@wtfalch/foundry 0.33.1 → 0.34.0

package/dist/bootstrap/versions.d.ts

@@ -13,6 +13,10 @@ export interface PinnedVersions {
     cloudflared: string;
     stalwart: string;
     hc: string;
+    /** The mail relay's base image (an exact Alpine release); Postfix comes from its package repository. */
+    alpine: string;
+    /** A static busybox, copied into the MAS image so its health check has an HTTP client. */
+    busybox: string;
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;

package/dist/calls-sfu.d.ts

@@ -129,6 +129,16 @@ export declare const LIVEKIT_SIGNALLING_PORT = 7880;
 export declare const LIVEKIT_MEDIA_TCP_PORT = 7881;
 /** RTP media. Matches #122's "Decided" section exactly; not the wider range `docs/research/2026-09-19-meetings-research.md` lists for embedded TURN, which #122 does not turn on. */
 export declare const LIVEKIT_MEDIA_UDP_RANGE = "50000:60000";
+/**
+ * The ports of one slice of the Coolify server's media ports (`services.sfuSlot`):
+ * slot n holds UDP `50000 + (n-1)*500` to `50000 + n*500 - 1` and TCP `7881 + n`.
+ * Throws for a slot outside 1..{@link SFU_SLOT_MAX}.
+ */
+export declare function sfuSlotPorts(slot: number): {
+    udpStart: number;
+    udpEnd: number;
+    tcp: number;
+};
 /**
  * The host's private network on `vmbr1`, where the calls service reaches
  * LiveKit's API directly (#127's "Human steps": VM 105 gets a second NIC on

package/dist/calls-sfu.js

@@ -53,6 +53,7 @@
  * from any error `calls-sfu-deploy.mjs` prints.
  */
 import { VERSIONS } from './bootstrap/versions.js';
+import { SFU_SLOT_MAX } from './org.js';
 // ---------------------------------------------------------------------------
 // The guard
 // ---------------------------------------------------------------------------
@@ -119,6 +120,27 @@ export const LIVEKIT_SIGNALLING_PORT = 7880;
 export const LIVEKIT_MEDIA_TCP_PORT = 7881;
 /** RTP media. Matches #122's "Decided" section exactly; not the wider range `docs/research/2026-09-19-meetings-research.md` lists for embedded TURN, which #122 does not turn on. */
 export const LIVEKIT_MEDIA_UDP_RANGE = '50000:60000';
+/** The first UDP port of slot 1 and the width of every slot's UDP range (contract section 1). */
+const SFU_SLOT_UDP_BASE = 50000;
+const SFU_SLOT_UDP_WIDTH = 500;
+/** Slot n's TCP fallback port is this plus n. */
+const SFU_SLOT_TCP_BASE = 7881;
+/**
+ * The ports of one slice of the Coolify server's media ports (`services.sfuSlot`):
+ * slot n holds UDP `50000 + (n-1)*500` to `50000 + n*500 - 1` and TCP `7881 + n`.
+ * Throws for a slot outside 1..{@link SFU_SLOT_MAX}.
+ */
+export function sfuSlotPorts(slot) {
+    if (!Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX) {
+        throw new Error(`sfu slot must be an integer from 1 to ${SFU_SLOT_MAX}`);
+    }
+    const udpStart = SFU_SLOT_UDP_BASE + (slot - 1) * SFU_SLOT_UDP_WIDTH;
+    return {
+        udpStart,
+        udpEnd: udpStart + SFU_SLOT_UDP_WIDTH - 1,
+        tcp: SFU_SLOT_TCP_BASE + slot,
+    };
+}
 /**
  * The host's private network on `vmbr1`, where the calls service reaches
  * LiveKit's API directly (#127's "Human steps": VM 105 gets a second NIC on
@@ -176,6 +198,11 @@ const UNSCOPED_SIGNALLING_RULE_PATTERN = new RegExp(`^${LIVEKIT_SIGNALLING_PORT}
 export function hasUnscopedSignallingRule(status) {
     return UNSCOPED_SIGNALLING_RULE_PATTERN.test(status);
 }
+/**
+ * Where `cloudflared` serves its metrics, which include `/ready`. The image has no shell, so its check is
+ * the binary's own `tunnel ready` in exec form, and that command asks this address.
+ */
+const CLOUDFLARED_METRICS_ADDRESS = '127.0.0.1:20241';
 /**
  * `network_mode: host`: LiveKit's own self-hosting guide recommends this
  * over mapping ten thousand individual UDP ports, and the SFU VM has no
@@ -193,13 +220,27 @@ export function dockerComposeYaml() {
     volumes:
       - ${LIVEKIT_CONFIG_PATH}:/etc/livekit.yaml:ro
     command: --config /etc/livekit.yaml
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:${LIVEKIT_SIGNALLING_PORT}/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
   cloudflared:
     image: ${CLOUDFLARED_IMAGE_REF}
     restart: unless-stopped
     network_mode: host
     env_file:
       - ${CLOUDFLARED_ENV_PATH}
+    environment:
+      TUNNEL_METRICS: ${CLOUDFLARED_METRICS_ADDRESS}
     command: tunnel --no-autoupdate run
+    healthcheck:
+      test: ["CMD", "cloudflared", "tunnel", "--metrics", "${CLOUDFLARED_METRICS_ADDRESS}", "ready"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
 `;
 }
 /**

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, appEntry, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
@@ -18,16 +18,22 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
-export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
+export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, MailRoute, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
+export type { FilesKeysMint, FilesKeysMinted, OwnFilesDeps, OwnFilesR2Key, OwnFilesR2Keys, OwnServicePorts, OwnServicesPort, OwnServicesProvision, OwnSfuDeps, ServiceTarget, } from './plan/index.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgTarget, } from './plan/index.js';
+export type { FilesHostInput, JobsHostDeps, JobsHostInput, OwnAuthInstance, PlanOwnAuthOptions, PlanOwnFilesOptions, PlanOwnFilesR2Options, PlanOwnJobsOptions, } from './plan/index.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
+export type { PlanOwnSfuOptions, SfuAppDeps, SfuAppInput } from './plan/index.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuPortsMappings, } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export type { EnsureSignInOrgOptions } from './plan/index.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
@@ -42,7 +48,7 @@ export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
@@ -68,3 +74,5 @@ export type { RunnerDb } from './runner/db.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';
 export type { CreateJobRunnerOptions, JobRunner, RunFailure, RunRecord, RunStatus, RunStepsOptions, RunnerStep, } from './runner/types.js';
+export type { StoredApp } from './plan/health-gaps.js';
+export { EXIT_JOBS, REPO_DOCKERFILE_CHECKED, hasRealCheck, healthGaps, } from './plan/health-gaps.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, appEntry, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
@@ -14,8 +14,11 @@ export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAudit
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgTarget, } from './plan/index.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuPortsMappings, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
@@ -24,7 +27,7 @@ export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, Provi
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
@@ -40,3 +43,4 @@ export { bootstrapPlatform } from './bootstrap/index.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';
+export { EXIT_JOBS, REPO_DOCKERFILE_CHECKED, hasRealCheck, healthGaps, } from './plan/health-gaps.js';

package/dist/migrations/0051_org_services.sql

@@ -0,0 +1,13 @@
+-- @wtfalch/foundry: a company's own services. `services_own` true gives the
+-- org its own sign-in, mail, files, jobs and calls SFU; false (the default)
+-- keeps the platform's shared ones. `services_sfu_slot` is the slice of the
+-- server's SFU ports an own org's media server takes; no two orgs share one.
+-- Mirrors src/store/schema.ts's `declaredOrgs` table additions.
+
+alter table foundry_declared_orgs
+  add column if not exists services_own boolean not null default false,
+  add column if not exists services_sfu_slot integer;
+
+create unique index if not exists foundry_declared_orgs_sfu_slot_idx
+  on foundry_declared_orgs (services_sfu_slot)
+  where services_sfu_slot is not null;

package/dist/migrations/0052_platform_mail_relay.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: `mail_relay` true puts one shared relay container on host
+-- port 25, which routes each message by recipient domain to a company's own
+-- mail server or to the platform's; false (the default) keeps the platform
+-- Stalwart bound to port 25 directly. Mirrors src/store/schema.ts's
+-- `foundryDeclaredPlatform` table addition.
+
+alter table foundry_declared_platform
+  add column if not exists mail_relay boolean not null default false;

package/dist/org.d.ts

@@ -548,6 +548,22 @@ export declare function validateSite(org: DeclaredOrg): string | null;
  * reason to pin at all.
  */
 export declare function validateCalls(org: DeclaredOrg): string | null;
+/** A company with a domain runs its own sign-in, mail, files, jobs and calls SFU in its own containers. */
+export interface ServicesConfig {
+    /** true: own copies of the services. false (default): the platform's shared ones. */
+    own: boolean;
+    /**
+     * Which slice of the server's SFU ports this company's media server takes.
+     * Required when `own` and `calls.enabled`. 1 to {@link SFU_SLOT_MAX}.
+     * Slice n holds UDP (50000 + (n-1)*500) .. (50000 + n*500 - 1) and TCP 7881 + n.
+     */
+    sfuSlot?: number | null;
+}
+export declare const SFU_SLOT_MAX = 20;
+/** The only reader of `services.own`: an org without `services` runs the platform's shared services. */
+export declare function ownsServices(org: Pick<DeclaredOrg, 'services'>): boolean;
+/** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
+export declare function validateServices(org: DeclaredOrg): string | null;
 /**
  * Per-org SSO. Decided to exist in #14 ("Also in scope") and its resolved
  * research #3 ("per-org SSO code exists unused"); nothing about its
@@ -822,6 +838,8 @@ export interface DeclaredOrg {
     site: SiteConfig;
     /** `enabled: false`, `issuerApps: []` by default -- a brand new org has no hosted app (#71). */
     hosting: HostingConfig;
+    /** Absent means `{ own: false }`. Optional so every existing literal and test fixture compiles unchanged, as `calls.versionPin` and `MailConfig.mailApps` do. */
+    services?: ServicesConfig;
     sso: SsoConfig;
     guests: GuestsConfig;
     solo: SoloConfig;

package/dist/org.js

@@ -706,6 +706,32 @@ export function validateCalls(org) {
     }
     return null;
 }
+export const SFU_SLOT_MAX = 20;
+/** The only reader of `services.own`: an org without `services` runs the platform's shared services. */
+export function ownsServices(org) {
+    return org.services?.own === true;
+}
+/** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
+export function validateServices(org) {
+    const slot = org.services?.sfuSlot ?? null;
+    if (!ownsServices(org)) {
+        return slot === null ? null : 'services.sfuSlot needs services.own';
+    }
+    if (org.domain === null) {
+        return "services.own needs the org's own domain: the issuer is auth.<domain>";
+    }
+    if (!org.issuer.usesDomain) {
+        return 'services.own needs issuer.usesDomain: the issuer is auth.<domain>';
+    }
+    if (org.mail.mode !== 'off' && !org.mail.usesDomain) {
+        return "services.own needs mail.usesDomain: the company's mail server serves its own domain";
+    }
+    if (org.calls.enabled &&
+        (slot === null || !Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX)) {
+        return `services.sfuSlot must be an integer from 1 to ${SFU_SLOT_MAX} when calls are enabled`;
+    }
+    return null;
+}
 const ORG_NUMBER_PATTERN = /^\d{9}$/;
 /**
  * `null` when `buyer` is valid; otherwise the reason it is not, for a caller

package/dist/plan/calls-matrix.d.ts

@@ -47,6 +47,15 @@
 export declare const SYNAPSE_IMAGE = "ghcr.io/element-hq/synapse";
 export declare const SYNAPSE_TAG: string;
 export declare const MAS_IMAGE: string;
+/** MAS listens here in both the calls and the chat config (`http.listeners[0].binds`). */
+export declare const MAS_PORT = 8080;
+/**
+ * The inline Dockerfile of a MAS app: the published image plus its entry command. That image is distroless: no
+ * shell and no HTTP client, so Coolify's own check (always `sh -c`) cannot run in it. A static busybox is copied in
+ * and an exec-form HEALTHCHECK asks MAS's `/health` (a `SELECT 1` on its database). Coolify keeps a Dockerfile's
+ * HEALTHCHECK when its own check is off (`health_check_enabled: false`).
+ */
+export declare function masDockerfile(): string;
 /** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
 export declare const MAS_TAG: string;
 /**

package/dist/plan/calls-matrix.js

@@ -49,6 +49,23 @@ import { VERSIONS } from '../bootstrap/versions.js';
 export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
 export const SYNAPSE_TAG = VERSIONS.synapse;
 export const MAS_IMAGE = `ghcr.io/element-hq/matrix-authentication-service:${VERSIONS.mas}`;
+/** MAS listens here in both the calls and the chat config (`http.listeners[0].binds`). */
+export const MAS_PORT = 8080;
+/**
+ * The inline Dockerfile of a MAS app: the published image plus its entry command. That image is distroless: no
+ * shell and no HTTP client, so Coolify's own check (always `sh -c`) cannot run in it. A static busybox is copied in
+ * and an exec-form HEALTHCHECK asks MAS's `/health` (a `SELECT 1` on its database). Coolify keeps a Dockerfile's
+ * HEALTHCHECK when its own check is off (`health_check_enabled: false`).
+ */
+export function masDockerfile() {
+    return [
+        `FROM busybox:${VERSIONS.busybox} AS busybox`,
+        `FROM ${MAS_IMAGE}`,
+        'COPY --from=busybox /bin/busybox /busybox',
+        'CMD ["server", "--config", "/config/config.yaml"]',
+        `HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 CMD ["/busybox", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:${MAS_PORT}/health"]`,
+    ].join('\n');
+}
 /** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
 export const MAS_TAG = VERSIONS.mas;
 /**

package/dist/plan/cloudflared-connector.d.ts

@@ -7,6 +7,12 @@ import type { CoolifyPort } from './executor.js';
  * `versions.json` (#247).
  */
 export declare const CLOUDFLARED_IMAGE_REF: string;
+/**
+ * Where the connector serves its metrics, which include `/ready` (200 with at least one edge connection, else 503).
+ * The image is distroless, so its check is the binary's own `tunnel ready` in exec form: a Dockerfile HEALTHCHECK,
+ * kept by Coolify while its own check is off. The port is not published; only the container network reaches it.
+ */
+export declare const CLOUDFLARED_METRICS_PORT = 20241;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -24,7 +30,7 @@ export declare function cloudflaredDockerfile(): string;
  * archon) calls this once with its own app name and scope key.
  */
 export interface EnsureCloudflaredConnectorInput {
-    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
+    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
     tunnels: Pick<TunnelPort, 'getTunnelToken'>;
     /** The Cloudflare tunnel this connector dials into (already created and configured by the caller). */
     tunnelId: string;

package/dist/plan/cloudflared-connector.js

@@ -7,6 +7,12 @@ import { isNotFoundError } from './executor.js';
  * `versions.json` (#247).
  */
 export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
+/**
+ * Where the connector serves its metrics, which include `/ready` (200 with at least one edge connection, else 503).
+ * The image is distroless, so its check is the binary's own `tunnel ready` in exec form: a Dockerfile HEALTHCHECK,
+ * kept by Coolify while its own check is off. The port is not published; only the container network reaches it.
+ */
+export const CLOUDFLARED_METRICS_PORT = 20241;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -17,7 +23,12 @@ export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudfla
  * variable `cloudflared` reads at boot.
  */
 export function cloudflaredDockerfile() {
-    return `FROM ${CLOUDFLARED_IMAGE_REF}\nCMD ["tunnel", "--no-autoupdate", "run"]\n`;
+    return [
+        `FROM ${CLOUDFLARED_IMAGE_REF}`,
+        `CMD ["tunnel", "--no-autoupdate", "--metrics", "0.0.0.0:${CLOUDFLARED_METRICS_PORT}", "run"]`,
+        `HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 CMD ["cloudflared", "tunnel", "--metrics", "127.0.0.1:${CLOUDFLARED_METRICS_PORT}", "ready"]`,
+        '',
+    ].join('\n');
 }
 /**
  * Finds or creates the one Coolify app that runs `cloudflared` for
@@ -79,6 +90,8 @@ export async function ensureCloudflaredConnector(input) {
         });
         appId = created.uuid;
         justCreated = true;
+        // Before the first deploy: Coolify reads the Dockerfile's HEALTHCHECK only while its own check is off.
+        await coolify.updateApplication(appId, { health_check_enabled: false });
     }
     if (appId !== input.recordedConnectorAppId)
         await input.recordAppId(appId);

package/dist/plan/diff.d.ts

@@ -43,6 +43,8 @@ export interface DraftStep {
 export interface PlanOrgOptions {
     /** #267: the executor was built with a `loginHostBindings` port. */
     loginHostBindings?: boolean;
+    /** A live read said the org's login host serves OIDC discovery as `https://<host>`. Absent: not read, so Agora keeps the platform issuer. */
+    loginHostServesDiscovery?: boolean;
     /** The executor's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`; without it `planIdTokenUserinfo` plans nothing. */
     zitadelIdTokenUserinfo?: boolean;
     /** F5: the executor was built with a `broker` port. */
@@ -59,6 +61,33 @@ export interface PlanOrgOptions {
     ownerInviteMail?: boolean;
     /** The platform's own service hostnames: `edgeReservedLabels` reserves them under the org's domain, and a wildcard Worker route (`planWorkers`) keeps them out. */
     platformHostnames?: readonly string[];
+    /** The executor was built with an `ownServices` port. Without it an own org's own-service steps are blocked. */
+    ownServices?: boolean;
+    /** An own org's Lettermint key (`orgTarget(org).refs.brokerMailKey`) is held. */
+    ownMailKeyHeld?: boolean;
+    /** The executor can mint an own org's Lettermint key (`FoundryStepExecutor.ownMailKeyMintable`). */
+    ownMailKeyMintable?: boolean;
+    /** The own jobs admin token's held-key ref holds a value. */
+    ownJobsTokenHeld?: boolean;
+    /** The own media server's key pair ref holds a value. */
+    ownSfuKeysHeld?: boolean;
+    /** The relay is declared and has applied a route list; an own org's mail server waits for it. */
+    mailRelayApplied?: boolean;
+    /** The host confirmed the ports of an own org's media server slot are open on the server. */
+    sfuPortsOpen?: boolean;
+    /** What the executor's own files dependencies supply: valid keys worker settings, and a bucket port. Absent counts as neither. */
+    ownFilesDeps?: {
+        keys: boolean;
+        bucket: boolean;
+    };
+    /**
+     * Which ports the own files storage key step needs the host supplied. Absent: the executor was not
+     * asked, and the step is neither planned nor reported.
+     */
+    ownFilesR2Ports?: {
+        r2Keys: boolean;
+        storeR2Credentials: boolean;
+    };
 }
 export interface PlanDetail {
     orgId: OrgId;