@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/plan/sign-in-org.d.ts

@@ -0,0 +1,99 @@
+import type { ZitadelPort } from './executor.js';
+/** Scope id: the domain registered as primary on the company's sign-in org. */
+export declare const ZITADEL_ORG_DOMAIN_SCOPE_KEY = "zitadel_org_domain";
+/**
+ * Scope id: the id of the sign-in org whose self-registration foundry closed,
+ * recorded only after `closeSelfRegistration` returned. While it is missing or
+ * names another org, the company plan holds the close step and no owner invite.
+ */
+export declare const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_org_registration_closed";
+/** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
+export declare function closeSignInOrgRegistration(zitadel: Pick<ZitadelPort, 'closeSelfRegistration'>, orgId: string, recordScopeId: (key: string, id: string) => void, scopeKey?: string): Promise<void>;
+/** Scope id: the domain the sign-in server refused to make primary (its domain policy wants proof). Set instead of failing; the planner reports it as blocked. */
+export declare const ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY = "zitadel_org_domain_blocked";
+/** The fixed text of the blocked item for a refused sign-in domain. No cause, no value but names. */
+export declare function signInDomainBlockedText(orgName: string, domain: string): string;
+/** The domain an org's owners sign in on: its own, or `<slug>.oikos.host` when it has none. */
+export declare function signInOrgDomain(org: {
+    slug: string;
+    domain: string | null;
+}): string;
+/**
+ * Adds `domain` to the ZITADEL org and makes it primary. Both calls are
+ * idempotent. A failure after the add leaves the domain on the org but not
+ * primary, and nothing is recorded, so the next run repeats both.
+ */
+export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
+/**
+ * {@link registerSignInDomain}, except that a refusal to make the domain
+ * primary (the sign-in server's domain policy wants proof) is recorded under
+ * `blockedScopeKey` and returns `false` instead of throwing on every apply.
+ * Any other failure throws. Returns `true` when the domain is primary.
+ */
+export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string): Promise<boolean>;
+export interface EnsureSignInOrgOptions {
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'addOrgDomain' | 'setPrimaryOrgDomain' | 'closeSelfRegistration'>;
+    /** Where the successful close is recorded (the org id). Absent: not recorded; the caller closes on every run. */
+    registrationClosedScopeKey?: string;
+    /** Defaults to {@link ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY}. */
+    domainBlockedScopeKey?: string;
+    /** The ZITADEL org's name. A company uses its slug, so every caller finds the same org. */
+    name: string;
+    /** The domain to make primary, from {@link signInOrgDomain}. */
+    domain: string;
+    /** Where the ids are recorded. */
+    recordScopeId(key: string, id: string): void;
+    /** Called once the org id is recorded and before the domain is registered, so a crash between them does not lose the org. */
+    persistScopeIds?(): Promise<void>;
+    /** Defaults to `zitadel_org`. */
+    orgScopeKey?: string;
+    /** Defaults to {@link ZITADEL_ORG_DOMAIN_SCOPE_KEY}. */
+    domainScopeKey?: string;
+}
+/**
+ * Finds or creates the company's sign-in organisation by name, registers
+ * `domain` on it and makes it primary, then records the org id and the domain.
+ * The domain is recorded last, only after both calls succeeded.
+ */
+export declare function ensureSignInOrg(options: EnsureSignInOrgOptions): Promise<{
+    orgId: string;
+    created: boolean;
+    domainBlocked?: true;
+}>;
+/** The user metadata key that holds an owner's personal address. */
+export declare const PERSONAL_EMAIL_METADATA_KEY = "personal_email";
+export interface InviteOwnerOptions {
+    zitadel: Pick<ZitadelPort, 'inviteOrgOwner' | 'setUserMetadata' | 'getUserMetadata'>;
+    mail: {
+        send(to: string, link: string): Promise<void>;
+    };
+    /** The sign-in org the account is made in. */
+    orgId: string;
+    /** The platform's login app, where the link lands (it serves `/verify`). */
+    authIssuer: string;
+    owner: {
+        givenName: string;
+        familyName: string;
+        /** The owner's work address: the account signs in as its local part. */
+        mailboxAddress: string;
+        /** Where the first-sign-in link is mailed and what the `personal_email` metadata holds. */
+        personalEmail: string;
+    };
+    /** The user id foundry recorded when it invited this owner before. An existing account with another id, and no personal_email metadata of the owner's, is refused. */
+    invitedUserId?: string;
+    /** Called with the invite code and the whole link before they are mailed, so the caller can mask them. */
+    onSecret?: (value: string) => void;
+    /** Names the step in errors, for example `zitadel:owner for acme`. */
+    label: string;
+}
+/**
+ * Makes the owner's account (username = local part of the work address, email =
+ * the work address), keeps the personal address as metadata, and mails the
+ * first-sign-in link to it. The invite code ZITADEL returns goes only into that
+ * mail (30 second timeout); no error holds it. A failure after the account
+ * exists leaves the account, and the next run finds it by username and mints a
+ * new code.
+ */
+export declare function inviteOwnerWithLink(options: InviteOwnerOptions): Promise<{
+    userId: string;
+}>;

package/dist/plan/sign-in-org.js

@@ -0,0 +1,151 @@
+/** Scope id: the domain registered as primary on the company's sign-in org. */
+export const ZITADEL_ORG_DOMAIN_SCOPE_KEY = 'zitadel_org_domain';
+/**
+ * Scope id: the id of the sign-in org whose self-registration foundry closed,
+ * recorded only after `closeSelfRegistration` returned. While it is missing or
+ * names another org, the company plan holds the close step and no owner invite.
+ */
+export const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = 'zitadel_org_registration_closed';
+/** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
+export async function closeSignInOrgRegistration(zitadel, orgId, recordScopeId, scopeKey = ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY) {
+    await zitadel.closeSelfRegistration(orgId);
+    recordScopeId(scopeKey, orgId);
+}
+/** Scope id: the domain the sign-in server refused to make primary (its domain policy wants proof). Set instead of failing; the planner reports it as blocked. */
+export const ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY = 'zitadel_org_domain_blocked';
+/** The fixed text of the blocked item for a refused sign-in domain. No cause, no value but names. */
+export function signInDomainBlockedText(orgName, domain) {
+    return `${orgName}'s sign-in domain ${domain} is blocked, not planned: the sign-in server refused to make it primary because its domain policy wants proof of ownership. Set the policy ValidateOrgDomains to false (and UserLoginMustBeDomain to true) on the sign-in server, then remove the recorded key ${ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY}`;
+}
+/** True for the providers' "domain is not verified" refusal of `setPrimaryOrgDomain`. */
+function isPrimaryDomainRefused(error) {
+    return error instanceof Error && /is not verified/.test(error.message);
+}
+/** True for the providers' "domain is not on org" answer of `setPrimaryOrgDomain`. */
+function isDomainNotListed(error) {
+    return error instanceof Error && /is not on org/.test(error.message);
+}
+const DOMAIN_LISTED_TRIES = 10;
+const DOMAIN_LISTED_WAIT_MS = 500;
+/** The domain an org's owners sign in on: its own, or `<slug>.oikos.host` when it has none. */
+export function signInOrgDomain(org) {
+    return (org.domain ?? `${org.slug}.oikos.host`).toLowerCase();
+}
+/**
+ * Adds `domain` to the ZITADEL org and makes it primary. Both calls are
+ * idempotent. A failure after the add leaves the domain on the org but not
+ * primary, and nothing is recorded, so the next run repeats both.
+ */
+export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    await zitadel.addOrgDomain(orgId, domain);
+    // The sign-in server lists a domain a moment after it accepts the add, and
+    // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await zitadel.setPrimaryOrgDomain(orgId, domain);
+            return;
+        }
+        catch (error) {
+            if (attempt >= DOMAIN_LISTED_TRIES || !isDomainNotListed(error))
+                throw error;
+            await sleep(DOMAIN_LISTED_WAIT_MS);
+        }
+    }
+}
+/**
+ * {@link registerSignInDomain}, except that a refusal to make the domain
+ * primary (the sign-in server's domain policy wants proof) is recorded under
+ * `blockedScopeKey` and returns `false` instead of throwing on every apply.
+ * Any other failure throws. Returns `true` when the domain is primary.
+ */
+export async function registerSignInDomainOrBlock(zitadel, orgId, domain, recordScopeId, blockedScopeKey = ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY) {
+    try {
+        await registerSignInDomain(zitadel, orgId, domain);
+        return true;
+    }
+    catch (error) {
+        if (!isPrimaryDomainRefused(error))
+            throw error;
+        recordScopeId(blockedScopeKey, domain);
+        return false;
+    }
+}
+/**
+ * Finds or creates the company's sign-in organisation by name, registers
+ * `domain` on it and makes it primary, then records the org id and the domain.
+ * The domain is recorded last, only after both calls succeeded.
+ */
+export async function ensureSignInOrg(options) {
+    const { zitadel, name, domain, recordScopeId } = options;
+    const { org, created } = await zitadel.findOrCreateOrg(name);
+    recordScopeId(options.orgScopeKey ?? 'zitadel_org', org.id);
+    await options.persistScopeIds?.();
+    // Before any owner invite can run: a stranger must not register the owner's
+    // username on an org that still inherits the instance's open registration.
+    // A failure here stops the step with the org recorded and no close recorded:
+    // the company plan then holds the close step and no invite until it succeeds.
+    await zitadel.closeSelfRegistration(org.id);
+    if (options.registrationClosedScopeKey) {
+        recordScopeId(options.registrationClosedScopeKey, org.id);
+    }
+    const registered = await registerSignInDomainOrBlock(zitadel, org.id, domain, recordScopeId, options.domainBlockedScopeKey);
+    if (!registered)
+        return { orgId: org.id, created, domainBlocked: true };
+    recordScopeId(options.domainScopeKey ?? ZITADEL_ORG_DOMAIN_SCOPE_KEY, domain);
+    return { orgId: org.id, created };
+}
+/** The user metadata key that holds an owner's personal address. */
+export const PERSONAL_EMAIL_METADATA_KEY = 'personal_email';
+/** How long the owner invite mail may take before the step gives up on it. */
+const OWNER_INVITE_MAIL_TIMEOUT_MS = 30_000;
+async function withTimeout(work, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
+    });
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Makes the owner's account (username = local part of the work address, email =
+ * the work address), keeps the personal address as metadata, and mails the
+ * first-sign-in link to it. The invite code ZITADEL returns goes only into that
+ * mail (30 second timeout); no error holds it. A failure after the account
+ * exists leaves the account, and the next run finds it by username and mints a
+ * new code.
+ */
+export async function inviteOwnerWithLink(options) {
+    const { zitadel, mail, orgId, authIssuer, owner, label } = options;
+    const { userId, created, inviteCode } = await zitadel.inviteOrgOwner(orgId, {
+        givenName: owner.givenName,
+        familyName: owner.familyName,
+        email: owner.mailboxAddress,
+        username: owner.mailboxAddress.slice(0, owner.mailboxAddress.indexOf('@')),
+    }, undefined, true);
+    if (!created && !inviteCode && userId !== options.invitedUserId) {
+        // An account that already has a sign-in method and no record of ours: not adopted.
+        // `personal_email` is written only by this function, through the admin API.
+        const metadata = await zitadel.getUserMetadata(orgId, userId, PERSONAL_EMAIL_METADATA_KEY);
+        if (metadata?.toLowerCase() !== owner.personalEmail.toLowerCase()) {
+            throw new Error(`${label}: in ZITADEL org ${orgId} an account with this username already exists and was not invited by foundry`);
+        }
+    }
+    await zitadel.setUserMetadata(orgId, userId, PERSONAL_EMAIL_METADATA_KEY, owner.personalEmail);
+    if (inviteCode) {
+        const link = `${authIssuer}/verify?userId=${encodeURIComponent(userId)}&code=${encodeURIComponent(inviteCode)}&organization=${encodeURIComponent(orgId)}&invite=true`;
+        options.onSecret?.(inviteCode);
+        options.onSecret?.(link);
+        try {
+            await withTimeout(mail.send(owner.personalEmail, link), OWNER_INVITE_MAIL_TIMEOUT_MS);
+        }
+        catch (_cause) {
+            // The mail port's own error may carry the link, and the link carries the code.
+            throw new Error(`${label}: the invite mail could not be sent; the account ${userId} exists and the next apply sends a new link`);
+        }
+    }
+    return { userId };
+}

package/dist/plan/zitadel-login-policy.js

@@ -74,7 +74,7 @@ export function createZitadelLoginPolicy(options) {
             const data = await call('GET', orgId, undefined);
             const policy = data.policy ?? {};
             const isDefault = data.isDefault === true || policy.isDefault === true;
-            if (!isDefault && policy.allowRegister === false) {
+            if (!isDefault && policy.allowRegister !== true) {
                 return { changed: false };
             }
             const settings = {};

package/dist/plan/zitadel-system-api.d.ts

@@ -36,13 +36,32 @@ export declare class CreateInstanceError extends Error {
     constructor(kind: 'rejected' | 'exists' | 'uncertain', message: string);
 }
 /** What a person does when an instance exists without a delivered bearer. Nothing is deleted automatically. */
-export declare function instanceWithoutBearerMessage(hostname: string, detail: string): string;
+export declare function instanceWithoutBearerMessage(hostname: string, detail: string, label?: string): string;
 export interface CreateInstanceRuntime {
     fetch?: typeof fetch;
     now: () => number;
     /** Fetch timeout for the one create call (default 30s). */
     timeoutMs?: number;
 }
+/**
+ * Waits until ZITADEL's system API answers, before the one create call. `/debug/healthz` and `/debug/ready`
+ * answer as soon as the HTTP server listens, but the gateway behind the system API reaches its gRPC server a
+ * moment later and answers 503 until then (seen: `POST /instances/_create` 503 about 100 ms after "server is
+ * listening"). A 503 on the create leaves the instance marked as possibly created, so the wait asks first with a
+ * read that changes nothing: `POST /system/v1/instances/_search`. Any answer other than a failed request or a
+ * 5xx counts (a 401 is the key being refused, which the create reports itself). Times out with an error that
+ * names the last answer.
+ */
+export declare function waitForSystemApi(input: {
+    customDomain: string;
+    privateKey: string;
+    label?: string;
+}, runtime: CreateInstanceRuntime & {
+    sleep: (ms: number) => Promise<void>;
+    timeoutMs?: number;
+    intervalMs?: number;
+    requestTimeoutMs?: number;
+}): Promise<void>;
 /**
  * Creates the platform's ZITADEL instance on `customDomain` with one machine
  * owner and returns its id and the owner's PAT. Sends exactly one request,
@@ -54,6 +73,8 @@ export declare function createZitadelInstance(input: {
     privateKey: string;
     instanceName: string;
     firstOrgName: string;
+    /** Names the target in error texts (default `platform:auth`). */
+    label?: string;
     owner: {
         userName: string;
         name: string;

package/dist/plan/zitadel-system-api.js

@@ -61,8 +61,48 @@ export class CreateInstanceError extends Error {
     }
 }
 /** What a person does when an instance exists without a delivered bearer. Nothing is deleted automatically. */
-export function instanceWithoutBearerMessage(hostname, detail) {
-    return `platform:auth: a ZITADEL instance may already exist for ${hostname} without a delivered bearer (${detail}). To recover, delete the instance with the system API (DELETE /system/v1/instances/{id}) or redeploy the ZITADEL database, remove the recorded key zitadel_platform_instance_undelivered, then apply again`;
+export function instanceWithoutBearerMessage(hostname, detail, label = 'platform:auth') {
+    return `${label}: a ZITADEL instance may already exist for ${hostname} without a delivered bearer (${detail}). To recover, delete the instance with the system API (DELETE /system/v1/instances/{id}) or redeploy the ZITADEL database, remove the recorded key zitadel_platform_instance_undelivered, then apply again`;
+}
+/**
+ * Waits until ZITADEL's system API answers, before the one create call. `/debug/healthz` and `/debug/ready`
+ * answer as soon as the HTTP server listens, but the gateway behind the system API reaches its gRPC server a
+ * moment later and answers 503 until then (seen: `POST /instances/_create` 503 about 100 ms after "server is
+ * listening"). A 503 on the create leaves the instance marked as possibly created, so the wait asks first with a
+ * read that changes nothing: `POST /system/v1/instances/_search`. Any answer other than a failed request or a
+ * 5xx counts (a 401 is the key being refused, which the create reports itself). Times out with an error that
+ * names the last answer.
+ */
+export async function waitForSystemApi(input, runtime) {
+    const fetchImpl = runtime.fetch ?? globalThis.fetch;
+    const url = `https://${input.customDomain}`;
+    const timeout = runtime.timeoutMs ?? 300_000;
+    const interval = runtime.intervalMs ?? 2_000;
+    const deadline = runtime.now() + timeout;
+    let last = 'no answer';
+    for (;;) {
+        try {
+            const response = await fetchImpl(`${url}/system/v1/instances/_search`, {
+                method: 'POST',
+                signal: AbortSignal.timeout(runtime.requestTimeoutMs ?? 10_000),
+                headers: {
+                    authorization: `Bearer ${signSystemApiJwt(input.privateKey, url, runtime.now())}`,
+                    'content-type': 'application/json',
+                },
+                body: '{}',
+            });
+            if (response.status < 500)
+                return;
+            last = `HTTP ${response.status}`;
+        }
+        catch {
+            last = 'the request failed';
+        }
+        if (runtime.now() >= deadline) {
+            throw new Error(`${input.label ?? 'platform:auth'}: ZITADEL's system API did not answer at ${url} within ${Math.round(timeout / 1000)}s (${last}); nothing was created, retry this apply`);
+        }
+        await runtime.sleep(interval);
+    }
 }
 /**
  * Creates the platform's ZITADEL instance on `customDomain` with one machine
@@ -73,6 +113,7 @@ export function instanceWithoutBearerMessage(hostname, detail) {
 export async function createZitadelInstance(input, runtime) {
     const fetchImpl = runtime.fetch ?? globalThis.fetch;
     const url = `https://${input.customDomain}`;
+    const label = input.label ?? 'platform:auth';
     let response;
     try {
         response = await fetchImpl(`${url}/system/v1/instances/_create`, {
@@ -97,19 +138,19 @@ export async function createZitadelInstance(input, runtime) {
         });
     }
     catch {
-        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the create request timed out or failed'));
+        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the create request timed out or failed', label));
     }
     if (response.status === 401) {
-        throw new CreateInstanceError('rejected', 'platform:auth: system API key rejected (HTTP 401); nothing was created');
+        throw new CreateInstanceError('rejected', `${label}: system API key rejected (HTTP 401); nothing was created`);
     }
     if (response.status === 409) {
-        throw new CreateInstanceError('exists', instanceWithoutBearerMessage(input.customDomain, 'ZITADEL answered 409, already exists'));
+        throw new CreateInstanceError('exists', instanceWithoutBearerMessage(input.customDomain, 'ZITADEL answered 409, already exists', label));
     }
     if (!response.ok) {
         // A 4xx is a refusal before anything was created; a 5xx may not be.
         throw new CreateInstanceError(response.status < 500 ? 'rejected' : 'uncertain', response.status < 500
-            ? `platform:auth: ZITADEL refused to create the instance (HTTP ${response.status}); nothing was created`
-            : instanceWithoutBearerMessage(input.customDomain, `ZITADEL answered HTTP ${response.status}`));
+            ? `${label}: ZITADEL refused to create the instance (HTTP ${response.status}); nothing was created`
+            : instanceWithoutBearerMessage(input.customDomain, `ZITADEL answered HTTP ${response.status}`, label));
     }
     let body = {};
     try {
@@ -119,7 +160,7 @@ export async function createZitadelInstance(input, runtime) {
         // Handled below.
     }
     if (!body.instanceId || !body.pat) {
-        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the answer had no instance id or token'));
+        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the answer had no instance id or token', label));
     }
     return { instanceId: body.instanceId, pat: body.pat };
 }

package/dist/plan.d.ts

@@ -62,6 +62,24 @@ export interface Plan {
      * this type with none.
      */
     versionChanges?: VersionChangeItem[];
+    /**
+     * Things a person should see that block no step: an optional credential not
+     * held yet. Never in `unmanaged`, so a plan with no steps and no blocked
+     * item still reads as settled. Optional: a consumer that does not know it
+     * loses only the notes.
+     */
+    notes?: PlanNote[];
+}
+/**
+ * One advisory line of a {@link Plan}. It never stops a step and is never a
+ * {@link PlanStep}. It names a credential, never a value.
+ */
+export interface PlanNote {
+    /** Stable, e.g. `uptime:CHAT_ACCESS_TOKEN`. */
+    key: string;
+    /** The service or step this is about, e.g. `uptime`. */
+    service: string;
+    description: string;
 }
 /**
  * The action kind a {@link VersionChangeItem} carries -- a distinct, typed

package/dist/platform.d.ts

@@ -31,6 +31,14 @@ export interface PlatformSfuService extends PlatformService {
  */
 export interface PlatformMailService extends PlatformService {
     lettermintProjectId?: string | null;
+    /**
+     * true: one shared relay container owns host port 25 and routes each
+     * message by recipient domain to a company's own mail server or to the
+     * platform's; the platform Stalwart then stops publishing port 25.
+     * false or unset (the default): the platform Stalwart binds host port 25
+     * directly, as it always has.
+     */
+    relay?: boolean;
 }
 /**
  * The uptime Worker (foundry#542): the outside prober Archon publishes as a

package/dist/slug.js

@@ -42,6 +42,7 @@ const RESERVED_ESTATE_SERVICES = [
     'manage',
     'boule',
     'operator',
+    'platform',
     'mailbox',
     'oikos',
     'cms',

package/dist/store/postgres.js

@@ -1,6 +1,7 @@
-import { and, asc, desc, eq, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
+import { and, asc, desc, eq, ne, sql } from 'drizzle-orm';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateHosting, validateMail, validateOwners, validateServices, validateSite, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
+import { findNameClashes, nameClashMessage } from '../plan/org-names.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
@@ -29,6 +30,7 @@ async function writeFenced(db, fence, write) {
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
 const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
+const SFU_SLOT_UNIQUE_INDEX = 'foundry_declared_orgs_sfu_slot_idx';
 /** #27: a bigint-safe decimal string of a non-negative integer -- no sign, no decimal point, no leading zeros (so "010" never diffs against a live "10"). */
 const NON_NEGATIVE_INTEGER = /^(0|[1-9]\d*)$/;
 /**
@@ -135,6 +137,15 @@ function rowToOrg(row) {
                 : {}),
         },
         issuer: { usesDomain: row.issuerUsesDomain },
+        // Omitted while shared, as `calls.versionPin` is.
+        ...(row.servicesOwn || row.servicesSfuSlot !== null
+            ? {
+                services: {
+                    own: row.servicesOwn,
+                    ...(row.servicesSfuSlot !== null ? { sfuSlot: row.servicesSfuSlot } : {}),
+                },
+            }
+            : {}),
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
             enabled: row.hostingEnabled,
@@ -177,6 +188,8 @@ function orgToRow(org) {
         callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
         callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
+        servicesOwn: org.services?.own ?? false,
+        servicesSfuSlot: org.services?.sfuSlot ?? null,
         siteEnabled: org.site.enabled,
         siteUsesDomain: org.site.usesDomain,
         hostingEnabled: org.hosting.enabled,
@@ -345,6 +358,30 @@ export function createPostgresDeclaredOrgStore(db) {
         if (reason)
             throw new DeclaredOrgError(`calls invalid: ${reason} (#259)`);
     }
+    // Own-service rules, on `create` and on the merged result of `update`; no
+    // two orgs share an `sfuSlot` (the unique index catches the race this misses).
+    async function requireValidServices(org) {
+        const reason = validateServices(org);
+        if (reason)
+            throw new DeclaredOrgError(`services invalid: ${reason}`);
+        const slot = org.services?.sfuSlot ?? null;
+        if (slot === null)
+            return;
+        const [taken] = await db
+            .select({ id: declaredOrgs.id })
+            .from(declaredOrgs)
+            .where(and(eq(declaredOrgs.servicesSfuSlot, slot), ne(declaredOrgs.id, org.id)))
+            .limit(1);
+        if (taken)
+            throw new DeclaredOrgError(`services invalid: sfuSlot ${slot} is already taken by another org`);
+    }
+    // No name foundry derives for this org may be one another org or the platform derives.
+    async function requireNoNameClash(org) {
+        const rows = await db.select().from(declaredOrgs).where(ne(declaredOrgs.id, org.id));
+        const [clash] = findNameClashes(org, rows.map(rowToOrg));
+        if (clash)
+            throw new DeclaredOrgError(nameClashMessage(org.slug, clash));
+    }
     // `as`: `update` is overloaded in the interface (#351), which one object-literal method cannot express.
     return {
         async create(org) {
@@ -357,6 +394,8 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidOwner(org);
             requireValidMail(org);
             requireValidCalls(org);
+            await requireValidServices(org);
+            await requireNoNameClash(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
@@ -371,6 +410,9 @@ export function createPostgresDeclaredOrgStore(db) {
                 if (constraint === DOMAIN_UNIQUE_INDEX) {
                     throw new DeclaredOrgError(`domain '${org.domain}' is already taken by another org (#131)`);
                 }
+                if (constraint === SFU_SLOT_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`services invalid: sfuSlot ${org.services?.sfuSlot} is already taken by another org`);
+                }
                 if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${org.slug}' is already taken by another org`);
                 }
@@ -461,6 +503,8 @@ export function createPostgresDeclaredOrgStore(db) {
             const wasTier2 = current.domain !== null && current.mail.mode === 'received';
             requireValidMail(next, { allowExistingTier2: wasTier2 });
             requireValidCalls(next);
+            await requireValidServices(next);
+            await requireNoNameClash(next);
             try {
                 // #351: with `expectedVersion` the version check is part of this one
                 // statement, so an edit that lands after the read above makes it match
@@ -489,6 +533,9 @@ export function createPostgresDeclaredOrgStore(db) {
                 if (constraint === DOMAIN_UNIQUE_INDEX) {
                     throw new DeclaredOrgError(`domain '${next.domain}' is already taken by another org (#131)`);
                 }
+                if (constraint === SFU_SLOT_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`services invalid: sfuSlot ${next.services?.sfuSlot} is already taken by another org`);
+                }
                 if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${next.slug}' is already taken by another org`);
                 }
@@ -605,6 +652,7 @@ function rowToPlatform(row) {
             hostname: row.mailHostname,
             gitRef: row.mailGitRef,
             ...(row.mailLettermintProjectId ? { lettermintProjectId: row.mailLettermintProjectId } : {}),
+            ...(row.mailRelay ? { relay: true } : {}),
         },
         sfu: {
             enabled: row.sfuEnabled,
@@ -656,6 +704,7 @@ function platformToRow(platform) {
         mailHostname: platform.mail.hostname,
         mailGitRef: platform.mail.gitRef,
         mailLettermintProjectId: platform.mail.lettermintProjectId ?? null,
+        mailRelay: platform.mail.relay === true,
         sfuEnabled: platform.sfu.enabled,
         sfuHostname: platform.sfu.hostname,
         sfuGitRef: platform.sfu.gitRef,

package/dist/store/schema.d.ts

@@ -321,6 +321,40 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        servicesOwn: import("drizzle-orm/pg-core").PgColumn<{
+            name: "services_own";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        servicesSfuSlot: import("drizzle-orm/pg-core").PgColumn<{
+            name: "services_sfu_slot";
+            tableName: "foundry_declared_orgs";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         siteEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "site_enabled";
             tableName: "foundry_declared_orgs";
@@ -1592,6 +1626,23 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        mailRelay: import("drizzle-orm/pg-core").PgColumn<{
+            name: "mail_relay";
+            tableName: "foundry_declared_platform";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         sfuEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sfu_enabled";
             tableName: "foundry_declared_platform";

package/dist/store/schema.js

@@ -35,6 +35,9 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     callsVersionPinSynapse: text('calls_version_pin_synapse'),
     callsVersionPinMas: text('calls_version_pin_mas'),
     issuerUsesDomain: boolean('issuer_uses_domain').notNull().default(false),
+    // ServicesConfig (org.ts): false and null are the platform's shared services.
+    servicesOwn: boolean('services_own').notNull().default(false),
+    servicesSfuSlot: integer('services_sfu_slot'),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.
     siteEnabled: boolean('site_enabled').notNull().default(false),
     siteUsesDomain: boolean('site_uses_domain').notNull().default(false),
@@ -162,6 +165,8 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     mailGitRef: text('mail_git_ref').notNull().default(''),
     /** #491, `migrations/0044_platform_mail_lettermint_project.sql`. Declared, never discovered. */
     mailLettermintProjectId: text('mail_lettermint_project_id'),
+    /** `migrations/0052_platform_mail_relay.sql`. */
+    mailRelay: boolean('mail_relay').notNull().default(false),
     sfuEnabled: boolean('sfu_enabled').notNull().default(false),
     sfuHostname: text('sfu_hostname').notNull(),
     sfuGitRef: text('sfu_git_ref').notNull().default(''),