@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/bootstrap/bootstrap.d.ts

@@ -1,5 +1,5 @@
 import type { Plan } from '../plan.js';
-import type { PlatformLiveReaders, PlatformStepExecutor, StepSystem } from '../plan/index.js';
+import type { FoundryPlanApplyOptions, LiveReaders, PlatformLiveReaders, PlatformStepExecutor, StepExecutor, StepSystem } from '../plan/index.js';
 import type { FoundryPlatformStepExecutorOptions } from '../plan/platform-providers.js';
 import type { FoundryStoreDb } from '../store/postgres.js';
 import type { BootstrapCompany, BootstrapOwner } from './declare.js';
@@ -38,6 +38,17 @@ export interface BootstrapProgress {
 }
 /** Everything foundry's per-step executors take besides the two clients and `deliverSecret`. */
 export type BootstrapExecutorDeps = Omit<FoundryPlatformStepExecutorOptions, 'coolify' | 'deliverSecret'>;
+/**
+ * What phase two needs to apply the platform's own org (Company Included):
+ * the org-side readers and step executor a host already builds for any org.
+ * Without it the run applies the platform only.
+ */
+export interface BootstrapCompanyDeps {
+    readers: LiveReaders;
+    executor: StepExecutor;
+    /** The same flags `FoundryPlanApply` takes: a step whose port the host did not build is reported blocked. */
+    options?: Pick<FoundryPlanApplyOptions, 'ownerInviteMail' | 'broker'>;
+}
 export interface BootstrapPlatformDeps {
     /** Foundry's tables live here, already migrated by the host; the store, the audit log and the plan all use it. */
     db: FoundryStoreDb;
@@ -54,6 +65,12 @@ export interface BootstrapPlatformDeps {
     };
     /** Per-step dependencies (auth, mail, files, ai, integrations, archon, sfu). A step without its own is reported blocked. */
     executor?: BootstrapExecutorDeps;
+    /**
+     * Phase two: after the platform, apply the platform's own org's database,
+     * sign-in client, owner and Boule, then the platform once more so Archon
+     * picks up the keys that slice produced. Absent: platform only.
+     */
+    company?: BootstrapCompanyDeps;
     /**
      * Passed to `createPostgresAuditLog`. Omit it in a real deployment: `db` is
      * the runtime role the host made with `ensureRuntimeRole`, and the default

package/dist/bootstrap/bootstrap.js

@@ -1,9 +1,12 @@
 import { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { CoolifyClient } from '@wtfalch/providers/coolify';
+import { validateMail } from '../org.js';
+import { BOULE_BROKER_ENTRY_KEY } from '../plan/boule.js';
+import { brokerEntryAppliedScopeKey } from '../plan/broker-entries.js';
 import { FoundryPlanApply, FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, } from '../plan/index.js';
 import { createPostgresAuditLog } from '../store/audit.js';
 import { createPostgresDeclaredOrgStore, createPostgresPlatformStore } from '../store/postgres.js';
-import { COMPANY_INCLUDED_ORG_ID, declaredCompanyOrg, declaredPlatformFor, ownerIdentity, } from './declare.js';
+import { COMPANY_INCLUDED_ORG_ID, declaredCompanyOrg, declaredPlatformFor } from './declare.js';
 import { driveApply } from './drive.js';
 const REDACTED = '<redacted>';
 /** Shorter strings in `deps.executor` are settings ("main", ports), not secrets, and would mangle every message. */
@@ -41,17 +44,47 @@ export class Redactor {
         return out;
     }
 }
-const allowPlatformApply = {
-    async canApply() {
-        return false;
-    },
-    async canDestroy() {
-        return false;
-    },
-    async canApplyPlatform() {
-        return true;
-    },
+/** The platform, and the platform's own org when the host gave phase two its dependencies. */
+function allowBootstrapApply(withCompany) {
+    return {
+        async canApply(_actor, orgId) {
+            return withCompany && orgId === COMPANY_INCLUDED_ORG_ID;
+        },
+        async canDestroy() {
+            return false;
+        },
+        async canApplyPlatform() {
+            return true;
+        },
+    };
+}
+/**
+ * The org steps phase two applies: the sign-in org and its domain, the owner
+ * (whose user id Boule's `AUTHZ_FIRST_OWNER` carries), Boule's sign-in client,
+ * and Boule with its database. Everything else the company declares (chat,
+ * mail, Boule's broker entry, which waits for the org's mail domain, ...) is
+ * for a later, ordinary org apply.
+ */
+const COMPANY_SLICE_STEPS = new Set([
+    'zitadel:issuer',
+    'zitadel:registration-closed',
+    'zitadel:domain',
+    'zitadel:owner',
+    'zitadel:app:boule',
+    'coolify:boule',
+]);
+const companySliceOnly = {
+    step: (action) => COMPANY_SLICE_STEPS.has(`${action.system}:${action.kind}`) ||
+        COMPANY_SLICE_STEPS.has(`${action.system}:${action.kind}:${action.key}`),
+    // `coolify:boule:mail` only says Boule runs without mail for now.
+    blocked: (key) => key !== 'coolify:boule:mail' &&
+        [...COMPANY_SLICE_STEPS].some((step) => key === step || key.startsWith(`${step}:`)),
 };
+/** Shown instead of a phase-two error that could carry a value; the failing step's own name and redacted text are in `failed`. */
+const COMPANY_NOT_FINISHED = "the company's own slice did not finish, so Archon has no people-store keys yet; run onboarding again";
+/** The step key and fixed text of the blocked item for Boule's missing broker entry. */
+const BOULE_BROKER_ENTRY_BLOCKED_STEP = 'coolify:boule-broker-entry';
+const BOULE_SIGN_IN_BLOCKED = "Boule is deployed but nobody can sign in to it yet: its broker entry waits for the company's mail domain, which the company's mail step records. Apply the company's mail, then its Boule broker entry (an ordinary org apply)";
 /** `FoundryPlanApply` needs org-scoped parts this run never uses; each refuses if called. */
 const unusedOrgExecutor = {
     async execute() {
@@ -68,6 +101,25 @@ export function roundSystem(plan) {
     return systems.size === 1 && only ? only : 'foundry';
 }
 const unusedOrgReader = { listResources: async () => [] };
+/** Counts the org steps a round starts and ends, as the platform executor is wrapped below. */
+function trackedOrgExecutor(inner, progress, redactor) {
+    return {
+        execute: async (action, context) => {
+            const p = progress();
+            p.started++;
+            try {
+                const result = await inner.execute(action, context);
+                p.completed++;
+                return result;
+            }
+            finally {
+                // After a failure too: the secrets it minted before failing must be masked in its error.
+                redactor.add(...(inner.secretsHandled?.() ?? []));
+            }
+        },
+        ...(inner.ownEdgePorts ? { ownEdgePorts: () => inner.ownEdgePorts?.() ?? {} } : {}),
+    };
+}
 /** The audit log with every free-text field run through the redactor before it is stored. */
 function redactingAudit(inner, redactor) {
     const plan = (p) => ({
@@ -115,6 +167,16 @@ export function guardStepDeps(executor, redactor, deliverSecret, heldKeys) {
         const copy = { ...deps };
         if ('deliverSecret' in copy)
             copy.deliverSecret = deliverSecret;
+        const inviteMail = copy.ownerInviteMail;
+        if (inviteMail) {
+            // The link carries the invite code; both are masked from the first moment they exist.
+            copy.ownerInviteMail = {
+                send: (to, link) => {
+                    redactor.add(link, new URL(link).searchParams.get('code'));
+                    return inviteMail.send(to, link);
+                },
+            };
+        }
         // #201: ai's own default minter needs heldKeys too, to re-sign a mint
         // request against its signing key when an earlier run pinned it but
         // crashed before the management key itself was minted and delivered.
@@ -170,8 +232,14 @@ export async function bootstrapPlatform(input, deps) {
         });
     };
     try {
-        ownerIdentity(input.owner);
+        // Refused here, before a credential is read or a row written: the work and
+        // personal addresses must be valid and not clash on the company's domain.
+        const mailProblem = validateMail(declaredCompanyOrg(input.company, input.owner));
+        if (mailProblem)
+            throw new Error(`bootstrapPlatform: ${mailProblem}`);
         redactor.addDeep(deps.executor);
+        // The company executor's own tokens (its ports hold the Coolify and ZITADEL credentials).
+        redactor.addDeep(deps.company?.executor);
         const credentials = await deps.rootCredentials();
         redactor.add(credentials.coolifyToken, credentials.cloudflareApiToken, credentials.cloudflareAccountId, ...Object.values(credentials.accessHeaders ?? {}));
         const deliverSecret = async (ref, secret) => {
@@ -272,9 +340,11 @@ export async function bootstrapPlatform(input, deps) {
                 ? { driftedSteps: (platform, ids) => inner.driftedSteps?.(platform, ids) ?? {} }
                 : {}),
         };
+        let orgProgress = { started: 0, completed: 0 };
+        const companyDeps = deps.company;
         const planApply = new FoundryPlanApply({
             store: orgStore,
-            readers: {
+            readers: companyDeps?.readers ?? {
                 zitadel: unusedOrgReader,
                 coolify: unusedOrgReader,
                 cloudflare: unusedOrgReader,
@@ -282,14 +352,17 @@ export async function bootstrapPlatform(input, deps) {
                 ai: unusedOrgReader,
                 cms: unusedOrgReader,
             },
-            executor: unusedOrgExecutor,
+            executor: companyDeps
+                ? trackedOrgExecutor(companyDeps.executor, () => orgProgress, redactor)
+                : unusedOrgExecutor,
             destroyer: unusedOrgExecutor,
             audit: redactingAudit(createPostgresAuditLog(deps.db, { checkRuntimeRole: deps.checkRuntimeRole }), redactor),
-            authz: allowPlatformApply,
+            authz: allowBootstrapApply(Boolean(companyDeps)),
             actor: { id: 'bootstrap-platform', display: 'bootstrapPlatform' },
             platform: { store: platformStore, readers: runtime.readers, executor },
+            ...(companyDeps ? { ...companyDeps.options, onlySteps: companySliceOnly } : {}),
         });
-        const driven = await driveApply({
+        const drivePlatform = (label) => driveApply({
             plan: () => planApply.planPlatform(),
             apply: (plan, stepProgress) => {
                 progress = stepProgress;
@@ -300,32 +373,98 @@ export async function bootstrapPlatform(input, deps) {
                 phase: 'plan',
                 system: roundSystem(plan),
                 round,
-                message: `round ${round}: ${plan.steps.length} step(s) planned`,
+                message: `${label}round ${round}: ${plan.steps.length} step(s) planned`,
                 steps: plan.steps.map((s) => s.description),
             }),
             onApplied: (round, plan) => emit({
                 phase: 'apply',
                 system: roundSystem(plan),
                 round,
-                message: `round ${round}: applied`,
+                message: `${label}round ${round}: applied`,
                 steps: plan.steps.map((s) => s.description),
             }),
         });
-        const blocked = (driven.failed ? [] : (driven.lastPlan?.unmanaged ?? []))
+        // Phase one: the platform.
+        const driven = await drivePlatform('');
+        const applied = [...driven.applied];
+        let failed = driven.failed;
+        let lastPlan = driven.lastPlan;
+        const blockedRaw = (driven.failed ? [] : (driven.lastPlan?.unmanaged ?? []))
             .filter((item) => item.key !== undefined)
-            .map((item) => ({
-            step: item.key,
-            message: redactor.text(item.description),
+            .map((item) => ({ step: item.key, message: item.description }));
+        if (companyDeps && !failed) {
+            // Phase two: the platform's own org. Its Boule needs the platform's
+            // sign-in, and Archon's people-store keys need that Boule.
+            const company = await driveApply({
+                plan: () => planApply.plan(COMPANY_INCLUDED_ORG_ID),
+                apply: (plan, stepProgress) => {
+                    orgProgress = stepProgress;
+                    return planApply.apply(plan, '');
+                },
+                maxRounds: deps.maxRounds,
+                onPlan: (round, plan) => emit({
+                    phase: 'plan',
+                    system: roundSystem(plan),
+                    round,
+                    message: `company round ${round}: ${plan.steps.length} step(s) planned`,
+                    steps: plan.steps.map((s) => s.description),
+                }),
+                onApplied: (round, plan) => emit({
+                    phase: 'apply',
+                    system: roundSystem(plan),
+                    round,
+                    message: `company round ${round}: applied`,
+                    steps: plan.steps.map((s) => s.description),
+                }),
+            });
+            applied.push(...company.applied);
+            if (company.failed) {
+                failed = company.failed;
+                blockedRaw.push({ step: 'company', message: COMPANY_NOT_FINISHED });
+            }
+            else {
+                for (const item of company.lastPlan?.unmanaged ?? []) {
+                    if (item.key !== undefined)
+                        blockedRaw.push({ step: item.key, message: item.description });
+                }
+                // Boule's broker entry needs the org's mail domain, which only the org's mail step
+                // records, so it is outside this slice. Until it is applied nobody can sign in to Boule:
+                // say so, and never report the onboarding complete.
+                const companyApplied = await orgStore.getAppliedState(COMPANY_INCLUDED_ORG_ID);
+                if (!companyApplied?.serviceIds[brokerEntryAppliedScopeKey(BOULE_BROKER_ENTRY_KEY)]) {
+                    blockedRaw.push({
+                        step: BOULE_BROKER_ENTRY_BLOCKED_STEP,
+                        message: BOULE_SIGN_IN_BLOCKED,
+                    });
+                }
+                // Phase three: the same platform plan again. Archon's step now sees
+                // the keys Boule holds and writes its own copies.
+                const again = await drivePlatform('after the company: ');
+                applied.push(...again.applied);
+                failed = again.failed;
+                lastPlan = again.lastPlan;
+                if (!again.failed) {
+                    for (const item of again.lastPlan?.unmanaged ?? []) {
+                        if (item.key !== undefined && !blockedRaw.some((b) => b.step === item.key)) {
+                            blockedRaw.push({ step: item.key, message: item.description });
+                        }
+                    }
+                }
+            }
+        }
+        const blocked = blockedRaw.map((item) => ({
+            step: item.step,
+            message: redactor.text(item.message),
         }));
         const result = {
-            applied: driven.applied.map((s) => redactor.text(s)),
+            applied: applied.map((s) => redactor.text(s)),
             blocked,
-            complete: !driven.failed && blocked.length === 0 && driven.lastPlan?.steps.length === 0,
-            ...(driven.failed
+            complete: !failed && blocked.length === 0 && lastPlan?.steps.length === 0,
+            ...(failed
                 ? {
                     failed: {
-                        step: redactor.text(driven.failed.step),
-                        message: redactor.text(driven.failed.message),
+                        step: redactor.text(failed.step),
+                        message: redactor.text(failed.message),
                     },
                 }
                 : {}),
@@ -333,7 +472,7 @@ export async function bootstrapPlatform(input, deps) {
         emit({
             phase: 'done',
             system: 'foundry',
-            message: driven.failed
+            message: failed
                 ? `stopped: ${result.failed?.message}`
                 : `${result.applied.length} step(s) applied, ${blocked.length} blocked`,
         });

package/dist/bootstrap/declare.d.ts

@@ -42,11 +42,15 @@ export interface BootstrapCompany {
 export interface BootstrapOwner {
     givenName: string;
     familyName: string;
+    /** The owner's personal address: the first-sign-in link is mailed here. */
     email: string;
+    /** The owner's work address on the company's domain; their sign-in name is its local part. */
+    mailboxAddress: string;
 }
 /**
  * The owner as `OwnerIdentity`, trimmed. Throws a plain error naming the
- * field when one is empty or the email is not an address.
+ * field when one is empty or an address is not an address. The work address
+ * is required: the owner signs in as its local part.
  */
 export declare function ownerIdentity(owner: BootstrapOwner): OwnerIdentity;
 /**

package/dist/bootstrap/declare.js

@@ -59,13 +59,15 @@ const SERVICES_ENABLED_BY_DEFAULT = new Set([
 ]);
 /**
  * The owner as `OwnerIdentity`, trimmed. Throws a plain error naming the
- * field when one is empty or the email is not an address.
+ * field when one is empty or an address is not an address. The work address
+ * is required: the owner signs in as its local part.
  */
 export function ownerIdentity(owner) {
     const identity = {
         email: owner.email?.trim() ?? '',
         givenName: owner.givenName?.trim() ?? '',
         familyName: owner.familyName?.trim() ?? '',
+        mailboxAddress: owner.mailboxAddress?.trim() ?? '',
     };
     const problem = validateOwners([identity]);
     if (problem)

package/dist/bootstrap/index.d.ts

@@ -1,3 +1,3 @@
 export type { BootstrapCompany, BootstrapOwner, } from './declare.js';
-export type { BootstrapExecutorDeps, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap.js';
+export type { BootstrapCompanyDeps, BootstrapExecutorDeps, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap.js';
 export { bootstrapPlatform } from './bootstrap.js';

package/dist/bootstrap/versions.d.ts

@@ -13,6 +13,10 @@ export interface PinnedVersions {
     cloudflared: string;
     stalwart: string;
     hc: string;
+    /** The mail relay's base image (an exact Alpine release); Postfix comes from its package repository. */
+    alpine: string;
+    /** A static busybox, copied into the MAS image so its health check has an HTTP client. */
+    busybox: string;
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;

package/dist/calls-sfu.d.ts

@@ -129,6 +129,16 @@ export declare const LIVEKIT_SIGNALLING_PORT = 7880;
 export declare const LIVEKIT_MEDIA_TCP_PORT = 7881;
 /** RTP media. Matches #122's "Decided" section exactly; not the wider range `docs/research/2026-09-19-meetings-research.md` lists for embedded TURN, which #122 does not turn on. */
 export declare const LIVEKIT_MEDIA_UDP_RANGE = "50000:60000";
+/**
+ * The ports of one slice of the Coolify server's media ports (`services.sfuSlot`):
+ * slot n holds UDP `50000 + (n-1)*500` to `50000 + n*500 - 1` and TCP `7881 + n`.
+ * Throws for a slot outside 1..{@link SFU_SLOT_MAX}.
+ */
+export declare function sfuSlotPorts(slot: number): {
+    udpStart: number;
+    udpEnd: number;
+    tcp: number;
+};
 /**
  * The host's private network on `vmbr1`, where the calls service reaches
  * LiveKit's API directly (#127's "Human steps": VM 105 gets a second NIC on

package/dist/calls-sfu.js

@@ -53,6 +53,7 @@
  * from any error `calls-sfu-deploy.mjs` prints.
  */
 import { VERSIONS } from './bootstrap/versions.js';
+import { SFU_SLOT_MAX } from './org.js';
 // ---------------------------------------------------------------------------
 // The guard
 // ---------------------------------------------------------------------------
@@ -119,6 +120,27 @@ export const LIVEKIT_SIGNALLING_PORT = 7880;
 export const LIVEKIT_MEDIA_TCP_PORT = 7881;
 /** RTP media. Matches #122's "Decided" section exactly; not the wider range `docs/research/2026-09-19-meetings-research.md` lists for embedded TURN, which #122 does not turn on. */
 export const LIVEKIT_MEDIA_UDP_RANGE = '50000:60000';
+/** The first UDP port of slot 1 and the width of every slot's UDP range (contract section 1). */
+const SFU_SLOT_UDP_BASE = 50000;
+const SFU_SLOT_UDP_WIDTH = 500;
+/** Slot n's TCP fallback port is this plus n. */
+const SFU_SLOT_TCP_BASE = 7881;
+/**
+ * The ports of one slice of the Coolify server's media ports (`services.sfuSlot`):
+ * slot n holds UDP `50000 + (n-1)*500` to `50000 + n*500 - 1` and TCP `7881 + n`.
+ * Throws for a slot outside 1..{@link SFU_SLOT_MAX}.
+ */
+export function sfuSlotPorts(slot) {
+    if (!Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX) {
+        throw new Error(`sfu slot must be an integer from 1 to ${SFU_SLOT_MAX}`);
+    }
+    const udpStart = SFU_SLOT_UDP_BASE + (slot - 1) * SFU_SLOT_UDP_WIDTH;
+    return {
+        udpStart,
+        udpEnd: udpStart + SFU_SLOT_UDP_WIDTH - 1,
+        tcp: SFU_SLOT_TCP_BASE + slot,
+    };
+}
 /**
  * The host's private network on `vmbr1`, where the calls service reaches
  * LiveKit's API directly (#127's "Human steps": VM 105 gets a second NIC on
@@ -176,6 +198,11 @@ const UNSCOPED_SIGNALLING_RULE_PATTERN = new RegExp(`^${LIVEKIT_SIGNALLING_PORT}
 export function hasUnscopedSignallingRule(status) {
     return UNSCOPED_SIGNALLING_RULE_PATTERN.test(status);
 }
+/**
+ * Where `cloudflared` serves its metrics, which include `/ready`. The image has no shell, so its check is
+ * the binary's own `tunnel ready` in exec form, and that command asks this address.
+ */
+const CLOUDFLARED_METRICS_ADDRESS = '127.0.0.1:20241';
 /**
  * `network_mode: host`: LiveKit's own self-hosting guide recommends this
  * over mapping ten thousand individual UDP ports, and the SFU VM has no
@@ -193,13 +220,27 @@ export function dockerComposeYaml() {
     volumes:
       - ${LIVEKIT_CONFIG_PATH}:/etc/livekit.yaml:ro
     command: --config /etc/livekit.yaml
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:${LIVEKIT_SIGNALLING_PORT}/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
   cloudflared:
     image: ${CLOUDFLARED_IMAGE_REF}
     restart: unless-stopped
     network_mode: host
     env_file:
       - ${CLOUDFLARED_ENV_PATH}
+    environment:
+      TUNNEL_METRICS: ${CLOUDFLARED_METRICS_ADDRESS}
     command: tunnel --no-autoupdate run
+    healthcheck:
+      test: ["CMD", "cloudflared", "tunnel", "--metrics", "${CLOUDFLARED_METRICS_ADDRESS}", "ready"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
 `;
 }
 /**

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, appEntry, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
@@ -10,7 +10,7 @@ export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requ
 export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export type { Checkpoint, LastApplied, AppliedState, DestroyRecord, DestroyStepRecord, } from './state.js';
-export type { PlanStep, UnmanagedItem, Plan, VersionChangeItem } from './plan.js';
+export type { PlanStep, UnmanagedItem, PlanNote, Plan, VersionChangeItem } from './plan.js';
 export type { AppliedVersion, AppliedVersionsStore, DeclaredOrgStore, HeldLease, MutationLease, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
 export { StaleLeaseError } from './store.js';
 export type { PlanApply, DestroyProgress } from './apply.js';
@@ -18,17 +18,25 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
-export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
+export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, MailRoute, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
+export type { FilesKeysMint, FilesKeysMinted, OwnFilesDeps, OwnFilesR2Key, OwnFilesR2Keys, OwnServicePorts, OwnServicesPort, OwnServicesProvision, OwnSfuDeps, ServiceTarget, } from './plan/index.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgTarget, } from './plan/index.js';
+export type { FilesHostInput, JobsHostDeps, JobsHostInput, OwnAuthInstance, PlanOwnAuthOptions, PlanOwnFilesOptions, PlanOwnFilesR2Options, PlanOwnJobsOptions, } from './plan/index.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
+export type { PlanOwnSfuOptions, SfuAppDeps, SfuAppInput } from './plan/index.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuPortsMappings, } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
+export type { EnsureSignInOrgOptions } from './plan/index.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
@@ -40,7 +48,7 @@ export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
@@ -58,7 +66,7 @@ export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './plan/index.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
 export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
-export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
+export type { BootstrapCompany, BootstrapCompanyDeps, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export type { OrgAppVersionRef, OrgAppVersionStatus, WtfalchPackageDrift, PlatformVersionStatus, ReadPlatformVersionStatusOptions, StatusCoolifyPort, StatusGithubPort, StatusGhExec, } from './plan/index.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
@@ -66,3 +74,5 @@ export type { RunnerDb } from './runner/db.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';
 export type { CreateJobRunnerOptions, JobRunner, RunFailure, RunRecord, RunStatus, RunStepsOptions, RunnerStep, } from './runner/types.js';
+export type { StoredApp } from './plan/health-gaps.js';
+export { EXIT_JOBS, REPO_DOCKERFILE_CHECKED, hasRealCheck, healthGaps, } from './plan/health-gaps.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, appEntry, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
@@ -14,16 +14,20 @@ export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAudit
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgTarget, } from './plan/index.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuPortsMappings, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
@@ -39,3 +43,4 @@ export { bootstrapPlatform } from './bootstrap/index.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';
+export { EXIT_JOBS, REPO_DOCKERFILE_CHECKED, hasRealCheck, healthGaps, } from './plan/health-gaps.js';

package/dist/migrations/0051_org_services.sql

@@ -0,0 +1,13 @@
+-- @wtfalch/foundry: a company's own services. `services_own` true gives the
+-- org its own sign-in, mail, files, jobs and calls SFU; false (the default)
+-- keeps the platform's shared ones. `services_sfu_slot` is the slice of the
+-- server's SFU ports an own org's media server takes; no two orgs share one.
+-- Mirrors src/store/schema.ts's `declaredOrgs` table additions.
+
+alter table foundry_declared_orgs
+  add column if not exists services_own boolean not null default false,
+  add column if not exists services_sfu_slot integer;
+
+create unique index if not exists foundry_declared_orgs_sfu_slot_idx
+  on foundry_declared_orgs (services_sfu_slot)
+  where services_sfu_slot is not null;

package/dist/migrations/0052_platform_mail_relay.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: `mail_relay` true puts one shared relay container on host
+-- port 25, which routes each message by recipient domain to a company's own
+-- mail server or to the platform's; false (the default) keeps the platform
+-- Stalwart bound to port 25 directly. Mirrors src/store/schema.ts's
+-- `foundryDeclaredPlatform` table addition.
+
+alter table foundry_declared_platform
+  add column if not exists mail_relay boolean not null default false;