@wtfalch/foundry 0.27.0 → 0.29.0

package/dist/plan/executor.js

@@ -3,7 +3,7 @@ import { URL } from 'node:url';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, chatInternalNames, chatMasConfigYaml, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -354,10 +354,10 @@ const CMS_DATABASE_SCOPE_KEY = 'coolify_cms_database';
  * domain choice, the same way {@link APP_CLIENT_ID_SCOPE_KEY} carries a
  * public value out. All of that org's Lettermint work -- ensure domain,
  * restrict, publish DNS, verify -- now happens inside the same step that
- * reads this key (`ensureAppLettermintMail`), so unlike the Resend design
+ * reads this key (`ensureAppLettermintMail`), so unlike the earlier design
  * this rework replaces, no separate domain-id scope key is recorded: the
  * domain is looked up by name fresh each apply. Renamed from
- * `resend_mail_domain`.
+ * the earlier mail domain key.
  */
 const MAIL_DOMAIN_SCOPE_KEY = 'mail_domain';
 /**
@@ -2493,9 +2493,13 @@ export class FoundryStepExecutor {
      * domain restricted to them before any old project is deleted, so the
      * restriction list never becomes empty.
      *
+     * #654: the non-platform-apex part now lives in {@link ensureOrgAppMailToken},
+     * shared with Boule, which holds the same token; the rule below is its rule
+     * with the consumers read from the hosted app and Boule.
+     *
      * Mint rule ("Credential model"): the project is healthy when the app env
      * holds `LETTERMINT_API_TOKEN` and Lettermint lists exactly one project
-     * named `<slug>-app` -- unlike Resend's key, a Lettermint project's name
+     * named `<slug>-app` -- unlike the earlier provider's key, a Lettermint project's name
      * carries no domain id, since a domain switch is handled entirely by
      * {@link LettermintPort.restrictDomainToProjects} below and never needs a
      * fresh project. Otherwise a fresh project is created and its token
@@ -2545,7 +2549,6 @@ export class FoundryStepExecutor {
         if (!hasPlatformApexField) {
             throw new Error(`coolify:app for ${org.slug}: this step's plan carries no platformApex; plan this org's app again`);
         }
-        const appName = `${org.slug}-app`;
         // #491: an org whose mail domain is the platform's own apex (Company
         // Included on companyincluded.com, today) shares the platform's existing
         // Lettermint project rather than minting a `<slug>-app` one of its own --
@@ -2588,44 +2591,129 @@ export class FoundryStepExecutor {
                 await this.ports.coolify.restart(appId);
             return;
         }
-        const [projects, envs] = await Promise.all([
+        await this.ensureOrgAppMailToken({
+            org,
+            context,
+            mailDomain,
+            self: { role: 'app', id: appId, restart: running },
+            mailFrom: `${org.mail.noReplyLocalPart ?? 'no-reply'}@${mailDomain}`,
+            platformApex,
+            platformLettermintProjectId,
+        });
+    }
+    /**
+     * The one mint rule for the org's `<slug>-app` Lettermint token, shared by
+     * the hosted app (`ensureAppLettermintMail`) and Boule
+     * (`ensureBouleMail`), which hold the same token. Lettermint shows a
+     * token once, so the token lives only in those apps' envs: the rule reads
+     * every consumer that is recorded (the hosted app first, Boule second).
+     * The project is healthy when Lettermint lists exactly one `<slug>-app`
+     * project and some consumer holds a token. A healthy rule gives `self` that
+     * token (the app's wins) when it lacks it or holds another; a peer gets it
+     * in its own step. An
+     * unhealthy one mints a fresh project and writes its token to every
+     * consumer, restarting those that run, before any other `<slug>-app`
+     * project is deleted. Either role may run first: an app added after Boule
+     * adopts Boule's token instead of deleting its project.
+     *
+     * The token goes straight to `bulkUpsertEnvs` and nowhere else: never
+     * returned, recorded, logged or interpolated into an error. Returns
+     * whether `self`'s own token changed and whether it was restarted here.
+     *
+     * A peer recorded but gone from Coolify (404) is no consumer. A healthy
+     * company's step writes only its own env; a re-mint writes every live
+     * consumer, restarts the running ones, restricts the domain, then deletes
+     * the old projects.
+     */
+    async ensureOrgAppMailToken(args) {
+        const { org, context, mailDomain, self, mailFrom } = args;
+        const appName = `${org.slug}-app`;
+        const recorded = context.recordedIds();
+        const appId = self.role === 'app' ? self.id : recorded[`coolify:app:${appStepKey(org)}`];
+        const bouleId = self.role === 'boule' ? self.id : recorded[`coolify:boule:${org.id}`];
+        const peerListEnvs = (id) => !id || id === self.id
+            ? Promise.resolve(null)
+            : // A recorded peer that Coolify no longer has is not a consumer: not
+                // read, written or restarted (same 404 rule as the retire step).
+                this.ports.coolify
+                    .listEnvs(id)
+                    .catch((error) => {
+                    if (!isNotFoundError(error))
+                        throw error;
+                    return null;
+                });
+        const [projects, selfEnvs, appEnvs, bouleEnvs] = await Promise.all([
             this.ports.lettermint.listProjects(),
-            this.ports.coolify.listEnvs(appId),
+            this.ports.coolify.listEnvs(self.id),
+            self.role === 'app' ? Promise.resolve(null) : peerListEnvs(appId),
+            self.role === 'boule' ? Promise.resolve(null) : peerListEnvs(bouleId),
         ]);
-        const envValue = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+        const tokenOf = (envs) => envs.find((e) => e.key === 'LETTERMINT_API_TOKEN' && !e.is_preview)?.value || undefined;
+        // The hosted app first, Boule second: the app's token wins a disagreement.
+        const consumers = [];
+        const appSlot = self.role === 'app' ? selfEnvs : appEnvs;
+        const bouleSlot = self.role === 'boule' ? selfEnvs : bouleEnvs;
+        if (appSlot && appId)
+            consumers.push({ id: appId, token: tokenOf(appSlot) });
+        if (bouleSlot && bouleId)
+            consumers.push({ id: bouleId, token: tokenOf(bouleSlot) });
+        const existingToken = consumers.find((c) => c.token)?.token;
         const ours = projects.filter((p) => p.name === appName);
         const held = ours.length === 1 ? ours[0] : undefined;
-        const healthy = held !== undefined && Boolean(envValue('LETTERMINT_API_TOKEN'));
+        const healthy = held !== undefined && existingToken !== undefined;
         let allProjects = projects;
         let keepProjectId;
-        const envUpdates = [];
-        if (healthy && held) {
+        let token;
+        if (healthy && held && existingToken) {
             keepProjectId = held.id;
+            token = existingToken;
         }
         else {
             const created = await this.ports.lettermint.createProject(appName);
             keepProjectId = created.project.id;
             allProjects = [...projects, created.project];
-            envUpdates.push({ key: 'LETTERMINT_API_TOKEN', value: created.token });
+            token = created.token;
+        }
+        // A healthy company: this step writes only its own env; a peer that lacks
+        // the token gets it in its own step. A re-mint kills the old token, so it
+        // reaches every live consumer here.
+        const targets = consumers.filter((c) => c.token !== token && (!healthy || c.id === self.id));
+        const selfChanged = targets.some((c) => c.id === self.id);
+        for (const consumer of consumers) {
+            const updates = [];
+            if (targets.includes(consumer))
+                updates.push({ key: 'LETTERMINT_API_TOKEN', value: token });
+            if (consumer.id === self.id && mailFrom)
+                updates.push({ key: 'MAIL_FROM', value: mailFrom });
+            if (updates.length > 0)
+                await this.ports.coolify.bulkUpsertEnvs(consumer.id, updates);
         }
-        envUpdates.push({
-            key: 'MAIL_FROM',
-            value: `${org.mail.noReplyLocalPart ?? 'no-reply'}@${mailDomain}`,
-        });
-        await this.ports.coolify.bulkUpsertEnvs(appId, envUpdates);
         // A running container read its env at start and still holds the old
-        // token, so a fresh one only reaches it through a restart -- before the
-        // old project is deleted below. A just-created app is deployed first (#566).
-        if (!healthy && running)
-            await this.ports.coolify.restart(appId);
-        await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
+        // token, so a fresh one only reaches it through a restart -- after every
+        // write and before the old project is deleted below, so a failure in
+        // between leaves the old project for the next apply to re-mint. A just-created
+        // app is deployed first (#566).
+        let selfRestarted = false;
+        for (const consumer of targets) {
+            const isSelf = consumer.id === self.id;
+            const running = isSelf
+                ? self.restart
+                : isRunningOrStarting((await this.ports.coolify.getApplication(consumer.id)).status);
+            if (!running)
+                continue;
+            await this.ports.coolify.restart(consumer.id);
+            if (isSelf)
+                selfRestarted = true;
+        }
+        await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, args.platformApex, args.platformLettermintProjectId);
         for (const project of allProjects) {
             if (project.name === appName &&
                 project.id !== keepProjectId &&
-                project.id !== platformLettermintProjectId) {
+                project.id !== args.platformLettermintProjectId) {
                 await this.ports.lettermint.deleteProject(project.id);
             }
         }
+        return { selfChanged, selfRestarted };
     }
     /**
      * #149: mints this org's own Lettermint relay credential and writes it to
@@ -4237,7 +4325,14 @@ export class FoundryStepExecutor {
         // written is the env the plan showed.
         const issuer = action.desired.issuer ?? null;
         const archonUrl = action.desired.archonUrl ?? null;
-        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl);
+        // The plan decides blocked mail (`mailBlocked`); a plan with no
+        // `platformApex` key predates this field and is refused before any mail
+        // env is written.
+        const mailWanted = bouleMailWanted(org, context.recordedIds()) && action.desired.mailBlocked !== true;
+        if (mailWanted && !('platformApex' in action.desired)) {
+            throw new Error(`coolify:boule for ${org.slug}: this step's plan carries no platformApex; plan this org's Boule again`);
+        }
+        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl, mailWanted);
         if (missing.length > 0) {
             throw new Error(`Boule for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
         }
@@ -4288,6 +4383,12 @@ export class FoundryStepExecutor {
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
+        // The org's Lettermint token, the same one its hosted app holds. A no-op
+        // for an org with mail off or no mail domain recorded: Boule then shows
+        // the invite link.
+        const mail = mailWanted
+            ? await this.ensureBouleMail(app.appId, org, context, action, app.existed && Boolean(context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]))
+            : { changed: false, restarted: false };
         // #504: see `coolifyAgora`'s own comment just above -- `createGithubAppApplication`
         // never sets `instant_deploy`, so a brand new app (or one found by name
         // that a previous apply created but crashed before deploying) sat built
@@ -4300,11 +4401,53 @@ export class FoundryStepExecutor {
             context.recordScopeId(BOULE_DEPLOYED_SCOPE_KEY, '1');
         }
         else if (app.existed &&
-            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed)) {
+            !mail.restarted &&
+            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed || mail.changed)) {
+            // A restart inside the mail rule already came after every env write above.
             await this.ports.coolify.restart(app.appId);
         }
         return { resourceId: app.appId };
     }
+    /**
+     * Gives Boule `LETTERMINT_API_TOKEN`: the platform's held key for an org on
+     * the platform's own apex, else the org's `<slug>-app` token through the
+     * shared mint rule ({@link ensureOrgAppMailToken}), which mints that project
+     * when no hosted app made it yet. `MAIL_FROM` is written with the rest of
+     * Boule's env. Returns whether Boule's token changed, so the caller
+     * restarts a running Boule, unless `restarted`: the shared rule then already
+     * restarted it (`running`), before it deleted the old project.
+     */
+    async ensureBouleMail(appId, org, context, action, running) {
+        const none = { changed: false, restarted: false };
+        const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
+        if (!mailDomain)
+            return none;
+        const platformApex = action.desired.platformApex ?? null;
+        const platformLettermintProjectId = action.desired.platformLettermintProjectId ?? null;
+        if (platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase()) {
+            const heldToken = (await this.ports.heldKeys?.resolve(PLATFORM_AUTH_BROKER_MAIL_KEY_REF)) ?? null;
+            if (!heldToken) {
+                throw new Error(`coolify:boule for ${org.slug}: the platform's own Lettermint token is not held yet (held-key ref ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF})`);
+            }
+            const current = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === 'LETTERMINT_API_TOKEN' && !e.is_preview)?.value;
+            if (current === heldToken)
+                return none;
+            await this.ports.coolify.bulkUpsertEnvs(appId, [
+                { key: 'LETTERMINT_API_TOKEN', value: heldToken },
+            ]);
+            return { changed: true, restarted: false };
+        }
+        const { selfChanged, selfRestarted } = await this.ensureOrgAppMailToken({
+            org,
+            context,
+            mailDomain,
+            self: { role: 'boule', id: appId, restart: running },
+            mailFrom: null,
+            platformApex,
+            platformLettermintProjectId,
+        });
+        return { changed: selfChanged, restarted: selfRestarted };
+    }
     // ---- jobs (#173) ---------------------------------------------------------
     /**
      * `plan/diff.ts`'s `planJobsRegistration`: registers the org's own app with
@@ -5188,7 +5331,7 @@ export class FoundryStepExecutor {
      * upsert `publishMailDnsRecords` above uses for Stalwart's own records --
      * except an existing `_dmarc` record is never overwritten (a stricter
      * policy an org already set, `p=quarantine`/`p=reject`, should not be
-     * relaxed back to Lettermint's own default). Resend's own domain also
+     * relaxed back to Lettermint's own default). The earlier provider's domain also
      * carried an apex `SPF` TXT record that had to be merged into whatever SPF
      * record already existed there (RFC 7208: two `v=spf1` TXT records on one
      * name is a permerror); Lettermint's own DNS records

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -23,7 +23,7 @@ export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from '
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
@@ -12,7 +12,7 @@ export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEME
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
-export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
+export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';

package/dist/plan/live.d.ts

@@ -23,9 +23,9 @@ export interface LiveResource {
     /**
      * `'sfu'` (#170) has no reader wired below -- there is no cheap way to
      * probe the calls SFU VM's own state over SSH during planning, so
-     * `platform-diff.ts`'s `planSfu` always plans its step when
-     * `DeclaredPlatform.sfu.enabled` is true, rather than diffing against a
-     * live resource the way every other system here does. It is still part of
+     * `platform-diff.ts`'s `planSfu` plans its step from a recorded
+     * fingerprint when `DeclaredPlatform.sfu.enabled` is true, rather than
+     * diffing against a live resource the way every other system here does. It is still part of
      * this union so `StepAction.system` (`diff.ts`) can name it. `'edge'`
      * (#317) is the same: a edge key has no live lookup of its own, the same
      * shape `ai`/`files` entry keys already follow.

package/dist/plan/plan-apply.js

@@ -1008,9 +1008,13 @@ export class FoundryPlanApply {
             store.getServiceIds(),
         ]);
         const sfuBlocked = await this.sfuBlockedReason(platform);
+        const callsOrgSlugs = (await this.store.list())
+            .filter((org) => org.calls.enabled)
+            .map((org) => org.slug);
         const detail = computePlatformPlanDetail(platform, live, {
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
+            callsOrgSlugs,
             recordedIds: serviceIds,
             blocked: (await executor.blockedSteps?.(platform, serviceIds)) ?? {},
             drifted: (await executor.driftedSteps?.(platform, serviceIds)) ?? {},

package/dist/plan/platform-diff.d.ts

@@ -99,6 +99,11 @@ export declare function versionNotAppliedLine(service: string, appLive: boolean,
  * the same `platform:<service>` shape as {@link PLATFORM_AUTH_KEY}.
  */
 export declare const PLATFORM_ARCHON_KEY = "platform:archon";
+/**
+ * The fingerprint (`callsSfuAppliedFingerprint`) of the last successful `sfu`
+ * apply. `planSfu` plans the step again when it differs from the desired one.
+ */
+export declare const PLATFORM_SFU_APPLIED_SCOPE_KEY = "sfu_applied_fingerprint";
 /**
  * #175: the hostname and `gitRef` the last successful Archon run applied.
  * `planArchon` plans the step again when either differs from the declared
@@ -922,6 +927,11 @@ export interface PlanPlatformOptions {
     jobsObservable?: boolean;
     /** Why the shared SFU is blocked, or `null` when it is not (default `null`). */
     sfuBlocked?: string | null;
+    /**
+     * The slugs of orgs with `calls.enabled`. With it, `planSfu` plans the step
+     * only when the recorded fingerprint differs; absent, it always plans it.
+     */
+    callsOrgSlugs?: readonly string[];
     /** The platform's recorded resource/scope ids (default `{}`). */
     recordedIds?: Readonly<Record<string, string>>;
     /** Per-step block reasons the executor reports (default `{}`). */

package/dist/plan/platform-diff.js

@@ -4,6 +4,7 @@ import { APP_ENTRY_KEY } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
+import { callsSfuAppliedFingerprint } from './platform-sfu.js';
 import { withStepSystem } from './step-system.js';
 /**
  * The `Plan` (#19's public contract) a {@link PlatformPlanDetail} carries,
@@ -122,6 +123,11 @@ export function versionNotAppliedLine(service, appLive, applied, pinned) {
  * the same `platform:<service>` shape as {@link PLATFORM_AUTH_KEY}.
  */
 export const PLATFORM_ARCHON_KEY = 'platform:archon';
+/**
+ * The fingerprint (`callsSfuAppliedFingerprint`) of the last successful `sfu`
+ * apply. `planSfu` plans the step again when it differs from the desired one.
+ */
+export const PLATFORM_SFU_APPLIED_SCOPE_KEY = 'sfu_applied_fingerprint';
 /**
  * #175: the hostname and `gitRef` the last successful Archon run applied.
  * `planArchon` plans the step again when either differs from the declared
@@ -1056,7 +1062,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, recordedIds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, recordedIds = {}, blocked = {}, drifted = {}, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1071,7 +1077,7 @@ export function planPlatform(platform, live, options = {}) {
     // A blocked SFU is reported in `unmanaged`, not planned: a step the
     // executor must refuse would halt every step after it (`diff.ts` does the
     // same for a blocked Agora).
-    const sfu = platform.sfu.enabled && sfuBlocked ? null : planSfu(platform);
+    const sfu = platform.sfu.enabled && sfuBlocked ? null : planSfu(platform, callsOrgSlugs, recordedIds);
     if (sfu)
         plannedSteps.push(sfu);
     // #478, F4.dns: first of the services, ahead of auth. Edge is the only
@@ -1505,20 +1511,29 @@ function planBackups(byKey, claimed, recordedIds, executorMissing, storageDrifte
 /**
  * The platform's shared calls SFU (#170), keyed `sfu:livekit:platform` --
  * there is exactly one, so `key` names the platform itself rather than a
- * domain or an org id, the way `LiveResource`'s own doc comment explains for
- * this system. Unlike {@link planApexZone}, this step is never matched
- * against a live resource: there is no cheap way to read the SFU VM's own
- * state over SSH during planning (`LiveResource`'s doc comment on the `sfu`
- * system), so the step is planned whenever `platform.sfu.enabled` is true,
- * full stop. That is safe rather than wasteful: `applyCallsSfu`
- * (`calls-sfu.ts`'s own top doc comment) is built to be re-run, so an apply
- * that runs this step again writes the same files and runs the same
- * idempotent `docker compose`/`ufw` commands, changing nothing on a VM
- * already caught up.
- */
-function planSfu(platform) {
+ * domain or an org id. It is never matched against a live resource: there is
+ * no cheap way to read the SFU VM's own state over SSH during planning
+ * (`LiveResource`'s doc comment on the `sfu` system). Instead the executor
+ * records {@link callsSfuAppliedFingerprint} after a successful apply, and
+ * with `callsOrgSlugs` the step is planned only when that record differs
+ * from the desired one (new org set, changed calls files, new
+ * `sfu.connectionRevision`). Without `callsOrgSlugs` it is planned whenever
+ * `platform.sfu.enabled` is true. Planning it needlessly is safe:
+ * `applyCallsSfu` is built to be re-run.
+ */
+function planSfu(platform, callsOrgSlugs, recordedIds) {
     if (!platform.sfu.enabled)
         return null;
+    if (callsOrgSlugs &&
+        recordedIds[PLATFORM_SFU_APPLIED_SCOPE_KEY] ===
+            callsSfuAppliedFingerprint({
+                orgSlugs: callsOrgSlugs,
+                ...(platform.sfu.connectionRevision
+                    ? { connectionRevision: platform.sfu.connectionRevision }
+                    : {}),
+            })) {
+        return null;
+    }
     const action = {
         system: 'sfu',
         kind: 'livekit',

package/dist/plan/platform-org.d.ts

@@ -79,10 +79,9 @@ export interface OrgPlatformReadiness {
     aiUrl?: string | null;
     /**
      * The shared calls SFU (#170) an org's own calls Matrix stack depends on.
-     * Declared is enough here: unlike the others, `platform-diff.ts`'s
-     * `planSfu` never diffs the SFU against a live resource either (its own
-     * doc comment: "there is no cheap way to read the SFU VM's own state over
-     * SSH during planning"), so "applied" has no separate signal to check.
+     * Declared is enough here: `platform-diff.ts`'s `planSfu` plans the step
+     * from a recorded fingerprint, which is no signal an org's plan could
+     * read, so "applied" has no separate check.
      */
     callsReady: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */

package/dist/plan/platform-providers.d.ts

@@ -805,7 +805,7 @@ export declare function createAiManagementKeyMinter(options: {
  * `_FILE` (#209 mints and pushes this once it lands) and `LETTERMINT_API_TOKEN`
  * (#210: `wtfalch/auth#138` moved the broker's account mail onto
  * `@wtfalch/mailer`'s Lettermint transport, so this is the env name the
- * broker actually reads now, not `RESEND_API_TOKEN`). Read from the broker's
+ * broker actually reads now, not the earlier provider's token). Read from the broker's
  * own live env, not a recorded scope id: whichever of #209/#210 lands first
  * (or a human, setting either directly on the app) is enough to clear that
  * one input, in either order, with no coupling to this step's own execution.

package/dist/plan/platform-providers.js

@@ -9,8 +9,8 @@ import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrSta
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
-import { applyCallsSfuPlatformStep } from './platform-sfu.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -644,7 +644,7 @@ export class FoundryPlatformStepExecutor {
             return provisionPlatformBackupStorage(context, this.backup);
         }
         if (action.system === 'sfu' && action.kind === 'livekit') {
-            return this.executeSfu();
+            return this.executeSfu(context);
         }
         throw new Error(`platform step ${action.system}:${action.kind} is not built yet`);
     }
@@ -670,7 +670,7 @@ export class FoundryPlatformStepExecutor {
      * Sorted by slug so a re-run with the same set of enabled orgs is a no-op
      * even before `applyCallsSfuPlatformStep`'s own sort (its doc comment).
      */
-    async executeSfu() {
+    async executeSfu(context) {
         if (!this.sfu) {
             throw new Error('platform step sfu:livekit is not built yet (#170: pass `sfu` to FoundryPlatformStepExecutor)');
         }
@@ -680,6 +680,13 @@ export class FoundryPlatformStepExecutor {
             .map((org) => org.slug)
             .sort();
         await applyCallsSfuPlatformStep(this.sfu, orgSlugs);
+        // Only after the apply succeeded: a failed apply records nothing, so the
+        // next plan shows the step again.
+        const { connectionRevision } = context.platform.sfu;
+        context.recordScopeId(PLATFORM_SFU_APPLIED_SCOPE_KEY, callsSfuAppliedFingerprint({
+            orgSlugs,
+            ...(connectionRevision ? { connectionRevision } : {}),
+        }));
         return undefined;
     }
     async coolifyJobs(action, context) {
@@ -1150,7 +1157,7 @@ async function liveLoginClientTokenHash(coolify, appId) {
  *   `IAM_LOGIN_CLIENT` machine user (never the admin one, which is
  *   `IAM_OWNER`) and delivers its token to both apps, once the broker's
  *   other required inputs are already met.
- * - ~~The broker never receives `RESEND_API_TOKEN` either, so it will not
+ * - ~~The broker never receives the earlier mail provider's token either, so it will not
  *   start on `AUTH_APPS` alone.~~ Closed by #210, once `wtfalch/auth#138`
  *   moved the broker's account mail onto `@wtfalch/mailer`'s Lettermint
  *   transport: this function now reads the key back from
@@ -2029,8 +2036,8 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  * instance-bootstrap helper `wtfalch-manage` already uses for the hand-built
  * `mail.wtfalch.dev`: that plan also wires an `AcmeProvider` and `DnsServer`
  * for Stalwart's own DNS-01 ACME challenge, and an `MtaRoute` that relays
- * every outbound message through Resend -- the estate moved transactional
- * mail off Resend onto Lettermint before this issue (`@wtfalch/mailer` ADR
+ * every outbound message through the earlier mail provider -- the estate moved transactional
+ * mail off it onto Lettermint before this issue (`@wtfalch/mailer` ADR
  * 0006), and this step provisions no Cloudflare DNS token for Stalwart's own
  * ACME either. Calling it as-is would mint an outbound relay this platform
  * does not want and a credential requirement this issue does not cover, so
@@ -2042,7 +2049,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  * William's review"):
  * - **No ACME/TLS for the SMTP listener.** `mx.<apex>` answers with
  *   Stalwart's own self-signed certificate until a follow-up wires a real
- *   one (`mailObjects`'s `AcmeProvider`/`DnsServer` shape, minus the Resend
+ *   one (`mailObjects`'s `AcmeProvider`/`DnsServer` shape, minus the earlier relay
  *   relay it also carries).
  * - **The Lettermint team token the org app step reads still comes from
  *   wherever the host already reads it, not held keys.** Needs
@@ -5044,7 +5051,7 @@ async function findOrCreatePlatformApp(coolify, name, environment, create) {
  * `_FILE` (#209 mints and pushes this once it lands) and `LETTERMINT_API_TOKEN`
  * (#210: `wtfalch/auth#138` moved the broker's account mail onto
  * `@wtfalch/mailer`'s Lettermint transport, so this is the env name the
- * broker actually reads now, not `RESEND_API_TOKEN`). Read from the broker's
+ * broker actually reads now, not the earlier provider's token). Read from the broker's
  * own live env, not a recorded scope id: whichever of #209/#210 lands first
  * (or a human, setting either directly on the app) is enough to clear that
  * one input, in either order, with no coupling to this step's own execution.

package/dist/plan/platform-sfu.d.ts

@@ -37,6 +37,16 @@
  */
 import { type LivekitCredentials } from '../calls-sfu-keys.js';
 import { type CallsSfuSshSession } from '../calls-sfu-ssh-adapter.js';
+/**
+ * What the last successful `sfu` apply is recorded as
+ * (`PLATFORM_SFU_APPLIED_SCOPE_KEY`): a SHA-256 hex digest of foundry's calls
+ * files, the sorted distinct org slugs and the connection revision. It holds
+ * no secret and does not depend on slug order or duplicates.
+ */
+export declare function callsSfuAppliedFingerprint(input: {
+    orgSlugs: readonly string[];
+    connectionRevision?: string;
+}): string;
 /** The SFU VM's own address, SSH credentials and host key fingerprint -- held keys a human stored ahead of time. */
 export interface CallsSfuConnection {
     address: string;