@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/bootstrap/bootstrap.d.ts

@@ -47,7 +47,7 @@ export interface BootstrapCompanyDeps {
     readers: LiveReaders;
     executor: StepExecutor;
     /** The same flags `FoundryPlanApply` takes: a step whose port the host did not build is reported blocked. */
-    options?: Pick<FoundryPlanApplyOptions, 'ownerInviteMail' | 'broker'>;
+    options?: Pick<FoundryPlanApplyOptions, 'ownerInviteMail' | 'broker' | 'ownServices'>;
 }
 export interface BootstrapPlatformDeps {
     /** Foundry's tables live here, already migrated by the host; the store, the audit log and the plan all use it. */

package/dist/bootstrap/bootstrap.js

@@ -59,13 +59,18 @@ function allowBootstrapApply(withCompany) {
     };
 }
 /**
- * The org steps phase two applies: the sign-in org and its domain, the owner
+ * The org steps phase two applies: the owner's own sign-in server and its zone,
+ * the sign-in org and its domain, the owner
  * (whose user id Boule's `AUTHZ_FIRST_OWNER` carries), Boule's sign-in client,
  * and Boule with its database. Everything else the company declares (chat,
  * mail, Boule's broker entry, which waits for the org's mail domain, ...) is
  * for a later, ordinary org apply.
  */
 const COMPANY_SLICE_STEPS = new Set([
+    // The owner's own sign-in server, before anyone can sign in. Own mail, files,
+    // jobs and sfu follow after sign-in, as for every company.
+    'cloudflare:zone',
+    'coolify:own-auth',
     'zitadel:issuer',
     'zitadel:registration-closed',
     'zitadel:domain',
@@ -77,8 +82,10 @@ const companySliceOnly = {
     step: (action) => COMPANY_SLICE_STEPS.has(`${action.system}:${action.kind}`) ||
         COMPANY_SLICE_STEPS.has(`${action.system}:${action.kind}:${action.key}`),
     // `coolify:boule:mail` only says Boule runs without mail for now.
-    blocked: (key) => key !== 'coolify:boule:mail' &&
-        [...COMPANY_SLICE_STEPS].some((step) => key === step || key.startsWith(`${step}:`)),
+    // `own-auth` is the unmanaged key `planOwnAuth` uses for a blocked sign-in server.
+    blocked: (key) => key === 'own-auth' ||
+        (key !== 'coolify:boule:mail' &&
+            [...COMPANY_SLICE_STEPS].some((step) => key === step || key.startsWith(`${step}:`))),
 };
 /** Shown instead of a phase-two error that could carry a value; the failing step's own name and redacted text are in `failed`. */
 const COMPANY_NOT_FINISHED = "the company's own slice did not finish, so Archon has no people-store keys yet; run onboarding again";
@@ -118,6 +125,10 @@ function trackedOrgExecutor(inner, progress, redactor) {
             }
         },
         ...(inner.ownEdgePorts ? { ownEdgePorts: () => inner.ownEdgePorts?.() ?? {} } : {}),
+        // The own sign-in step plans without a held Lettermint key only when the executor can mint one.
+        ...(inner.ownMailKeyMintable
+            ? { ownMailKeyMintable: () => inner.ownMailKeyMintable?.() ?? false }
+            : {}),
     };
 }
 /** The audit log with every free-text field run through the redactor before it is stored. */
@@ -334,10 +345,14 @@ export async function bootstrapPlatform(input, deps) {
                 return result;
             },
             ...(inner.blockedSteps
-                ? { blockedSteps: (platform, ids) => inner.blockedSteps?.(platform, ids) ?? {} }
+                ? {
+                    blockedSteps: (platform, ids, owner) => inner.blockedSteps?.(platform, ids, owner) ?? {},
+                }
                 : {}),
             ...(inner.driftedSteps
-                ? { driftedSteps: (platform, ids) => inner.driftedSteps?.(platform, ids) ?? {} }
+                ? {
+                    driftedSteps: (platform, ids, owner) => inner.driftedSteps?.(platform, ids, owner) ?? {},
+                }
                 : {}),
         };
         let orgProgress = { started: 0, completed: 0 };
@@ -392,10 +407,11 @@ export async function bootstrapPlatform(input, deps) {
         const blockedRaw = (driven.failed ? [] : (driven.lastPlan?.unmanaged ?? []))
             .filter((item) => item.key !== undefined)
             .map((item) => ({ step: item.key, message: item.description }));
+        const platformBlockedCount = blockedRaw.length;
         if (companyDeps && !failed) {
             // Phase two: the platform's own org. Its Boule needs the platform's
             // sign-in, and Archon's people-store keys need that Boule.
-            const company = await driveApply({
+            const driveCompany = (label) => driveApply({
                 plan: () => planApply.plan(COMPANY_INCLUDED_ORG_ID),
                 apply: (plan, stepProgress) => {
                     orgProgress = stepProgress;
@@ -406,27 +422,30 @@ export async function bootstrapPlatform(input, deps) {
                     phase: 'plan',
                     system: roundSystem(plan),
                     round,
-                    message: `company round ${round}: ${plan.steps.length} step(s) planned`,
+                    message: `${label}company round ${round}: ${plan.steps.length} step(s) planned`,
                     steps: plan.steps.map((s) => s.description),
                 }),
                 onApplied: (round, plan) => emit({
                     phase: 'apply',
                     system: roundSystem(plan),
                     round,
-                    message: `company round ${round}: applied`,
+                    message: `${label}company round ${round}: applied`,
                     steps: plan.steps.map((s) => s.description),
                 }),
             });
+            const company = await driveCompany('');
             applied.push(...company.applied);
             if (company.failed) {
                 failed = company.failed;
                 blockedRaw.push({ step: 'company', message: COMPANY_NOT_FINISHED });
             }
             else {
+                const companyBlockedStart = blockedRaw.length;
                 for (const item of company.lastPlan?.unmanaged ?? []) {
                     if (item.key !== undefined)
                         blockedRaw.push({ step: item.key, message: item.description });
                 }
+                const companyBlockedCount = blockedRaw.length - companyBlockedStart;
                 // Boule's broker entry needs the org's mail domain, which only the org's mail step
                 // records, so it is outside this slice. Until it is applied nobody can sign in to Boule:
                 // say so, and never report the onboarding complete.
@@ -444,12 +463,31 @@ export async function bootstrapPlatform(input, deps) {
                 failed = again.failed;
                 lastPlan = again.lastPlan;
                 if (!again.failed) {
-                    for (const item of again.lastPlan?.unmanaged ?? []) {
-                        if (item.key !== undefined && !blockedRaw.some((b) => b.step === item.key)) {
-                            blockedRaw.push({ step: item.key, message: item.description });
+                    // Archon's registration put the first entry on the owner's broker. Only now can the
+                    // owner's sign-in mint its login client and start that broker, so its plan runs once more.
+                    const signIn = await driveCompany('after Archon: ');
+                    applied.push(...signIn.applied);
+                    if (signIn.failed) {
+                        failed = signIn.failed;
+                        blockedRaw.push({ step: 'company', message: COMPANY_NOT_FINISHED });
+                    }
+                    else {
+                        const fresh = [];
+                        for (const item of signIn.lastPlan?.unmanaged ?? []) {
+                            if (item.key !== undefined)
+                                fresh.push({ step: item.key, message: item.description });
                         }
+                        blockedRaw.splice(companyBlockedStart, companyBlockedCount, ...fresh);
                     }
                 }
+                if (!failed) {
+                    // Archon was blocked on the owner's sign-in in phase one; this plan is the current truth.
+                    blockedRaw.splice(0, platformBlockedCount);
+                    const platformBlocked = (again.lastPlan?.unmanaged ?? [])
+                        .filter((item) => item.key !== undefined)
+                        .map((item) => ({ step: item.key, message: item.description }));
+                    blockedRaw.unshift(...platformBlocked);
+                }
             }
         }
         const blocked = blockedRaw.map((item) => ({

package/dist/bootstrap/declare.d.ts

@@ -38,6 +38,11 @@ export interface BootstrapCompany {
     name: string;
     slug: string;
     apex: string;
+    /**
+     * The owner company's own domain: absent means `apex`, `null` means none (it
+     * then runs on oikos.host). `apex` stays the platform's.
+     */
+    domain?: string | null;
 }
 export interface BootstrapOwner {
     givenName: string;
@@ -54,13 +59,15 @@ export interface BootstrapOwner {
  */
 export declare function ownerIdentity(owner: BootstrapOwner): OwnerIdentity;
 /**
- * Company Included's declared org: the platform's owner, tier 3 on the
- * platform's own apex from the start (#512) -- it runs on that domain with
- * hosted mail, not a level-1 org whose domain gets set by hand afterward.
+ * Company Included's declared org: the platform's owner, a company like any
+ * other (`services.own`: its own sign-in, mail, files and jobs). Tier 3 on the
+ * platform's apex from the start (#512) -- it runs on that domain with
+ * hosted mail, not a level-1 org whose domain gets set by hand afterward --
+ * unless `company.domain` is `null`, which runs it on oikos.host.
  * `issuer`/`calls`/`site` go on the domain too, the same tier-3 defaults
  * archon#388 gives every company declared there. `calls` and `site` stay
- * disabled (calls is not in v1; no site is declared), so `usesDomain` is
- * inert on both until one is switched on. Chat stays off the domain: its
+ * disabled (calls is not in v1; no site is declared). Without a domain
+ * `calls.usesDomain` is off, as `validateCalls` requires. Chat stays off the domain: its
  * re-key onto a per-org homeserver is not built yet (#463). The org's own
  * sign-in still never collides with the shared ZITADEL instance's host --
  * `loginHostnameFor` (#488) falls back to `<slug>-auth.oikos.host` whenever

package/dist/bootstrap/declare.js

@@ -36,10 +36,11 @@ export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
  */
 export const DEFAULT_HC_IMAGE_TAG = VERSIONS.hc;
 /**
- * Every platform service except `sfu` is enabled, like the other steps: a
- * service whose dependencies the host did not supply is reported blocked,
- * not planned. `sfu` stays off because it needs a held SSH key and host
- * fingerprint, a separate human step (issue 170). `edge` is on because every
+ * Every platform service is enabled except `auth`, `mail`, `files`, `jobs`
+ * and `sfu`: the owner company runs its own copies of those like any
+ * company (`validatePlatform` refuses them on), so the platform keeps only
+ * what no company owns. A service whose dependencies the host did not supply
+ * is reported blocked, not planned. `edge` is on because every
  * platform DNS record is written through it (F4.dns); its own Cloudflare API
  * token is a held key (`cloudflare:edge:apiToken`), and until a human holds
  * it the planner reports edge blocked, and auth, mail and archon with it.
@@ -47,16 +48,23 @@ export const DEFAULT_HC_IMAGE_TAG = VERSIONS.hc;
  * the same as mail and archon.
  */
 const SERVICES_ENABLED_BY_DEFAULT = new Set([
-    'auth',
-    'mail',
-    'files',
     'ai',
-    'jobs',
     'integrations',
     'archon',
     'edge',
     'hc',
 ]);
+/**
+ * The services every company deploys its own copy of. Their platform entries
+ * are off but still carry the release the own steps deploy
+ * (`serviceGitRefsOf`); with an empty one `own-auth` is blocked.
+ */
+const OWN_SERVICE_KEYS = new Set([
+    'auth',
+    'mail',
+    'files',
+    'jobs',
+]);
 /**
  * The owner as `OwnerIdentity`, trimmed. Throws a plain error naming the
  * field when one is empty or an address is not an address. The work address
@@ -75,33 +83,36 @@ export function ownerIdentity(owner) {
     return identity;
 }
 /**
- * Company Included's declared org: the platform's owner, tier 3 on the
- * platform's own apex from the start (#512) -- it runs on that domain with
- * hosted mail, not a level-1 org whose domain gets set by hand afterward.
+ * Company Included's declared org: the platform's owner, a company like any
+ * other (`services.own`: its own sign-in, mail, files and jobs). Tier 3 on the
+ * platform's apex from the start (#512) -- it runs on that domain with
+ * hosted mail, not a level-1 org whose domain gets set by hand afterward --
+ * unless `company.domain` is `null`, which runs it on oikos.host.
  * `issuer`/`calls`/`site` go on the domain too, the same tier-3 defaults
  * archon#388 gives every company declared there. `calls` and `site` stay
- * disabled (calls is not in v1; no site is declared), so `usesDomain` is
- * inert on both until one is switched on. Chat stays off the domain: its
+ * disabled (calls is not in v1; no site is declared). Without a domain
+ * `calls.usesDomain` is off, as `validateCalls` requires. Chat stays off the domain: its
  * re-key onto a per-org homeserver is not built yet (#463). The org's own
  * sign-in still never collides with the shared ZITADEL instance's host --
  * `loginHostnameFor` (#488) falls back to `<slug>-auth.oikos.host` whenever
  * `auth.<domain>` would equal the platform's own auth hostname.
  */
 export function declaredCompanyOrg(company, owner) {
+    const domain = company.domain === undefined ? company.apex : company.domain;
     return {
         id: COMPANY_INCLUDED_ORG_ID,
         slug: company.slug,
         displayName: company.name,
-        domain: company.apex,
+        domain,
         mail: {
             mode: 'hosted',
-            usesDomain: true,
+            usesDomain: domain !== null,
             ownerMailboxAddress: null,
             noReplyLocalPart: 'no-reply',
         },
         chat: { enabled: true, usesDomain: false },
-        calls: { enabled: false, usesDomain: true },
-        issuer: { usesDomain: true },
+        calls: { enabled: false, usesDomain: domain !== null },
+        issuer: { usesDomain: domain !== null },
         site: { enabled: false, usesDomain: true },
         hosting: {
             enabled: false,
@@ -119,6 +130,7 @@ export function declaredCompanyOrg(company, owner) {
         buyer: { legalName: null, orgNumber: null, address: null, vatRegistered: null },
         bespokeAppRepo: null,
         adoptedApp: null,
+        services: { own: true },
         owners: [ownerIdentity(owner)],
         test: false,
     };
@@ -134,7 +146,7 @@ export function declaredPlatformFor(apex, serverIpv4) {
         services[key] = {
             enabled,
             hostname: defaultPlatformHostname(key, apex),
-            gitRef: !enabled
+            gitRef: !enabled && !OWN_SERVICE_KEYS.has(key)
                 ? ''
                 : key === 'mail'
                     ? DEFAULT_MAIL_IMAGE_TAG
@@ -148,9 +160,12 @@ export function declaredPlatformFor(apex, serverIpv4) {
         apex,
         ...(serverIpv4 ? { serverIpv4 } : {}),
         ...services,
+        // The platform runs no mail server, but every company's mail goes through the shared relay.
+        mail: { ...services.mail, relay: true },
         // Off, like `sfu`: the pin is an Archon release tag and digest, which exist
         // only after Archon runs. Declared on with no pin, it would be reported
         // blocked and the bootstrap would never be complete.
         uptime: { enabled: false, tag: '', sha256: '' },
+        heartbeatsProvider: 'self-hosted',
     };
 }

package/dist/bootstrap/versions.d.ts

@@ -13,9 +13,31 @@ export interface PinnedVersions {
     cloudflared: string;
     stalwart: string;
     hc: string;
+    /** The mail relay's base image (an exact Alpine release); Postfix comes from its package repository. */
+    alpine: string;
+    /** A static busybox, copied into the MAS image so its health check has an HTTP client. */
+    busybox: string;
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;
+/**
+ * The multi-arch index digest of each tag in `versions.json`, in
+ * `versions.digests.json` beside it. Kept apart so every tag comparison
+ * (applied refs, version-change lines) stays on the tag. Validated on read:
+ * a malformed digest, or a key of `versions.json` without one, throws.
+ */
+export declare function loadDigests(): PinnedVersions;
+export declare const DIGESTS: PinnedVersions;
+/**
+ * `<tag>@<digest>` for an image string handed to Coolify or a Dockerfile.
+ * Only the image string uses it; the recorded applied ref stays the tag.
+ */
+export declare function pinnedRef(key: keyof PinnedVersions): string;
+/**
+ * A declared tag that equals the pinned one gets its digest; any other
+ * declared tag (an override) is passed through unchanged.
+ */
+export declare function pinnedTagFor(key: keyof PinnedVersions, tag: string): string;
 /**
  * Why an image tag cannot be used, or `null`. #248: generalised out of what
  * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard
@@ -24,3 +46,5 @@ export declare const VERSIONS: PinnedVersions;
  * `"ZITADEL"`, `"LiveKit"`, ...); `example` is a real pinned tag to suggest.
  */
 export declare function floatingTagBlocked(label: string, tag: string, example: string): string | null;
+/** {@link floatingTagBlocked} for a git ref: it also refuses `main`, `master` and `HEAD`. */
+export declare function floatingRefBlocked(label: string, ref: string, example: string): string | null;

package/dist/bootstrap/versions.js

@@ -10,6 +10,43 @@ export function loadVersions() {
     return JSON.parse(readFileSync(VERSIONS_PATH, 'utf8'));
 }
 export const VERSIONS = loadVersions();
+const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const DIGESTS_PATH = new URL('../../versions.digests.json', import.meta.url);
+/**
+ * The multi-arch index digest of each tag in `versions.json`, in
+ * `versions.digests.json` beside it. Kept apart so every tag comparison
+ * (applied refs, version-change lines) stays on the tag. Validated on read:
+ * a malformed digest, or a key of `versions.json` without one, throws.
+ */
+export function loadDigests() {
+    const raw = JSON.parse(readFileSync(DIGESTS_PATH, 'utf8'));
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        throw new Error('versions.digests.json must be a JSON object');
+    }
+    const record = raw;
+    for (const key of Object.keys(loadVersions())) {
+        const value = record[key];
+        if (typeof value !== 'string' || !DIGEST_PATTERN.test(value)) {
+            throw new Error(`versions.digests.json: "${key}" must be a sha256:<64 hex> digest`);
+        }
+    }
+    return record;
+}
+export const DIGESTS = loadDigests();
+/**
+ * `<tag>@<digest>` for an image string handed to Coolify or a Dockerfile.
+ * Only the image string uses it; the recorded applied ref stays the tag.
+ */
+export function pinnedRef(key) {
+    return `${VERSIONS[key]}@${DIGESTS[key]}`;
+}
+/**
+ * A declared tag that equals the pinned one gets its digest; any other
+ * declared tag (an override) is passed through unchanged.
+ */
+export function pinnedTagFor(key, tag) {
+    return tag === VERSIONS[key] ? pinnedRef(key) : tag;
+}
 /**
  * Tag spellings that resolve to whatever the registry currently has, not a
  * fixed image -- a re-apply of the same declaration can silently run a
@@ -41,3 +78,12 @@ export function floatingTagBlocked(label, tag, example) {
     }
     return null;
 }
+/** Branch names that move, refused for a git ref on top of the floating image tags. */
+const FLOATING_GIT_REFS = new Set(['main', 'master', 'head']);
+/** {@link floatingTagBlocked} for a git ref: it also refuses `main`, `master` and `HEAD`. */
+export function floatingRefBlocked(label, ref, example) {
+    if (FLOATING_GIT_REFS.has(ref.trim().toLowerCase())) {
+        return `the ${label} image tag "${ref}" floats; declare a pinned release (for example ${example})`;
+    }
+    return floatingTagBlocked(label, ref, example);
+}

package/dist/calls-sfu.d.ts

@@ -129,6 +129,16 @@ export declare const LIVEKIT_SIGNALLING_PORT = 7880;
 export declare const LIVEKIT_MEDIA_TCP_PORT = 7881;
 /** RTP media. Matches #122's "Decided" section exactly; not the wider range `docs/research/2026-09-19-meetings-research.md` lists for embedded TURN, which #122 does not turn on. */
 export declare const LIVEKIT_MEDIA_UDP_RANGE = "50000:60000";
+/**
+ * The ports of one slice of the Coolify server's media ports (`services.sfuSlot`):
+ * slot n holds UDP `50000 + (n-1)*500` to `50000 + n*500 - 1` and TCP `7881 + n`.
+ * Throws for a slot outside 1..{@link SFU_SLOT_MAX}.
+ */
+export declare function sfuSlotPorts(slot: number): {
+    udpStart: number;
+    udpEnd: number;
+    tcp: number;
+};
 /**
  * The host's private network on `vmbr1`, where the calls service reaches
  * LiveKit's API directly (#127's "Human steps": VM 105 gets a second NIC on

package/dist/calls-sfu.js

@@ -52,7 +52,8 @@
  * `calls-sfu-deploy-support.ts`'s `fileWriteMode`), never logged, scrubbed
  * from any error `calls-sfu-deploy.mjs` prints.
  */
-import { VERSIONS } from './bootstrap/versions.js';
+import { VERSIONS, pinnedRef } from './bootstrap/versions.js';
+import { SFU_SLOT_MAX } from './org.js';
 // ---------------------------------------------------------------------------
 // The guard
 // ---------------------------------------------------------------------------
@@ -119,6 +120,27 @@ export const LIVEKIT_SIGNALLING_PORT = 7880;
 export const LIVEKIT_MEDIA_TCP_PORT = 7881;
 /** RTP media. Matches #122's "Decided" section exactly; not the wider range `docs/research/2026-09-19-meetings-research.md` lists for embedded TURN, which #122 does not turn on. */
 export const LIVEKIT_MEDIA_UDP_RANGE = '50000:60000';
+/** The first UDP port of slot 1 and the width of every slot's UDP range (contract section 1). */
+const SFU_SLOT_UDP_BASE = 50000;
+const SFU_SLOT_UDP_WIDTH = 500;
+/** Slot n's TCP fallback port is this plus n. */
+const SFU_SLOT_TCP_BASE = 7881;
+/**
+ * The ports of one slice of the Coolify server's media ports (`services.sfuSlot`):
+ * slot n holds UDP `50000 + (n-1)*500` to `50000 + n*500 - 1` and TCP `7881 + n`.
+ * Throws for a slot outside 1..{@link SFU_SLOT_MAX}.
+ */
+export function sfuSlotPorts(slot) {
+    if (!Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX) {
+        throw new Error(`sfu slot must be an integer from 1 to ${SFU_SLOT_MAX}`);
+    }
+    const udpStart = SFU_SLOT_UDP_BASE + (slot - 1) * SFU_SLOT_UDP_WIDTH;
+    return {
+        udpStart,
+        udpEnd: udpStart + SFU_SLOT_UDP_WIDTH - 1,
+        tcp: SFU_SLOT_TCP_BASE + slot,
+    };
+}
 /**
  * The host's private network on `vmbr1`, where the calls service reaches
  * LiveKit's API directly (#127's "Human steps": VM 105 gets a second NIC on
@@ -176,6 +198,11 @@ const UNSCOPED_SIGNALLING_RULE_PATTERN = new RegExp(`^${LIVEKIT_SIGNALLING_PORT}
 export function hasUnscopedSignallingRule(status) {
     return UNSCOPED_SIGNALLING_RULE_PATTERN.test(status);
 }
+/**
+ * Where `cloudflared` serves its metrics, which include `/ready`. The image has no shell, so its check is
+ * the binary's own `tunnel ready` in exec form, and that command asks this address.
+ */
+const CLOUDFLARED_METRICS_ADDRESS = '127.0.0.1:20241';
 /**
  * `network_mode: host`: LiveKit's own self-hosting guide recommends this
  * over mapping ten thousand individual UDP ports, and the SFU VM has no
@@ -187,19 +214,33 @@ export function hasUnscopedSignallingRule(status) {
 export function dockerComposeYaml() {
     return `services:
   livekit:
-    image: ${LIVEKIT_IMAGE_REF}
+    image: livekit/livekit-server:${pinnedRef('livekit')}
     restart: unless-stopped
     network_mode: host
     volumes:
       - ${LIVEKIT_CONFIG_PATH}:/etc/livekit.yaml:ro
     command: --config /etc/livekit.yaml
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:${LIVEKIT_SIGNALLING_PORT}/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
   cloudflared:
-    image: ${CLOUDFLARED_IMAGE_REF}
+    image: cloudflare/cloudflared:${pinnedRef('cloudflared')}
     restart: unless-stopped
     network_mode: host
     env_file:
       - ${CLOUDFLARED_ENV_PATH}
+    environment:
+      TUNNEL_METRICS: ${CLOUDFLARED_METRICS_ADDRESS}
     command: tunnel --no-autoupdate run
+    healthcheck:
+      test: ["CMD", "cloudflared", "tunnel", "--metrics", "${CLOUDFLARED_METRICS_ADDRESS}", "ready"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
 `;
 }
 /**

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
-export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, } from './platform.js';
-export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, VersionPin, VersionPinPart, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateVersionPin, validateSite, } from './org.js';
+export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
+export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
 export type { PinnedVersions };
 export declare const PINNED_VERSIONS: Readonly<PinnedVersions>;
@@ -18,17 +18,28 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
-export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
+export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, MailRoute, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
+export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
+export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
+export type { BackupGatePorts } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
+export type { FilesKeysMint, FilesKeysMinted, OwnFilesDeps, OwnFilesR2Key, OwnFilesR2Keys, OwnServicePorts, OwnServicesPort, OwnServicesProvision, OwnSfuDeps, ServiceTarget, } from './plan/index.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgTarget, } from './plan/index.js';
+export type { FilesHostInput, JobsHostDeps, JobsHostInput, OwnAuthInstance, PlanOwnAuthOptions, PlanOwnFilesOptions, PlanOwnFilesR2Options, PlanOwnJobsOptions, } from './plan/index.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
+export type { PlanOwnSfuOptions, SfuAppDeps, SfuAppInput } from './plan/index.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuPortsMappings, } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
+export { NO_DOMAIN_ZONE, ownHostnames } from './plan/index.js';
+export type { OwnHostnames } from './plan/index.js';
 export type { EnsureSignInOrgOptions } from './plan/index.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
@@ -42,7 +53,7 @@ export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
@@ -68,3 +79,5 @@ export type { RunnerDb } from './runner/db.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';
 export type { CreateJobRunnerOptions, JobRunner, RunFailure, RunRecord, RunStatus, RunStepsOptions, RunnerStep, } from './runner/types.js';
+export type { StoredApp } from './plan/health-gaps.js';
+export { EXIT_JOBS, REPO_DOCKERFILE_CHECKED, hasRealCheck, healthGaps, } from './plan/health-gaps.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
-export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateVersionPin, validateSite, } from './org.js';
+export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
 // object, not a copy.
@@ -11,12 +11,18 @@ export { StaleLeaseError } from './store.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
+export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
+export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgTarget, } from './plan/index.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuPortsMappings, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
+export { NO_DOMAIN_ZONE, ownHostnames } from './plan/index.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
@@ -24,7 +30,7 @@ export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, Provi
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';
@@ -40,3 +46,4 @@ export { bootstrapPlatform } from './bootstrap/index.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';
+export { EXIT_JOBS, REPO_DOCKERFILE_CHECKED, hasRealCheck, healthGaps, } from './plan/health-gaps.js';

package/dist/migrations/0051_org_services.sql

@@ -0,0 +1,13 @@
+-- @wtfalch/foundry: a company's own services. `services_own` true gives the
+-- org its own sign-in, mail, files, jobs and calls SFU; false (the default)
+-- keeps the platform's shared ones. `services_sfu_slot` is the slice of the
+-- server's SFU ports an own org's media server takes; no two orgs share one.
+-- Mirrors src/store/schema.ts's `declaredOrgs` table additions.
+
+alter table foundry_declared_orgs
+  add column if not exists services_own boolean not null default false,
+  add column if not exists services_sfu_slot integer;
+
+create unique index if not exists foundry_declared_orgs_sfu_slot_idx
+  on foundry_declared_orgs (services_sfu_slot)
+  where services_sfu_slot is not null;