@wtfalch/foundry 0.78.1 → 0.79.0

package/dist/plan/files-apps-minter.d.ts

@@ -0,0 +1,131 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { OrgPlatformReadiness } from './platform-org.js';
+/**
+ * Files for Boule's own apps (a Worker app's `files` module). Boule's apps are not hosting entries, so foundry
+ * cannot mint their keys the way it does an entry's (`entry-files-key.ts`). Instead the company's Boule gets one
+ * key that may mint and revoke keys below itself and make collections: `files:apps-minter`, keyed by the org id,
+ * planned while `org.boule.apps` is on.
+ *
+ * Why not below the org's own key, like Boule's read key (`files-boule-key.ts`): files never lets a key minted
+ * below another hold `credentials:create` (`manage-keys.ts`, NEVER_DELEGATED), so a minter has to come from
+ * the operator route, `issueOrganisationKey`, with the files organisation's recorded owner as issuer, as the
+ * org's own key does. It holds only {@link FILES_APPS_MINTER_PERMISSIONS}: what an app's key may hold, plus
+ * minting, revoking and making collections. Every key Boule mints with it is below it, so revoking it stops
+ * them all.
+ *
+ * Order (rule 1): mint; record the id as `files_apps_minter_undelivered` and persist; hold the key at
+ * `files:apps-minter:<orgId>` (3 tries); record the id as `files_apps_minter` (the held guard) and its expiry,
+ * persist; write `FILES_APPS_URL`, `FILES_APPS_ORGANISATION_ID`, `FILES_APPS_KEY_ID`, `FILES_APPS_KEY_EXPIRES` and
+ * `FILES_APPS_KEY` to
+ * Boule's env and restart Boule; only then clear the marker and record `files_apps_minter_applied`.
+ *
+ * Renewal (under 30 days left) mints a new minter and does **not** revoke the old one: revoking it would revoke
+ * every app key below it at once. The old one is listed in `files_apps_minter_previous` and expires by itself;
+ * Boule sees the new `FILES_APPS_KEY_ID` and mints each app's key again below the new minter before then.
+ *
+ * Apps off plans the retire form (`destroys: true`): revoke every minter (so every app key with it), take the
+ * names out of Boule's env, restart Boule, clear the records. The held value stays (no delete); it is never read
+ * without a guard. The key reaches the held keys and Boule's env and nothing else.
+ */
+/** What Boule's minter holds: an app key's permissions, and minting, revoking and making collections. */
+export declare const FILES_APPS_MINTER_PERMISSIONS: readonly ["credentials:create", "credentials:revoke", "files.collections:create", "files.collections:read", "files.files:read", "files.files:download", "files.files:upload", "files.files:replace", "files.files:delete"];
+export declare const FILES_APPS_MINTER_SCOPE_KEY = "files_apps_minter";
+export declare const FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY = "files_apps_minter_undelivered";
+export declare const FILES_APPS_MINTER_EXPIRES_SCOPE_KEY = "files_apps_minter_expires";
+export declare const FILES_APPS_MINTER_APPLIED_SCOPE_KEY = "files_apps_minter_applied";
+/** Minters a renewal replaced, as a JSON array; never revoked by a renewal, only by the retire form. */
+export declare const FILES_APPS_MINTER_PREVIOUS_SCOPE_KEY = "files_apps_minter_previous";
+/** Boule's env names. */
+export declare const FILES_APPS_ENV: {
+    readonly url: "FILES_APPS_URL";
+    readonly organisationId: "FILES_APPS_ORGANISATION_ID";
+    readonly keyId: "FILES_APPS_KEY_ID";
+    /** When the minter expires: a key below it cannot outlive it, so Boule mints below it for at most that long. */
+    readonly keyExpires: "FILES_APPS_KEY_EXPIRES";
+    readonly key: "FILES_APPS_KEY";
+};
+export declare const filesAppsMinterRef: (orgId: string) => string;
+export declare const filesAppsMinterName: (org: Pick<DeclaredOrg, "slug">) => string;
+export interface FilesAppsMinterWant {
+    url: string;
+    organisationId: string;
+}
+export interface FilesAppsMinterStep extends FilesAppsMinterWant {
+    mode: 'mint' | 'renew' | 'deliver';
+    name: string;
+    expiresDays: number;
+    permissions: string[];
+}
+type Blocked = Array<{
+    description: string;
+    key: string;
+}>;
+/**
+ * Boule's apps minter step, or nothing. Blocked, not planned (rule 2), while the held keys cannot hold the key,
+ * files' address or the files organisation's owner is not recorded, Boule is not recorded or planned, or after a
+ * mint whose key was never held.
+ */
+export declare function planFilesAppsMinter(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], readiness: OrgPlatformReadiness, now: number): {
+    steps: DraftStep[];
+    blocked: Blocked;
+};
+/** Every call is cut off after this long. */
+export declare const FILES_APPS_MINTER_TIMEOUT_MS = 30000;
+export declare const FILES_APPS_MINTER_HOLD_ATTEMPTS = 3;
+export interface FilesAppsMinterDeps {
+    files: {
+        issueOrganisationKey(organisationId: string, input: {
+            name: string;
+            kind: 'api_key' | 'agent' | 'service';
+            issuer: string;
+            permissions: string[];
+            expiresDays: number;
+        }): Promise<{
+            id: string;
+            secret: string;
+            expiresAt: string;
+        }>;
+        revokeOrganisationKey(organisationId: string, keyId: string): Promise<unknown>;
+    };
+    heldKeys: {
+        resolve(ref: string): Promise<string | null | undefined>;
+        put(ref: string, value: string): Promise<void>;
+    };
+    coolify: {
+        bulkUpsertEnvs(appId: string, envs: Array<{
+            key: string;
+            value: string;
+            literal?: boolean;
+        }>): Promise<unknown>;
+        listEnvs(appId: string): Promise<Array<{
+            uuid?: string;
+            key: string;
+            value: string;
+            is_preview: boolean;
+        }>>;
+        deleteEnv(appId: string, envUuid: string): Promise<unknown>;
+        restart(appId: string): Promise<unknown>;
+    };
+    org: {
+        id: string;
+        slug: string;
+    };
+    bouleAppId: string | undefined;
+    recorded: () => Readonly<Record<string, string>>;
+    record: (key: string, value: string) => void;
+    forget: (key: string) => void;
+    persist: () => Promise<void>;
+    /** Registers a value for redaction before anything else can see it. */
+    secret: (value: string) => void;
+    timeoutMs?: number;
+}
+/** Mints (or reuses the held) minter and writes it to Boule's env. Errors name the key id and the ref, never the key. */
+export declare function ensureFilesAppsMinter(deps: FilesAppsMinterDeps, step: FilesAppsMinterStep): Promise<void>;
+/**
+ * Apps are off: revokes every minter (held, minted and never held, and those renewals kept), which revokes every
+ * app key below them, takes the names out of Boule's env, restarts Boule and clears the records. A key files no
+ * longer knows counts as revoked.
+ */
+export declare function retireFilesAppsMinter(deps: FilesAppsMinterDeps): Promise<void>;
+export {};

package/dist/plan/files-apps-minter.js

@@ -0,0 +1,336 @@
+import { FILES_ENTRY_PERMISSIONS } from '../entry-rules.js';
+import { appsOn } from '../org.js';
+import { FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, parseIdList, } from './entry-files-key.js';
+/**
+ * Files for Boule's own apps (a Worker app's `files` module). Boule's apps are not hosting entries, so foundry
+ * cannot mint their keys the way it does an entry's (`entry-files-key.ts`). Instead the company's Boule gets one
+ * key that may mint and revoke keys below itself and make collections: `files:apps-minter`, keyed by the org id,
+ * planned while `org.boule.apps` is on.
+ *
+ * Why not below the org's own key, like Boule's read key (`files-boule-key.ts`): files never lets a key minted
+ * below another hold `credentials:create` (`manage-keys.ts`, NEVER_DELEGATED), so a minter has to come from
+ * the operator route, `issueOrganisationKey`, with the files organisation's recorded owner as issuer, as the
+ * org's own key does. It holds only {@link FILES_APPS_MINTER_PERMISSIONS}: what an app's key may hold, plus
+ * minting, revoking and making collections. Every key Boule mints with it is below it, so revoking it stops
+ * them all.
+ *
+ * Order (rule 1): mint; record the id as `files_apps_minter_undelivered` and persist; hold the key at
+ * `files:apps-minter:<orgId>` (3 tries); record the id as `files_apps_minter` (the held guard) and its expiry,
+ * persist; write `FILES_APPS_URL`, `FILES_APPS_ORGANISATION_ID`, `FILES_APPS_KEY_ID`, `FILES_APPS_KEY_EXPIRES` and
+ * `FILES_APPS_KEY` to
+ * Boule's env and restart Boule; only then clear the marker and record `files_apps_minter_applied`.
+ *
+ * Renewal (under 30 days left) mints a new minter and does **not** revoke the old one: revoking it would revoke
+ * every app key below it at once. The old one is listed in `files_apps_minter_previous` and expires by itself;
+ * Boule sees the new `FILES_APPS_KEY_ID` and mints each app's key again below the new minter before then.
+ *
+ * Apps off plans the retire form (`destroys: true`): revoke every minter (so every app key with it), take the
+ * names out of Boule's env, restart Boule, clear the records. The held value stays (no delete); it is never read
+ * without a guard. The key reaches the held keys and Boule's env and nothing else.
+ */
+/** What Boule's minter holds: an app key's permissions, and minting, revoking and making collections. */
+export const FILES_APPS_MINTER_PERMISSIONS = [
+    'credentials:create',
+    'credentials:revoke',
+    'files.collections:create',
+    ...FILES_ENTRY_PERMISSIONS,
+];
+export const FILES_APPS_MINTER_SCOPE_KEY = 'files_apps_minter';
+export const FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY = 'files_apps_minter_undelivered';
+export const FILES_APPS_MINTER_EXPIRES_SCOPE_KEY = 'files_apps_minter_expires';
+export const FILES_APPS_MINTER_APPLIED_SCOPE_KEY = 'files_apps_minter_applied';
+/** Minters a renewal replaced, as a JSON array; never revoked by a renewal, only by the retire form. */
+export const FILES_APPS_MINTER_PREVIOUS_SCOPE_KEY = 'files_apps_minter_previous';
+/** Boule's env names. */
+export const FILES_APPS_ENV = {
+    url: 'FILES_APPS_URL',
+    organisationId: 'FILES_APPS_ORGANISATION_ID',
+    keyId: 'FILES_APPS_KEY_ID',
+    /** When the minter expires: a key below it cannot outlive it, so Boule mints below it for at most that long. */
+    keyExpires: 'FILES_APPS_KEY_EXPIRES',
+    key: 'FILES_APPS_KEY',
+};
+export const filesAppsMinterRef = (orgId) => `files:apps-minter:${orgId}`;
+export const filesAppsMinterName = (org) => `${org.slug}-boule-apps-files`;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Boule's apps minter step, or nothing. Blocked, not planned (rule 2), while the held keys cannot hold the key,
+ * files' address or the files organisation's owner is not recorded, Boule is not recorded or planned, or after a
+ * mint whose key was never held.
+ */
+export function planFilesAppsMinter(org, recordedIds, plannedSteps, readiness, now) {
+    const steps = [];
+    const blocked = [];
+    const key = `files:apps-minter:${org.id}`;
+    const at = `${org.slug}'s Boule apps files key`;
+    const block = (why) => blocked.push({ description: `${at} is blocked: ${why}`, key });
+    const guard = recordedIds[FILES_APPS_MINTER_SCOPE_KEY];
+    const undelivered = recordedIds[FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY];
+    const previous = parseIdList(recordedIds[FILES_APPS_MINTER_PREVIOUS_SCOPE_KEY]);
+    if (!appsOn(org)) {
+        if (readiness.filesReady && (guard || undelivered || previous.length > 0)) {
+            steps.push({
+                action: {
+                    system: 'files',
+                    kind: 'apps-minter',
+                    key: org.id,
+                    desired: { mode: 'retire' },
+                },
+                step: {
+                    description: `revoke Boule's apps files key for ${org.slug}, and with it every app's files key, take FILES_APPS_* out of Boule's env, restart Boule: apps are off`,
+                    destroys: true,
+                    migrates: false,
+                },
+            });
+        }
+        return { steps, blocked };
+    }
+    if (!readiness.filesReady)
+        return { steps, blocked };
+    if (undelivered && undelivered !== guard) {
+        block(`key ${undelivered} was minted but never held, and files shows a key once; revoke it in files and remove the recorded key ${FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY}`);
+        return { steps, blocked };
+    }
+    if (readiness.canHoldSecrets !== true) {
+        block("the host's held keys cannot hold the key");
+        return { steps, blocked };
+    }
+    if (!readiness.filesUrl) {
+        block("the platform has not recorded files' address yet");
+        return { steps, blocked };
+    }
+    if (!recordedIds[FILES_ORG_OWNER_SCOPE_KEY]) {
+        block('the files organisation has no recorded owner to mint the key for');
+        return { steps, blocked };
+    }
+    const boulePlanned = plannedSteps.some((p) => p.action.system === 'coolify' && p.action.kind === 'boule' && p.action.key === org.id);
+    if (!recordedIds[`coolify:boule:${org.id}`] && !boulePlanned) {
+        block("the company's Boule is not recorded yet");
+        return { steps, blocked };
+    }
+    const want = { url: readiness.filesUrl, organisationId: org.id };
+    let mode = null;
+    if (!guard)
+        mode = 'mint';
+    else if (!(Date.parse(recordedIds[FILES_APPS_MINTER_EXPIRES_SCOPE_KEY] ?? '') - now >=
+        FILES_KEY_RENEW_WINDOW_DAYS * DAY_MS))
+        mode = 'renew';
+    else if (undelivered === guard ||
+        recordedIds[FILES_APPS_MINTER_APPLIED_SCOPE_KEY] !== JSON.stringify(want))
+        mode = 'deliver';
+    if (!mode)
+        return { steps, blocked };
+    steps.push({
+        action: {
+            system: 'files',
+            kind: 'apps-minter',
+            key: org.id,
+            desired: {
+                mode,
+                name: filesAppsMinterName(org),
+                expiresDays: FILES_KEY_DAYS,
+                permissions: [...FILES_APPS_MINTER_PERMISSIONS],
+                ...want,
+            },
+        },
+        step: {
+            description: mode === 'deliver'
+                ? `write Boule's apps files key for ${org.slug} to Boule's env, restart Boule`
+                : `${mode === 'mint' ? 'mint' : 'renew'} Boule's apps files key for ${org.slug} (it mints each app's files key), hold it, write FILES_APPS_* to Boule's env, restart Boule`,
+            destroys: false,
+            migrates: false,
+        },
+    });
+    return { steps, blocked };
+}
+/** Every call is cut off after this long. */
+export const FILES_APPS_MINTER_TIMEOUT_MS = 30_000;
+export const FILES_APPS_MINTER_HOLD_ATTEMPTS = 3;
+async function timed(work, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            work(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const statusOf = (error) => {
+    const status = error?.status;
+    return typeof status === 'number' ? ` (${status})` : '';
+};
+const isNotFound = (error) => error?.status === 404;
+/** Mints (or reuses the held) minter and writes it to Boule's env. Errors name the key id and the ref, never the key. */
+export async function ensureFilesAppsMinter(deps, step) {
+    const ms = deps.timeoutMs ?? FILES_APPS_MINTER_TIMEOUT_MS;
+    const at = `files:apps-minter for ${deps.org.slug}`;
+    const ref = filesAppsMinterRef(deps.org.id);
+    if (!deps.bouleAppId)
+        throw new Error(`${at}: Boule is not recorded yet`);
+    const bouleAppId = deps.bouleAppId;
+    const recorded = deps.recorded();
+    const undelivered = recorded[FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY];
+    let guard = recorded[FILES_APPS_MINTER_SCOPE_KEY];
+    if (undelivered && undelivered !== guard) {
+        throw new Error(`${at}: key ${undelivered} was minted but never held, and files shows a key once; revoke it in files and remove the recorded key ${FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY}`);
+    }
+    let key = null;
+    if (guard && step.mode === 'renew') {
+        // The old minter is kept, not revoked: every app key below it would stop at once. It expires by itself.
+        const previous = parseIdList(recorded[FILES_APPS_MINTER_PREVIOUS_SCOPE_KEY]);
+        if (!previous.includes(guard))
+            previous.push(guard);
+        deps.record(FILES_APPS_MINTER_PREVIOUS_SCOPE_KEY, JSON.stringify(previous));
+        deps.forget(FILES_APPS_MINTER_SCOPE_KEY);
+        deps.forget(FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY);
+        await deps.persist();
+        guard = undefined;
+    }
+    else if (guard) {
+        try {
+            key = (await timed(() => deps.heldKeys.resolve(ref), ms)) || null;
+        }
+        catch {
+            throw new Error(`${at}: the held key ${ref} could not be read`);
+        }
+        if (key)
+            deps.secret(key);
+        else {
+            // The held value is gone: that minter is revoked (with its app keys) before a new one is minted.
+            try {
+                await timed(() => deps.files.revokeOrganisationKey(deps.org.id, guard), ms);
+            }
+            catch (error) {
+                if (!isNotFound(error)) {
+                    throw new Error(`${at}: the held key ${ref} is missing and key ${guard} could not be revoked before a new one is minted; the next apply tries again`);
+                }
+            }
+            deps.forget(FILES_APPS_MINTER_SCOPE_KEY);
+            deps.forget(FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY);
+            await deps.persist();
+            guard = undefined;
+        }
+    }
+    let keyId = guard;
+    if (!key) {
+        const issuer = recorded[FILES_ORG_OWNER_SCOPE_KEY];
+        if (!issuer)
+            throw new Error(`${at}: the files organisation has no recorded owner`);
+        let minted;
+        try {
+            minted = await timed(() => deps.files.issueOrganisationKey(deps.org.id, {
+                name: step.name,
+                kind: 'service',
+                issuer,
+                permissions: [...step.permissions],
+                expiresDays: step.expiresDays,
+            }), ms);
+        }
+        catch (error) {
+            throw new Error(`${at}: files refused or did not answer the key${statusOf(error)}`);
+        }
+        if (typeof minted?.secret === 'string' && minted.secret)
+            deps.secret(minted.secret);
+        if (typeof minted?.id !== 'string' || !minted.id) {
+            throw new Error(`${at}: files answered the key with no id`);
+        }
+        deps.record(FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY, minted.id);
+        await deps.persist();
+        if (typeof minted.secret !== 'string' || !minted.secret) {
+            throw new Error(`${at}: key ${minted.id} was minted but files returned no key, which it shows once; revoke it in files and remove the recorded key ${FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY}`);
+        }
+        let stored = false;
+        for (let attempt = 1; attempt <= FILES_APPS_MINTER_HOLD_ATTEMPTS && !stored; attempt++) {
+            try {
+                await timed(() => deps.heldKeys.put(ref, minted.secret), ms);
+                stored = true;
+            }
+            catch {
+                // Retried; the error is dropped in case it echoes the key.
+            }
+        }
+        if (!stored) {
+            throw new Error(`${at}: key ${minted.id} was minted but could not be held at ${ref} after ${FILES_APPS_MINTER_HOLD_ATTEMPTS} attempts; revoke it in files and remove the recorded key ${FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY}`);
+        }
+        deps.record(FILES_APPS_MINTER_SCOPE_KEY, minted.id);
+        deps.record(FILES_APPS_MINTER_EXPIRES_SCOPE_KEY, minted.expiresAt);
+        await deps.persist();
+        key = minted.secret;
+        keyId = minted.id;
+    }
+    try {
+        await timed(() => deps.coolify.bulkUpsertEnvs(bouleAppId, [
+            { key: FILES_APPS_ENV.url, value: step.url, literal: true },
+            { key: FILES_APPS_ENV.organisationId, value: step.organisationId, literal: true },
+            { key: FILES_APPS_ENV.keyId, value: keyId, literal: true },
+            {
+                key: FILES_APPS_ENV.keyExpires,
+                value: deps.recorded()[FILES_APPS_MINTER_EXPIRES_SCOPE_KEY] ?? '',
+                literal: true,
+            },
+            { key: FILES_APPS_ENV.key, value: key, literal: true },
+        ]), ms);
+        await timed(() => deps.coolify.restart(bouleAppId), ms);
+    }
+    catch {
+        // The error is dropped in case Coolify echoes the request body, which holds the key.
+        throw new Error(`${at}: the key is held at ${ref} but could not be written to Boule's env; the next apply writes it again`);
+    }
+    deps.forget(FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY);
+    deps.record(FILES_APPS_MINTER_APPLIED_SCOPE_KEY, JSON.stringify({ url: step.url, organisationId: step.organisationId }));
+}
+/**
+ * Apps are off: revokes every minter (held, minted and never held, and those renewals kept), which revokes every
+ * app key below them, takes the names out of Boule's env, restarts Boule and clears the records. A key files no
+ * longer knows counts as revoked.
+ */
+export async function retireFilesAppsMinter(deps) {
+    const ms = deps.timeoutMs ?? FILES_APPS_MINTER_TIMEOUT_MS;
+    const at = `files:apps-minter for ${deps.org.slug}`;
+    const recorded = deps.recorded();
+    const ids = [
+        ...new Set([
+            recorded[FILES_APPS_MINTER_SCOPE_KEY],
+            recorded[FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY],
+            ...parseIdList(recorded[FILES_APPS_MINTER_PREVIOUS_SCOPE_KEY]),
+        ].filter((id) => Boolean(id))),
+    ];
+    for (const id of ids) {
+        try {
+            await timed(() => deps.files.revokeOrganisationKey(deps.org.id, id), ms);
+        }
+        catch (error) {
+            if (!isNotFound(error)) {
+                throw new Error(`${at}: key ${id} could not be revoked; the next apply tries again`);
+            }
+        }
+    }
+    if (deps.bouleAppId) {
+        const appId = deps.bouleAppId;
+        const names = new Set(Object.values(FILES_APPS_ENV));
+        try {
+            const rows = await timed(() => deps.coolify.listEnvs(appId), ms);
+            const gone = rows.filter((e) => !e.is_preview && e.uuid && names.has(e.key));
+            for (const row of gone)
+                await timed(() => deps.coolify.deleteEnv(appId, row.uuid), ms);
+            if (gone.length > 0)
+                await timed(() => deps.coolify.restart(appId), ms);
+        }
+        catch {
+            throw new Error(`${at}: the key is revoked but could not be taken out of Boule's env; the next apply tries again`);
+        }
+    }
+    for (const name of [
+        FILES_APPS_MINTER_SCOPE_KEY,
+        FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY,
+        FILES_APPS_MINTER_EXPIRES_SCOPE_KEY,
+        FILES_APPS_MINTER_APPLIED_SCOPE_KEY,
+        FILES_APPS_MINTER_PREVIOUS_SCOPE_KEY,
+    ])
+        deps.forget(name);
+}

package/dist/plan/files-boule-key.js

@@ -1,4 +1,4 @@
-import { FILES_BOULE_KEY_SCOPE_KEY, FILES_BOULE_MINTER_SCOPE_KEY, FILES_BOULE_PREVIOUS_SCOPE_KEY, FILES_BOULE_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, entryCollectionNames, parseIdList, } from './entry-files-key.js';
+import { FILES_BOULE_KEY_SCOPE_KEY, FILES_BOULE_MINTER_SCOPE_KEY, FILES_BOULE_PREVIOUS_SCOPE_KEY, FILES_BOULE_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, entryCollectionNames, parseIdList, usesServerFiles, } from './entry-files-key.js';
 export { entryCollectionName, entryCollectionNames, entryFilesCollectionsScopeKey, FILES_BOULE_KEY_SCOPE_KEY, FILES_BOULE_MINTER_SCOPE_KEY, FILES_BOULE_PREVIOUS_SCOPE_KEY, FILES_BOULE_UNDELIVERED_SCOPE_KEY, knownCollectionNames, } from './entry-files-key.js';
 /**
  * foundry#1121: Boule's files key, and each app's collections named apart.
@@ -81,7 +81,7 @@ export function planFilesBouleKey(org, recordedIds, plannedSteps, readiness, now
             key: `${key}:unrevoked:${id}`,
         });
     }
-    const entries = org.hosting.enabled ? org.hosting.entries.filter((e) => e.uses?.files) : [];
+    const entries = org.hosting.enabled ? org.hosting.entries.filter(usesServerFiles) : [];
     const undelivered = recordedIds[FILES_BOULE_UNDELIVERED_SCOPE_KEY];
     const guard = recordedIds[FILES_BOULE_KEY_SCOPE_KEY];
     const previous = parseIdList(recordedIds[FILES_BOULE_PREVIOUS_SCOPE_KEY]);

package/dist/plan/files-space-alert.js

@@ -1,13 +1,13 @@
 import { createHash } from 'node:crypto';
 import { isLiveEntry } from '../org.js';
 import { withTimeout } from './call-timeout.js';
-import { entryCollectionNames } from './entry-files-key.js';
+import { entryCollectionNames, usesServerFiles } from './entry-files-key.js';
 const PREFIX = 'files_space_alert_';
 export const filesSpaceAlertScopeKey = (key) => `${PREFIX}${key}`;
 /** Addresses are resolved only during apply. Plans and recorded ids hold their hash. */
 export function filesSpaceAlertInput(org, entryKey, ids) {
     const entry = org.hosting.enabled
-        ? org.hosting.entries.find((e) => e.key === entryKey && isLiveEntry(e) && e.uses?.files)
+        ? org.hosting.entries.find((e) => e.key === entryKey && isLiveEntry(e) && usesServerFiles(e))
         : undefined;
     if (!entry?.uses?.files)
         return null;
@@ -25,7 +25,7 @@ export function planFilesSpaceAlerts(org, ids, ready, capable) {
     const steps = [];
     const blocked = [];
     const keys = new Set([
-        ...org.hosting.entries.filter((e) => isLiveEntry(e) && e.uses?.files).map((e) => e.key),
+        ...org.hosting.entries.filter((e) => isLiveEntry(e) && usesServerFiles(e)).map((e) => e.key),
         ...Object.keys(ids)
             .filter((key) => key.startsWith(PREFIX))
             .map((key) => key.slice(PREFIX.length)),

package/dist/plan/jobs-apps-key.d.ts

@@ -0,0 +1,29 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { JobsBouleKeyDeps } from './entry-jobs-boule-key-apply.js';
+import type { JobsSchedulerPort } from './executor.js';
+import type { OrgPlatformReadiness } from './platform-org.js';
+export declare const JOBS_APPS_PROJECT = "jobs_apps_project";
+export declare const JOBS_APPS_KEY = "jobs_apps_key";
+export declare const JOBS_APPS_UNDELIVERED = "jobs_apps_key_undelivered";
+export declare const JOBS_APPS_APPLIED = "jobs_apps_key_applied";
+export declare const JOBS_APPS_EXPIRES = "jobs_apps_key_expires";
+export declare const jobsAppsRef: (org: string) => string;
+export declare const jobsAppsProject: (org: string) => string;
+export declare function planJobsAppsKey(org: DeclaredOrg, ids: Readonly<Record<string, string>>, steps: readonly DraftStep[], ready: OrgPlatformReadiness, usable: boolean, capable: boolean, now: number): {
+    steps: DraftStep[];
+    blocked: {
+        key: string;
+        description: string;
+    }[];
+};
+type Deps = Omit<JobsBouleKeyDeps, 'entryKey' | 'project' | 'scheduler'> & {
+    scheduler: JobsSchedulerPort;
+};
+/** Every scheduler/held-key/Coolify call is bounded, and no provider error text can carry a secret out. */
+export declare function applyJobsAppsKey(deps: Deps, desired: {
+    mode: 'ensure' | 'retire';
+    url?: string;
+    expiresAt?: string;
+}): Promise<void>;
+export {};