@wtfalch/foundry 0.3.0 → 0.4.0

package/dist/plan/index.d.ts

@@ -6,5 +6,5 @@ export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, Dest
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, } from './plan-apply.js';
 export type { ScopeResolver, RecordedIds } from './providers-readers.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, FilesOrgLimits, AiOrgLimits, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, } from './executor.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, FilesOrgLimits, AiOrgLimits, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';

package/dist/plan/plan-apply.js

@@ -333,6 +333,8 @@ const STEP_FIELDS = {
     'zitadel:customers': 'hosting.issuerApps',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
+    'coolify:calls': 'calls.enabled',
+    'coolify:calls-service': 'calls.enabled',
     'files:storage': 'storage',
     'ai:budget': 'ai',
     'cms:site': 'site',
@@ -356,10 +358,12 @@ function stepField(action) {
  *
  * Three sources, in this order:
  * - fields no planner step exists for yet, so no apply can make them true:
- *   SSO, guests and solo when turned on, calls on the org's domain, a
- *   bespoke app repo, an adopted app in the `repo` form (#7's `#15` comment:
- *   "declared but refused by `apply`"), and hosting on a domain the org has
- *   not recorded;
+ *   SSO, guests and solo when turned on, a bespoke app repo, an adopted app
+ *   in the `repo` form (#7's `#15` comment: "declared but refused by
+ *   `apply`"), and calls or hosting on a domain the org has not recorded
+ *   (#145: calls on the org's own domain now has a planner step, the same
+ *   way hosting's own domain does, so it only fails for that one missing-
+ *   domain reason, not unconditionally);
  * - chat's reverse re-key, which the planner surfaces but which is not built
  *   (#7 amendment 3), so it counts as failed even when no step threw;
  * - on a failed apply, the field of every planned step from the one that
@@ -377,7 +381,10 @@ function failedFields(org, detail, completed) {
         failed.add('bespokeAppRepo');
     if (org.adoptedApp?.form === 'repo')
         failed.add('adoptedApp');
-    if (org.calls.usesDomain)
+    // `planCallsService`/`planTunnel`/`planZone` all share this same domain
+    // requirement (#145): a declared `usesDomain: true` with no recorded
+    // domain plans no step for any of them either.
+    if (org.calls.usesDomain && org.domain === null)
         failed.add('calls.usesDomain');
     // `planZone` plans nothing without a domain to put the zone on.
     if (org.hosting.usesDomain && org.domain === null)

package/dist/slug.js

@@ -32,11 +32,15 @@ const RESERVED_ESTATE_SERVICES = [
     'keys',
     'chat',
     'calls',
+    'calls-sfu',
     'calendar',
     'threads',
     'audit',
     'authz',
+    // Manage was renamed Boule on every surface (#147); 'manage' stays
+    // reserved so no org can take it while the old hostname still redirects.
     'manage',
+    'boule',
     'operator',
     'mailbox',
     'oikos',
@@ -112,6 +116,8 @@ const DNS_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
 const PR_SUFFIX = /-pr-\d+$/;
 /** `<something>-stage` — the stage-hostname shape (#28). */
 const STAGE_SUFFIX = /-stage$/;
+/** `<something>-calls` — a level-1 org's own calls service hostname (foundry#145's "Decided", 2026-09-27). */
+const CALLS_SUFFIX = /-calls$/;
 /**
  * Validates a candidate org slug against every rule #28 decided. Returns
  * `null` when the slug is acceptable, or a {@link SlugRejection} naming
@@ -132,10 +138,10 @@ export function validateSlug(slug) {
             message: `slug '${slug}' is reserved by the estate (#28) and cannot be taken by an org`,
         };
     }
-    if (STAGE_SUFFIX.test(slug) || PR_SUFFIX.test(slug)) {
+    if (STAGE_SUFFIX.test(slug) || PR_SUFFIX.test(slug) || CALLS_SUFFIX.test(slug)) {
         return {
             reason: 'environment-suffix',
-            message: `slug '${slug}' ends with an environment suffix ('-stage' or '-pr-<digits>') reserved for another org's own hostname (#28) — 'acme-stage' is only legal as acme's stage hostname, never as an org slug in its own right`,
+            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>' or '-calls') reserved for another org's own hostname (#28, #145) — 'acme-calls' is only legal as acme's calls hostname, never as an org slug in its own right`,
         };
     }
     return null;

package/dist/store/postgres.d.ts

@@ -14,7 +14,10 @@ export type FoundryStoreDb = PgDatabase<PgQueryResultHKT, any, any>;
  * environment-suffix shape), a slug already taken by another org (#28:
  * checked by the unique index `0004_slug_unique.sql` adds, whether caught
  * ahead of time by a pre-check or by a race this store maps back to the
- * same error) or — the one impossible combination #18 implements — a slug
+ * same error), a domain that fails `../org.js`'s `validateDomain` or is
+ * already taken by another org (#131, the same shape as the slug: format
+ * checked ahead of time, uniqueness checked by `0015_domain_unique.sql`'s
+ * index) or — the one impossible combination #18 implements — a slug
  * change once the org has mail. `store.ts`'s `update` doc requires a caller
  * to be "ready for this to throw rather than silently drop a field"; this
  * is that throw.
@@ -36,10 +39,12 @@ export declare class DeclaredOrgError extends Error {
  * (or `null` for uncapped), checked the same way on both `create` and the
  * merged result of `update`. #67 adds a fourth (`org.ts`'s
  * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
- * checked the same way. The broader "combinations foundry knows are
- * impossible are rejected with a reason" line needs a ruleset (domain
- * requirements per service, `adoptedApp.form`, mail-level transitions…)
- * that later tickets, not #18, #27 or #28, decide; `update` still merges and
- * stores any other patch as given.
+ * checked the same way. #131 adds a sixth, in the same shape as the slug: the
+ * domain, when set, is a validated (`org.ts`'s `validateDomain`), globally
+ * unique DNS name, checked on both `create` and `update`. The broader
+ * "combinations foundry knows are impossible are rejected with a reason"
+ * line needs a ruleset (domain requirements per service, `adoptedApp.form`,
+ * mail-level transitions…) that later tickets, not #18, #27, #28 or #131,
+ * decide; `update` still merges and stores any other patch as given.
  */
 export declare function createPostgresDeclaredOrgStore(db: FoundryStoreDb): DeclaredOrgStore;

package/dist/store/postgres.js

@@ -1,25 +1,34 @@
 import { eq, sql } from 'drizzle-orm';
-import { validateBuyerIdentity, validateHosting, validateOwner, validateSite } from '../org.js';
+import { validateBuyerIdentity, validateDomain, validateHosting, validateOwner, validateSite, } from '../org.js';
 import { validateSlug } from '../slug.js';
 import { declaredOrgs, foundryAppliedState, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
+/** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
+const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
+const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
 /** #27: a bigint-safe decimal string of a non-negative integer -- no sign, no decimal point, no leading zeros (so "010" never diffs against a live "10"). */
 const NON_NEGATIVE_INTEGER = /^(0|[1-9]\d*)$/;
 /**
- * True for a Postgres unique-violation, however the driver hands it back --
- * directly (PGlite in this package's own tests) or wrapped in drizzle-orm's
- * own `DrizzleQueryError`, whose `cause` carries the raw driver error
- * (postgres-js in a host). Checked by Postgres error code, never by message
- * text, since message text is not a contract. Same pattern as
+ * The Postgres unique-violation constraint name, however the driver hands the
+ * error back -- directly (PGlite in this package's own tests) or wrapped in
+ * drizzle-orm's own `DrizzleQueryError`, whose `cause` carries the raw driver
+ * error (postgres-js in a host) -- or `undefined` when this is not a unique
+ * violation. Checked by Postgres error code, never by message text, since
+ * message text is not a contract. Same code-check pattern as
  * `../runner/runner.ts`'s own `isUniqueViolation` -- kept as a local copy
- * here rather than shared, since neither module depends on the other.
+ * here rather than shared, since neither module depends on the other; this
+ * one additionally reads `constraint` so `create`/`update` can tell a slug
+ * collision from a domain collision (#131) rather than reporting both the
+ * same way.
  */
-function isUniqueViolation(error) {
-    const code = error?.code;
-    if (code === UNIQUE_VIOLATION)
-        return true;
+function uniqueViolationConstraint(error) {
+    const direct = error;
+    if (direct?.code === UNIQUE_VIOLATION)
+        return direct.constraint;
     const cause = error?.cause;
-    return cause?.code === UNIQUE_VIOLATION;
+    if (cause?.code === UNIQUE_VIOLATION)
+        return cause.constraint;
+    return undefined;
 }
 /**
  * Thrown by `create` and `update` when the store refuses a write: an id
@@ -28,7 +37,10 @@ function isUniqueViolation(error) {
  * environment-suffix shape), a slug already taken by another org (#28:
  * checked by the unique index `0004_slug_unique.sql` adds, whether caught
  * ahead of time by a pre-check or by a race this store maps back to the
- * same error) or — the one impossible combination #18 implements — a slug
+ * same error), a domain that fails `../org.js`'s `validateDomain` or is
+ * already taken by another org (#131, the same shape as the slug: format
+ * checked ahead of time, uniqueness checked by `0015_domain_unique.sql`'s
+ * index) or — the one impossible combination #18 implements — a slug
  * change once the org has mail. `store.ts`'s `update` doc requires a caller
  * to be "ready for this to throw rather than silently drop a field"; this
  * is that throw.
@@ -47,7 +59,7 @@ function rowToOrg(row) {
         domain: row.domain,
         mail: { mode: row.mailMode, usesDomain: row.mailUsesDomain },
         chat: { usesDomain: row.chatUsesDomain },
-        calls: { usesDomain: row.callsUsesDomain },
+        calls: { enabled: row.callsEnabled, usesDomain: row.callsUsesDomain },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
@@ -83,6 +95,7 @@ function orgToRow(org) {
         mailMode: org.mail.mode,
         mailUsesDomain: org.mail.usesDomain,
         chatUsesDomain: org.chat.usesDomain,
+        callsEnabled: org.calls.enabled,
         callsUsesDomain: org.calls.usesDomain,
         issuerUsesDomain: org.issuer.usesDomain,
         siteEnabled: org.site.enabled,
@@ -166,11 +179,13 @@ function rowToOwner(row) {
  * (or `null` for uncapped), checked the same way on both `create` and the
  * merged result of `update`. #67 adds a fourth (`org.ts`'s
  * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
- * checked the same way. The broader "combinations foundry knows are
- * impossible are rejected with a reason" line needs a ruleset (domain
- * requirements per service, `adoptedApp.form`, mail-level transitions…)
- * that later tickets, not #18, #27 or #28, decide; `update` still merges and
- * stores any other patch as given.
+ * checked the same way. #131 adds a sixth, in the same shape as the slug: the
+ * domain, when set, is a validated (`org.ts`'s `validateDomain`), globally
+ * unique DNS name, checked on both `create` and `update`. The broader
+ * "combinations foundry knows are impossible are rejected with a reason"
+ * line needs a ruleset (domain requirements per service, `adoptedApp.form`,
+ * mail-level transitions…) that later tickets, not #18, #27, #28 or #131,
+ * decide; `update` still merges and stores any other patch as given.
  */
 export function createPostgresDeclaredOrgStore(db) {
     async function requireRow(id) {
@@ -184,6 +199,18 @@ export function createPostgresDeclaredOrgStore(db) {
         if (rejection)
             throw new DeclaredOrgError(rejection.message);
     }
+    // #131: same place `requireValidSlug` checks the slug's format (#28) --
+    // `domain` is nullable (a brand new org has none), so this is only called
+    // once it is set. Uniqueness itself is not pre-checked here, the same
+    // choice `requireValidSlug` makes for the slug: the unique index
+    // `0015_domain_unique.sql` adds is the source of truth, caught below.
+    function requireValidDomain(domain) {
+        if (domain === null)
+            return;
+        const reason = validateDomain(domain);
+        if (reason)
+            throw new DeclaredOrgError(`domain invalid: ${reason} (#131)`);
+    }
     function requireValidLimit(fieldName, value) {
         if (value !== null && !NON_NEGATIVE_INTEGER.test(value)) {
             throw new DeclaredOrgError(`${fieldName} '${value}' must be a bigint-safe decimal string of a non-negative integer, or null for uncapped (#27)`);
@@ -230,6 +257,7 @@ export function createPostgresDeclaredOrgStore(db) {
     return {
         async create(org) {
             requireValidSlug(org.slug);
+            requireValidDomain(org.domain);
             requireValidLimits(org);
             requireValidBuyer(org);
             requireValidHosting(org);
@@ -239,13 +267,19 @@ export function createPostgresDeclaredOrgStore(db) {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
             catch (error) {
-                // The pre-check above already refuses a slug this process knows is
-                // taken (nothing does, on a fresh insert) -- this catches the race
-                // the pre-check cannot: two concurrent creates for the same slug,
-                // caught by `0004_slug_unique.sql`'s unique index and reported
-                // through the same error a pre-check would have thrown (#28).
-                if (isUniqueViolation(error))
+                // The pre-checks above already refuse a slug or domain this process
+                // knows is taken (nothing does, on a fresh insert) -- this catches
+                // the race they cannot: two concurrent creates for the same slug or
+                // domain, caught by `0004_slug_unique.sql`/`0015_domain_unique.sql`'s
+                // unique indexes and reported through the same error a pre-check
+                // would have thrown (#28, #131).
+                const constraint = uniqueViolationConstraint(error);
+                if (constraint === DOMAIN_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`domain '${org.domain}' is already taken by another org (#131)`);
+                }
+                if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${org.slug}' is already taken by another org`);
+                }
                 throw error;
             }
         },
@@ -261,6 +295,23 @@ export function createPostgresDeclaredOrgStore(db) {
                 .limit(1);
             return row !== undefined;
         },
+        // #131: a plain scan, not an indexed lookup -- `serviceIds` is jsonb
+        // keyed by resource, not by provider id, and foundry's own org count is
+        // small enough that this never needs to be more than that (same
+        // reasoning `getAppliedState`/`putAppliedState` already lean on: one row
+        // per org).
+        async findOrgIdForZone(zoneId) {
+            const rows = await db
+                .select({ orgId: foundryAppliedState.orgId, serviceIds: foundryAppliedState.serviceIds })
+                .from(foundryAppliedState);
+            for (const row of rows) {
+                for (const [key, id] of Object.entries(row.serviceIds)) {
+                    if (id === zoneId && key.startsWith('cloudflare:zone:'))
+                        return row.orgId;
+                }
+            }
+            return null;
+        },
         async update(id, patch) {
             const current = rowToOrg(await requireRow(id));
             // The slug freeze (#7 corrections 3): once mail exists, the mail
@@ -279,6 +330,7 @@ export function createPostgresDeclaredOrgStore(db) {
             if (patch.slug !== undefined && patch.slug !== current.slug)
                 requireValidSlug(patch.slug);
             const next = { ...current, ...patch, id: current.id };
+            requireValidDomain(next.domain);
             requireValidLimits(next);
             requireValidBuyer(next);
             requireValidHosting(next);
@@ -292,9 +344,15 @@ export function createPostgresDeclaredOrgStore(db) {
             }
             catch (error) {
                 // Same race as `create`: another org's concurrent write took this
-                // slug between the pre-check above and this statement (#28).
-                if (isUniqueViolation(error))
+                // slug or domain between the pre-check above and this statement
+                // (#28, #131).
+                const constraint = uniqueViolationConstraint(error);
+                if (constraint === DOMAIN_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`domain '${next.domain}' is already taken by another org (#131)`);
+                }
+                if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${next.slug}' is already taken by another org`);
+                }
                 throw error;
             }
             return next;

package/dist/store/schema.d.ts

@@ -130,6 +130,23 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        callsEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "calls_enabled";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         callsUsesDomain: import("drizzle-orm/pg-core").PgColumn<{
             name: "calls_uses_domain";
             tableName: "foundry_declared_orgs";

package/dist/store/schema.js

@@ -13,6 +13,7 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     mailMode: text('mail_mode').notNull().default('off'),
     mailUsesDomain: boolean('mail_uses_domain').notNull().default(false),
     chatUsesDomain: boolean('chat_uses_domain').notNull().default(false),
+    callsEnabled: boolean('calls_enabled').notNull().default(false),
     callsUsesDomain: boolean('calls_uses_domain').notNull().default(false),
     issuerUsesDomain: boolean('issuer_uses_domain').notNull().default(false),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.

package/dist/store.d.ts

@@ -14,6 +14,16 @@ export interface DeclaredOrgStore {
     get(id: OrgId): Promise<DeclaredOrg | null>;
     /** Whether any org already holds this slug. `slugFromName` asks it. */
     slugTaken(slug: string): Promise<boolean>;
+    /**
+     * The org id, if any, whose applied state already records `zoneId` under a
+     * `cloudflare:zone:*` key (#131). `plan/executor.ts`'s `cloudflareZone`
+     * asks this before adopting a zone `findZoneByApex` finds, the same
+     * foreign-resource refusal `cloudflareAccess` makes by reading Cloudflare's
+     * own Access-app name -- a Cloudflare zone carries no org-identifying
+     * field of its own for that live check, so this asks the store's own
+     * record instead.
+     */
+    findOrgIdForZone(zoneId: string): Promise<OrgId | null>;
     /**
      * Combinations foundry knows are impossible are rejected with a reason
      * (#18 "Done when"), so a caller must be ready for this to throw rather

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -39,7 +39,7 @@
   "dependencies": {
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/email": "0.15.0",
-    "@wtfalch/providers": "0.5.0",
+    "@wtfalch/providers": "0.6.0",
     "ssh2": "1.17.0"
   },
   "devDependencies": {