@wtfalch/foundry 0.16.0 → 0.16.2

package/dist/plan/chat-matrix.d.ts

@@ -26,9 +26,9 @@ export declare const mintChatMatrixSecrets: typeof mintCallsMatrixSecrets;
 /** The chat repo: the Synapse module and the chat service are both built from it. */
 export declare const CHAT_REPO = "wtfalch/chat";
 /** Synapse plus the `wtfalch_chat_gate` module; built from the repo root. */
-export declare const CHAT_SYNAPSE_DOCKERFILE = "apps/chat-service/synapse-module/Dockerfile";
+export declare const CHAT_SYNAPSE_DOCKERFILE = "/apps/chat-service/synapse-module/Dockerfile";
 /** The chat service, built from the repo root (that Dockerfile's own top comment). */
-export declare const CHAT_SERVICE_DOCKERFILE = "apps/chat-service/Dockerfile";
+export declare const CHAT_SERVICE_DOCKERFILE = "/apps/chat-service/Dockerfile";
 export declare const CHAT_SYNAPSE_PORT = "8008";
 export declare const CHAT_MAS_PORT = "8080";
 export declare const CHAT_SERVICE_PORT = "8080";

package/dist/plan/chat-matrix.js

@@ -3,9 +3,9 @@ export const mintChatMatrixSecrets = mintCallsMatrixSecrets;
 /** The chat repo: the Synapse module and the chat service are both built from it. */
 export const CHAT_REPO = 'wtfalch/chat';
 /** Synapse plus the `wtfalch_chat_gate` module; built from the repo root. */
-export const CHAT_SYNAPSE_DOCKERFILE = 'apps/chat-service/synapse-module/Dockerfile';
+export const CHAT_SYNAPSE_DOCKERFILE = '/apps/chat-service/synapse-module/Dockerfile';
 /** The chat service, built from the repo root (that Dockerfile's own top comment). */
-export const CHAT_SERVICE_DOCKERFILE = 'apps/chat-service/Dockerfile';
+export const CHAT_SERVICE_DOCKERFILE = '/apps/chat-service/Dockerfile';
 export const CHAT_SYNAPSE_PORT = '8008';
 export const CHAT_MAS_PORT = '8080';
 export const CHAT_SERVICE_PORT = '8080';

package/dist/plan/executor.js

@@ -9,7 +9,7 @@ import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOC
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
-import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
+import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, } from './platform-diff.js';
@@ -193,7 +193,7 @@ const RATE_LIMIT_REQUESTS_PER_PERIOD = 10;
  * multiple-apps shape `cmsSite`/`CMS_APP_DOCKERFILE` already use below.
  */
 const DEFAULT_APP_REPO = 'wtfalch/foundry';
-const DEFAULT_APP_DOCKERFILE = 'apps/hestia/Dockerfile';
+const DEFAULT_APP_DOCKERFILE = '/apps/hestia/Dockerfile';
 /**
  * The one repo `cmsSite` builds both of its apps from
  * (https://github.com/wtfalch/cms) -- the 2026-09-25 decision this campaign
@@ -205,8 +205,8 @@ const DEFAULT_APP_DOCKERFILE = 'apps/hestia/Dockerfile';
  * is `apps/site`'s own Dockerfile (the reference renderer).
  */
 const CMS_REPO = 'wtfalch/cms';
-const CMS_APP_DOCKERFILE = 'Dockerfile';
-const CMS_SITE_APP_DOCKERFILE = 'apps/site/Dockerfile';
+const CMS_APP_DOCKERFILE = '/Dockerfile';
+const CMS_SITE_APP_DOCKERFILE = '/apps/site/Dockerfile';
 /**
  * #164: the repo `coolifyAgora` builds the org's Agora from
  * (https://github.com/wtfalch/agora) -- the issue's own "How" names this
@@ -225,7 +225,7 @@ const CMS_SITE_APP_DOCKERFILE = 'apps/site/Dockerfile';
  * way it does for `cmsSite`'s two apps above.
  */
 const AGORA_REPO = 'wtfalch/agora';
-const AGORA_APP_DOCKERFILE = 'apps/agora/Dockerfile';
+const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -534,7 +534,7 @@ const CALLS_SERVICE_DB_SCOPE_KEY = 'coolify_calls_service_database';
 /** `wtfalch/calls`'s own repo -- `coolifyCallsService` deploys its `packages/service` (#145, part 2 of #128). */
 const CALLS_SERVICE_REPO = 'wtfalch/calls';
 /** `packages/service/Dockerfile`, built from the repo root (that Dockerfile's own top comment). */
-const CALLS_SERVICE_DOCKERFILE = 'packages/service/Dockerfile';
+const CALLS_SERVICE_DOCKERFILE = '/packages/service/Dockerfile';
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
  * `exited:unhealthy` `` -- `@wtfalch/providers`' own doc comment) means it is
@@ -1208,7 +1208,7 @@ export class FoundryStepExecutor {
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
                 name: appNameFor(org, entry),
-                domains: names.length > 0 ? names.join(',') : undefined,
+                domains: names.length > 0 ? coolifyDomains(names) : undefined,
                 autogenerate_domain: names.length > 0 ? undefined : false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
@@ -1239,7 +1239,7 @@ export class FoundryStepExecutor {
         // here (rule 3). The internal name is set after create, as the calls
         // stack's apps do.
         if (JSON.stringify(names) !== JSON.stringify(haveNames))
-            patch.domains = names.join(',');
+            patch.domains = coolifyDomains(names);
         if (names.length === 0 && (!existing || patch.domains !== undefined)) {
             patch.custom_internal_name = appNameFor(org, entry);
         }
@@ -2178,7 +2178,7 @@ export class FoundryStepExecutor {
             git_branch: 'main',
             build_pack: 'dockerfile',
             name: input.name,
-            domains: input.domain,
+            domains: coolifyDomains([input.domain]),
             dockerfile_location: input.dockerfileLocation,
         });
         return { appId: created.uuid, existed: false };
@@ -2708,7 +2708,7 @@ export class FoundryStepExecutor {
             git_branch: 'main',
             build_pack: 'dockerfile',
             name,
-            domains: callsHostnameFor(org),
+            domains: coolifyDomains([callsHostnameFor(org)]),
             dockerfile_location: CALLS_SERVICE_DOCKERFILE,
         }));
         // A fixed internal name, like Synapse and MAS above, so the org's Agora
@@ -2936,7 +2936,7 @@ export class FoundryStepExecutor {
             git_branch: 'main',
             build_pack: 'dockerfile',
             name,
-            domains: agoraHostnameFor(org),
+            domains: coolifyDomains([agoraHostnameFor(org)]),
             dockerfile_location: AGORA_APP_DOCKERFILE,
         }));
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.

package/dist/plan/hostnames.d.ts

@@ -18,6 +18,12 @@ export declare function wildcardHostname(org: DeclaredOrg): string | null;
  * and the jobs registration read it.
  */
 export declare function appHostname(org: DeclaredOrg): string;
+/**
+ * Coolify's `domains` field: comma-separated full URLs. A bare hostname is a
+ * 422 ("Invalid URL"), so every write names each host as `https://<host>`.
+ * Foundry's own records and proxy labels keep the bare names.
+ */
+export declare function coolifyDomains(names: readonly string[]): string;
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export declare function legacyAppHostname(org: DeclaredOrg): string;
 /**

package/dist/plan/hostnames.js

@@ -34,6 +34,14 @@ export function appHostname(org) {
     const first = entry ? entryHostnames(org, entry)[0] : undefined;
     return first ?? legacyAppHostname(org);
 }
+/**
+ * Coolify's `domains` field: comma-separated full URLs. A bare hostname is a
+ * 422 ("Invalid URL"), so every write names each host as `https://<host>`.
+ * Foundry's own records and proxy labels keep the bare names.
+ */
+export function coolifyDomains(names) {
+    return names.map((name) => `https://${name}`).join(',');
+}
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export function legacyAppHostname(org) {
     return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;

package/dist/plan/platform-providers.js

@@ -5,6 +5,7 @@ import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { ACCESS_POLICY_NAME, isNotFoundError, isRunningOrStarting } from './executor.js';
+import { coolifyDomains } from './hostnames.js';
 import { JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
@@ -424,7 +425,7 @@ export class FoundryPlatformStepExecutor {
                 git_branch: gitRef,
                 build_pack: 'dockerfile',
                 name: JOBS_SCHEDULER_KEY,
-                domains: hostname,
+                domains: coolifyDomains([hostname]),
             });
             appId = created.uuid;
         }
@@ -496,9 +497,9 @@ const AUTH_ZITADEL_IMAGE = 'ghcr.io/zitadel/zitadel';
 const AUTH_ZITADEL_IMAGE_TAG = VERSIONS.zitadel;
 /** `wtfalch/auth`'s own `login/Dockerfile` -- `docs/deploy.md`'s "One compose service, four containers... Two images are built from this repository: the proxy... and the login". */
 const AUTH_REPO = 'wtfalch/auth';
-const AUTH_LOGIN_DOCKERFILE = 'login/Dockerfile';
+const AUTH_LOGIN_DOCKERFILE = '/login/Dockerfile';
 /** `wtfalch/auth`'s own `broker/Dockerfile` -- built from the repo root so the workspace resolves (#204). */
-const AUTH_BROKER_DOCKERFILE = 'broker/Dockerfile';
+const AUTH_BROKER_DOCKERFILE = '/broker/Dockerfile';
 /**
  * `wtfalch/auth`'s login app answers on 3000 (its `Dockerfile`'s Next.js
  * default); ZITADEL answers on 8080 -- both fixed by `docker-compose.yml`'s
@@ -4369,7 +4370,7 @@ async function provisionPlatformIntegrations(action, context, deps) {
     };
     const migrateApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_MIGRATE_APP.name, environment, createApp(INTEGRATIONS_MIGRATE_APP.name));
     await record(INTEGRATIONS_MIGRATE_APP_SCOPE_KEY, migrateApp.appId);
-    const runnerApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_RUNNER_APP.name, environment, createApp(INTEGRATIONS_RUNNER_APP.name, hostname));
+    const runnerApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_RUNNER_APP.name, environment, createApp(INTEGRATIONS_RUNNER_APP.name, coolifyDomains([hostname])));
     await record(INTEGRATIONS_RUNNER_APP_SCOPE_KEY, runnerApp.appId);
     const workerApp = await findOrCreatePlatformApp(coolify, INTEGRATIONS_WORKER_APP.name, environment, createApp(INTEGRATIONS_WORKER_APP.name));
     await record(INTEGRATIONS_WORKER_APP_SCOPE_KEY, workerApp.appId);
@@ -4387,7 +4388,7 @@ async function provisionPlatformIntegrations(action, context, deps) {
         dockerfile_target_build: INTEGRATIONS_RUNNER_APP.target,
         ports_exposes: INTEGRATIONS_RUNNER_PORT,
         git_branch: gitRef,
-        domains: hostname,
+        domains: coolifyDomains([hostname]),
     });
     await coolify.updateApplication(workerApp.appId, {
         dockerfile_target_build: INTEGRATIONS_WORKER_APP.target,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",