@wtfalch/foundry 0.2.0 → 0.4.0

package/dist/plan/calls-matrix.js

@@ -0,0 +1,275 @@
+import { generateKeyPairSync, randomBytes } from 'node:crypto';
+/**
+ * The calls Matrix stack (#128, part 1 of 2 -- see that issue's "If this
+ * passes about 800 changed lines, split it" note): pure config generation
+ * for the dedicated Synapse and matrix-authentication-service (MAS)
+ * `executor.ts`'s `coolifyCalls` deploys per org, adapted from
+ * `wtfalch/app-template#344`'s `bootstrap/steps/calls-instance.ts`.
+ *
+ * TWO COOLIFY DATABASES, NOT ONE SHARED POSTGRES
+ * ------------------------------------------------
+ * PR 344 ran one bare `postgres` container and created Synapse's and MAS's
+ * databases on it with hand-rolled SQL over a direct connection -- workable
+ * for a CLI run with network access to the box, but this executor never
+ * connects to a database it creates (`executor.ts`'s `pushDatabaseUrl`/
+ * `ensureCmsRuntimeUrl` only ever read `internal_db_url` back through
+ * Coolify's own API). So this stack instead asks Coolify for two ordinary
+ * managed Postgres databases, `coolifyCalls`'s own `CoolifyPort.
+ * createPostgresDatabase` calls -- the same primitive `coolifyDatabase`/
+ * `ensureCmsDatabase` already use for the org's own app and its cms site.
+ * That also means neither app needs a postgres superuser password minted
+ * here: Coolify mints and owns each database's own credential.
+ *
+ * NOT CHAT'S STACK, BY CONSTRUCTION
+ * ----------------------------------
+ * PR 344's review settled that a call guest must never gain chat membership.
+ * This is not a gate bolted onto shared infrastructure -- there is no shared
+ * infrastructure: this stack is an entirely separate homeserver from
+ * `archon/bootstrap/steps/chat-instance.ts`'s own Synapse+MAS, with its own
+ * databases, its own `server_name` ({@link callsServerName}) and its own MAS
+ * client. A guest account minted here cannot join a chat room because it does
+ * not exist on chat's homeserver at all.
+ *
+ * NO PUBLIC HOSTNAME OF ITS OWN
+ * -------------------------------
+ * `@wtfalch/calls`' own `SYNAPSE_URL`/`MAS_URL` env vars
+ * (`calls/packages/service/src/config.mjs`) are plain internal addresses --
+ * the calls service is the only thing that ever talks to either, over
+ * Coolify's own Docker network, proxying the Matrix client-server API on a
+ * guest's behalf (`calls/packages/service/src/matrix-gateway.mjs`). Neither
+ * app needs a Cloudflare-routed hostname, unlike chat's own Synapse (real
+ * Matrix clients, real federation surface). That is also why this module
+ * mints no tunnel or DNS anything: the only public hostname this stack ever
+ * needs is the calls *service's* own, which foundry#145 (part 2 of #128)
+ * gives it -- `<slug>-calls.oikos.host` on the shared tunnel for a level-1
+ * org, `calls.<domain>` on its own per-org tunnel for an own-domain one
+ * (`executor.ts`'s `callsHostnameFor`).
+ */
+export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
+export const SYNAPSE_TAG = 'v1.161.0';
+export const MAS_IMAGE = 'ghcr.io/element-hq/matrix-authentication-service:1.24.0';
+/**
+ * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
+ * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and
+ * Synapse agree on, and the same value the calls service's own
+ * `MAS_HOMESERVER` (part 2) must carry. `<org.slug>` alone would collide with
+ * a real domain some org might later own; `.internal` never resolves and
+ * matches `@wtfalch/calls`' own bare-homeserver-domain regex
+ * (`^[A-Za-z0-9.:-]+$`).
+ */
+export function callsServerName(orgSlug) {
+    return `calls-${orgSlug}.internal`;
+}
+/**
+ * Coolify's own `internal_db_url` is `postgres://user:password@host[:port]/db`
+ * -- `URL` parses it exactly the way `executor.ts`'s `ensureCmsRuntimeUrl`
+ * already parses the same shape for the cms app's own database. Returns
+ * `null` on a malformed URL rather than throwing, the same defensive stance
+ * `ensureCmsRuntimeUrl` takes: Coolify's own superuser password is not
+ * something this package controls the alphabet of.
+ */
+export function parseCallsDbUrl(internalDbUrl) {
+    try {
+        const url = new URL(internalDbUrl);
+        const database = url.pathname.replace(/^\//, '');
+        if (!url.hostname || !url.username || !database)
+            return null;
+        return {
+            host: url.hostname,
+            port: url.port ? Number(url.port) : 5432,
+            user: decodeURIComponent(url.username),
+            password: decodeURIComponent(url.password),
+            database,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function mintCallsMatrixSecrets() {
+    const rsa = generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
+        publicKeyEncoding: { type: 'pkcs1', format: 'pem' },
+    });
+    const ec = generateKeyPairSync('ec', {
+        namedCurve: 'P-256',
+        privateKeyEncoding: { type: 'sec1', format: 'pem' },
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+    });
+    return {
+        masSynapseSharedSecret: randomBytes(32).toString('hex'),
+        masClientId: generateUlid(),
+        masClientSecret: randomBytes(24).toString('base64url'),
+        masEncryptionKey: randomBytes(32).toString('hex'),
+        masRsaKeyPem: rsa.privateKey,
+        masEcKeyPem: ec.privateKey,
+    };
+}
+/**
+ * A ULID-shaped (26-char Crockford base32) id -- MAS's `clients[].client_id`
+ * must be one (`docs/reference/configuration.md`). Not time-sortable (a
+ * static config value, not an event id), just shape-valid: 16 random bytes,
+ * Crockford-encoded. Identical to `chat-instance.ts`'s own helper of the same
+ * name -- restated, not imported, since neither `plan/` nor `archon`'s
+ * bootstrap tree exposes the other as a dependency.
+ */
+export function generateUlid(bytes = randomBytes(16)) {
+    const alphabet = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+    let bits = 0n;
+    for (const b of bytes)
+        bits = (bits << 8n) | BigInt(b);
+    let out = '';
+    for (let i = 0; i < 26; i++) {
+        const shift = BigInt(130 - (i + 1) * 5);
+        const idx = shift >= 0n ? Number((bits >> shift) & 0x1fn) : Number((bits << -shift) & 0x1fn);
+        out += alphabet[idx];
+    }
+    return out;
+}
+/**
+ * `homeserver.yaml` -- rate limits raised well past Synapse's defaults
+ * (`rc_*` below), matching `calls/proof/provider/scripts/guest-stack.mjs`'s
+ * own real-deployment values: every guest session this stack mints goes
+ * through MAS's admin API and Synapse's client API in a burst when a call
+ * starts, not at human typing speed.
+ */
+export function callsSynapseHomeserverYaml(input) {
+    const serverName = callsServerName(input.orgSlug);
+    const rateLimit = '{ per_second: 100, burst_count: 1000 }';
+    return [
+        '# Generated by @wtfalch/foundry (executor.ts, coolify:calls). Do not edit',
+        '# by hand; re-run apply instead -- it is idempotent and will not rotate',
+        '# secrets that already exist.',
+        '',
+        `server_name: "${serverName}"`,
+        'pid_file: /data/homeserver.pid',
+        'report_stats: false',
+        '',
+        'listeners:',
+        '  - port: 8008',
+        '    type: http',
+        '    tls: false',
+        '    bind_addresses: ["0.0.0.0"]',
+        '    x_forwarded: true',
+        '    resources:',
+        '      - names: [client]',
+        '        compress: false',
+        '',
+        'database:',
+        '  name: psycopg2',
+        '  args:',
+        `    user: ${input.db.user}`,
+        `    password: "${input.db.password}"`,
+        `    dbname: ${input.db.database}`,
+        `    host: ${input.db.host}`,
+        `    port: ${input.db.port}`,
+        '    cp_min: 5',
+        '    cp_max: 10',
+        '',
+        '# "Specifying an empty list ([]) here is the recommended way of disabling',
+        '# federation." (config_documentation.md, federation_domain_whitelist) --',
+        '# this homeserver never federates: it exists only to authenticate calls',
+        '# guests, never to talk to another Matrix server.',
+        'federation_domain_whitelist: []',
+        '',
+        'presence:',
+        '  enabled: false',
+        '',
+        'media_store_path: /data/media_store',
+        'signing_key_path: /data/signing.key',
+        '',
+        'matrix_authentication_service:',
+        '  enabled: true',
+        `  endpoint: "http://${input.masHost}:8080/"`,
+        `  secret: "${input.masSharedSecret}"`,
+        '',
+        `rc_message: ${rateLimit}`,
+        `rc_room_creation: ${rateLimit}`,
+        'rc_joins:',
+        `  local: ${rateLimit}`,
+        `  remote: ${rateLimit}`,
+        'rc_invites:',
+        `  per_room: ${rateLimit}`,
+        `  per_user: ${rateLimit}`,
+        `  per_issuer: ${rateLimit}`,
+        '',
+    ].join('\n');
+}
+/**
+ * `config.yaml` -- password login and registration off (the calls service is
+ * the only way in, minting a guest a personal session through the admin API,
+ * `calls/proof/provider/scripts/guest-stack.mjs`'s `provisioner`); the one
+ * registered client is the calls service itself, granted `admin_clients` so
+ * its `client_credentials` grant can carry `urn:mas:admin`.
+ */
+export function callsMasConfigYaml(input) {
+    const serverName = callsServerName(input.orgSlug);
+    const indentKey = (pem, spaces) => pem
+        .trimEnd()
+        .split('\n')
+        .map((line) => `${' '.repeat(spaces)}${line}`)
+        .join('\n');
+    return [
+        '# Generated by @wtfalch/foundry (executor.ts, coolify:calls). Do not edit by hand.',
+        '',
+        'http:',
+        '  listeners:',
+        '    - name: web',
+        '      resources:',
+        '        - name: discovery',
+        '        - name: human',
+        '        - name: oauth',
+        '        - name: compat',
+        '        - name: graphql',
+        '        - name: assets',
+        '        - name: adminapi',
+        '        - name: health',
+        '      binds:',
+        '        - address: "[::]:8080"',
+        '      proxy_protocol: false',
+        `  public_base: "http://${serverName}/"`,
+        '  trusted_proxies:',
+        '    - 0.0.0.0/0',
+        '',
+        'database:',
+        `  host: ${input.db.host}`,
+        `  port: ${input.db.port}`,
+        `  username: ${input.db.user}`,
+        `  password: "${input.db.password}"`,
+        `  database: ${input.db.database}`,
+        '  ssl_mode: disable',
+        '',
+        'matrix:',
+        '  kind: synapse',
+        `  homeserver: ${serverName}`,
+        `  endpoint: "http://${input.synapseHost}:8008"`,
+        `  secret: "${input.sharedSecret}"`,
+        '',
+        '# The calls service is the only way in.',
+        'passwords:',
+        '  enabled: false',
+        '',
+        'account:',
+        '  password_registration_enabled: false',
+        '',
+        'clients:',
+        `  - client_id: "${input.clientId}"`,
+        '    client_auth_method: client_secret_basic',
+        `    client_secret: "${input.clientSecret}"`,
+        '',
+        'policy:',
+        '  data:',
+        '    admin_clients:',
+        `      - "${input.clientId}"`,
+        '',
+        'secrets:',
+        `  encryption: ${input.encryptionKey}`,
+        '  keys:',
+        '    - key: |',
+        indentKey(input.rsaKeyPem, 8),
+        '    - key: |',
+        indentKey(input.ecKeyPem, 8),
+        '',
+    ].join('\n');
+}

package/dist/plan/diff.d.ts

@@ -56,10 +56,14 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * rest: the org's owner, invited by ZITADEL email, idempotent on the
  * *recorded* resource id (`recordedIds`, sourced from
  * `AppliedState.serviceIds`) rather than a live resource, since a human user
- * is never something `live` can contain. Everything else in `live` that none
- * of these twelve singletons and however many declared issuer apps claim is
- * unmanaged. The full field-by-field provisioning surface (SSO, guests,
- * calls, adopted/bespoke apps, the actual
+ * is never something `live` can contain. #128 adds one more singleton, off
+ * by default unlike chat's own: {@link planCalls}, the org's own calls
+ * Matrix stack (`org.ts`'s `CallsConfig.enabled`). #145 adds one more,
+ * planned right after it and gated on the same flag: {@link planCallsService},
+ * the calls service itself (`wtfalch/calls`'s `packages/service`). Everything
+ * else in `live` that none of these fifteen singletons and however many
+ * declared issuer apps claim is unmanaged. The full field-by-field provisioning surface (SSO,
+ * guests, calls on the org's own domain, adopted/bespoke apps, the actual
  * Zitadel/Coolify/Cloudflare/Files/AI/cms shapes) is #20's "provision
  * Company Factory end to end", which wires real readers and executors
  * against this seam.

package/dist/plan/diff.js

@@ -34,10 +34,14 @@ function resourceKey(system, kind, key) {
  * rest: the org's owner, invited by ZITADEL email, idempotent on the
  * *recorded* resource id (`recordedIds`, sourced from
  * `AppliedState.serviceIds`) rather than a live resource, since a human user
- * is never something `live` can contain. Everything else in `live` that none
- * of these twelve singletons and however many declared issuer apps claim is
- * unmanaged. The full field-by-field provisioning surface (SSO, guests,
- * calls, adopted/bespoke apps, the actual
+ * is never something `live` can contain. #128 adds one more singleton, off
+ * by default unlike chat's own: {@link planCalls}, the org's own calls
+ * Matrix stack (`org.ts`'s `CallsConfig.enabled`). #145 adds one more,
+ * planned right after it and gated on the same flag: {@link planCallsService},
+ * the calls service itself (`wtfalch/calls`'s `packages/service`). Everything
+ * else in `live` that none of these fifteen singletons and however many
+ * declared issuer apps claim is unmanaged. The full field-by-field provisioning surface (SSO,
+ * guests, calls on the org's own domain, adopted/bespoke apps, the actual
  * Zitadel/Coolify/Cloudflare/Files/AI/cms shapes) is #20's "provision
  * Company Factory end to end", which wires real readers and executors
  * against this seam.
@@ -58,6 +62,16 @@ export function computePlanDetail(org, live, recordedIds = {}) {
     const chat = planChat(org, byKey, claimed);
     if (chat)
         plannedSteps.push(chat);
+    const calls = planCalls(org, byKey, claimed);
+    if (calls)
+        plannedSteps.push(calls);
+    // Right after the Matrix stack (#145): its own executor
+    // (`executor.ts`'s `coolifyCallsService`) reads the Synapse/MAS addresses
+    // and MAS client credentials `coolifyCalls` just recorded, the same
+    // ordering `planOwner` relies on for `zitadel:issuer`.
+    const callsService = planCallsService(org, byKey, claimed);
+    if (callsService)
+        plannedSteps.push(callsService);
     const filesOrganisation = planFilesOrganisation(org, byKey, claimed);
     if (filesOrganisation)
         plannedSteps.push(filesOrganisation);
@@ -70,9 +84,27 @@ export function computePlanDetail(org, live, recordedIds = {}) {
     const aiBudget = planAiBudget(org, byKey, claimed);
     if (aiBudget)
         plannedSteps.push(aiBudget);
+    // Before `planSite`'s own step (#139): `cmsSite`'s executor reads this
+    // step's recorded client id, the same way `coolifyApp` runs after the
+    // hosted app's own `zitadel:app` steps.
+    const cmsClient = planCmsClient(org, byKey, claimed);
+    if (cmsClient)
+        plannedSteps.push(cmsClient);
     const site = planSite(org, byKey, claimed);
     if (site)
         plannedSteps.push(site);
+    // Every declared ZITADEL app, before the app cluster below (level-1
+    // app-env campaign, gap P2): `coolifyApp`'s own env push
+    // (`executor.ts`'s `pushAppEnv`) reads a web app's `clientId` to set
+    // `AUTH_CLIENT_ID`, which only exists once that app's own `zitadel:app`
+    // step has run -- `plan-apply.ts`'s `runSteps` executes `plannedSteps` in
+    // this array order, one at a time.
+    plannedSteps.push(...planIssuerApps(org, byKey, claimed));
+    // The Access gate before the database, app, tunnel and zone (#84): on a
+    // first apply the hostname is gated before anything answers on it.
+    const access = planAccess(org, recordedIds);
+    if (access)
+        plannedSteps.push(access);
     // Database before app (hosting-wiring campaign): `plan-apply.ts`'s
     // `runSteps` executes `plannedSteps` in this array order, and the app's own
     // step (`executor.ts`'s `coolifyApp`) pushes the database's connection
@@ -91,7 +123,12 @@ export function computePlanDetail(org, live, recordedIds = {}) {
     const zone = planZone(org, byKey, claimed);
     if (zone)
         plannedSteps.push(zone);
-    plannedSteps.push(...planIssuerApps(org, byKey, claimed));
+    // Right after the zone (#43): `cloudflareRateLimit` resolves the zone by
+    // apex domain, so the zone step above must already have run (or the zone
+    // must already exist live) by the time this one's action executes.
+    const rateLimit = planRateLimit(org, recordedIds);
+    if (rateLimit)
+        plannedSteps.push(rateLimit);
     // After the apps: the customers org is granted the project the first app
     // step creates.
     const customers = planCustomers(org, live, claimed, recordedIds);
@@ -318,6 +355,34 @@ function planChat(org, byKey, claimed) {
         },
     };
 }
+/**
+ * The org's own calls Matrix stack (#128) -- a dedicated Synapse and
+ * matrix-authentication-service, entirely separate from chat's
+ * (`plan/calls-matrix.ts`'s own top doc comment: a call guest must never gain
+ * chat membership). Unlike chat, off by default: `org.ts`'s
+ * `CallsConfig.enabled` doc comment. Same on/off, park-not-delete shape as
+ * {@link planApp}/{@link planDatabase}/{@link planTunnel} below
+ * (`planHostingToggle`, #7 corrections 1) -- turning it off parks Synapse and
+ * MAS, never either database (`executor.ts`'s `coolifyCalls`).
+ */
+function planCalls(org, byKey, claimed) {
+    return planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`);
+}
+/**
+ * The org's own calls service (#145, part 2 of #128) -- `wtfalch/calls`'s
+ * `packages/service`, deployed alongside the calls Matrix stack {@link planCalls}
+ * provisions and wired to it and to the shared LiveKit SFU (foundry#122/#127).
+ * Gated on the same `org.calls.enabled` flag as the Matrix stack, not a flag
+ * of its own: a calls service with no Matrix stack behind it has nothing to
+ * authenticate a guest against, and a Matrix stack alone answers no browser,
+ * so the two are declared as one on/off switch even though they are two
+ * planner steps. Same on/off, park-not-delete shape as {@link planCalls}
+ * (`planHostingToggle`, #7 corrections 1) -- turning it off parks the app,
+ * never its database (`executor.ts`'s `coolifyCallsService`).
+ */
+function planCallsService(org, byKey, claimed) {
+    return planHostingToggle('coolify', 'calls-service', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls service`, () => `park ${org.slug}'s calls service (stops serving; data is retained, not deleted -- #7 corrections 1)`);
+}
 /**
  * Deduped `ai.*` permissions offered to every organisation by default
  * (Decision, this campaign's report): the minimum set that lets an org
@@ -456,6 +521,46 @@ function planAiBudget(org, byKey, claimed) {
         },
     };
 }
+/**
+ * https://github.com/wtfalch/foundry/issues/139 (parent decision:
+ * https://github.com/wtfalch/foundry/issues/99): every site-enabled org gets
+ * one fixed ZITADEL web client named `cms`, so its studio
+ * (`@wtfalch/cms`'s `apps/host`) can sign anyone in -- automatically, with no
+ * new field on `DeclaredOrg`. Modeled on {@link planIssuerApps}'s single-app
+ * shape: provision when missing, recreate when the live `appType` differs,
+ * nothing otherwise. There is no park for this client either, for the same
+ * reason `planIssuerApps`'s own doc comment gives -- ZITADEL has no notion of
+ * a disabled-but-retained OIDC client.
+ */
+function planCmsClient(org, byKey, claimed) {
+    if (!org.site.enabled)
+        return null;
+    const key = resourceKey('zitadel', 'app', 'cms');
+    const live = byKey.get(key);
+    if (live)
+        claimed.add(key);
+    const desired = { appType: 'web' };
+    if (!live) {
+        return {
+            action: { system: 'zitadel', kind: 'app', key: 'cms', desired },
+            step: {
+                description: `provision the web ZITADEL app 'cms' for ${org.slug}'s cms studio sign-in`,
+                destroys: false,
+                migrates: false,
+            },
+        };
+    }
+    if (live.config.appType === 'web')
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'app', key: 'cms', desired },
+        step: {
+            description: `recreate ZITADEL app 'cms' for ${org.slug} as web (was ${String(live.config.appType)})`,
+            destroys: true,
+            migrates: false,
+        },
+    };
+}
 /**
  * The org's cms site (`org.ts`'s `SiteConfig`), a per-org singleton
  * resource modeled on {@link planMail}. Disabling a live site parks it,
@@ -562,9 +667,42 @@ function planHostingToggle(system, kind, desiredEnabled, org, byKey, claimed, de
  * The org's own app on Coolify (`org.ts`'s `HostingConfig.enabled`, #71), a
  * per-org singleton resource modeled on {@link planSite}: park, not delete,
  * on the way off (#7 corrections 1).
+ *
+ * #75: every app foundry deploys also carries a durable log directory (a
+ * persistent volume mounted at `/app/logs`, `LOG_DIR` in its env) so a
+ * database outage does not erase the only other copy of the evidence
+ * (`executor.ts`'s `ensureLogVolume`/`pushAppEnv`, lokessmie's own pilot at
+ * https://github.com/wtfalch/lokessmie/pull/521). `planHostingToggle` above
+ * only tracks on/off, so once it finds nothing to toggle -- app live and
+ * already enabled -- this planner adds one more check on top: a live app
+ * that predates this feature (`live.config.hasLogVolume === false`,
+ * `providers-readers.ts`'s `withLogVolumeConfig`) is planned for it, reusing
+ * the same `coolify:app`/`enabled: true` action `planHostingToggle`'s own
+ * provision step uses -- `executor.ts`'s `coolifyApp` already runs
+ * `ensureLogVolume` unconditionally on that action, whether it just created
+ * the app or found it already there, so no new step kind is needed. A
+ * missing `hasLogVolume` (rather than an explicit `false`) reads as
+ * compliant, the same convention `planHostingToggle` itself uses for a live
+ * resource's `enabled` field -- a live resource nothing has actually
+ * checked yet is assumed fine rather than replanned every time.
  */
 function planApp(org, byKey, claimed) {
-    return planHostingToggle('coolify', 'app', org.hosting.enabled, org, byKey, claimed, () => `provision ${org.slug}'s app`, () => `park ${org.slug}'s app (stops serving; app data is retained, not deleted -- #7 corrections 1)`);
+    const toggled = planHostingToggle('coolify', 'app', org.hosting.enabled, org, byKey, claimed, () => `provision ${org.slug}'s app`, () => `park ${org.slug}'s app (stops serving; app data is retained, not deleted -- #7 corrections 1)`);
+    if (toggled)
+        return toggled;
+    if (!org.hosting.enabled)
+        return null;
+    const live = byKey.get(resourceKey('coolify', 'app', org.id));
+    if (!live || live.config.hasLogVolume !== false)
+        return null;
+    return {
+        action: { system: 'coolify', kind: 'app', key: org.id, desired: { enabled: true } },
+        step: {
+            description: `add a durable log directory to ${org.slug}'s app (persistent volume at /app/logs + LOG_DIR) so a database outage does not erase the evidence (#75)`,
+            destroys: false,
+            migrates: false,
+        },
+    };
 }
 /**
  * A Postgres database beside the org's app (`org.ts`'s
@@ -579,10 +717,31 @@ function planDatabase(org, byKey, claimed) {
  * A Cloudflare tunnel reaching the org's app (`org.ts`'s
  * `HostingConfig.tunnel`, #71) -- `validateHosting` requires
  * `hosting.enabled` before this can be true. Same park-not-delete shape as
- * {@link planApp}.
+ * {@link planApp}, gated on the same `usesDomain`+`domain` pair
+ * {@link planZone} checks: a level-1 org (no own domain, served at
+ * `<slug>.oikos.host`) gets no per-org tunnel at all -- one shared tunnel
+ * with a wildcard `*.oikos.host` record serves every level-1 org instead
+ * (William, 2026-09-26, map gap N3). The gate folds into the `desired`
+ * flag rather than an early return, so an org that drops its domain while
+ * a per-org tunnel is still live gets that tunnel parked, not left
+ * unmanaged, through `planHostingToggle`'s own park path.
+ *
+ * https://github.com/wtfalch/foundry/issues/115: a site-enabled org always
+ * needs its tunnel too, routing both its public site and its cms studio
+ * (`executor.ts`'s `tunnelIngressHostnames`) -- there is no separate
+ * `site.tunnel` toggle to gate on the way `hosting.tunnel` does, since a site
+ * has no meaning without one.
+ *
+ * #145: an own-domain calls service (`org.ts`'s `CallsConfig.usesDomain`)
+ * needs a tunnel too, for the same reason a site does -- an org that wants
+ * `calls.<domain>` but declares no other own-domain feature must still get
+ * one provisioned, not silently have nowhere for that hostname to route.
  */
 function planTunnel(org, byKey, claimed) {
-    return planHostingToggle('cloudflare', 'tunnel', org.hosting.tunnel, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`);
+    const desired = (org.hosting.tunnel && org.hosting.usesDomain && Boolean(org.domain)) ||
+        (org.site.enabled && Boolean(org.domain)) ||
+        (org.calls.enabled && org.calls.usesDomain && Boolean(org.domain));
+    return planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`);
 }
 /**
  * The org's Cloudflare zone for its own domain (`org.ts`'s
@@ -593,9 +752,20 @@ function planTunnel(org, byKey, claimed) {
  * foundry should stop managing a domain the org may still own elsewhere, so
  * a live zone under a not-`usesDomain` org is left unmanaged rather than
  * claimed -- the same choice {@link planMail} makes for a `mode: 'off'` org.
+ *
+ * https://github.com/wtfalch/foundry/issues/115: a site-enabled org
+ * (`org.ts`'s `SiteConfig.enabled`) also needs a zone for its domain, even
+ * though it can never have `hosting` on at the same time (`validateSite`) --
+ * `org.site.enabled` already guarantees both `domain` and `site.usesDomain`
+ * are set, so the `org.domain` check below still covers it.
+ *
+ * #145: an own-domain calls service (`org.ts`'s `CallsConfig.usesDomain`)
+ * needs a zone for the same reason, whether or not the org also has hosting
+ * or a site on its domain.
  */
 function planZone(org, byKey, claimed) {
-    if (!org.hosting.usesDomain || !org.domain)
+    const usesDomain = org.hosting.usesDomain || org.site.enabled || (org.calls.enabled && org.calls.usesDomain);
+    if (!usesDomain || !org.domain)
         return null;
     const key = resourceKey('cloudflare', 'zone', org.domain);
     const live = byKey.get(key);
@@ -693,3 +863,63 @@ function planCustomers(org, live, claimed, recordedIds) {
         },
     };
 }
+/**
+ * #84: a Cloudflare Access gate on the org's app hostname, letting only
+ * `hosting.accessEmails` through. Idempotent on the recorded Access app id,
+ * like `planOwner`: Cloudflare's live listing has no Access apps. A later
+ * change to the email list is not reconciled yet.
+ */
+function planAccess(org, recordedIds) {
+    if (!org.hosting.enabled || org.hosting.accessEmails.length === 0)
+        return null;
+    if (recordedIds[resourceKey('cloudflare', 'access', org.id)])
+        return null;
+    return {
+        action: { system: 'cloudflare', kind: 'access', key: org.id, desired: {} },
+        step: {
+            description: `put ${org.slug}'s app behind Cloudflare Access`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
+/**
+ * https://github.com/wtfalch/foundry/issues/43: one Cloudflare rate-limiting
+ * rule on the org's own app hostname's sign-in paths (`@wtfalch/auth`'s
+ * `NextAuth.handlers`, mounted at `app/auth/[...auth]/route.ts` -- every
+ * sign-in request passes through `/auth/*`, `executor.ts`'s
+ * `cloudflareRateLimit`). Gated on the same `usesDomain`/`site.enabled`
+ * +`domain` pair {@link planZone} and {@link planTunnel} check (widened for a
+ * site-enabled org by #115: the cms studio signs in under `/auth/` too, on
+ * the same zone {@link planZone} provisions for it): only an own-domain org
+ * gets this step. A level-1 org (no own domain, served at
+ * `<slug>.oikos.host`) shares the `oikos.host` zone with every other level-1
+ * org, and Cloudflare's Free plan allows exactly one rate limiting rule per
+ * zone (developers.cloudflare.com/waf/rate-limiting-rules/, checked
+ * 2026-09-26) -- a per-org step here would fight every other level-1 org's
+ * for that one slot the moment a second org applied. The shared zone instead
+ * gets one rule covering every level-1 org at once, provisioned by
+ * `scripts/shared-ingress.mjs`, not by this planner (#43's own task brief).
+ *
+ * Idempotent on the recorded rule id, like {@link planAccess}: rate limiting
+ * rules are not part of any system's `listResources` (`@wtfalch/providers`
+ * 0.5.0 has no typed reader for them, only its generic `request` escape
+ * hatch -- `executor.ts`'s `CloudflarePort.request` doc comment), so there is
+ * no live resource to diff against here. Planned right after {@link planZone}
+ * so the zone `cloudflareRateLimit` needs to resolve always exists by the
+ * time this step's own action runs.
+ */
+function planRateLimit(org, recordedIds) {
+    if (!(org.hosting.usesDomain || org.site.enabled) || !org.domain)
+        return null;
+    if (recordedIds[resourceKey('cloudflare', 'ratelimit', org.id)])
+        return null;
+    return {
+        action: { system: 'cloudflare', kind: 'ratelimit', key: org.id, desired: {} },
+        step: {
+            description: `rate limit ${org.slug}'s sign-in paths on Cloudflare (free-plan allowance: one rule per zone)`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}