@wtfalch/foundry 0.26.4 → 0.28.0

package/dist/calls-sfu.d.ts

@@ -154,6 +154,19 @@ export declare const CALLS_SFU_PRIVATE_URL = "http://10.10.10.105:7880";
  * hostname out from under it.
  */
 export declare const CALLS_SFU_PUBLIC_URL = "https://calls-sfu.oikos.host";
+/**
+ * A host's own SFU addresses, for a stack where the shared SFU is not the
+ * estate's (a local run). Optional on `FoundryStepExecutorPorts`; absent, the
+ * two constants above apply unchanged.
+ */
+export interface CallsSfuUrls {
+    /** What a browser reaches: becomes the calls service's `LIVEKIT_PUBLIC_URL`. */
+    publicUrl: string;
+    /** What the calls service reaches: becomes its `LIVEKIT_URL`. */
+    privateUrl: string;
+}
+/** The SFU addresses to use: the override, validated, else the constants. Throws naming the bad field. */
+export declare function resolveCallsSfuUrls(override?: CallsSfuUrls): CallsSfuUrls;
 /**
  * Exported for the test file. Reads `ufw status`'s own report rather than
  * assuming the exit code of a blind `ufw delete allow 7880/tcp` -- real
@@ -190,6 +203,12 @@ export declare function cloudflaredEnvFile(token: string): string;
  * writes the set it was given.
  */
 export declare function livekitConfigYaml(config: CallsSfuConfig): string;
+/** The command that brings both compose services up; part of what {@link callsSfuFilesVersion} hashes. */
+export declare const CALLS_SFU_UP_COMMAND = "docker compose -f /opt/livekit/docker-compose.yml up -d";
+/** Run first, so the SSH session this runs over is never refused. */
+export declare const CALLS_SFU_SSH_RULE_COMMAND = "ufw allow 22/tcp";
+/** Run after any unscoped signalling rule is removed, in this order. */
+export declare const CALLS_SFU_FIREWALL_COMMANDS: readonly string[];
 /**
  * Writes all three files, brings LiveKit and `cloudflared` up, then narrows
  * the VM firewall to exactly what #122's and #127's "Decided" sections name

package/dist/calls-sfu.js

@@ -144,6 +144,20 @@ export const CALLS_SFU_PRIVATE_URL = `http://10.10.10.105:${LIVEKIT_SIGNALLING_P
  * hostname out from under it.
  */
 export const CALLS_SFU_PUBLIC_URL = 'https://calls-sfu.oikos.host';
+/** The SFU addresses to use: the override, validated, else the constants. Throws naming the bad field. */
+export function resolveCallsSfuUrls(override) {
+    if (!override)
+        return { publicUrl: CALLS_SFU_PUBLIC_URL, privateUrl: CALLS_SFU_PRIVATE_URL };
+    for (const field of ['publicUrl', 'privateUrl']) {
+        const value = override[field];
+        if (typeof value !== 'string' ||
+            !URL.canParse(value) ||
+            !/^https?:$/.test(new URL(value).protocol)) {
+            throw new Error(`callsSfuUrls.${field} must be an absolute http(s) URL`);
+        }
+    }
+    return { publicUrl: override.publicUrl, privateUrl: override.privateUrl };
+}
 /**
  * Matches `ufw status`'s report of the exact wide-open rule PR 125 added
  * (`ufw allow 7880/tcp`) -- "Anywhere" in the From column -- and not the
@@ -225,6 +239,19 @@ rtc:
   node_ip: ${address}
 ${keysYaml}`;
 }
+/** The command that brings both compose services up; part of what {@link callsSfuFilesVersion} hashes. */
+export const CALLS_SFU_UP_COMMAND = `docker compose -f ${LIVEKIT_COMPOSE_PATH} up -d`;
+/** Run first, so the SSH session this runs over is never refused. */
+export const CALLS_SFU_SSH_RULE_COMMAND = 'ufw allow 22/tcp';
+/** Run after any unscoped signalling rule is removed, in this order. */
+export const CALLS_SFU_FIREWALL_COMMANDS = [
+    `ufw allow from ${CALLS_SFU_PRIVATE_CIDR} to any port ${LIVEKIT_SIGNALLING_PORT} proto tcp`,
+    `ufw allow ${LIVEKIT_MEDIA_TCP_PORT}/tcp`,
+    `ufw allow ${LIVEKIT_MEDIA_UDP_RANGE}/udp`,
+    'ufw default deny incoming',
+    'ufw default allow outgoing',
+    'ufw --force enable',
+];
 async function run(host, command) {
     const result = await host.exec(command);
     if (result.exitCode !== 0) {
@@ -276,16 +303,12 @@ export async function applyCallsSfu(host, config) {
     await host.writeFile(LIVEKIT_COMPOSE_PATH, dockerComposeYaml());
     await writeFileAtomically(host, LIVEKIT_CONFIG_PATH, livekitConfigYaml(config));
     await host.writeFile(CLOUDFLARED_ENV_PATH, cloudflaredEnvFile(config.cloudflaredTunnelToken));
-    await run(host, `docker compose -f ${LIVEKIT_COMPOSE_PATH} up -d`);
-    await run(host, 'ufw allow 22/tcp');
+    await run(host, CALLS_SFU_UP_COMMAND);
+    await run(host, CALLS_SFU_SSH_RULE_COMMAND);
     const status = await host.exec('ufw status');
     if (status.exitCode === 0 && hasUnscopedSignallingRule(status.stdout)) {
         await run(host, `ufw delete allow ${LIVEKIT_SIGNALLING_PORT}/tcp`);
     }
-    await run(host, `ufw allow from ${CALLS_SFU_PRIVATE_CIDR} to any port ${LIVEKIT_SIGNALLING_PORT} proto tcp`);
-    await run(host, `ufw allow ${LIVEKIT_MEDIA_TCP_PORT}/tcp`);
-    await run(host, `ufw allow ${LIVEKIT_MEDIA_UDP_RANGE}/udp`);
-    await run(host, 'ufw default deny incoming');
-    await run(host, 'ufw default allow outgoing');
-    await run(host, 'ufw --force enable');
+    for (const command of CALLS_SFU_FIREWALL_COMMANDS)
+        await run(host, command);
 }

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
 export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
-export type { DeclaredPlatform, PlatformService, PlatformServiceKey } from './platform.js';
+export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
 export type { PinnedVersions };
@@ -22,7 +22,7 @@ export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, File
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
@@ -41,13 +41,14 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './plan/index.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './plan/index.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
+export type { CallsSfuUrls } from './calls-sfu.js';
 export type { CallsSfuSshSession } from './calls-sfu-ssh-adapter.js';
 export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export type { CallsSfuSshConnectOptions } from './calls-sfu-ssh-client.js';

package/dist/index.js

@@ -13,7 +13,7 @@ export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
@@ -26,7 +26,7 @@ export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
 export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export { UnknownCallsSfuHostKeyError, toCallsSfuHostPort, applyCallsSfuOverSession, } from './calls-sfu-ssh-adapter.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';

package/dist/migrations/0050_platform_sfu_connection_revision.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: the platform's `sfu.connectionRevision`, a value a host
+-- changes when the SFU VM's SSH key, host key or tunnel token changes, so the
+-- platform plan shows the `sfu` step again. Declared; null until set.
+-- Mirrors src/store/schema.ts's `foundryDeclaredPlatform` table addition.
+
+alter table foundry_declared_platform
+  add column if not exists sfu_connection_revision text;

package/dist/plan/diff.d.ts

@@ -43,6 +43,8 @@ export interface DraftStep {
 export interface PlanOrgOptions {
     /** #267: the executor was built with a `loginHostBindings` port. */
     loginHostBindings?: boolean;
+    /** The executor's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`; without it `planIdTokenUserinfo` plans nothing. */
+    zitadelIdTokenUserinfo?: boolean;
     /** F5: the executor was built with a `broker` port. */
     broker?: boolean;
     /** #161: the slugs of the other declared orgs, so a Boule whose hostname another org's slug would take is blocked. */

package/dist/plan/diff.js

@@ -12,7 +12,7 @@ import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } fro
 import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
@@ -441,6 +441,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
             plannedSteps.push(step);
         }
     }
+    // Last: a repair that fails must not stop any step after it (`runSteps` stops at the first failure).
+    const idTokenUserinfo = planIdTokenUserinfo(org, live, recordedIds, plannedSteps, platformReadiness.authReady, options.zitadelIdTokenUserinfo ?? false);
+    if (idTokenUserinfo)
+        plannedSteps.push(idTokenUserinfo);
     // #10 (resolved): "foundry manages only what the declared org names";
     // anything left unclaimed is listed, never proposed for deletion.
     // A resource foundry made for the org is not a finding: only a resource
@@ -861,6 +865,45 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // repoint nothing until the port that writes the binding is wired.
     return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor(false);
 }
+/**
+ * Every sign-in app this org already has live (web or native, not api) gets
+ * "user info inside the ID token" switched on once: apps made before the
+ * setting existed have none, and `@wtfalch/auth` builds the signed-in user
+ * from ID token claims only. One `zitadel:id-token-userinfo` step names the
+ * apps whose recorded id differs from their marker
+ * ({@link zitadelAppIdTokenUserinfoAppliedScopeKey}); a re-created app has a
+ * new id, so it is named again. Plans nothing when the host's ZITADEL client
+ * lacks the method, before the org and project are recorded, or while
+ * the platform's sign-in is not ready.
+ */
+function planIdTokenUserinfo(org, live, recordedIds, plannedSteps, authReady, wired) {
+    if (!wired || !authReady || !recordedIds.zitadel_org || !recordedIds.zitadel_project)
+        return null;
+    const apps = live
+        .filter((r) => r.system === 'zitadel' &&
+        r.kind === 'app' &&
+        (r.config.appType === 'web' || r.config.appType === 'native'))
+        .map((r) => r.key)
+        // An app this plan recreates gets its marker when it is made.
+        .filter((appKey) => !plannedSteps.some((s) => s.action.system === 'zitadel' &&
+        s.action.kind === 'app' &&
+        s.action.key === appKey &&
+        s.action.desired.recreate === true))
+        .filter((appKey) => {
+        const appId = recordedIds[`zitadel:app:${appKey}`];
+        return (Boolean(appId) && recordedIds[zitadelAppIdTokenUserinfoAppliedScopeKey(appKey)] !== appId);
+    });
+    if (apps.length === 0)
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'id-token-userinfo', key: org.id, desired: { apps } },
+        step: {
+            description: `switch on user info in the ID token for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /** Why a login-host step cannot run yet, or `null` when nothing is missing. */
 function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) {
     if (!bindingsWired) {

package/dist/plan/executor.d.ts

@@ -1,4 +1,5 @@
 import type { OrgMailOptions, OrgMailOrg, OrgMailResult } from '@wtfalch/email/postmaster';
+import { type CallsSfuUrls } from '../calls-sfu.js';
 import type { DeclaredOrg, HostingBuildPack } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import { type BrokerPort } from './broker-entries.js';
@@ -518,7 +519,7 @@ export interface WorkersPort {
 /**
  * One DNS record a Lettermint domain's own response says must be published --
  * `purpose` is Lettermint's own label (`return_path`, `dmarc`, `dkim_legacy`,
- * `dkim_primary`, `dkim_secondary`), replacing Resend's `record` field, from
+ * `dkim_primary`, `dkim_secondary`), replacing the earlier provider's `record` field, from
  * {@link LettermintPort.createDomain}/{@link LettermintPort.getDomain}, the
  * same shape https://lettermint.co/docs/api-reference/team/0.0.1/lettermint-team-openapi.json's
  * `DomainDnsRecordData` documents (`fqdn`/`content` renamed to this port's own
@@ -551,17 +552,17 @@ export interface LettermintProject {
  * has no Lettermint client yet, unlike Coolify/Cloudflare/ZITADEL above, so
  * this port names Lettermint's own REST shapes directly
  * (`.plans/2026-09-28-lettermint-api.md`, its own primary-source citations).
- * Replaces `ResendPort` (#138/#140), trimmed to what `coolifyApp`/`coolifyMail`
+ * Replaces the earlier mail port (#138/#140), trimmed to what `coolifyApp`/`coolifyMail`
  * below actually call.
  *
- * Unlike Resend's per-domain sending key, a Lettermint domain is
+ * Unlike the earlier provider's per-domain sending key, a Lettermint domain is
  * unrestricted by default -- any project in the team could send from it --
  * so a project's own domain access is a separate call
  * ({@link restrictDomainToProjects}), and the credential unit is a *project*,
  * not a per-domain key: Lettermint's API mints, at most, one live token per
  * project and has no call to list or revoke an individual token within one
  * (`.plans/2026-09-28-lettermint-api.md` §4), so `<slug>-app` is a project
- * name, never suffixed with a domain id the way Resend's key name was.
+ * name, never suffixed with a domain id the way the earlier provider's key name was.
  */
 export interface LettermintPort {
     /**
@@ -584,7 +585,7 @@ export interface LettermintPort {
     /**
      * Asks Lettermint to re-check DNS now. Never polled or awaited to
      * completion -- the same "do not block the plan on DNS propagation" rule
-     * `ResendPort.verifyDomain` followed: record the status, and let the next
+     * the earlier mail port followed: record the status, and let the next
      * apply re-check it.
      */
     verifyDomain(id: string): Promise<{
@@ -1009,6 +1010,18 @@ export interface ZitadelPort {
      * the binding holds; `zitadelApp` never sets it at creation.
      */
     updateOidcAppLoginBaseUri(orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;
+    /**
+     * Switches on "user info inside the ID token" for an already-created app,
+     * read-modify-write (`@wtfalch/providers`' `ZitadelClient.
+     * updateOidcAppIdTokenUserinfoAssertion`): ZITADEL defaults it to off, and
+     * `@wtfalch/auth` builds the signed-in user from ID token claims only, so
+     * an app made without it has no `email` claim. Resolves `true` when it
+     * wrote the setting, `false` when the app already had it on (no write).
+     * Optional: a host whose client lacks it gets no repair step planned
+     * (`FoundryPlanApplyOptions.zitadelIdTokenUserinfo`), and nothing throws.
+     * `createOidcApp` and `createOidcAppWithSecret` send it on themselves.
+     */
+    updateOidcAppIdTokenUserinfoAssertion?(orgId: string, projectId: string, appId: string): Promise<boolean>;
 }
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
@@ -1377,6 +1390,12 @@ export interface FoundryStepExecutorPorts {
     jobsScheduler?: JobsSchedulerPort;
     /** The shared calls SFU's own LiveKit credentials (#145) -- see {@link CallsSfuPort}'s own doc comment. */
     callsSfu: CallsSfuPort;
+    /**
+     * The calls service's `LIVEKIT_URL` / `LIVEKIT_PUBLIC_URL`, for a host whose
+     * SFU is not the estate's shared one. Absent, the estate's addresses apply.
+     * Refused (the calls-service step throws) unless both are absolute http(s) URLs.
+     */
+    callsSfuUrls?: CallsSfuUrls;
     /**
      * #113: the org's old-mail copy into Stalwart, ahead of a `received` ->
      * `hosted` MX cutover -- see {@link MailCopyPort}'s own doc comment.
@@ -1696,6 +1715,15 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * recorded).
      */
     private zitadelOwner;
+    /**
+     * Switches on "user info inside the ID token" for each live sign-in app
+     * the planner named. An app's marker (its ZITADEL app id) is recorded and
+     * persisted only after its call resolved to a boolean, so a call that throws
+     * or resolves to anything else leaves no marker and the next plan names the
+     * app again. The error names ids only,
+     * never the cause.
+     */
+    private zitadelIdTokenUserinfo;
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted
@@ -1931,7 +1959,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *
      * Mint rule ("Credential model"): the project is healthy when the app env
      * holds `LETTERMINT_API_TOKEN` and Lettermint lists exactly one project
-     * named `<slug>-app` -- unlike Resend's key, a Lettermint project's name
+     * named `<slug>-app` -- unlike the earlier provider's key, a Lettermint project's name
      * carries no domain id, since a domain switch is handled entirely by
      * {@link LettermintPort.restrictDomainToProjects} below and never needs a
      * fresh project. Otherwise a fresh project is created and its token
@@ -2726,7 +2754,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * upsert `publishMailDnsRecords` above uses for Stalwart's own records --
      * except an existing `_dmarc` record is never overwritten (a stricter
      * policy an org already set, `p=quarantine`/`p=reject`, should not be
-     * relaxed back to Lettermint's own default). Resend's own domain also
+     * relaxed back to Lettermint's own default). The earlier provider's domain also
      * carried an apex `SPF` TXT record that had to be merged into whatever SPF
      * record already existed there (RFC 7208: two `v=spf1` TXT records on one
      * name is a permerror); Lettermint's own DNS records

package/dist/plan/executor.js

@@ -1,6 +1,6 @@
 import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
-import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
+import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
@@ -24,7 +24,7 @@ import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
@@ -354,10 +354,10 @@ const CMS_DATABASE_SCOPE_KEY = 'coolify_cms_database';
  * domain choice, the same way {@link APP_CLIENT_ID_SCOPE_KEY} carries a
  * public value out. All of that org's Lettermint work -- ensure domain,
  * restrict, publish DNS, verify -- now happens inside the same step that
- * reads this key (`ensureAppLettermintMail`), so unlike the Resend design
+ * reads this key (`ensureAppLettermintMail`), so unlike the earlier design
  * this rework replaces, no separate domain-id scope key is recorded: the
  * domain is looked up by name fresh each apply. Renamed from
- * `resend_mail_domain`.
+ * the earlier mail domain key.
  */
 const MAIL_DOMAIN_SCOPE_KEY = 'mail_domain';
 /**
@@ -770,6 +770,8 @@ export class FoundryStepExecutor {
                 return this.zitadelLoginHost(action, org, context);
             case 'zitadel:app':
                 return this.zitadelApp(action, org, context);
+            case 'zitadel:id-token-userinfo':
+                return this.zitadelIdTokenUserinfo(action, org, context);
             case 'zitadel:customers':
                 return this.zitadelCustomers(org, context);
             case 'coolify:app':
@@ -1312,6 +1314,44 @@ export class FoundryStepExecutor {
         }
         return { resourceId: userId };
     }
+    /**
+     * Switches on "user info inside the ID token" for each live sign-in app
+     * the planner named. An app's marker (its ZITADEL app id) is recorded and
+     * persisted only after its call resolved to a boolean, so a call that throws
+     * or resolves to anything else leaves no marker and the next plan names the
+     * app again. The error names ids only,
+     * never the cause.
+     */
+    async zitadelIdTokenUserinfo(action, org, context) {
+        const update = this.ports.zitadel.updateOidcAppIdTokenUserinfoAssertion?.bind(this.ports.zitadel);
+        // The planner plans nothing without the method; a stale plan does nothing.
+        if (!update)
+            return {};
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded.zitadel_org;
+        const projectId = recorded.zitadel_project;
+        if (!zitadelOrgId || !projectId) {
+            throw new Error(`zitadel:id-token-userinfo for ${org.slug}: no ZITADEL org and project recorded yet -- the issuer must be provisioned first`);
+        }
+        for (const appKey of action.desired.apps) {
+            const appId = recorded[`zitadel:app:${appKey}`];
+            if (!appId)
+                continue;
+            let done;
+            try {
+                done = await update(zitadelOrgId, projectId, appId);
+            }
+            catch {
+                throw new Error(`zitadel:id-token-userinfo for ${org.slug}: switching on user info in the ID token failed for app '${appKey}' (${appId})`);
+            }
+            // A client that answers every property (`packages/local`) resolves to something else: no marker.
+            if (typeof done !== 'boolean')
+                continue;
+            context.recordScopeId(zitadelAppIdTokenUserinfoAppliedScopeKey(appKey), appId);
+            await context.persistScopeIds();
+        }
+        return {};
+    }
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted
@@ -1706,6 +1746,8 @@ export class FoundryStepExecutor {
             // never something an app's env needs.
             context.recordScopeId(clientIdScopeKey, created.clientId);
         }
+        // Made with the setting on (providers 0.9.0): nothing to repair on this id.
+        context.recordScopeId(zitadelAppIdTokenUserinfoAppliedScopeKey(action.key), created.appId);
         return { resourceId: created.appId };
     }
     /**
@@ -2453,7 +2495,7 @@ export class FoundryStepExecutor {
      *
      * Mint rule ("Credential model"): the project is healthy when the app env
      * holds `LETTERMINT_API_TOKEN` and Lettermint lists exactly one project
-     * named `<slug>-app` -- unlike Resend's key, a Lettermint project's name
+     * named `<slug>-app` -- unlike the earlier provider's key, a Lettermint project's name
      * carries no domain id, since a domain switch is handled entirely by
      * {@link LettermintPort.restrictDomainToProjects} below and never needs a
      * fresh project. Otherwise a fresh project is created and its token
@@ -3771,6 +3813,8 @@ export class FoundryStepExecutor {
             await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
             return { resourceId: appId };
         }
+        // Refused before anything is created, like the missing-stack refusal below.
+        const sfuUrls = resolveCallsSfuUrls(this.ports.callsSfuUrls);
         const recorded = context.recordedIds();
         const synapseId = recorded[CALLS_SYNAPSE_SCOPE_KEY];
         const masId = recorded[CALLS_MAS_SCOPE_KEY];
@@ -3832,8 +3876,8 @@ export class FoundryStepExecutor {
         await this.ensureLogVolume(app.appId, org, app.existed);
         const bindingSecret = await this.ensureCallsBindingSecret(app.appId);
         const envs = [
-            { key: 'LIVEKIT_URL', value: CALLS_SFU_PRIVATE_URL },
-            { key: 'LIVEKIT_PUBLIC_URL', value: CALLS_SFU_PUBLIC_URL },
+            { key: 'LIVEKIT_URL', value: sfuUrls.privateUrl },
+            { key: 'LIVEKIT_PUBLIC_URL', value: sfuUrls.publicUrl },
             { key: 'LIVEKIT_API_KEY', value: sfu.apiKey },
             { key: 'LIVEKIT_API_SECRET', value: sfu.apiSecret },
             { key: 'MAS_URL', value: `http://${masHost}:8080/` },
@@ -5144,7 +5188,7 @@ export class FoundryStepExecutor {
      * upsert `publishMailDnsRecords` above uses for Stalwart's own records --
      * except an existing `_dmarc` record is never overwritten (a stricter
      * policy an org already set, `p=quarantine`/`p=reject`, should not be
-     * relaxed back to Lettermint's own default). Resend's own domain also
+     * relaxed back to Lettermint's own default). The earlier provider's domain also
      * carried an apex `SPF` TXT record that had to be merged into whatever SPF
      * record already existed there (RFC 7208: two `v=spf1` TXT records on one
      * name is a permerror); Lettermint's own DNS records

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -15,7 +15,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
@@ -23,7 +23,7 @@ export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from '
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
@@ -12,7 +12,7 @@ export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEME
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';

package/dist/plan/live.d.ts

@@ -23,9 +23,9 @@ export interface LiveResource {
     /**
      * `'sfu'` (#170) has no reader wired below -- there is no cheap way to
      * probe the calls SFU VM's own state over SSH during planning, so
-     * `platform-diff.ts`'s `planSfu` always plans its step when
-     * `DeclaredPlatform.sfu.enabled` is true, rather than diffing against a
-     * live resource the way every other system here does. It is still part of
+     * `platform-diff.ts`'s `planSfu` plans its step from a recorded
+     * fingerprint when `DeclaredPlatform.sfu.enabled` is true, rather than
+     * diffing against a live resource the way every other system here does. It is still part of
      * this union so `StepAction.system` (`diff.ts`) can name it. `'edge'`
      * (#317) is the same: a edge key has no live lookup of its own, the same
      * shape `ai`/`files` entry keys already follow.

package/dist/plan/plan-apply.d.ts

@@ -361,6 +361,13 @@ export interface FoundryPlanApplyOptions {
      * before zitadel-login's binding can be written.
      */
     loginHostBindings?: boolean;
+    /**
+     * True when the host's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`
+     * (`@wtfalch/providers` at the version that has it). Optional, and false
+     * without it: no org plans the step that switches on user info in the ID
+     * token of its existing sign-in apps.
+     */
+    zitadelIdTokenUserinfo?: boolean;
     /**
      * F5: true when the host's executor was built with a `broker` port.
      * Optional, and false without it: each entry's broker entry is then
@@ -461,6 +468,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly agora;
     private readonly jobsScheduler;
     private readonly loginHostBindings;
+    private readonly zitadelIdTokenUserinfo;
     private readonly broker;
     private readonly edgeWorkers;
     private readonly hostFiles;

package/dist/plan/plan-apply.js

@@ -121,6 +121,7 @@ export class FoundryPlanApply {
     agora;
     jobsScheduler;
     loginHostBindings;
+    zitadelIdTokenUserinfo;
     broker;
     edgeWorkers;
     hostFiles;
@@ -142,6 +143,7 @@ export class FoundryPlanApply {
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
+        this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
         this.broker = options.broker ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
@@ -876,6 +878,7 @@ export class FoundryPlanApply {
         const platformHostnames = await this.platformServiceHostnames();
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
+            zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
             broker: this.broker,
             edgeWorkers: this.edgeWorkers,
             otherSlugs,
@@ -1005,9 +1008,13 @@ export class FoundryPlanApply {
             store.getServiceIds(),
         ]);
         const sfuBlocked = await this.sfuBlockedReason(platform);
+        const callsOrgSlugs = (await this.store.list())
+            .filter((org) => org.calls.enabled)
+            .map((org) => org.slug);
         const detail = computePlatformPlanDetail(platform, live, {
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
+            callsOrgSlugs,
             recordedIds: serviceIds,
             blocked: (await executor.blockedSteps?.(platform, serviceIds)) ?? {},
             drifted: (await executor.driftedSteps?.(platform, serviceIds)) ?? {},
@@ -1301,6 +1308,7 @@ const STEP_FIELDS = {
     'zitadel:issuer': 'issuer.usesDomain',
     'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
+    'zitadel:id-token-userinfo': 'hosting.entries.uses.auth',
     'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',