@wtfalch/foundry 0.12.0 → 0.14.0

package/dist/apply.d.ts

@@ -11,13 +11,6 @@ import type { AppliedState } from './state.js';
  * `@wtfalch/audit` records every plan and apply — who, when, the plan, the
  * result.
  */
-/** What {@link PlanApply.restore} put back: resource keys and env names, never a value. */
-export interface AdoptionRestored {
-    restored: string[];
-    envDeleted: string[];
-    /** Connector rows whose TUNNEL_TOKEN was left because it is not the one foundry wrote. */
-    tokenLeft?: string[];
-}
 export interface PlanApply {
     /** Reads live state from Zitadel, Coolify and Cloudflare and diffs it
      * against the declared org (#19 "Done when"). */
@@ -45,13 +38,4 @@ export interface PlanApply {
      * `destroy` only tears down what's left.
      */
     destroy(id: OrgId, confirmedOrgName: string): Promise<void>;
-    /**
-     * Puts an adopted app back as the snapshot recorded it (#311): the settings
-     * it had, its old env values, and none of the env names foundry added. Marks
-     * each adoption `restored`. Refused unless `confirmedOrgName` matches the
-     * org's `displayName`, once the snapshot is `confirmed` (the first
-     * successful apply after the adopting one), and, before any write, when the
-     * snapshot's vault entry is missing.
-     */
-    restore(id: OrgId, confirmedOrgName: string): Promise<AdoptionRestored>;
 }

package/dist/index.d.ts

@@ -8,10 +8,9 @@ export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export type { Checkpoint, LastApplied, AppliedState } from './state.js';
 export type { PlanStep, UnmanagedItem, Plan } from './plan.js';
-export type { Adoption, AdoptionKind, AdoptionState, AdoptionStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore, } from './store.js';
-export type { AdoptionVault } from './plan/adoption-vault.js';
+export type { DeclaredOrgStore, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
 export type { PlanApply } from './apply.js';
-export { createPostgresAdoptionStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
+export { createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';

package/dist/index.js

@@ -2,7 +2,7 @@ export { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, appEntry, validateBuyerIdentity, vali
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
-export { createPostgresAdoptionStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
+export { createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';

package/dist/migrations/0032_drop_adoptions.sql

@@ -0,0 +1,16 @@
+-- @wtfalch/foundry: removes what 0031 added. Adoption is gone: every org is
+-- provisioned fresh (2026-10-02). 0031 shipped in 0.11.0 and 0.12.0, so it
+-- stays in place and this migration drops its table and column.
+--
+-- Drops `foundry_adoptions` (its rows only recorded snapshots for resources
+-- foundry took over in place) and `foundry_declared_orgs.hosting_adopt`.
+-- Nothing else reads either. An entry's own `adopt` key inside
+-- `hosting_entries` is jsonb that the code now ignores, so it needs no change.
+--
+-- Safe to run twice, and on a database that never ran 0031: every drop is
+-- `if exists`.
+
+drop table if exists foundry_adoptions;
+
+alter table foundry_declared_orgs
+  drop column if exists hosting_adopt;

package/dist/migrations/0033_declared_org_version.sql

@@ -0,0 +1,13 @@
+-- @wtfalch/foundry: a version counter on the declared org, for a
+-- compare-and-set write (#351). Mirrors `src/store/schema.ts`'s
+-- `declaredOrgs.version`.
+--
+-- Every write through the store bumps it by 1. `DeclaredOrgStore.update` with
+-- an expected version writes `where id = $1 and version = $2` in one
+-- statement, so a caller that read the org, planned, and writes back cannot
+-- overwrite an edit that landed in between. Existing rows start at 1.
+--
+-- Additive, and safe to run twice.
+
+alter table foundry_declared_orgs
+  add column if not exists version integer not null default 1;

package/dist/org.d.ts

@@ -208,15 +208,6 @@ export interface HostingConfig {
     issuerApps: IssuerApp[];
     /** One entry per app the org runs. */
     entries: HostingEntry[];
-    /** Live resources foundry takes over in place instead of creating. */
-    adopt?: {
-        /** The Coolify uuid of the org's live database, taken over as `<slug>-db`. */
-        database?: string;
-        /** The id of the org's live Cloudflare tunnel: its routes are merged, never overwritten (#312). Requires `tunnel`. */
-        tunnel?: string;
-        /** The Coolify uuid of the live `cloudflared` app that dials into `tunnel` (#312). Requires `tunnel`. */
-        connectorApp?: string;
-    };
 }
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
@@ -266,10 +257,6 @@ export interface HostingEntry {
      * this map.
      */
     env: Record<string, EnvValue>;
-    /** Takes over the live Coolify app with this uuid instead of creating one. */
-    adopt?: {
-        app: string;
-    };
     /** What the entry signs in through. Absent means it uses nothing. */
     uses?: HostingEntryUses;
 }
@@ -317,12 +304,6 @@ export declare const APP_ENV_SOURCES: ReadonlySet<AppEnvSource>;
  * - Every `entries[]` entry follows {@link validateHostingEntry}; keys are
  *   unique, and at most one entry has a `database`, because the one
  *   `<slug>_rt` runtime role cannot serve two apps.
- * - An adopted uuid (`entries[].adopt.app`, `adopt.database`) is non-empty
- *   and only lowercase letters and digits (it goes into a URL path), and no two
- *   entries adopt the same app. `adopt.database` needs an entry with `database`.
- * - `adopt.tunnel` is a Cloudflare tunnel id (a UUID), `adopt.connectorApp` a
- *   Coolify uuid that no entry or database adopts. `connectorApp` needs
- *   `tunnel`, and both need `hosting.tunnel` (#312).
  */
 export declare function validateHosting(hosting: HostingConfig, names?: {
     domain: string | null;
@@ -546,6 +527,12 @@ export interface AdoptedApp {
  */
 export interface DeclaredOrg {
     id: OrgId;
+    /**
+     * How many writes the store has made to this org, starting at 1 (#351).
+     * Set by the store on read; ignored on `create` and `update`. Pass it back
+     * as `update`'s `expectedVersion` to refuse a write over a newer edit.
+     */
+    version?: number;
     /**
      * Mutable at any time — except: once `mail.mode` is not `'off'`, the slug
      * is frozen. The level-1 mail address is built from it

package/dist/org.js

@@ -13,9 +13,6 @@ export const APP_ENV_SOURCES = new Set([
     'aiOrganisationId',
     'mailDomain',
 ]);
-const ADOPT_UUID = /^[a-z0-9]+$/;
-/** A Cloudflare tunnel id: a lowercase UUID with hyphens (#312). */
-const TUNNEL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const ISSUER_APP_KINDS = new Set(['web', 'native', 'api']);
 const HOSTING_BUILD_PACKS = new Set([
     'dockerfile',
@@ -34,12 +31,6 @@ const HOSTING_BUILD_PACKS = new Set([
  * - Every `entries[]` entry follows {@link validateHostingEntry}; keys are
  *   unique, and at most one entry has a `database`, because the one
  *   `<slug>_rt` runtime role cannot serve two apps.
- * - An adopted uuid (`entries[].adopt.app`, `adopt.database`) is non-empty
- *   and only lowercase letters and digits (it goes into a URL path), and no two
- *   entries adopt the same app. `adopt.database` needs an entry with `database`.
- * - `adopt.tunnel` is a Cloudflare tunnel id (a UUID), `adopt.connectorApp` a
- *   Coolify uuid that no entry or database adopts. `connectorApp` needs
- *   `tunnel`, and both need `hosting.tunnel` (#312).
  */
 export function validateHosting(hosting, names) {
     if (hosting.tunnel && !hosting.enabled) {
@@ -69,27 +60,7 @@ export function validateHosting(hosting, names) {
     if (hosting.enabled && !appEntry(hosting)) {
         return `hosting.enabled requires an entry keyed '${APP_ENTRY_KEY}'`;
     }
-    if (hosting.adopt?.database !== undefined && !hosting.adopt.database) {
-        return 'hosting.adopt.database needs a non-empty uuid';
-    }
-    if (hosting.adopt?.database && !ADOPT_UUID.test(hosting.adopt.database)) {
-        return 'hosting.adopt.database must be lowercase letters and digits only';
-    }
-    const { tunnel: adoptedTunnel, connectorApp } = hosting.adopt ?? {};
-    if (adoptedTunnel !== undefined && !TUNNEL_ID.test(adoptedTunnel)) {
-        return 'hosting.adopt.tunnel must be a Cloudflare tunnel id (a lowercase UUID with hyphens)';
-    }
-    if (connectorApp !== undefined && !ADOPT_UUID.test(connectorApp)) {
-        return 'hosting.adopt.connectorApp must be a non-empty uuid of lowercase letters and digits only';
-    }
-    if ((connectorApp === undefined) !== (adoptedTunnel === undefined)) {
-        return 'hosting.adopt.tunnel and hosting.adopt.connectorApp must be declared together';
-    }
-    if ((adoptedTunnel !== undefined || connectorApp !== undefined) && !hosting.tunnel) {
-        return 'hosting.adopt.tunnel and hosting.adopt.connectorApp require hosting.tunnel';
-    }
     const seenKeys = new Set();
-    const seenAdopted = new Set();
     for (const entry of hosting.entries) {
         if (seenKeys.has(entry.key)) {
             return `hosting.entries key '${entry.key}' is not unique`;
@@ -98,33 +69,10 @@ export function validateHosting(hosting, names) {
         const invalid = validateHostingEntry(entry, hosting.enabled);
         if (invalid)
             return invalid;
-        if (entry.adopt) {
-            if (!entry.adopt.app)
-                return `hosting entry '${entry.key}' adopt.app needs a non-empty uuid`;
-            if (!ADOPT_UUID.test(entry.adopt.app)) {
-                return `hosting entry '${entry.key}' adopt.app must be lowercase letters and digits only`;
-            }
-            if (seenAdopted.has(entry.adopt.app)) {
-                return `hosting entry '${entry.key}' adopts an app another entry already adopts`;
-            }
-            seenAdopted.add(entry.adopt.app);
-            if (entry.adopt.app === hosting.adopt?.database) {
-                return `hosting entry '${entry.key}' adopts the same uuid as hosting.adopt.database`;
-            }
-            if (entry.database && !hosting.adopt?.database) {
-                return `hosting entry '${entry.key}' adopts its app and sets database, so hosting.adopt.database must name the live database`;
-            }
-        }
         const invalidAuth = validateEntryAuth(entry, hosting, names?.domain);
         if (invalidAuth)
             return invalidAuth;
     }
-    if (hosting.adopt?.database && !hosting.entries.some((entry) => entry.database)) {
-        return 'hosting.adopt.database is set, so an entry must set database';
-    }
-    if (connectorApp && (seenAdopted.has(connectorApp) || connectorApp === hosting.adopt?.database)) {
-        return 'hosting.adopt.connectorApp is the uuid of an adopted app or database';
-    }
     const invalidNames = validateEntryHostnames(hosting, names);
     if (invalidNames)
         return invalidNames;

package/dist/plan/agora.d.ts

@@ -90,12 +90,74 @@ export declare function agoraHostMissing(host: AgoraHostValues): string[];
  * `AGORA_SUFFIX` reserves the collision).
  */
 export declare function agoraHostnameFor(org: DeclaredOrg): string;
+/** The port `calls/packages/service/Dockerfile` documents (`EXPOSE 8080`); `config.mjs`'s `PORT` has no default, so the executor pushes it. */
+export declare const CALLS_SERVICE_PORT = "8080";
+/**
+ * Recorded by the executor once the calls service app carries its fixed
+ * internal name (`callsServiceInternalName`). `desiredAgoraEnv` waits for it,
+ * so Agora is never given an address that does not resolve yet.
+ */
+export declare const CALLS_SERVICE_NAME_SCOPE_KEY = "coolify_calls_service_internal_name";
+/**
+ * The calls service app's fixed internal name: the executor gives the app
+ * this `custom_internal_name`, so Agora reaches it as
+ * `http://<name>:{@link CALLS_SERVICE_PORT}` inside Coolify's Docker network.
+ */
+export declare function callsServiceInternalName(org: DeclaredOrg): string;
+/** Whether the recorded marker says the calls service carries the name the org's current slug gives it. */
+export declare function callsServiceHasName(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
+/**
+ * Recorded once the calls service app carries the seven ZITADEL token env
+ * vars (`CALLS_ISSUER` ... `CALLS_INTROSPECTION_CLIENT_SECRET`,
+ * `calls/docs/member-auth.md`). Its value is {@link callsTokenEnvMarker}, so a
+ * changed issuer, audience or organisation plans the step again. The same
+ * marker-and-one-restart mechanism as {@link CALLS_SERVICE_NAME_SCOPE_KEY}.
+ */
+export declare const CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY = "coolify_calls_service_token_env";
+/**
+ * The introspection API app minted for the calls service (once), and the
+ * undelivered key recorded before its secret leaves the executor
+ * (`foundry/CLAUDE.md`, platform rule 1). No `:` in either, as that rule says.
+ */
+export declare const CALLS_INTROSPECTION_SCOPE_KEY = "zitadel_calls_introspection_app";
+export declare const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = "zitadel_calls_introspection_undelivered";
+/** What the plan hands the calls service step: the two host values the token env needs. */
+export interface CallsTokenHost {
+    issuer: string;
+    messagingProjectId: string;
+}
+/**
+ * The token env's inputs, or null while any is missing: the host's issuer and
+ * messaging project id (`AgoraHostValues`) and the org's recorded ZITADEL org
+ * id. Null means write none of the seven, never a partial set: the calls
+ * service refuses to boot on one.
+ */
+export declare function callsTokenHostFrom(host: AgoraHostValues): CallsTokenHost | null;
+/** The value {@link CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY} holds once the env is in place; null when it cannot be written yet. */
+export declare function callsTokenEnvMarker(host: CallsTokenHost | null, recorded: Readonly<Record<string, string>>): string | null;
+/**
+ * The calls service's introspection API app, in the messaging project. One per
+ * org: the project is shared by every org, so the name carries the slug (a DNS
+ * label, at most 63 characters) and only an exact match is ever deleted.
+ */
+export declare function callsIntrospectionAppName(org: DeclaredOrg): string;
+/**
+ * The block shown, and thrown, when the messaging project or the ZITADEL org
+ * differs from what the token env was written for: the recorded client
+ * belongs to the old project, and foundry does not replace or delete it. Null
+ * when nothing is recorded, or only the issuer differs (the client is kept).
+ */
+export declare function callsTokenEnvMovedMessage(org: DeclaredOrg, host: CallsTokenHost | null, recorded: Readonly<Record<string, string>>): string | null;
+/** True when there is nothing to write yet, or the recorded marker says it was written. */
+export declare function callsServiceHasTokenEnv(host: CallsTokenHost | null, recorded: Readonly<Record<string, string>>): boolean;
 /**
  * The env vars an org's Agora app should carry, and every input still
  * missing to build them. `AGORA_CONFIG` is present only when `missing` is
  * empty; callers that write must refuse on a non-empty `missing`.
  * `AGORA_MAIL_UPSTREAM` is present only when mail is on and the host supplies
- * an address.
+ * an address. `AGORA_CALLS_UPSTREAM` is per org, so it comes from `recorded`,
+ * not `host`: present only when calls are on and this org's calls service
+ * app carries its internal name ({@link callsServiceHasName}).
  */
 export declare function desiredAgoraEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, host: AgoraHostValues): {
     env: Record<string, string>;

package/dist/plan/agora.js

@@ -89,12 +89,97 @@ export function agoraHostMissing(host) {
 export function agoraHostnameFor(org) {
     return org.domain ? `agora.${org.domain}` : `${org.slug}-agora.oikos.host`;
 }
+/** The port `calls/packages/service/Dockerfile` documents (`EXPOSE 8080`); `config.mjs`'s `PORT` has no default, so the executor pushes it. */
+export const CALLS_SERVICE_PORT = '8080';
+/**
+ * Recorded by the executor once the calls service app carries its fixed
+ * internal name (`callsServiceInternalName`). `desiredAgoraEnv` waits for it,
+ * so Agora is never given an address that does not resolve yet.
+ */
+export const CALLS_SERVICE_NAME_SCOPE_KEY = 'coolify_calls_service_internal_name';
+/**
+ * The calls service app's fixed internal name: the executor gives the app
+ * this `custom_internal_name`, so Agora reaches it as
+ * `http://<name>:{@link CALLS_SERVICE_PORT}` inside Coolify's Docker network.
+ */
+export function callsServiceInternalName(org) {
+    return `${org.slug}-calls`;
+}
+/** Whether the recorded marker says the calls service carries the name the org's current slug gives it. */
+export function callsServiceHasName(org, recorded) {
+    return recorded[CALLS_SERVICE_NAME_SCOPE_KEY] === callsServiceInternalName(org);
+}
+/**
+ * Recorded once the calls service app carries the seven ZITADEL token env
+ * vars (`CALLS_ISSUER` ... `CALLS_INTROSPECTION_CLIENT_SECRET`,
+ * `calls/docs/member-auth.md`). Its value is {@link callsTokenEnvMarker}, so a
+ * changed issuer, audience or organisation plans the step again. The same
+ * marker-and-one-restart mechanism as {@link CALLS_SERVICE_NAME_SCOPE_KEY}.
+ */
+export const CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY = 'coolify_calls_service_token_env';
+/**
+ * The introspection API app minted for the calls service (once), and the
+ * undelivered key recorded before its secret leaves the executor
+ * (`foundry/CLAUDE.md`, platform rule 1). No `:` in either, as that rule says.
+ */
+export const CALLS_INTROSPECTION_SCOPE_KEY = 'zitadel_calls_introspection_app';
+export const CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY = 'zitadel_calls_introspection_undelivered';
+/**
+ * The token env's inputs, or null while any is missing: the host's issuer and
+ * messaging project id (`AgoraHostValues`) and the org's recorded ZITADEL org
+ * id. Null means write none of the seven, never a partial set: the calls
+ * service refuses to boot on one.
+ */
+export function callsTokenHostFrom(host) {
+    if (!host.issuer || !host.messagingProjectId)
+        return null;
+    return { issuer: host.issuer, messagingProjectId: host.messagingProjectId };
+}
+/** The value {@link CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY} holds once the env is in place; null when it cannot be written yet. */
+export function callsTokenEnvMarker(host, recorded) {
+    const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    if (!host || !zitadelOrgId)
+        return null;
+    return `${host.issuer} ${host.messagingProjectId} ${zitadelOrgId}`;
+}
+/**
+ * The calls service's introspection API app, in the messaging project. One per
+ * org: the project is shared by every org, so the name carries the slug (a DNS
+ * label, at most 63 characters) and only an exact match is ever deleted.
+ */
+export function callsIntrospectionAppName(org) {
+    return `calls-introspection-${org.slug}`;
+}
+/**
+ * The block shown, and thrown, when the messaging project or the ZITADEL org
+ * differs from what the token env was written for: the recorded client
+ * belongs to the old project, and foundry does not replace or delete it. Null
+ * when nothing is recorded, or only the issuer differs (the client is kept).
+ */
+export function callsTokenEnvMovedMessage(org, host, recorded) {
+    const wanted = callsTokenEnvMarker(host, recorded);
+    const written = recorded[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY];
+    if (!wanted || !written || !recorded[CALLS_INTROSPECTION_SCOPE_KEY])
+        return null;
+    const [, oldProject, oldOrg] = written.split(' ');
+    const [, newProject, newOrg] = wanted.split(' ');
+    if (oldProject === newProject && oldOrg === newOrg)
+        return null;
+    return `${org.slug}'s calls service is blocked, not changed: the messaging project or ZITADEL org differs from the one its token env was written for (project ${oldProject} -> ${newProject}, org ${oldOrg} -> ${newOrg}); retire the ZITADEL app ${callsIntrospectionAppName(org)} (${recorded[CALLS_INTROSPECTION_SCOPE_KEY]}) in the old project by hand, then remove the recorded keys ${CALLS_INTROSPECTION_SCOPE_KEY} and ${CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY}`;
+}
+/** True when there is nothing to write yet, or the recorded marker says it was written. */
+export function callsServiceHasTokenEnv(host, recorded) {
+    const marker = callsTokenEnvMarker(host, recorded);
+    return marker === null || recorded[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY] === marker;
+}
 /**
  * The env vars an org's Agora app should carry, and every input still
  * missing to build them. `AGORA_CONFIG` is present only when `missing` is
  * empty; callers that write must refuse on a non-empty `missing`.
  * `AGORA_MAIL_UPSTREAM` is present only when mail is on and the host supplies
- * an address.
+ * an address. `AGORA_CALLS_UPSTREAM` is per org, so it comes from `recorded`,
+ * not `host`: present only when calls are on and this org's calls service
+ * app carries its internal name ({@link callsServiceHasName}).
  */
 export function desiredAgoraEnv(org, recorded, host) {
     const env = { AGORA_CANONICAL_HOST: agoraHostnameFor(org) };
@@ -117,6 +202,8 @@ export function desiredAgoraEnv(org, recorded, host) {
             messagingProjectId: host.messagingProjectId,
             // Chat is not in v1: Agora hides all chat UI unless this is true.
             chat: { enabled: org.chat.enabled },
+            // Agora draws call buttons only when this is true.
+            calls: { enabled: org.calls.enabled },
         });
     }
     if (org.mail.mode !== 'off' && host.mailUpstream) {
@@ -127,6 +214,9 @@ export function desiredAgoraEnv(org, recorded, host) {
     if (host.filesUpstream) {
         env.AGORA_FILES_UPSTREAM = host.filesUpstream;
     }
+    if (org.calls.enabled && callsServiceHasName(org, recorded)) {
+        env.AGORA_CALLS_UPSTREAM = `http://${callsServiceInternalName(org)}:${CALLS_SERVICE_PORT}`;
+    }
     return { env, missing };
 }
 function stable(value) {

package/dist/plan/broker-entries.d.ts

@@ -20,7 +20,7 @@ export declare function brokerEntryAppliedScopeKey(entryKey: string): string;
 /** The foreign entries the last write found invalid, as a JSON array of names. */
 export declare function brokerEntryWarningsScopeKey(entryKey: string): string;
 /** What the app's env says about who signs in, as recorded so far. Missing values are left out. */
-export declare function entryAuthEnv(org: DeclaredOrg, entry: Pick<HostingEntry, 'key' | 'uses'>, recorded: Readonly<Record<string, string>>, issuer: string | null): Record<string, string>;
+export declare function entryAuthEnv(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>, issuer: string | null): Record<string, string>;
 /** The marker `pushAppEnv` records for an entry's sign-in env; the planner compares against it. */
 export declare function entryAuthEnvAppliedScopeKey(entryKey: string): string;
 /** What a broker entry must say, without its key. */
@@ -74,13 +74,9 @@ export declare class PlatformBrokerPort implements BrokerPort {
     });
     appId(): Promise<string>;
     listEnvs(): Promise<{
-        uuid?: string;
         key: string;
         value: string;
         is_preview: boolean;
-        is_buildtime?: boolean;
-        is_literal?: boolean;
-        is_multiline?: boolean;
     }[]>;
     setAuthApps(raw: string): Promise<void>;
     deploy(): Promise<void>;

package/dist/plan/cloudflared-connector.d.ts

@@ -29,20 +29,12 @@ export interface EnsureCloudflaredConnectorInput {
     tunnelId: string;
     /** Fixed name, found before created -- so a second apply reuses this app rather than making a second one. */
     appName: string;
-    /** Needed to find the app by name or create it; an `adopted` connector needs neither. */
-    projectUuid?: string;
-    environment?: {
+    projectUuid: string;
+    environment: {
         id: number;
         name: string;
         uuid: string;
     };
-    /**
-     * #312: `recordedConnectorAppId` is a live app foundry adopted. It is never
-     * looked up by name or created; one that cannot be found is an error.
-     */
-    adopted?: boolean;
-    /** #312: called with the token just before `TUNNEL_TOKEN` is rewritten, so a later restore knows foundry wrote it. */
-    beforeTokenWrite?: (token: string) => Promise<void>;
     /** Called only when the app must be created -- never on the found-by-name or found-by-id paths. */
     resolveServer: () => Promise<{
         uuid: string;

package/dist/plan/cloudflared-connector.js

@@ -54,15 +54,8 @@ export async function ensureCloudflaredConnector(input) {
         }
     }
     if (!appId) {
-        if (input.adopted) {
-            throw new Error(`cloudflared connector ${input.appName}: the adopted app was not found`);
-        }
-        const { projectUuid, environment } = input;
-        if (!projectUuid || !environment) {
-            throw new Error(`cloudflared connector ${input.appName}: no project to find or create it in`);
-        }
         const found = await coolify.findApplicationByName(input.appName, {
-            environmentIds: [environment.id],
+            environmentIds: [input.environment.id],
         });
         if (found) {
             const live = await liveStatus(found.uuid);
@@ -71,21 +64,21 @@ export async function ensureCloudflaredConnector(input) {
                 status = live.status;
             }
         }
-        if (!appId) {
-            const server = await input.resolveServer();
-            const created = await coolify.createDockerfileApplication({
-                project_uuid: projectUuid,
-                server_uuid: server.uuid,
-                environment_name: environment.name,
-                environment_uuid: environment.uuid,
-                dockerfile: cloudflaredDockerfile(),
-                name: input.appName,
-                description: 'cloudflared connector for a Cloudflare tunnel',
-                instant_deploy: false,
-            });
-            appId = created.uuid;
-            justCreated = true;
-        }
+    }
+    if (!appId) {
+        const server = await input.resolveServer();
+        const created = await coolify.createDockerfileApplication({
+            project_uuid: input.projectUuid,
+            server_uuid: server.uuid,
+            environment_name: input.environment.name,
+            environment_uuid: input.environment.uuid,
+            dockerfile: cloudflaredDockerfile(),
+            name: input.appName,
+            description: 'cloudflared connector for a Cloudflare tunnel',
+            instant_deploy: false,
+        });
+        appId = created.uuid;
+        justCreated = true;
     }
     if (appId !== input.recordedConnectorAppId)
         await input.recordAppId(appId);
@@ -93,7 +86,6 @@ export async function ensureCloudflaredConnector(input) {
     const tokenChanged = justCreated || (await tunnelTokenDiffers(coolify, appId, token));
     if (tokenChanged) {
         try {
-            await input.beforeTokenWrite?.(token);
             await coolify.bulkUpsertEnvs(appId, [{ key: 'TUNNEL_TOKEN', value: token, literal: true }]);
         }
         catch {

package/dist/plan/diff.d.ts

@@ -1,6 +1,5 @@
 import type { DeclaredOrg, OrgId } from '../org.js';
 import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.js';
-import type { Adoption } from '../store.js';
 import { type AgoraHostReading } from './agora.js';
 import type { LiveResource } from './live.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
@@ -35,17 +34,6 @@ export interface PlannedStep {
 export interface PlanOrgOptions {
     /** #267: the executor was built with a `loginHostBindings` port. */
     loginHostBindings?: boolean;
-    /**
-     * #311: the host wired an `AdoptionVault` and an `AdoptionStore`, and the
-     * rows it holds. An adopting org plans a `coolify:adopt` step for each
-     * resource with no active snapshot (`isActiveSnapshot`), or, with nothing
-     * wired, reports adoption blocked and plans neither it nor the resource's
-     * own step.
-     */
-    adoption?: {
-        wired: boolean;
-        adopted: readonly Adoption[];
-    };
     /** F5: the executor was built with a `broker` port. */
     broker?: boolean;
 }