@wtfalch/foundry 0.18.0 → 0.19.1

package/dist/plan/executor.js

@@ -2,8 +2,8 @@ import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, chatInternalNames, chatMasConfigYaml, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -14,7 +14,7 @@ import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScope
 import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
@@ -240,10 +240,14 @@ const CMS_SITE_APP_DOCKERFILE = '/apps/site/Dockerfile';
  * followed rather than reopened (#164 "Decide" 1). The agora repo's own
  * Dockerfile (`apps/agora/Dockerfile`) already `EXPOSE`s 8080 and serves
  * from a build built at the repository root, the same one-repo shape
- * `CMS_REPO`'s own two apps use -- no `ports_exposes`/`PORT` env is needed
- * the way `CALLS_SERVICE_PORT` is for the calls service's own Node process,
- * since Coolify's github-app build already reads the exposed port the same
- * way it does for `cmsSite`'s two apps above.
+ * `CMS_REPO`'s own two apps use. This comment used to claim that needed no
+ * `ports_exposes` of its own, on the theory that Coolify's github-app build
+ * reads a Dockerfile's `EXPOSE` the same way it does for `cmsSite`'s two
+ * apps above -- wrong (#506): Coolify never reads `EXPOSE` for a build it
+ * runs itself, so without an explicit `agora.ts`'s `AGORA_APP_PORTS_EXPOSES`,
+ * Traefik is left routing to a port nothing listens on, and a company's
+ * Agora answers 502 behind the tunnel. Seen live on Company Included,
+ * 2026-10-05.
  */
 const AGORA_REPO = 'wtfalch/agora';
 const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
@@ -665,7 +669,7 @@ export class FoundryStepExecutor {
             case 'cloudflare:tunnel':
                 return this.cloudflareTunnel(action, org, context);
             case 'cloudflare:zone':
-                return this.cloudflareZone(action, org);
+                return this.cloudflareZone(action, org, context);
             case 'cloudflare:access':
                 return this.cloudflareAccess(action, org);
             case 'cloudflare:ratelimit':
@@ -1232,11 +1236,16 @@ export class FoundryStepExecutor {
             throw new Error(`zitadel:login-host for ${org.slug}: the loginHostBindings port is not wired`);
         }
         const host = action.desired.host;
-        await this.ports.zitadel.ensureTrustedDomain(host);
-        // zitadel-login's own routing table, written before any app is repointed
-        // so no app ever points at a host with no binding.
+        // The platform's own shared sign-in host: already trusted and routed by
+        // the shared instance, so it gets no trusted domain or binding here.
+        const shared = action.desired.shared === true;
         const clientIds = loginHostClientIds(recorded);
-        await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+        if (!shared) {
+            await this.ports.zitadel.ensureTrustedDomain(host);
+            // zitadel-login's own routing table, written before any app is repointed
+            // so no app ever points at a host with no binding.
+            await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+        }
         // Only apps whose client id the binding now holds: any other app in the
         // project would lose sign-in. The rest move on a later run, once the
         // recorded client ids differ from the binding and replan this step.
@@ -1337,7 +1346,10 @@ export class FoundryStepExecutor {
         // the binding and replans the step next run; a nonempty pending list
         // does too (`planLoginHost`), independent of the host comparison that
         // normally alone decides it.
-        context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+        if (shared)
+            context.recordScopeId(LOGIN_HOST_SHARED_SCOPE_KEY, '1');
+        else
+            context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
@@ -3067,6 +3079,74 @@ export class FoundryStepExecutor {
         }
     }
     // ---- chat -----------------------------------------------------------------
+    /**
+     * The chat service's introspection client: an API app in the org's
+     * messaging project (the audience Agora's token carries), so ZITADEL's
+     * introspection accepts it. The chat service authenticates as it with
+     * `client_secret_basic`. Minted once, the way {@link callsTokenEnvs} does:
+     * the id is recorded under an undelivered key and persisted before the
+     * secret leaves, the secret goes to `deliverSecret` and to the caller's env
+     * write, never to a log, error or return beyond that. A re-run reads the id
+     * and secret back from the service's own env and mints nothing. `changed`
+     * is true only for a fresh mint.
+     */
+    async ensureChatIntrospection(org, zitadelOrgId, projectId, serviceAppId, context) {
+        const recorded = context.recordedIds();
+        const done = recorded[CHAT_INTROSPECTION_SCOPE_KEY];
+        const undelivered = recorded[CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
+        if (done) {
+            const envs = await this.ports.coolify.listEnvs(serviceAppId);
+            const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+            const clientId = read('CHAT_INTROSPECTION_CLIENT_ID');
+            const clientSecret = read('CHAT_INTROSPECTION_CLIENT_SECRET');
+            if (!clientId || !clientSecret) {
+                throw new Error(`coolify:chat for ${org.slug}: the introspection client (ZITADEL app ${done}) is recorded but its id or secret is no longer on the service; remove the recorded keys ${CHAT_INTROSPECTION_SCOPE_KEY} and ${CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY}, and delete the ZITADEL client, to mint a new one`);
+            }
+            return { clientId, clientSecret, appId: done, changed: false };
+        }
+        if (undelivered) {
+            // A minted client with no marker: a crash or failure after the mint.
+            // Both values on the service mean the write landed and only the marker
+            // was lost; otherwise nothing usable was delivered, and the app is
+            // deleted below and made again.
+            const envs = await this.ports.coolify.listEnvs(serviceAppId);
+            const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+            const clientId = read('CHAT_INTROSPECTION_CLIENT_ID');
+            const clientSecret = read('CHAT_INTROSPECTION_CLIENT_SECRET');
+            if (clientId && clientSecret) {
+                return { clientId, clientSecret, appId: undelivered, changed: false };
+            }
+        }
+        // An app by this name with no recorded secret is a crash between create
+        // and record: nothing was delivered, so it is deleted and made again.
+        const stale = (await this.ports.zitadel.listApps(zitadelOrgId, projectId)).apps.filter((app) => app.name === chatIntrospectionAppName(org) && app.state !== 'APP_STATE_REMOVED');
+        const staleIds = new Set(stale.map((app) => app.id));
+        if (undelivered)
+            staleIds.add(undelivered);
+        for (const id of staleIds) {
+            try {
+                await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, id);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        const client = await this.ports.zitadel.createApiApp(zitadelOrgId, projectId, {
+            name: chatIntrospectionAppName(org),
+        });
+        context.recordScopeId(CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, client.appId);
+        await context.persistScopeIds();
+        if (!(await this.deliverWithRetry(`zitadel:chat:${org.slug}:introspection`, client.clientSecret))) {
+            throw new Error(`coolify:chat for ${org.slug}: the introspection client secret (ZITADEL app ${client.appId}) could not be delivered after ${JOBS_DELIVERY_ATTEMPTS} attempts`);
+        }
+        return {
+            clientId: client.clientId,
+            clientSecret: client.clientSecret,
+            appId: client.appId,
+            changed: true,
+        };
+    }
     /**
      * Creates the `chat.admin` role on the org's messaging project and grants
      * it to each owner whose invite is recorded (`zitadel:owner:<orgId>:<email>`,
@@ -3135,6 +3215,29 @@ export class FoundryStepExecutor {
                 context.recordScopeId(markerKey, '1');
                 return { resourceId: serviceAppId };
             }
+            // `planChat` plans this for a live chat whose service has no
+            // introspection client: mint it once, push only its two env vars and
+            // redeploy. Never the re-key paths or a fresh provision.
+            if (action.desired.refreshIntrospection === true) {
+                const serviceAppId = recorded[CHAT_SERVICE_SCOPE_KEY];
+                const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+                const projectId = recorded[ZITADEL_MESSAGING_PROJECT_SCOPE_KEY];
+                if (!serviceAppId || !zitadelOrgId || !projectId) {
+                    throw new Error(`coolify:chat introspection for ${org.slug}: the chat service app, the ZITADEL org or the messaging project is not recorded yet`);
+                }
+                const hadMarker = Boolean(recorded[CHAT_INTROSPECTION_SCOPE_KEY]);
+                const client = await this.ensureChatIntrospection(org, zitadelOrgId, projectId, serviceAppId, context);
+                await this.ports.coolify.bulkUpsertEnvs(serviceAppId, [
+                    { key: 'CHAT_INTROSPECTION_CLIENT_ID', value: client.clientId },
+                    { key: 'CHAT_INTROSPECTION_CLIENT_SECRET', value: client.clientSecret },
+                ]);
+                // Deploy first, marker last: a failed deploy leaves the marker unset,
+                // so the next plan still carries this step and the container gets the env.
+                if (client.changed || !hadMarker)
+                    await this.ports.coolify.deploy(serviceAppId);
+                context.recordScopeId(CHAT_INTROSPECTION_SCOPE_KEY, client.appId);
+                return { resourceId: serviceAppId };
+            }
             if (action.desired.usesDomain === false) {
                 throw new NotBuiltError(`coolify:chat reverse re-key for ${org.slug}`, 'moving its chat back onto the original server_name is not built (#7 amendment 3)');
             }
@@ -3268,6 +3371,7 @@ export class FoundryStepExecutor {
             rsaKeyPem: secrets.value.masRsaKeyPem,
             ecKeyPem: secrets.value.masEcKeyPem,
         }));
+        const introspection = await this.ensureChatIntrospection(org, zitadelOrgId, project.id, service.appId, context);
         await this.ports.coolify.bulkUpsertEnvs(service.appId, chatServiceEnvs({
             orgSlug: org.slug,
             companyName: org.displayName,
@@ -3277,6 +3381,8 @@ export class FoundryStepExecutor {
             agoraHost,
             masClientId: secrets.value.masClientId,
             masClientSecret: secrets.value.masClientSecret,
+            introspectionClientId: introspection.clientId,
+            introspectionClientSecret: introspection.clientSecret,
         }));
         // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
         // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
@@ -3294,11 +3400,14 @@ export class FoundryStepExecutor {
         for (const app of [mas, synapse, service]) {
             if (!app.existed ||
                 secrets.changed ||
-                (app === service && serviceDbPush.changed) ||
+                (app === service && (serviceDbPush.changed || introspection.changed)) ||
                 !isRunningOrStarting((await this.ports.coolify.getApplication(app.appId)).status)) {
                 await this.ports.coolify.deploy(app.appId);
             }
         }
+        // After the write and the deploys, so a failure before them leaves the
+        // marker unset and the next apply repeats the step.
+        context.recordScopeId(CHAT_INTROSPECTION_SCOPE_KEY, introspection.appId);
         // #456: recorded here too, not only on the `refreshDatabaseSplit` replan
         // path above -- without it a fresh provision's very first apply never
         // sets this marker, so `planChat` (`!recordedIds[serviceDbEnvAppliedScopeKey('chat')]`)
@@ -3603,11 +3712,25 @@ export class FoundryStepExecutor {
      * actually differs, or whenever the last restart this step confirmed
      * ({@link AGORA_ACTIVATED_ENV_SCOPE_KEY}) is not this exact env (an org
      * applied before this existed, whose live env already matched desired
-     * with nothing ever confirmed running it). A brand new app has nothing
-     * running yet to restart. The activation marker is recorded last, after
-     * the restart (if any) returns without throwing, so a failed restart
-     * leaves it stale and the next plan replans this step even though
-     * Coolify's own env store already matches desired.
+     * with nothing ever confirmed running it). The activation marker is
+     * recorded last, after the restart (if any) returns without throwing, so a
+     * failed restart leaves it stale and the next plan replans this step even
+     * though Coolify's own env store already matches desired.
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link AGORA_DEPLOYED_SCOPE_KEY}). `createGithubAppApplication` never
+     * sets `instant_deploy`, and Coolify defaults it to false, so without an
+     * explicit deploy the app sat created but never built or started.
+     *
+     * #506: `ports_exposes: AGORA_APP_PORTS_EXPOSES` goes on the create call
+     * itself, so Traefik has a port to route to from the moment the app
+     * exists. An app `findOrCreateCallsApp` instead *found* may predate this
+     * fix and carry no `ports_exposes` at all (or the wrong one), so its live
+     * value is read and, when it differs, patched -- and, since the container
+     * listens on `ports_exposes` only at its next deploy (the same rule
+     * `coolifyApp`'s own `settingsNeedDeploy` follows for a port change
+     * there), redeployed even on a run that already has its one #504 deploy
+     * behind it.
      */
     async coolifyAgora(action, org, context) {
         // The host values the plan read, carried in the step: never read again
@@ -3637,9 +3760,22 @@ export class FoundryStepExecutor {
             name,
             domains: coolifyDomains([agoraHostnameFor(org)]),
             dockerfile_location: AGORA_APP_DOCKERFILE,
+            ports_exposes: AGORA_APP_PORTS_EXPOSES,
         }));
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
+        // #506: an app found rather than just created may predate passing
+        // `ports_exposes` at create -- Traefik then routes to a port nothing
+        // listens on and Agora answers 502 behind the tunnel. A freshly created
+        // app already got the right port above, so only a found one is checked.
+        const portDiffers = app.existed &&
+            (await this.ports.coolify.getApplication(app.appId)).ports_exposes !==
+                AGORA_APP_PORTS_EXPOSES;
+        if (portDiffers) {
+            await this.ports.coolify.updateApplication(app.appId, {
+                ports_exposes: AGORA_APP_PORTS_EXPOSES,
+            });
+        }
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
         // can no longer tell a changed value from one already live.
@@ -3650,7 +3786,25 @@ export class FoundryStepExecutor {
         await this.ports.coolify.bulkUpsertEnvs(app.appId, Object.entries(env).map(([key, value]) => ({ key, value })));
         const revision = agoraEnvRevision(env);
         const alreadyActivated = context.recordedIds()[AGORA_ACTIVATED_ENV_SCOPE_KEY] === revision;
-        if (app.existed && (envChanged || !alreadyActivated)) {
+        // #504: `createGithubAppApplication` never sets `instant_deploy`, and
+        // Coolify defaults it to false -- a brand new app, and one found by name
+        // that a previous apply created but crashed before deploying, both sat
+        // built but never started. `restart` cannot fix either: it starts a
+        // container that was never built. Deployed once this executor has
+        // confirmed (the marker never changes value once set), never again -- a
+        // live app is only ever restarted from here on, unless #506's port fix
+        // below needs its own deploy.
+        if (!context.recordedIds()[AGORA_DEPLOYED_SCOPE_KEY]) {
+            await this.ports.coolify.deploy(app.appId);
+            context.recordScopeId(AGORA_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (portDiffers) {
+            // #506: a port fix needs its own full deploy -- env drift alone only
+            // needs the cheaper restart, and this deploy already carries this
+            // run's env (pushed above), so the two never both run.
+            await this.ports.coolify.deploy(app.appId);
+        }
+        else if (app.existed && (envChanged || !alreadyActivated)) {
             await this.ports.coolify.restart(app.appId);
         }
         context.recordScopeId(AGORA_ACTIVATED_ENV_SCOPE_KEY, revision);
@@ -3679,6 +3833,10 @@ export class FoundryStepExecutor {
      *
      * `AUTH_APP_KEY` is minted once here; its broker entry is the next step
      * (`bouleBrokerEntry`).
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link BOULE_DEPLOYED_SCOPE_KEY}), the same reason and the same marker
+     * shape {@link coolifyAgora}'s own doc comment explains.
      */
     async coolifyBoule(action, org, context) {
         // The issuer and Archon URL the plan read, carried in the step: the env
@@ -3730,7 +3888,17 @@ export class FoundryStepExecutor {
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
-        if (app.existed && (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed)) {
+        // #504: see `coolifyAgora`'s own comment just above -- `createGithubAppApplication`
+        // never sets `instant_deploy`, so a brand new app (or one found by name
+        // that a previous apply created but crashed before deploying) sat built
+        // but never started. Deployed once this executor has confirmed, never
+        // again -- a live app is only ever restarted from here on.
+        if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
+            await this.ports.coolify.deploy(app.appId);
+            context.recordScopeId(BOULE_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (app.existed &&
+            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed)) {
             await this.ports.coolify.restart(app.appId);
         }
         return { resourceId: app.appId };
@@ -4219,8 +4387,17 @@ export class FoundryStepExecutor {
      * shared-hostname collision this ticket exists to refuse. An org re-running
      * its own already-recorded zone is unaffected: the store then names this
      * same org as the owner.
+     *
+     * #510: also records the zone's own id under the flat `cloudflare_zone`
+     * scope key, alongside the `cloudflare:zone:<domain>` resource id `runSteps`
+     * already records from this method's return value. Without it, nothing
+     * ever gives `ProvidersCloudflareReader` a zone id to resolve this org's
+     * scope with (`providers-readers.ts`'s `storeScopeResolver` doc comment),
+     * so that reader's `listResources` always returned `[]` and `diff.ts`'s
+     * `planZone` re-proposed "provision a Cloudflare zone" on every apply, even
+     * once the zone was live.
      */
-    async cloudflareZone(action, org) {
+    async cloudflareZone(action, org, context) {
         const domain = action.key;
         const cf = this.ports.cloudflare;
         const existing = await cf.findZoneByApex(domain);
@@ -4229,9 +4406,11 @@ export class FoundryStepExecutor {
             if (owner !== null && owner !== org.id) {
                 throw new Error(`cloudflare:zone for ${org.slug}: zone ${existing.id} (${domain}) is already recorded under org ${owner}; foundry does not adopt it`);
             }
+            context.recordScopeId('cloudflare_zone', existing.id);
             return { resourceId: existing.id };
         }
         const created = await cf.createZone(domain);
+        context.recordScopeId('cloudflare_zone', created.id);
         return { resourceId: created.id };
     }
     // ---- mail -----------------------------------------------------------
@@ -5318,7 +5497,14 @@ export class FoundryStepExecutor {
                     // `LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY` -- nothing else ever runs
                     // for this org again to finish removing it once destroy deletes
                     // the ZITADEL project and org below, so it has to go here too.
-                    for (const host of [target.id, ...pendingRemovalHosts(recordedIds)]) {
+                    // A shared instance host's trusted domain is not this org's to remove.
+                    // The flag may be missing, so the recorded host is also compared
+                    // with the platform's shared auth host.
+                    const sharedHost = await this.ports.platformOrg?.authHostname?.();
+                    const isShared = recordedIds[LOGIN_HOST_SHARED_SCOPE_KEY] === '1' ||
+                        (sharedHost != null && target.id === sharedHost);
+                    const own = isShared ? [] : [target.id];
+                    for (const host of [...own, ...pendingRemovalHosts(recordedIds)]) {
                         try {
                             await this.ports.zitadel.deleteTrustedDomain(host);
                         }

package/dist/plan/login-host.d.ts

@@ -22,18 +22,22 @@ import type { DeclaredOrg } from '../org.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
- * -- the platform's own org, declared with-domain on the platform's own
- * domain, would otherwise compute the shared ZITADEL instance's own login
- * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
- * `auth.companyincluded.com`). Archon's login-host write throws on that
- * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
- * written instead, `auth`'s own `company-host.ts` denies every request
- * through a duplicate host, the shared one included. `platformAuthHostname`
- * is `null` when the caller has none to compare against (no platform
- * declared, or sign-in not ready yet), in which case this never refuses.
+ * #488: the platform's own org is not handled here: it signs in on the shared
+ * ZITADEL instance's own host (`platformAuthHostname`), whatever
+ * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
+ * that host itself. That host must never get a trusted
+ * domain or a login binding of its own:
+ * Archon's login-host write throws on a duplicate host, and `auth`'s own
+ * `company-host.ts` denies every request through one, the shared one
+ * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
  */
-export declare function loginHostnameFor(org: DeclaredOrg, platformAuthHostname?: string | null): string;
+export declare function loginHostnameFor(org: DeclaredOrg): string;
+/**
+ * Scope id set to `'1'` once an org's recorded login host is the platform's
+ * shared instance host: that host's trusted domain belongs to the shared
+ * instance, so `destroy` must not remove it.
+ */
+export declare const LOGIN_HOST_SHARED_SCOPE_KEY = "zitadel_login_host_shared";
 /**
  * One entry in zitadel-login's own `LOGIN_HOST_BINDINGS`
  * (`auth/docs/company-login-hosts.md`) -- a single-line JSON document naming

package/dist/plan/login-host.js

@@ -23,30 +23,30 @@ import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
- * -- the platform's own org, declared with-domain on the platform's own
- * domain, would otherwise compute the shared ZITADEL instance's own login
- * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
- * `auth.companyincluded.com`). Archon's login-host write throws on that
- * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
- * written instead, `auth`'s own `company-host.ts` denies every request
- * through a duplicate host, the shared one included. `platformAuthHostname`
- * is `null` when the caller has none to compare against (no platform
- * declared, or sign-in not ready yet), in which case this never refuses.
+ * #488: the platform's own org is not handled here: it signs in on the shared
+ * ZITADEL instance's own host (`platformAuthHostname`), whatever
+ * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
+ * that host itself. That host must never get a trusted
+ * domain or a login binding of its own:
+ * Archon's login-host write throws on a duplicate host, and `auth`'s own
+ * `company-host.ts` denies every request through one, the shared one
+ * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
  */
-export function loginHostnameFor(org, platformAuthHostname = null) {
+export function loginHostnameFor(org) {
     // `issuer.usesDomain` is the issuer's opt-in into the org's domain
     // (`org.ts`'s `IssuerConfig`): a domain alone never moves it, so a domain
     // with `usesDomain` false stays on the tier 1 host.
     if (org.domain && org.issuer.usesDomain) {
-        const host = `auth.${org.domain}`;
-        if (platformAuthHostname && host === platformAuthHostname) {
-            return `${org.slug}-auth.oikos.host`;
-        }
-        return host;
+        return `auth.${org.domain}`;
     }
     return `${org.slug}-auth.oikos.host`;
 }
+/**
+ * Scope id set to `'1'` once an org's recorded login host is the platform's
+ * shared instance host: that host's trusted domain belongs to the shared
+ * instance, so `destroy` must not remove it.
+ */
+export const LOGIN_HOST_SHARED_SCOPE_KEY = 'zitadel_login_host_shared';
 /**
  * Scope id holding what the binding was last written with
  * ({@link loginBindingState}). Client ids are not secrets. The planner

package/dist/plan/platform-org-ports.d.ts

@@ -45,6 +45,7 @@ export declare class PlatformOrgPorts {
     files(): Promise<FilesOrganisationPort>;
     ai(): Promise<AiOrganisationPort>;
     jobs(): Promise<JobsSchedulerPort>;
+    authHostname(): Promise<string | null>;
     private recorded;
     private held;
 }

package/dist/plan/platform-org-ports.js

@@ -47,6 +47,9 @@ export class PlatformOrgPorts {
         const token = await this.held('jobs', JOBS_ADMIN_TOKEN_REF);
         return new HttpJobsSchedulerClient(`https://${platform.jobs.hostname}`, token, this.options.fetch);
     }
+    async authHostname() {
+        return (await this.options.store.get())?.auth.hostname ?? null;
+    }
     async recorded(service, scopeKey) {
         const value = (await this.options.store.getServiceIds())[scopeKey];
         if (!value) {

package/dist/plan/platform-providers.d.ts

@@ -640,8 +640,9 @@ export declare const PLATFORM_AI_MANAGEMENT_KEY_REF = "ai:platform:managementKey
  * What Archon's management key may do in ai: exactly `ai`'s own
  * `ARCHON_AI_PERMISSIONS` (`apps/host/scripts/authz/bootstrap-archon.ts`) --
  * configuration only (offerings, provisioning, offers, budgets, usage, cost)
- * plus deleting (archiving) an organisation, never connections, runs or
- * webhooks. ai's `/v1/platform/keys` route refuses any permission outside
+ * plus deleting (archiving) an organisation and setting another
+ * organisation's webhook address and budget, never connections, runs or
+ * webhook deliveries. ai's `/v1/platform/keys` route refuses any permission outside
  * this same list, so a request for more than this is a 403, not a wider key.
  */
 export declare const PLATFORM_AI_MANAGEMENT_PERMISSIONS: readonly string[];

package/dist/plan/platform-providers.js

@@ -2330,11 +2330,14 @@ const PLATFORM_ARCHON_PROJECT = 'platform';
 const PLATFORM_ARCHON_APP_NAME = 'platform-archon';
 const PLATFORM_ARCHON_DB_NAME = 'platform-archon-db';
 /**
- * The database Coolify creates for Archon. Archon's own
- * `drizzle/0001_runtime_role.sql` names its runtime role
- * `current_database() || '_rt'`, so {@link ARCHON_RUNTIME_ROLE} follows.
+ * The database Archon runs on. Live platform-archon moved to `archon_v2` on
+ * the same server (2026-10-02, the move onto `@wtfalch/db`), while its Coolify
+ * resource still names `archon` as its first database. So both URLs built
+ * here set this database themselves, never `internal_db_url`'s path.
+ * Archon's own migrations grant to `current_database() || '_rt'`, so
+ * {@link ARCHON_RUNTIME_ROLE} follows.
  */
-const ARCHON_POSTGRES_DB = 'archon';
+const ARCHON_POSTGRES_DB = 'archon_v2';
 const ARCHON_RUNTIME_ROLE = `${ARCHON_POSTGRES_DB}_rt`;
 /** Fixed so the tunnel addresses the container directly (see `provisionPlatformAuth`). */
 const PLATFORM_ARCHON_INTERNAL_NAME = 'platform-archon';
@@ -2668,11 +2671,12 @@ async function provisionPlatformArchon(context, deps) {
     // The owner URL must name the adopted database's host, or the app's two
     // database URLs would point at different databases.
     const liveOwnerUrl = await currentEnvValue(deps.coolify, appId, 'DATABASE_URL_OWNER');
+    const ownerUrl = archonDatabaseUrl(db.internal_db_url);
     if (liveOwnerUrl) {
         assertSameDatabaseHost('DATABASE_URL_OWNER', liveOwnerUrl, db.internal_db_url);
     }
     else {
-        envs.push({ key: 'DATABASE_URL_OWNER', value: db.internal_db_url });
+        envs.push({ key: 'DATABASE_URL_OWNER', value: ownerUrl });
     }
     const liveReportingSite = await currentEnvValue(deps.coolify, appId, 'REPORTING_SITE');
     if (!liveReportingSite) {
@@ -2692,7 +2696,7 @@ async function provisionPlatformArchon(context, deps) {
     // reflects the env Archon actually ends up running with, not just this
     // run's delta.
     const archonEnvHashOverrides = new Map([
-        ['DATABASE_URL_OWNER', liveOwnerUrl ?? db.internal_db_url],
+        ['DATABASE_URL_OWNER', liveOwnerUrl ?? ownerUrl],
         ['REPORTING_SITE', liveReportingSite ?? 'archon'],
     ]);
     const effectiveCookieSecret = cookieSecret ?? (await currentEnvValue(deps.coolify, appId, 'AUTH_COOKIE_SECRET'));
@@ -3625,10 +3629,9 @@ async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
         return null;
     }
     let host;
-    let pathname;
     let search;
     try {
-        ({ host, pathname, search } = new URL(dbInternalUrl));
+        ({ host, search } = new URL(dbInternalUrl));
     }
     catch {
         // Node's `ERR_INVALID_URL` carries the whole input, credential included, so
@@ -3636,7 +3639,19 @@ async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
         throw new Error('platform:archon: the database internal_db_url could not be parsed; not generating DATABASE_URL. Check the database in Coolify and apply again');
     }
     const password = randomBytes(24).toString('base64url');
-    return `postgres://${ARCHON_RUNTIME_ROLE}:${password}@${host}${pathname}${search}`;
+    return `postgres://${ARCHON_RUNTIME_ROLE}:${password}@${host}/${ARCHON_POSTGRES_DB}${search}`;
+}
+/** `internalUrl` on {@link ARCHON_POSTGRES_DB}. The error never carries the URL: it holds a credential. */
+function archonDatabaseUrl(internalUrl) {
+    let url;
+    try {
+        url = new URL(internalUrl);
+    }
+    catch {
+        throw new Error('platform:archon: the database internal_db_url could not be parsed; not generating DATABASE_URL_OWNER. Check the database in Coolify and apply again');
+    }
+    url.pathname = `/${ARCHON_POSTGRES_DB}`;
+    return url.toString();
 }
 /**
  * Thrown by {@link createAiManagementKeyMinter} (never by a test's own
@@ -3720,8 +3735,9 @@ export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
  * What Archon's management key may do in ai: exactly `ai`'s own
  * `ARCHON_AI_PERMISSIONS` (`apps/host/scripts/authz/bootstrap-archon.ts`) --
  * configuration only (offerings, provisioning, offers, budgets, usage, cost)
- * plus deleting (archiving) an organisation, never connections, runs or
- * webhooks. ai's `/v1/platform/keys` route refuses any permission outside
+ * plus deleting (archiving) an organisation and setting another
+ * organisation's webhook address and budget, never connections, runs or
+ * webhook deliveries. ai's `/v1/platform/keys` route refuses any permission outside
  * this same list, so a request for more than this is a 403, not a wider key.
  */
 export const PLATFORM_AI_MANAGEMENT_PERMISSIONS = [
@@ -3732,6 +3748,8 @@ export const PLATFORM_AI_MANAGEMENT_PERMISSIONS = [
     'ai.organisations:provision',
     'ai.organisations:offer',
     'ai.organisations:delete',
+    'ai.organisations:webhook',
+    'ai.organisations:budget',
     'ai.keys:issue',
     'ai.budgets:read',
     'ai.budgets:update',