@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/plan/own-diff.d.ts

@@ -0,0 +1,169 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import { type OrgPlatformReadiness } from './platform-org.js';
+/** `unmanaged` key of the one line `planOwnJobs` reports. */
+export declare const OWN_JOBS_BLOCKED_KEY = "own-jobs";
+export interface PlanOwnJobsOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    isPlatformOrg: boolean;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** The admin token's held-key ref holds a value, so an undelivered marker is resumed, not blocked. */
+    tokenHeld?: boolean;
+}
+/**
+ * An own org (`services.own`) runs its own jobs scheduler: a database, an app
+ * and an admin token in the org's own Coolify project. Applied once, and
+ * again when the platform's declared jobs ref changed, an earlier run died
+ * before the deploy finished, or the address was never recorded. Every
+ * blocked line is fixed text: it is part of the stale-plan comparison.
+ */
+export declare function planOwnJobs(options: PlanOwnJobsOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one line `planOwnAuth` reports. */
+export declare const OWN_AUTH_BLOCKED_KEY = "own-auth";
+/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
+export declare const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = "own_auth_applied_hostname";
+/** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
+export declare const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = "own_auth_applied_git_ref";
+export interface PlanOwnAuthOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    isPlatformOrg: boolean;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** The org's Cloudflare zone as the live read shows it, or null when none exists yet. */
+    zone: {
+        active: boolean;
+    } | null;
+    /** The org's own Lettermint key (`orgTarget(org).refs.brokerMailKey`) is held. */
+    mailKeyHeld: boolean;
+    /** The host can mint that key itself (a Lettermint port and a held-key reader): the step plans without it. */
+    mailKeyMintable?: boolean;
+}
+/**
+ * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
+ * and the broker in the org's own Coolify project, at `auth.<domain>`.
+ * Applied once, and again when the declared domain or the platform's auth ref
+ * changed or an earlier run died before it finished. A login client that is
+ * not minted yet plans the step again only once the broker holds an entry:
+ * until then it waits on `AUTH_APPS`, which no re-run of this step supplies. Every blocked line is fixed
+ * text: it is part of the stale-plan comparison.
+ */
+export declare function planOwnAuth(options: PlanOwnAuthOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one line `planOwnMail` reports. */
+export declare const OWN_MAIL_BLOCKED_KEY = "own-mail";
+export interface PlanOwnMailOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    isPlatformOrg: boolean;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** `platform.mail.relay` is declared and the relay recorded a route list as applied. */
+    mailRelayApplied: boolean;
+    /** The org's zone is live and active. */
+    zoneActive: boolean;
+}
+/**
+ * An own org (`services.own`) with mail on gets its own Stalwart in its own
+ * Coolify project, behind the shared relay. It waits for the org's own
+ * sign-in (its directory trusts that issuer), the relay (port 25 has no other
+ * way in) and the zone. Applied once, and again when the hostname or the
+ * image tag changed. Every blocked line is fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export declare function planOwnMail(options: PlanOwnMailOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one blocked line `planOwnSfu` reports. */
+export declare const OWN_SFU_BLOCKED_KEY = "own-sfu";
+/** `unmanaged` key of the firewall line: the server's ports foundry cannot open itself. */
+export declare const OWN_SFU_FIREWALL_KEY = "own-sfu:firewall";
+export interface PlanOwnSfuOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    isPlatformOrg: boolean;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** The org's zone is live and active: none is planned and none is waiting. */
+    zoneActive: boolean;
+    readiness: OrgPlatformReadiness;
+    /** The host confirmed the slot's ports are open on the server. */
+    sfuPortsOpen: boolean;
+    /** The key pair's held-key ref holds a value, so an undelivered marker is resumed, not blocked. */
+    keysHeld?: boolean;
+}
+/**
+ * An own org (`services.own`) with calls on runs its own LiveKit media server
+ * as a Coolify app. Applied once, and again when the pinned LiveKit version,
+ * the slot or the hostname changed, or an earlier run died before the deploy
+ * finished. `firewall` is the one line that says which ports the server must
+ * have open: foundry opens none, so it stays until the host confirms them.
+ * Every line is fixed text: it is part of the stale-plan comparison.
+ */
+export declare function planOwnSfu(options: PlanOwnSfuOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+    firewall: string | null;
+};
+/** `unmanaged` key of the one line `planOwnFiles` reports. */
+export declare const OWN_FILES_BLOCKED_KEY = "own-files";
+export interface PlanOwnFilesOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    isPlatformOrg: boolean;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** What the host's own files dependencies supply: valid keys worker settings, and a bucket port. */
+    filesDeps: {
+        keys: boolean;
+        bucket: boolean;
+    };
+}
+/**
+ * An own org (`services.own`) runs its own files host: a database, a migrate
+ * app, a runner app, a ZITADEL project in the company's own instance and a
+ * bucket. Applied once, and again when the declared domain, the platform's
+ * files ref or the org's share domains changed or an earlier run died before
+ * it finished. A secret minted but not confirmed delivered never plans the
+ * step again. Every blocked line is fixed text: it is part of the stale-plan
+ * comparison.
+ */
+export declare function planOwnFiles(options: PlanOwnFilesOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one line `planOwnFilesR2` reports. */
+export declare const OWN_FILES_R2_BLOCKED_KEY = "own-files-r2";
+export interface PlanOwnFilesR2Options {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    isPlatformOrg: boolean;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** Which ports the step needs the host supplied: the R2 key port, and the files-organisation `storeR2Credentials`. */
+    ports: {
+        r2Keys: boolean;
+        storeR2Credentials: boolean;
+    };
+}
+/**
+ * The storage key of an own org's files bucket: planned once its files host is applied (the host must be
+ * up to receive the key) and until `files_r2_id` is recorded. A token minted and not confirmed delivered
+ * does not block the step: the next run deletes it first. The blocked line is fixed text.
+ */
+export declare function planOwnFilesR2(options: PlanOwnFilesR2Options): {
+    step: DraftStep | null;
+    blocked: string | null;
+};

package/dist/plan/own-diff.js

@@ -0,0 +1,432 @@
+import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
+import { sfuSlotPorts } from '../calls-sfu.js';
+import { SFU_SLOT_MAX, ownsServices } from '../org.js';
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { brokerEntryAppliedScopeKey } from './broker-entries.js';
+import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
+import { ownAuthApplied } from './login-host.js';
+import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY } from './mail-relay.js';
+import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
+import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
+import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
+import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+/** `unmanaged` key of the one line `planOwnJobs` reports. */
+export const OWN_JOBS_BLOCKED_KEY = 'own-jobs';
+/**
+ * An own org (`services.own`) runs its own jobs scheduler: a database, an app
+ * and an admin token in the org's own Coolify project. Applied once, and
+ * again when the platform's declared jobs ref changed, an earlier run died
+ * before the deploy finished, or the address was never recorded. Every
+ * blocked line is fixed text: it is part of the stale-plan comparison.
+ */
+export function planOwnJobs(options) {
+    const { org, recordedIds, readiness, isPlatformOrg, ownServices } = options;
+    if (!ownsServices(org))
+        return { step: null, blocked: null };
+    const blocked = (line) => ({ step: null, blocked: line });
+    if (isPlatformOrg) {
+        return blocked(`${org.slug} cannot run its own services: it is the platform's own org`);
+    }
+    const undelivered = recordedIds[JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY];
+    if (undelivered && !options.tokenHeld) {
+        return blocked(`${org.slug}'s own jobs scheduler admin token for app ${undelivered} was minted but not confirmed delivered; remove the recorded key ${JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    }
+    if (!ownServices) {
+        return blocked(`${org.slug}'s own jobs scheduler is blocked, not planned: the host supplies no ownServices port`);
+    }
+    const gitRef = readiness.serviceGitRefs?.jobs;
+    if (!gitRef) {
+        return blocked(`${org.slug}'s own jobs scheduler is blocked, not planned: the platform declares no jobs git ref`);
+    }
+    const applied = Boolean(recordedIds[`coolify:own-jobs:${org.id}`]);
+    if (applied &&
+        recordedIds[JOBS_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
+        !recordedIds[JOBS_DEPLOY_PENDING_SCOPE_KEY] &&
+        recordedIds[JOBS_INTERNAL_URL_SCOPE_KEY]) {
+        return { step: null, blocked: null };
+    }
+    return {
+        blocked: null,
+        step: {
+            action: {
+                system: 'coolify',
+                kind: 'own-jobs',
+                key: org.id,
+                desired: { gitRef },
+            },
+            step: {
+                description: `provision ${org.slug}'s own jobs scheduler`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
+const BROKER_ENTRY_APPLIED_PREFIX = brokerEntryAppliedScopeKey('');
+/** `unmanaged` key of the one line `planOwnAuth` reports. */
+export const OWN_AUTH_BLOCKED_KEY = 'own-auth';
+/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
+export const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = 'own_auth_applied_hostname';
+/** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
+export const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'own_auth_applied_git_ref';
+/**
+ * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
+ * and the broker in the org's own Coolify project, at `auth.<domain>`.
+ * Applied once, and again when the declared domain or the platform's auth ref
+ * changed or an earlier run died before it finished. A login client that is
+ * not minted yet plans the step again only once the broker holds an entry:
+ * until then it waits on `AUTH_APPS`, which no re-run of this step supplies. Every blocked line is fixed
+ * text: it is part of the stale-plan comparison.
+ */
+export function planOwnAuth(options) {
+    const { org, recordedIds, readiness, isPlatformOrg, ownServices } = options;
+    // `planOwnJobs` reports the platform's own org once.
+    if (!ownsServices(org) || isPlatformOrg || !org.domain)
+        return { step: null, blocked: null };
+    const blocked = (reason) => ({
+        step: null,
+        blocked: `${org.slug}'s own sign-in is blocked, not planned: ${reason}`,
+    });
+    if (recordedIds.zitadel_org && !recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY]) {
+        return {
+            step: null,
+            blocked: `${org.slug} already signs in on the shared service; moving it is a later phase`,
+        };
+    }
+    const instanceLost = recordedIds[PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY];
+    if (instanceLost &&
+        !recordedIds[PLATFORM_AUTH_INSTANCE_SCOPE_KEY] &&
+        !recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) {
+        return blocked(`a ZITADEL instance (${instanceLost}) may exist without a delivered owner token; delete it with the system API or redeploy its database, then remove the recorded key ${PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY}`);
+    }
+    const adminLost = recordedIds[PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY];
+    if (adminLost && !recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) {
+        return blocked(`the admin key of ZITADEL machine user ${adminLost} was minted but not confirmed delivered; delete that user and remove the recorded key ${PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    }
+    const loginClientLost = recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY];
+    if (loginClientLost && !recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) {
+        return blocked(`the login-client token of ZITADEL machine user ${loginClientLost} was minted but not confirmed delivered; remove the recorded key ${PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    }
+    if (!ownServices)
+        return blocked('the host supplies no ownServices port');
+    const gitRef = readiness.serviceGitRefs?.auth;
+    if (!gitRef)
+        return blocked('the platform declares no auth git ref');
+    if (!options.zone?.active)
+        return blocked(`the zone for ${org.domain} is not active yet`);
+    const ownEdge = readiness.ownEdgePorts;
+    if (readiness.dnsBlocked && !(ownEdge?.dns && ownEdge.tunnels)) {
+        return blocked(readiness.dnsBlocked);
+    }
+    if (!ownEdge?.tunnels && !readiness.edgeReady) {
+        return blocked('the host supplies no tunnel port and edge is not ready');
+    }
+    if (!options.mailKeyHeld && !options.mailKeyMintable) {
+        return blocked(`the held key ${orgTarget(org).refs.brokerMailKey} is not held yet`);
+    }
+    const hostname = `auth.${org.domain}`;
+    // The broker starts only on a valid `AUTH_APPS`, and the login client is minted only once it does:
+    // the first broker entry is what lets this step finish, as the platform's first registration does.
+    const brokerHoldsAnEntry = Object.keys(recordedIds).some((key) => key.startsWith(BROKER_ENTRY_APPLIED_PREFIX));
+    const applied = Boolean(recordedIds[`coolify:own-auth:${org.id}`]) &&
+        Boolean(recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY]);
+    if (applied &&
+        recordedIds[OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
+        recordedIds[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
+        recordedIds[PLATFORM_AUTH_ZITADEL_SCOPE_KEY] &&
+        recordedIds[PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY] &&
+        recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY] &&
+        recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY] &&
+        recordedIds[PLATFORM_AUTH_SMTP_SCOPE_KEY] &&
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
+        (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry)) {
+        return { step: null, blocked: null };
+    }
+    return {
+        blocked: null,
+        step: {
+            action: {
+                system: 'coolify',
+                kind: 'own-auth',
+                key: org.id,
+                desired: { hostname, gitRef },
+            },
+            step: {
+                description: `provision ${org.slug}'s own sign-in at ${hostname}`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
+/** `unmanaged` key of the one line `planOwnMail` reports. */
+export const OWN_MAIL_BLOCKED_KEY = 'own-mail';
+/**
+ * An own org (`services.own`) with mail on gets its own Stalwart in its own
+ * Coolify project, behind the shared relay. It waits for the org's own
+ * sign-in (its directory trusts that issuer), the relay (port 25 has no other
+ * way in) and the zone. Applied once, and again when the hostname or the
+ * image tag changed. Every blocked line is fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export function planOwnMail(options) {
+    const { org, recordedIds, readiness, isPlatformOrg, ownServices, mailRelayApplied, zoneActive } = options;
+    if (!ownsServices(org) || org.mail.mode === 'off' || isPlatformOrg) {
+        return { step: null, blocked: null };
+    }
+    const blocked = (reason) => ({
+        step: null,
+        blocked: `${org.slug}'s own mail server is blocked, not planned: ${reason}`,
+    });
+    const undelivered = recordedIds[PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY];
+    if (undelivered && !recordedIds[PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY]) {
+        return blocked(`its admin API key ("${undelivered}") was minted but not confirmed delivered; revoke it in Stalwart and remove the recorded key ${PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    }
+    if (!ownServices)
+        return blocked('the host supplies no ownServices port');
+    const gitRef = readiness.serviceGitRefs?.mail;
+    if (!gitRef)
+        return blocked('the platform declares no mail git ref');
+    const floating = floatingTagBlocked('Stalwart', gitRef, 'v0.16.24');
+    if (floating)
+        return blocked(`${floating} as the mail gitRef`);
+    if (!org.domain)
+        return blocked('the org declares no domain');
+    if (!ownAuthApplied(org, recordedIds)) {
+        return blocked('its own sign-in is not applied yet');
+    }
+    if (!mailRelayApplied || !readiness.platformApex) {
+        return blocked('the shared mail relay is not applied yet');
+    }
+    if (!zoneActive)
+        return blocked(`the zone for ${org.domain} is not active yet`);
+    const platformApex = readiness.platformApex;
+    const hostname = `mail.${org.domain}`;
+    if (recordedIds[`coolify:own-mail:${org.id}`] &&
+        recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
+        recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
+        recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] &&
+        recordedIds[OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY]) {
+        return { step: null, blocked: null };
+    }
+    return {
+        blocked: null,
+        step: {
+            action: {
+                system: 'coolify',
+                kind: 'own-mail',
+                key: org.id,
+                desired: { hostname, gitRef, mailHost: platformMailMxHost(platformApex) },
+            },
+            step: {
+                description: `provision ${org.slug}'s own mail server`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
+/** `unmanaged` key of the one blocked line `planOwnSfu` reports. */
+export const OWN_SFU_BLOCKED_KEY = 'own-sfu';
+/** `unmanaged` key of the firewall line: the server's ports foundry cannot open itself. */
+export const OWN_SFU_FIREWALL_KEY = 'own-sfu:firewall';
+/**
+ * An own org (`services.own`) with calls on runs its own LiveKit media server
+ * as a Coolify app. Applied once, and again when the pinned LiveKit version,
+ * the slot or the hostname changed, or an earlier run died before the deploy
+ * finished. `firewall` is the one line that says which ports the server must
+ * have open: foundry opens none, so it stays until the host confirms them.
+ * Every line is fixed text: it is part of the stale-plan comparison.
+ */
+export function planOwnSfu(options) {
+    const { org, recordedIds, isPlatformOrg, ownServices, zoneActive, sfuPortsOpen, readiness } = options;
+    const none = { step: null, blocked: null, firewall: null };
+    // The platform's own org is reported once, by `planOwnJobs`.
+    if (!ownsServices(org) || !org.calls.enabled || isPlatformOrg || !org.domain)
+        return none;
+    const blocked = (line) => ({ ...none, blocked: line });
+    const slot = org.services?.sfuSlot;
+    if (typeof slot !== 'number' || !Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX) {
+        return blocked(`${org.slug}'s own media server is blocked, not planned: no sfuSlot is declared`);
+    }
+    const ports = sfuSlotPorts(slot);
+    const firewall = sfuPortsOpen
+        ? null
+        : `${org.slug}'s own media server needs UDP ${ports.udpStart}-${ports.udpEnd} and TCP ${ports.tcp} open on the Coolify server's firewall; foundry does not open them`;
+    const result = (step, line = null) => ({
+        step,
+        blocked: line,
+        firewall,
+    });
+    const undelivered = recordedIds[OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY];
+    if (undelivered && !options.keysHeld) {
+        return result(null, `${org.slug}'s own media server LiveKit key for app ${undelivered} was minted but not confirmed delivered; remove the recorded key ${OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    }
+    if (!ownServices) {
+        return result(null, `${org.slug}'s own media server is blocked, not planned: the host supplies no ownServices port`);
+    }
+    const waiting = (reason) => result(null, `${org.slug}'s own media server is blocked, not planned: ${reason}`);
+    if (!ownAuthApplied(org, recordedIds))
+        return waiting('its own sign-in is not applied yet');
+    if (!zoneActive)
+        return waiting(`the zone for ${org.domain} is not active yet`);
+    const ownEdge = readiness.ownEdgePorts;
+    if (readiness.dnsBlocked && !(ownEdge?.dns && ownEdge.tunnels)) {
+        return waiting(readiness.dnsBlocked);
+    }
+    if (!ownEdge?.tunnels && !readiness.edgeReady) {
+        return waiting('the host supplies no tunnel port and edge is not ready');
+    }
+    const hostname = `sfu.${org.domain}`;
+    const version = VERSIONS.livekit;
+    const applied = Boolean(recordedIds[`coolify:own-sfu:${org.id}`]) &&
+        recordedIds[OWN_SFU_APPLIED_VERSION_SCOPE_KEY] === version &&
+        recordedIds[OWN_SFU_APPLIED_SLOT_SCOPE_KEY] === String(slot) &&
+        recordedIds[OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
+        !recordedIds[OWN_SFU_DEPLOY_PENDING_SCOPE_KEY] &&
+        Boolean(recordedIds[SFU_INTERNAL_URL_SCOPE_KEY]) &&
+        Boolean(recordedIds[SFU_PUBLIC_URL_SCOPE_KEY]);
+    if (applied)
+        return result(null);
+    return result({
+        action: {
+            system: 'coolify',
+            kind: 'own-sfu',
+            key: org.id,
+            desired: { slot, hostname, version },
+        },
+        step: {
+            description: `provision ${org.slug}'s own media server`,
+            destroys: false,
+            migrates: false,
+        },
+    });
+}
+/** `unmanaged` key of the one line `planOwnFiles` reports. */
+export const OWN_FILES_BLOCKED_KEY = 'own-files';
+/**
+ * An own org (`services.own`) runs its own files host: a database, a migrate
+ * app, a runner app, a ZITADEL project in the company's own instance and a
+ * bucket. Applied once, and again when the declared domain, the platform's
+ * files ref or the org's share domains changed or an earlier run died before
+ * it finished. A secret minted but not confirmed delivered never plans the
+ * step again. Every blocked line is fixed text: it is part of the stale-plan
+ * comparison.
+ */
+export function planOwnFiles(options) {
+    const { org, recordedIds, readiness, isPlatformOrg, ownServices, filesDeps } = options;
+    // `planOwnJobs` reports the platform's own org once.
+    if (!ownsServices(org) || isPlatformOrg || !org.domain)
+        return { step: null, blocked: null };
+    const blocked = (reason) => ({
+        step: null,
+        blocked: `${org.slug}'s own files host is blocked, not planned: ${reason}`,
+    });
+    const managementLost = recordedIds[PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY];
+    if (managementLost && !recordedIds[PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY]) {
+        return blocked(`the files management key ${managementLost} was minted but not confirmed delivered; remove the recorded key ${PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    }
+    const introspectionLost = recordedIds[PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
+    if (introspectionLost && !recordedIds[PLATFORM_FILES_INTROSPECTION_SCOPE_KEY]) {
+        return blocked(`the introspection client secret of ZITADEL app ${introspectionLost} was minted but not confirmed delivered; remove the recorded key ${PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    }
+    if (!ownServices)
+        return blocked('the host supplies no ownServices port');
+    const gitRef = readiness.serviceGitRefs?.files;
+    if (!gitRef)
+        return blocked('the platform declares no files git ref');
+    if (!ownAuthApplied(org, recordedIds))
+        return blocked('its own sign-in service is not applied yet');
+    if (!recordedIds[ZITADEL_ORG_SCOPE_KEY])
+        return blocked('its ZITADEL organisation is not recorded yet');
+    if (!filesDeps.keys) {
+        return blocked('the host supplies no keys mint port (keysMint) for the files host keyring');
+    }
+    if (!filesDeps.bucket)
+        return blocked('the host supplies no bucket port');
+    const hostname = `files.${org.domain}`;
+    const applied = Boolean(recordedIds[`coolify:own-files:${org.id}`]);
+    if (applied &&
+        recordedIds[PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
+        recordedIds[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
+        (recordedIds[PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY] ?? '') ===
+            filesShareDomains([org]).join(',') &&
+        recordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] &&
+        recordedIds[OWN_FILES_RUNNER_SCOPE_KEY] &&
+        recordedIds[ZITADEL_FILES_PROJECT_SCOPE_KEY] &&
+        recordedIds[PLATFORM_FILES_INTROSPECTION_SCOPE_KEY] &&
+        recordedIds[PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY]) {
+        return { step: null, blocked: null };
+    }
+    // The platform administers a company's files host: its operator is the platform's owner, never the company's.
+    const platformOwner = readiness.platformOwnerUserId;
+    if (!platformOwner) {
+        return blocked("the platform has not recorded its owner's sign-in id yet");
+    }
+    return {
+        blocked: null,
+        step: {
+            action: {
+                system: 'coolify',
+                kind: 'own-files',
+                key: org.id,
+                desired: {
+                    hostname,
+                    gitRef,
+                    ...(platformOwner === 'none' ? {} : { bootstrapOperator: platformOwner }),
+                },
+            },
+            step: {
+                description: `provision ${org.slug}'s own files host at ${hostname}`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
+/** `unmanaged` key of the one line `planOwnFilesR2` reports. */
+export const OWN_FILES_R2_BLOCKED_KEY = 'own-files-r2';
+/**
+ * The storage key of an own org's files bucket: planned once its files host is applied (the host must be
+ * up to receive the key) and until `files_r2_id` is recorded. A token minted and not confirmed delivered
+ * does not block the step: the next run deletes it first. The blocked line is fixed text.
+ */
+export function planOwnFilesR2(options) {
+    const { org, recordedIds, isPlatformOrg, ownServices, ports } = options;
+    if (!ownsServices(org) || isPlatformOrg || !org.domain || !ownServices) {
+        return { step: null, blocked: null };
+    }
+    if (!recordedIds[`coolify:own-files:${org.id}`])
+        return { step: null, blocked: null };
+    if (recordedIds[OWN_FILES_R2_SCOPE_KEY])
+        return { step: null, blocked: null };
+    const missing = [
+        ...(ports.r2Keys ? [] : ['R2 key port (r2Keys)']),
+        ...(ports.storeR2Credentials
+            ? []
+            : ["storeR2Credentials on the company's files-organisation port"]),
+    ];
+    if (missing.length > 0) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s own files storage key is blocked, not planned: the host supplies no ${missing.join(' and no ')}`,
+        };
+    }
+    return {
+        blocked: null,
+        step: {
+            action: {
+                system: 'coolify',
+                kind: 'own-files-r2',
+                key: org.id,
+                desired: { bucket: orgTarget(org).names.filesBucket },
+            },
+            step: {
+                description: `make and deliver ${org.slug}'s storage key for bucket ${orgTarget(org).names.filesBucket}`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}

package/dist/plan/own-dns.d.ts

@@ -0,0 +1,6 @@
+import type { StepScope } from './own-services.js';
+/** Comma-separated hostnames of the tunnel CNAMEs an own org's service steps wrote. */
+export declare const OWN_SERVICES_DNS_HOSTNAMES_SCOPE_KEY = "own_services_dns_hostnames";
+/** Records a hostname once, and writes the record out now: called after the DNS write, so a crash between the two is repaired by the rerun. */
+export declare function recordOwnDnsHostname(scope: StepScope, hostname: string): Promise<void>;
+export declare function ownDnsHostnames(recordedIds: Readonly<Record<string, string>>): string[];

package/dist/plan/own-dns.js

@@ -0,0 +1,15 @@
+/** Comma-separated hostnames of the tunnel CNAMEs an own org's service steps wrote. */
+export const OWN_SERVICES_DNS_HOSTNAMES_SCOPE_KEY = 'own_services_dns_hostnames';
+/** Records a hostname once, and writes the record out now: called after the DNS write, so a crash between the two is repaired by the rerun. */
+export async function recordOwnDnsHostname(scope, hostname) {
+    const known = (scope.recordedIds()[OWN_SERVICES_DNS_HOSTNAMES_SCOPE_KEY] ?? '')
+        .split(',')
+        .filter(Boolean);
+    if (known.includes(hostname))
+        return;
+    scope.recordScopeId(OWN_SERVICES_DNS_HOSTNAMES_SCOPE_KEY, [...known, hostname].join(','));
+    await scope.persist();
+}
+export function ownDnsHostnames(recordedIds) {
+    return (recordedIds[OWN_SERVICES_DNS_HOSTNAMES_SCOPE_KEY] ?? '').toLowerCase().split(',');
+}

package/dist/plan/own-limits.d.ts

@@ -0,0 +1,22 @@
+import type { CoolifyPort } from './executor.js';
+/**
+ * The hard limits every container of a company that runs its own services
+ * gets: one flat default. Field names are Coolify's (`PATCH /applications/{uuid}`
+ * and `PATCH /databases/{uuid}`: `limits_memory`, `limits_cpus`). Coolify has
+ * no field for a process limit, and its `custom_docker_run_options` parser drops
+ * `--pids-limit`, so 512 processes cannot be set through Coolify.
+ */
+export declare const OWN_LIMITS_MEMORY = "1g";
+export declare const OWN_LIMITS_CPUS = "1";
+/** The same bound the neighbouring Coolify calls in this package use for a call that may hang. */
+export declare const OWN_LIMITS_TIMEOUT_MS = 60000;
+type LimitsPort = Partial<Pick<CoolifyPort, 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'findApplicationByName' | 'getApplication' | 'getDatabase' | 'updateApplication' | 'raw'>>;
+/**
+ * The Coolify port an own-services step uses, with the limits set on every
+ * application and database it creates, and set again on one it finds without
+ * them, so a company provisioned before the limits existed converges on its
+ * next apply. A failed limits call fails the calling step before it records
+ * its applied marker; the next run finds the resource and sets them.
+ */
+export declare function limited<C extends LimitsPort>(coolify: C): C;
+export {};