@wtfalch/foundry 0.27.0 → 0.28.0

package/dist/calls-sfu.d.ts

@@ -203,6 +203,12 @@ export declare function cloudflaredEnvFile(token: string): string;
  * writes the set it was given.
  */
 export declare function livekitConfigYaml(config: CallsSfuConfig): string;
+/** The command that brings both compose services up; part of what {@link callsSfuFilesVersion} hashes. */
+export declare const CALLS_SFU_UP_COMMAND = "docker compose -f /opt/livekit/docker-compose.yml up -d";
+/** Run first, so the SSH session this runs over is never refused. */
+export declare const CALLS_SFU_SSH_RULE_COMMAND = "ufw allow 22/tcp";
+/** Run after any unscoped signalling rule is removed, in this order. */
+export declare const CALLS_SFU_FIREWALL_COMMANDS: readonly string[];
 /**
  * Writes all three files, brings LiveKit and `cloudflared` up, then narrows
  * the VM firewall to exactly what #122's and #127's "Decided" sections name

package/dist/calls-sfu.js

@@ -239,6 +239,19 @@ rtc:
   node_ip: ${address}
 ${keysYaml}`;
 }
+/** The command that brings both compose services up; part of what {@link callsSfuFilesVersion} hashes. */
+export const CALLS_SFU_UP_COMMAND = `docker compose -f ${LIVEKIT_COMPOSE_PATH} up -d`;
+/** Run first, so the SSH session this runs over is never refused. */
+export const CALLS_SFU_SSH_RULE_COMMAND = 'ufw allow 22/tcp';
+/** Run after any unscoped signalling rule is removed, in this order. */
+export const CALLS_SFU_FIREWALL_COMMANDS = [
+    `ufw allow from ${CALLS_SFU_PRIVATE_CIDR} to any port ${LIVEKIT_SIGNALLING_PORT} proto tcp`,
+    `ufw allow ${LIVEKIT_MEDIA_TCP_PORT}/tcp`,
+    `ufw allow ${LIVEKIT_MEDIA_UDP_RANGE}/udp`,
+    'ufw default deny incoming',
+    'ufw default allow outgoing',
+    'ufw --force enable',
+];
 async function run(host, command) {
     const result = await host.exec(command);
     if (result.exitCode !== 0) {
@@ -290,16 +303,12 @@ export async function applyCallsSfu(host, config) {
     await host.writeFile(LIVEKIT_COMPOSE_PATH, dockerComposeYaml());
     await writeFileAtomically(host, LIVEKIT_CONFIG_PATH, livekitConfigYaml(config));
     await host.writeFile(CLOUDFLARED_ENV_PATH, cloudflaredEnvFile(config.cloudflaredTunnelToken));
-    await run(host, `docker compose -f ${LIVEKIT_COMPOSE_PATH} up -d`);
-    await run(host, 'ufw allow 22/tcp');
+    await run(host, CALLS_SFU_UP_COMMAND);
+    await run(host, CALLS_SFU_SSH_RULE_COMMAND);
     const status = await host.exec('ufw status');
     if (status.exitCode === 0 && hasUnscopedSignallingRule(status.stdout)) {
         await run(host, `ufw delete allow ${LIVEKIT_SIGNALLING_PORT}/tcp`);
     }
-    await run(host, `ufw allow from ${CALLS_SFU_PRIVATE_CIDR} to any port ${LIVEKIT_SIGNALLING_PORT} proto tcp`);
-    await run(host, `ufw allow ${LIVEKIT_MEDIA_TCP_PORT}/tcp`);
-    await run(host, `ufw allow ${LIVEKIT_MEDIA_UDP_RANGE}/udp`);
-    await run(host, 'ufw default deny incoming');
-    await run(host, 'ufw default allow outgoing');
-    await run(host, 'ufw --force enable');
+    for (const command of CALLS_SFU_FIREWALL_COMMANDS)
+        await run(host, command);
 }

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
 export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
-export type { DeclaredPlatform, PlatformService, PlatformServiceKey } from './platform.js';
+export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
 export type { PinnedVersions };
@@ -22,7 +22,7 @@ export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, File
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
@@ -47,7 +47,7 @@ export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEME
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './plan/index.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './plan/index.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
 export type { CallsSfuUrls } from './calls-sfu.js';
 export type { CallsSfuSshSession } from './calls-sfu-ssh-adapter.js';
 export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';

package/dist/index.js

@@ -13,7 +13,7 @@ export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
@@ -26,7 +26,7 @@ export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
 export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export { UnknownCallsSfuHostKeyError, toCallsSfuHostPort, applyCallsSfuOverSession, } from './calls-sfu-ssh-adapter.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';

package/dist/migrations/0050_platform_sfu_connection_revision.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: the platform's `sfu.connectionRevision`, a value a host
+-- changes when the SFU VM's SSH key, host key or tunnel token changes, so the
+-- platform plan shows the `sfu` step again. Declared; null until set.
+-- Mirrors src/store/schema.ts's `foundryDeclaredPlatform` table addition.
+
+alter table foundry_declared_platform
+  add column if not exists sfu_connection_revision text;

package/dist/plan/executor.d.ts

@@ -519,7 +519,7 @@ export interface WorkersPort {
 /**
  * One DNS record a Lettermint domain's own response says must be published --
  * `purpose` is Lettermint's own label (`return_path`, `dmarc`, `dkim_legacy`,
- * `dkim_primary`, `dkim_secondary`), replacing Resend's `record` field, from
+ * `dkim_primary`, `dkim_secondary`), replacing the earlier provider's `record` field, from
  * {@link LettermintPort.createDomain}/{@link LettermintPort.getDomain}, the
  * same shape https://lettermint.co/docs/api-reference/team/0.0.1/lettermint-team-openapi.json's
  * `DomainDnsRecordData` documents (`fqdn`/`content` renamed to this port's own
@@ -552,17 +552,17 @@ export interface LettermintProject {
  * has no Lettermint client yet, unlike Coolify/Cloudflare/ZITADEL above, so
  * this port names Lettermint's own REST shapes directly
  * (`.plans/2026-09-28-lettermint-api.md`, its own primary-source citations).
- * Replaces `ResendPort` (#138/#140), trimmed to what `coolifyApp`/`coolifyMail`
+ * Replaces the earlier mail port (#138/#140), trimmed to what `coolifyApp`/`coolifyMail`
  * below actually call.
  *
- * Unlike Resend's per-domain sending key, a Lettermint domain is
+ * Unlike the earlier provider's per-domain sending key, a Lettermint domain is
  * unrestricted by default -- any project in the team could send from it --
  * so a project's own domain access is a separate call
  * ({@link restrictDomainToProjects}), and the credential unit is a *project*,
  * not a per-domain key: Lettermint's API mints, at most, one live token per
  * project and has no call to list or revoke an individual token within one
  * (`.plans/2026-09-28-lettermint-api.md` §4), so `<slug>-app` is a project
- * name, never suffixed with a domain id the way Resend's key name was.
+ * name, never suffixed with a domain id the way the earlier provider's key name was.
  */
 export interface LettermintPort {
     /**
@@ -585,7 +585,7 @@ export interface LettermintPort {
     /**
      * Asks Lettermint to re-check DNS now. Never polled or awaited to
      * completion -- the same "do not block the plan on DNS propagation" rule
-     * `ResendPort.verifyDomain` followed: record the status, and let the next
+     * the earlier mail port followed: record the status, and let the next
      * apply re-check it.
      */
     verifyDomain(id: string): Promise<{
@@ -1959,7 +1959,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *
      * Mint rule ("Credential model"): the project is healthy when the app env
      * holds `LETTERMINT_API_TOKEN` and Lettermint lists exactly one project
-     * named `<slug>-app` -- unlike Resend's key, a Lettermint project's name
+     * named `<slug>-app` -- unlike the earlier provider's key, a Lettermint project's name
      * carries no domain id, since a domain switch is handled entirely by
      * {@link LettermintPort.restrictDomainToProjects} below and never needs a
      * fresh project. Otherwise a fresh project is created and its token
@@ -2754,7 +2754,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * upsert `publishMailDnsRecords` above uses for Stalwart's own records --
      * except an existing `_dmarc` record is never overwritten (a stricter
      * policy an org already set, `p=quarantine`/`p=reject`, should not be
-     * relaxed back to Lettermint's own default). Resend's own domain also
+     * relaxed back to Lettermint's own default). The earlier provider's domain also
      * carried an apex `SPF` TXT record that had to be merged into whatever SPF
      * record already existed there (RFC 7208: two `v=spf1` TXT records on one
      * name is a permerror); Lettermint's own DNS records

package/dist/plan/executor.js

@@ -354,10 +354,10 @@ const CMS_DATABASE_SCOPE_KEY = 'coolify_cms_database';
  * domain choice, the same way {@link APP_CLIENT_ID_SCOPE_KEY} carries a
  * public value out. All of that org's Lettermint work -- ensure domain,
  * restrict, publish DNS, verify -- now happens inside the same step that
- * reads this key (`ensureAppLettermintMail`), so unlike the Resend design
+ * reads this key (`ensureAppLettermintMail`), so unlike the earlier design
  * this rework replaces, no separate domain-id scope key is recorded: the
  * domain is looked up by name fresh each apply. Renamed from
- * `resend_mail_domain`.
+ * the earlier mail domain key.
  */
 const MAIL_DOMAIN_SCOPE_KEY = 'mail_domain';
 /**
@@ -2495,7 +2495,7 @@ export class FoundryStepExecutor {
      *
      * Mint rule ("Credential model"): the project is healthy when the app env
      * holds `LETTERMINT_API_TOKEN` and Lettermint lists exactly one project
-     * named `<slug>-app` -- unlike Resend's key, a Lettermint project's name
+     * named `<slug>-app` -- unlike the earlier provider's key, a Lettermint project's name
      * carries no domain id, since a domain switch is handled entirely by
      * {@link LettermintPort.restrictDomainToProjects} below and never needs a
      * fresh project. Otherwise a fresh project is created and its token
@@ -5188,7 +5188,7 @@ export class FoundryStepExecutor {
      * upsert `publishMailDnsRecords` above uses for Stalwart's own records --
      * except an existing `_dmarc` record is never overwritten (a stricter
      * policy an org already set, `p=quarantine`/`p=reject`, should not be
-     * relaxed back to Lettermint's own default). Resend's own domain also
+     * relaxed back to Lettermint's own default). The earlier provider's domain also
      * carried an apex `SPF` TXT record that had to be merged into whatever SPF
      * record already existed there (RFC 7208: two `v=spf1` TXT records on one
      * name is a permerror); Lettermint's own DNS records

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -23,7 +23,7 @@ export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from '
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
@@ -12,7 +12,7 @@ export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEME
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';

package/dist/plan/live.d.ts

@@ -23,9 +23,9 @@ export interface LiveResource {
     /**
      * `'sfu'` (#170) has no reader wired below -- there is no cheap way to
      * probe the calls SFU VM's own state over SSH during planning, so
-     * `platform-diff.ts`'s `planSfu` always plans its step when
-     * `DeclaredPlatform.sfu.enabled` is true, rather than diffing against a
-     * live resource the way every other system here does. It is still part of
+     * `platform-diff.ts`'s `planSfu` plans its step from a recorded
+     * fingerprint when `DeclaredPlatform.sfu.enabled` is true, rather than
+     * diffing against a live resource the way every other system here does. It is still part of
      * this union so `StepAction.system` (`diff.ts`) can name it. `'edge'`
      * (#317) is the same: a edge key has no live lookup of its own, the same
      * shape `ai`/`files` entry keys already follow.

package/dist/plan/plan-apply.js

@@ -1008,9 +1008,13 @@ export class FoundryPlanApply {
             store.getServiceIds(),
         ]);
         const sfuBlocked = await this.sfuBlockedReason(platform);
+        const callsOrgSlugs = (await this.store.list())
+            .filter((org) => org.calls.enabled)
+            .map((org) => org.slug);
         const detail = computePlatformPlanDetail(platform, live, {
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
+            callsOrgSlugs,
             recordedIds: serviceIds,
             blocked: (await executor.blockedSteps?.(platform, serviceIds)) ?? {},
             drifted: (await executor.driftedSteps?.(platform, serviceIds)) ?? {},

package/dist/plan/platform-diff.d.ts

@@ -99,6 +99,11 @@ export declare function versionNotAppliedLine(service: string, appLive: boolean,
  * the same `platform:<service>` shape as {@link PLATFORM_AUTH_KEY}.
  */
 export declare const PLATFORM_ARCHON_KEY = "platform:archon";
+/**
+ * The fingerprint (`callsSfuAppliedFingerprint`) of the last successful `sfu`
+ * apply. `planSfu` plans the step again when it differs from the desired one.
+ */
+export declare const PLATFORM_SFU_APPLIED_SCOPE_KEY = "sfu_applied_fingerprint";
 /**
  * #175: the hostname and `gitRef` the last successful Archon run applied.
  * `planArchon` plans the step again when either differs from the declared
@@ -922,6 +927,11 @@ export interface PlanPlatformOptions {
     jobsObservable?: boolean;
     /** Why the shared SFU is blocked, or `null` when it is not (default `null`). */
     sfuBlocked?: string | null;
+    /**
+     * The slugs of orgs with `calls.enabled`. With it, `planSfu` plans the step
+     * only when the recorded fingerprint differs; absent, it always plans it.
+     */
+    callsOrgSlugs?: readonly string[];
     /** The platform's recorded resource/scope ids (default `{}`). */
     recordedIds?: Readonly<Record<string, string>>;
     /** Per-step block reasons the executor reports (default `{}`). */

package/dist/plan/platform-diff.js

@@ -4,6 +4,7 @@ import { APP_ENTRY_KEY } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
+import { callsSfuAppliedFingerprint } from './platform-sfu.js';
 import { withStepSystem } from './step-system.js';
 /**
  * The `Plan` (#19's public contract) a {@link PlatformPlanDetail} carries,
@@ -122,6 +123,11 @@ export function versionNotAppliedLine(service, appLive, applied, pinned) {
  * the same `platform:<service>` shape as {@link PLATFORM_AUTH_KEY}.
  */
 export const PLATFORM_ARCHON_KEY = 'platform:archon';
+/**
+ * The fingerprint (`callsSfuAppliedFingerprint`) of the last successful `sfu`
+ * apply. `planSfu` plans the step again when it differs from the desired one.
+ */
+export const PLATFORM_SFU_APPLIED_SCOPE_KEY = 'sfu_applied_fingerprint';
 /**
  * #175: the hostname and `gitRef` the last successful Archon run applied.
  * `planArchon` plans the step again when either differs from the declared
@@ -1056,7 +1062,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, recordedIds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, recordedIds = {}, blocked = {}, drifted = {}, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1071,7 +1077,7 @@ export function planPlatform(platform, live, options = {}) {
     // A blocked SFU is reported in `unmanaged`, not planned: a step the
     // executor must refuse would halt every step after it (`diff.ts` does the
     // same for a blocked Agora).
-    const sfu = platform.sfu.enabled && sfuBlocked ? null : planSfu(platform);
+    const sfu = platform.sfu.enabled && sfuBlocked ? null : planSfu(platform, callsOrgSlugs, recordedIds);
     if (sfu)
         plannedSteps.push(sfu);
     // #478, F4.dns: first of the services, ahead of auth. Edge is the only
@@ -1505,20 +1511,29 @@ function planBackups(byKey, claimed, recordedIds, executorMissing, storageDrifte
 /**
  * The platform's shared calls SFU (#170), keyed `sfu:livekit:platform` --
  * there is exactly one, so `key` names the platform itself rather than a
- * domain or an org id, the way `LiveResource`'s own doc comment explains for
- * this system. Unlike {@link planApexZone}, this step is never matched
- * against a live resource: there is no cheap way to read the SFU VM's own
- * state over SSH during planning (`LiveResource`'s doc comment on the `sfu`
- * system), so the step is planned whenever `platform.sfu.enabled` is true,
- * full stop. That is safe rather than wasteful: `applyCallsSfu`
- * (`calls-sfu.ts`'s own top doc comment) is built to be re-run, so an apply
- * that runs this step again writes the same files and runs the same
- * idempotent `docker compose`/`ufw` commands, changing nothing on a VM
- * already caught up.
- */
-function planSfu(platform) {
+ * domain or an org id. It is never matched against a live resource: there is
+ * no cheap way to read the SFU VM's own state over SSH during planning
+ * (`LiveResource`'s doc comment on the `sfu` system). Instead the executor
+ * records {@link callsSfuAppliedFingerprint} after a successful apply, and
+ * with `callsOrgSlugs` the step is planned only when that record differs
+ * from the desired one (new org set, changed calls files, new
+ * `sfu.connectionRevision`). Without `callsOrgSlugs` it is planned whenever
+ * `platform.sfu.enabled` is true. Planning it needlessly is safe:
+ * `applyCallsSfu` is built to be re-run.
+ */
+function planSfu(platform, callsOrgSlugs, recordedIds) {
     if (!platform.sfu.enabled)
         return null;
+    if (callsOrgSlugs &&
+        recordedIds[PLATFORM_SFU_APPLIED_SCOPE_KEY] ===
+            callsSfuAppliedFingerprint({
+                orgSlugs: callsOrgSlugs,
+                ...(platform.sfu.connectionRevision
+                    ? { connectionRevision: platform.sfu.connectionRevision }
+                    : {}),
+            })) {
+        return null;
+    }
     const action = {
         system: 'sfu',
         kind: 'livekit',

package/dist/plan/platform-org.d.ts

@@ -79,10 +79,9 @@ export interface OrgPlatformReadiness {
     aiUrl?: string | null;
     /**
      * The shared calls SFU (#170) an org's own calls Matrix stack depends on.
-     * Declared is enough here: unlike the others, `platform-diff.ts`'s
-     * `planSfu` never diffs the SFU against a live resource either (its own
-     * doc comment: "there is no cheap way to read the SFU VM's own state over
-     * SSH during planning"), so "applied" has no separate signal to check.
+     * Declared is enough here: `platform-diff.ts`'s `planSfu` plans the step
+     * from a recorded fingerprint, which is no signal an org's plan could
+     * read, so "applied" has no separate check.
      */
     callsReady: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */

package/dist/plan/platform-providers.d.ts

@@ -805,7 +805,7 @@ export declare function createAiManagementKeyMinter(options: {
  * `_FILE` (#209 mints and pushes this once it lands) and `LETTERMINT_API_TOKEN`
  * (#210: `wtfalch/auth#138` moved the broker's account mail onto
  * `@wtfalch/mailer`'s Lettermint transport, so this is the env name the
- * broker actually reads now, not `RESEND_API_TOKEN`). Read from the broker's
+ * broker actually reads now, not the earlier provider's token). Read from the broker's
  * own live env, not a recorded scope id: whichever of #209/#210 lands first
  * (or a human, setting either directly on the app) is enough to clear that
  * one input, in either order, with no coupling to this step's own execution.

package/dist/plan/platform-providers.js

@@ -9,8 +9,8 @@ import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrSta
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
-import { applyCallsSfuPlatformStep } from './platform-sfu.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -644,7 +644,7 @@ export class FoundryPlatformStepExecutor {
             return provisionPlatformBackupStorage(context, this.backup);
         }
         if (action.system === 'sfu' && action.kind === 'livekit') {
-            return this.executeSfu();
+            return this.executeSfu(context);
         }
         throw new Error(`platform step ${action.system}:${action.kind} is not built yet`);
     }
@@ -670,7 +670,7 @@ export class FoundryPlatformStepExecutor {
      * Sorted by slug so a re-run with the same set of enabled orgs is a no-op
      * even before `applyCallsSfuPlatformStep`'s own sort (its doc comment).
      */
-    async executeSfu() {
+    async executeSfu(context) {
         if (!this.sfu) {
             throw new Error('platform step sfu:livekit is not built yet (#170: pass `sfu` to FoundryPlatformStepExecutor)');
         }
@@ -680,6 +680,13 @@ export class FoundryPlatformStepExecutor {
             .map((org) => org.slug)
             .sort();
         await applyCallsSfuPlatformStep(this.sfu, orgSlugs);
+        // Only after the apply succeeded: a failed apply records nothing, so the
+        // next plan shows the step again.
+        const { connectionRevision } = context.platform.sfu;
+        context.recordScopeId(PLATFORM_SFU_APPLIED_SCOPE_KEY, callsSfuAppliedFingerprint({
+            orgSlugs,
+            ...(connectionRevision ? { connectionRevision } : {}),
+        }));
         return undefined;
     }
     async coolifyJobs(action, context) {
@@ -1150,7 +1157,7 @@ async function liveLoginClientTokenHash(coolify, appId) {
  *   `IAM_LOGIN_CLIENT` machine user (never the admin one, which is
  *   `IAM_OWNER`) and delivers its token to both apps, once the broker's
  *   other required inputs are already met.
- * - ~~The broker never receives `RESEND_API_TOKEN` either, so it will not
+ * - ~~The broker never receives the earlier mail provider's token either, so it will not
  *   start on `AUTH_APPS` alone.~~ Closed by #210, once `wtfalch/auth#138`
  *   moved the broker's account mail onto `@wtfalch/mailer`'s Lettermint
  *   transport: this function now reads the key back from
@@ -2029,8 +2036,8 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  * instance-bootstrap helper `wtfalch-manage` already uses for the hand-built
  * `mail.wtfalch.dev`: that plan also wires an `AcmeProvider` and `DnsServer`
  * for Stalwart's own DNS-01 ACME challenge, and an `MtaRoute` that relays
- * every outbound message through Resend -- the estate moved transactional
- * mail off Resend onto Lettermint before this issue (`@wtfalch/mailer` ADR
+ * every outbound message through the earlier mail provider -- the estate moved transactional
+ * mail off it onto Lettermint before this issue (`@wtfalch/mailer` ADR
  * 0006), and this step provisions no Cloudflare DNS token for Stalwart's own
  * ACME either. Calling it as-is would mint an outbound relay this platform
  * does not want and a credential requirement this issue does not cover, so
@@ -2042,7 +2049,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  * William's review"):
  * - **No ACME/TLS for the SMTP listener.** `mx.<apex>` answers with
  *   Stalwart's own self-signed certificate until a follow-up wires a real
- *   one (`mailObjects`'s `AcmeProvider`/`DnsServer` shape, minus the Resend
+ *   one (`mailObjects`'s `AcmeProvider`/`DnsServer` shape, minus the earlier relay
  *   relay it also carries).
  * - **The Lettermint team token the org app step reads still comes from
  *   wherever the host already reads it, not held keys.** Needs
@@ -5044,7 +5051,7 @@ async function findOrCreatePlatformApp(coolify, name, environment, create) {
  * `_FILE` (#209 mints and pushes this once it lands) and `LETTERMINT_API_TOKEN`
  * (#210: `wtfalch/auth#138` moved the broker's account mail onto
  * `@wtfalch/mailer`'s Lettermint transport, so this is the env name the
- * broker actually reads now, not `RESEND_API_TOKEN`). Read from the broker's
+ * broker actually reads now, not the earlier provider's token). Read from the broker's
  * own live env, not a recorded scope id: whichever of #209/#210 lands first
  * (or a human, setting either directly on the app) is enough to clear that
  * one input, in either order, with no coupling to this step's own execution.

package/dist/plan/platform-sfu.d.ts

@@ -37,6 +37,16 @@
  */
 import { type LivekitCredentials } from '../calls-sfu-keys.js';
 import { type CallsSfuSshSession } from '../calls-sfu-ssh-adapter.js';
+/**
+ * What the last successful `sfu` apply is recorded as
+ * (`PLATFORM_SFU_APPLIED_SCOPE_KEY`): a SHA-256 hex digest of foundry's calls
+ * files, the sorted distinct org slugs and the connection revision. It holds
+ * no secret and does not depend on slug order or duplicates.
+ */
+export declare function callsSfuAppliedFingerprint(input: {
+    orgSlugs: readonly string[];
+    connectionRevision?: string;
+}): string;
 /** The SFU VM's own address, SSH credentials and host key fingerprint -- held keys a human stored ahead of time. */
 export interface CallsSfuConnection {
     address: string;

package/dist/plan/platform-sfu.js

@@ -35,9 +35,48 @@
  * live outside this package. `calls-sfu-ssh-adapter.ts`'s {@link CallsSfuSshSession} is the narrow shape
  * a test fakes instead.
  */
+import { createHash } from 'node:crypto';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { mintLivekitCredentials } from '../calls-sfu-keys.js';
 import { applyCallsSfuOverSession } from '../calls-sfu-ssh-adapter.js';
+import { CALLS_SFU_FIREWALL_COMMANDS, CALLS_SFU_SSH_RULE_COMMAND, CALLS_SFU_UP_COMMAND, cloudflaredEnvFile, dockerComposeYaml, livekitConfigYaml, } from '../calls-sfu.js';
+/**
+ * Hash of what `applyCallsSfu` writes and runs, rendered from placeholder
+ * values so no secret is involved: a change to the compose file, the
+ * `livekit.yaml` template, the env file template or a command changes it.
+ */
+function callsSfuFilesVersion() {
+    const placeholder = {
+        address: 'address',
+        livekitKeys: { key: 'secret' },
+        cloudflaredTunnelToken: 'token',
+    };
+    return createHash('sha256')
+        .update(JSON.stringify([
+        dockerComposeYaml(),
+        livekitConfigYaml(placeholder),
+        cloudflaredEnvFile(placeholder.cloudflaredTunnelToken),
+        CALLS_SFU_UP_COMMAND,
+        CALLS_SFU_SSH_RULE_COMMAND,
+        CALLS_SFU_FIREWALL_COMMANDS,
+    ]))
+        .digest('hex');
+}
+/**
+ * What the last successful `sfu` apply is recorded as
+ * (`PLATFORM_SFU_APPLIED_SCOPE_KEY`): a SHA-256 hex digest of foundry's calls
+ * files, the sorted distinct org slugs and the connection revision. It holds
+ * no secret and does not depend on slug order or duplicates.
+ */
+export function callsSfuAppliedFingerprint(input) {
+    return createHash('sha256')
+        .update(JSON.stringify([
+        callsSfuFilesVersion(),
+        [...new Set(input.orgSlugs)].sort(),
+        input.connectionRevision ?? '',
+    ]))
+        .digest('hex');
+}
 /**
  * The key id the platform's own LiveKit pair is held under, alongside every
  * org's own pair, in the same {@link CallsSfuKeysPort} (#152 round 2 review:

package/dist/platform.d.ts

@@ -12,6 +12,14 @@ export interface PlatformService {
     hostname: string;
     gitRef: string;
 }
+/**
+ * `sfu`'s own extra field. A host that changes what the SFU VM is reached
+ * with (its SSH key, host key or tunnel token) sets a new `connectionRevision`
+ * so the platform plan shows the `sfu` step again; foundry never reads it.
+ */
+export interface PlatformSfuService extends PlatformService {
+    connectionRevision?: string;
+}
 /**
  * #491: `mail`'s own extra field, on top of every other service's shape.
  * Company Included (or whichever org's mail domain is the platform's own
@@ -76,7 +84,7 @@ export interface DeclaredPlatform {
     serverIpv4?: string | null;
     auth: PlatformService;
     mail: PlatformMailService;
-    sfu: PlatformService;
+    sfu: PlatformSfuService;
     files: PlatformService;
     ai: PlatformService;
     jobs: PlatformService;
@@ -116,6 +124,8 @@ export declare function defaultPlatformHostname(service: PlatformServiceKey, ape
  * - `serverIpv4`, when declared, is a dotted-quad IPv4 address.
  * - Every service's `hostname` is the apex itself or a subdomain of it -- a
  *   platform service does not live outside the platform's own apex.
+ * - `sfu.connectionRevision`, when declared, is at most 64 characters of
+ *   `A-Za-z0-9:.-`.
  * - Every service's `gitRef` is non-empty once that service is `enabled` --
  *   an enabled service with nothing to deploy is not yet declared.
  */

package/dist/platform.js

@@ -32,6 +32,8 @@ function serviceOf(platform, key) {
  * - `serverIpv4`, when declared, is a dotted-quad IPv4 address.
  * - Every service's `hostname` is the apex itself or a subdomain of it -- a
  *   platform service does not live outside the platform's own apex.
+ * - `sfu.connectionRevision`, when declared, is at most 64 characters of
+ *   `A-Za-z0-9:.-`.
  * - Every service's `gitRef` is non-empty once that service is `enabled` --
  *   an enabled service with nothing to deploy is not yet declared.
  */
@@ -54,6 +56,10 @@ export function validatePlatform(platform) {
             return `${key}.gitRef must not be empty once ${key}.enabled is true`;
         }
     }
+    const revision = platform.sfu.connectionRevision;
+    if (revision != null && !/^[A-Za-z0-9:.-]{0,64}$/.test(revision)) {
+        return 'sfu.connectionRevision must be at most 64 characters of A-Z, a-z, 0-9, ":", "." and "-"';
+    }
     const { uptime } = platform;
     if (Boolean(uptime.tag.trim()) !== Boolean(uptime.sha256.trim())) {
         return 'uptime.tag and uptime.sha256 must be set together: a pin is both';

package/dist/store/postgres.js

@@ -606,7 +606,12 @@ function rowToPlatform(row) {
             gitRef: row.mailGitRef,
             ...(row.mailLettermintProjectId ? { lettermintProjectId: row.mailLettermintProjectId } : {}),
         },
-        sfu: { enabled: row.sfuEnabled, hostname: row.sfuHostname, gitRef: row.sfuGitRef },
+        sfu: {
+            enabled: row.sfuEnabled,
+            hostname: row.sfuHostname,
+            gitRef: row.sfuGitRef,
+            ...(row.sfuConnectionRevision ? { connectionRevision: row.sfuConnectionRevision } : {}),
+        },
         files: { enabled: row.filesEnabled, hostname: row.filesHostname, gitRef: row.filesGitRef },
         ai: { enabled: row.aiEnabled, hostname: row.aiHostname, gitRef: row.aiGitRef },
         jobs: { enabled: row.jobsEnabled, hostname: row.jobsHostname, gitRef: row.jobsGitRef },
@@ -654,6 +659,7 @@ function platformToRow(platform) {
         sfuEnabled: platform.sfu.enabled,
         sfuHostname: platform.sfu.hostname,
         sfuGitRef: platform.sfu.gitRef,
+        sfuConnectionRevision: platform.sfu.connectionRevision ?? null,
         filesEnabled: platform.files.enabled,
         filesHostname: platform.files.hostname,
         filesGitRef: platform.files.gitRef,

package/dist/store/schema.d.ts

@@ -1643,6 +1643,23 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        sfuConnectionRevision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sfu_connection_revision";
+            tableName: "foundry_declared_platform";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         filesEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "files_enabled";
             tableName: "foundry_declared_platform";

package/dist/store/schema.js

@@ -165,6 +165,8 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     sfuEnabled: boolean('sfu_enabled').notNull().default(false),
     sfuHostname: text('sfu_hostname').notNull(),
     sfuGitRef: text('sfu_git_ref').notNull().default(''),
+    /** `migrations/0050_platform_sfu_connection_revision.sql`. Declared; null means unset. */
+    sfuConnectionRevision: text('sfu_connection_revision'),
     filesEnabled: boolean('files_enabled').notNull().default(false),
     filesHostname: text('files_hostname').notNull(),
     filesGitRef: text('files_git_ref').notNull().default(''),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",