@wtfalch/foundry 0.15.0 → 0.16.1

package/dist/plan/hostnames.d.ts

@@ -6,18 +6,31 @@ import type { DeclaredOrg, HostingEntry } from '../org.js';
  * acted on elsewhere.
  */
 export declare function entryHostnames(org: DeclaredOrg, entry: HostingEntry): string[];
+/**
+ * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
+ * Like `entryHostnames`, it is read only while hosting is on, `usesDomain` is
+ * on and the org has a domain.
+ */
+export declare function wildcardHostname(org: DeclaredOrg): string | null;
 /**
  * The one primary name of the org's app: its first, or the name the app was
  * served at before entries had hostnames. `APP_URL`, the ZITADEL redirect URI
  * and the jobs registration read it.
  */
 export declare function appHostname(org: DeclaredOrg): string;
+/**
+ * Coolify's `domains` field: comma-separated full URLs. A bare hostname is a
+ * 422 ("Invalid URL"), so every write names each host as `https://<host>`.
+ * Foundry's own records and proxy labels keep the bare names.
+ */
+export declare function coolifyDomains(names: readonly string[]): string;
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export declare function legacyAppHostname(org: DeclaredOrg): string;
 /**
  * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
  * #164): a site's two names, every entry's names, an own-domain calls name and
- * Agora's. An org that does not host keeps the single name it always had.
+ * Agora's, then the wildcard last. An org that does not host keeps the single
+ * name it always had.
  */
 export declare function tunnelIngressHostnames(org: DeclaredOrg): string[];
 /** The ingress names that get a DNS record: those under the org's own domain. */

package/dist/plan/hostnames.js

@@ -13,6 +13,17 @@ export function entryHostnames(org, entry) {
     }
     return entry.hostnames.flatMap((name) => name === '*' ? [] : name === '@' ? [domain] : [`${name}.${domain}`]);
 }
+/**
+ * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
+ * Like `entryHostnames`, it is read only while hosting is on, `usesDomain` is
+ * on and the org has a domain.
+ */
+export function wildcardHostname(org) {
+    const { domain } = org;
+    if (!org.hosting.enabled || !org.hosting.usesDomain || !domain)
+        return null;
+    return org.hosting.entries.some((entry) => entry.hostnames.includes('*')) ? `*.${domain}` : null;
+}
 /**
  * The one primary name of the org's app: its first, or the name the app was
  * served at before entries had hostnames. `APP_URL`, the ZITADEL redirect URI
@@ -23,6 +34,14 @@ export function appHostname(org) {
     const first = entry ? entryHostnames(org, entry)[0] : undefined;
     return first ?? legacyAppHostname(org);
 }
+/**
+ * Coolify's `domains` field: comma-separated full URLs. A bare hostname is a
+ * 422 ("Invalid URL"), so every write names each host as `https://<host>`.
+ * Foundry's own records and proxy labels keep the bare names.
+ */
+export function coolifyDomains(names) {
+    return names.map((name) => `https://${name}`).join(',');
+}
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export function legacyAppHostname(org) {
     return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
@@ -30,7 +49,8 @@ export function legacyAppHostname(org) {
 /**
  * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
  * #164): a site's two names, every entry's names, an own-domain calls name and
- * Agora's. An org that does not host keeps the single name it always had.
+ * Agora's, then the wildcard last. An org that does not host keeps the single
+ * name it always had.
  */
 export function tunnelIngressHostnames(org) {
     const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [];
@@ -48,6 +68,11 @@ export function tunnelIngressHostnames(org) {
     if (org.domain) {
         hostnames.push(agoraHostnameFor(org));
     }
+    // The wildcard goes last: Cloudflare takes the first ingress rule that
+    // matches, so every exact name above must come before `*.<domain>`.
+    const wildcard = wildcardHostname(org);
+    if (wildcard)
+        hostnames.push(wildcard);
     return [...new Set(hostnames)];
 }
 /** The ingress names that get a DNS record: those under the org's own domain. */

package/dist/plan/index.d.ts

@@ -17,6 +17,7 @@ export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEME
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
+export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';

package/dist/plan/index.js

@@ -9,6 +9,7 @@ export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, Provide
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
+export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';

package/dist/plan/plan-apply.d.ts

@@ -120,6 +120,8 @@ export interface StepExecutionContext {
      * run, plus whatever a previous apply already persisted.
      */
     recordedIds(): Readonly<Record<string, string>>;
+    /** The clock the plan was made with, in ms; the same one `computePlanDetail` read. Absent: `Date.now()`. */
+    now?(): number;
     /**
      * Records a provider *scope* id — `coolify_project`, `zitadel_org`,
      * `zitadel_project`, `cloudflare_zone` — alongside whatever `system:kind:key`

package/dist/plan/plan-apply.js

@@ -4,6 +4,8 @@ import { validateHosting } from '../org.js';
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
+import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
+import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
@@ -292,6 +294,7 @@ export class FoundryPlanApply {
         const context = {
             org,
             recordedIds: () => ({ ...serviceIds }),
+            now: () => this.now().getTime(),
             recordScopeId: (key, id) => {
                 serviceIds[key] = id;
             },
@@ -368,7 +371,11 @@ export class FoundryPlanApply {
             this.orgPlatformReadiness(),
             this.orgAgoraHost(id),
         ]);
-        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, { loginHostBindings: this.loginHostBindings, broker: this.broker });
+        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
+            loginHostBindings: this.loginHostBindings,
+            broker: this.broker,
+            now: () => this.now().getTime(),
+        });
         const invalid = await this.invalidHosting(org);
         if (invalid) {
             // Rule 2: reported in `unmanaged`, not thrown. Steps that read the
@@ -599,12 +606,20 @@ function destroyTargets(serviceIds) {
         'coolify:database:',
         'coolify:app:',
         'zitadel:customers:',
+        // F6a: an entry's ai key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
+        'ai:key:',
+        // F6b: an entry's files key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
+        'files:key:',
     ];
     const targets = [];
     for (const prefix of ORDERED_PREFIXES) {
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix))
                 continue;
+            if (prefix === 'ai:key:' && !resourceKey.slice(prefix.length).includes(':'))
+                continue;
+            if (prefix === 'files:key:' && !resourceKey.slice(prefix.length).includes(':'))
+                continue;
             const [system, kind] = prefix.split(':');
             targets.push({ system, kind, key: resourceKey.slice(prefix.length), id });
         }
@@ -642,7 +657,7 @@ function destroyServiceIdKey(target) {
  */
 const STEP_FIELDS = {
     'zitadel:issuer': 'issuer.usesDomain',
-    'zitadel:owner': 'owner',
+    'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
     'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
@@ -661,6 +676,13 @@ const STEP_FIELDS = {
     'cloudflare:ratelimit': 'hosting.usesDomain',
 };
 function stepField(action) {
+    // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.
+    if (action.system === 'ai' && action.kind === 'key' && action.key.includes(':')) {
+        return 'hosting.entries.uses.ai';
+    }
+    // The org's own files key (F6b) is keyed `<orgId>`, an entry's `<orgId>:<entry>`.
+    if (action.system === 'files' && action.kind === 'key')
+        return 'hosting.entries.uses.files';
     // An org declares several issuer apps, each keyed by its name (#71).
     if (action.system === 'zitadel' && action.kind === 'app') {
         return `hosting.issuerApps.${action.key}`;
@@ -691,6 +713,24 @@ function failedFields(org, detail, completed, serviceIds) {
     // as converged with no working key.
     if (serviceIds[AI_KEY_UNDELIVERED_SCOPE_KEY] && !serviceIds[`ai:key:${org.id}`])
         failed.add('ai');
+    // The same for an entry's ai key (F6a): minted, never delivered, so no step is planned.
+    for (const entry of org.hosting.entries) {
+        if (entry.uses?.ai && serviceIds[entryAiUndeliveredScopeKey(entry.key)]) {
+            failed.add('hosting.entries.uses.ai');
+        }
+    }
+    // The same for the org's files key and an entry's (F6b): minted, never delivered, so no step is planned.
+    if (org.hosting.entries.some((e) => e.uses?.files)) {
+        if (serviceIds[FILES_ROOT_UNDELIVERED_SCOPE_KEY] &&
+            serviceIds[FILES_ROOT_UNDELIVERED_SCOPE_KEY] !== serviceIds[`files:key:${org.id}`]) {
+            failed.add('hosting.entries.uses.files');
+        }
+        for (const entry of org.hosting.entries) {
+            if (entry.uses?.files && serviceIds[entryFilesUndeliveredScopeKey(entry.key)]) {
+                failed.add('hosting.entries.uses.files');
+            }
+        }
+    }
     // The same for a jobs registration whose credentials never reached the host.
     if (serviceIds[JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY] &&
         !serviceIds[`jobs:registration:${org.id}`]) {

package/dist/plan/platform-org.d.ts

@@ -32,8 +32,18 @@ export interface OrgPlatformReadiness {
     } | null;
     /** The files host (#171). Files is always on for every org (#80), so `false` always blocks rather than only mattering when a flag is set. */
     filesReady: boolean;
+    /**
+     * The files host's internal address, which an entry with `uses.files` gets
+     * as `FILES_URL`. `null` or absent until the platform has recorded it.
+     */
+    filesUrl?: string | null;
     /** The AI host (#172), the same always-on shape as {@link filesReady}. */
     aiReady: boolean;
+    /**
+     * The AI host's internal address, which an entry with `uses.ai` gets as
+     * `AI_URL`. `null` or absent until the platform has recorded it.
+     */
+    aiUrl?: string | null;
     /**
      * The shared calls SFU (#170) an org's own calls Matrix stack depends on.
      * Declared is enough here: unlike the others, `platform-diff.ts`'s
@@ -110,11 +120,13 @@ noKeyReader?: boolean): OrgPlatformReadiness;
  * than requiring a bespoke host-supplied `AgoraHostPort` for values the
  * platform already knows -- the `issuer`/`mailUpstream`/`filesUpstream`
  * addresses `agora.ts`'s own doc comment named this issue as the source of.
- * `mailProjectId`/`messagingProjectId` still have no live source (chat has no
- * admin API yet, https://github.com/wtfalch/chat/issues/40, and mail's own
- * OIDC directory does not surface a project id), so a platform-derived Agora
- * stays blocked on those two until something records them -- this only stops
- * pretending the other three are unavailable once the platform actually
+ * `mailProjectId` is the `mail` ZITADEL project `provisionPlatformMail` finds
+ * or creates and records under `PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY`; it
+ * is read once mail is enabled and applied (the same gate as `mailUpstream`),
+ * and null before that. `messagingProjectId` is not read from the
+ * platform: `agora.ts`'s `withRecordedMessagingProject` fills it from
+ * the project each org's chat step creates -- this only stops
+ * pretending the other values are unavailable once the platform actually
  * supplies them. `plan-apply.ts`'s `FoundryPlanApply` calls this only when no
  * host-supplied `agora` port overrides it.
  */

package/dist/plan/platform-org.js

@@ -1,4 +1,4 @@
-import { JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, platformMailMxHost, } from './platform-diff.js';
+import { JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
 /**
  * What an org's plan reads when no platform is declared: nothing is ready, so
@@ -76,7 +76,11 @@ noKeyReader = false) {
             ? { apex: platform.apex, mailHost: platformMailMxHost(platform.apex) }
             : null,
         filesReady: filesApplied && missingKeys.files === null,
+        filesUrl: filesApplied
+            ? (platformRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] ?? null)
+            : null,
         aiReady: aiApplied && missingKeys.ai === null,
+        aiUrl: aiApplied ? (platformRecordedIds[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY] ?? null) : null,
         callsReady: platform.sfu.enabled,
         authReady: platform.auth.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY),
         jobsReady: jobsApplied && missingKeys.jobs === null,
@@ -89,11 +93,13 @@ noKeyReader = false) {
  * than requiring a bespoke host-supplied `AgoraHostPort` for values the
  * platform already knows -- the `issuer`/`mailUpstream`/`filesUpstream`
  * addresses `agora.ts`'s own doc comment named this issue as the source of.
- * `mailProjectId`/`messagingProjectId` still have no live source (chat has no
- * admin API yet, https://github.com/wtfalch/chat/issues/40, and mail's own
- * OIDC directory does not surface a project id), so a platform-derived Agora
- * stays blocked on those two until something records them -- this only stops
- * pretending the other three are unavailable once the platform actually
+ * `mailProjectId` is the `mail` ZITADEL project `provisionPlatformMail` finds
+ * or creates and records under `PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY`; it
+ * is read once mail is enabled and applied (the same gate as `mailUpstream`),
+ * and null before that. `messagingProjectId` is not read from the
+ * platform: `agora.ts`'s `withRecordedMessagingProject` fills it from
+ * the project each org's chat step creates -- this only stops
+ * pretending the other values are unavailable once the platform actually
  * supplies them. `plan-apply.ts`'s `FoundryPlanApply` calls this only when no
  * host-supplied `agora` port overrides it.
  */
@@ -103,7 +109,9 @@ export function agoraHostValuesFromPlatform(platform, platformRecordedIds) {
     const filesReady = platform.files.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_FILES_KEY);
     return {
         issuer: authReady ? `https://${platform.auth.hostname}` : null,
-        mailProjectId: null,
+        mailProjectId: mailReady
+            ? (platformRecordedIds[PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY] ?? null)
+            : null,
         messagingProjectId: null,
         mailUpstream: mailReady
             ? (platformRecordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] ?? null)

package/dist/plan/platform-providers.js

@@ -5,6 +5,7 @@ import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { ACCESS_POLICY_NAME, isNotFoundError, isRunningOrStarting } from './executor.js';
+import { coolifyDomains } from './hostnames.js';
 import { JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
@@ -424,7 +425,7 @@ export class FoundryPlatformStepExecutor {
                 git_branch: gitRef,
                 build_pack: 'dockerfile',
                 name: JOBS_SCHEDULER_KEY,
-                domains: hostname,
+                domains: coolifyDomains([hostname]),
             });
             appId = created.uuid;
         }
@@ -4369,7 +4370,7 @@ async function provisionPlatformIntegrations(action, context, deps) {
     };
     const migrateApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_MIGRATE_APP.name, environment, createApp(INTEGRATIONS_MIGRATE_APP.name));
     await record(INTEGRATIONS_MIGRATE_APP_SCOPE_KEY, migrateApp.appId);
-    const runnerApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_RUNNER_APP.name, environment, createApp(INTEGRATIONS_RUNNER_APP.name, hostname));
+    const runnerApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_RUNNER_APP.name, environment, createApp(INTEGRATIONS_RUNNER_APP.name, coolifyDomains([hostname])));
     await record(INTEGRATIONS_RUNNER_APP_SCOPE_KEY, runnerApp.appId);
     const workerApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_WORKER_APP.name, environment, createApp(INTEGRATIONS_WORKER_APP.name));
     await record(INTEGRATIONS_WORKER_APP_SCOPE_KEY, workerApp.appId);
@@ -4387,7 +4388,7 @@ async function provisionPlatformIntegrations(action, context, deps) {
         dockerfile_target_build: INTEGRATIONS_RUNNER_APP.target,
         ports_exposes: INTEGRATIONS_RUNNER_PORT,
         git_branch: gitRef,
-        domains: hostname,
+        domains: coolifyDomains([hostname]),
     });
     await coolify.updateApplication(workerApp.appId, {
         dockerfile_target_build: INTEGRATIONS_WORKER_APP.target,

package/dist/plan/proxy-labels.d.ts

@@ -0,0 +1,42 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+/**
+ * What an entry's Traefik label set is built from. `wildcardDomain` is the
+ * org's domain when the entry declares `'*'`, else `null`.
+ */
+export interface EntryLabelSpec {
+    names: string[];
+    wildcardDomain: string | null;
+    port: number;
+}
+/**
+ * The scope key holding the hash of the label set last patched onto an
+ * entry's app. Present only for an entry that has had a custom label set.
+ */
+export declare function appLabelsAppliedScopeKey(entryKey: string): string;
+/**
+ * The label set an entry's app needs, or `null` when it needs none. Coolify
+ * replaces the labels it generates from `domains` once `custom_labels` is
+ * set, so an entry with `'*'` carries its exact `Host` rules as well. An entry
+ * that already has a custom set (`hadLabels`) keeps one, without the wildcard
+ * rule, so a removed `'*'` stops matching and a later name change still
+ * reaches the app: an empty `custom_labels` is refused by Coolify's API.
+ * Coolify's default port for an app is 80.
+ */
+export declare function entryLabelSpec(org: DeclaredOrg, entry: HostingEntry, hadLabels: boolean): EntryLabelSpec | null;
+/** A short digest of the spec; the same spec always gives the same hash. */
+export declare function entryLabelHash(spec: EntryLabelSpec): string;
+/**
+ * The Traefik labels for an entry's app, one per line. Coolify reaches an app
+ * through its http entrypoint here (the tunnel dials `coolify-proxy:80`), so
+ * each name gets the same http router Coolify generates for a plain domain:
+ * `Host(name) && PathPrefix(/)`, default priority. The wildcard is one
+ * `HostRegexp` router at `priority=1`, so any exact name, this app's or
+ * another's, wins over it. The regex matches one label (`[a-z0-9-]+`), the
+ * same depth Cloudflare's Universal certificate covers.
+ */
+export declare function entryProxyLabels(appUuid: string, spec: EntryLabelSpec): string;
+/**
+ * Whether two label sets hold the same labels. Order and the `coolify.*`
+ * lines Coolify adds and strips itself do not count.
+ */
+export declare function sameLabelSets(a: string, b: string): boolean;

package/dist/plan/proxy-labels.js

@@ -0,0 +1,73 @@
+import { createHash } from 'node:crypto';
+import { entryHostnames, wildcardHostname } from './hostnames.js';
+/**
+ * The scope key holding the hash of the label set last patched onto an
+ * entry's app. Present only for an entry that has had a custom label set.
+ */
+export function appLabelsAppliedScopeKey(entryKey) {
+    return `app_labels_applied.${entryKey}`;
+}
+/**
+ * The label set an entry's app needs, or `null` when it needs none. Coolify
+ * replaces the labels it generates from `domains` once `custom_labels` is
+ * set, so an entry with `'*'` carries its exact `Host` rules as well. An entry
+ * that already has a custom set (`hadLabels`) keeps one, without the wildcard
+ * rule, so a removed `'*'` stops matching and a later name change still
+ * reaches the app: an empty `custom_labels` is refused by Coolify's API.
+ * Coolify's default port for an app is 80.
+ */
+export function entryLabelSpec(org, entry, hadLabels) {
+    const wildcard = entry.hostnames.includes('*') ? wildcardHostname(org) : null;
+    if (!wildcard && !hadLabels)
+        return null;
+    return {
+        names: entryHostnames(org, entry),
+        wildcardDomain: wildcard ? wildcard.slice(2) : null,
+        port: entry.buildPack === 'static' ? 80 : (entry.port ?? 80),
+    };
+}
+/** A short digest of the spec; the same spec always gives the same hash. */
+export function entryLabelHash(spec) {
+    return createHash('sha256').update(JSON.stringify(spec)).digest('hex').slice(0, 16);
+}
+/**
+ * The Traefik labels for an entry's app, one per line. Coolify reaches an app
+ * through its http entrypoint here (the tunnel dials `coolify-proxy:80`), so
+ * each name gets the same http router Coolify generates for a plain domain:
+ * `Host(name) && PathPrefix(/)`, default priority. The wildcard is one
+ * `HostRegexp` router at `priority=1`, so any exact name, this app's or
+ * another's, wins over it. The regex matches one label (`[a-z0-9-]+`), the
+ * same depth Cloudflare's Universal certificate covers.
+ */
+export function entryProxyLabels(appUuid, spec) {
+    const labels = [];
+    const route = (id, rule, priority) => {
+        const router = `traefik.http.routers.${id}`;
+        labels.push(`${router}.rule=${rule}`, `${router}.entryPoints=http`, `${router}.service=${id}`, `${router}.middlewares=gzip`, `traefik.http.services.${id}.loadbalancer.server.port=${spec.port}`);
+        if (priority !== undefined)
+            labels.push(`${router}.priority=${priority}`);
+    };
+    spec.names.forEach((name, i) => {
+        route(`http-${i}-${appUuid}`, `Host(\`${name}\`) && PathPrefix(\`/\`)`);
+    });
+    if (spec.wildcardDomain) {
+        const domain = spec.wildcardDomain.replace(/\./g, '[.]');
+        route(`http-wildcard-${appUuid}`, `HostRegexp(\`^[a-z0-9-]+[.]${domain}$\`)`, 1);
+    }
+    if (labels.length === 0)
+        return 'traefik.enable=false';
+    labels.push('traefik.enable=true', 'traefik.http.middlewares.gzip.compress=true');
+    return labels.sort().join('\n');
+}
+/**
+ * Whether two label sets hold the same labels. Order and the `coolify.*`
+ * lines Coolify adds and strips itself do not count.
+ */
+export function sameLabelSets(a, b) {
+    const lines = (set) => set
+        .split(/\r\n|\n|\r/)
+        .filter((line) => line !== '' && !line.startsWith('coolify.'))
+        .sort()
+        .join('\n');
+    return lines(a) === lines(b);
+}

package/dist/plan/zitadel-machine-user.d.ts

@@ -49,7 +49,11 @@ import type { ZitadelPort } from './executor.js';
  */
 export declare class ZitadelHttpError extends Error {
     readonly status: number;
-    constructor(status: number, message: string);
+    /** ZITADEL's own gRPC-style error code from the body (6 is AlreadyExists), when it sent one. */
+    readonly code?: number | undefined;
+    constructor(status: number, message: string, 
+    /** ZITADEL's own gRPC-style error code from the body (6 is AlreadyExists), when it sent one. */
+    code?: number | undefined);
 }
 /**
  * #216: thrown by {@link createZitadelAdminMinter}'s `mintLoginClientMachineUser`

package/dist/plan/zitadel-machine-user.js

@@ -48,9 +48,13 @@
  */
 export class ZitadelHttpError extends Error {
     status;
-    constructor(status, message) {
+    code;
+    constructor(status, message, 
+    /** ZITADEL's own gRPC-style error code from the body (6 is AlreadyExists), when it sent one. */
+    code) {
         super(message);
         this.status = status;
+        this.code = code;
         this.name = 'ZitadelHttpError';
     }
 }

package/dist/plan/zitadel-project-roles.d.ts

@@ -0,0 +1,25 @@
+import type { ZitadelPort } from './executor.js';
+export interface ZitadelProjectRolesOptions {
+    /** The ZITADEL instance's base URL. */
+    url: string;
+    /** Bearer token allowed to manage projects and user grants. */
+    token: string;
+    fetchImpl?: typeof fetch;
+    instanceHost?: string;
+}
+/**
+ * The real {@link ZitadelPort.ensureProjectRole} and
+ * {@link ZitadelPort.grantProjectRoles}. `@wtfalch/providers` has no
+ * project-role API, so this speaks ZITADEL's v1 management API directly, with
+ * the request shape `createZitadelAdminMinter` uses. The calls follow
+ * ZITADEL's published API reference and have not been run against a live
+ * instance.
+ *
+ *  1. `POST /management/v1/projects/{id}/roles` adds the role; a 409 means it
+ *     exists already.
+ *  2. `POST /management/v1/users/grants/_search` finds the user's grant on the
+ *     project; `PUT /management/v1/users/{id}/grants/{grantId}` adds the
+ *     missing roles to it, or `POST /management/v1/users/{id}/grants` creates
+ *     the grant.
+ */
+export declare function createZitadelProjectRoles(options: ZitadelProjectRolesOptions): Pick<ZitadelPort, 'ensureProjectRole' | 'grantProjectRoles'>;

package/dist/plan/zitadel-project-roles.js

@@ -0,0 +1,104 @@
+import { ZitadelHttpError } from './zitadel-machine-user.js';
+/**
+ * The real {@link ZitadelPort.ensureProjectRole} and
+ * {@link ZitadelPort.grantProjectRoles}. `@wtfalch/providers` has no
+ * project-role API, so this speaks ZITADEL's v1 management API directly, with
+ * the request shape `createZitadelAdminMinter` uses. The calls follow
+ * ZITADEL's published API reference and have not been run against a live
+ * instance.
+ *
+ *  1. `POST /management/v1/projects/{id}/roles` adds the role; a 409 means it
+ *     exists already.
+ *  2. `POST /management/v1/users/grants/_search` finds the user's grant on the
+ *     project; `PUT /management/v1/users/{id}/grants/{grantId}` adds the
+ *     missing roles to it, or `POST /management/v1/users/{id}/grants` creates
+ *     the grant.
+ */
+export function createZitadelProjectRoles(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    async function call(method, path, orgId, body) {
+        const response = await fetchImpl(`${options.url}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${options.token}`,
+                'content-type': 'application/json',
+                'x-zitadel-orgid': orgId,
+                ...(options.instanceHost
+                    ? {
+                        'x-zitadel-instance-host': options.instanceHost,
+                        'x-forwarded-host': options.instanceHost,
+                        'x-forwarded-proto': 'https',
+                    }
+                    : {}),
+            },
+            body: JSON.stringify(body),
+        });
+        const text = await response.text();
+        let data = {};
+        try {
+            data = text ? JSON.parse(text) : {};
+        }
+        catch {
+            throw new ZitadelHttpError(response.status, `non-JSON response from ${path}`);
+        }
+        if (!response.ok) {
+            throw new ZitadelHttpError(response.status, String(data.message ?? response.statusText), typeof data.code === 'number' ? data.code : undefined);
+        }
+        return data;
+    }
+    return {
+        async ensureProjectRole(orgId, projectId, role) {
+            try {
+                await call('POST', `/management/v1/projects/${projectId}/roles`, orgId, {
+                    roleKey: role.key,
+                    displayName: role.displayName,
+                });
+                return { created: true };
+            }
+            catch (e) {
+                // Only AlreadyExists (gRPC code 6, or its name in the message) means the
+                // role is there; any other 409 is a real failure.
+                if (e instanceof ZitadelHttpError &&
+                    e.status === 409 &&
+                    (e.code === 6 || /already.?exists/i.test(e.message))) {
+                    return { created: false };
+                }
+                throw e;
+            }
+        },
+        async grantProjectRoles(orgId, userId, projectId, roleKeys) {
+            // This project's own grant for this user: not one inherited through a
+            // project grant from another org. Paged, so a user with many grants
+            // cannot hide it.
+            const pageSize = 100;
+            let existing;
+            for (let offset = 0; !existing; offset += pageSize) {
+                const found = await call('POST', '/management/v1/users/grants/_search', orgId, {
+                    query: { offset: String(offset), limit: pageSize },
+                    queries: [{ userIdQuery: { userId } }, { projectIdQuery: { projectId } }],
+                });
+                const page = found.result ?? [];
+                existing = page.find((g) => (g.userId === undefined || g.userId === userId) &&
+                    (g.projectId === undefined || g.projectId === projectId) &&
+                    !g.projectGrantId);
+                if (page.length < pageSize)
+                    break;
+            }
+            if (!existing) {
+                await call('POST', `/management/v1/users/${userId}/grants`, orgId, {
+                    projectId,
+                    roleKeys,
+                });
+                return { changed: true };
+            }
+            const held = existing.roleKeys ?? [];
+            const missing = roleKeys.filter((k) => !held.includes(k));
+            if (missing.length === 0)
+                return { changed: false };
+            await call('PUT', `/management/v1/users/${userId}/grants/${existing.id}`, orgId, {
+                roleKeys: [...held, ...missing],
+            });
+            return { changed: true };
+        },
+    };
+}