undefined);
+        if (!dbPush.pushed) {
+            throw new Error(`kosmos for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        if (!context.recordedIds()[KOSMOS_DEPLOYED_SCOPE_KEY]) {
+            const runtime = this.ports.runtime ?? {};
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), kosmosHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:kosmos', `${org.slug}'s kosmos stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'kosmos' }, (key, value) => context.recordScopeId(key, value));
+            context.recordScopeId(KOSMOS_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (app.existed && (envChanged || cookieSecret !== null || dbPush.changed)) {
+            await this.ports.coolify.restart(app.appId);
+        }
+        return { resourceId: app.appId };
+    }
     /**
      * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
      * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is

package/dist/plan/kosmos.d.ts

@@ -0,0 +1,56 @@
+import type { DeclaredOrg } from '../org.js';
+/**
+ * foundry#949: what both the planner (`diff.ts`) and the executor
+ * (`executor.ts`) need to agree on for an org's kosmos -- the hostname, the
+ * recorded ids and the env vars those produce -- so the plan can compare the
+ * live app with exactly what the executor would write. The same split
+ * `boule.ts` and `agora.ts` already follow, trimmed to what kosmos needs for
+ * its first release: a ZITADEL client, a database and sign-in env. Kosmos has
+ * no mail, no owner seeding and no Archon credential -- it is not Boule.
+ */
+/**
+ * The fixed `kosmos` ZITADEL web client's `clientId`, recorded by
+ * `executor.ts`'s `zitadelApp` and read by `coolifyKosmos` for
+ * `AUTH_CLIENT_ID`. Public, not a secret, so a flat scope id like
+ * `boule_client_id`.
+ */
+export declare const KOSMOS_CLIENT_ID_SCOPE_KEY = "kosmos_client_id";
+/**
+ * The kosmos database's Coolify uuid. It has no `system:kind:key` slot of its
+ * own (the step's one auto-recorded `resourceId` is the app), so it is a flat
+ * scope id, like the Boule and cms databases.
+ */
+export declare const KOSMOS_DATABASE_SCOPE_KEY = "coolify_kosmos_database";
+/**
+ * Recorded once `coolifyKosmos` has actually called `deploy` on this org's
+ * kosmos app -- the same marker {@link BOULE_DEPLOYED_SCOPE_KEY} (`boule.ts`)
+ * and {@link AGORA_DEPLOYED_SCOPE_KEY} (`agora.ts`) are, and for the same
+ * reason: Coolify defaults `instant_deploy` to false, so a freshly created
+ * app sat built but never started.
+ */
+export declare const KOSMOS_DEPLOYED_SCOPE_KEY = "coolify_kosmos_deployed";
+/**
+ * `kosmos.<domain>` when the org has a domain, `<slug>-kosmos.oikos.host`
+ * otherwise -- the same tier rule `bouleHostnameFor`/`agoraHostnameFor`
+ * follow; `../slug.ts`'s `KOSMOS_SUFFIX` reserves the collision.
+ */
+export declare function kosmosHostnameFor(org: DeclaredOrg): string;
+/** The env names `desiredKosmosEnv` can write, so the live reader knows which to read back. */
+export declare const KOSMOS_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID"];
+/**
+ * The env vars an org's kosmos app should carry, and every input still missing
+ * to build them. Callers that write must refuse on a non-empty `missing`: an
+ * kosmos with a blank client id fails every sign-in. `issuer` is the host's
+ * issuer address (`AgoraHostValues.issuer`), the same one Agora and Boule sign
+ * in at.
+ *
+ * Not here, and written by the executor instead: the database URLs
+ * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
+ * (generated once, never rotated) -- the same split `desiredBouleEnv` keeps.
+ */
+export declare function desiredKosmosEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null): {
+    env: Record<string, string>;
+    missing: string[];
+};
+/** The desired env keys the live app lacks or holds a different value for. */
+export declare function kosmosEnvDrift(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): string[];

package/dist/plan/kosmos.js

@@ -0,0 +1,84 @@
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+/**
+ * foundry#949: what both the planner (`diff.ts`) and the executor
+ * (`executor.ts`) need to agree on for an org's kosmos -- the hostname, the
+ * recorded ids and the env vars those produce -- so the plan can compare the
+ * live app with exactly what the executor would write. The same split
+ * `boule.ts` and `agora.ts` already follow, trimmed to what kosmos needs for
+ * its first release: a ZITADEL client, a database and sign-in env. Kosmos has
+ * no mail, no owner seeding and no Archon credential -- it is not Boule.
+ */
+/**
+ * The fixed `kosmos` ZITADEL web client's `clientId`, recorded by
+ * `executor.ts`'s `zitadelApp` and read by `coolifyKosmos` for
+ * `AUTH_CLIENT_ID`. Public, not a secret, so a flat scope id like
+ * `boule_client_id`.
+ */
+export const KOSMOS_CLIENT_ID_SCOPE_KEY = 'kosmos_client_id';
+/**
+ * The kosmos database's Coolify uuid. It has no `system:kind:key` slot of its
+ * own (the step's one auto-recorded `resourceId` is the app), so it is a flat
+ * scope id, like the Boule and cms databases.
+ */
+export const KOSMOS_DATABASE_SCOPE_KEY = 'coolify_kosmos_database';
+/**
+ * Recorded once `coolifyKosmos` has actually called `deploy` on this org's
+ * kosmos app -- the same marker {@link BOULE_DEPLOYED_SCOPE_KEY} (`boule.ts`)
+ * and {@link AGORA_DEPLOYED_SCOPE_KEY} (`agora.ts`) are, and for the same
+ * reason: Coolify defaults `instant_deploy` to false, so a freshly created
+ * app sat built but never started.
+ */
+export const KOSMOS_DEPLOYED_SCOPE_KEY = 'coolify_kosmos_deployed';
+/**
+ * `kosmos.<domain>` when the org has a domain, `<slug>-kosmos.oikos.host`
+ * otherwise -- the same tier rule `bouleHostnameFor`/`agoraHostnameFor`
+ * follow; `../slug.ts`'s `KOSMOS_SUFFIX` reserves the collision.
+ */
+export function kosmosHostnameFor(org) {
+    return org.domain ? `kosmos.${org.domain}` : `${org.slug}-kosmos.oikos.host`;
+}
+/** The env names `desiredKosmosEnv` can write, so the live reader knows which to read back. */
+export const KOSMOS_MANAGED_ENV_KEYS = [
+    'APP_URL',
+    'AUTH_ISSUER',
+    'AUTH_ORGANIZATION_ID',
+    'AUTH_CLIENT_ID',
+];
+/**
+ * The env vars an org's kosmos app should carry, and every input still missing
+ * to build them. Callers that write must refuse on a non-empty `missing`: an
+ * kosmos with a blank client id fails every sign-in. `issuer` is the host's
+ * issuer address (`AgoraHostValues.issuer`), the same one Agora and Boule sign
+ * in at.
+ *
+ * Not here, and written by the executor instead: the database URLs
+ * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
+ * (generated once, never rotated) -- the same split `desiredBouleEnv` keeps.
+ */
+export function desiredKosmosEnv(org, recorded, issuer) {
+    const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    const clientId = recorded[KOSMOS_CLIENT_ID_SCOPE_KEY];
+    const missing = [];
+    if (!issuer)
+        missing.push('issuer');
+    if (!zitadelOrgId)
+        missing.push('zitadelOrgId');
+    if (!clientId)
+        missing.push('clientId');
+    const env = {
+        APP_URL: `https://${kosmosHostnameFor(org)}`,
+    };
+    if (issuer)
+        env.AUTH_ISSUER = issuer;
+    if (zitadelOrgId)
+        env.AUTH_ORGANIZATION_ID = zitadelOrgId;
+    if (clientId)
+        env.AUTH_CLIENT_ID = clientId;
+    return { env, missing };
+}
+/** The desired env keys the live app lacks or holds a different value for. */
+export function kosmosEnvDrift(desired, live) {
+    return Object.entries(desired)
+        .filter(([key, value]) => live[key] !== value)
+        .map(([key]) => key);
+}

package/dist/plan/locked-hostnames.js

@@ -1,8 +1,9 @@
-import { ownsServices } from '../org.js';
+import { kosmosOn, ownsServices } from '../org.js';
 import { OWN_SERVICE_LABELS } from '../service-labels.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { cmsStudioHostnameFor, siteHostnameFor } from './hostnames.js';
+import { kosmosHostnameFor } from './kosmos.js';
 import { loginHostnameFor } from './login-host.js';
 import { ownHostnames } from './own-hostnames.js';
 export { OWN_SERVICE_LABELS };
@@ -31,6 +32,8 @@ export function lockedHostnames(org, platformHostnames) {
     }
     locked.add(agoraHostnameFor(org));
     locked.add(bouleHostnameFor(org));
+    if (kosmosOn(org))
+        locked.add(kosmosHostnameFor(org));
     if (org.site.enabled)
         locked.add(cmsStudioHostnameFor(org));
     if (org.calls.enabled && org.calls.usesDomain)
@@ -58,6 +61,6 @@ export function hostingNames(org, platformHostnames) {
         locked: lockedHostnames(org, platformHostnames),
         slug: org.slug,
         siteOwnsApex: org.site.enabled && org.site.usesDomain && org.domain !== null,
-        builtinBlueGreen: org.boule?.blueGreen !== undefined || org.agora?.blueGreen !== undefined,
+        builtinBlueGreen: org.boule?.blueGreen !== undefined || org.agora?.blueGreen !== undefined || kosmosOn(org),
     };
 }

package/dist/plan/org-names.d.ts

@@ -6,13 +6,13 @@ export type OrgNameSource = 'own' | 'hosting';
  * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
  * calls and the cms site while they are on.
  */
-export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site'>): string[];
+export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site' | 'kosmos'>): string[];
 /**
  * Every container name, network alias, database, tunnel and bucket name that
  * foundry derives for an org: its own-service names when it owns services,
  * and its hosting-entry and database names.
  */
-export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>): {
     name: string;
     source: OrgNameSource;
 }[];
@@ -26,5 +26,5 @@ export interface NameClash {
     source: OrgNameSource;
 }
 /** Every name `org` derives that another org or the platform also derives. */
-export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>[]): NameClash[];
 export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -1,4 +1,4 @@
-import { ownsServices } from '../org.js';
+import { kosmosOn, ownsServices } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
 import { workerAppHostname, workspaceHost, workspaceInboxHost } from './hostnames.js';
@@ -20,6 +20,8 @@ export function companyServiceNames(org) {
         `${s}-tunnel`,
         `${s}-cloudflared`,
     ];
+    if (kosmosOn(org))
+        names.push(`${s}-kosmos`, `${s}-kosmos-db`);
     if (org.chat?.enabled) {
         names.push(...Object.values(chatInternalNames(s)), ...Object.values(chatRekeyedInternalNames(s)));
     }

package/dist/plan/org-postgres-migrate.js

@@ -64,6 +64,7 @@ export function parseMigrationConfirmation(raw) {
 const MIGRATION_ORDER = [
     'app',
     'cms',
+    'kosmos',
     'boule',
     'chat_service',
     'calls_service',

package/dist/plan/own-limits.d.ts

@@ -107,6 +107,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly kosmos: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly companyOther: {
         memory: string;
         dbMemory: string;

package/dist/plan/own-limits.js

@@ -29,6 +29,7 @@ export const LIMITS = {
     calls: profile('1g', '512m'),
     agora: profile('1g', '512m'),
     boule: profile('512m'),
+    kosmos: profile('512m'),
     companyOther: profile('1g', '512m'),
     platformArchon: profile('1g'),
     platformAi: profile('1g'),

package/dist/plan/platform-providers.js

@@ -3905,6 +3905,9 @@ async function waitForMailInstance(url, runtime, sleep) {
     for (;;) {
         try {
             const response = await fetchImpl(url);
+            // #760: an unread body left undici's parser paused when the socket
+            // ended, throwing an uncaught assertion in the host.
+            await response.body?.cancel();
             if (response.ok)
                 return;
         }
@@ -7035,6 +7038,9 @@ async function waitForInstance(url, runtime, sleep, label = 'platform:auth') {
             const response = await fetchImpl(url, {
                 signal: AbortSignal.timeout(runtime.readyRequestTimeoutMs ?? 10_000),
             });
+            // #760: an unread body left undici's parser paused when the socket
+            // ended, throwing an uncaught assertion in the host.
+            await response.body?.cancel();
             if (response.ok)
                 return;
         }

package/dist/plan/post-logout-uris.d.ts

@@ -16,7 +16,7 @@ export declare function zitadelAppPostLogoutAppliedScopeKey(appKey: string): str
 /**
  * The post-logout addresses company app `appKey` is created with and kept at.
  * Agora signs out locally and has no signed-out page, so it holds only its
- * root; every `@wtfalch/auth` app (cms, boule, the app, entries with
+ * root; every `@wtfalch/auth` app (cms, boule, kosmos, the app, entries with
  * `uses.auth`) holds both on each of its hosts.
  */
 export declare function companyAppPostLogoutUris(org: DeclaredOrg, appKey: string): string[];

package/dist/plan/post-logout-uris.js

@@ -1,6 +1,7 @@
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { appHostname, cmsStudioHostnameFor, entryHostnames } from './hostnames.js';
+import { kosmosHostnameFor } from './kosmos.js';
 import { workspaceAuthEntryOf, workspaceClientHosts } from './workspace-client.js';
 /** The page `@wtfalch/auth` apps land on after ZITADEL ends the session. */
 export const SIGNED_OUT_PATH = '/auth/signed-out';
@@ -27,7 +28,7 @@ export function zitadelAppPostLogoutAppliedScopeKey(appKey) {
 /**
  * The post-logout addresses company app `appKey` is created with and kept at.
  * Agora signs out locally and has no signed-out page, so it holds only its
- * root; every `@wtfalch/auth` app (cms, boule, the app, entries with
+ * root; every `@wtfalch/auth` app (cms, boule, kosmos, the app, entries with
  * `uses.auth`) holds both on each of its hosts.
  */
 export function companyAppPostLogoutUris(org, appKey) {
@@ -44,6 +45,8 @@ export function companyAppPostLogoutUris(org, appKey) {
         ? cmsStudioHostnameFor(org)
         : appKey === 'boule'
             ? bouleHostnameFor(org)
-            : appHostname(org);
+            : appKey === 'kosmos'
+                ? kosmosHostnameFor(org)
+                : appHostname(org);
     return postLogoutUrisFor(hosts ?? [hostname]);
 }