@wtfalch/foundry 0.33.1 → 0.34.0

package/dist/plan/own-limits.js

@@ -0,0 +1,101 @@
+/**
+ * The hard limits every container of a company that runs its own services
+ * gets: one flat default. Field names are Coolify's (`PATCH /applications/{uuid}`
+ * and `PATCH /databases/{uuid}`: `limits_memory`, `limits_cpus`). Coolify has
+ * no field for a process limit, and its `custom_docker_run_options` parser drops
+ * `--pids-limit`, so 512 processes cannot be set through Coolify.
+ */
+export const OWN_LIMITS_MEMORY = '1g';
+export const OWN_LIMITS_CPUS = '1';
+const OWN_LIMITS = { limits_memory: OWN_LIMITS_MEMORY, limits_cpus: OWN_LIMITS_CPUS };
+/** The same bound the neighbouring Coolify calls in this package use for a call that may hang. */
+export const OWN_LIMITS_TIMEOUT_MS = 60_000;
+const lacks = (r) => Boolean(r) && (r?.limits_memory !== OWN_LIMITS_MEMORY || r?.limits_cpus !== OWN_LIMITS_CPUS);
+async function bounded(work, what) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${what}: setting the resource limits timed out`)), OWN_LIMITS_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The Coolify port an own-services step uses, with the limits set on every
+ * application and database it creates, and set again on one it finds without
+ * them, so a company provisioned before the limits existed converges on its
+ * next apply. A failed limits call fails the calling step before it records
+ * its applied marker; the next run finds the resource and sets them.
+ */
+export function limited(coolify) {
+    const patchApp = (uuid) => {
+        if (!coolify.updateApplication)
+            throw new Error('own limits: the Coolify port has no updateApplication');
+        return bounded(coolify.updateApplication(uuid, OWN_LIMITS), `application ${uuid}`);
+    };
+    const patchDb = (uuid) => {
+        if (!coolify.raw)
+            throw new Error('own limits: the Coolify port has no raw');
+        return bounded(coolify.raw('PATCH', `/databases/${uuid}`, OWN_LIMITS), `database ${uuid}`);
+    };
+    const afterCreate = (create, patch) => async (input) => {
+        const created = await create.call(coolify, input);
+        await patch(created.uuid);
+        return created;
+    };
+    const over = {};
+    if (coolify.createGithubAppApplication)
+        over.createGithubAppApplication = afterCreate(coolify.createGithubAppApplication, patchApp);
+    if (coolify.createDockerImageApplication)
+        over.createDockerImageApplication = afterCreate(coolify.createDockerImageApplication, patchApp);
+    if (coolify.createDockerfileApplication)
+        over.createDockerfileApplication = afterCreate(coolify.createDockerfileApplication, patchApp);
+    if (coolify.createPostgresDatabase) {
+        const create = coolify.createPostgresDatabase;
+        over.createPostgresDatabase = async (input) => {
+            const created = await create.call(coolify, input);
+            await patchDb(created.uuid);
+            return created;
+        };
+    }
+    const getApplication = coolify.getApplication;
+    if (getApplication) {
+        over.getApplication = async (uuid) => {
+            const app = await getApplication.call(coolify, uuid);
+            if (lacks(app))
+                await patchApp(uuid);
+            return app;
+        };
+    }
+    const find = coolify.findApplicationByName;
+    if (find && getApplication) {
+        over.findApplicationByName = async (...args) => {
+            const found = await find.apply(coolify, args);
+            if (found && lacks(await getApplication.call(coolify, found.uuid)))
+                await patchApp(found.uuid);
+            return found;
+        };
+    }
+    const getDatabase = coolify.getDatabase;
+    if (getDatabase) {
+        over.getDatabase = async (uuid) => {
+            const db = await getDatabase.call(coolify, uuid);
+            if (lacks(db))
+                await patchDb(uuid);
+            return db;
+        };
+    }
+    return new Proxy(coolify, {
+        get(target, prop) {
+            if (typeof prop === 'string' && prop in over)
+                return over[prop];
+            const value = Reflect.get(target, prop, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}

package/dist/plan/own-services.d.ts

@@ -0,0 +1,193 @@
+import type { LivekitCredentials } from '../calls-sfu-keys.js';
+import type { CallsSfuUrls } from '../calls-sfu.js';
+import type { DeclaredOrg } from '../org.js';
+import type { BrokerPort } from './broker-entries.js';
+import type { DnsPort } from './edge-dns.js';
+import type { ZonePort } from './edge-zones.js';
+import type { CallsSfuPort, CloudflarePort, CoolifyPort, FilesOrganisationPort, FoundryStepExecutorPorts, JobsSchedulerPort, MailPort, ZitadelPort } from './executor.js';
+import type { PlatformStepExecutionContext, StepExecutionContext } from './plan-apply.js';
+import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformTunnelPort, PlatformTunnelsFactory } from './platform-providers.js';
+/** Applied-state key under which an own org's provisioned-services marker is recorded. */
+export declare const OWN_SERVICES_APPLIED_SCOPE_KEY = "own_services_applied";
+/**
+ * Every name a service step creates, so the platform's steps and an own
+ * org's steps take them from one place. Names are unique on the server: each
+ * Coolify app name, each `custom_internal_name` on the shared Docker network
+ * and each held-key ref carries the owner (`platform` or the org slug).
+ */
+export interface ServiceTarget {
+    readonly id: string;
+    readonly kind: 'platform' | 'org';
+    readonly names: {
+        authDb: string;
+        authZitadel: string;
+        authLogin: string;
+        authBroker: string;
+        authTunnel: string;
+        authCloudflared: string;
+        mailApp: string;
+        mailTunnel: string;
+        mailCloudflared: string;
+        filesDb: string;
+        filesMigrate: string;
+        filesRunner: string;
+        /** An own org's R2 bucket. The platform's is host-supplied (`PlatformFilesDeps.r2`), so its value here is never read. */
+        filesBucket: string;
+        jobsApp: string;
+        jobsDb: string;
+        sfuApp: string;
+        sfuTunnel: string;
+        sfuCloudflared: string;
+    };
+    readonly internal: {
+        authZitadel: string;
+        authLogin: string;
+        authBroker: string;
+        mail: string;
+        files: string;
+        jobs: string;
+        sfu: string;
+    };
+    readonly refs: {
+        instanceBearer: string;
+        authAdmin: string;
+        brokerMailKey: string;
+        mailAdminKey: string;
+        filesManagement: string;
+        filesIntrospection: string;
+        jobsAdminToken: string;
+        livekitKeys: string;
+        /** An own files host's derived keys credential, held after the mint. The platform's value is never read. */
+        keysCredential: string;
+        /** The public half the host verifies with (`KEYS_VERIFY_KEYS`). */
+        keysVerifyKeys: string;
+    };
+}
+/** The platform's shared services, with the literals the platform steps use today. */
+export declare function platformTarget(): ServiceTarget;
+/** One company's own services: every name and ref carries the org's slug, so two orgs never clash. */
+export declare function orgTarget(org: Pick<DeclaredOrg, 'slug'>): ServiceTarget;
+/** Where a step reads and records its ids: the platform's store or one org's. */
+export interface StepScope {
+    /** This scope's own ids (platform store or org store). */
+    recordedIds(): Readonly<Record<string, string>>;
+    recordScopeId(key: string, id: string): void;
+    persist(): Promise<void>;
+    /** Read only. For a platform scope this is `recordedIds()`. */
+    platformIds(): Readonly<Record<string, string>>;
+}
+export declare function scopeFromPlatform(context: PlatformStepExecutionContext, _platformIds?: never): StepScope;
+export declare function scopeFromOrg(context: StepExecutionContext, platformIds: Readonly<Record<string, string>>): StepScope;
+export interface ServiceNetwork {
+    dns(): Promise<DnsPort>;
+    tunnels(): Promise<PlatformTunnelPort>;
+    zoneId(apex: string): Promise<string | undefined>;
+}
+export declare function platformNetwork(deps: {
+    dns: PlatformDnsFactory;
+    tunnels: PlatformTunnelsFactory;
+    cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
+}, scope: StepScope, step: string): ServiceNetwork;
+/**
+ * An own org's DNS and tunnels: the org's edge-routed ports, never the
+ * platform's scope, and the zone edge recorded for the org's domain. A port
+ * the host did not supply is named in the error, never reached around.
+ */
+export declare function orgNetwork(ports: {
+    dns?: DnsPort;
+    tunnels?: PlatformTunnelPort;
+    zones?: Pick<ZonePort, 'findZoneByApex'>;
+}, scope: StepScope, step: string): ServiceNetwork;
+/** Where the project comes from: the platform's 'platform' project, or the org's own. */
+export interface ProjectSource {
+    ensure(coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject'>, scope: StepScope): Promise<string>;
+}
+export interface OwnAuthInstance {
+    issuerUrl: string;
+    bearerRef: string;
+}
+/** Every field optional: absent means "not ready", and the executor throws {@link OwnServicesBlockedError} naming the ref. */
+export interface OwnServicePorts {
+    zitadel?: ZitadelPort;
+    mail?: MailPort;
+    broker?: BrokerPort;
+    filesOrganisation?: FilesOrganisationPort;
+    jobsScheduler?: JobsSchedulerPort;
+    callsSfu?: CallsSfuPort;
+    callsSfuUrls?: CallsSfuUrls;
+}
+/** Dependencies of the `coolify:own-*` steps themselves. */
+export interface OwnServicesProvision {
+    auth: PlatformAuthDeps;
+    mail: PlatformMailDeps;
+    files: OwnFilesDeps;
+    jobs: NonNullable<FoundryPlatformStepExecutorOptions['coolify']>;
+    sfu: OwnSfuDeps;
+}
+/** What the keys worker answers for one company's derived host: the credential and the public keys, plus ids for the record. */
+export interface FilesKeysMinted {
+    credential: string;
+    verifyKeys: string;
+    credentialId: string;
+    epoch: number;
+    expiresAt: number;
+}
+/** Mints a company's own keys credential on the keys worker. Called with the host id `files-<slug>`. */
+export interface FilesKeysMint {
+    workerUrl: string;
+    mint(hostId: string, requestId: string): Promise<FilesKeysMinted>;
+}
+/** One S3 pair for one bucket, and the id of the API token it came from. The secret is shown once. */
+export interface OwnFilesR2Key {
+    accessKeyId: string;
+    secretAccessKey: string;
+    tokenId: string;
+}
+/**
+ * Mints and removes the storage key of one company bucket. Each call is given 30 seconds. A delete
+ * of a token that is already gone (404) is a success.
+ */
+export interface OwnFilesR2Keys {
+    mintBucketKey(bucket: string): Promise<OwnFilesR2Key>;
+    deleteBucketKey(tokenId: string): Promise<void>;
+}
+/** The token id of the storage key delivered to an own files host. Its presence means the step is done. */
+export declare const OWN_FILES_R2_SCOPE_KEY = "files_r2_id";
+/** The token id minted and not yet confirmed delivered: deleted before any new mint. */
+export declare const OWN_FILES_R2_UNDELIVERED_SCOPE_KEY = "files_r2_undelivered";
+/**
+ * An own files host takes no `keys.credential`, `keys.auditToken` or `jobsSigningSecrets` from here:
+ * those are the platform's and never reach a company's containers. Its keyring comes from `keysMint`.
+ */
+export interface OwnFilesDeps extends Omit<PlatformFilesDeps, 'r2'> {
+    r2Buckets: {
+        ensureBucket(name: string): Promise<{
+            bucket: string;
+            endpoint: string;
+        }>;
+    };
+    /** Absent: the own files R2 key step is blocked, naming this port. */
+    r2Keys?: OwnFilesR2Keys;
+    /** Absent: the own files step is blocked, naming this port. */
+    keysMint?: FilesKeysMint;
+    /** Reads a delivered secret back from the host, so a rerun after a failed run resumes instead of minting. */
+    readSecret?: (ref: string) => Promise<string | null>;
+}
+export interface OwnSfuDeps {
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'createDockerImageApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'deploy' | 'getApplication' | 'raw' | 'listEnvs' | 'createDockerfileApplication' | 'deployAndWait'>;
+    mintLivekitCredentials?: () => LivekitCredentials;
+    deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
+}
+/** A held key an own service needs is missing. Names the service and the ref, never a value. */
+export declare class OwnServicesBlockedError extends Error {
+    readonly service: string;
+    readonly ref: string;
+    constructor(service: string, ref: string);
+}
+export interface OwnServicesPort {
+    /** Ports scoped to this org's own instances, or null when the org is not own. Throws {@link OwnServicesBlockedError} when a held key is missing. */
+    portsFor(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<OwnServicePorts | null>;
+    /** Builds the ZITADEL port for one company instance. */
+    zitadelFor(instance: OwnAuthInstance): ZitadelPort;
+    provision: OwnServicesProvision;
+}

package/dist/plan/own-services.js

@@ -0,0 +1,167 @@
+import { apexZoneKey, exactZone, platformDns, platformTunnels } from './platform-providers.js';
+/** The key the org's zone step records its Cloudflare zone id under. */
+const ORG_ZONE_SCOPE_KEY = 'cloudflare_zone';
+/** Applied-state key under which an own org's provisioned-services marker is recorded. */
+export const OWN_SERVICES_APPLIED_SCOPE_KEY = 'own_services_applied';
+/** The platform's shared services, with the literals the platform steps use today. */
+export function platformTarget() {
+    return {
+        id: 'platform',
+        kind: 'platform',
+        names: {
+            authDb: 'platform-auth-db',
+            authZitadel: 'platform-auth-zitadel',
+            authLogin: 'platform-auth-login',
+            authBroker: 'platform-auth-broker',
+            authTunnel: 'platform-auth-tunnel',
+            authCloudflared: 'platform-auth-cloudflared',
+            mailApp: 'platform-mail-stalwart',
+            mailTunnel: 'platform-mail-tunnel',
+            mailCloudflared: 'platform-mail-cloudflared',
+            filesDb: 'platform-files-db',
+            filesMigrate: 'files-migrate',
+            filesRunner: 'files',
+            filesBucket: 'platform-files',
+            jobsApp: 'jobs',
+            jobsDb: 'jobs-scheduler-db',
+            sfuApp: 'platform-sfu',
+            sfuTunnel: 'platform-sfu-tunnel',
+            sfuCloudflared: 'platform-sfu-cloudflared',
+        },
+        internal: {
+            authZitadel: 'platform-auth-zitadel',
+            authLogin: 'platform-auth-login',
+            authBroker: 'platform-auth-broker',
+            mail: 'platform-mail-stalwart',
+            files: 'platform-files',
+            jobs: 'platform-jobs',
+            sfu: 'platform-sfu',
+        },
+        refs: {
+            instanceBearer: 'zitadel:platform:instanceBearer',
+            authAdmin: 'zitadel:platform:admin',
+            brokerMailKey: 'lettermint:platform:apiToken',
+            mailAdminKey: 'stalwart:platform:admin',
+            filesManagement: 'files:platform:managementKey',
+            filesIntrospection: 'zitadel:platform:files:introspection',
+            jobsAdminToken: 'jobs:scheduler:adminToken',
+            livekitKeys: 'livekit:platform:keys',
+            keysCredential: 'keys:platform:credential',
+            keysVerifyKeys: 'keys:platform:verifyKeys',
+        },
+    };
+}
+/** One company's own services: every name and ref carries the org's slug, so two orgs never clash. */
+export function orgTarget(org) {
+    const s = org.slug;
+    return {
+        id: s,
+        kind: 'org',
+        names: {
+            authDb: `${s}-auth-db`,
+            authZitadel: `${s}-auth-zitadel`,
+            authLogin: `${s}-auth-login`,
+            authBroker: `${s}-auth-broker`,
+            authTunnel: `${s}-auth-tunnel`,
+            authCloudflared: `${s}-auth-cloudflared`,
+            mailApp: `${s}-mail-stalwart`,
+            mailTunnel: `${s}-mail-tunnel`,
+            mailCloudflared: `${s}-mail-cloudflared`,
+            filesDb: `${s}-files-db`,
+            filesMigrate: `${s}-files-migrate`,
+            filesRunner: `${s}-files`,
+            filesBucket: `${s}-files`,
+            jobsApp: `${s}-jobs`,
+            jobsDb: `${s}-jobs-db`,
+            sfuApp: `${s}-sfu`,
+            sfuTunnel: `${s}-sfu-tunnel`,
+            sfuCloudflared: `${s}-sfu-cloudflared`,
+        },
+        internal: {
+            authZitadel: `${s}-auth-zitadel`,
+            authLogin: `${s}-auth-login`,
+            authBroker: `${s}-auth-broker`,
+            mail: `${s}-mail-stalwart`,
+            files: `${s}-files`,
+            jobs: `${s}-jobs`,
+            sfu: `${s}-sfu`,
+        },
+        refs: {
+            instanceBearer: `zitadel:org:${s}:instanceBearer`,
+            authAdmin: `zitadel:org:${s}:admin`,
+            brokerMailKey: `lettermint:org:${s}:apiToken`,
+            mailAdminKey: `stalwart:org:${s}:admin`,
+            filesManagement: `files:org:${s}:managementKey`,
+            filesIntrospection: `zitadel:org:${s}:files:introspection`,
+            jobsAdminToken: `jobs:org:${s}:adminToken`,
+            livekitKeys: `livekit:org:${s}:keys`,
+            keysCredential: `keys:org:${s}:credential`,
+            keysVerifyKeys: `keys:org:${s}:verifyKeys`,
+        },
+    };
+}
+export function scopeFromPlatform(context, _platformIds) {
+    return {
+        recordedIds: () => context.recordedIds(),
+        recordScopeId: (key, id) => context.recordScopeId(key, id),
+        persist: async () => {
+            await context.persist?.();
+        },
+        platformIds: () => context.recordedIds(),
+    };
+}
+export function scopeFromOrg(context, platformIds) {
+    return {
+        recordedIds: () => context.recordedIds(),
+        recordScopeId: (key, id) => context.recordScopeId(key, id),
+        persist: () => context.persistScopeIds(),
+        platformIds: () => platformIds,
+    };
+}
+export function platformNetwork(deps, scope, step) {
+    return {
+        dns: () => platformDns(deps, scope.recordedIds(), step),
+        tunnels: () => platformTunnels(deps, scope.recordedIds(), step),
+        zoneId: async (apex) => scope.recordedIds()[apexZoneKey(apex)] ?? (await exactZone(deps.cloudflare, apex))?.id,
+    };
+}
+/**
+ * An own org's DNS and tunnels: the org's edge-routed ports, never the
+ * platform's scope, and the zone edge recorded for the org's domain. A port
+ * the host did not supply is named in the error, never reached around.
+ */
+export function orgNetwork(ports, scope, step) {
+    return {
+        dns: async () => {
+            if (!ports.dns)
+                throw new Error(`${step}: the host supplies no DNS port for this org`);
+            return ports.dns;
+        },
+        tunnels: async () => {
+            if (!ports.tunnels)
+                throw new Error(`${step}: the host supplies no tunnel port for this org`);
+            return ports.tunnels;
+        },
+        zoneId: async (apex) => {
+            const recorded = scope.recordedIds()[ORG_ZONE_SCOPE_KEY];
+            if (recorded)
+                return recorded;
+            return ports.zones ? (await exactZone(ports.zones, apex))?.id : undefined;
+        },
+    };
+}
+/** The token id of the storage key delivered to an own files host. Its presence means the step is done. */
+export const OWN_FILES_R2_SCOPE_KEY = 'files_r2_id';
+/** The token id minted and not yet confirmed delivered: deleted before any new mint. */
+export const OWN_FILES_R2_UNDELIVERED_SCOPE_KEY = 'files_r2_undelivered';
+/** A held key an own service needs is missing. Names the service and the ref, never a value. */
+export class OwnServicesBlockedError extends Error {
+    service;
+    ref;
+    constructor(service, ref) {
+        super(`own ${service} is blocked: held key ${ref} is missing`);
+        this.service = service;
+        this.ref = ref;
+        this.name = 'OwnServicesBlockedError';
+    }
+}

package/dist/plan/own-sfu.d.ts

@@ -0,0 +1,69 @@
+import { type LivekitCredentials } from '../calls-sfu-keys.js';
+import { type CallsSfuUrls } from '../calls-sfu.js';
+import { type DeployHealthRuntime } from './deploy-health.js';
+import type { FoundryStepExecutorPorts } from './executor.js';
+import type { OwnSfuDeps, ProjectSource, ServiceNetwork, ServiceTarget, StepScope } from './own-services.js';
+/** The LiveKit image, the same repository the shared SFU runs. */
+export declare const OWN_SFU_IMAGE = "livekit/livekit-server";
+export declare const OWN_SFU_APP_SCOPE_KEY = "coolify_own_sfu_app";
+export declare const OWN_SFU_TUNNEL_SCOPE_KEY = "cloudflare_own_sfu_tunnel";
+export declare const OWN_SFU_CONNECTOR_APP_SCOPE_KEY = "coolify_own_sfu_connector_app";
+/** Set to the app id before the key pair leaves, cleared after the pair is delivered and written to the app. */
+export declare const OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY = "own_sfu_keys_undelivered";
+/** The app id once the company's key pair is delivered and in the app's env. */
+export declare const OWN_SFU_KEYS_SCOPE_KEY = "own_sfu_keys_set";
+export declare const OWN_SFU_DEPLOY_PENDING_SCOPE_KEY = "own_sfu_deploy_pending";
+export declare const OWN_SFU_APPLIED_VERSION_SCOPE_KEY = "own_sfu_applied_version";
+export declare const OWN_SFU_APPLIED_SLOT_SCOPE_KEY = "own_sfu_applied_slot";
+export declare const OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY = "own_sfu_applied_hostname";
+export declare const SFU_INTERNAL_URL_SCOPE_KEY = "sfu_internal_url";
+export declare const SFU_PUBLIC_URL_SCOPE_KEY = "sfu_public_url";
+export interface SfuAppDeps {
+    coolify: OwnSfuDeps['coolify'];
+    network: ServiceNetwork;
+    deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
+    /** Reads a delivered secret back from the host. Without it, an undelivered marker cannot be resumed. */
+    readSecret?: (ref: string) => Promise<string | null>;
+    runtime: DeployHealthRuntime;
+    mintLivekitCredentials?: () => LivekitCredentials;
+    /** Called with every secret value this step handles, so the caller can scrub it from output. */
+    onSecret?: (value: string) => void;
+}
+export interface SfuAppInput {
+    slot: number;
+    /** `sfu.<domain>`. */
+    hostname: string;
+    /** The org's domain: the zone the hostname goes in. */
+    apex: string;
+    /** The pinned LiveKit release tag. */
+    version: string;
+    project: ProjectSource;
+}
+/** The Docker `ports_mappings` string for a slot: the UDP range and the TCP fallback port, one to one. */
+export declare function sfuPortsMappings(slot: number): string;
+/**
+ * LiveKit takes its whole config from one env value. `node_ip` is the
+ * server's address: the app is not on the host network, so the media ports
+ * reach it through the published mappings.
+ */
+export declare function sfuConfig(input: {
+    slot: number;
+    nodeIp: string;
+    keys: LivekitCredentials;
+}): string;
+/**
+ * One company's LiveKit media server as a Coolify app: the image, its slot's
+ * ports published to the server, and a tunnel for signalling at `sfu.<domain>`.
+ * The company's single key pair is minted once, delivered to
+ * `target.refs.livekitKeys` as JSON, and written to the app's env; it is never
+ * recorded. Rules 1 to 6 of `CLAUDE.md` "Platform steps".
+ */
+export declare function provisionSfuApp(scope: StepScope, deps: SfuAppDeps, target: ServiceTarget, input: SfuAppInput): Promise<{
+    resourceId?: string;
+}>;
+/**
+ * The addresses of the company's media server, from its recorded ids. Before
+ * the step is recorded the pair is empty, which `resolveCallsSfuUrls` refuses:
+ * an own org's calls service never falls back to the shared SFU's addresses.
+ */
+export declare function ownSfuUrls(ids: Readonly<Record<string, string>>): CallsSfuUrls;