@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/oikos-ingress.js

@@ -0,0 +1,231 @@
+import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { COOLIFY_PROXY_ORIGIN } from './executor.js';
+/**
+ * The shared `oikos.host` ingress: one Cloudflare tunnel, its connector app on
+ * Coolify, one proxied wildcard record `*.oikos.host` and one zone-wide rate
+ * limiting rule for the sign-in paths. Every company without a domain of its
+ * own is reached through it, so a fresh platform needs it before such a company
+ * can be planned. It is the platform step that `scripts/shared-ingress.mjs`
+ * used to be run by hand for. The script keeps its own copy of the rate limit
+ * constants (it runs outside this package) and a test here keeps them equal.
+ *
+ * The three names below are found by name, and the tunnel's whole ingress is
+ * replaced. They differ from the script's (`oikos-shared`) on purpose: a hand-made
+ * project or tunnel of that name may carry other traffic, and this step must only
+ * ever find its own.
+ *
+ * One `coolify:app` step keyed {@link PLATFORM_OIKOS_INGRESS_KEY}. Its applied
+ * id (the connector app) is recorded by the runner only when the whole step
+ * returns, so a run that fails halfway is planned again and finds what it made
+ * by name.
+ */
+export const PLATFORM_OIKOS_INGRESS_KEY = 'platform:oikos-ingress';
+export const OIKOS_INGRESS_ZONE = 'oikos.host';
+export const OIKOS_INGRESS_TUNNEL_NAME = 'platform-oikos-ingress';
+export const OIKOS_INGRESS_WILDCARD = `*.${OIKOS_INGRESS_ZONE}`;
+export const OIKOS_INGRESS_CONNECTOR_APP_NAME = 'platform-oikos-ingress-cloudflared';
+export const OIKOS_INGRESS_PROJECT = 'platform-oikos-ingress';
+export const OIKOS_INGRESS_ENVIRONMENT = 'production';
+/** Bookkeeping of what the last run finished; none of these is the applied marker. */
+export const OIKOS_INGRESS_PROJECT_SCOPE_KEY = 'oikos_ingress_project';
+export const OIKOS_INGRESS_TUNNEL_SCOPE_KEY = 'oikos_ingress_tunnel';
+export const OIKOS_INGRESS_CONNECTOR_APP_SCOPE_KEY = 'oikos_ingress_connector_app';
+export const OIKOS_INGRESS_DNS_SCOPE_KEY = 'oikos_ingress_dns';
+export const OIKOS_INGRESS_RATELIMIT_SCOPE_KEY = 'oikos_ingress_ratelimit';
+/** The key the runner records the step's result under (`system:kind:key`). */
+const APPLIED_KEY = `coolify:app:${PLATFORM_OIKOS_INGRESS_KEY}`;
+/** True once the step has finished: the readiness a company without a domain waits for. */
+export function oikosIngressApplied(recordedIds) {
+    return Boolean(recordedIds[APPLIED_KEY]);
+}
+/** Fixed texts. None carries a provider's error. */
+export const OIKOS_INGRESS_BLOCKED = {
+    edgeNotApplied: 'the shared oikos.host ingress is blocked, not planned: every DNS record and tunnel is written through edge, and edge is not applied yet',
+    zoneMissing: `the shared oikos.host ingress is blocked, not planned: the ${OIKOS_INGRESS_ZONE} zone is not on the Cloudflare account the platform's edge reaches; add the zone to that account`,
+    zoneUnchecked: `the shared oikos.host ingress is blocked, not planned: the ${OIKOS_INGRESS_ZONE} zone could not be looked up through edge just now; apply again`,
+    executorMissing: 'the shared oikos.host ingress is blocked, not planned: the host built the platform executor without its oikos ingress dependencies',
+};
+/**
+ * The step, or the reason it cannot be planned. Nothing when the platform has
+ * no edge (it could not write a record) or the step is already applied.
+ * `edgeApplied` is whether edge has recorded its address.
+ */
+export function planOikosIngress(platform, recordedIds, input) {
+    if (!platform.edge.enabled)
+        return { step: null, blocked: null };
+    if (oikosIngressApplied(recordedIds))
+        return { step: null, blocked: null };
+    if (!input.edgeApplied)
+        return { step: null, blocked: OIKOS_INGRESS_BLOCKED.edgeNotApplied };
+    if (input.executorBlocked)
+        return { step: null, blocked: input.executorBlocked };
+    return {
+        step: {
+            action: { system: 'coolify', kind: 'app', key: PLATFORM_OIKOS_INGRESS_KEY, desired: {} },
+            step: {
+                description: `set up the shared ${OIKOS_INGRESS_ZONE} ingress: its tunnel and connector, the ${OIKOS_INGRESS_WILDCARD} record and the sign-in rate limit`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
+// ---- the decisions of scripts/shared-ingress.mjs, as pure functions --------
+/** The tunnel's ingress: the wildcard to Coolify's proxy, then the mandatory catch-all. */
+export function oikosIngressTunnelIngress() {
+    return [
+        { hostname: OIKOS_INGRESS_WILDCARD, service: COOLIFY_PROXY_ORIGIN },
+        { service: 'http_status:404' },
+    ];
+}
+/** What the wildcard record needs: nothing, a create, or an update. */
+export function planWildcardRecord(live, tunnelId) {
+    if (!live)
+        return 'create';
+    return live.content === `${tunnelId}.cfargotunnel.com` && live.proxied === true
+        ? 'exists'
+        : 'update';
+}
+export const OIKOS_INGRESS_RATE_LIMIT_DESCRIPTION = 'foundry: rate limit sign-in paths (oikos.host, shared)';
+/** The Free plan allows one rule per zone, with only "Path" in the expression, a 10 second period and IP counting. */
+export const OIKOS_INGRESS_RATE_LIMIT_PERIOD_SECONDS = 10;
+export const OIKOS_INGRESS_RATE_LIMIT_REQUESTS = 10;
+export const OIKOS_INGRESS_SIGN_IN_EXPRESSION = 'starts_with(http.request.uri.path, "/auth/")';
+export function oikosIngressRateLimitRule() {
+    return {
+        description: OIKOS_INGRESS_RATE_LIMIT_DESCRIPTION,
+        expression: OIKOS_INGRESS_SIGN_IN_EXPRESSION,
+        action: 'block',
+        ratelimit: {
+            characteristics: ['cf.colo.id', 'ip.src'],
+            period: OIKOS_INGRESS_RATE_LIMIT_PERIOD_SECONDS,
+            requests_per_period: OIKOS_INGRESS_RATE_LIMIT_REQUESTS,
+            mitigation_timeout: OIKOS_INGRESS_RATE_LIMIT_PERIOD_SECONDS,
+        },
+    };
+}
+/** Ours is there, nothing is there, or a rule that is not ours holds the zone's one Free-plan slot. */
+export function planOikosRateLimit(rules) {
+    const own = rules.find((r) => r.description === OIKOS_INGRESS_RATE_LIMIT_DESCRIPTION);
+    if (own)
+        return { status: 'exists', ruleId: own.id };
+    return { status: rules.length > 0 ? 'conflict' : 'create', ruleId: null };
+}
+const DEFAULT_CALL_TIMEOUT_MS = 60_000;
+class CallTimeout extends Error {
+}
+/**
+ * One outside call, with a limit. A failure is reported by name only: a provider
+ * error can echo a token or a request body, so it is never carried on.
+ */
+async function call(label, ms, work) {
+    let timer;
+    try {
+        return await Promise.race([
+            work(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new CallTimeout()), ms);
+            }),
+        ]);
+    }
+    catch (error) {
+        const how = error instanceof CallTimeout ? 'timed out' : 'failed';
+        throw new Error(`platform:oikos-ingress: ${label} ${how}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Why the step cannot be planned for want of its zone, or `null` when the zone
+ * is on the account edge reaches. The texts are fixed; a lookup error is never carried.
+ */
+export async function oikosIngressZoneBlocked(zones, callTimeoutMs = DEFAULT_CALL_TIMEOUT_MS) {
+    try {
+        const zone = await call('zone lookup', callTimeoutMs, () => zones.findZoneByApex(OIKOS_INGRESS_ZONE));
+        return zone && zone.name === OIKOS_INGRESS_ZONE ? null : OIKOS_INGRESS_BLOCKED.zoneMissing;
+    }
+    catch {
+        // The error is dropped on purpose: it may carry provider detail, and the fixed text says enough.
+        return OIKOS_INGRESS_BLOCKED.zoneUnchecked;
+    }
+}
+/**
+ * Makes the ingress, in this order: tunnel, its ingress, the connector app, the
+ * wildcard record, the rate limit rule. Each is found by name or content before
+ * it is made, so a second run makes nothing twice. Returns the connector app id,
+ * which the runner records as the step's applied marker only on success.
+ */
+export async function provisionOikosIngress(context, ports) {
+    const ms = ports.callTimeoutMs ?? DEFAULT_CALL_TIMEOUT_MS;
+    const record = async (key, id) => {
+        context.recordScopeId(key, id);
+        await context.persist?.();
+    };
+    const recorded = context.recordedIds();
+    const zone = await call('zone lookup', ms, () => ports.zones.findZoneByApex(OIKOS_INGRESS_ZONE));
+    if (!zone || zone.name !== OIKOS_INGRESS_ZONE) {
+        throw new Error(`platform:oikos-ingress: ${OIKOS_INGRESS_BLOCKED.zoneMissing}`);
+    }
+    let projectUuid = recorded[OIKOS_INGRESS_PROJECT_SCOPE_KEY];
+    if (!projectUuid) {
+        const found = await call('project lookup', ms, () => ports.coolify.findProjectByName(OIKOS_INGRESS_PROJECT));
+        projectUuid = found
+            ? found.uuid
+            : (await call('project create', ms, () => ports.coolify.createProject(OIKOS_INGRESS_PROJECT)))
+                .uuid;
+        await record(OIKOS_INGRESS_PROJECT_SCOPE_KEY, projectUuid);
+    }
+    const projectId = projectUuid;
+    const { environment } = await call('environment', ms, () => ports.coolify.findOrCreateEnvironment(projectId, OIKOS_INGRESS_ENVIRONMENT));
+    const found = await call('tunnel lookup', ms, () => ports.tunnels.findTunnelByName(OIKOS_INGRESS_TUNNEL_NAME));
+    const tunnel = found ??
+        (await call('tunnel create', ms, () => ports.tunnels.createTunnel(OIKOS_INGRESS_TUNNEL_NAME)));
+    await record(OIKOS_INGRESS_TUNNEL_SCOPE_KEY, tunnel.id);
+    await call('tunnel ingress', ms, () => ports.tunnels.putTunnelConfig(tunnel.id, { ingress: oikosIngressTunnelIngress() }));
+    const connector = await call('connector app', ms * 5, () => ensureCloudflaredConnector({
+        coolify: ports.coolify,
+        tunnels: ports.tunnels,
+        tunnelId: tunnel.id,
+        appName: OIKOS_INGRESS_CONNECTOR_APP_NAME,
+        projectUuid: projectId,
+        environment,
+        resolveServer: ports.resolveServer,
+        recordedConnectorAppId: recorded[OIKOS_INGRESS_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (appId) => record(OIKOS_INGRESS_CONNECTOR_APP_SCOPE_KEY, appId),
+    }));
+    const [live] = await call('wildcard lookup', ms, () => ports.dns.findDnsRecord(OIKOS_INGRESS_ZONE, OIKOS_INGRESS_WILDCARD, 'CNAME'));
+    const wanted = {
+        type: 'CNAME',
+        name: OIKOS_INGRESS_WILDCARD,
+        content: `${tunnel.id}.cfargotunnel.com`,
+        proxied: true,
+    };
+    const dnsPlan = planWildcardRecord(live, tunnel.id);
+    if (dnsPlan === 'create') {
+        const made = await call('wildcard create', ms, () => ports.dns.createDnsRecord(OIKOS_INGRESS_ZONE, wanted));
+        await record(OIKOS_INGRESS_DNS_SCOPE_KEY, made.id);
+    }
+    else if (dnsPlan === 'update' && live) {
+        const id = live.id;
+        await call('wildcard update', ms, () => ports.dns.updateDnsRecord(OIKOS_INGRESS_ZONE, id, wanted));
+        await record(OIKOS_INGRESS_DNS_SCOPE_KEY, id);
+    }
+    else if (live) {
+        await record(OIKOS_INGRESS_DNS_SCOPE_KEY, live.id);
+    }
+    const rules = await call('rate limit lookup', ms, () => ports.ratelimits.listRateLimitRules(zone.id));
+    const limit = planOikosRateLimit(rules);
+    if (limit.status === 'conflict') {
+        throw new Error(`platform:oikos-ingress: the ${OIKOS_INGRESS_ZONE} zone already has a rate limiting rule foundry did not make, and the Free plan allows one; it is not adopted or replaced`);
+    }
+    if (limit.status === 'create') {
+        const made = await call('rate limit create', ms, () => ports.ratelimits.createRateLimitRule(zone.id, oikosIngressRateLimitRule()));
+        await record(OIKOS_INGRESS_RATELIMIT_SCOPE_KEY, made.id);
+    }
+    else if (limit.ruleId) {
+        await record(OIKOS_INGRESS_RATELIMIT_SCOPE_KEY, limit.ruleId);
+    }
+    return { resourceId: connector.appId };
+}

package/dist/plan/org-names.d.ts

@@ -0,0 +1,30 @@
+import { type DeclaredOrg } from '../org.js';
+/** Which side of an org a derived name belongs to: its own services or its hosting entries. */
+export type OrgNameSource = 'own' | 'hosting';
+/**
+ * The names foundry gives the services every company can run beside its own
+ * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
+ * calls and the cms site while they are on.
+ */
+export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site'>): string[];
+/**
+ * Every container name, network alias, database, tunnel and bucket name that
+ * foundry derives for an org: its own-service names when it owns services,
+ * and its hosting-entry and database names.
+ */
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
+    name: string;
+    source: OrgNameSource;
+}[];
+/** Every name the platform's shared services take. */
+export declare function platformDerivedNames(): string[];
+export interface NameClash {
+    name: string;
+    /** The slug of the other org, or `platform`. */
+    other: string;
+    /** Which side of `org` holds the clashing name. */
+    source: OrgNameSource;
+}
+/** Every name `org` derives that another org or the platform also derives. */
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
+export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -0,0 +1,108 @@
+import { ownsServices } from '../org.js';
+import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
+import { orgTarget, platformTarget } from './own-services.js';
+import { appNameFor } from './platform-diff.js';
+/**
+ * The names foundry gives the services every company can run beside its own
+ * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
+ * calls and the cms site while they are on.
+ */
+export function companyServiceNames(org) {
+    const s = org.slug;
+    const names = [`${s}-agora`, `${s}-boule`, `${s}-boule-db`, `${s}-tunnel`, `${s}-cloudflared`];
+    if (org.chat?.enabled) {
+        names.push(...Object.values(chatInternalNames(s)), ...Object.values(chatRekeyedInternalNames(s)));
+    }
+    if (org.calls?.enabled) {
+        names.push(`${s}-calls`, `${s}-calls-synapse`, `${s}-calls-mas`, `${s}-calls-synapse-db`, `${s}-calls-mas-db`);
+    }
+    if (org.site?.enabled)
+        names.push(`${s}-site`, `${s}-cms`, `${s}-cms-db`);
+    return names;
+}
+/**
+ * Every container name, network alias, database, tunnel and bucket name that
+ * foundry derives for an org: its own-service names when it owns services,
+ * and its hosting-entry and database names.
+ */
+export function orgDerivedNames(org) {
+    const names = [];
+    for (const name of companyServiceNames(org))
+        names.push({ name, source: 'own' });
+    if (ownsServices(org)) {
+        const target = orgTarget(org);
+        for (const name of [...Object.values(target.names), ...Object.values(target.internal)]) {
+            names.push({ name, source: 'own' });
+        }
+    }
+    for (const entry of org.hosting.entries) {
+        names.push({ name: appNameFor(org, entry), source: 'hosting' });
+    }
+    if (org.hosting.entries.some((entry) => entry.database)) {
+        names.push({ name: `${org.slug}-db`, source: 'hosting' });
+    }
+    return names;
+}
+/** Names the platform's own steps give apps, tunnels, connectors, databases and projects outside `platformTarget()`. */
+const PLATFORM_STEP_NAMES = [
+    'platform',
+    'platform-archon',
+    'platform-archon-db',
+    'platform-archon-tunnel',
+    'platform-archon-cloudflared',
+    'platform-hc',
+    'platform-hc-db',
+    'platform-hc-tunnel',
+    'platform-hc-cloudflared',
+    'platform-edge',
+    'platform-edge-db',
+    'platform-edge-tunnel',
+    'platform-edge-cloudflared',
+    'platform-ai',
+    'platform-ai-migrate',
+    'platform-ai-worker',
+    'platform-backups',
+    'platform-oikos-ingress',
+];
+/** Every name the platform's shared services take. */
+export function platformDerivedNames() {
+    const target = platformTarget();
+    return [
+        ...Object.values(target.names),
+        ...Object.values(target.internal),
+        ...PLATFORM_STEP_NAMES,
+    ];
+}
+/** Every name `org` derives that another org or the platform also derives. */
+export function findNameClashes(org, others) {
+    const mine = orgDerivedNames(org);
+    const platform = new Set(platformDerivedNames());
+    const clashes = [];
+    for (const { name, source } of mine) {
+        if (platform.has(name))
+            clashes.push({ name, other: 'platform', source });
+    }
+    // A hosting entry may not take a name foundry runs a service under for the same company.
+    const ownServices = new Set(companyServiceNames(org));
+    for (const { name, source } of mine) {
+        if (source === 'hosting' && ownServices.has(name)) {
+            clashes.push({ name, other: org.slug, source });
+        }
+    }
+    for (const other of others) {
+        if (other.slug === org.slug)
+            continue;
+        const theirs = new Set(orgDerivedNames(other).map((n) => n.name));
+        for (const { name, source } of mine) {
+            if (theirs.has(name))
+                clashes.push({ name, other: other.slug, source });
+        }
+    }
+    return clashes;
+}
+export function nameClashMessage(slug, clash) {
+    if (clash.other === slug) {
+        return `name '${clash.name}' is taken by both a hosting entry and a service foundry runs for '${slug}'`;
+    }
+    return `name '${clash.name}' is taken by both '${slug}' and '${clash.other}'`;
+}

package/dist/plan/own-diff.d.ts

@@ -0,0 +1,170 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY } from './login-host.js';
+import { type OrgPlatformReadiness } from './platform-org.js';
+/** `unmanaged` key of the one line `planOwnJobs` reports. */
+export declare const OWN_JOBS_BLOCKED_KEY = "own-jobs";
+export interface PlanOwnJobsOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** The admin token's held-key ref holds a value, so an undelivered marker is resumed, not blocked. */
+    tokenHeld?: boolean;
+}
+/**
+ * An own org (`services.own`) runs its own jobs scheduler: a database, an app
+ * and an admin token in the org's own Coolify project. Applied once, and
+ * again when the platform's declared jobs ref changed, an earlier run died
+ * before the deploy finished, or the address was never recorded. Every
+ * blocked line is fixed text: it is part of the stale-plan comparison.
+ */
+export declare function planOwnJobs(options: PlanOwnJobsOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one line `planOwnAuth` reports. */
+export declare const OWN_AUTH_BLOCKED_KEY = "own-auth";
+export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
+/** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
+export declare const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = "own_auth_applied_git_ref";
+export interface PlanOwnAuthOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** The org's Cloudflare zone as the live read shows it, or null when none exists yet. */
+    zone: {
+        active: boolean;
+    } | null;
+    /** The platform's edge has the `oikos.host` zone: the zone gate of a company without a domain. */
+    oikosZoneReady?: boolean;
+    /** The org's own Lettermint key (`orgTarget(org).refs.brokerMailKey`) is held. */
+    mailKeyHeld: boolean;
+    /** The host can mint that key itself (a Lettermint port and a held-key reader): the step plans without it. */
+    mailKeyMintable?: boolean;
+}
+/**
+ * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
+ * and the broker in the org's own Coolify project, at `auth.<domain>`.
+ * Applied once, and again when the declared domain or the platform's auth ref
+ * changed or an earlier run died before it finished. A login client that is
+ * not minted yet plans the step again only once the broker holds an entry:
+ * until then it waits on `AUTH_APPS`, which no re-run of this step supplies. Every blocked line is fixed
+ * text: it is part of the stale-plan comparison.
+ */
+export declare function planOwnAuth(options: PlanOwnAuthOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one line `planOwnMail` reports. */
+export declare const OWN_MAIL_BLOCKED_KEY = "own-mail";
+export interface PlanOwnMailOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** `platform.mail.relay` is declared and the relay recorded a route list as applied. */
+    mailRelayApplied: boolean;
+    /** The org's zone is live and active. */
+    zoneActive: boolean;
+    /**
+     * The host port the company's Stalwart publishes for the relay (`plan-apply.ts` gives the one the
+     * company already has, else the lowest free). Absent: the first port of the range.
+     */
+    smtpPort?: number;
+}
+/**
+ * An own org (`services.own`) with mail on gets its own Stalwart in its own
+ * Coolify project, behind the shared relay. It waits for the org's own
+ * sign-in (its directory trusts that issuer), the relay (port 25 has no other
+ * way in) and the zone. Applied once, and again when the hostname or the
+ * image tag changed. Every blocked line is fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export declare function planOwnMail(options: PlanOwnMailOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one blocked line `planOwnSfu` reports. */
+export declare const OWN_SFU_BLOCKED_KEY = "own-sfu";
+/** `unmanaged` key of the firewall line: the server's ports foundry cannot open itself. */
+export declare const OWN_SFU_FIREWALL_KEY = "own-sfu:firewall";
+export interface PlanOwnSfuOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** The org's zone is live and active: none is planned and none is waiting. */
+    zoneActive: boolean;
+    readiness: OrgPlatformReadiness;
+    /** The host confirmed the slot's ports are open on the server. */
+    sfuPortsOpen: boolean;
+    /** The key pair's held-key ref holds a value, so an undelivered marker is resumed, not blocked. */
+    keysHeld?: boolean;
+}
+/**
+ * An own org (`services.own`) with calls on runs its own LiveKit media server
+ * as a Coolify app. Applied once, and again when the pinned LiveKit version,
+ * the slot or the hostname changed, or an earlier run died before the deploy
+ * finished. `firewall` is the one line that says which ports the server must
+ * have open: foundry opens none, so it stays until the host confirms them.
+ * Every line is fixed text: it is part of the stale-plan comparison.
+ */
+export declare function planOwnSfu(options: PlanOwnSfuOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+    firewall: string | null;
+};
+/** `unmanaged` key of the one line `planOwnFiles` reports. */
+export declare const OWN_FILES_BLOCKED_KEY = "own-files";
+export interface PlanOwnFilesOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    readiness: OrgPlatformReadiness;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** What the host's own files dependencies supply: valid keys worker settings, and a bucket port. */
+    filesDeps: {
+        keys: boolean;
+        bucket: boolean;
+    };
+}
+/**
+ * An own org (`services.own`) runs its own files host: a database, a migrate
+ * app, a runner app, a ZITADEL project in the company's own instance and a
+ * bucket. Applied once, and again when the declared domain, the platform's
+ * files ref or the org's share domains changed or an earlier run died before
+ * it finished. A secret minted but not confirmed delivered never plans the
+ * step again. Every blocked line is fixed text: it is part of the stale-plan
+ * comparison.
+ */
+export declare function planOwnFiles(options: PlanOwnFilesOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** `unmanaged` key of the one line `planOwnFilesR2` reports. */
+export declare const OWN_FILES_R2_BLOCKED_KEY = "own-files-r2";
+export interface PlanOwnFilesR2Options {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    /** The executor was built with an `ownServices` port. */
+    ownServices: boolean;
+    /** Which ports the step needs the host supplied: the R2 key port, and the files-organisation `storeR2Credentials`. */
+    ports: {
+        r2Keys: boolean;
+        storeR2Credentials: boolean;
+    };
+}
+/**
+ * The storage key of an own org's files bucket: planned once its files host is applied (the host must be
+ * up to receive the key) and until `files_r2_id` is recorded. A token minted and not confirmed delivered
+ * does not block the step: the next run deletes it first. The blocked line is fixed text.
+ */
+export declare function planOwnFilesR2(options: PlanOwnFilesR2Options): {
+    step: DraftStep | null;
+    blocked: string | null;
+};