@wtfalch/foundry 0.4.0 → 0.6.0

package/dist/calls-sfu-deploy-support.d.ts

@@ -1,10 +1,13 @@
 /**
- * Pure decision logic for `scripts/calls-sfu-deploy.mjs`'s SSH/SFTP adapter,
- * split out so it is unit-tested by vitest against `src/**` -- before
- * `pnpm build` produces `dist` -- the same way `calls-sfu.ts` is, rather
- * than only by hand against a real VM. The adapter itself (`ssh2`'s
- * `Client`/`sftp`/`exec` wiring) stays untested, same as
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * Pure decision logic for the calls SFU's SSH/SFTP deploy, split out so it is
+ * unit-tested by vitest against `src/**` -- before `pnpm build` produces
+ * `dist` -- the same way `calls-sfu.ts` is, rather than only by hand against
+ * a real VM. `calls-sfu-ssh-adapter.ts` applies every export here to a
+ * {@link CallsSfuSshSession} (`toCallsSfuHostPort`/`applyCallsSfuOverSession`)
+ * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
+ * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
+ * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
+ * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):
@@ -35,6 +38,14 @@ export declare function verifyHostKey(rawKey: Buffer, expectedFingerprint: strin
  * this script writes holds no secret. Returns the SFTP file mode to write
  * with, or `undefined` for anything else (the SFTP server's own default).
  * PR #125's review, finding 2; extended for #127's second secret file.
+ *
+ * A trailing `.tmp` is stripped before comparing: `calls-sfu.ts`'s
+ * `applyCallsSfu` writes `livekit.yaml` to a `.tmp` path first and renames
+ * it into place (#152 round 2 review, finding 3 -- a temp file plus an
+ * atomic rename, rather than overwriting the live config two concurrent
+ * applies could otherwise tear). The temp file holds the same secret the
+ * final path does, so it gets the same 0600 mode; `mv` preserves it across
+ * the rename.
  */
 export declare function fileWriteMode(path: string): number | undefined;
 /**

package/dist/calls-sfu-deploy-support.js

@@ -1,10 +1,13 @@
 /**
- * Pure decision logic for `scripts/calls-sfu-deploy.mjs`'s SSH/SFTP adapter,
- * split out so it is unit-tested by vitest against `src/**` -- before
- * `pnpm build` produces `dist` -- the same way `calls-sfu.ts` is, rather
- * than only by hand against a real VM. The adapter itself (`ssh2`'s
- * `Client`/`sftp`/`exec` wiring) stays untested, same as
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * Pure decision logic for the calls SFU's SSH/SFTP deploy, split out so it is
+ * unit-tested by vitest against `src/**` -- before `pnpm build` produces
+ * `dist` -- the same way `calls-sfu.ts` is, rather than only by hand against
+ * a real VM. `calls-sfu-ssh-adapter.ts` applies every export here to a
+ * {@link CallsSfuSshSession} (`toCallsSfuHostPort`/`applyCallsSfuOverSession`)
+ * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
+ * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
+ * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
+ * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):
@@ -50,9 +53,18 @@ export function verifyHostKey(rawKey, expectedFingerprint) {
  * this script writes holds no secret. Returns the SFTP file mode to write
  * with, or `undefined` for anything else (the SFTP server's own default).
  * PR #125's review, finding 2; extended for #127's second secret file.
+ *
+ * A trailing `.tmp` is stripped before comparing: `calls-sfu.ts`'s
+ * `applyCallsSfu` writes `livekit.yaml` to a `.tmp` path first and renames
+ * it into place (#152 round 2 review, finding 3 -- a temp file plus an
+ * atomic rename, rather than overwriting the live config two concurrent
+ * applies could otherwise tear). The temp file holds the same secret the
+ * final path does, so it gets the same 0600 mode; `mv` preserves it across
+ * the rename.
  */
 export function fileWriteMode(path) {
-    return path === LIVEKIT_CONFIG_PATH || path === CLOUDFLARED_ENV_PATH ? 0o600 : undefined;
+    const target = path.endsWith('.tmp') ? path.slice(0, -'.tmp'.length) : path;
+    return target === LIVEKIT_CONFIG_PATH || target === CLOUDFLARED_ENV_PATH ? 0o600 : undefined;
 }
 // ---------------------------------------------------------------------------
 // 3. Preflight

package/dist/calls-sfu-keys.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Mints the LiveKit API key/secret pair the shared calls SFU signs tokens
+ * with (#170). Before this, `scripts/calls-sfu-deploy.mjs` read
+ * `LIVEKIT_API_KEY`/`LIVEKIT_API_SECRET` from the environment -- a human
+ * minted the pair by hand and put it in the secrets store. The platform
+ * `sfu` step (`plan/platform-sfu.ts`) mints it instead, once, and delivers it
+ * to held keys through `CallsSfuKeysPort.deliverLivekitKeys`; every apply
+ * after that reads the same pair back through `resolveLivekitKeys` rather
+ * than minting a second one.
+ *
+ * The shape matches LiveKit's own self-hosting docs: an `API`-prefixed key
+ * id and a long random secret, both plain alphanumeric so they drop straight
+ * into `livekit.yaml`'s `keys:` map (`calls-sfu.ts`'s `livekitConfigYaml`)
+ * with no escaping to worry about.
+ */
+export interface LivekitCredentials {
+    apiKey: string;
+    apiSecret: string;
+}
+/** A fresh LiveKit API key/secret pair, minted with `node:crypto`'s CSPRNG. */
+export declare function mintLivekitCredentials(): LivekitCredentials;

package/dist/calls-sfu-keys.js

@@ -0,0 +1,27 @@
+/**
+ * Mints the LiveKit API key/secret pair the shared calls SFU signs tokens
+ * with (#170). Before this, `scripts/calls-sfu-deploy.mjs` read
+ * `LIVEKIT_API_KEY`/`LIVEKIT_API_SECRET` from the environment -- a human
+ * minted the pair by hand and put it in the secrets store. The platform
+ * `sfu` step (`plan/platform-sfu.ts`) mints it instead, once, and delivers it
+ * to held keys through `CallsSfuKeysPort.deliverLivekitKeys`; every apply
+ * after that reads the same pair back through `resolveLivekitKeys` rather
+ * than minting a second one.
+ *
+ * The shape matches LiveKit's own self-hosting docs: an `API`-prefixed key
+ * id and a long random secret, both plain alphanumeric so they drop straight
+ * into `livekit.yaml`'s `keys:` map (`calls-sfu.ts`'s `livekitConfigYaml`)
+ * with no escaping to worry about.
+ */
+import { randomBytes } from 'node:crypto';
+const ALPHANUMERIC = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+function randomAlphanumeric(length) {
+    return Array.from(randomBytes(length), (byte) => ALPHANUMERIC[byte % ALPHANUMERIC.length]).join('');
+}
+/** A fresh LiveKit API key/secret pair, minted with `node:crypto`'s CSPRNG. */
+export function mintLivekitCredentials() {
+    return {
+        apiKey: `API${randomAlphanumeric(12)}`,
+        apiSecret: randomAlphanumeric(40),
+    };
+}

package/dist/calls-sfu-ssh-adapter.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Turns one open SSH session into the `CallsSfuHostPort` {@link applyCallsSfu}
+ * needs, applying `calls-sfu-deploy-support.ts`'s decision logic
+ * (`verifyHostKey`, `fileWriteMode`, the preflight check) exactly once so
+ * `scripts/calls-sfu-deploy.mjs` and the platform `sfu` step
+ * (`plan/platform-sfu.ts`, #170) share it rather than each re-deriving it.
+ *
+ * {@link CallsSfuSshSession} is deliberately narrow -- the host key an
+ * already-open session presented, a way to run a command, a way to write a
+ * file at a chosen mode -- so a test hands in a fake session and proves the
+ * host-key refusal and the 0600 file mode without ever opening a socket.
+ * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
+ * implementation, over `ssh2`, and stays untested for the same reason
+ * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * branch logic worth a fake session over.
+ */
+import { type CallsSfuConfig, type CallsSfuHostPort } from './calls-sfu.js';
+export declare class UnknownCallsSfuHostKeyError extends Error {
+    constructor();
+}
+/**
+ * One already-open SSH session, narrow enough to fake in a test: the raw
+ * host key it presented during the handshake, a way to run one command, and
+ * a way to write a file at a chosen mode (`undefined` for the SFTP server's
+ * own default, same as {@link CallsSfuHostPort.writeFile} today).
+ */
+export interface CallsSfuSshSession {
+    hostKey: Buffer;
+    exec(command: string): Promise<{
+        exitCode: number;
+        stdout: string;
+        stderr: string;
+    }>;
+    writeFile(path: string, contents: string, mode: number | undefined): Promise<void>;
+}
+/**
+ * Refuses with {@link UnknownCallsSfuHostKeyError} before adapting anything
+ * when `session.hostKey` does not match `expectedFingerprint` -- checked
+ * here, in code a fake session exercises directly, rather than only inside
+ * `ssh2`'s own `hostVerifier` (PR #125's review, finding 1). Otherwise
+ * returns a {@link CallsSfuHostPort} that writes each file at
+ * {@link fileWriteMode}'s mode (finding 2) and runs commands as-is.
+ */
+export declare function toCallsSfuHostPort(session: CallsSfuSshSession, expectedFingerprint: string | undefined): CallsSfuHostPort;
+/**
+ * The whole deploy, over one already-open session: refuse an unknown host
+ * key first (before any command runs), check `docker`/`ufw` are installed
+ * (PR #125's review, finding 3), make sure `/opt/livekit` exists, then hand
+ * off to {@link applyCallsSfu} -- the same order
+ * `scripts/calls-sfu-deploy.mjs` ran by hand, now shared with the platform
+ * `sfu` step. Every step here is safe to re-run, the same "safe to re-run"
+ * {@link applyCallsSfu} itself promises, so calling this twice with the same
+ * `session`/`config` changes nothing on the second call.
+ */
+export declare function applyCallsSfuOverSession(session: CallsSfuSshSession, config: CallsSfuConfig, expectedFingerprint: string | undefined): Promise<void>;

package/dist/calls-sfu-ssh-adapter.js

@@ -0,0 +1,78 @@
+/**
+ * Turns one open SSH session into the `CallsSfuHostPort` {@link applyCallsSfu}
+ * needs, applying `calls-sfu-deploy-support.ts`'s decision logic
+ * (`verifyHostKey`, `fileWriteMode`, the preflight check) exactly once so
+ * `scripts/calls-sfu-deploy.mjs` and the platform `sfu` step
+ * (`plan/platform-sfu.ts`, #170) share it rather than each re-deriving it.
+ *
+ * {@link CallsSfuSshSession} is deliberately narrow -- the host key an
+ * already-open session presented, a way to run a command, a way to write a
+ * file at a chosen mode -- so a test hands in a fake session and proves the
+ * host-key refusal and the 0600 file mode without ever opening a socket.
+ * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
+ * implementation, over `ssh2`, and stays untested for the same reason
+ * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * branch logic worth a fake session over.
+ */
+import { dirname } from 'node:path';
+import { PREFLIGHT_COMMAND, fileWriteMode, preflightFailureMessage, verifyHostKey, } from './calls-sfu-deploy-support.js';
+import { LIVEKIT_COMPOSE_PATH, LIVEKIT_CONFIG_PATH, applyCallsSfu, livekitConfigYaml, } from './calls-sfu.js';
+export class UnknownCallsSfuHostKeyError extends Error {
+    constructor() {
+        super('The calls SFU host key did not match the fingerprint held for it; refusing to ' +
+            'deploy. See calls-sfu-deploy-support.ts’s verifyHostKey (PR #125) -- the ' +
+            'expected fingerprint comes from held keys (#170’s "Human steps").');
+        this.name = 'UnknownCallsSfuHostKeyError';
+    }
+}
+/**
+ * Refuses with {@link UnknownCallsSfuHostKeyError} before adapting anything
+ * when `session.hostKey` does not match `expectedFingerprint` -- checked
+ * here, in code a fake session exercises directly, rather than only inside
+ * `ssh2`'s own `hostVerifier` (PR #125's review, finding 1). Otherwise
+ * returns a {@link CallsSfuHostPort} that writes each file at
+ * {@link fileWriteMode}'s mode (finding 2) and runs commands as-is.
+ */
+export function toCallsSfuHostPort(session, expectedFingerprint) {
+    if (!verifyHostKey(session.hostKey, expectedFingerprint)) {
+        throw new UnknownCallsSfuHostKeyError();
+    }
+    return {
+        writeFile: (path, contents) => session.writeFile(path, contents, fileWriteMode(path)),
+        exec: (command) => session.exec(command),
+    };
+}
+/**
+ * The whole deploy, over one already-open session: refuse an unknown host
+ * key first (before any command runs), check `docker`/`ufw` are installed
+ * (PR #125's review, finding 3), make sure `/opt/livekit` exists, then hand
+ * off to {@link applyCallsSfu} -- the same order
+ * `scripts/calls-sfu-deploy.mjs` ran by hand, now shared with the platform
+ * `sfu` step. Every step here is safe to re-run, the same "safe to re-run"
+ * {@link applyCallsSfu} itself promises, so calling this twice with the same
+ * `session`/`config` changes nothing on the second call.
+ */
+export async function applyCallsSfuOverSession(session, config, expectedFingerprint) {
+    const host = toCallsSfuHostPort(session, expectedFingerprint);
+    const preflight = await host.exec(PREFLIGHT_COMMAND);
+    if (preflight.exitCode !== 0) {
+        throw new Error(preflightFailureMessage(preflight));
+    }
+    const mkdir = await host.exec(`mkdir -p ${dirname(LIVEKIT_COMPOSE_PATH)}`);
+    if (mkdir.exitCode !== 0) {
+        throw new Error(`mkdir -p failed: ${mkdir.stderr || mkdir.stdout}`);
+    }
+    // `docker compose up -d` leaves a running container alone when the compose
+    // file is unchanged, so LiveKit would keep the old keys in memory after a
+    // new `livekit.yaml` lands. Read the config before it is overwritten and
+    // restart LiveKit afterwards if the keys (or anything else in it) changed.
+    const previous = await host.exec(`cat ${LIVEKIT_CONFIG_PATH}`);
+    const configChanged = previous.exitCode === 0 && previous.stdout !== livekitConfigYaml(config);
+    await applyCallsSfu(host, config);
+    if (configChanged) {
+        const restart = await host.exec(`docker compose -f ${LIVEKIT_COMPOSE_PATH} restart livekit`);
+        if (restart.exitCode !== 0) {
+            throw new Error(`restarting livekit failed: ${restart.stderr || restart.stdout}`);
+        }
+    }
+}

package/dist/calls-sfu-ssh-client.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The real {@link CallsSfuSshConnector} (`plan/platform-sfu.ts`), over `ssh2`:
+ * the same `connect()`/`exec`/SFTP wiring `scripts/calls-sfu-deploy.mjs` uses
+ * by hand. A host (archon) passes {@link connectCallsSfuSsh} as the `ssh` dep
+ * of `CallsSfuPlatformDeps`.
+ *
+ * The host key is verified inside `ssh2`'s own `hostVerifier`, which returns
+ * `false` on a mismatch or a missing fingerprint so the handshake is refused
+ * before any authentication happens and the private key is never offered to
+ * an unknown host. `applyCallsSfuOverSession` checks the captured key again.
+ *
+ * `ssh2` is loaded lazily and the `Client` class can be injected, so a test
+ * hands in a fake and never opens a socket.
+ */
+import type { CallsSfuSshSession } from './calls-sfu-ssh-adapter.js';
+interface SshStream {
+    on(event: string, listener: (...args: never[]) => void): SshStream;
+    stderr: {
+        on(event: string, listener: (...args: never[]) => void): unknown;
+    };
+}
+interface SshSftp {
+    writeFile(path: string, contents: string, options: {
+        mode: number;
+    } | undefined, cb: (err?: Error | null) => void): void;
+    chmod(path: string, mode: number, cb: (err?: Error | null) => void): void;
+}
+interface SshClient {
+    on(event: string, listener: (...args: never[]) => void): SshClient;
+    connect(options: Record<string, unknown>): void;
+    exec(command: string, cb: (err: Error | undefined, stream: SshStream) => void): void;
+    sftp(cb: (err: Error | undefined, sftp: SshSftp) => void): void;
+    end(): void;
+}
+export type SshClientConstructor = new () => SshClient;
+export interface CallsSfuSshConnectOptions {
+    address: string;
+    sshUser: string;
+    sshPort: number;
+    sshPrivateKey: string;
+    /** `SHA256:...`. Without it every host key is refused. */
+    sshHostFingerprint: string | undefined;
+}
+export declare function connectCallsSfuSsh(options: CallsSfuSshConnectOptions, deps?: {
+    Client?: SshClientConstructor;
+}): Promise<CallsSfuSshSession & {
+    close(): void;
+}>;
+export {};

package/dist/calls-sfu-ssh-client.js

@@ -0,0 +1,82 @@
+/**
+ * The real {@link CallsSfuSshConnector} (`plan/platform-sfu.ts`), over `ssh2`:
+ * the same `connect()`/`exec`/SFTP wiring `scripts/calls-sfu-deploy.mjs` uses
+ * by hand. A host (archon) passes {@link connectCallsSfuSsh} as the `ssh` dep
+ * of `CallsSfuPlatformDeps`.
+ *
+ * The host key is verified inside `ssh2`'s own `hostVerifier`, which returns
+ * `false` on a mismatch or a missing fingerprint so the handshake is refused
+ * before any authentication happens and the private key is never offered to
+ * an unknown host. `applyCallsSfuOverSession` checks the captured key again.
+ *
+ * `ssh2` is loaded lazily and the `Client` class can be injected, so a test
+ * hands in a fake and never opens a socket.
+ */
+import { verifyHostKey } from './calls-sfu-deploy-support.js';
+function sshExec(conn, command) {
+    return new Promise((resolve, reject) => {
+        conn.exec(command, (err, stream) => {
+            if (err)
+                return reject(err);
+            let stdout = '';
+            let stderr = '';
+            stream.on('close', (code) => resolve({ exitCode: code ?? 0, stdout, stderr }));
+            stream.on('data', (chunk) => {
+                stdout += chunk;
+            });
+            stream.stderr.on('data', (chunk) => {
+                stderr += chunk;
+            });
+        });
+    });
+}
+function sshWriteFile(conn, path, contents, mode) {
+    return new Promise((resolve, reject) => {
+        conn.sftp((err, sftp) => {
+            if (err)
+                return reject(err);
+            sftp.writeFile(path, contents, mode ? { mode } : undefined, (writeErr) => {
+                if (writeErr)
+                    return reject(writeErr);
+                // `mode` on writeFile only applies when the file is created; chmod
+                // repairs a file that already existed with looser permissions.
+                if (!mode)
+                    return resolve();
+                sftp.chmod(path, mode, (chmodErr) => (chmodErr ? reject(chmodErr) : resolve()));
+            });
+        });
+    });
+}
+export async function connectCallsSfuSsh(options, deps = {}) {
+    const Client = deps.Client ?? (await loadSsh2()).Client;
+    return new Promise((resolve, reject) => {
+        const conn = new Client();
+        let hostKey = Buffer.alloc(0);
+        conn.on('ready', () => resolve({
+            hostKey,
+            exec: (command) => sshExec(conn, command),
+            writeFile: (path, contents, mode) => sshWriteFile(conn, path, contents, mode),
+            close: () => conn.end(),
+        }));
+        conn.on('error', reject);
+        conn.connect({
+            host: options.address,
+            port: options.sshPort,
+            username: options.sshUser,
+            privateKey: options.sshPrivateKey,
+            // One argument: ssh2 treats the return value as the verdict.
+            hostVerifier: (key) => {
+                hostKey = key;
+                return verifyHostKey(key, options.sshHostFingerprint);
+            },
+        });
+    });
+}
+async function loadSsh2() {
+    const specifier = 'ssh2';
+    const mod = (await import(specifier));
+    const Client = mod.Client ?? mod.default?.Client;
+    if (!Client)
+        throw new Error('ssh2 did not export a Client');
+    return { Client };
+}

package/dist/calls-sfu.d.ts

@@ -17,16 +17,25 @@
  * specifically to keep Coolify's own firewall script (`ADR 0011`) untouched
  * (calls#15). {@link CallsSfuHostPort} is deliberately narrow -- write a
  * file, run a command -- so a real implementation is a thin SSH/SFTP client
- * (`packages/foundry/scripts/calls-sfu-deploy.mjs`), never imported here,
- * and every test in `calls-sfu.test.ts` runs against a fake.
+ * (`packages/foundry/scripts/calls-sfu-deploy.mjs`, and, as of #170, the
+ * platform's own `sfu:livekit` step, `plan/platform-sfu.ts`), never imported
+ * here, and every test in `calls-sfu.test.ts` runs against a fake.
  *
- * The address, the LiveKit API key and its secret are never hardcoded here
+ * The address and every LiveKit API key/secret pair are never hardcoded here
  * ({@link CallsSfuConfig}): PR 344's review on app-template's
  * `calls-instance` step found its first cut created three Coolify apps
  * before it ever checked the address was known.
  * {@link requireCallsSfuAddress} is that check, run first, before either
  * file is written.
  *
+ * #152: one shared instance, kept apart by *per-company* keys rather than
+ * one shared pair -- {@link CallsSfuConfig.livekitKeys} carries every org's
+ * own key/secret pair, and {@link livekitConfigYaml} writes all of them into
+ * `keys:`. Minting and delivering each org's pair is the platform `sfu`
+ * step's job (`plan/platform-sfu.ts`'s `applyCallsSfuPlatformStep`), not
+ * this module's -- the same "this package never invents a credential" rule
+ * the single-pair design already followed.
+ *
  * #127 adds a second compose service, `cloudflared`, so the SFU has a public
  * `wss://` address through its own named tunnel -- browsers on an https page
  * cannot open a plain `ws://` connection, and 7880 was open to the whole
@@ -63,16 +72,24 @@ export declare class MissingCloudflaredTunnelTokenError extends Error {
 export declare function requireCloudflaredTunnelToken(token: string | undefined | null): string;
 /**
  * Everything {@link applyCallsSfu} needs and this package never invents on
- * its own: the SFU's own address (calls#15), the LiveKit API key/secret pair
- * every client and the service sign tokens with, and the token for the
- * named tunnel `scripts/calls-sfu-ingress.mjs` creates. All four come from
- * the secrets store, at the caller's own script -- #122's and #127's "Human
- * steps".
+ * its own: the SFU's own address (calls#15), one LiveKit API key/secret pair
+ * per org with calls enabled (#152 -- a shared instance, kept apart by
+ * per-company keys, not a port range or a deployment each), and the token
+ * for the named tunnel `scripts/calls-sfu-ingress.mjs` creates. All of it
+ * comes from the secrets store, at the caller's own script -- #122's and
+ * #127's "Human steps" -- except the per-org pairs, which the platform `sfu`
+ * step mints itself (`plan/platform-sfu.ts`).
  */
 export interface CallsSfuConfig {
     address: string;
-    livekitApiKey: string;
-    livekitApiSecret: string;
+    /**
+     * API key id -> secret, one entry per org currently enabled for calls.
+     * {@link livekitConfigYaml} writes every entry under `keys:`, sorted by key
+     * id so the same set of orgs always serializes to the same bytes -- what
+     * `calls-sfu-ssh-adapter.ts`'s `applyCallsSfuOverSession` compares, byte
+     * for byte, to decide whether LiveKit needs a restart.
+     */
+    livekitKeys: Record<string, string>;
     cloudflaredTunnelToken: string;
 }
 /**
@@ -102,8 +119,8 @@ export declare const CLOUDFLARED_ENV_PATH = "/opt/livekit/cloudflared.env";
  * anywhere a supply-chain review has asked for a digest pin yet.
  */
 export declare const LIVEKIT_IMAGE_REF = "livekit/livekit-server:latest";
-/** Same tag policy as {@link LIVEKIT_IMAGE_REF}; matches `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export declare const CLOUDFLARED_IMAGE_REF = "cloudflare/cloudflared:latest";
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
+export declare const CLOUDFLARED_IMAGE_REF = "cloudflare/cloudflared:2026.9.3";
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export declare const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */
@@ -162,6 +179,13 @@ export declare function cloudflaredEnvFile(token: string): string;
  * has one public address of its own, bridged directly rather than sitting
  * behind NAT (calls#15's decision comment), so there is a known-good answer
  * and no reason to make LiveKit discover it via STUN.
+ *
+ * `keys:` carries one line per entry in {@link CallsSfuConfig.livekitKeys}
+ * (#152), sorted by key id -- never object insertion order, which
+ * JavaScript does not even guarantee is the order the platform step built
+ * the map in. An org dropped from the map (calls turned off) simply has no
+ * line here on the next apply; nothing here deletes a key, it only ever
+ * writes the set it was given.
  */
 export declare function livekitConfigYaml(config: CallsSfuConfig): string;
 /**

package/dist/calls-sfu.js

@@ -17,16 +17,25 @@
  * specifically to keep Coolify's own firewall script (`ADR 0011`) untouched
  * (calls#15). {@link CallsSfuHostPort} is deliberately narrow -- write a
  * file, run a command -- so a real implementation is a thin SSH/SFTP client
- * (`packages/foundry/scripts/calls-sfu-deploy.mjs`), never imported here,
- * and every test in `calls-sfu.test.ts` runs against a fake.
+ * (`packages/foundry/scripts/calls-sfu-deploy.mjs`, and, as of #170, the
+ * platform's own `sfu:livekit` step, `plan/platform-sfu.ts`), never imported
+ * here, and every test in `calls-sfu.test.ts` runs against a fake.
  *
- * The address, the LiveKit API key and its secret are never hardcoded here
+ * The address and every LiveKit API key/secret pair are never hardcoded here
  * ({@link CallsSfuConfig}): PR 344's review on app-template's
  * `calls-instance` step found its first cut created three Coolify apps
  * before it ever checked the address was known.
  * {@link requireCallsSfuAddress} is that check, run first, before either
  * file is written.
  *
+ * #152: one shared instance, kept apart by *per-company* keys rather than
+ * one shared pair -- {@link CallsSfuConfig.livekitKeys} carries every org's
+ * own key/secret pair, and {@link livekitConfigYaml} writes all of them into
+ * `keys:`. Minting and delivering each org's pair is the platform `sfu`
+ * step's job (`plan/platform-sfu.ts`'s `applyCallsSfuPlatformStep`), not
+ * this module's -- the same "this package never invents a credential" rule
+ * the single-pair design already followed.
+ *
  * #127 adds a second compose service, `cloudflared`, so the SFU has a public
  * `wss://` address through its own named tunnel -- browsers on an https page
  * cannot open a plain `ws://` connection, and 7880 was open to the whole
@@ -99,8 +108,8 @@ export const CLOUDFLARED_ENV_PATH = '/opt/livekit/cloudflared.env';
  * anywhere a supply-chain review has asked for a digest pin yet.
  */
 export const LIVEKIT_IMAGE_REF = 'livekit/livekit-server:latest';
-/** Same tag policy as {@link LIVEKIT_IMAGE_REF}; matches `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export const CLOUDFLARED_IMAGE_REF = 'cloudflare/cloudflared:latest';
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
+export const CLOUDFLARED_IMAGE_REF = 'cloudflare/cloudflared:2026.9.3';
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */
@@ -190,9 +199,20 @@ export function cloudflaredEnvFile(token) {
  * has one public address of its own, bridged directly rather than sitting
  * behind NAT (calls#15's decision comment), so there is a known-good answer
  * and no reason to make LiveKit discover it via STUN.
+ *
+ * `keys:` carries one line per entry in {@link CallsSfuConfig.livekitKeys}
+ * (#152), sorted by key id -- never object insertion order, which
+ * JavaScript does not even guarantee is the order the platform step built
+ * the map in. An org dropped from the map (calls turned off) simply has no
+ * line here on the next apply; nothing here deletes a key, it only ever
+ * writes the set it was given.
  */
 export function livekitConfigYaml(config) {
     const address = requireCallsSfuAddress(config.address);
+    const keys = Object.entries(config.livekitKeys).sort(([a], [b]) => a.localeCompare(b));
+    const keysYaml = keys.length === 0
+        ? 'keys: {}\n'
+        : `keys:\n${keys.map(([apiKey, apiSecret]) => `  ${apiKey}: ${apiSecret}`).join('\n')}\n`;
     return `port: ${LIVEKIT_SIGNALLING_PORT}
 rtc:
   tcp_port: ${LIVEKIT_MEDIA_TCP_PORT}
@@ -200,9 +220,7 @@ rtc:
   port_range_end: 60000
   use_external_ip: false
   node_ip: ${address}
-keys:
-  ${config.livekitApiKey}: ${config.livekitApiSecret}
-`;
+${keysYaml}`;
 }
 async function run(host, command) {
     const result = await host.exec(command);
@@ -210,6 +228,20 @@ async function run(host, command) {
         throw new Error(`"${command}" exited ${result.exitCode}: ${result.stderr || result.stdout}`);
     }
 }
+/**
+ * Writes `contents` to `${path}.tmp` and renames it onto `path` with `mv`,
+ * rather than writing `path` directly -- `mv` within the same directory is a
+ * single rename syscall, so a reader of `path` (this function's own
+ * `cat`-and-compare in `calls-sfu-ssh-adapter.ts`, or LiveKit's own read at
+ * container start) only ever sees the old complete file or the new complete
+ * one, never a partial write from one apply interleaved with another's
+ * (#152 round 2 review, finding 3).
+ */
+async function writeFileAtomically(host, path, contents) {
+    const tmpPath = `${path}.tmp`;
+    await host.writeFile(tmpPath, contents);
+    await run(host, `mv -f ${tmpPath} ${path}`);
+}
 /**
  * Writes all three files, brings LiveKit and `cloudflared` up, then narrows
  * the VM firewall to exactly what #122's and #127's "Decided" sections name
@@ -239,7 +271,7 @@ export async function applyCallsSfu(host, config) {
     requireCallsSfuAddress(config.address);
     requireCloudflaredTunnelToken(config.cloudflaredTunnelToken);
     await host.writeFile(LIVEKIT_COMPOSE_PATH, dockerComposeYaml());
-    await host.writeFile(LIVEKIT_CONFIG_PATH, livekitConfigYaml(config));
+    await writeFileAtomically(host, LIVEKIT_CONFIG_PATH, livekitConfigYaml(config));
     await host.writeFile(CLOUDFLARED_ENV_PATH, cloudflaredEnvFile(config.cloudflaredTunnelToken));
     await run(host, `docker compose -f ${LIVEKIT_COMPOSE_PATH} up -d`);
     await run(host, 'ufw allow 22/tcp');