@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/own-limits.d.ts

@@ -0,0 +1,213 @@
+import type { CoolifyPort } from './executor.js';
+import { type CapabilityTier } from './run-options.js';
+/**
+ * The hard limits of every container foundry creates, per step (`LIMITS`). Field names are Coolify's (`PATCH /applications/{uuid}`
+ * and `PATCH /databases/{uuid}`: `limits_memory`, `limits_cpus`). Coolify has
+ * no field for a process limit, and its `custom_docker_run_options` parser drops
+ * `--pids-limit`, so 512 processes cannot be set through Coolify.
+ */
+export declare const OWN_LIMITS_MEMORY = "1g";
+export declare const OWN_LIMITS_CPUS = "1";
+/**
+ * What a step's containers get. `memory` is for applications, `dbMemory` for
+ * databases. `autoDeploy: false` makes every git application the step creates
+ * or updates deploy only when foundry deploys it; `'declared'` leaves it to
+ * the company's own hosting entry (`HostingEntry.autoDeploy`).
+ */
+export interface LimitProfile {
+    memory: string;
+    dbMemory: string;
+    autoDeploy: false | 'declared';
+    /** The capability options sent in `custom_docker_run_options` (`plan/run-options.ts`). */
+    capabilities: CapabilityTier;
+}
+/**
+ * The one table of memory limits, per step. Every container foundry creates
+ * is in a step named here. The five `own*` rows are the flat 1g the own
+ * services already ran with. A Node or Next app gets 1g, a small Postgres
+ * 512m, the Go-sized helpers (relay, boule, edge, hc) less.
+ */
+export declare const LIMITS: {
+    readonly ownAuth: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownJobs: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownFiles: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownMail: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownSfu: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    /** A customer's hosting entry: capability tier B, unless the entry declares `capabilities: 'standard'`. */
+    readonly companyApp: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly companyAppStandard: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly brokerEntry: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly cms: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly chat: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly calls: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly agora: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly boule: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly companyOther: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformArchon: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformAi: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformIntegrations: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformMailRelay: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformIngress: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly connector: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformFiles: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformEdge: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformHc: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformMail: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformAuth: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformJobs: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+};
+/** The same bound the neighbouring Coolify calls in this package use for a call that may hang. */
+export declare const OWN_LIMITS_TIMEOUT_MS = 60000;
+type LimitsPort = Partial<Pick<CoolifyPort, 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'findApplicationByName' | 'getApplication' | 'getDatabase' | 'updateApplication' | 'raw'>>;
+/**
+ * The Coolify port a step uses, with the profile's memory limit set on every
+ * application and database it creates, and set again on one it finds without
+ * it, so a company provisioned before the limits existed converges on its
+ * next apply. With `autoDeploy: false` a git application is created with
+ * auto-deploy off, and one found or updated with it on is switched off. A
+ * failed limits call fails the calling step before it records its applied
+ * marker; the next run finds the resource and sets them.
+ *
+ * `scope` is a profile, or a function that gives the profile of the step now
+ * running (none: the port is used as it is).
+ *
+ * Every limits call has a 60 second timeout. A step that creates a resource
+ * and then fails on the limits call leaves a resource without limits; the
+ * next run finds it by name and sets them.
+ */
+export declare function limited<C extends LimitsPort>(coolify: C, scope?: LimitProfile | (() => LimitProfile | undefined)): C;
+/** The deps of a step with their Coolify port limited by `profile`. */
+export declare function limitedDeps<D extends {
+    coolify: LimitsPort;
+}>(deps: D, profile: LimitProfile): D;
+export {};

package/dist/plan/own-limits.js

@@ -0,0 +1,232 @@
+import { hasCapabilities, withCapabilities } from './run-options.js';
+/**
+ * The hard limits of every container foundry creates, per step (`LIMITS`). Field names are Coolify's (`PATCH /applications/{uuid}`
+ * and `PATCH /databases/{uuid}`: `limits_memory`, `limits_cpus`). Coolify has
+ * no field for a process limit, and its `custom_docker_run_options` parser drops
+ * `--pids-limit`, so 512 processes cannot be set through Coolify.
+ */
+export const OWN_LIMITS_MEMORY = '1g';
+export const OWN_LIMITS_CPUS = '1';
+const profile = (memory, dbMemory = memory, autoDeploy = false, capabilities = 'A') => ({ memory, dbMemory, autoDeploy, capabilities });
+/**
+ * The one table of memory limits, per step. Every container foundry creates
+ * is in a step named here. The five `own*` rows are the flat 1g the own
+ * services already ran with. A Node or Next app gets 1g, a small Postgres
+ * 512m, the Go-sized helpers (relay, boule, edge, hc) less.
+ */
+export const LIMITS = {
+    ownAuth: profile('1g'),
+    ownJobs: profile('1g'),
+    ownFiles: profile('1g'),
+    ownMail: profile('1g'),
+    ownSfu: profile('1g'),
+    /** A customer's hosting entry: capability tier B, unless the entry declares `capabilities: 'standard'`. */
+    companyApp: profile('1g', '1g', 'declared', 'B'),
+    companyAppStandard: profile('1g', '1g', 'declared'),
+    brokerEntry: profile('1g', '1g', 'declared'),
+    cms: profile('1g', '512m'),
+    chat: profile('1g', '512m'),
+    calls: profile('1g', '512m'),
+    agora: profile('1g', '512m'),
+    boule: profile('512m'),
+    companyOther: profile('1g', '512m'),
+    platformArchon: profile('1g'),
+    platformAi: profile('1g'),
+    platformIntegrations: profile('1g', '512m'),
+    platformMailRelay: profile('256m'),
+    platformIngress: profile('256m'),
+    connector: profile('256m'),
+    platformFiles: profile('1g'),
+    platformEdge: profile('512m'),
+    platformHc: profile('512m'),
+    platformMail: profile('1g'),
+    platformAuth: profile('1g'),
+    platformJobs: profile('1g'),
+};
+/** The same bound the neighbouring Coolify calls in this package use for a call that may hang. */
+export const OWN_LIMITS_TIMEOUT_MS = 60_000;
+const appLimits = (p) => ({ limits_memory: p.memory, limits_cpus: OWN_LIMITS_CPUS });
+const dbLimits = (p) => ({ limits_memory: p.dbMemory, limits_cpus: OWN_LIMITS_CPUS });
+const lacks = (r, want) => Boolean(r) && (r?.limits_memory !== want.limits_memory || r?.limits_cpus !== OWN_LIMITS_CPUS);
+const capsLack = (r, p) => Boolean(r) &&
+    !hasCapabilities(typeof r?.custom_docker_run_options === 'string' ? r.custom_docker_run_options : null, p.capabilities);
+async function bounded(work, what) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${what}: setting the resource limits timed out`)), OWN_LIMITS_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const wrapped = new WeakSet();
+/**
+ * The Coolify port a step uses, with the profile's memory limit set on every
+ * application and database it creates, and set again on one it finds without
+ * it, so a company provisioned before the limits existed converges on its
+ * next apply. With `autoDeploy: false` a git application is created with
+ * auto-deploy off, and one found or updated with it on is switched off. A
+ * failed limits call fails the calling step before it records its applied
+ * marker; the next run finds the resource and sets them.
+ *
+ * `scope` is a profile, or a function that gives the profile of the step now
+ * running (none: the port is used as it is).
+ *
+ * Every limits call has a 60 second timeout. A step that creates a resource
+ * and then fails on the limits call leaves a resource without limits; the
+ * next run finds it by name and sets them.
+ */
+export function limited(coolify, scope = LIMITS.ownAuth) {
+    if (wrapped.has(coolify))
+        return coolify;
+    const current = () => (typeof scope === 'function' ? scope() : scope);
+    // `existing`: the application as just read, or the options just sent on its create. Absent, it is read
+    // here, because the capability options are written together with the `--entrypoint` already on the app.
+    const patchApp = async (uuid, p, autoDeploy, existing) => {
+        if (!coolify.updateApplication)
+            throw new Error('own limits: the Coolify port has no updateApplication');
+        const current = existing ??
+            (coolify.getApplication
+                ? await bounded(coolify.getApplication(uuid), `application ${uuid}`)
+                : undefined);
+        const options = current === undefined
+            ? {}
+            : {
+                custom_docker_run_options: withCapabilities(typeof current?.custom_docker_run_options === 'string'
+                    ? current.custom_docker_run_options
+                    : null, p.capabilities),
+            };
+        return bounded(coolify.updateApplication(uuid, {
+            ...appLimits(p),
+            ...options,
+            ...(autoDeploy ? { is_auto_deploy_enabled: false } : {}),
+        }), `application ${uuid}`);
+    };
+    const patchDb = (uuid, p) => {
+        if (!coolify.raw)
+            throw new Error('own limits: the Coolify port has no raw');
+        return bounded(coolify.raw('PATCH', `/databases/${uuid}`, dbLimits(p)), `database ${uuid}`);
+    };
+    const afterCreate = (method, git) => async (input) => {
+        const p = current();
+        const noDeploy = git && p?.autoDeploy === false && input.is_auto_deploy_enabled === undefined
+            ? { ...input, is_auto_deploy_enabled: false }
+            : input;
+        const sent = p
+            ? {
+                ...noDeploy,
+                custom_docker_run_options: withCapabilities(typeof input.custom_docker_run_options === 'string'
+                    ? input.custom_docker_run_options
+                    : null, p.capabilities),
+            }
+            : noDeploy;
+        const create = coolify[method];
+        const created = await create.call(coolify, sent);
+        if (p) {
+            await patchApp(created.uuid, p, false, {
+                custom_docker_run_options: sent
+                    .custom_docker_run_options,
+            });
+            settled.add(created.uuid);
+        }
+        return created;
+    };
+    const over = {};
+    if (coolify.createGithubAppApplication)
+        over.createGithubAppApplication = afterCreate('createGithubAppApplication', true);
+    if (coolify.createDockerImageApplication)
+        over.createDockerImageApplication = afterCreate('createDockerImageApplication', false);
+    if (coolify.createDockerfileApplication)
+        over.createDockerfileApplication = afterCreate('createDockerfileApplication', false);
+    if (coolify.createPostgresDatabase) {
+        over.createPostgresDatabase = async (input) => {
+            const created = await coolify.createPostgresDatabase.call(coolify, input);
+            const p = current();
+            if (p)
+                await patchDb(created.uuid, p);
+            return created;
+        };
+    }
+    const getApplication = coolify.getApplication;
+    const update = coolify.updateApplication;
+    // Applications already brought to the profile by this port: no second patch for them.
+    const settled = new Set();
+    const settle = async (uuid, p, app, git) => {
+        if (settled.has(uuid))
+            return;
+        const deploys = git && p.autoDeploy === false && app?.is_auto_deploy_enabled !== false;
+        if (!app || lacks(app, appLimits(p)) || capsLack(app, p) || deploys) {
+            await patchApp(uuid, p, deploys, app);
+        }
+        settled.add(uuid);
+    };
+    if (update) {
+        over.updateApplication = async (uuid, patch) => {
+            const p = current();
+            // A step that sends its own run options (the entrypoint) must not take the capability options off.
+            const sent = p && typeof patch.custom_docker_run_options === 'string'
+                ? {
+                    ...patch,
+                    custom_docker_run_options: withCapabilities(patch.custom_docker_run_options, p.capabilities),
+                }
+                : patch;
+            const out = await coolify.updateApplication?.call(coolify, uuid, sent);
+            if (p) {
+                const git = 'git_branch' in patch || 'is_auto_deploy_enabled' in patch;
+                await settle(uuid, p, null, git);
+            }
+            return out;
+        };
+    }
+    if (getApplication) {
+        over.getApplication = async (uuid) => {
+            const app = await coolify.getApplication?.call(coolify, uuid);
+            const p = current();
+            if (p && app)
+                await settle(uuid, p, app, Boolean(app.git_repository));
+            return app;
+        };
+    }
+    const find = coolify.findApplicationByName;
+    if (find && getApplication) {
+        over.findApplicationByName = async (...args) => {
+            const found = await coolify.findApplicationByName?.apply(coolify, args);
+            const p = current();
+            if (found && p) {
+                const app = await coolify.getApplication?.call(coolify, found.uuid);
+                if (app)
+                    await settle(found.uuid, p, app, Boolean(app.git_repository));
+            }
+            return found;
+        };
+    }
+    const getDatabase = coolify.getDatabase;
+    if (getDatabase) {
+        over.getDatabase = async (uuid) => {
+            const db = await coolify.getDatabase?.call(coolify, uuid);
+            const p = current();
+            if (p && lacks(db, dbLimits(p)))
+                await patchDb(uuid, p);
+            return db;
+        };
+    }
+    const proxy = new Proxy(coolify, {
+        get(target, prop) {
+            if (typeof prop === 'string' && prop in over)
+                return over[prop];
+            const value = Reflect.get(target, prop, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+    wrapped.add(proxy);
+    return proxy;
+}
+/** The deps of a step with their Coolify port limited by `profile`. */
+export function limitedDeps(deps, profile) {
+    return { ...deps, coolify: limited(deps.coolify, profile) };
+}

package/dist/plan/own-services.d.ts

@@ -0,0 +1,193 @@
+import type { LivekitCredentials } from '../calls-sfu-keys.js';
+import type { CallsSfuUrls } from '../calls-sfu.js';
+import type { DeclaredOrg } from '../org.js';
+import type { BrokerPort } from './broker-entries.js';
+import type { DnsPort } from './edge-dns.js';
+import type { ZonePort } from './edge-zones.js';
+import type { CallsSfuPort, CloudflarePort, CoolifyPort, FilesOrganisationPort, FoundryStepExecutorPorts, JobsSchedulerPort, MailPort, ZitadelPort } from './executor.js';
+import type { PlatformStepExecutionContext, StepExecutionContext } from './plan-apply.js';
+import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformTunnelPort, PlatformTunnelsFactory } from './platform-providers.js';
+/** Applied-state key under which an own org's provisioned-services marker is recorded. */
+export declare const OWN_SERVICES_APPLIED_SCOPE_KEY = "own_services_applied";
+/**
+ * Every name a service step creates, so the platform's steps and an own
+ * org's steps take them from one place. Names are unique on the server: each
+ * Coolify app name, each `custom_internal_name` on the shared Docker network
+ * and each held-key ref carries the owner (`platform` or the org slug).
+ */
+export interface ServiceTarget {
+    readonly id: string;
+    readonly kind: 'platform' | 'org';
+    readonly names: {
+        authDb: string;
+        authZitadel: string;
+        authLogin: string;
+        authBroker: string;
+        authTunnel: string;
+        authCloudflared: string;
+        mailApp: string;
+        mailTunnel: string;
+        mailCloudflared: string;
+        filesDb: string;
+        filesMigrate: string;
+        filesRunner: string;
+        /** An own org's R2 bucket. The platform's is host-supplied (`PlatformFilesDeps.r2`), so its value here is never read. */
+        filesBucket: string;
+        jobsApp: string;
+        jobsDb: string;
+        sfuApp: string;
+        sfuTunnel: string;
+        sfuCloudflared: string;
+    };
+    readonly internal: {
+        authZitadel: string;
+        authLogin: string;
+        authBroker: string;
+        mail: string;
+        files: string;
+        jobs: string;
+        sfu: string;
+    };
+    readonly refs: {
+        instanceBearer: string;
+        authAdmin: string;
+        brokerMailKey: string;
+        mailAdminKey: string;
+        filesManagement: string;
+        filesIntrospection: string;
+        jobsAdminToken: string;
+        livekitKeys: string;
+        /** An own files host's derived keys credential, held after the mint. The platform's value is never read. */
+        keysCredential: string;
+        /** The public half the host verifies with (`KEYS_VERIFY_KEYS`). */
+        keysVerifyKeys: string;
+    };
+}
+/** The platform's shared services, with the literals the platform steps use today. */
+export declare function platformTarget(): ServiceTarget;
+/** One company's own services: every name and ref carries the org's slug, so two orgs never clash. */
+export declare function orgTarget(org: Pick<DeclaredOrg, 'slug'>): ServiceTarget;
+/** Where a step reads and records its ids: the platform's store or one org's. */
+export interface StepScope {
+    /** This scope's own ids (platform store or org store). */
+    recordedIds(): Readonly<Record<string, string>>;
+    recordScopeId(key: string, id: string): void;
+    persist(): Promise<void>;
+    /** Read only. For a platform scope this is `recordedIds()`. */
+    platformIds(): Readonly<Record<string, string>>;
+}
+export declare function scopeFromPlatform(context: PlatformStepExecutionContext, _platformIds?: never): StepScope;
+export declare function scopeFromOrg(context: StepExecutionContext, platformIds: Readonly<Record<string, string>>): StepScope;
+export interface ServiceNetwork {
+    dns(): Promise<DnsPort>;
+    tunnels(): Promise<PlatformTunnelPort>;
+    zoneId(apex: string): Promise<string | undefined>;
+}
+export declare function platformNetwork(deps: {
+    dns: PlatformDnsFactory;
+    tunnels: PlatformTunnelsFactory;
+    cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
+}, scope: StepScope, step: string): ServiceNetwork;
+/**
+ * An own org's DNS and tunnels: the org's edge-routed ports, never the
+ * platform's scope, and the zone edge recorded for the org's domain. A port
+ * the host did not supply is named in the error, never reached around.
+ */
+export declare function orgNetwork(ports: {
+    dns?: DnsPort;
+    tunnels?: PlatformTunnelPort;
+    zones?: Pick<ZonePort, 'findZoneByApex'>;
+}, scope: StepScope, step: string): ServiceNetwork;
+/** Where the project comes from: the platform's 'platform' project, or the org's own. */
+export interface ProjectSource {
+    ensure(coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject'>, scope: StepScope): Promise<string>;
+}
+export interface OwnAuthInstance {
+    issuerUrl: string;
+    bearerRef: string;
+}
+/** Every field optional: absent means "not ready", and the executor throws {@link OwnServicesBlockedError} naming the ref. */
+export interface OwnServicePorts {
+    zitadel?: ZitadelPort;
+    mail?: MailPort;
+    broker?: BrokerPort;
+    filesOrganisation?: FilesOrganisationPort;
+    jobsScheduler?: JobsSchedulerPort;
+    callsSfu?: CallsSfuPort;
+    callsSfuUrls?: CallsSfuUrls;
+}
+/** Dependencies of the `coolify:own-*` steps themselves. */
+export interface OwnServicesProvision {
+    auth: PlatformAuthDeps;
+    mail: PlatformMailDeps;
+    files: OwnFilesDeps;
+    jobs: NonNullable<FoundryPlatformStepExecutorOptions['coolify']>;
+    sfu: OwnSfuDeps;
+}
+/** What the keys worker answers for one company's derived host: the credential and the public keys, plus ids for the record. */
+export interface FilesKeysMinted {
+    credential: string;
+    verifyKeys: string;
+    credentialId: string;
+    epoch: number;
+    expiresAt: number;
+}
+/** Mints a company's own keys credential on the keys worker. Called with the host id `files-<slug>`. */
+export interface FilesKeysMint {
+    workerUrl: string;
+    mint(hostId: string, requestId: string): Promise<FilesKeysMinted>;
+}
+/** One S3 pair for one bucket, and the id of the API token it came from. The secret is shown once. */
+export interface OwnFilesR2Key {
+    accessKeyId: string;
+    secretAccessKey: string;
+    tokenId: string;
+}
+/**
+ * Mints and removes the storage key of one company bucket. Each call is given 30 seconds. A delete
+ * of a token that is already gone (404) is a success.
+ */
+export interface OwnFilesR2Keys {
+    mintBucketKey(bucket: string): Promise<OwnFilesR2Key>;
+    deleteBucketKey(tokenId: string): Promise<void>;
+}
+/** The token id of the storage key delivered to an own files host. Its presence means the step is done. */
+export declare const OWN_FILES_R2_SCOPE_KEY = "files_r2_id";
+/** The token id minted and not yet confirmed delivered: deleted before any new mint. */
+export declare const OWN_FILES_R2_UNDELIVERED_SCOPE_KEY = "files_r2_undelivered";
+/**
+ * An own files host takes no `keys.credential`, `keys.auditToken` or `jobsSigningSecrets` from here:
+ * those are the platform's and never reach a company's containers. Its keyring comes from `keysMint`.
+ */
+export interface OwnFilesDeps extends Omit<PlatformFilesDeps, 'r2'> {
+    r2Buckets: {
+        ensureBucket(name: string): Promise<{
+            bucket: string;
+            endpoint: string;
+        }>;
+    };
+    /** Absent: the own files R2 key step is blocked, naming this port. */
+    r2Keys?: OwnFilesR2Keys;
+    /** Absent: the own files step is blocked, naming this port. */
+    keysMint?: FilesKeysMint;
+    /** Reads a delivered secret back from the host, so a rerun after a failed run resumes instead of minting. */
+    readSecret?: (ref: string) => Promise<string | null>;
+}
+export interface OwnSfuDeps {
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'createDockerImageApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'deploy' | 'getApplication' | 'raw' | 'listEnvs' | 'createDockerfileApplication' | 'deployAndWait'>;
+    mintLivekitCredentials?: () => LivekitCredentials;
+    deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
+}
+/** A held key an own service needs is missing. Names the service and the ref, never a value. */
+export declare class OwnServicesBlockedError extends Error {
+    readonly service: string;
+    readonly ref: string;
+    constructor(service: string, ref: string);
+}
+export interface OwnServicesPort {
+    /** Ports scoped to this org's own instances, or null when the org is not own. Throws {@link OwnServicesBlockedError} when a held key is missing. */
+    portsFor(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<OwnServicePorts | null>;
+    /** Builds the ZITADEL port for one company instance. */
+    zitadelFor(instance: OwnAuthInstance): ZitadelPort;
+    provision: OwnServicesProvision;
+}