@wtfalch/foundry 0.61.0 → 0.63.0

package/dist/plan/diff.js

@@ -1,5 +1,6 @@
-import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, heldEnvRef, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, } from '../org.js';
+import { VERSIONS } from '../bootstrap/versions.js';
+import { NATIVE_BUILD_KEY_ENV } from '../native-build.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, heldEnvRef, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, entryClientIdScopeKey, withRecordedMessagingProject, } from './agora.js';
 import { planAppsDbRoute } from './apps-db-route.js';
@@ -26,6 +27,7 @@ import { gateIdRecordKey, hasWildcardGate, planGates } from './gates.js';
 import { githubSourceResourceKey, planGithubSource } from './github-source.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { planKeysRegistrar } from './keys-registrar.js';
+import { desiredKosmosEnv, kosmosEnvDrift } from './kosmos.js';
 import { APP_GONE_KIND } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, agoraIssuerHostFor, clientOrganizationsState, companyLoginTunnelHost, customersClientOrganizations, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, ownCustomersAppState, pendingRemovalHosts, } from './login-host.js';
@@ -351,7 +353,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     const chat = planChat(org, byKey, claimed, recordedIds, agoraHost, issuer.step !== null);
     if (chat.step)
         plannedSteps.push(chat.step);
-    const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady, versionPin?.calls);
+    const calls = planCalls(org, byKey, claimed);
     if (calls.step)
         plannedSteps.push(calls.step);
     // An own org's media server, before the calls service that reads its addresses.
@@ -567,6 +569,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
         canHoldSecrets: platformReadiness.canHoldSecrets === true,
         accessProviderId: platformReadiness.accessProviderId ?? null,
         ...(options.stageSinkDown ? { stageSinkDown: true } : {}),
+        ...(options.stageGuardPorts ? { stageGuardPorts: options.stageGuardPorts } : {}),
         appPlanned: (entryKey) => plannedSteps.some((p) => p.action.system === 'coolify' &&
             p.action.kind === 'app' &&
             p.action.key === appStepKey(org, entryKey)),
@@ -711,7 +714,16 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     }, customerGrantsShape);
     if (boule.step)
         plannedSteps.push(boule.step);
-    // Boule's and Agora's blue/green: after their own steps, which make the app it copies.
+    // foundry#949: the company's kosmos, only once it turns it on. Its fixed ZITADEL client first, the same
+    // reason Boule's and Agora's do: `coolifyKosmos` reads this step's recorded client id.
+    const kosmosClient = planKosmosClient(org, byKey, claimed);
+    const kosmosGuarded = guardApp(kosmosClient);
+    if (kosmosGuarded)
+        plannedSteps.push(kosmosGuarded);
+    const kosmos = planKosmos(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? []);
+    if (kosmos.step)
+        plannedSteps.push(kosmos.step);
+    // Boule's, Agora's and kosmos's blue/green: after their own steps, which make the app it copies.
     plannedSteps.push(...blueGreen.steps.filter((x) => x.phase === 'last').map(blueGreenDraft()));
     // Boule owners, after the Boule step: needs the app deployed and the seeding secret in its env.
     const bouleOwners = planBouleOwners(org, recordedIds, (byKey.get(resourceKey('coolify', 'boule', org.id))?.config.env ?? null));
@@ -977,6 +989,8 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     if (boule.mailBlocked) {
         unmanaged.push({ description: boule.mailBlocked, key: 'coolify:boule:mail' });
     }
+    if (kosmos.blocked)
+        unmanaged.push({ description: kosmos.blocked, key: 'coolify:kosmos' });
     // Same for an ai key minted but never delivered: planning a new mint would
     // orphan a second live key.
     if (aiKey.blocked)
@@ -1769,8 +1783,8 @@ function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned)
  * actually need it -- CMS's, chat's and calls' entries follow their own
  * on/off switch, the same ones this file already gates their own
  * `coolify:*` steps on (`org.ts`'s `SiteConfig.enabled`, `ChatConfig.enabled`,
- * `CallsConfig.enabled`); Boule's is unconditional, matching `org.ts`'s own
- * "every org gets one" rule; the app schema follows whether any
+ * `CallsConfig.enabled`); kosmos follows its own switch too (`KosmosApp.enabled`, foundry#949); Boule's is
+ * unconditional, matching `org.ts`'s own "every org gets one" rule; the app schema follows whether any
  * `hosting.entries` entry declares `database: true` (`coolifyDatabase`'s own
  * gate) rather than `hosting.enabled` alone, since a hosting org with no
  * database-bearing entry has nothing for this schema to hold.
@@ -1778,6 +1792,8 @@ function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned)
 function orgServiceSchemaEnabled(org, schema) {
     if (schema.schema === 'cms')
         return org.site.enabled;
+    if (schema.schema === 'kosmos')
+        return kosmosOn(org);
     if (schema.schema.startsWith('chat_'))
         return org.chat.enabled;
     if (schema.schema.startsWith('calls_'))
@@ -2197,75 +2213,47 @@ function planChat(org, byKey, claimed, recordedIds, reading, issuerPlanned) {
  * matrix-authentication-service, entirely separate from chat's
  * (`plan/calls-matrix.ts`'s own top doc comment: a call guest must never gain
  * chat membership). Unlike chat, off by default: `org.ts`'s
- * `CallsConfig.enabled` doc comment. Same on/off, park-not-delete shape as
- * {@link planApp}/{@link planDatabase}/{@link planTunnel} below
- * (`planHostingToggle`, #7 corrections 1) -- turning it off parks Synapse and
- * MAS, never either database (`executor.ts`'s `coolifyCalls`).
+ * `CallsConfig.enabled` doc comment.
  *
- * #177: a first-ever provision (no live resource yet) is blocked, not
- * planned, while `platformReadiness.callsReady` is false -- an org's own
- * Matrix stack is wired to the shared calls SFU (#122/#127), so there is
- * nothing for it to authenticate calls against until the platform's own
- * `sfu:livekit` step is declared. Parking, and an already-provisioned stack,
- * are unaffected.
+ * #430: calls run transit-only now (calls#93's `CALLS_ENCRYPTION=transit`),
+ * so the calls service no longer talks to a per-org Matrix stack and this
+ * never provisions a new one, nor re-provisions a parked one -- the live
+ * resource is still claimed, so it is never reported unmanaged. An org
+ * whose stack is already live and enabled is left exactly as it is;
+ * removing it is a separate, human-confirmed step. Turning `calls.enabled`
+ * off still parks an already-live stack unchanged (`executor.ts`'s
+ * `coolifyCalls`, #7 corrections 1): data is retained, not deleted.
  */
-function planCalls(org, byKey, claimed, callsReady, synapseTag) {
+function planCalls(org, byKey, claimed) {
     const key = resourceKey('coolify', 'calls', org.id);
-    if (org.calls.enabled && !byKey.get(key) && !callsReady) {
-        return {
-            step: null,
-            blocked: ownsServices(org)
-                ? `${org.slug}'s calls Matrix stack is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`
-                : `${org.slug}'s calls Matrix stack is blocked, not planned: the platform owner's calls SFU (the platform's) is off`,
-        };
-    }
-    // #248: the two images this stack's own apply would run, checked the same
-    // way the platform's SFU checks LiveKit/cloudflared and ZITADEL checks its
-    // own tag -- a re-apply of the same declaration must not silently run a
-    // different version with no diff shown anywhere.
-    if (org.calls.enabled && !byKey.get(key)) {
-        const synapseBlocked = floatingTagBlocked('Synapse', synapseTag ?? VERSIONS.synapse, 'v1.161.0');
-        if (synapseBlocked) {
-            return {
-                step: null,
-                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${synapseBlocked}`,
-            };
-        }
-        const masBlocked = floatingTagBlocked('matrix-authentication-service', VERSIONS.mas, '1.24.0');
-        if (masBlocked) {
-            return {
-                step: null,
-                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${masBlocked}`,
-            };
-        }
-    }
+    const live = byKey.get(key);
+    if (live)
+        claimed.add(key);
+    const liveEnabled = live !== undefined && live.config.enabled !== false;
+    if (org.calls.enabled && !liveEnabled)
+        return { step: null, blocked: null };
     const toggle = planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`);
-    // A held Synapse tag rides in the provisioning step; a parking step carries none.
-    if (toggle && synapseTag && toggle.action.desired.enabled === true) {
-        toggle.action.desired = { ...toggle.action.desired, synapseTag };
-    }
     return { step: toggle, blocked: null };
 }
 /**
  * The org's own calls service (#145, part 2 of #128) -- `wtfalch/calls`'s
- * `packages/service`, deployed alongside the calls Matrix stack {@link planCalls}
- * provisions and wired to it and to the shared LiveKit SFU (foundry#122/#127).
- * Gated on the same `org.calls.enabled` flag as the Matrix stack, not a flag
- * of its own: a calls service with no Matrix stack behind it has nothing to
- * authenticate a guest against, and a Matrix stack alone answers no browser,
- * so the two are declared as one on/off switch even though they are two
- * planner steps. Same on/off, park-not-delete shape as {@link planCalls}
- * (`planHostingToggle`, #7 corrections 1) -- turning it off parks the app,
- * never its database (`executor.ts`'s `coolifyCallsService`).
+ * `packages/service`, wired to the shared LiveKit SFU (foundry#122/#127).
+ * Same on/off shape as {@link planCalls} (`planHostingToggle`, #7
+ * corrections 1) -- turning it off parks the app, never its database
+ * (`executor.ts`'s `coolifyCallsService`).
  *
- * #177: silently plans nothing (no second blocked message) while the Matrix
- * stack it rides beside is itself blocked on `callsReady` -- {@link planCalls}
- * already reports the platform's shared SFU as missing once.
+ * #430: calls run transit-only (calls#93), so this no longer rides behind
+ * the Matrix stack {@link planCalls} used to provision -- there is none to
+ * ride behind any more -- and reports the shared SFU as missing itself
+ * (#177) rather than relying on `planCalls`'s now-removed report.
  */
 function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlocked, tokenHost) {
     const key = resourceKey('coolify', 'calls-service', org.id);
-    if (org.calls.enabled && !byKey.get(key) && !callsReady) {
-        return { step: null, blocked: null };
+    if (org.calls.enabled && !byKey.get(key) && !callsReady && !ownsServices(org)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls service is blocked, not planned: the platform owner's calls SFU (the platform's) is off`,
+        };
     }
     // An own org's service names its own media server, so it waits for it even when already provisioned.
     if (org.calls.enabled && ownsServices(org) && !callsReady) {
@@ -3081,6 +3069,137 @@ function planBouleClient(org, byKey, claimed) {
         },
     };
 }
+/**
+ * foundry#949: the fixed ZITADEL web client `kosmos`, once the company turns kosmos on. The same shape as
+ * {@link planBouleClient} and {@link planAgoraClient}; `kosmosOn(org)` is false before any client is planned.
+ */
+function planKosmosClient(org, byKey, claimed) {
+    if (!kosmosOn(org))
+        return null;
+    const key = resourceKey('zitadel', 'app', 'kosmos');
+    const live = byKey.get(key);
+    if (live)
+        claimed.add(key);
+    const desired = { appType: 'web' };
+    if (!live) {
+        return {
+            action: { system: 'zitadel', kind: 'app', key: 'kosmos', desired },
+            step: {
+                description: `provision the web ZITADEL app 'kosmos' for ${org.slug}'s kosmos sign-in`,
+                destroys: false,
+                migrates: false,
+            },
+        };
+    }
+    if (live.config.appType === 'web')
+        return null;
+    return {
+        action: {
+            system: 'zitadel',
+            kind: 'app',
+            key: 'kosmos',
+            desired: { ...desired, recreate: true },
+        },
+        step: {
+            description: `recreate ZITADEL app 'kosmos' for ${org.slug} as web (was ${String(live.config.appType)})`,
+            destroys: true,
+            migrates: false,
+        },
+    };
+}
+/**
+ * foundry#949: the org's own kosmos, a per-org singleton keyed by the org id under its own `kosmos` kind, built
+ * from https://github.com/wtfalch/kosmos's root Dockerfile (`executor.ts`'s `coolifyKosmos`), with a database of
+ * its own. Unlike Boule and Agora, kosmos is set up only once the company turns it on (`kosmosOn(org)`); while
+ * it is off, an org that never had it plans nothing, and a live app is parked (stopped, database kept), the
+ * same rule a switched-off service always follows here.
+ *
+ * Once live, a step is planned again whenever the live app's sign-in env lacks a desired key or holds a
+ * different value (`kosmos.ts`'s `desiredKosmosEnv`, the function the executor writes from). The only host
+ * value is the issuer address (the one Agora and Boule sign in at); without it kosmos is blocked, not planned,
+ * so every other step still applies.
+ */
+function planKosmos(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
+    if (!kosmosOn(org)) {
+        // Switched off: park a live app (stop it, keep the database), like CMS and calls. A stopped app is
+        // already parked, so the plan reaches empty.
+        const parked = planHostingToggle('coolify', 'kosmos', false, org, byKey, claimed, () => `provision ${org.slug}'s kosmos`, () => `park ${org.slug}'s kosmos (stops serving; its database is retained, not deleted)`, org.id, (live) => !/^(exited|stopped)/.test(String(live.config.status ?? '')));
+        return { step: parked, blocked: null };
+    }
+    const key = resourceKey('coolify', 'kosmos', org.id);
+    const live = byKey.get(key);
+    if (live)
+        claimed.add(key);
+    // Never truncated: Postgres cuts an identifier at 63 bytes, and a DNS label
+    // over 63 is refused by Coolify and Cloudflare -- the same check `planBoule` makes.
+    const tooLong = [
+        [`${org.slug}-kosmos`, 'the kosmos host label and app name'],
+        [`${org.slug}_kosmos_db_rt`, 'the kosmos database role'],
+    ].filter(([name]) => name.length > 63);
+    if (tooLong.length > 0) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s kosmos is blocked, not planned: ${tooLong.map(([n, what]) => `${what} '${n}' is over 63 characters`).join(', ')}; shorten the slug`,
+        };
+    }
+    if (otherSlugs.includes(`${org.slug}-kosmos`)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s kosmos is blocked, not planned: another declared org has the slug '${org.slug}-kosmos', which is this kosmos's hostname`,
+        };
+    }
+    if (!issuer) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s kosmos is blocked, not planned: the host supplies no issuer`,
+        };
+    }
+    const action = {
+        system: 'coolify',
+        kind: 'kosmos',
+        key: org.id,
+        desired: { issuer },
+    };
+    if (!live) {
+        return {
+            step: {
+                action,
+                step: { description: `provision ${org.slug}'s kosmos`, destroys: false, migrates: false },
+            },
+            blocked: null,
+        };
+    }
+    const liveEnv = (live.config.env ?? {});
+    const { env } = desiredKosmosEnv(org, recordedIds, issuer);
+    const drift = kosmosEnvDrift(env, liveEnv);
+    // Switched back on while the app is still stopped: the step starts it (`coolifyKosmos` starts a stopped app).
+    if (/^(exited|stopped)/.test(String(live.config.status ?? ''))) {
+        return {
+            step: {
+                action,
+                step: {
+                    description: `start ${org.slug}'s kosmos again (it was parked)`,
+                    destroys: false,
+                    migrates: false,
+                },
+            },
+            blocked: null,
+        };
+    }
+    if (drift.length === 0)
+        return { step: null, blocked: null };
+    return {
+        step: {
+            action,
+            step: {
+                description: `update ${org.slug}'s kosmos config (${drift.join(', ')} missing or different)`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
 /**
  * C3: which credentials the org's Boule is given, and why one is not. Archon's credential goes to every
  * Boule the host can mint it for; the customers directory credential only while `customers.enabled`. Each
@@ -3269,6 +3388,8 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         drift.push(BOULE_BRIDGE_SECRET_ENV);
     if (!liveEnv[BOULE_OWNER_SEED_SECRET_ENV])
         drift.push(BOULE_OWNER_SEED_SECRET_ENV);
+    if (!liveEnv[NATIVE_BUILD_KEY_ENV])
+        drift.push(NATIVE_BUILD_KEY_ENV);
     // Secrets written but Boule not restarted since: plan the step so it restarts, minting nothing.
     if (platformOwner && !recordedIds[BOULE_SECRETS_RESTARTED_SCOPE_KEY]) {
         drift.push('restart after the peer password and bridge secret');

package/dist/plan/edge-access.d.ts

@@ -87,9 +87,8 @@ export interface AccessPort {
     }>;
     replaceGateHostnames(gateId: string, hostnames: string[]): Promise<void>;
     /**
-     * Replaces the whole list of people who pass a gate; nothing else about the gate changes. Edge's platform
-     * client has no such call yet, so {@link createEdgeAccess} does not implement it: a host that wants a
-     * workspace's testers to change supplies a port that does (edge's company `gates.setPeople`).
+     * Replaces the whole list of people who pass a gate; nothing else about the gate changes. The edge adapter
+     * implements it with edge's platform `setGatePeople`; a host may supply its own port instead.
      */
     setGatePeople?(gateId: string, emails: string[]): Promise<void>;
     /** Deletes the gate with its application, policy and list; a gate already gone is done. */

package/dist/plan/edge-access.js

@@ -35,6 +35,7 @@ export function createEdgeAccess(client, options = {}) {
         createGate: (input) => retrying(() => client.createGate(input)),
         replaceGateHostnames: (id, input) => retrying(() => client.replaceGateHostnames(id, input)),
         deleteGate: (id) => retrying(() => client.deleteGate(id)),
+        setGatePeople: (id, input) => retrying(() => client.setGatePeople(id, input)),
     };
     const writeSlot = options.writeSlot ?? limiter(EDGE_DNS_WRITE_CONCURRENCY);
     /** app id -> a seen live app with no edge row yet. */
@@ -166,6 +167,13 @@ export function createEdgeAccess(client, options = {}) {
         async replaceGateHostnames(gateId, hostnames) {
             await writeSlot(() => access.replaceGateHostnames(gateId, { hostnames }));
         },
+        ...(typeof client.setGatePeople === 'function'
+            ? {
+                async setGatePeople(gateId, emails) {
+                    await writeSlot(() => access.setGatePeople(gateId, { emails }));
+                },
+            }
+            : {}),
         async readiness() {
             const { authDomain } = await access.readiness();
             return { authDomain };

package/dist/plan/executor.d.ts

@@ -21,7 +21,8 @@ import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor }
 import type { EdgePortName } from './platform-org.js';
 import type { RequestHeaderPort } from './platform-providers.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
-import { type StageProbePort } from './stage-guards.js';
+import { type StageCopyHostConfig } from './stage-copy-host.js';
+import { type ReleasePreviewMembers, type StageProbePort } from './stage-guards.js';
 import type { WorkerAppDatabasePort } from './worker-app-database.js';
 import { type KeysCustodyPort, type WorkerAppPort } from './worker-app.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
@@ -1411,6 +1412,11 @@ export interface FilesOrganisationPort {
      * the list is a no-op.
      */
     ensureAllowedOrigin(organisationId: string, origin: string): Promise<void>;
+    /**
+     * Deletes an organisation with its keys. Optional: used only by org destroy for stage's own organisation
+     * (`<org>-stage`); a port without it leaves that organisation, which destroy then reports as blocked.
+     */
+    deleteOrganisation?(organisationId: string): Promise<void>;
 }
 /**
  * Provisions one org's organisation on AI and switches its AI use on (#80),
@@ -1519,6 +1525,11 @@ export interface AiOrganisationPort {
         keyId: string | null;
         limitMicros: string;
     }): Promise<unknown>;
+    /**
+     * Deletes an organisation with its keys and budget. Optional: used only by org destroy for stage's own
+     * organisation (`<org>-stage`); a port without it leaves that organisation, which destroy then reports as blocked.
+     */
+    deleteOrganisation?(organisationId: string): Promise<void>;
 }
 /**
  * #317 (F7): the edge service's own management API
@@ -1634,6 +1645,11 @@ export interface JobsSchedulerPort {
         secret?: string;
         syncKey?: string;
     }>;
+    /**
+     * Removes a project and its keys (`DELETE /admin/projects/<name>`). Optional: used only by org destroy for
+     * stage's own project (`<org>-stage`); a port without it leaves that project, which destroy then reports as blocked.
+     */
+    deleteProject?(name: string): Promise<void>;
 }
 /**
  * #177: where the org steps' files, AI and jobs ports come from when the host
@@ -1746,6 +1762,18 @@ export interface FoundryStepExecutorPorts {
      * one the probes are reported as not run, and the stage copy stays blocked.
      */
     stageProbes?: StageProbePort;
+    /**
+     * The stage copy (`copy_prod_to_stage`, run by the release tick). The host supplies the dump download and the
+     * backup storage; foundry builds the restore port itself and reads production's address live from Coolify.
+     * Without it a copy request is refused with `no-copy-port`. The host needs `pg_restore` (Postgres 16) on PATH.
+     */
+    stageCopy?: StageCopyHostConfig;
+    /**
+     * Who may open an org's stage gate besides its owners: the people holding `releases:preview` in `orgId`. Read on
+     * each release tick (10 s limit) and when the gate is made; a failed read leaves the gate as it is. Without it
+     * the gate keeps the owners it was made with.
+     */
+    releasePreviewMembers?: ReleasePreviewMembers;
     /**
      * F4.ratelimits: overrides the rate limiting rule calls, which otherwise go through
      * `edge.ratelimits` (see {@link EdgePort.ratelimits}). Kept for a host or a test that supplies its own.
@@ -1966,6 +1994,15 @@ export declare const BOULE_REPO = "wtfalch/boule";
 export declare const BOULE_APP_DOCKERFILE = "/Dockerfile";
 /** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
 export declare const BOULE_PORT = 3000;
+/**
+ * foundry#949: kosmos (https://github.com/wtfalch/kosmos), bootstrapped from the same `wtfalch/package-template`
+ * service shape Boule is, with its own Dockerfile at the repository root, serving on 3000 (`EXPOSE 3000`) and
+ * running its migrations through `apps/host/scripts/migrate.mjs` before it serves, the same shape Boule's
+ * `migrate-and-start.sh` follows.
+ */
+export declare const KOSMOS_REPO = "wtfalch/kosmos";
+export declare const KOSMOS_APP_DOCKERFILE = "/Dockerfile";
+export declare const KOSMOS_PORT = 3000;
 export declare const LOG_DIR = "/app/logs";
 /** The company's Coolify destination (its Docker network `co-<slug>`), recorded when its first resource is created. */
 export declare const COOLIFY_DESTINATION_SCOPE_KEY = "coolify_destination";
@@ -2427,8 +2464,18 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * blue copy is not recorded. The health token is only read here, never minted.
      */
     releaseHost(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /**
+     * The copy's ports for one subject. Production's database is the org's (`coolify:database:<org id>`) for an
+     * entry and Boule's own for Boule; Agora has none, so its copy is refused with `no-production-database`.
+     */
+    private stageCopyFor;
     /** Whether the stage mail sink app is stopped or gone, read live. A failed read throws; the caller reads that as up. */
     stageSinkDown(appId: string): Promise<boolean>;
+    /** Which stage-guard ports this executor has, for the planner (they decide the guard names in the applied hash). */
+    stageGuardPorts(): {
+        probes: boolean;
+        access: boolean;
+    };
     /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
     blueGreenServers(): Promise<BlueGreenServer[]>;
     /**
@@ -2496,6 +2543,25 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * bypass or service-token rule there would open stage, so no gate is made and the guard stays unrecorded.
      */
     private stageGuards;
+    /**
+     * One release tick for one subject: its recorded stage gate's list follows the people holding
+     * `releases:preview`, owners always staying (`syncStageGateMembers`). Never throws.
+     */
+    syncStageGateMembers(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext): Promise<void>;
+    /**
+     * Stage's own files organisation, ai organisation and jobs project (`plan/stage-services.ts`), each named
+     * for its subject (`<org id>-stage-<subject id>`, `<slug>-stage-<subject id>`: one per subject, as the recorded keys are) and built from the same ports production's steps use. A service whose port is
+     * missing or not ready answers `available() === false`, and stage then records it absent and mints nothing.
+     */
+    private stageServicesPort;
+    /**
+     * Stage's own sign-in (`plan/stage-signin.ts`): a client named `<production client>-stage` on production's
+     * sign-in organisation and project with redirect URIs on the stage host only, a broker entry
+     * `<production entry>-stage` with a key of its own, and that key's held ref. `{ required: false }` for an entry
+     * that does not sign in. `undefined`, with one fixed log line saying why, when something it needs is missing:
+     * the guard then stays unrecorded and the copy waits. Platform-archon is not covered yet.
+     */
+    private stageSignInPort;
     private coolifyApp;
     /**
      * #75: mounts a persistent volume at {@link LOG_DIR} on the app, unless one
@@ -2702,7 +2768,20 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private ensurePeerPassword;
     /** Same rule for the secret Archon's invite form sends to Boule. */
     private ensureBridgeSecret;
+    /**
+     * `minLength`, when given, also counts a present-but-empty value as not set -- the same guard
+     * {@link ensureAuthAppKey} already applies for `AUTH_APP_KEY`, now reusable here instead of a
+     * third, bare copy of this check (foundry#970, thermo note 1 in #957). Omitted, the three existing
+     * callers below keep their original behaviour.
+     */
     private mintIfAbsent;
+    /**
+     * Every company's Boule, F3/#970: `NATIVE_BUILD_KEY` is what Boule presents to Archon's
+     * native-build route (estate#262) to ask it to dispatch `build-app.yml`. Minted once, like
+     * {@link ensureAuthAppKey}, and never rotated; a present-but-empty value (the bug
+     * `mintNativeBuildKey`'s own read-then-generate had, see #957) is treated as not set.
+     */
+    private ensureNativeBuildKey;
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
      * only the first time (task brief), never regenerated or overwritten, so a
@@ -3145,16 +3224,18 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private coolifyChatRekey;
     /**
      * `plan/diff.ts`'s `planCallsService`: the org's own calls service --
-     * `wtfalch/calls`'s `packages/service`, wired to the calls Matrix stack
-     * {@link coolifyCalls} provisions and the shared LiveKit SFU (#122/#127).
-     * Static config checks run first, before any Coolify call (#128's own
-     * carried-over PR 344 review fix, restated in #145's own issue body): the
-     * calls Matrix stack must already be recorded, its MAS app must already
-     * carry its client id/secret, and the shared SFU's LiveKit credentials must
-     * already be resolvable -- none of the three is minted or guessed here.
-     * Park stops the app only, the same park-not-delete rule
-     * {@link coolifyCalls}/{@link coolifyApp} already follow (#7 corrections
-     * 1); its own database is never touched from that branch.
+     * `wtfalch/calls`'s `packages/service`, wired to the shared LiveKit SFU
+     * (#122/#127). #430: calls run transit-only (calls#93's
+     * `CALLS_ENCRYPTION=transit`), so this no longer waits on or wires a
+     * per-org Matrix stack at all -- an org whose stack is already live from
+     * before this keeps running it, unused, until a human removes it
+     * separately. Static config checks run first, before any Coolify call
+     * (#128's own carried-over PR 344 review fix, restated in #145's own
+     * issue body): the shared SFU's LiveKit credentials must already be
+     * resolvable -- not minted or guessed here. Park stops the app only, the
+     * same park-not-delete rule {@link coolifyCalls}/{@link coolifyApp}
+     * already follow (#7 corrections 1); its own database is never touched
+     * from that branch.
      */
     private coolifyCallsService;
     /**
@@ -3187,14 +3268,6 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * env and mints nothing.
      */
     private callsTokenEnvs;
-    /**
-     * Reads back the calls Matrix stack's MAS client id/secret from the MAS
-     * app's own envs ({@link CALLS_SECRET_ENV_KEYS}) -- never mints: minting
-     * either is {@link ensureCallsMatrixSecrets}'s own job, and a missing value
-     * here means that stack has not finished provisioning yet, not something
-     * this step can fix on its own.
-     */
-    private readCallsMasClientCredentials;
     /**
      * `null` once the calls service app already has a `CALLS_BINDING_SECRET` --
      * never rotated, the same rule {@link ensureAuthCookieSecret} follows for
@@ -3327,6 +3400,25 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * shape {@link coolifyAgora}'s own doc comment explains.
      */
     private coolifyBoule;
+    /**
+     * `plan/diff.ts`'s `planKosmos`: provisions the org's own kosmos
+     * (https://github.com/wtfalch/kosmos) as one more Coolify application, from
+     * that repo's root Dockerfile ({@link KOSMOS_REPO}), with a database of its
+     * own, and pushes its sign-in env. The same shape as {@link coolifyBoule},
+     * trimmed: kosmos is opt-in (`kosmosOn(org)` guards every caller, so this is
+     * never reached while it is off), has no mail, no owner seeding and no
+     * Archon credential.
+     *
+     * The sign-in env comes from `plan/kosmos.ts`'s `desiredKosmosEnv`, the same
+     * function the plan compares the live app against; it never writes a
+     * partial set. The database is `<slug>-kosmos-db`, split the same way
+     * Boule's is: the superuser URL as `DATABASE_URL_OWNER` and a `<dbName>_rt`
+     * role's URL as `DATABASE_URL`, both through `pushDatabaseUrl`.
+     *
+     * #504 (same reason {@link coolifyBoule}'s own comment gives): a brand new
+     * app is never restarted, but it is deployed once ({@link KOSMOS_DEPLOYED_SCOPE_KEY}).
+     */
+    private coolifyKosmos;
     /**
      * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
      * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is