@wtfalch/foundry 0.2.0 → 0.4.0

package/dist/plan/index.d.ts

@@ -5,6 +5,6 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, } from './plan-apply.js';
 export type { ScopeResolver, RecordedIds } from './providers-readers.js';
-export { ProvidersCloudflareReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, FilesOrgLimits, AiOrgLimits, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, } from './executor.js';
-export { FoundryStepExecutor, NotBuiltError, MissingBespokeAppRepoError } from './executor.js';
+export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, FilesOrgLimits, AiOrgLimits, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, } from './executor.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';

package/dist/plan/index.js

@@ -1,5 +1,5 @@
 export { readLiveResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, } from './plan-apply.js';
-export { ProvidersCloudflareReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
-export { FoundryStepExecutor, NotBuiltError, MissingBespokeAppRepoError } from './executor.js';
+export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';

package/dist/plan/plan-apply.js

@@ -252,7 +252,7 @@ const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
 /**
  * Every resource `FoundryPlanApply.destroy` tears down, built from
  * `AppliedState.serviceIds`, in the order the goal line and this campaign's
- * report settle on: the Cloudflare tunnel first (stop routing traffic to the
+ * report settle on: the Cloudflare tunnel first, then the Access gate (stop routing traffic to the
  * app before tearing it down), then the org's own Coolify database and app,
  * then the org's customers ZITADEL org (plan gap A9), then every ZITADEL app
  * foundry recorded, then the ZITADEL project, then the
@@ -269,7 +269,12 @@ const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
  *
  * The Cloudflare zone and the Coolify project are deliberately absent: no
  * zone-delete or Coolify-project-delete method was named for this campaign
- * (Finding, this campaign's report), so destroy leaves both in place.
+ * (Finding, this campaign's report), so destroy leaves both in place. The
+ * Cloudflare rate limiting rule (#43, `diff.ts`'s `planRateLimit`) is absent
+ * for the same reason: it lives inside the same zone's ruleset, no rule-
+ * delete method exists on `CloudflarePort` (`executor.ts`), and the zone it
+ * belongs to is already left in place -- deleting only the rule and not the
+ * zone is a decision left for whoever wires teardown in, not made here.
  */
 function destroyTargets(serviceIds) {
     // Reverse-teardown order: everything under one of these prefixes is
@@ -277,6 +282,7 @@ function destroyTargets(serviceIds) {
     // #71), then the two scope ids last.
     const ORDERED_PREFIXES = [
         'cloudflare:tunnel:',
+        'cloudflare:access:',
         'coolify:database:',
         'coolify:app:',
         'zitadel:customers:',
@@ -327,6 +333,8 @@ const STEP_FIELDS = {
     'zitadel:customers': 'hosting.issuerApps',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
+    'coolify:calls': 'calls.enabled',
+    'coolify:calls-service': 'calls.enabled',
     'files:storage': 'storage',
     'ai:budget': 'ai',
     'cms:site': 'site',
@@ -334,6 +342,8 @@ const STEP_FIELDS = {
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',
+    'cloudflare:access': 'hosting.accessEmails',
+    'cloudflare:ratelimit': 'hosting.usesDomain',
 };
 function stepField(action) {
     // An org declares several issuer apps, each keyed by its name (#71).
@@ -348,10 +358,12 @@ function stepField(action) {
  *
  * Three sources, in this order:
  * - fields no planner step exists for yet, so no apply can make them true:
- *   SSO, guests and solo when turned on, calls on the org's domain, a
- *   bespoke app repo, an adopted app in the `repo` form (#7's `#15` comment:
- *   "declared but refused by `apply`"), and hosting on a domain the org has
- *   not recorded;
+ *   SSO, guests and solo when turned on, a bespoke app repo, an adopted app
+ *   in the `repo` form (#7's `#15` comment: "declared but refused by
+ *   `apply`"), and calls or hosting on a domain the org has not recorded
+ *   (#145: calls on the org's own domain now has a planner step, the same
+ *   way hosting's own domain does, so it only fails for that one missing-
+ *   domain reason, not unconditionally);
  * - chat's reverse re-key, which the planner surfaces but which is not built
  *   (#7 amendment 3), so it counts as failed even when no step threw;
  * - on a failed apply, the field of every planned step from the one that
@@ -369,11 +381,21 @@ function failedFields(org, detail, completed) {
         failed.add('bespokeAppRepo');
     if (org.adoptedApp?.form === 'repo')
         failed.add('adoptedApp');
-    if (org.calls.usesDomain)
+    // `planCallsService`/`planTunnel`/`planZone` all share this same domain
+    // requirement (#145): a declared `usesDomain: true` with no recorded
+    // domain plans no step for any of them either.
+    if (org.calls.usesDomain && org.domain === null)
         failed.add('calls.usesDomain');
     // `planZone` plans nothing without a domain to put the zone on.
     if (org.hosting.usesDomain && org.domain === null)
         failed.add('hosting.usesDomain');
+    // `planTunnel` shares that same domain requirement (#71, map gap N3): a
+    // declared `usesDomain: true` with no recorded domain plans no tunnel
+    // step either. A domainless org (`usesDomain: false`) is not a failure --
+    // it is the level-1 case N3 decided gets no per-org tunnel at all.
+    if (org.hosting.tunnel && org.hosting.usesDomain && org.domain === null) {
+        failed.add('hosting.tunnel');
+    }
     for (const { action, step } of detail.plannedSteps) {
         // Provisioning chat also desires `usesDomain: false`; only the reverse
         // re-key is a destructive step with that value.

package/dist/plan/providers-readers.d.ts

@@ -3,7 +3,7 @@ import type { CoolifyClient } from '@wtfalch/providers/coolify';
 import type { ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
-import type { CloudflareReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
+import type { CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
 /**
  * Real `CoolifyReader`, `CloudflareReader` and `ZitadelReader` implementations
  * (`live.ts:31-45`), backed by `@wtfalch/providers`' HTTP clients instead of
@@ -119,3 +119,56 @@ export declare class ProvidersZitadelReader implements ZitadelReader {
     constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }
+/**
+ * Backed by the same `@wtfalch/providers/coolify`'s `CoolifyClient.listResources`
+ * call {@link ProvidersCoolifyReader} makes, not a real cms admin API --
+ * `executor.ts`'s `cmsSite` (#116) provisions the org's cms app and site app
+ * as two ordinary Coolify applications in the *same* Coolify project the
+ * org's own hosted app would use (`ensureCoolifyProject`), so this reader
+ * resolves that project's scope the same way, then finds the two
+ * applications this org recorded there -- by the flat scope ids `cmsSite`
+ * records them under (`coolify_cms_app`/`coolify_site_app`, `executor.ts`'s
+ * `CMS_APP_SCOPE_KEY`/`SITE_APP_SCOPE_KEY` -- restated here rather than
+ * imported, the same way `hostnameFor`'s hostname rule is restated across
+ * files rather than shared), matched by id the same way every other reader
+ * in this file matches a recorded resource, never by name.
+ *
+ * Without this reader nothing ever reports a live `cms:site:<orgId>`
+ * resource, so `diff.ts`'s `planSite` sees `!live` forever and re-plans
+ * "provision a cms site" on every apply even after one has already
+ * succeeded -- #116 review Finding 1, breaking #14's "repeat until plan
+ * returns empty" invariant.
+ *
+ * `planSite` reads this resource's `config.enabled`/`config.usesDomain` with
+ * plain truthiness (`Boolean(live.config.enabled)`), unlike
+ * `planHostingToggle`'s own `!== false` convention for the org's *own* app
+ * -- so, unlike {@link ProvidersCoolifyReader}, which only ever passes
+ * Coolify's raw fields through untouched, this reader has to synthesize an
+ * explicit `enabled` boolean itself, or the plan would never converge in
+ * either direction. Both apps must exist and count as up, or on their way
+ * there ({@link isRunningApplication}), for `enabled` to be `true`; not
+ * found, or found but actually stopped, reads as `false`, which is what
+ * lets a later park step's own live check (`!live.config.enabled`) settle
+ * once both apps have actually stopped.
+ * `usesDomain` is always `true`: `validateSite` ("site.enabled requires
+ * site.usesDomain") guarantees it whenever this resource can exist at all.
+ *
+ * Nothing recorded yet (no Coolify project scope, or either app id still
+ * unrecorded -- `cmsSite`'s own doc comment: a crash partway through a first
+ * apply can leave only one recorded) or either application missing from
+ * Coolify's own listing reads as "nothing live" (`[]`), the same "not
+ * provisioned yet" answer `computePlanDetail` already knows how to plan
+ * against. A failing `client.listResources` call is not caught here, the
+ * same way it is not caught in `ProvidersCoolifyReader`/
+ * `ProvidersCloudflareReader`/`ProvidersZitadelReader` either -- only a
+ * bolt-on *extra* read (`withLogVolumeConfig`'s own doc comment) gets a
+ * try/catch, and this call is this reader's entire job, not an extra.
+ */
+export declare class ProvidersCmsReader implements CmsReader {
+    private readonly client;
+    private readonly resolveProjectScope;
+    private readonly resolveCmsAppId;
+    private readonly resolveSiteAppId;
+    constructor(client: CoolifyClient, resolveProjectScope: ScopeResolver, resolveCmsAppId: ScopeResolver, resolveSiteAppId: ScopeResolver);
+    listResources(orgId: OrgId): Promise<LiveResource[]>;
+}

package/dist/plan/providers-readers.js

@@ -76,6 +76,60 @@ function applyRecordedIds(resources, recorded, dropUnrecordedKinds = new Set())
 }
 /** Cloudflare tunnels this org has not recorded are dropped — see {@link applyRecordedIds}. */
 const CLOUDFLARE_DROP_UNRECORDED = new Set(['tunnel']);
+/**
+ * The persistent-storage mount path #75 requires on every app foundry
+ * deploys, and the exact string `executor.ts`'s own `LOG_DIR` constant holds
+ * -- restated here rather than imported the same way `executor.ts` restates
+ * `diff.ts`'s hostname rule, since neither file in `plan/` imports another's
+ * private constants.
+ */
+const LOG_DIR = '/app/logs';
+/**
+ * #75: whether the org's own recorded app already carries the durable log
+ * directory `executor.ts`'s `ensureLogVolume` creates -- an extra
+ * `listStorages` read, by the application's own provider uuid
+ * (`resource.key`, still the raw Coolify uuid at this point -- called
+ * *before* {@link applyRecordedIds} below overwrites `key` with the foundry
+ * key it was recorded under, or `listStorages` would be asked for a
+ * "storages" listing of the org id instead of the application). Gated on
+ * `recorded` mapping this exact uuid onto foundry's `app` kind (the same map
+ * {@link applyRecordedIds} itself reads), not just `resource.kind ===
+ * 'application'`, so this never fires for some other application in the same
+ * project, nor for the project's own database uuid.
+ *
+ * This lets `diff.ts`'s `planApp` notice a live app that predates this
+ * feature and plan the missing volume, the same way `LiveResource.config`
+ * (`live.ts`) already carries whatever a planner needs to diff against.
+ * `hasLogDir`'s env var itself is not read back here: `executor.ts`'s
+ * `coolifyApp` always pushes `LOG_DIR` in the same step that mounts the
+ * volume, so the volume's own presence is the one signal this reader needs
+ * (Decision: reading `listEnvs` too would only catch a volume manually
+ * removed after the env was pushed by hand, which #75's own "no app is
+ * configured by hand" rules out).
+ *
+ * `listStorages` is one extra, unrelated-to-the-plan's-real-purpose read
+ * bolted onto every org's plan (#75), so a failure of this one call --
+ * Coolify briefly unreachable, a 5xx, anything `CoolifyClient` throws on a
+ * non-2xx -- must not abort the whole org's plan the way an unhandled
+ * rejection here would (Finding, refuted against the first version of this
+ * function: it had no try/catch at all). Caught and treated the same as
+ * "nothing has checked this app yet": the resource passes through
+ * unchanged, `hasLogVolume` stays absent, and `diff.ts`'s `planApp` already
+ * reads a missing `hasLogVolume` as compliant rather than drift.
+ */
+async function withLogVolumeConfig(client, resource, recorded) {
+    if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('app:')) {
+        return resource;
+    }
+    try {
+        const storages = await client.listStorages(resource.key);
+        const hasLogVolume = (storages.persistent_storages ?? []).some((s) => s.mount_path === LOG_DIR);
+        return { ...resource, config: { ...resource.config, hasLogVolume } };
+    }
+    catch {
+        return resource;
+    }
+}
 /** `@wtfalch/providers`' own `LiveResource` (`resource.ts`) has no `system` field — foundry's adds it at this boundary. */
 function toFoundryResources(system, resources) {
     return resources.map((r) => ({ system, kind: r.kind, key: r.key, config: r.config }));
@@ -102,7 +156,8 @@ export class ProvidersCoolifyReader {
             this.client.listResources(projectUuid),
             this.resolveRecordedIds(orgId),
         ]);
-        return applyRecordedIds(toFoundryResources('coolify', resources), recorded);
+        const withLogConfig = await Promise.all(toFoundryResources('coolify', resources).map((r) => withLogVolumeConfig(this.client, r, recorded)));
+        return applyRecordedIds(withLogConfig, recorded);
     }
 }
 /**
@@ -158,3 +213,100 @@ export class ProvidersZitadelReader {
         return applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
     }
 }
+/**
+ * Whether an application counts as up, or on its way there, from its own
+ * Coolify `status` (`` `running:healthy`, `running:unknown`,
+ * `exited:unhealthy` `` -- `CoolifyClient`'s own `CoolifyApplication.status`
+ * doc comment). Anything except `exited`/`stopped` (Coolify's own
+ * resting-off states; `stopped` is not one this codebase has verified
+ * against a live instance, included defensively) reads as still on --
+ * concretely, `starting:*`/`restarting:*` right after `cmsSite` (re)creates
+ * or starts an app both count as on too, not just `running:*`, or a status
+ * read moments after that call would misreport `enabled: false` and cause a
+ * spurious re-plan (#116 review round 3, Finding 2, mirroring
+ * `executor.ts`'s own `isRunningOrStarting`, restated here rather than
+ * imported the same way `hostnameFor`'s hostname rule is). A missing
+ * `status` defaults to on too, the same "nothing says it's off" convention
+ * `planHostingToggle` (`diff.ts`) uses for the org's own app.
+ */
+function isRunningApplication(resource) {
+    const status = resource.config.status;
+    if (!status)
+        return true;
+    return (typeof status === 'string' && !status.startsWith('exited') && !status.startsWith('stopped'));
+}
+/**
+ * Backed by the same `@wtfalch/providers/coolify`'s `CoolifyClient.listResources`
+ * call {@link ProvidersCoolifyReader} makes, not a real cms admin API --
+ * `executor.ts`'s `cmsSite` (#116) provisions the org's cms app and site app
+ * as two ordinary Coolify applications in the *same* Coolify project the
+ * org's own hosted app would use (`ensureCoolifyProject`), so this reader
+ * resolves that project's scope the same way, then finds the two
+ * applications this org recorded there -- by the flat scope ids `cmsSite`
+ * records them under (`coolify_cms_app`/`coolify_site_app`, `executor.ts`'s
+ * `CMS_APP_SCOPE_KEY`/`SITE_APP_SCOPE_KEY` -- restated here rather than
+ * imported, the same way `hostnameFor`'s hostname rule is restated across
+ * files rather than shared), matched by id the same way every other reader
+ * in this file matches a recorded resource, never by name.
+ *
+ * Without this reader nothing ever reports a live `cms:site:<orgId>`
+ * resource, so `diff.ts`'s `planSite` sees `!live` forever and re-plans
+ * "provision a cms site" on every apply even after one has already
+ * succeeded -- #116 review Finding 1, breaking #14's "repeat until plan
+ * returns empty" invariant.
+ *
+ * `planSite` reads this resource's `config.enabled`/`config.usesDomain` with
+ * plain truthiness (`Boolean(live.config.enabled)`), unlike
+ * `planHostingToggle`'s own `!== false` convention for the org's *own* app
+ * -- so, unlike {@link ProvidersCoolifyReader}, which only ever passes
+ * Coolify's raw fields through untouched, this reader has to synthesize an
+ * explicit `enabled` boolean itself, or the plan would never converge in
+ * either direction. Both apps must exist and count as up, or on their way
+ * there ({@link isRunningApplication}), for `enabled` to be `true`; not
+ * found, or found but actually stopped, reads as `false`, which is what
+ * lets a later park step's own live check (`!live.config.enabled`) settle
+ * once both apps have actually stopped.
+ * `usesDomain` is always `true`: `validateSite` ("site.enabled requires
+ * site.usesDomain") guarantees it whenever this resource can exist at all.
+ *
+ * Nothing recorded yet (no Coolify project scope, or either app id still
+ * unrecorded -- `cmsSite`'s own doc comment: a crash partway through a first
+ * apply can leave only one recorded) or either application missing from
+ * Coolify's own listing reads as "nothing live" (`[]`), the same "not
+ * provisioned yet" answer `computePlanDetail` already knows how to plan
+ * against. A failing `client.listResources` call is not caught here, the
+ * same way it is not caught in `ProvidersCoolifyReader`/
+ * `ProvidersCloudflareReader`/`ProvidersZitadelReader` either -- only a
+ * bolt-on *extra* read (`withLogVolumeConfig`'s own doc comment) gets a
+ * try/catch, and this call is this reader's entire job, not an extra.
+ */
+export class ProvidersCmsReader {
+    client;
+    resolveProjectScope;
+    resolveCmsAppId;
+    resolveSiteAppId;
+    constructor(client, resolveProjectScope, resolveCmsAppId, resolveSiteAppId) {
+        this.client = client;
+        this.resolveProjectScope = resolveProjectScope;
+        this.resolveCmsAppId = resolveCmsAppId;
+        this.resolveSiteAppId = resolveSiteAppId;
+    }
+    async listResources(orgId) {
+        const projectUuid = await this.resolveProjectScope(orgId);
+        if (!projectUuid)
+            return [];
+        const [cmsAppId, siteAppId] = await Promise.all([
+            this.resolveCmsAppId(orgId),
+            this.resolveSiteAppId(orgId),
+        ]);
+        if (!cmsAppId || !siteAppId)
+            return [];
+        const resources = await this.client.listResources(projectUuid);
+        const cmsApp = resources.find((r) => r.kind === 'application' && r.key === cmsAppId);
+        const siteApp = resources.find((r) => r.kind === 'application' && r.key === siteAppId);
+        if (!cmsApp || !siteApp)
+            return [];
+        const enabled = isRunningApplication(cmsApp) && isRunningApplication(siteApp);
+        return [{ system: 'cms', kind: 'site', key: orgId, config: { enabled, usesDomain: true } }];
+    }
+}

package/dist/provision.d.ts

@@ -0,0 +1,56 @@
+import type { CoolifyPort } from './plan/executor.js';
+export declare const PROJECT_NAME = "foundry";
+export declare const ENVIRONMENT_NAME = "production";
+export declare const DATABASE_NAME = "foundry";
+/**
+ * The Coolify calls provisioning needs, on top of `plan/executor.ts`'s own
+ * `CoolifyPort` (reused by reference below rather than restated): `listEnvironments`,
+ * which `CoolifyPort` has no read-only equivalent for (`findOrCreateEnvironment`
+ * creates on a miss). A real `CoolifyClient` already has both, so this is
+ * still satisfied with no adapter.
+ */
+export interface ProvisionCoolifyPort extends Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'listDatabases' | 'createPostgresDatabase'> {
+    listEnvironments(projectUuid: string): Promise<Array<{
+        id: number;
+        uuid: string;
+        name: string;
+    }>>;
+}
+export interface ProvisionPlan {
+    projectExists: boolean;
+    project?: {
+        uuid: string;
+    };
+    environmentExists: boolean;
+    environment?: {
+        id: number;
+        uuid: string;
+        name: string;
+    };
+    databaseExists: boolean;
+    database?: {
+        uuid: string;
+        name: string;
+        environment_id?: number;
+    };
+}
+/**
+ * Read-only: works out what `applyProvision` would need to do to make the
+ * `PROJECT_NAME`/`ENVIRONMENT_NAME`/`DATABASE_NAME` database exist, without
+ * creating anything. Mirrors `plan/executor.ts`'s `coolifyDatabase` step --
+ * find the database by name scoped to the environment's numeric
+ * `environment_id`, the same care about environment scoping
+ * `findApplicationByName`'s doc comment explains (an unscoped name match
+ * risks a false positive against a same-named database in a different
+ * environment).
+ */
+export declare function planProvision(coolify: ProvisionCoolifyPort): Promise<ProvisionPlan>;
+/**
+ * Makes `plan` true: creates whatever `planProvision` found missing.
+ * A no-op read (returns `plan.database`) when the database already exists,
+ * so calling this twice never creates a second one.
+ */
+export declare function applyProvision(coolify: ProvisionCoolifyPort, plan: ProvisionPlan): Promise<{
+    uuid: string;
+    name: string;
+}>;

package/dist/provision.js

@@ -0,0 +1,69 @@
+// #R2 (map gap: foundry's own Postgres, two commands): find-or-create the
+// Postgres database `scripts/foundry-db-provision.mjs` migrates into.
+// Project, environment and database names are fixed here rather than taken
+// as input -- one foundry install, one project -- so there is nothing to
+// mistype on the command line.
+export const PROJECT_NAME = 'foundry';
+export const ENVIRONMENT_NAME = 'production';
+export const DATABASE_NAME = 'foundry';
+/**
+ * Read-only: works out what `applyProvision` would need to do to make the
+ * `PROJECT_NAME`/`ENVIRONMENT_NAME`/`DATABASE_NAME` database exist, without
+ * creating anything. Mirrors `plan/executor.ts`'s `coolifyDatabase` step --
+ * find the database by name scoped to the environment's numeric
+ * `environment_id`, the same care about environment scoping
+ * `findApplicationByName`'s doc comment explains (an unscoped name match
+ * risks a false positive against a same-named database in a different
+ * environment).
+ */
+export async function planProvision(coolify) {
+    const project = await coolify.findProjectByName(PROJECT_NAME);
+    if (!project) {
+        return { projectExists: false, environmentExists: false, databaseExists: false };
+    }
+    const environments = await coolify.listEnvironments(project.uuid);
+    const environment = environments.find((e) => e.name === ENVIRONMENT_NAME);
+    if (!environment) {
+        return { projectExists: true, project, environmentExists: false, databaseExists: false };
+    }
+    const databases = await coolify.listDatabases();
+    const database = databases.find((db) => db.name === DATABASE_NAME && db.environment_id === environment.id);
+    return {
+        projectExists: true,
+        project,
+        environmentExists: true,
+        environment,
+        databaseExists: Boolean(database),
+        database,
+    };
+}
+/**
+ * Makes `plan` true: creates whatever `planProvision` found missing.
+ * A no-op read (returns `plan.database`) when the database already exists,
+ * so calling this twice never creates a second one.
+ */
+export async function applyProvision(coolify, plan) {
+    if (plan.databaseExists && plan.database)
+        return plan.database;
+    const project = plan.projectExists && plan.project ? plan.project : await coolify.createProject(PROJECT_NAME);
+    const environment = plan.environmentExists && plan.environment
+        ? plan.environment
+        : (await coolify.findOrCreateEnvironment(project.uuid, ENVIRONMENT_NAME)).environment;
+    const servers = await coolify.listServers();
+    const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
+    if (!server)
+        throw new Error('No usable Coolify server is registered on this instance.');
+    // `createPostgresDatabase` also returns `internal_db_url` -- a live
+    // credential -- which is deliberately never read off this result: only
+    // `uuid` (and the `name` we already know) leaves this function.
+    const created = await coolify.createPostgresDatabase({
+        project_uuid: project.uuid,
+        server_uuid: server.uuid,
+        environment_name: environment.name,
+        environment_uuid: environment.uuid,
+        name: DATABASE_NAME,
+        postgres_db: DATABASE_NAME,
+        postgres_user: DATABASE_NAME,
+    });
+    return { uuid: created.uuid, name: DATABASE_NAME };
+}

package/dist/slug.d.ts

@@ -1,21 +1,3 @@
-/**
- * The declared org's slug: a pure validator, no I/O, no store access.
- *
- * Decided in https://github.com/wtfalch/foundry/issues/28, forced by the
- * level-1 apex `oikos.host` being live: Cloudflare's free-tier Universal SSL
- * covers a single wildcard level, so every level-1 org's hostnames are flat
- * (`acme.oikos.host`, `acme-stage.oikos.host`, `acme-pr-12.oikos.host`).
- * That makes the slug a live hostname from the moment the org exists — #7
- * only froze it once the org had mail, which is too late: by then the
- * hostname is already serving. This validator runs at creation, not at
- * first use (#28 "Done when").
- *
- * Kept separate from `org.ts` and `store/postgres.ts` so it can be called
- * from both without either depending on the other: `store/postgres.ts`
- * calls it on `create` and `update` (#28), and anything that needs to
- * pre-validate a slug before it ever reaches the store — the operator page,
- * one day — can import it too.
- */
 /** The flattened set {@link validateSlug} checks a candidate slug against. */
 export declare const RESERVED_SLUGS: ReadonlySet<string>;
 /**
@@ -36,3 +18,15 @@ export interface SlugRejection {
  * needs one reason reported.
  */
 export declare function validateSlug(slug: string): SlugRejection | null;
+/**
+ * The slug for a new org, derived from its first display name (William,
+ * 2026-09-26): "Good Company" becomes `good-company`, and `good-company.oikos.host`
+ * is its address. When that slug is taken, reserved or has an environment
+ * suffix, a short random suffix is added: `bruh-7k3q`. The display name stays
+ * separate, so an org can rename itself without moving its address.
+ *
+ * An offensive name is refused outright, by the same check the sign-in broker
+ * runs on usernames (https://github.com/wtfalch/foundry/issues/103, N1b). A
+ * name that could pass as infra (`admin`, `help`) only costs the slug a suffix.
+ */
+export declare function slugFromName(name: string, slugTaken: (slug: string) => Promise<boolean>, suffix?: () => string): Promise<string>;

package/dist/slug.js

@@ -1,3 +1,4 @@
+import { checkName } from '@wtfalch/auth/names';
 /**
  * The declared org's slug: a pure validator, no I/O, no store access.
  *
@@ -31,11 +32,15 @@ const RESERVED_ESTATE_SERVICES = [
     'keys',
     'chat',
     'calls',
+    'calls-sfu',
     'calendar',
     'threads',
     'audit',
     'authz',
+    // Manage was renamed Boule on every surface (#147); 'manage' stays
+    // reserved so no org can take it while the old hostname still redirects.
     'manage',
+    'boule',
     'operator',
     'mailbox',
     'oikos',
@@ -111,6 +116,8 @@ const DNS_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
 const PR_SUFFIX = /-pr-\d+$/;
 /** `<something>-stage` — the stage-hostname shape (#28). */
 const STAGE_SUFFIX = /-stage$/;
+/** `<something>-calls` — a level-1 org's own calls service hostname (foundry#145's "Decided", 2026-09-27). */
+const CALLS_SUFFIX = /-calls$/;
 /**
  * Validates a candidate org slug against every rule #28 decided. Returns
  * `null` when the slug is acceptable, or a {@link SlugRejection} naming
@@ -131,11 +138,76 @@ export function validateSlug(slug) {
             message: `slug '${slug}' is reserved by the estate (#28) and cannot be taken by an org`,
         };
     }
-    if (STAGE_SUFFIX.test(slug) || PR_SUFFIX.test(slug)) {
+    if (STAGE_SUFFIX.test(slug) || PR_SUFFIX.test(slug) || CALLS_SUFFIX.test(slug)) {
         return {
             reason: 'environment-suffix',
-            message: `slug '${slug}' ends with an environment suffix ('-stage' or '-pr-<digits>') reserved for another org's own hostname (#28) — 'acme-stage' is only legal as acme's stage hostname, never as an org slug in its own right`,
+            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>' or '-calls') reserved for another org's own hostname (#28, #145) — 'acme-calls' is only legal as acme's calls hostname, never as an org slug in its own right`,
         };
     }
     return null;
 }
+/** Letters a plain accent strip gets wrong, mostly Norwegian. */
+const SPELLED_OUT = {
+    æ: 'ae',
+    ø: 'o',
+    å: 'a',
+    ß: 'ss',
+    œ: 'oe',
+    þ: 'th',
+    ð: 'd',
+    ı: 'i',
+    ł: 'l',
+    đ: 'd',
+};
+/** Room left for `-xxxx` after the base, so a suffixed slug stays one DNS label. */
+const BASE_MAX = 58;
+function randomSuffix() {
+    const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
+    let out = '';
+    for (let i = 0; i < 4; i++)
+        out += alphabet[Math.floor(Math.random() * alphabet.length)];
+    return out;
+}
+/**
+ * The sign-in broker's name check, with the length and character rules
+ * loosened: a display name has spaces and accents, and a slug may be 63 long.
+ * Only its `reserved` and `disallowed` verdicts apply here.
+ */
+const ANY_TEXT = { minLength: 0, maxLength: Number.MAX_SAFE_INTEGER, pattern: /^/ };
+/**
+ * The slug for a new org, derived from its first display name (William,
+ * 2026-09-26): "Good Company" becomes `good-company`, and `good-company.oikos.host`
+ * is its address. When that slug is taken, reserved or has an environment
+ * suffix, a short random suffix is added: `bruh-7k3q`. The display name stays
+ * separate, so an org can rename itself without moving its address.
+ *
+ * An offensive name is refused outright, by the same check the sign-in broker
+ * runs on usernames (https://github.com/wtfalch/foundry/issues/103, N1b). A
+ * name that could pass as infra (`admin`, `help`) only costs the slug a suffix.
+ */
+export async function slugFromName(name, slugTaken, suffix = randomSuffix) {
+    const base = name
+        .toLowerCase()
+        .replace(/[æøåßœþðıłđ]/g, (c) => SPELLED_OUT[c] ?? c)
+        .normalize('NFKD')
+        .replace(/\p{M}/gu, '')
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, BASE_MAX)
+        .replace(/-+$/, '') || 'org';
+    const nameVerdict = checkName(name, ANY_TEXT);
+    const baseVerdict = checkName(base, ANY_TEXT);
+    if ((!nameVerdict.ok && nameVerdict.reason === 'disallowed') ||
+        (!baseVerdict.ok && baseVerdict.reason === 'disallowed')) {
+        throw new Error(`org name '${name}' is not allowed`);
+    }
+    const free = async (slug) => validateSlug(slug) === null && checkName(slug, ANY_TEXT).ok && !(await slugTaken(slug));
+    if (await free(base))
+        return base;
+    for (let attempt = 0; attempt < 10; attempt++) {
+        const candidate = `${base}-${suffix()}`;
+        if (await free(candidate))
+            return candidate;
+    }
+    throw new Error(`no free slug found for '${name}' after 10 tries`);
+}

package/dist/store/audit.d.ts

@@ -0,0 +1,8 @@
+import type { AuditLog } from '../plan/plan-apply.js';
+import type { FoundryStoreDb } from './postgres.js';
+/**
+ * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
+ * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
+ * attached archon reads the same table. It only inserts.
+ */
+export declare function createPostgresAuditLog(db: FoundryStoreDb): AuditLog;