@wtfalch/foundry 0.5.0 → 0.7.1

package/dist/bootstrap/bootstrap.d.ts

@@ -7,7 +7,16 @@ export interface BootstrapPlatformInput {
     company: BootstrapCompany;
     owner: BootstrapOwner;
 }
-/** The master keys, read from the host's held keys by the caller. */
+/**
+ * The master keys, read from the host's held keys by the caller.
+ *
+ * #213: `coolifyUrl`, `coolifyToken` and `cloudflareApiToken` are also what
+ * `bootstrapPlatform` puts as Archon's own held keys
+ * (`platform:master:coolify-url`, `-coolify-token`, `-cloudflare-token`)
+ * before Archon's app deploys, so its onboarding can read them back.
+ * `cloudflareApiToken` needs "API Tokens Write" for that: Archon mints its
+ * own scoped child tokens from it.
+ */
 export interface RootCredentials {
     coolifyUrl: string;
     coolifyToken: string;
@@ -32,8 +41,14 @@ export interface BootstrapPlatformDeps {
     migrateSql: MigrateSql;
     rootCredentials: () => Promise<RootCredentials>;
     deliverSecret: (ref: string, secret: string) => Promise<void>;
+    /**
+     * `put` (#213) is optional, like `PlatformArchonDeps.heldKeys`'s own: a
+     * host without one still compiles, and Archon's master keys are reported
+     * blocked, not skipped, while it is missing.
+     */
     heldKeys: {
         resolve(ref: string): Promise<string | null>;
+        put?(ref: string, value: string): Promise<void>;
     };
     /** Per-step dependencies (auth, mail, files, ai, integrations, archon, sfu). A step without its own is reported blocked. */
     executor?: BootstrapExecutorDeps;

package/dist/bootstrap/bootstrap.js

@@ -106,12 +106,39 @@ export function guardStepDeps(executor, redactor, deliverSecret, heldKeys) {
         const copy = { ...deps };
         if ('deliverSecret' in copy)
             copy.deliverSecret = deliverSecret;
-        if (key === 'archon' || 'heldKeys' in copy)
+        // #201: ai's own default minter needs heldKeys too, to re-sign a mint
+        // request against its signing key when an earlier run pinned it but
+        // crashed before the management key itself was minted and delivered.
+        if (key === 'archon' || key === 'ai' || 'heldKeys' in copy)
             copy.heldKeys = heldKeys;
         out[key] = copy;
     }
     return out;
 }
+/**
+ * #213: stamps `PlatformArchonDeps.masterKeys` from the root credentials
+ * `bootstrapPlatform` already resolved, onto whatever the host gave the
+ * archon step through `deps.executor.archon` -- the values are
+ * `credentials`' own, not something the host names separately, so this is
+ * not one more thing for `guardStepDeps`'s caller to wire by hand. A run
+ * with no `archon` deps at all (the step then reported blocked, as before)
+ * is passed through unchanged.
+ */
+function archonMasterKeys(guarded, credentials) {
+    if (!guarded.archon)
+        return guarded;
+    return {
+        ...guarded,
+        archon: {
+            ...guarded.archon,
+            masterKeys: {
+                coolifyUrl: credentials.coolifyUrl,
+                coolifyToken: credentials.coolifyToken,
+                cloudflareParentToken: credentials.cloudflareApiToken,
+            },
+        },
+    };
+}
 /**
  * The platform's first apply, run from Archon's onboarding flow: migrates
  * foundry's tables, declares Company Included and the platform (never
@@ -148,6 +175,17 @@ export async function bootstrapPlatform(input, deps) {
                 redactor.add(value);
                 return value;
             },
+            // #213: only present when the host's own heldKeys can put, so a host
+            // without one leaves Archon's master keys reported blocked rather
+            // than silently no-op'd.
+            ...(deps.heldKeys.put
+                ? {
+                    async put(ref, value) {
+                        redactor.add(value);
+                        await deps.heldKeys.put?.(ref, value);
+                    },
+                }
+                : {}),
         };
         const migrated = await migrate(deps.migrateSql);
         emit({
@@ -193,7 +231,7 @@ export async function bootstrapPlatform(input, deps) {
                 executor: new FoundryPlatformStepExecutor(cloudflare, orgStore, {
                     coolify,
                     deliverSecret,
-                    ...guardStepDeps(deps.executor, redactor, deliverSecret, heldKeys),
+                    ...archonMasterKeys(guardStepDeps(deps.executor, redactor, deliverSecret, heldKeys), credentials),
                 }),
             };
         }

package/dist/bootstrap/declare.d.ts

@@ -7,8 +7,10 @@ export declare const DEFAULT_GIT_REF = "main";
  * The Stalwart image tag the platform's mail step runs. `platform.mail.gitRef`
  * is an image tag, not a git ref, and the planner blocks a floating one
  * (`platform-providers.ts`, `mailImageTagBlocked`), so this is a pinned release.
+ * Pinned in `versions.json` as `stalwart` (#247) -- this is the pattern that
+ * file's loader follows.
  */
-export declare const DEFAULT_MAIL_IMAGE_TAG = "v0.16.24";
+export declare const DEFAULT_MAIL_IMAGE_TAG: string;
 export interface BootstrapCompany {
     name: string;
     slug: string;

package/dist/bootstrap/declare.js

@@ -1,5 +1,6 @@
 import { validateOwner } from '../org.js';
 import { PLATFORM_SERVICE_KEYS, defaultPlatformHostname } from '../platform.js';
+import { VERSIONS } from './versions.js';
 /** Company Included's own org id, the same literal `test/fakes.ts`'s `basePlatform()` uses for `ownerOrgId`. */
 export const COMPANY_INCLUDED_ORG_ID = 'org_company_included';
 export const DEFAULT_GIT_REF = 'main';
@@ -7,8 +8,10 @@ export const DEFAULT_GIT_REF = 'main';
  * The Stalwart image tag the platform's mail step runs. `platform.mail.gitRef`
  * is an image tag, not a git ref, and the planner blocks a floating one
  * (`platform-providers.ts`, `mailImageTagBlocked`), so this is a pinned release.
+ * Pinned in `versions.json` as `stalwart` (#247) -- this is the pattern that
+ * file's loader follows.
  */
-export const DEFAULT_MAIL_IMAGE_TAG = 'v0.16.24';
+export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
 /**
  * Every platform service except `sfu` is enabled, like the other steps: a
  * service whose dependencies the host did not supply is reported blocked, not
@@ -49,12 +52,18 @@ export function declaredCompanyOrg(company, owner) {
         slug: company.slug,
         displayName: company.name,
         domain: null,
-        mail: { mode: 'off', usesDomain: false },
-        chat: { usesDomain: false },
+        mail: {
+            mode: 'off',
+            usesDomain: false,
+            ownerMailboxAddress: null,
+            noReplyLocalPart: 'no-reply',
+        },
+        chat: { enabled: false, usesDomain: false },
         calls: { enabled: false, usesDomain: false },
         issuer: { usesDomain: false },
         site: { enabled: false, usesDomain: false },
         hosting: {
+            appEnv: {},
             enabled: false,
             usesDomain: false,
             database: false,

package/dist/bootstrap/versions.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The estate's pinned third-party image/release refs for the platform
+ * services foundry provisions (#247). One JSON file, so Renovate can read
+ * and later propose bumps against it, instead of four separate string
+ * constants it cannot see. `postgres` has no entry here: no planner step
+ * pins a postgres image tag today, so there is no ref to record yet.
+ */
+export interface PinnedVersions {
+    zitadel: string;
+    synapse: string;
+    mas: string;
+    livekit: string;
+    cloudflared: string;
+    stalwart: string;
+}
+export declare function loadVersions(): PinnedVersions;
+export declare const VERSIONS: PinnedVersions;

package/dist/bootstrap/versions.js

@@ -0,0 +1,12 @@
+import { readFileSync } from 'node:fs';
+/**
+ * Read at module load from `versions.json`, which sits beside this
+ * package's `package.json` (not under `src`, so plain JSON import would
+ * fight `tsconfig.build.json`'s `rootDir`) and ships in the published
+ * tarball via `package.json`'s `files`.
+ */
+const VERSIONS_PATH = new URL('../../versions.json', import.meta.url);
+export function loadVersions() {
+    return JSON.parse(readFileSync(VERSIONS_PATH, 'utf8'));
+}
+export const VERSIONS = loadVersions();

package/dist/calls-sfu-deploy-support.d.ts

@@ -38,6 +38,14 @@ export declare function verifyHostKey(rawKey: Buffer, expectedFingerprint: strin
  * this script writes holds no secret. Returns the SFTP file mode to write
  * with, or `undefined` for anything else (the SFTP server's own default).
  * PR #125's review, finding 2; extended for #127's second secret file.
+ *
+ * A trailing `.tmp` is stripped before comparing: `calls-sfu.ts`'s
+ * `applyCallsSfu` writes `livekit.yaml` to a `.tmp` path first and renames
+ * it into place (#152 round 2 review, finding 3 -- a temp file plus an
+ * atomic rename, rather than overwriting the live config two concurrent
+ * applies could otherwise tear). The temp file holds the same secret the
+ * final path does, so it gets the same 0600 mode; `mv` preserves it across
+ * the rename.
  */
 export declare function fileWriteMode(path: string): number | undefined;
 /**

package/dist/calls-sfu-deploy-support.js

@@ -53,9 +53,18 @@ export function verifyHostKey(rawKey, expectedFingerprint) {
  * this script writes holds no secret. Returns the SFTP file mode to write
  * with, or `undefined` for anything else (the SFTP server's own default).
  * PR #125's review, finding 2; extended for #127's second secret file.
+ *
+ * A trailing `.tmp` is stripped before comparing: `calls-sfu.ts`'s
+ * `applyCallsSfu` writes `livekit.yaml` to a `.tmp` path first and renames
+ * it into place (#152 round 2 review, finding 3 -- a temp file plus an
+ * atomic rename, rather than overwriting the live config two concurrent
+ * applies could otherwise tear). The temp file holds the same secret the
+ * final path does, so it gets the same 0600 mode; `mv` preserves it across
+ * the rename.
  */
 export function fileWriteMode(path) {
-    return path === LIVEKIT_CONFIG_PATH || path === CLOUDFLARED_ENV_PATH ? 0o600 : undefined;
+    const target = path.endsWith('.tmp') ? path.slice(0, -'.tmp'.length) : path;
+    return target === LIVEKIT_CONFIG_PATH || target === CLOUDFLARED_ENV_PATH ? 0o600 : undefined;
 }
 // ---------------------------------------------------------------------------
 // 3. Preflight

package/dist/calls-sfu.d.ts

@@ -21,13 +21,21 @@
  * platform's own `sfu:livekit` step, `plan/platform-sfu.ts`), never imported
  * here, and every test in `calls-sfu.test.ts` runs against a fake.
  *
- * The address, the LiveKit API key and its secret are never hardcoded here
+ * The address and every LiveKit API key/secret pair are never hardcoded here
  * ({@link CallsSfuConfig}): PR 344's review on app-template's
  * `calls-instance` step found its first cut created three Coolify apps
  * before it ever checked the address was known.
  * {@link requireCallsSfuAddress} is that check, run first, before either
  * file is written.
  *
+ * #152: one shared instance, kept apart by *per-company* keys rather than
+ * one shared pair -- {@link CallsSfuConfig.livekitKeys} carries every org's
+ * own key/secret pair, and {@link livekitConfigYaml} writes all of them into
+ * `keys:`. Minting and delivering each org's pair is the platform `sfu`
+ * step's job (`plan/platform-sfu.ts`'s `applyCallsSfuPlatformStep`), not
+ * this module's -- the same "this package never invents a credential" rule
+ * the single-pair design already followed.
+ *
  * #127 adds a second compose service, `cloudflared`, so the SFU has a public
  * `wss://` address through its own named tunnel -- browsers on an https page
  * cannot open a plain `ws://` connection, and 7880 was open to the whole
@@ -64,16 +72,24 @@ export declare class MissingCloudflaredTunnelTokenError extends Error {
 export declare function requireCloudflaredTunnelToken(token: string | undefined | null): string;
 /**
  * Everything {@link applyCallsSfu} needs and this package never invents on
- * its own: the SFU's own address (calls#15), the LiveKit API key/secret pair
- * every client and the service sign tokens with, and the token for the
- * named tunnel `scripts/calls-sfu-ingress.mjs` creates. All four come from
- * the secrets store, at the caller's own script -- #122's and #127's "Human
- * steps".
+ * its own: the SFU's own address (calls#15), one LiveKit API key/secret pair
+ * per org with calls enabled (#152 -- a shared instance, kept apart by
+ * per-company keys, not a port range or a deployment each), and the token
+ * for the named tunnel `scripts/calls-sfu-ingress.mjs` creates. All of it
+ * comes from the secrets store, at the caller's own script -- #122's and
+ * #127's "Human steps" -- except the per-org pairs, which the platform `sfu`
+ * step mints itself (`plan/platform-sfu.ts`).
  */
 export interface CallsSfuConfig {
     address: string;
-    livekitApiKey: string;
-    livekitApiSecret: string;
+    /**
+     * API key id -> secret, one entry per org currently enabled for calls.
+     * {@link livekitConfigYaml} writes every entry under `keys:`, sorted by key
+     * id so the same set of orgs always serializes to the same bytes -- what
+     * `calls-sfu-ssh-adapter.ts`'s `applyCallsSfuOverSession` compares, byte
+     * for byte, to decide whether LiveKit needs a restart.
+     */
+    livekitKeys: Record<string, string>;
     cloudflaredTunnelToken: string;
 }
 /**
@@ -100,11 +116,12 @@ export declare const CLOUDFLARED_ENV_PATH = "/opt/livekit/cloudflared.env";
 /**
  * `:latest`, matching this codebase's one other pinned-by-tag-only image
  * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet.
+ * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
+ * `versions.json` (#247).
  */
-export declare const LIVEKIT_IMAGE_REF = "livekit/livekit-server:latest";
-/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export declare const CLOUDFLARED_IMAGE_REF = "cloudflare/cloudflared:2026.9.3";
+export declare const LIVEKIT_IMAGE_REF: string;
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */
+export declare const CLOUDFLARED_IMAGE_REF: string;
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export declare const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */
@@ -163,6 +180,13 @@ export declare function cloudflaredEnvFile(token: string): string;
  * has one public address of its own, bridged directly rather than sitting
  * behind NAT (calls#15's decision comment), so there is a known-good answer
  * and no reason to make LiveKit discover it via STUN.
+ *
+ * `keys:` carries one line per entry in {@link CallsSfuConfig.livekitKeys}
+ * (#152), sorted by key id -- never object insertion order, which
+ * JavaScript does not even guarantee is the order the platform step built
+ * the map in. An org dropped from the map (calls turned off) simply has no
+ * line here on the next apply; nothing here deletes a key, it only ever
+ * writes the set it was given.
  */
 export declare function livekitConfigYaml(config: CallsSfuConfig): string;
 /**

package/dist/calls-sfu.js

@@ -21,13 +21,21 @@
  * platform's own `sfu:livekit` step, `plan/platform-sfu.ts`), never imported
  * here, and every test in `calls-sfu.test.ts` runs against a fake.
  *
- * The address, the LiveKit API key and its secret are never hardcoded here
+ * The address and every LiveKit API key/secret pair are never hardcoded here
  * ({@link CallsSfuConfig}): PR 344's review on app-template's
  * `calls-instance` step found its first cut created three Coolify apps
  * before it ever checked the address was known.
  * {@link requireCallsSfuAddress} is that check, run first, before either
  * file is written.
  *
+ * #152: one shared instance, kept apart by *per-company* keys rather than
+ * one shared pair -- {@link CallsSfuConfig.livekitKeys} carries every org's
+ * own key/secret pair, and {@link livekitConfigYaml} writes all of them into
+ * `keys:`. Minting and delivering each org's pair is the platform `sfu`
+ * step's job (`plan/platform-sfu.ts`'s `applyCallsSfuPlatformStep`), not
+ * this module's -- the same "this package never invents a credential" rule
+ * the single-pair design already followed.
+ *
  * #127 adds a second compose service, `cloudflared`, so the SFU has a public
  * `wss://` address through its own named tunnel -- browsers on an https page
  * cannot open a plain `ws://` connection, and 7880 was open to the whole
@@ -44,6 +52,7 @@
  * `calls-sfu-deploy-support.ts`'s `fileWriteMode`), never logged, scrubbed
  * from any error `calls-sfu-deploy.mjs` prints.
  */
+import { VERSIONS } from './bootstrap/versions.js';
 // ---------------------------------------------------------------------------
 // The guard
 // ---------------------------------------------------------------------------
@@ -97,11 +106,12 @@ export const CLOUDFLARED_ENV_PATH = '/opt/livekit/cloudflared.env';
 /**
  * `:latest`, matching this codebase's one other pinned-by-tag-only image
  * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet.
+ * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
+ * `versions.json` (#247).
  */
-export const LIVEKIT_IMAGE_REF = 'livekit/livekit-server:latest';
-/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export const CLOUDFLARED_IMAGE_REF = 'cloudflare/cloudflared:2026.9.3';
+export const LIVEKIT_IMAGE_REF = `livekit/livekit-server:${VERSIONS.livekit}`;
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */
+export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */
@@ -191,9 +201,20 @@ export function cloudflaredEnvFile(token) {
  * has one public address of its own, bridged directly rather than sitting
  * behind NAT (calls#15's decision comment), so there is a known-good answer
  * and no reason to make LiveKit discover it via STUN.
+ *
+ * `keys:` carries one line per entry in {@link CallsSfuConfig.livekitKeys}
+ * (#152), sorted by key id -- never object insertion order, which
+ * JavaScript does not even guarantee is the order the platform step built
+ * the map in. An org dropped from the map (calls turned off) simply has no
+ * line here on the next apply; nothing here deletes a key, it only ever
+ * writes the set it was given.
  */
 export function livekitConfigYaml(config) {
     const address = requireCallsSfuAddress(config.address);
+    const keys = Object.entries(config.livekitKeys).sort(([a], [b]) => a.localeCompare(b));
+    const keysYaml = keys.length === 0
+        ? 'keys: {}\n'
+        : `keys:\n${keys.map(([apiKey, apiSecret]) => `  ${apiKey}: ${apiSecret}`).join('\n')}\n`;
     return `port: ${LIVEKIT_SIGNALLING_PORT}
 rtc:
   tcp_port: ${LIVEKIT_MEDIA_TCP_PORT}
@@ -201,9 +222,7 @@ rtc:
   port_range_end: 60000
   use_external_ip: false
   node_ip: ${address}
-keys:
-  ${config.livekitApiKey}: ${config.livekitApiSecret}
-`;
+${keysYaml}`;
 }
 async function run(host, command) {
     const result = await host.exec(command);
@@ -211,6 +230,20 @@ async function run(host, command) {
         throw new Error(`"${command}" exited ${result.exitCode}: ${result.stderr || result.stdout}`);
     }
 }
+/**
+ * Writes `contents` to `${path}.tmp` and renames it onto `path` with `mv`,
+ * rather than writing `path` directly -- `mv` within the same directory is a
+ * single rename syscall, so a reader of `path` (this function's own
+ * `cat`-and-compare in `calls-sfu-ssh-adapter.ts`, or LiveKit's own read at
+ * container start) only ever sees the old complete file or the new complete
+ * one, never a partial write from one apply interleaved with another's
+ * (#152 round 2 review, finding 3).
+ */
+async function writeFileAtomically(host, path, contents) {
+    const tmpPath = `${path}.tmp`;
+    await host.writeFile(tmpPath, contents);
+    await run(host, `mv -f ${tmpPath} ${path}`);
+}
 /**
  * Writes all three files, brings LiveKit and `cloudflared` up, then narrows
  * the VM firewall to exactly what #122's and #127's "Decided" sections name
@@ -240,7 +273,7 @@ export async function applyCallsSfu(host, config) {
     requireCallsSfuAddress(config.address);
     requireCloudflaredTunnelToken(config.cloudflaredTunnelToken);
     await host.writeFile(LIVEKIT_COMPOSE_PATH, dockerComposeYaml());
-    await host.writeFile(LIVEKIT_CONFIG_PATH, livekitConfigYaml(config));
+    await writeFileAtomically(host, LIVEKIT_CONFIG_PATH, livekitConfigYaml(config));
     await host.writeFile(CLOUDFLARED_ENV_PATH, cloudflaredEnvFile(config.cloudflaredTunnelToken));
     await run(host, `docker compose -f ${LIVEKIT_COMPOSE_PATH} up -d`);
     await run(host, 'ufw allow 22/tcp');

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, DeclaredOrg, } from './org.js';
-export { validateBuyerIdentity, validateHosting, validateOwner, validateSite } from './org.js';
+export { DEFAULT_MAIL_APPS, validateBuyerIdentity, validateHosting, validateMail, validateOwner, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 export type { RequestableField, CallsChange, StorageLimitChange, AiLimitChange, DomainChange, MailTierChange, RequestedChangeValue, ChangeClassification, RequestedChangeState, RequestedChange, } from './requested-changes.js';
@@ -20,14 +20,18 @@ export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, } from './plan/index.js';
-export { FoundryStepExecutor, NotBuiltError, healthUrls } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
+export { checkMailIdentityAudience } from './plan/index.js';
+export type { MailAllowlistApp } from './plan/index.js';
+export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, } from './plan/index.js';
-export { PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, PLATFORM_AI_MINTER_MISSING, } from './plan/index.js';
+export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './plan/index.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
@@ -37,6 +41,8 @@ export type { CallsSfuSshConnectOptions } from './calls-sfu-ssh-client.js';
 export { UnknownCallsSfuHostKeyError, toCallsSfuHostPort, applyCallsSfuOverSession, } from './calls-sfu-ssh-adapter.js';
 export type { LivekitCredentials } from './calls-sfu-keys.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
+export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './plan/index.js';
+export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
 export type { MigrateSql, MigrationResult } from './migrate.js';
 export { MIGRATIONS_DIR, migrate } from './migrate.js';
 export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { validateBuyerIdentity, validateHosting, validateOwner, validateSite } from './org.js';
+export { DEFAULT_MAIL_APPS, validateBuyerIdentity, validateHosting, validateMail, validateOwner, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
@@ -8,15 +8,18 @@ export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredP
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export { FoundryStepExecutor, NotBuiltError, healthUrls } from './plan/index.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { checkMailIdentityAudience } from './plan/index.js';
+export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, } from './plan/index.js';
-export { PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, PLATFORM_AI_MINTER_MISSING, } from './plan/index.js';
+export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
 export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export { UnknownCallsSfuHostKeyError, toCallsSfuHostPort, applyCallsSfuOverSession, } from './calls-sfu-ssh-adapter.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
+export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
 export { MIGRATIONS_DIR, migrate } from './migrate.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';

package/dist/migrations/0019_mail_owner_mailbox.sql

@@ -0,0 +1,15 @@
+-- @wtfalch/foundry: #162 (decided 2026-09-29) -- the owner's mailbox
+-- address is now declared, not guessed (replacing the hardcoded
+-- `owner@<domain>` PR 163 shipped first), and the org's send-only no-reply
+-- address gets its own configurable local part. Mirrors
+-- `src/store/schema.ts`'s `declaredOrgs` table additions.
+--
+-- owner_mailbox_address is nullable: an org can have mail on with no
+-- address declared yet, and `plan/diff.ts`'s `planMail` reports the
+-- mailbox alone as blocked in that case rather than this column refusing
+-- the row. no_reply_local_part defaults to 'no-reply' so every existing
+-- row keeps today's behaviour unchanged.
+
+alter table foundry_declared_orgs
+  add column if not exists owner_mailbox_address text,
+  add column if not exists no_reply_local_part text not null default 'no-reply';

package/dist/migrations/0020_mail_apps.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: which ZITADEL apps in the org's audience project may
+-- read a person's mail (#34). Mirrors `src/store/schema.ts`'s `mailApps`.
+-- Defaults to 'agora' and 'webmail' so every existing org keeps its current
+-- behaviour.
+
+alter table foundry_declared_orgs
+  add column if not exists mail_apps jsonb not null default '["agora","webmail"]'::jsonb;

package/dist/migrations/0021_mail_role_mailboxes.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: the role mailboxes an org wants pre-created on its mail
+-- domain (#230). Mirrors `src/store/schema.ts`'s `roleMailboxes`. Defaults to
+-- an empty list so every existing org keeps its current behaviour.
+
+alter table foundry_declared_orgs
+  add column if not exists role_mailboxes jsonb not null default '[]'::jsonb;

package/dist/migrations/0022_chat_enabled.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: chat is not in v1 (decided 2026-10-01). Mirrors
+-- `src/store/schema.ts`'s `chatEnabled`. Defaults false, so every existing org
+-- reads as chat off and `apply` leaves any live chat resource alone.
+
+alter table foundry_declared_orgs
+  add column if not exists chat_enabled boolean not null default false;

package/dist/migrations/0023_hosting_app_env.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: the bespoke app's own env var names for values the plan
+-- already mints (Files, AI, mail), each a key `pushAppEnv` resolves (#243).
+-- Mirrors `src/store/schema.ts`'s `hostingAppEnv`. Defaults to an empty
+-- object so every existing org keeps its current behaviour: no app env
+-- pushed from this map.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_app_env jsonb not null default '{}'::jsonb;