@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/own-services.js

@@ -0,0 +1,169 @@
+import { NO_DOMAIN_ZONE } from './own-hostnames.js';
+import { apexZoneKey, exactZone, platformDns, platformTunnels } from './platform-providers.js';
+/** The key the org's zone step records its Cloudflare zone id under. */
+const ORG_ZONE_SCOPE_KEY = 'cloudflare_zone';
+/** Applied-state key under which an own org's provisioned-services marker is recorded. */
+export const OWN_SERVICES_APPLIED_SCOPE_KEY = 'own_services_applied';
+/** The platform's shared services, with the literals the platform steps use today. */
+export function platformTarget() {
+    return {
+        id: 'platform',
+        kind: 'platform',
+        names: {
+            authDb: 'platform-auth-db',
+            authZitadel: 'platform-auth-zitadel',
+            authLogin: 'platform-auth-login',
+            authBroker: 'platform-auth-broker',
+            authTunnel: 'platform-auth-tunnel',
+            authCloudflared: 'platform-auth-cloudflared',
+            mailApp: 'platform-mail-stalwart',
+            mailTunnel: 'platform-mail-tunnel',
+            mailCloudflared: 'platform-mail-cloudflared',
+            filesDb: 'platform-files-db',
+            filesMigrate: 'files-migrate',
+            filesRunner: 'files',
+            filesBucket: 'platform-files',
+            jobsApp: 'jobs',
+            jobsDb: 'jobs-scheduler-db',
+            sfuApp: 'platform-sfu',
+            sfuTunnel: 'platform-sfu-tunnel',
+            sfuCloudflared: 'platform-sfu-cloudflared',
+        },
+        internal: {
+            authZitadel: 'platform-auth-zitadel',
+            authLogin: 'platform-auth-login',
+            authBroker: 'platform-auth-broker',
+            mail: 'platform-mail-stalwart',
+            files: 'platform-files',
+            jobs: 'platform-jobs',
+            sfu: 'platform-sfu',
+        },
+        refs: {
+            instanceBearer: 'zitadel:platform:instanceBearer',
+            authAdmin: 'zitadel:platform:admin',
+            brokerMailKey: 'lettermint:platform:apiToken',
+            mailAdminKey: 'stalwart:platform:admin',
+            filesManagement: 'files:platform:managementKey',
+            filesIntrospection: 'zitadel:platform:files:introspection',
+            jobsAdminToken: 'jobs:scheduler:adminToken',
+            livekitKeys: 'livekit:platform:keys',
+            keysCredential: 'keys:platform:credential',
+            keysVerifyKeys: 'keys:platform:verifyKeys',
+        },
+    };
+}
+/** One company's own services: every name and ref carries the org's slug, so two orgs never clash. */
+export function orgTarget(org) {
+    const s = org.slug;
+    return {
+        id: s,
+        kind: 'org',
+        names: {
+            authDb: `${s}-auth-db`,
+            authZitadel: `${s}-auth-zitadel`,
+            authLogin: `${s}-auth-login`,
+            authBroker: `${s}-auth-broker`,
+            authTunnel: `${s}-auth-tunnel`,
+            authCloudflared: `${s}-auth-cloudflared`,
+            mailApp: `${s}-mail-stalwart`,
+            mailTunnel: `${s}-mail-tunnel`,
+            mailCloudflared: `${s}-mail-cloudflared`,
+            filesDb: `${s}-files-db`,
+            filesMigrate: `${s}-files-migrate`,
+            filesRunner: `${s}-files`,
+            filesBucket: `${s}-files`,
+            jobsApp: `${s}-jobs`,
+            jobsDb: `${s}-jobs-db`,
+            sfuApp: `${s}-sfu`,
+            sfuTunnel: `${s}-sfu-tunnel`,
+            sfuCloudflared: `${s}-sfu-cloudflared`,
+        },
+        internal: {
+            authZitadel: `${s}-auth-zitadel`,
+            authLogin: `${s}-auth-login`,
+            authBroker: `${s}-auth-broker`,
+            mail: `${s}-mail-stalwart`,
+            files: `${s}-files`,
+            jobs: `${s}-jobs`,
+            sfu: `${s}-sfu`,
+        },
+        refs: {
+            instanceBearer: `zitadel:org:${s}:instanceBearer`,
+            authAdmin: `zitadel:org:${s}:admin`,
+            brokerMailKey: `lettermint:org:${s}:apiToken`,
+            mailAdminKey: `stalwart:org:${s}:admin`,
+            filesManagement: `files:org:${s}:managementKey`,
+            filesIntrospection: `zitadel:org:${s}:files:introspection`,
+            jobsAdminToken: `jobs:org:${s}:adminToken`,
+            livekitKeys: `livekit:org:${s}:keys`,
+            keysCredential: `keys:org:${s}:credential`,
+            keysVerifyKeys: `keys:org:${s}:verifyKeys`,
+        },
+    };
+}
+export function scopeFromPlatform(context, _platformIds) {
+    return {
+        recordedIds: () => context.recordedIds(),
+        recordScopeId: (key, id) => context.recordScopeId(key, id),
+        persist: async () => {
+            await context.persist?.();
+        },
+        platformIds: () => context.recordedIds(),
+    };
+}
+export function scopeFromOrg(context, platformIds) {
+    return {
+        recordedIds: () => context.recordedIds(),
+        recordScopeId: (key, id) => context.recordScopeId(key, id),
+        persist: () => context.persistScopeIds(),
+        platformIds: () => platformIds,
+    };
+}
+export function platformNetwork(deps, scope, step) {
+    return {
+        dns: () => platformDns(deps, scope.recordedIds(), step),
+        tunnels: () => platformTunnels(deps, scope.recordedIds(), step),
+        zoneId: async (apex) => scope.recordedIds()[apexZoneKey(apex)] ?? (await exactZone(deps.cloudflare, apex))?.id,
+    };
+}
+/**
+ * An own org's DNS and tunnels: the org's edge-routed ports, never the
+ * platform's scope, and the zone edge recorded for the org's domain. A port
+ * the host did not supply is named in the error, never reached around.
+ */
+export function orgNetwork(ports, scope, step) {
+    return {
+        dns: async () => {
+            if (!ports.dns)
+                throw new Error(`${step}: the host supplies no DNS port for this org`);
+            return ports.dns;
+        },
+        tunnels: async () => {
+            if (!ports.tunnels)
+                throw new Error(`${step}: the host supplies no tunnel port for this org`);
+            return ports.tunnels;
+        },
+        zoneId: async (apex) => {
+            // The recorded zone is the company's own; `oikos.host` is never it.
+            const recorded = apex === NO_DOMAIN_ZONE ? undefined : scope.recordedIds()[ORG_ZONE_SCOPE_KEY];
+            if (recorded)
+                return recorded;
+            return ports.zones ? (await exactZone(ports.zones, apex))?.id : undefined;
+        },
+    };
+}
+/** The token id of the storage key delivered to an own files host. Its presence means the step is done. */
+export const OWN_FILES_R2_SCOPE_KEY = 'files_r2_id';
+/** The token id minted and not yet confirmed delivered: deleted before any new mint. */
+export const OWN_FILES_R2_UNDELIVERED_SCOPE_KEY = 'files_r2_undelivered';
+/** A held key an own service needs is missing. Names the service and the ref, never a value. */
+export class OwnServicesBlockedError extends Error {
+    service;
+    ref;
+    constructor(service, ref) {
+        super(`own ${service} is blocked: held key ${ref} is missing`);
+        this.service = service;
+        this.ref = ref;
+        this.name = 'OwnServicesBlockedError';
+    }
+}

package/dist/plan/own-sfu.d.ts

@@ -0,0 +1,69 @@
+import { type LivekitCredentials } from '../calls-sfu-keys.js';
+import { type CallsSfuUrls } from '../calls-sfu.js';
+import { type DeployHealthRuntime } from './deploy-health.js';
+import type { FoundryStepExecutorPorts } from './executor.js';
+import type { OwnSfuDeps, ProjectSource, ServiceNetwork, ServiceTarget, StepScope } from './own-services.js';
+/** The LiveKit image, the same repository the shared SFU runs. */
+export declare const OWN_SFU_IMAGE = "livekit/livekit-server";
+export declare const OWN_SFU_APP_SCOPE_KEY = "coolify_own_sfu_app";
+export declare const OWN_SFU_TUNNEL_SCOPE_KEY = "cloudflare_own_sfu_tunnel";
+export declare const OWN_SFU_CONNECTOR_APP_SCOPE_KEY = "coolify_own_sfu_connector_app";
+/** Set to the app id before the key pair leaves, cleared after the pair is delivered and written to the app. */
+export declare const OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY = "own_sfu_keys_undelivered";
+/** The app id once the company's key pair is delivered and in the app's env. */
+export declare const OWN_SFU_KEYS_SCOPE_KEY = "own_sfu_keys_set";
+export declare const OWN_SFU_DEPLOY_PENDING_SCOPE_KEY = "own_sfu_deploy_pending";
+export declare const OWN_SFU_APPLIED_VERSION_SCOPE_KEY = "own_sfu_applied_version";
+export declare const OWN_SFU_APPLIED_SLOT_SCOPE_KEY = "own_sfu_applied_slot";
+export declare const OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY = "own_sfu_applied_hostname";
+export declare const SFU_INTERNAL_URL_SCOPE_KEY = "sfu_internal_url";
+export declare const SFU_PUBLIC_URL_SCOPE_KEY = "sfu_public_url";
+export interface SfuAppDeps {
+    coolify: OwnSfuDeps['coolify'];
+    network: ServiceNetwork;
+    deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
+    /** Reads a delivered secret back from the host. Without it, an undelivered marker cannot be resumed. */
+    readSecret?: (ref: string) => Promise<string | null>;
+    runtime: DeployHealthRuntime;
+    mintLivekitCredentials?: () => LivekitCredentials;
+    /** Called with every secret value this step handles, so the caller can scrub it from output. */
+    onSecret?: (value: string) => void;
+}
+export interface SfuAppInput {
+    slot: number;
+    /** `sfu.<domain>`. */
+    hostname: string;
+    /** The org's domain: the zone the hostname goes in. */
+    apex: string;
+    /** The pinned LiveKit release tag. */
+    version: string;
+    project: ProjectSource;
+}
+/** The Docker `ports_mappings` string for a slot: the UDP range and the TCP fallback port, one to one. */
+export declare function sfuPortsMappings(slot: number): string;
+/**
+ * LiveKit takes its whole config from one env value. `node_ip` is the
+ * server's address: the app is not on the host network, so the media ports
+ * reach it through the published mappings.
+ */
+export declare function sfuConfig(input: {
+    slot: number;
+    nodeIp: string;
+    keys: LivekitCredentials;
+}): string;
+/**
+ * One company's LiveKit media server as a Coolify app: the image, its slot's
+ * ports published to the server, and a tunnel for signalling at `sfu.<domain>`.
+ * The company's single key pair is minted once, delivered to
+ * `target.refs.livekitKeys` as JSON, and written to the app's env; it is never
+ * recorded. Rules 1 to 6 of `CLAUDE.md` "Platform steps".
+ */
+export declare function provisionSfuApp(scope: StepScope, deps: SfuAppDeps, target: ServiceTarget, input: SfuAppInput): Promise<{
+    resourceId?: string;
+}>;
+/**
+ * The addresses of the company's media server, from its recorded ids. Before
+ * the step is recorded the pair is empty, which `resolveCallsSfuUrls` refuses:
+ * an own org's calls service never falls back to the shared SFU's addresses.
+ */
+export declare function ownSfuUrls(ids: Readonly<Record<string, string>>): CallsSfuUrls;

package/dist/plan/own-sfu.js

@@ -0,0 +1,256 @@
+import { pinnedTagFor } from '../bootstrap/versions.js';
+import { mintLivekitCredentials } from '../calls-sfu-keys.js';
+import { LIVEKIT_SIGNALLING_PORT, sfuSlotPorts } from '../calls-sfu.js';
+import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { waitForNewDeployment } from './deploy-health.js';
+import { healthCheckSettings } from './health-check-settings.js';
+import { recordOwnDnsHostname } from './own-dns.js';
+/** The LiveKit image, the same repository the shared SFU runs. */
+export const OWN_SFU_IMAGE = 'livekit/livekit-server';
+export const OWN_SFU_APP_SCOPE_KEY = 'coolify_own_sfu_app';
+export const OWN_SFU_TUNNEL_SCOPE_KEY = 'cloudflare_own_sfu_tunnel';
+export const OWN_SFU_CONNECTOR_APP_SCOPE_KEY = 'coolify_own_sfu_connector_app';
+/** Set to the app id before the key pair leaves, cleared after the pair is delivered and written to the app. */
+export const OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY = 'own_sfu_keys_undelivered';
+/** The app id once the company's key pair is delivered and in the app's env. */
+export const OWN_SFU_KEYS_SCOPE_KEY = 'own_sfu_keys_set';
+export const OWN_SFU_DEPLOY_PENDING_SCOPE_KEY = 'own_sfu_deploy_pending';
+export const OWN_SFU_APPLIED_VERSION_SCOPE_KEY = 'own_sfu_applied_version';
+export const OWN_SFU_APPLIED_SLOT_SCOPE_KEY = 'own_sfu_applied_slot';
+export const OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY = 'own_sfu_applied_hostname';
+export const SFU_INTERNAL_URL_SCOPE_KEY = 'sfu_internal_url';
+export const SFU_PUBLIC_URL_SCOPE_KEY = 'sfu_public_url';
+const KEYS_DELIVERY_ATTEMPTS = 3;
+const CONFIG_ENV = 'LIVEKIT_CONFIG';
+/** The Docker `ports_mappings` string for a slot: the UDP range and the TCP fallback port, one to one. */
+export function sfuPortsMappings(slot) {
+    const { udpStart, udpEnd, tcp } = sfuSlotPorts(slot);
+    return `${udpStart}-${udpEnd}:${udpStart}-${udpEnd}/udp,${tcp}:${tcp}`;
+}
+/**
+ * LiveKit takes its whole config from one env value. `node_ip` is the
+ * server's address: the app is not on the host network, so the media ports
+ * reach it through the published mappings.
+ */
+export function sfuConfig(input) {
+    const { udpStart, udpEnd, tcp } = sfuSlotPorts(input.slot);
+    return [
+        `port: ${LIVEKIT_SIGNALLING_PORT}`,
+        'rtc:',
+        `  tcp_port: ${tcp}`,
+        `  port_range_start: ${udpStart}`,
+        `  port_range_end: ${udpEnd}`,
+        '  use_external_ip: false',
+        `  node_ip: ${input.nodeIp}`,
+        'keys:',
+        `  ${input.keys.apiKey}: ${input.keys.apiSecret}`,
+        '',
+    ].join('\n');
+}
+function heldPairOf(value) {
+    if (!value)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+    const { apiKey, apiSecret } = (parsed ?? {});
+    return typeof apiKey === 'string' &&
+        typeof apiSecret === 'string' &&
+        KEY_PAIR_SHAPE.test(apiKey) &&
+        KEY_PAIR_SHAPE.test(apiSecret)
+        ? { apiKey, apiSecret }
+        : null;
+}
+function keysOf(config) {
+    const match = /^keys:\n {2}([A-Za-z0-9]+): ([A-Za-z0-9]+)$/m.exec(config ?? '');
+    return match ? { apiKey: match[1], apiSecret: match[2] } : null;
+}
+const KEY_PAIR_SHAPE = /^[A-Za-z0-9]{8,128}$/;
+/**
+ * One company's LiveKit media server as a Coolify app: the image, its slot's
+ * ports published to the server, and a tunnel for signalling at `sfu.<domain>`.
+ * The company's single key pair is minted once, delivered to
+ * `target.refs.livekitKeys` as JSON, and written to the app's env; it is never
+ * recorded. Rules 1 to 6 of `CLAUDE.md` "Platform steps".
+ */
+export async function provisionSfuApp(scope, deps, target, input) {
+    const { coolify, network, deliverSecret, runtime } = deps;
+    const label = `own step coolify:own-sfu for ${target.id}`;
+    sfuSlotPorts(input.slot);
+    const zoneId = await network.zoneId(input.apex);
+    if (!zoneId)
+        throw new Error(`${label}: no Cloudflare zone for ${input.apex}`);
+    const projectUuid = await input.project.ensure(coolify, scope);
+    const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+    const servers = await coolify.listServers();
+    const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
+    if (!server)
+        throw new Error(`${label}: no usable Coolify server is registered`);
+    if (!server.ip)
+        throw new Error(`${label}: the Coolify server has no address to give LiveKit`);
+    const existingApp = await coolify.findApplicationByName(target.names.sfuApp, {
+        environmentIds: [environment.id],
+    });
+    let appId;
+    if (existingApp) {
+        appId = existingApp.uuid;
+    }
+    else {
+        appId = (await coolify.createDockerImageApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            docker_registry_image_name: OWN_SFU_IMAGE,
+            docker_registry_image_tag: pinnedTagFor('livekit', input.version),
+            ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
+            ports_mappings: sfuPortsMappings(input.slot),
+            name: target.names.sfuApp,
+            description: `LiveKit media server for ${target.id}`,
+            instant_deploy: false,
+        })).uuid;
+    }
+    scope.recordScopeId(OWN_SFU_APP_SCOPE_KEY, appId);
+    const recorded = scope.recordedIds();
+    const changed = recorded[OWN_SFU_APPLIED_VERSION_SCOPE_KEY] !== input.version ||
+        recorded[OWN_SFU_APPLIED_SLOT_SCOPE_KEY] !== String(input.slot) ||
+        recorded[OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY] !== input.hostname;
+    // Set on every run: a declared version or slot reaches an existing app here.
+    await coolify.updateApplication(appId, {
+        custom_internal_name: target.internal.sfu,
+        docker_registry_image_tag: pinnedTagFor('livekit', input.version),
+        ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
+        ports_mappings: sfuPortsMappings(input.slot),
+        ...healthCheckSettings('/', LIVEKIT_SIGNALLING_PORT),
+    });
+    const liveConfig = (await coolify.listEnvs(appId)).find((e) => e.key === CONFIG_ENV && !e.is_preview)?.value;
+    let keys;
+    let keysJustSet = false;
+    if (scope.recordedIds()[OWN_SFU_KEYS_SCOPE_KEY]) {
+        const held = keysOf(liveConfig);
+        if (!held) {
+            throw new Error(`${label}: the app's ${CONFIG_ENV} no longer holds the company's key`);
+        }
+        keys = held;
+        deps.onSecret?.(keys.apiSecret);
+    }
+    else {
+        const lost = scope.recordedIds()[OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY];
+        const resumed = lost
+            ? heldPairOf((await deps.readSecret?.(target.refs.livekitKeys)) ?? null)
+            : null;
+        if (lost && !resumed) {
+            throw new Error(`${label}: a LiveKit key pair (${lost}) was minted but never confirmed delivered; remove the recorded key ${OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+        }
+        if (resumed) {
+            keys = resumed;
+            deps.onSecret?.(keys.apiSecret);
+            keysJustSet = true;
+        }
+        else {
+            keys = (deps.mintLivekitCredentials ?? mintLivekitCredentials)();
+            if (!KEY_PAIR_SHAPE.test(keys.apiKey) || !KEY_PAIR_SHAPE.test(keys.apiSecret)) {
+                throw new Error(`${label}: the minted LiveKit key has characters the config cannot hold`);
+            }
+            deps.onSecret?.(keys.apiSecret);
+            scope.recordScopeId(OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, appId);
+            await scope.persist();
+            let delivered = false;
+            const payload = JSON.stringify({ apiKey: keys.apiKey, apiSecret: keys.apiSecret });
+            for (let attempt = 1; attempt <= KEYS_DELIVERY_ATTEMPTS && !delivered; attempt++) {
+                try {
+                    await deliverSecret(target.refs.livekitKeys, payload);
+                    delivered = true;
+                }
+                catch {
+                    // Retried; the error is dropped in case it echoes the key.
+                }
+            }
+            if (!delivered) {
+                throw new Error(`${label}: the LiveKit key pair could not be delivered after ${KEYS_DELIVERY_ATTEMPTS} attempts`);
+            }
+            keysJustSet = true;
+        }
+    }
+    const config = sfuConfig({ slot: input.slot, nodeIp: server.ip, keys });
+    deps.onSecret?.(config);
+    const envChanged = liveConfig !== config;
+    const pending = Boolean(scope.recordedIds()[OWN_SFU_DEPLOY_PENDING_SCOPE_KEY]) || changed || envChanged;
+    if (pending) {
+        scope.recordScopeId(OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, '1');
+        await scope.persist();
+    }
+    if (envChanged) {
+        await coolify.bulkUpsertEnvs(appId, [{ key: CONFIG_ENV, value: config, literal: true }]);
+    }
+    if (keysJustSet) {
+        scope.recordScopeId(OWN_SFU_KEYS_SCOPE_KEY, appId);
+        scope.recordScopeId(OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, '');
+        await scope.persist();
+    }
+    const running = (await coolify.getApplication(appId)).status?.startsWith('running') ?? false;
+    if (!existingApp || pending || !running) {
+        await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, runtime, runtime.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))), label, 'the media server keeps its old version');
+    }
+    if (pending) {
+        scope.recordScopeId(OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, '');
+        await scope.persist();
+    }
+    const tunnels = await network.tunnels();
+    const tunnel = (await tunnels.findTunnelByName(target.names.sfuTunnel)) ??
+        (await tunnels.createTunnel(target.names.sfuTunnel));
+    scope.recordScopeId(OWN_SFU_TUNNEL_SCOPE_KEY, tunnel.id);
+    await tunnels.putTunnelConfig(tunnel.id, {
+        ingress: [
+            {
+                hostname: input.hostname,
+                service: `http://${target.internal.sfu}:${LIVEKIT_SIGNALLING_PORT}`,
+            },
+            { service: 'http_status:404' },
+        ],
+    });
+    await ensureCloudflaredConnector({
+        coolify,
+        tunnels,
+        tunnelId: tunnel.id,
+        appName: target.names.sfuCloudflared,
+        projectUuid,
+        environment,
+        resolveServer: async () => server,
+        recordedConnectorAppId: scope.recordedIds()[OWN_SFU_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: async (id) => {
+            scope.recordScopeId(OWN_SFU_CONNECTOR_APP_SCOPE_KEY, id);
+            await scope.persist();
+        },
+    });
+    const dns = await network.dns();
+    const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
+    const [record] = await dns.findDnsRecord(input.apex, input.hostname, 'CNAME');
+    const cname = { type: 'CNAME', name: input.hostname, content: dnsTarget, proxied: true };
+    if (!record)
+        await dns.createDnsRecord(input.apex, cname);
+    else if (record.content !== dnsTarget)
+        await dns.updateDnsRecord(input.apex, record.id, cname);
+    await recordOwnDnsHostname(scope, input.hostname);
+    scope.recordScopeId(OWN_SFU_APPLIED_VERSION_SCOPE_KEY, input.version);
+    scope.recordScopeId(OWN_SFU_APPLIED_SLOT_SCOPE_KEY, String(input.slot));
+    scope.recordScopeId(OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, input.hostname);
+    scope.recordScopeId(SFU_INTERNAL_URL_SCOPE_KEY, `http://${target.internal.sfu}:${LIVEKIT_SIGNALLING_PORT}`);
+    scope.recordScopeId(SFU_PUBLIC_URL_SCOPE_KEY, `https://${input.hostname}`);
+    return { resourceId: appId };
+}
+/**
+ * The addresses of the company's media server, from its recorded ids. Before
+ * the step is recorded the pair is empty, which `resolveCallsSfuUrls` refuses:
+ * an own org's calls service never falls back to the shared SFU's addresses.
+ */
+export function ownSfuUrls(ids) {
+    return {
+        privateUrl: ids[SFU_INTERNAL_URL_SCOPE_KEY] ?? '',
+        publicUrl: ids[SFU_PUBLIC_URL_SCOPE_KEY] ?? '',
+    };
+}