@wtfalch/foundry 0.26.4 → 0.28.0

package/dist/plan/platform-diff.d.ts

@@ -99,6 +99,11 @@ export declare function versionNotAppliedLine(service: string, appLive: boolean,
  * the same `platform:<service>` shape as {@link PLATFORM_AUTH_KEY}.
  */
 export declare const PLATFORM_ARCHON_KEY = "platform:archon";
+/**
+ * The fingerprint (`callsSfuAppliedFingerprint`) of the last successful `sfu`
+ * apply. `planSfu` plans the step again when it differs from the desired one.
+ */
+export declare const PLATFORM_SFU_APPLIED_SCOPE_KEY = "sfu_applied_fingerprint";
 /**
  * #175: the hostname and `gitRef` the last successful Archon run applied.
  * `planArchon` plans the step again when either differs from the declared
@@ -472,6 +477,22 @@ export declare function dbEnvAppliedScopeKey(entryKey: string): string;
  * service's own marker, and vice versa.
  */
 export declare function serviceDbEnvAppliedScopeKey(service: 'chat' | 'calls-service'): string;
+/**
+ * The ZITADEL app id of company app `appKey` once "user info inside the ID
+ * token" was switched on for it (`updateOidcAppIdTokenUserinfoAssertion`).
+ * `diff.ts` plans one step for the org while any live sign-in app's recorded
+ * id differs from its marker, so an app made before the setting existed, or
+ * made again under a new id, is repaired once.
+ */
+export declare function zitadelAppIdTokenUserinfoAppliedScopeKey(appKey: string): string;
+/** The ZITADEL app id of Archon's sign-in client in the platform's own ZITADEL. */
+export declare const PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY = "zitadel_platform_archon_app";
+/**
+ * The ZITADEL app id of Archon's sign-in client once "user info inside the
+ * ID token" was switched on for it. `planArchonIdTokenUserinfo` plans the
+ * repair while this differs from the recorded client app id.
+ */
+export declare const PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY = "archon_id_token_userinfo_applied";
 /**
  * The settings `coolifyApp` owns on an entry's app (`folder`, `port`,
  * `autoDeploy`) as the JSON the marker below holds. `coolifyApp` records it
@@ -906,6 +927,11 @@ export interface PlanPlatformOptions {
     jobsObservable?: boolean;
     /** Why the shared SFU is blocked, or `null` when it is not (default `null`). */
     sfuBlocked?: string | null;
+    /**
+     * The slugs of orgs with `calls.enabled`. With it, `planSfu` plans the step
+     * only when the recorded fingerprint differs; absent, it always plans it.
+     */
+    callsOrgSlugs?: readonly string[];
     /** The platform's recorded resource/scope ids (default `{}`). */
     recordedIds?: Readonly<Record<string, string>>;
     /** Per-step block reasons the executor reports (default `{}`). */
@@ -988,6 +1014,12 @@ export interface PlanPlatformOptions {
         };
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
+        /**
+         * The Archon sign-in client's ZITADEL client has
+         * `updateOidcAppIdTokenUserinfoAssertion`. Not a block: without it the
+         * repair step is not planned.
+         */
+        archonIdTokenUserinfo?: boolean;
     };
     /**
      * Steps whose live state differs from the declared one in a way the recorded

package/dist/plan/platform-diff.js

@@ -4,6 +4,7 @@ import { APP_ENTRY_KEY } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
+import { callsSfuAppliedFingerprint } from './platform-sfu.js';
 import { withStepSystem } from './step-system.js';
 /**
  * The `Plan` (#19's public contract) a {@link PlatformPlanDetail} carries,
@@ -122,6 +123,11 @@ export function versionNotAppliedLine(service, appLive, applied, pinned) {
  * the same `platform:<service>` shape as {@link PLATFORM_AUTH_KEY}.
  */
 export const PLATFORM_ARCHON_KEY = 'platform:archon';
+/**
+ * The fingerprint (`callsSfuAppliedFingerprint`) of the last successful `sfu`
+ * apply. `planSfu` plans the step again when it differs from the desired one.
+ */
+export const PLATFORM_SFU_APPLIED_SCOPE_KEY = 'sfu_applied_fingerprint';
 /**
  * #175: the hostname and `gitRef` the last successful Archon run applied.
  * `planArchon` plans the step again when either differs from the declared
@@ -521,6 +527,24 @@ export function dbEnvAppliedScopeKey(entryKey) {
 export function serviceDbEnvAppliedScopeKey(service) {
     return `service_db_env_applied.${service}`;
 }
+/**
+ * The ZITADEL app id of company app `appKey` once "user info inside the ID
+ * token" was switched on for it (`updateOidcAppIdTokenUserinfoAssertion`).
+ * `diff.ts` plans one step for the org while any live sign-in app's recorded
+ * id differs from its marker, so an app made before the setting existed, or
+ * made again under a new id, is repaired once.
+ */
+export function zitadelAppIdTokenUserinfoAppliedScopeKey(appKey) {
+    return `zitadel_app_id_token_userinfo_applied.${appKey}`;
+}
+/** The ZITADEL app id of Archon's sign-in client in the platform's own ZITADEL. */
+export const PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY = 'zitadel_platform_archon_app';
+/**
+ * The ZITADEL app id of Archon's sign-in client once "user info inside the
+ * ID token" was switched on for it. `planArchonIdTokenUserinfo` plans the
+ * repair while this differs from the recorded client app id.
+ */
+export const PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY = 'archon_id_token_userinfo_applied';
 export function appSettingsOf(entry) {
     return {
         folder: entry.folder,
@@ -1038,7 +1062,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, recordedIds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, recordedIds = {}, blocked = {}, drifted = {}, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1053,7 +1077,7 @@ export function planPlatform(platform, live, options = {}) {
     // A blocked SFU is reported in `unmanaged`, not planned: a step the
     // executor must refuse would halt every step after it (`diff.ts` does the
     // same for a blocked Agora).
-    const sfu = platform.sfu.enabled && sfuBlocked ? null : planSfu(platform);
+    const sfu = platform.sfu.enabled && sfuBlocked ? null : planSfu(platform, callsOrgSlugs, recordedIds);
     if (sfu)
         plannedSteps.push(sfu);
     // #478, F4.dns: first of the services, ahead of auth. Edge is the only
@@ -1137,6 +1161,10 @@ export function planPlatform(platform, live, options = {}) {
         plannedSteps.push(uptime.step);
     if (archon.step && blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
+    // After Archon's own step: a repair that fails must not hold up the work before it.
+    const idTokenUserinfo = planArchonIdTokenUserinfo(platform, recordedIds, blocked.archonIdTokenUserinfo ?? false);
+    if (idTokenUserinfo)
+        plannedSteps.push(idTokenUserinfo);
     // #251: one line per service whose recorded applied ref no longer matches
     // what the next apply would use (or, for zitadel, what is actually live).
     // Never pushed into `plannedSteps` -- see `VersionChangeItem`'s own doc
@@ -1483,20 +1511,29 @@ function planBackups(byKey, claimed, recordedIds, executorMissing, storageDrifte
 /**
  * The platform's shared calls SFU (#170), keyed `sfu:livekit:platform` --
  * there is exactly one, so `key` names the platform itself rather than a
- * domain or an org id, the way `LiveResource`'s own doc comment explains for
- * this system. Unlike {@link planApexZone}, this step is never matched
- * against a live resource: there is no cheap way to read the SFU VM's own
- * state over SSH during planning (`LiveResource`'s doc comment on the `sfu`
- * system), so the step is planned whenever `platform.sfu.enabled` is true,
- * full stop. That is safe rather than wasteful: `applyCallsSfu`
- * (`calls-sfu.ts`'s own top doc comment) is built to be re-run, so an apply
- * that runs this step again writes the same files and runs the same
- * idempotent `docker compose`/`ufw` commands, changing nothing on a VM
- * already caught up.
- */
-function planSfu(platform) {
+ * domain or an org id. It is never matched against a live resource: there is
+ * no cheap way to read the SFU VM's own state over SSH during planning
+ * (`LiveResource`'s doc comment on the `sfu` system). Instead the executor
+ * records {@link callsSfuAppliedFingerprint} after a successful apply, and
+ * with `callsOrgSlugs` the step is planned only when that record differs
+ * from the desired one (new org set, changed calls files, new
+ * `sfu.connectionRevision`). Without `callsOrgSlugs` it is planned whenever
+ * `platform.sfu.enabled` is true. Planning it needlessly is safe:
+ * `applyCallsSfu` is built to be re-run.
+ */
+function planSfu(platform, callsOrgSlugs, recordedIds) {
     if (!platform.sfu.enabled)
         return null;
+    if (callsOrgSlugs &&
+        recordedIds[PLATFORM_SFU_APPLIED_SCOPE_KEY] ===
+            callsSfuAppliedFingerprint({
+                orgSlugs: callsOrgSlugs,
+                ...(platform.sfu.connectionRevision
+                    ? { connectionRevision: platform.sfu.connectionRevision }
+                    : {}),
+            })) {
+        return null;
+    }
     const action = {
         system: 'sfu',
         kind: 'livekit',
@@ -2156,6 +2193,32 @@ function planEdge(platform, recordedIds, executorBlocked, drifted) {
         blocked: null,
     };
 }
+/**
+ * Archon's sign-in client, once it exists, gets "user info inside the ID
+ * token" switched on: a client made before the setting existed has none, so
+ * its ID token carries no `email` and the console stores none for its
+ * people. One `zitadel:id-token-userinfo` step keyed {@link PLATFORM_ARCHON_KEY},
+ * planned while the recorded client app id differs from
+ * {@link PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY} (a client made
+ * again has a new id). Not planned when the host's ZITADEL client lacks the
+ * method, and not blocked either: nothing is owed until the host wires it.
+ */
+function planArchonIdTokenUserinfo(platform, recordedIds, wired) {
+    if (!wired || !platform.archon.enabled)
+        return null;
+    const appId = recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!appId || recordedIds[PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY] === appId) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'id-token-userinfo', key: PLATFORM_ARCHON_KEY, desired: {} },
+        step: {
+            description: "switch on user info in the ID token for Archon's sign-in client",
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /**
  * #604: the platform's ZITADEL as a sign-in provider in Cloudflare Access: a
  * ZITADEL client for Cloudflare, then edge's `ensureProvider`. One

package/dist/plan/platform-org.d.ts

@@ -79,10 +79,9 @@ export interface OrgPlatformReadiness {
     aiUrl?: string | null;
     /**
      * The shared calls SFU (#170) an org's own calls Matrix stack depends on.
-     * Declared is enough here: unlike the others, `platform-diff.ts`'s
-     * `planSfu` never diffs the SFU against a live resource either (its own
-     * doc comment: "there is no cheap way to read the SFU VM's own state over
-     * SSH during planning"), so "applied" has no separate signal to check.
+     * Declared is enough here: `platform-diff.ts`'s `planSfu` plans the step
+     * from a recorded fingerprint, which is no signal an org's plan could
+     * read, so "applied" has no separate check.
      */
     callsReady: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */

package/dist/plan/platform-providers.d.ts

@@ -66,7 +66,23 @@ export interface PlatformZitadelSmtp {
         changed: boolean;
     }>;
 }
+/**
+ * Where ZITADEL's SMTP provider sends mail, instead of Lettermint's relay
+ * (`smtp.lettermint.co:587`, STARTTLS, user `lettermint`).
+ */
+export interface PlatformAuthSmtp {
+    host: string;
+    /** An integer from 1 to 65535. */
+    port: number;
+    /** ZITADEL's "TLS" flag for the connection. */
+    tls: boolean;
+    user: string;
+    /** Resolves the SMTP password. Absent, the broker's mail key (held, else the broker's env) is the password. */
+    password?: () => Promise<string>;
+}
 export interface PlatformAuthDeps {
+    /** Overrides the Lettermint SMTP relay ZITADEL is given. Absent, Lettermint exactly as before. */
+    smtp?: PlatformAuthSmtp;
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
@@ -319,6 +335,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         };
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
+        archonIdTokenUserinfo?: boolean;
     }>;
     /**
      * foundry#542: why the uptime Worker cannot run yet, which optional secrets
@@ -516,7 +533,7 @@ export interface PlatformArchonDeps {
     access: PlatformAccessFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'>;
     /** {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client. */
     zitadelForInstance?: (issuerUrl: string) => PlatformArchonDeps['zitadel'];
     /**
@@ -788,7 +805,7 @@ export declare function createAiManagementKeyMinter(options: {
  * `_FILE` (#209 mints and pushes this once it lands) and `LETTERMINT_API_TOKEN`
  * (#210: `wtfalch/auth#138` moved the broker's account mail onto
  * `@wtfalch/mailer`'s Lettermint transport, so this is the env name the
- * broker actually reads now, not `RESEND_API_TOKEN`). Read from the broker's
+ * broker actually reads now, not the earlier provider's token). Read from the broker's
  * own live env, not a recorded scope id: whichever of #209/#210 lands first
  * (or a human, setting either directly on the app) is enough to clear that
  * one input, in either order, with no coupling to this step's own execution.

package/dist/plan/platform-providers.js

@@ -9,8 +9,8 @@ import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrSta
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
-import { applyCallsSfuPlatformStep } from './platform-sfu.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -350,6 +350,21 @@ export class FoundryPlatformStepExecutor {
                 }
             }
         }
+        // Not a block: without the method the planner plans no repair step for Archon's sign-in client.
+        if (this.archon &&
+            platform.archon.enabled &&
+            recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY]) {
+            try {
+                const zitadel = this.archon.zitadelForInstance?.(`https://${platform.auth.hostname}`) ??
+                    this.archon.zitadel;
+                if (zitadel.updateOidcAppIdTokenUserinfoAssertion)
+                    blocked.archonIdTokenUserinfo = true;
+            }
+            catch (e) {
+                // No ZITADEL client for this instance: the flag stays unset and the repair is not planned.
+                console.error(`platform:archon: could not reach the platform's ZITADEL client to plan the ID token repair: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
         // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
         if (this.archon?.runsInsideApp) {
             blocked.archonRunsInsideApp = true;
@@ -582,6 +597,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformHc(context, this.hc);
         }
+        if (action.system === 'zitadel' &&
+            action.kind === 'id-token-userinfo' &&
+            action.key === PLATFORM_ARCHON_KEY) {
+            if (!this.archon) {
+                throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
+            }
+            return switchOnArchonIdTokenUserinfo(context, this.archon);
+        }
         if (action.system === 'cloudflare' && action.kind === 'access-provider') {
             if (!this.accessProvider) {
                 throw new Error('cloudflare:access-provider needs FoundryPlatformStepExecutor to be constructed with its Access provider dependencies (#604)');
@@ -621,7 +644,7 @@ export class FoundryPlatformStepExecutor {
             return provisionPlatformBackupStorage(context, this.backup);
         }
         if (action.system === 'sfu' && action.kind === 'livekit') {
-            return this.executeSfu();
+            return this.executeSfu(context);
         }
         throw new Error(`platform step ${action.system}:${action.kind} is not built yet`);
     }
@@ -647,7 +670,7 @@ export class FoundryPlatformStepExecutor {
      * Sorted by slug so a re-run with the same set of enabled orgs is a no-op
      * even before `applyCallsSfuPlatformStep`'s own sort (its doc comment).
      */
-    async executeSfu() {
+    async executeSfu(context) {
         if (!this.sfu) {
             throw new Error('platform step sfu:livekit is not built yet (#170: pass `sfu` to FoundryPlatformStepExecutor)');
         }
@@ -657,6 +680,13 @@ export class FoundryPlatformStepExecutor {
             .map((org) => org.slug)
             .sort();
         await applyCallsSfuPlatformStep(this.sfu, orgSlugs);
+        // Only after the apply succeeded: a failed apply records nothing, so the
+        // next plan shows the step again.
+        const { connectionRevision } = context.platform.sfu;
+        context.recordScopeId(PLATFORM_SFU_APPLIED_SCOPE_KEY, callsSfuAppliedFingerprint({
+            orgSlugs,
+            ...(connectionRevision ? { connectionRevision } : {}),
+        }));
         return undefined;
     }
     async coolifyJobs(action, context) {
@@ -1127,7 +1157,7 @@ async function liveLoginClientTokenHash(coolify, appId) {
  *   `IAM_LOGIN_CLIENT` machine user (never the admin one, which is
  *   `IAM_OWNER`) and delivers its token to both apps, once the broker's
  *   other required inputs are already met.
- * - ~~The broker never receives `RESEND_API_TOKEN` either, so it will not
+ * - ~~The broker never receives the earlier mail provider's token either, so it will not
  *   start on `AUTH_APPS` alone.~~ Closed by #210, once `wtfalch/auth#138`
  *   moved the broker's account mail onto `@wtfalch/mailer`'s Lettermint
  *   transport: this function now reads the key back from
@@ -1725,25 +1755,29 @@ async function provisionPlatformAuth(context, deps, owners = []) {
     // The token is the held key, else the broker's live env. Absent, nothing
     // here can run; `authBrokerBlockedReason` already reports it by name.
     const mailToken = heldMailKey || (await currentEnvValue(deps.coolify, brokerAppId, 'LETTERMINT_API_TOKEN'));
+    const smtpTarget = resolveAuthSmtp(deps.smtp);
     if (mailToken) {
         const mailZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        let smtpPassword;
         try {
             // Runs every time the step does (idempotent), so a rotated token lands.
+            smtpPassword = (await deps.smtp?.password?.()) ?? mailToken;
             const smtp = await mailZitadel.ensureSmtpProvider({
-                host: PLATFORM_AUTH_SMTP_HOST,
-                user: PLATFORM_AUTH_SMTP_USER,
-                password: mailToken,
+                host: smtpTarget.host,
+                user: smtpTarget.user,
+                password: smtpPassword,
                 senderAddress: `noreply@${platform.apex}`,
                 senderName: PLATFORM_AUTH_MAIL_SENDER_NAME,
-                tls: true,
+                tls: smtpTarget.tls,
                 description: PLATFORM_AUTH_SMTP_DESCRIPTION,
             });
             await record(PLATFORM_AUTH_SMTP_SCOPE_KEY, smtp.id);
         }
         catch (error) {
-            // The cause, with the Lettermint key redacted, so a failure says why.
+            // The cause, with the Lettermint key (and an overriding SMTP password) redacted, so a failure says why.
             const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
                 mailToken,
+                ...(smtpPassword ? [smtpPassword] : []),
             ]);
             throw new Error(`platform:auth: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
         }
@@ -1773,6 +1807,7 @@ async function provisionPlatformAuth(context, deps, owners = []) {
                         owner.email,
                         owner.email.toLowerCase(),
                         mailToken,
+                        ...(smtpPassword ? [smtpPassword] : []),
                     ]);
                     throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerOrgId}: ${cause}`);
                 }
@@ -1785,6 +1820,29 @@ async function provisionPlatformAuth(context, deps, owners = []) {
 /** Lettermint's SMTP relay, as ZITADEL's SMTP provider wants it: `host:port`, STARTTLS. */
 const PLATFORM_AUTH_SMTP_HOST = 'smtp.lettermint.co:587';
 const PLATFORM_AUTH_SMTP_USER = 'lettermint';
+/**
+ * The SMTP target for ZITADEL's provider: Lettermint's, or the host's override
+ * once validated. Throws a message that never holds the password.
+ */
+function resolveAuthSmtp(override) {
+    if (!override) {
+        return { host: PLATFORM_AUTH_SMTP_HOST, user: PLATFORM_AUTH_SMTP_USER, tls: true };
+    }
+    const { host, port, tls, user } = override;
+    if (typeof host !== 'string' || !host.trim() || /[\s/:]/.test(host)) {
+        throw new Error('platform:auth: smtp.host must be a non-empty host name with no port or path');
+    }
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error('platform:auth: smtp.port must be an integer from 1 to 65535');
+    }
+    if (typeof tls !== 'boolean') {
+        throw new Error('platform:auth: smtp.tls must be true or false');
+    }
+    if (typeof user !== 'string' || !user.trim()) {
+        throw new Error('platform:auth: smtp.user must be non-empty');
+    }
+    return { host: `${host}:${port}`, user, tls };
+}
 /** Marks the provider as foundry's, so `ensureSmtpProvider` finds it again. */
 const PLATFORM_AUTH_SMTP_DESCRIPTION = 'foundry:platform:lettermint';
 /** The same name the broker's `from` uses (`Company Included <noreply@apex>`). */
@@ -1978,8 +2036,8 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  * instance-bootstrap helper `wtfalch-manage` already uses for the hand-built
  * `mail.wtfalch.dev`: that plan also wires an `AcmeProvider` and `DnsServer`
  * for Stalwart's own DNS-01 ACME challenge, and an `MtaRoute` that relays
- * every outbound message through Resend -- the estate moved transactional
- * mail off Resend onto Lettermint before this issue (`@wtfalch/mailer` ADR
+ * every outbound message through the earlier mail provider -- the estate moved transactional
+ * mail off it onto Lettermint before this issue (`@wtfalch/mailer` ADR
  * 0006), and this step provisions no Cloudflare DNS token for Stalwart's own
  * ACME either. Calling it as-is would mint an outbound relay this platform
  * does not want and a credential requirement this issue does not cover, so
@@ -1991,7 +2049,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  * William's review"):
  * - **No ACME/TLS for the SMTP listener.** `mx.<apex>` answers with
  *   Stalwart's own self-signed certificate until a follow-up wires a real
- *   one (`mailObjects`'s `AcmeProvider`/`DnsServer` shape, minus the Resend
+ *   one (`mailObjects`'s `AcmeProvider`/`DnsServer` shape, minus the earlier relay
  *   relay it also carries).
  * - **The Lettermint team token the org app step reads still comes from
  *   wherever the host already reads it, not held keys.** Needs
@@ -2636,11 +2694,44 @@ const PLATFORM_ARCHON_ACCESS_SCOPE_KEY = 'cloudflare_platform_archon_access_app'
 /** The platform's own ZITADEL org (`foundry`, the one `provisionPlatformAuth` mints its admin user in). */
 export const PLATFORM_ZITADEL_ORG_SCOPE_KEY = 'zitadel_platform_org';
 const PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_platform_archon_project';
-const PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY = 'zitadel_platform_archon_app';
 /** The hostname the sign-in client's redirect URIs were made for; a change makes a new client. */
 const PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY = 'zitadel_platform_archon_client_hostname';
 /** Archon's OIDC client id: public, not a secret, so a plain scope id. */
 export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_client_id';
+/**
+ * Switches on "user info inside the ID token" for Archon's sign-in client
+ * (`zitadel:id-token-userinfo` keyed {@link PLATFORM_ARCHON_KEY}). The marker
+ * is the client's app id, recorded only after the call returned, so a call
+ * that throws leaves none and the next plan names the step again. The error
+ * names the ids only, never the cause.
+ */
+async function switchOnArchonIdTokenUserinfo(context, deps) {
+    const { platform } = context;
+    const recorded = context.recordedIds();
+    const zitadel = deps.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? deps.zitadel;
+    // The planner plans nothing without the method; a stale plan does nothing.
+    if (!zitadel.updateOidcAppIdTokenUserinfoAssertion)
+        return {};
+    const orgId = recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
+    const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!orgId || !projectId || !appId) {
+        throw new Error('platform:archon: the sign-in client is not recorded yet -- cannot switch on user info in its ID token');
+    }
+    let done;
+    try {
+        done = await zitadel.updateOidcAppIdTokenUserinfoAssertion(orgId, projectId, appId);
+    }
+    catch {
+        throw new Error(`platform:archon: switching on user info in the ID token failed for the sign-in client ${appId}`);
+    }
+    // A client that answers every property (`packages/local`) resolves to something else: no marker.
+    if (typeof done !== 'boolean')
+        return {};
+    context.recordScopeId(PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, appId);
+    await context.persist?.();
+    return {};
+}
 /**
  * #175: makes `coolify:app` keyed {@link PLATFORM_ARCHON_KEY} true: Archon
  * from https://github.com/wtfalch/archon on `platform.archon.gitRef`, its own
@@ -2916,6 +3007,8 @@ async function provisionPlatformArchon(context, deps) {
             postLogoutRedirectUris: [`https://${hostname}/`],
         });
         context.recordScopeId(PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, created.appId);
+        // Made with the setting on (providers 0.9.0): nothing to repair on this id.
+        context.recordScopeId(PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, created.appId);
         context.recordScopeId(PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY, hostname);
         await record(PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY, created.clientId);
         clientId = created.clientId;
@@ -4958,7 +5051,7 @@ async function findOrCreatePlatformApp(coolify, name, environment, create) {
  * `_FILE` (#209 mints and pushes this once it lands) and `LETTERMINT_API_TOKEN`
  * (#210: `wtfalch/auth#138` moved the broker's account mail onto
  * `@wtfalch/mailer`'s Lettermint transport, so this is the env name the
- * broker actually reads now, not `RESEND_API_TOKEN`). Read from the broker's
+ * broker actually reads now, not the earlier provider's token). Read from the broker's
  * own live env, not a recorded scope id: whichever of #209/#210 lands first
  * (or a human, setting either directly on the app) is enough to clear that
  * one input, in either order, with no coupling to this step's own execution.

package/dist/plan/platform-sfu.d.ts

@@ -37,6 +37,16 @@
  */
 import { type LivekitCredentials } from '../calls-sfu-keys.js';
 import { type CallsSfuSshSession } from '../calls-sfu-ssh-adapter.js';
+/**
+ * What the last successful `sfu` apply is recorded as
+ * (`PLATFORM_SFU_APPLIED_SCOPE_KEY`): a SHA-256 hex digest of foundry's calls
+ * files, the sorted distinct org slugs and the connection revision. It holds
+ * no secret and does not depend on slug order or duplicates.
+ */
+export declare function callsSfuAppliedFingerprint(input: {
+    orgSlugs: readonly string[];
+    connectionRevision?: string;
+}): string;
 /** The SFU VM's own address, SSH credentials and host key fingerprint -- held keys a human stored ahead of time. */
 export interface CallsSfuConnection {
     address: string;

package/dist/plan/platform-sfu.js

@@ -35,9 +35,48 @@
  * live outside this package. `calls-sfu-ssh-adapter.ts`'s {@link CallsSfuSshSession} is the narrow shape
  * a test fakes instead.
  */
+import { createHash } from 'node:crypto';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { mintLivekitCredentials } from '../calls-sfu-keys.js';
 import { applyCallsSfuOverSession } from '../calls-sfu-ssh-adapter.js';
+import { CALLS_SFU_FIREWALL_COMMANDS, CALLS_SFU_SSH_RULE_COMMAND, CALLS_SFU_UP_COMMAND, cloudflaredEnvFile, dockerComposeYaml, livekitConfigYaml, } from '../calls-sfu.js';
+/**
+ * Hash of what `applyCallsSfu` writes and runs, rendered from placeholder
+ * values so no secret is involved: a change to the compose file, the
+ * `livekit.yaml` template, the env file template or a command changes it.
+ */
+function callsSfuFilesVersion() {
+    const placeholder = {
+        address: 'address',
+        livekitKeys: { key: 'secret' },
+        cloudflaredTunnelToken: 'token',
+    };
+    return createHash('sha256')
+        .update(JSON.stringify([
+        dockerComposeYaml(),
+        livekitConfigYaml(placeholder),
+        cloudflaredEnvFile(placeholder.cloudflaredTunnelToken),
+        CALLS_SFU_UP_COMMAND,
+        CALLS_SFU_SSH_RULE_COMMAND,
+        CALLS_SFU_FIREWALL_COMMANDS,
+    ]))
+        .digest('hex');
+}
+/**
+ * What the last successful `sfu` apply is recorded as
+ * (`PLATFORM_SFU_APPLIED_SCOPE_KEY`): a SHA-256 hex digest of foundry's calls
+ * files, the sorted distinct org slugs and the connection revision. It holds
+ * no secret and does not depend on slug order or duplicates.
+ */
+export function callsSfuAppliedFingerprint(input) {
+    return createHash('sha256')
+        .update(JSON.stringify([
+        callsSfuFilesVersion(),
+        [...new Set(input.orgSlugs)].sort(),
+        input.connectionRevision ?? '',
+    ]))
+        .digest('hex');
+}
 /**
  * The key id the platform's own LiveKit pair is held under, alongside every
  * org's own pair, in the same {@link CallsSfuKeysPort} (#152 round 2 review:

package/dist/plan/providers-readers.d.ts

@@ -4,6 +4,8 @@ import { type ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import type { AiReader, CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
+/** The `CoolifyClient` methods the readers call, so a host's own implementation needs no cast. */
+type CoolifyReaderClient = Pick<CoolifyClient, 'listResources' | 'getApplication' | 'getDatabase' | 'listEnvs' | 'listStorages'>;
 /**
  * Real `CoolifyReader`, `CloudflareReader` and `ZitadelReader` implementations
  * (`live.ts:31-45`), backed by `@wtfalch/providers`' HTTP clients instead of
@@ -94,7 +96,7 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
+    constructor(client: CoolifyReaderClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
     /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
     listProject(projectUuid: string): Promise<LiveResource[]>;
@@ -229,6 +231,7 @@ export declare class ProvidersCmsReader implements CmsReader {
     private readonly resolveProjectScope;
     private readonly resolveCmsAppId;
     private readonly resolveSiteAppId;
-    constructor(client: CoolifyClient, resolveProjectScope: ScopeResolver, resolveCmsAppId: ScopeResolver, resolveSiteAppId: ScopeResolver);
+    constructor(client: CoolifyReaderClient, resolveProjectScope: ScopeResolver, resolveCmsAppId: ScopeResolver, resolveSiteAppId: ScopeResolver);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }
+export {};