@wtfalch/foundry 0.1.0 → 0.3.0

package/dist/migrate.d.ts

@@ -0,0 +1,38 @@
+/** This package's own migrations -- `../migrations` from `src/`, `./migrations` once built to `dist/` (`package.json`'s `build` script copies the `.sql` files there alongside `migrate.js`). */
+export declare const MIGRATIONS_DIR: string;
+/**
+ * The one capability `migrate` needs from a driver: run SQL text (one
+ * statement or several) and run a callback inside a transaction. Deliberately
+ * not a drizzle `PgDatabase` or a concrete driver type -- drizzle's own
+ * `.execute()` routes a multi-statement string through a single prepared
+ * query on PGlite, which rejects it, so a migration file's raw text has to
+ * reach the driver's own multi-statement path (`postgres`'s `.unsafe()`,
+ * PGlite's `.exec()`) instead. Same "narrow port, no concrete client type"
+ * shape `plan/executor.ts`'s `CoolifyPort` uses, for the same reason: a real
+ * driver satisfies this structurally, with a few lines of adapter at the
+ * call site (see `scripts/foundry-db-migrate.mjs` and `migrate.test.ts`).
+ */
+export interface MigrateSql {
+    /** Run SQL text and discard any result -- the tracking table's own DDL, and each migration file's contents. */
+    exec(text: string): Promise<void>;
+    /**
+     * Run one literal SELECT and return its rows. Only ever called here with
+     * fixed text this module builds itself (the tracking table's name, and a
+     * migration filename already checked against `/^\d{4}_.+\.sql$/`), so
+     * there is no external input to inject.
+     */
+    query<T = Record<string, unknown>>(text: string): Promise<T[]>;
+    /** Run `fn` inside one transaction, handing it a `MigrateSql` scoped to it; rolled back if `fn` throws. */
+    transaction<T>(fn: (tx: MigrateSql) => Promise<T>): Promise<T>;
+}
+export interface MigrationResult {
+    /** Names of the migration files applied this run, in filename order -- empty when the database was already current. */
+    applied: string[];
+}
+/**
+ * Applies every migration file in `dir` (default: this package's own
+ * `../migrations`) not yet recorded in `foundry_schema_migrations`, in
+ * filename order, one transaction per file. Safe to call repeatedly: a file
+ * already recorded is never re-read, let alone re-run.
+ */
+export declare function migrate(sql: MigrateSql, dir?: string): Promise<MigrationResult>;

package/dist/migrate.js

@@ -0,0 +1,47 @@
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// #R2 (map gap: foundry's own Postgres, two commands): a tracked, idempotent
+// migration runner. `./test/db.ts` and `./runner/test/db.ts` already read
+// and sort this same directory to build one concatenated blob for a fresh
+// PGlite -- fine for a test fixture that always starts empty, wrong for a
+// real host that must apply only what a `foundry_schema_migrations` table
+// does not yet list. `migrationFiles` below is that same discovery, reused
+// rather than re-implemented, kept per-file instead of concatenated.
+const here = dirname(fileURLToPath(import.meta.url));
+/** This package's own migrations -- `../migrations` from `src/`, `./migrations` once built to `dist/` (`package.json`'s `build` script copies the `.sql` files there alongside `migrate.js`). */
+export const MIGRATIONS_DIR = join(here, 'migrations');
+const TRACKING_TABLE = 'foundry_schema_migrations';
+function migrationFiles(dir) {
+    return readdirSync(dir)
+        .filter((f) => /^\d{4}_.+\.sql$/.test(f))
+        .sort()
+        .map((name) => ({ name, path: join(dir, name) }));
+}
+/**
+ * Applies every migration file in `dir` (default: this package's own
+ * `../migrations`) not yet recorded in `foundry_schema_migrations`, in
+ * filename order, one transaction per file. Safe to call repeatedly: a file
+ * already recorded is never re-read, let alone re-run.
+ */
+export async function migrate(sql, dir = MIGRATIONS_DIR) {
+    await sql.exec(`create table if not exists ${TRACKING_TABLE} (name text primary key, applied_at timestamptz not null default now())`);
+    const appliedRows = await sql.query(`select name from ${TRACKING_TABLE}`);
+    const applied = new Set(appliedRows.map((row) => row.name));
+    const pending = migrationFiles(dir).filter((file) => !applied.has(file.name));
+    const done = [];
+    for (const file of pending) {
+        const text = readFileSync(file.path, 'utf8');
+        await sql.transaction(async (tx) => {
+            await tx.exec(text);
+            // `file.name` is drawn from `migrationFiles`' own regex-filtered
+            // `readdirSync`, never from outside this module -- see `MigrateSql`'s
+            // doc comment. Quotes are still escaped, so an oddly-named future
+            // migration file cannot break the statement.
+            const escaped = file.name.replace(/'/g, "''");
+            await tx.exec(`insert into ${TRACKING_TABLE} (name) values ('${escaped}')`);
+        });
+        done.push(file.name);
+    }
+    return { applied: done };
+}

package/dist/migrations/0008_hosting.sql

@@ -0,0 +1,24 @@
+-- @wtfalch/foundry: an org's own hosted app, its database, its Cloudflare
+-- tunnel and its declared ZITADEL issuer apps (#71), declared alongside
+-- everything else in `foundry_declared_orgs` (#0001). Mirrors
+-- `src/store/schema.ts`'s `declaredOrgs` table additions.
+--
+-- HostingConfig (org.ts) is the same `usesDomain`-opts-into-`domain` shape as
+-- mail/chat/calls/issuer/site (#0001's `mail_uses_domain` etc, `0007_site.sql`'s
+-- `site_uses_domain`), plus its own on/off switch: hosting_enabled turns the
+-- org's own app on at all, hosting_database and hosting_tunnel each add a
+-- Postgres database and a Cloudflare tunnel beside it (both require
+-- hosting_enabled -- org.ts's `validateHosting`), and hosting_issuer_apps
+-- carries the org's declared ZITADEL OIDC applications (`IssuerApp[]`).
+--
+-- All four booleans default false and hosting_issuer_apps defaults to an
+-- empty array -- a brand new org has no hosted app, the same "full schema
+-- exists from day one" pattern #0001, #0005 and #0007 established: a new
+-- column with a decided default, never a reshape.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_enabled     boolean not null default false,
+  add column if not exists hosting_uses_domain boolean not null default false,
+  add column if not exists hosting_database    boolean not null default false,
+  add column if not exists hosting_tunnel      boolean not null default false,
+  add column if not exists hosting_issuer_apps jsonb   not null default '[]';

package/dist/migrations/0009_hosting_git_branch_build_pack.sql

@@ -0,0 +1,14 @@
+-- @wtfalch/foundry: the org's own hosted app's git branch and Coolify build
+-- pack (#71, hosting-wiring campaign), declarable on `HostingConfig` where
+-- `executor.ts`'s `coolifyApp` previously hardcoded `'main'`/`'nixpacks'`.
+-- Mirrors `src/store/schema.ts`'s `declaredOrgs` table additions.
+--
+-- Both default to the values `coolify:app` already provisioned with, so an
+-- org that never mentions them keeps getting exactly what shipped before
+-- this migration -- the same "full schema exists from day one, new column
+-- with a decided default" pattern `0008_hosting.sql` and its predecessors
+-- established.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_git_branch text not null default 'main',
+  add column if not exists hosting_build_pack text not null default 'nixpacks';

package/dist/migrations/0010_owner.sql

@@ -0,0 +1,13 @@
+-- @wtfalch/foundry: the org's owner, invited by ZITADEL email. Declared
+-- alongside everything else in `foundry_declared_orgs`. Mirrors
+-- `src/store/schema.ts`'s `declaredOrgs` table additions.
+--
+-- OwnerIdentity (org.ts) is flattened into three nullable columns the same
+-- way BuyerIdentity's own contact fields are (`0006_buyer_identity.sql`):
+-- present only when an operator has named an owner, reassembled as one
+-- object only once all three are non-null.
+
+alter table foundry_declared_orgs
+  add column if not exists owner_email        text,
+  add column if not exists owner_given_name   text,
+  add column if not exists owner_family_name  text;

package/dist/migrations/0011_test_org.sql

@@ -0,0 +1,12 @@
+-- @wtfalch/foundry: the test/real flag that gates whether an org can be
+-- destroyed. Declared alongside everything else in
+-- `foundry_declared_orgs`. Mirrors `src/store/schema.ts`'s `declaredOrgs`
+-- table additions.
+--
+-- `is_test` defaults false -- a brand new org is presumed real, matching
+-- every other "full schema exists from day one" column this table has added
+-- (#0001, #0005, #0007, #0008, #0010): a new column with a decided default,
+-- never a reshape.
+
+alter table foundry_declared_orgs
+  add column if not exists is_test boolean not null default false;

package/dist/migrations/0012_audit.sql

@@ -0,0 +1,21 @@
+-- @wtfalch/foundry: who planned, applied or destroyed which org, and how it
+-- went. Mirrors `src/store/schema.ts`'s `foundryAuditEvents`.
+--
+-- Decided on #85: before any archon exists, the foundry CLI records here. An
+-- attached archon reads this table later. Rows are only ever inserted.
+-- `org_id` has no foreign key, so a destroyed org's trail survives it.
+
+create table if not exists foundry_audit_events (
+  id bigserial primary key,
+  at timestamptz not null,
+  kind text not null check (kind in ('plan', 'apply', 'destroy')),
+  actor_id text not null,
+  actor_display text not null,
+  org_id text not null,
+  outcome text check (outcome in ('applied', 'refused', 'failed', 'destroyed')),
+  reason text,
+  plan jsonb
+);
+
+create index if not exists foundry_audit_events_org_at
+  on foundry_audit_events (org_id, at);

package/dist/migrations/0013_access_emails.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: emails Cloudflare Access lets through to the org's app
+-- (#84). Mirrors `src/store/schema.ts`'s `hostingAccessEmails`. An empty list
+-- means no Access gate, so every existing org keeps its current behaviour.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_access_emails jsonb not null default '[]'::jsonb;

package/dist/org.d.ts

@@ -89,6 +89,100 @@ export interface SiteConfig {
     enabled: boolean;
     usesDomain: boolean;
 }
+/**
+ * A ZITADEL OIDC application kind foundry can provision inside an org's
+ * issuer project (#71): `web` (a browser-based confidential/PKCE client),
+ * `native` (a public native-app client) or `api` (an API resource with no
+ * login flow of its own).
+ */
+export type IssuerAppKind = 'web' | 'native' | 'api';
+/**
+ * One ZITADEL OIDC application the org declares (#71), keyed within
+ * `HostingConfig.issuerApps` by its own `name` -- `validateHosting` below
+ * requires every name non-empty and unique in that list. `kind` decides the
+ * ZITADEL `appType` the planner provisions it as (`plan/diff.ts`'s
+ * `planIssuerApps`); changing `kind` for an app that already exists live is
+ * a destructive step there, since ZITADEL has no in-place app-type change.
+ */
+export interface IssuerApp {
+    name: string;
+    kind: IssuerAppKind;
+}
+/**
+ * The Coolify build strategy for the org's own hosted app -- the same union
+ * `@wtfalch/providers`' `CoolifyClient.createGithubAppApplication` accepts as
+ * `build_pack`, reused here rather than redeclared so a value this package
+ * validates is always one Coolify itself accepts.
+ */
+export type HostingBuildPack = 'dockerfile' | 'nixpacks' | 'static' | 'dockercompose';
+/**
+ * The org's own hosted app and what runs beside it (#71, part of #14's
+ * adopted/standard/bespoke map) -- distinct from the cms site (`SiteConfig`
+ * above), which is `@wtfalch/cms` content, not the org's own application
+ * code. `usesDomain` follows the same opt-in-per-service rule as mail, chat,
+ * calls, the issuer and the site (#7 amendment 1): setting `DeclaredOrg.domain`
+ * alone never moves the app onto it or starts managing its Cloudflare zone.
+ *
+ * `database` and `tunnel` are each meaningless without the app itself
+ * running, so `validateHosting` below requires `enabled` before either can
+ * be true.
+ *
+ * `gitBranch` and `buildPack` were fixed values `executor.ts` hardcoded
+ * (`'main'`/`'nixpacks'`) until this campaign's hosting-wiring work made them
+ * declarable; those two strings are their defaults now, kept here so an org
+ * that never mentions them still gets exactly what shipped before.
+ */
+export interface HostingConfig {
+    /** The org's own app runs on Coolify. */
+    enabled: boolean;
+    /** Served on `DeclaredOrg.domain` (and its Cloudflare zone managed) instead of `<slug>.oikos.host` (`../slug.ts`). */
+    usesDomain: boolean;
+    /** A Postgres database beside the app. Requires `enabled`. */
+    database: boolean;
+    /** The app is reached through a Cloudflare tunnel. Requires `enabled`. */
+    tunnel: boolean;
+    /** The branch `coolify:app` builds and deploys from. Default: `'main'`. */
+    gitBranch: string;
+    /** The Coolify build strategy `coolify:app` provisions with. Default: `'nixpacks'`. */
+    buildPack: HostingBuildPack;
+    /** The org's declared ZITADEL OIDC applications (#71). */
+    issuerApps: IssuerApp[];
+    /**
+     * Emails Cloudflare Access lets through to the app's hostname (#84). Empty
+     * means no Access gate. Requires `enabled`.
+     */
+    accessEmails: string[];
+}
+/**
+ * `null` when `hosting` is valid; otherwise the reason it is not (#71), same
+ * shape as `validateBuyerIdentity` below.
+ *
+ * - `database` and `tunnel` each require `enabled` -- neither means anything
+ *   without the app itself running.
+ * - `gitBranch` is non-empty and `buildPack` is one of `HostingBuildPack`'s
+ *   four values.
+ * - Every `issuerApps[]` entry has a non-empty `name`, unique within the
+ *   list, and a `kind` that is one of `IssuerAppKind`'s three values.
+ */
+export declare function validateHosting(hosting: HostingConfig): string | null;
+/**
+ * `null` when `site` is valid; otherwise the reason it is not (#101).
+ *
+ * Decided 2026-09-25
+ * (https://github.com/wtfalch/cms/blob/main/.plans/2026-09-25-org-sites.md):
+ * a cms site is how an org puts content on its own domain, and an org
+ * either runs its own app on its domain (`hosting`) or we host its website
+ * and cms there (`site`), never both -- both would otherwise fight over the
+ * same hostname (https://github.com/wtfalch/foundry/issues/99).
+ *
+ * - `site.enabled` requires `domain` to be set -- a site with nowhere to
+ *   live is not a site.
+ * - `site.enabled` requires `site.usesDomain` -- unlike mail, chat, calls
+ *   and the issuer, the site has no meaning anywhere but the org's own
+ *   domain, so turning it on always means the domain opt-in too.
+ * - `site.enabled` and `hosting.enabled` cannot both be on.
+ */
+export declare function validateSite(org: DeclaredOrg): string | null;
 /**
  * Per-org SSO. Decided to exist in #14 ("Also in scope") and its resolved
  * research #3 ("per-org SSO code exists unused"); nothing about its
@@ -196,6 +290,29 @@ export interface BuyerIdentity {
  *   name before its other details are typed).
  */
 export declare function validateBuyerIdentity(buyer: BuyerIdentity): string | null;
+/**
+ * The org's owner: the one person a real org is created for, invited into
+ * its ZITADEL org by email so they can set their own first credential (a
+ * passkey) without a password ever passing through foundry. `null` until an
+ * operator names one -- an org can exist declared before its owner is known.
+ *
+ * `apply`'s `zitadel:owner` step (`plan/diff.ts`'s `planOwner`) calls
+ * `ZitadelClient.inviteOrgOwner(zitadelOrgId, owner)` once the org's ZITADEL
+ * org exists, then never touches this again -- a re-run is idempotent on the
+ * recorded invited user id, not on this declared value, so editing `owner`
+ * after the invite has gone out does not send a second one.
+ */
+export interface OwnerIdentity {
+    email: string;
+    givenName: string;
+    familyName: string;
+}
+/**
+ * `null` when `owner` is valid; otherwise the reason it is not, same shape as
+ * {@link validateBuyerIdentity} and `../slug.ts`'s `validateSlug`. `owner:
+ * null` (no owner named yet) is always valid.
+ */
+export declare function validateOwner(owner: OwnerIdentity | null): string | null;
 /**
  * The form an app foundry does not own takes. Decided in #7's `#15`
  * refinement comment:
@@ -255,6 +372,8 @@ export interface DeclaredOrg {
     issuer: IssuerConfig;
     /** `enabled: false` by default -- a brand new org has no cms site. */
     site: SiteConfig;
+    /** `enabled: false`, `issuerApps: []` by default -- a brand new org has no hosted app (#71). */
+    hosting: HostingConfig;
     sso: SsoConfig;
     guests: GuestsConfig;
     solo: SoloConfig;
@@ -273,4 +392,15 @@ export interface DeclaredOrg {
     bespokeAppRepo: string | null;
     /** `null` when the org has none. */
     adoptedApp: AdoptedApp | null;
+    /** The org's owner, invited by ZITADEL email. `null` until an operator names one. See {@link OwnerIdentity}. */
+    owner: OwnerIdentity | null;
+    /**
+     * Marks this org as a test org rather than a real customer's. Purely
+     * declarative -- it changes nothing about what `apply` provisions -- but it
+     * is the one gate `FoundryPlanApply.destroy` checks: only a test org
+     * (`test: true`) can be destroyed, so deleting every resource foundry made
+     * for an org, then the org itself, can never reach a real customer's org by
+     * mistake.
+     */
+    test: boolean;
 }

package/dist/org.js

@@ -1,3 +1,86 @@
+const ISSUER_APP_KINDS = new Set(['web', 'native', 'api']);
+const HOSTING_BUILD_PACKS = new Set([
+    'dockerfile',
+    'nixpacks',
+    'static',
+    'dockercompose',
+]);
+/**
+ * `null` when `hosting` is valid; otherwise the reason it is not (#71), same
+ * shape as `validateBuyerIdentity` below.
+ *
+ * - `database` and `tunnel` each require `enabled` -- neither means anything
+ *   without the app itself running.
+ * - `gitBranch` is non-empty and `buildPack` is one of `HostingBuildPack`'s
+ *   four values.
+ * - Every `issuerApps[]` entry has a non-empty `name`, unique within the
+ *   list, and a `kind` that is one of `IssuerAppKind`'s three values.
+ */
+export function validateHosting(hosting) {
+    if (hosting.database && !hosting.enabled) {
+        return 'hosting.database requires hosting.enabled';
+    }
+    if (hosting.tunnel && !hosting.enabled) {
+        return 'hosting.tunnel requires hosting.enabled';
+    }
+    if (!hosting.gitBranch) {
+        return 'hosting.gitBranch must be non-empty';
+    }
+    if (!HOSTING_BUILD_PACKS.has(hosting.buildPack)) {
+        return `hosting.buildPack has an unknown value '${hosting.buildPack}'`;
+    }
+    if (hosting.accessEmails.length > 0 && !hosting.enabled) {
+        return 'hosting.accessEmails requires hosting.enabled';
+    }
+    for (const email of hosting.accessEmails) {
+        if (!/^[^@\s]+@[^@\s]+$/.test(email)) {
+            return `hosting.accessEmails has an invalid email '${email}'`;
+        }
+    }
+    const seenNames = new Set();
+    for (const app of hosting.issuerApps) {
+        if (!app.name) {
+            return 'every issuerApps entry needs a non-empty name';
+        }
+        if (seenNames.has(app.name)) {
+            return `issuerApps name '${app.name}' is not unique`;
+        }
+        seenNames.add(app.name);
+        if (!ISSUER_APP_KINDS.has(app.kind)) {
+            return `issuerApps '${app.name}' has an unknown kind '${app.kind}'`;
+        }
+    }
+    return null;
+}
+/**
+ * `null` when `site` is valid; otherwise the reason it is not (#101).
+ *
+ * Decided 2026-09-25
+ * (https://github.com/wtfalch/cms/blob/main/.plans/2026-09-25-org-sites.md):
+ * a cms site is how an org puts content on its own domain, and an org
+ * either runs its own app on its domain (`hosting`) or we host its website
+ * and cms there (`site`), never both -- both would otherwise fight over the
+ * same hostname (https://github.com/wtfalch/foundry/issues/99).
+ *
+ * - `site.enabled` requires `domain` to be set -- a site with nowhere to
+ *   live is not a site.
+ * - `site.enabled` requires `site.usesDomain` -- unlike mail, chat, calls
+ *   and the issuer, the site has no meaning anywhere but the org's own
+ *   domain, so turning it on always means the domain opt-in too.
+ * - `site.enabled` and `hosting.enabled` cannot both be on.
+ */
+export function validateSite(org) {
+    if (org.site.enabled && !org.domain) {
+        return 'site.enabled requires domain';
+    }
+    if (org.site.enabled && !org.site.usesDomain) {
+        return 'site.enabled requires site.usesDomain';
+    }
+    if (org.site.enabled && org.hosting.enabled) {
+        return 'site.enabled and hosting.enabled cannot both be on';
+    }
+    return null;
+}
 const ORG_NUMBER_PATTERN = /^\d{9}$/;
 /**
  * `null` when `buyer` is valid; otherwise the reason it is not, for a caller
@@ -27,3 +110,22 @@ export function validateBuyerIdentity(buyer) {
     }
     return null;
 }
+/** A deliberately loose email shape check -- foundry never sends mail itself, ZITADEL does; this only catches an obviously malformed address before it reaches the invite call. */
+const OWNER_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * `null` when `owner` is valid; otherwise the reason it is not, same shape as
+ * {@link validateBuyerIdentity} and `../slug.ts`'s `validateSlug`. `owner:
+ * null` (no owner named yet) is always valid.
+ */
+export function validateOwner(owner) {
+    if (owner === null)
+        return null;
+    if (!OWNER_EMAIL_PATTERN.test(owner.email)) {
+        return `owner email '${owner.email}' is not a valid email address`;
+    }
+    if (!owner.givenName.trim())
+        return 'owner.givenName must not be empty';
+    if (!owner.familyName.trim())
+        return 'owner.familyName must not be empty';
+    return null;
+}

package/dist/plan/diff.d.ts

@@ -41,12 +41,27 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * exist for every org — the issuer, mail, and chat (always provisioned at
  * level 1, per #7 "Chat", regardless of `usesDomain`). #27 adds two more,
  * in the same singleton shape: storage's spend limit on Files and AI's
- * budget. This task adds a sixth, in the same shape: the org's cms site
- * (`org.ts`'s `SiteConfig`). Everything else in `live` that none of these
- * six claim is unmanaged. The full field-by-field provisioning surface (SSO,
- * guests, calls, adopted/bespoke apps, the actual
+ * budget. T10 adds a sixth, in the same shape: the org's cms site
+ * (`org.ts`'s `SiteConfig`). #71 adds four more singleton resources, in the
+ * same shape — the org's own hosted app, its database, its Cloudflare
+ * tunnel and its Cloudflare zone (`org.ts`'s `HostingConfig`) — plus one
+ * list-shaped resource: `planIssuerApps` below emits one step per declared
+ * `hosting.issuerApps[]` entry rather than a single singleton, since an org
+ * can declare more than one ZITADEL app. #80 adds two more singletons,
+ * modeled on {@link planIssuer}: `planFilesOrganisation` and
+ * `planAiOrganisation`, each planned before its own system's limit step
+ * ({@link planStorage}, {@link planAiBudget}) so an org has somewhere for a
+ * limit to land, and AI use is switched on, before either limit is ever set.
+ * `planOwner` below adds one more singleton, in a different shape from the
+ * rest: the org's owner, invited by ZITADEL email, idempotent on the
+ * *recorded* resource id (`recordedIds`, sourced from
+ * `AppliedState.serviceIds`) rather than a live resource, since a human user
+ * is never something `live` can contain. Everything else in `live` that none
+ * of these twelve singletons and however many declared issuer apps claim is
+ * unmanaged. The full field-by-field provisioning surface (SSO, guests,
+ * calls, adopted/bespoke apps, the actual
  * Zitadel/Coolify/Cloudflare/Files/AI/cms shapes) is #20's "provision
  * Company Factory end to end", which wires real readers and executors
  * against this seam.
  */
-export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]): PlanDetail;
+export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>): PlanDetail;