@wtfalch/foundry 0.21.1 → 0.22.1

package/dist/plan/executor.js

@@ -21,21 +21,47 @@ import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
-import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
+/**
+ * The real {@link StepExecutor} (#20 "provision Company Factory end to
+ * end"): makes each {@link StepAction} `diff.ts` plans true against a real
+ * Coolify, Cloudflare and ZITADEL, plus per-org organisations, spend limits
+ * and (for AI) offers on Files and AI (#80). Scope and design are exactly
+ * what `.claude/decisions-2026-09-24-executor.md`'s "Executor decisions"
+ * section settled, referenced by name at each dispatch branch below.
+ *
+ * Built entirely from narrow ports (interfaces), never a concrete
+ * `@wtfalch/providers` client: this package holds no credential and never
+ * will (executor decisions: "the executor is constructed with narrow ports
+ * ... a host [archon] supplies real clients. How the host gets provider
+ * tokens from the keys Worker is the host's job, not this campaign's").
+ * Every port method here is named and shaped to match a real method on
+ * `@wtfalch/providers`' `CoolifyClient`/`CloudflareClient`/`ZitadelClient`
+ * (checked against `providers` `origin/main`, 2026-09-24), or on
+ * `@wtfalch/files`'/`@wtfalch/ai`'s own SDK clients (#80, checked against
+ * each repo's own `main`, 2026-09-25), so a real client satisfies the port
+ * structurally, with no adapter needed — see each port's own doc comment for
+ * the one real method it does not yet have.
+ */
+/** #569: the description foundry gives the Coolify project it creates for an org. */
+const COOLIFY_PROJECT_MARK_PREFIX = 'foundry org ';
+function coolifyProjectMark(org) {
+    return `${COOLIFY_PROJECT_MARK_PREFIX}${org.id}`;
+}
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
  * -- into {@link ZitadelPort.listApps}'s own shape, so a host wiring that
  * real client in satisfies this port without reaching into `executor.ts`
- * itself to build the wrapper by hand. `complete: false` on every call:
- * the real client's own `_search` request has no pagination on it yet
- * (https://github.com/wtfalch/providers/issues/29), so this adapter cannot
- * promise it read more than one page. `loginBaseUri` comes back `undefined`
+ * itself to build the wrapper by hand. `complete: true` on every call:
+ * since providers 0.7.4 the real client pages `_search` to the end. A host
+ * that supplies its own `listApps` keeps whatever `complete` it reports.
+ * Each app's `clientId` (providers 0.7.5) passes through. `loginBaseUri` comes back `undefined`
  * for every app for the identical reason -- the real client does not read
  * it back at all yet, not "read it back as absent" -- which is exactly the
  * state `zitadelLoginHost`'s fail-closed rule exists for: every pending
@@ -45,7 +71,9 @@ import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerR
 export function adaptZitadelListApps(client) {
     return async (orgId, projectId) => ({
         apps: await client.listApps(orgId, projectId),
-        complete: false,
+        // Sound because package.json requires providers >=0.7.4 as a peer: from
+        // there `listApps` pages `_search` to the end, so this read every app.
+        complete: true,
     });
 }
 // ---------------------------------------------------------------------------
@@ -731,6 +759,16 @@ export class FoundryStepExecutor {
     constructor(ports) {
         this.ports = ports;
     }
+    /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
+    ownEdgePorts() {
+        return {
+            dns: Boolean(this.ports.dns),
+            zones: Boolean(this.ports.zones),
+            access: Boolean(this.ports.access),
+            ratelimits: Boolean(this.ports.ratelimits),
+            tunnels: Boolean(this.ports.tunnels),
+        };
+    }
     async execute(action, context) {
         const { org } = context;
         switch (`${action.system}:${action.kind}`) {
@@ -1318,7 +1356,7 @@ export class FoundryStepExecutor {
         // The platform's own shared sign-in host: already trusted and routed by
         // the shared instance, so it gets no trusted domain or binding here.
         const shared = action.desired.shared === true;
-        const clientIds = loginHostClientIds(recorded);
+        const clientIds = loginHostClientIds(org, recorded);
         if (!shared) {
             await this.ports.zitadel.ensureTrustedDomain(host);
             // zitadel-login's own routing table, written before any app is repointed
@@ -1328,13 +1366,16 @@ export class FoundryStepExecutor {
         // Only apps whose client id the binding now holds: any other app in the
         // project would lose sign-in. The rest move on a later run, once the
         // recorded client ids differ from the binding and replan this step.
+        const customersKeys = customersEntryKeys(org);
         const boundAppIds = new Set([
             ...(recorded[APP_CLIENT_ID_SCOPE_KEY]
                 ? org.hosting.issuerApps.filter((a) => a.kind === 'web').map((a) => a.name)
                 : []),
             ...Object.keys(recorded)
                 .filter((key) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX))
-                .map((key) => key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length)),
+                .map((key) => key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length))
+                // #573: a customers entry signs in on the shared host.
+                .filter((name) => !customersKeys.has(name)),
             ...(recorded[CMS_CLIENT_ID_SCOPE_KEY] ? ['cms'] : []),
             ...(recorded[AGORA_CLIENT_ID_SCOPE_KEY] ? ['agora'] : []),
             ...(recorded[BOULE_CLIENT_ID_SCOPE_KEY] ? ['boule'] : []),
@@ -1459,14 +1500,69 @@ export class FoundryStepExecutor {
             throw new Error(`zitadel:app '${action.key}' for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
         }
         const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
-        // A kind change deletes the recorded app then recreates it (task
-        // brief); the first-ever create for this key has nothing recorded, so
-        // this is a no-op then. A 404 here (already gone) is tolerated the same
-        // way `destroy` tolerates one -- a retry after the delete half already
-        // succeeded but the recreate half failed must find an already-deleted
-        // app a no-op, not a new error that wedges the apply forever.
+        const isCmsClient = action.key === 'cms' && org.site.enabled;
+        const isAgoraClient = action.key === 'agora';
+        const isBouleClient = action.key === 'boule';
+        const authEntry = org.hosting.entries.find((e) => e.key === action.key && e.uses?.auth);
+        const clientIdScopeKey = isCmsClient
+            ? CMS_CLIENT_ID_SCOPE_KEY
+            : isAgoraClient
+                ? AGORA_CLIENT_ID_SCOPE_KEY
+                : isBouleClient
+                    ? BOULE_CLIENT_ID_SCOPE_KEY
+                    : authEntry
+                        ? entryClientIdScopeKey(action.key)
+                        : APP_CLIENT_ID_SCOPE_KEY;
         const priorAppId = recorded[`zitadel:app:${action.key}`];
-        if (priorAppId) {
+        // Only a step the planner flagged as destroying (`recreate`, set with
+        // `destroys: true` so plan-apply asks for the typed confirmation) may
+        // delete an app. A plain provision adopts a live app instead: one with
+        // the recorded id, or one of the same name in the project (an app an
+        // earlier apply created whose response was lost). ZITADEL's listing can
+        // miss a live app (it once dropped both company sign-in clients on
+        // production), and there is no read by app id, so a recorded app the
+        // listing does not show is never replaced: the planner reports it
+        // blocked, and this throws if a stale plan reaches it.
+        if (action.desired.recreate !== true) {
+            const listing = await this.ports.zitadel.listApps(zitadelOrgId, projectId);
+            const liveApps = listing.apps.filter((app) => app.state !== 'APP_STATE_REMOVED');
+            const byId = priorAppId ? liveApps.find((app) => app.id === priorAppId) : undefined;
+            const adopted = byId ?? liveApps.find((app) => app.name === action.key && app.appType === appType);
+            if (adopted) {
+                // Not adopted silently: a wrong type is a recreate (destroying, typed
+                // confirmation) and an inactive app is a person's decision. Neither
+                // can be known from the plan's name-keyed live read, so this throws.
+                if (adopted.appType !== appType || adopted.state !== 'APP_STATE_ACTIVE') {
+                    throw new Error(`zitadel:app '${action.key}' for ${org.slug}: app ${adopted.id} is live as a ${adopted.appType} app in state ${adopted.state}, not an active ${appType} app -- nothing was created or deleted`);
+                }
+                if (appType === 'api') {
+                    // The secret was minted once, at creation; an app matched only by
+                    // name has no recorded delivery, and nothing can recover it.
+                    if (adopted.id !== priorAppId) {
+                        throw new Error(`zitadel:app '${action.key}' for ${org.slug}: an api app ${adopted.id} of that name exists but was never recorded, so its secret cannot be recovered -- nothing was created or deleted; delete that app in ZITADEL, then apply again to mint a new one`);
+                    }
+                }
+                else {
+                    // A client id recorded for another app is never carried over.
+                    const clientId = adopted.clientId ??
+                        (adopted.id === priorAppId ? recorded[clientIdScopeKey] : undefined);
+                    if (!clientId) {
+                        throw new Error(`zitadel:app '${action.key}' for ${org.slug}: app ${adopted.id} is live but the listing gives no client id for it -- nothing was created or deleted`);
+                    }
+                    context.recordScopeId(clientIdScopeKey, clientId);
+                }
+                return { resourceId: adopted.id };
+            }
+            if (priorAppId) {
+                throw new Error(`zitadel:app '${action.key}' for ${org.slug}: recorded app ${priorAppId} is not in the listing, and a listing can miss a live app -- nothing was created or deleted; plan again and confirm the replacement step if the app is really gone`);
+            }
+        }
+        // A kind change (`recreate`) deletes the recorded app then recreates it
+        // (task brief); a 404 (already gone) is tolerated the same way `destroy`
+        // tolerates one -- a retry after the delete half already succeeded but
+        // the recreate half failed must find an already-deleted app a no-op, not
+        // a new error that wedges the apply forever.
+        if (action.desired.recreate === true && priorAppId) {
             try {
                 await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, priorAppId);
             }
@@ -1474,16 +1570,22 @@ export class FoundryStepExecutor {
                 if (!isNotFoundError(error))
                     throw error;
             }
+            // Gone now: a retry after a failed create must not find this id and be
+            // blocked as "recorded but missing" (`diff.ts`'s `guardAppProvision`).
+            // Removed (not blanked) and persisted now: a death before the create
+            // must not leave the stale id behind, nor an empty one for destroy.
+            if (context.forgetId)
+                context.forgetId(`zitadel:app:${action.key}`);
+            else
+                context.recordScopeId(`zitadel:app:${action.key}`, '');
+            await context.persistScopeIds();
             // The recreate half is retried on its own failure (the delete above
             // already tolerates the resulting 404), so a retry can also land here
             // after an earlier attempt's create call actually succeeded against
-            // ZITADEL but whose response this executor never saw (a dropped
-            // connection, a killed process). That app is deleted, not reused: the
-            // lost response also lost its clientSecret and clientId, which
-            // `listApps` cannot return, so reusing it would leave the secret
-            // undelivered and the clientId unrecorded forever. The create below
-            // then runs every side effect. A first-ever create (no `priorAppId`)
-            // has nothing to find here and never pays this read.
+            // ZITADEL but whose response this executor never saw. That app is
+            // deleted, not reused: the lost response also lost its clientSecret
+            // and clientId, which `listApps` cannot return, so reusing it would
+            // leave the secret undelivered and the clientId unrecorded forever.
             const orphan = await this.findRecreatedApp(zitadelOrgId, projectId, action.key, appType);
             if (orphan) {
                 try {
@@ -1512,16 +1614,13 @@ export class FoundryStepExecutor {
         // doc comment relies on. #164: the fixed `agora` client (`diff.ts`'s
         // `planAgoraClient`) is the same shape, always -- there is no
         // `org.site.enabled`-style guard to check, since Agora is always on.
-        const isCmsClient = action.key === 'cms' && org.site.enabled;
         // The Agora client stays `appType: 'web'`: providers' `createOidcApp`
         // makes every non-native app a public client (authorization code + PKCE,
         // `OIDC_AUTH_METHOD_TYPE_NONE`, no secret), which is what Agora's browser
         // SPA needs. Providers cannot create ZITADEL's `USER_AGENT` app kind.
-        const isAgoraClient = action.key === 'agora';
         // #161: the fixed `boule` client signs people into the org's Boule at its
         // own hostname, on the standard `/auth/callback` path (Boule is built on
         // `@wtfalch/auth` like every other web app here).
-        const isBouleClient = action.key === 'boule';
         const hostname = isCmsClient
             ? cmsHostnameFor(org)
             : isAgoraClient
@@ -1542,7 +1641,6 @@ export class FoundryStepExecutor {
             : `https://${hostname}/auth/callback`;
         // An entry with `uses.auth` signs in at its own exact hostnames, one pair
         // of addresses each; a `*` adds none (`entryHostnames`).
-        const authEntry = org.hosting.entries.find((e) => e.key === action.key && e.uses?.auth);
         const hosts = authEntry ? entryHostnames(org, authEntry) : null;
         const created = await this.ports.zitadel.createOidcApp(zitadelOrgId, projectId, {
             name: action.key,
@@ -1567,15 +1665,7 @@ export class FoundryStepExecutor {
             // plain scope id, not `deliverSecret`. A native app signs in via
             // device code with no cookie session of its own, so its clientId is
             // never something an app's env needs.
-            context.recordScopeId(isCmsClient
-                ? CMS_CLIENT_ID_SCOPE_KEY
-                : isAgoraClient
-                    ? AGORA_CLIENT_ID_SCOPE_KEY
-                    : isBouleClient
-                        ? BOULE_CLIENT_ID_SCOPE_KEY
-                        : authEntry
-                            ? entryClientIdScopeKey(action.key)
-                            : APP_CLIENT_ID_SCOPE_KEY, created.clientId);
+            context.recordScopeId(clientIdScopeKey, created.clientId);
         }
         return { resourceId: created.appId };
     }
@@ -1608,9 +1698,19 @@ export class FoundryStepExecutor {
         if (existing)
             return existing;
         const found = await this.ports.coolify.findProjectByName(org.slug);
+        // #569: a project foundry did not create is never adopted. With no id
+        // recorded, a found project is reused only when it carries this org's
+        // mark, or holds no application or database (a crash between create and
+        // record). Refused before any write otherwise.
+        if (found && found.description !== coolifyProjectMark(org)) {
+            const resources = await this.ports.coolify.listResources?.(found.uuid);
+            if (!resources || resources.some((r) => r.kind !== 'environment')) {
+                throw new Error(`coolify project ${org.slug} (${found.uuid}) was not created by foundry for this org and may hold other resources: rename or delete it, then apply again`);
+            }
+        }
         const projectUuid = found
             ? found.uuid
-            : (await this.ports.coolify.createProject(org.slug)).uuid;
+            : (await this.ports.coolify.createProject(org.slug, coolifyProjectMark(org))).uuid;
         context.recordScopeId('coolify_project', projectUuid);
         return projectUuid;
     }
@@ -1694,6 +1794,10 @@ export class FoundryStepExecutor {
         let haveNames;
         let have;
         let appId;
+        // A stopped app with no settings marker was never deployed successfully
+        // (the marker is recorded only after the redeploy), e.g. a first deploy
+        // that failed: starting it builds nothing. A parked app has its marker.
+        let neverDeployed = false;
         if (existing) {
             appId = existing.uuid;
             // Found by name (rather than just created) is started back up if not
@@ -1705,6 +1809,7 @@ export class FoundryStepExecutor {
             live ??= await this.ports.coolify.getApplication(existing.uuid);
             if (!isRunningOrStarting(live.status)) {
                 await this.ports.coolify.raw('POST', `/applications/${existing.uuid}/start`);
+                neverDeployed = context.recordedIds()[settingsKey] === undefined;
             }
             have = appliedAppSettings(context.recordedIds(), entry.key);
             haveNames = appliedAppDomains(org, context.recordedIds(), entry.key);
@@ -1839,8 +1944,10 @@ export class FoundryStepExecutor {
         // that was already there is restarted, once, when its database URLs or its
         // declared appEnv changed.
         // A new folder needs a build, which a restart does not do, so a settings
-        // change deploys instead (rule 3), and that carries the env too.
-        if (settingsNeedDeploy) {
+        // change deploys instead (rule 3), and that carries the env too. A
+        // created app is never deployed by Coolify itself (create sends no
+        // `instant_deploy`), so it deploys here too (#566).
+        if (settingsNeedDeploy || !existing || neverDeployed) {
             // #543: every deploy waits for health through the shared helper, never
             // a fire-and-forget `deploy` call -- `names[0]` is the same hostname
             // `healthUrls` probes for this entry; an internal entry (no hostname)
@@ -1879,7 +1986,10 @@ export class FoundryStepExecutor {
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
         if (entry.key === APP_ENTRY_KEY) {
-            await this.ensureAppLettermintMail(appId, org, context, Boolean(existing), 
+            await this.ensureAppLettermintMail(appId, org, context, 
+            // Deployed or started above on every path, a created app included
+            // (#566), so it has read its env before the mail env is written.
+            true, 
             // #491 (review round 2, finding 3): `diff.ts`'s `planApps` always
             // sets `platformApex` on this step's `desired` once it's planned at
             // all -- `null` when no platform is declared, never omitted. The key
@@ -1908,9 +2018,9 @@ export class FoundryStepExecutor {
      * container itself still writing nowhere). `wasAlreadyRunning` tells this
      * method whether `appId` names an app `coolifyApp` found already there
      * (restart it once the volume is created) or one it just created fresh
-     * (already about to get its first deploy/start from
-     * `createGithubAppApplication`'s own instant-deploy path, so a restart
-     * here would only be a redundant extra one).
+     * (`coolifyApp` deploys it after this call, #566, and that first start
+     * carries the storage, so a restart here would only be a redundant extra
+     * one).
      */
     async ensureLogVolume(appId, org, wasAlreadyRunning, appName = org.slug) {
         const storages = await this.ports.coolify.listStorages(appId);
@@ -2420,7 +2530,7 @@ export class FoundryStepExecutor {
         await this.ports.coolify.bulkUpsertEnvs(appId, envUpdates);
         // A running container read its env at start and still holds the old
         // token, so a fresh one only reaches it through a restart -- before the
-        // old project is deleted below. A just-created app starts with the new env.
+        // old project is deleted below. A just-created app is deployed first (#566).
         if (!healthy && running)
             await this.ports.coolify.restart(appId);
         await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
@@ -4299,9 +4409,15 @@ export class FoundryStepExecutor {
         // (#115) gets one ingress entry per hostname `tunnelIngressHostnames`
         // returns, all routed to the same proxy -- Traefik itself, not this list,
         // is what tells the public site apart from the cms studio.
-        const ingress = tunnelIngressHostnames(org).map((hostname) => ({
+        // #568: the company's own login host goes straight to the platform's
+        // login app (the same container the platform auth tunnel routes to), not
+        // through Coolify's proxy, which has no route for it.
+        const loginHost = action.desired.loginHost ?? null;
+        const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
-            service: COOLIFY_PROXY_ORIGIN,
+            service: hostname === loginHost
+                ? `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`
+                : COOLIFY_PROXY_ORIGIN,
         }));
         await this.tunnelPort().putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
@@ -4366,7 +4482,7 @@ export class FoundryStepExecutor {
             const previousHostnamesRaw = recordedBefore[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY];
             const previousHostnames = previousHostnamesRaw ? previousHostnamesRaw.split(',') : [];
             const domainChanged = previousDomain !== undefined && previousDomain !== org.domain;
-            const publishedHostnames = await this.publishTunnelDnsRecords(org, org.domain, tunnel.id, 
+            const publishedHostnames = await this.publishTunnelDnsRecords(org, org.domain, loginHost, tunnel.id, 
             // Round 6 finding 2: every id this step has ever replaced, not only
             // the one `recordedTunnelId` captured above -- see the scope key's
             // own doc comment.
@@ -4529,7 +4645,7 @@ export class FoundryStepExecutor {
      * overwriting them. `destroy` and {@link deleteStaleTunnelDnsRecords}
      * both read this set.
      */
-    async publishTunnelDnsRecords(org, domain, tunnelId, previousIds, previousHostnames, context) {
+    async publishTunnelDnsRecords(org, domain, loginHost, tunnelId, previousIds, previousHostnames, context) {
         const dns = this.dnsPort();
         const zone = await this.zonePort().findZoneByApex(domain);
         if (!zone) {
@@ -4537,7 +4653,7 @@ export class FoundryStepExecutor {
         }
         const dnsTarget = `${tunnelId}.cfargotunnel.com`;
         const previousTargets = new Set([...previousIds].filter((id) => id !== tunnelId).map((id) => `${id}.cfargotunnel.com`));
-        const hostnames = tunnelDnsHostnames(org, domain);
+        const hostnames = tunnelDnsHostnames(org, domain, loginHost);
         const droppedHostnames = previousHostnames.filter((hostname) => !hostnames.includes(hostname));
         const conflicts = [];
         const toCreate = [];
@@ -4715,6 +4831,9 @@ export class FoundryStepExecutor {
             const parkedMailOrg = mailOrgFor(org, usesDomain, 'hosted');
             await this.ports.mail.parkOrgMail(parkedMailOrg, options);
             await this.parkLettermintMail(org, parkedMailOrg, context, platformApex, platformLettermintProjectId);
+            // #554: so a later declaration of hosted or received is not mistaken for applied.
+            context.recordScopeId(ORG_MAIL_APPLIED_MODE_SCOPE_KEY, mode);
+            context.recordScopeId(ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, String(usesDomain));
             return undefined;
         }
         const mailOrg = mailOrgFor(org, usesDomain, mode);
@@ -4722,12 +4841,16 @@ export class FoundryStepExecutor {
         await this.publishMailDnsRecords(org, result);
         await this.deleteStaleLettermintDomain(context, result.domain, platformApex);
         context.recordScopeId(MAIL_DOMAIN_SCOPE_KEY, result.domain);
-        // #177: what this step wrote from the platform, so `planMail` can see a later change.
-        context.recordScopeId(ORG_MAIL_APPLIED_APEX_SCOPE_KEY, options.apex);
-        context.recordScopeId(ORG_MAIL_APPLIED_HOST_SCOPE_KEY, options.mailHost);
         await this.ensureOwnerMailbox(org, mailOrg, options, context);
         await this.ensureOrgLettermintRelay(org, mailOrg, result.domain, context, platformApex, platformLettermintProjectId);
         await this.ensureRoleMailboxes(org, mailOrg, result.domain, options, context);
+        // #177, #554: what this step wrote, so `planMail` can see a later change
+        // and knows mail is applied. Last on purpose: a crash in the relay or a
+        // mailbox leaves these unrecorded, so the next plan still has the step.
+        context.recordScopeId(ORG_MAIL_APPLIED_APEX_SCOPE_KEY, options.apex);
+        context.recordScopeId(ORG_MAIL_APPLIED_HOST_SCOPE_KEY, options.mailHost);
+        context.recordScopeId(ORG_MAIL_APPLIED_MODE_SCOPE_KEY, mode);
+        context.recordScopeId(ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, String(usesDomain));
         return { resourceId: result.domain };
     }
     /**

package/dist/plan/hostnames.d.ts

@@ -36,8 +36,10 @@ export declare function filesShareHostname(org: DeclaredOrg): string | null;
  * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
  * #164): a site's two names, every entry's names, an own-domain calls name,
  * Agora's and Boule's, then the wildcard last. An org that does not host keeps the single
- * name it always had.
+ * name it always had. `loginHost` (#568) is the company's own `auth.<domain>`
+ * when it has one; it is listed before the wildcard, and the tunnel step routes
+ * it to the platform's login app, not to Coolify's proxy.
  */
-export declare function tunnelIngressHostnames(org: DeclaredOrg): string[];
+export declare function tunnelIngressHostnames(org: DeclaredOrg, loginHost?: string | null): string[];
 /** The ingress names that get a DNS record: those under the org's own domain. */
-export declare function tunnelDnsHostnames(org: DeclaredOrg, domain: string): string[];
+export declare function tunnelDnsHostnames(org: DeclaredOrg, domain: string, loginHost?: string | null): string[];

package/dist/plan/hostnames.js

@@ -61,9 +61,11 @@ export function filesShareHostname(org) {
  * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
  * #164): a site's two names, every entry's names, an own-domain calls name,
  * Agora's and Boule's, then the wildcard last. An org that does not host keeps the single
- * name it always had.
+ * name it always had. `loginHost` (#568) is the company's own `auth.<domain>`
+ * when it has one; it is listed before the wildcard, and the tunnel step routes
+ * it to the platform's login app, not to Coolify's proxy.
  */
-export function tunnelIngressHostnames(org) {
+export function tunnelIngressHostnames(org, loginHost = null) {
     const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [];
     if (org.hosting.enabled) {
         for (const entry of org.hosting.entries)
@@ -84,6 +86,8 @@ export function tunnelIngressHostnames(org) {
     const share = filesShareHostname(org);
     if (share)
         hostnames.push(share);
+    if (loginHost)
+        hostnames.push(loginHost);
     // The wildcard goes last: Cloudflare takes the first ingress rule that
     // matches, so every exact name above must come before `*.<domain>`.
     const wildcard = wildcardHostname(org);
@@ -92,6 +96,6 @@ export function tunnelIngressHostnames(org) {
     return [...new Set(hostnames)];
 }
 /** The ingress names that get a DNS record: those under the org's own domain. */
-export function tunnelDnsHostnames(org, domain) {
-    return tunnelIngressHostnames(org).filter((hostname) => hostname === domain || hostname.endsWith(`.${domain}`));
+export function tunnelDnsHostnames(org, domain, loginHost = null) {
+    return tunnelIngressHostnames(org, loginHost).filter((hostname) => hostname === domain || hostname.endsWith(`.${domain}`));
 }

package/dist/plan/login-host.d.ts

@@ -81,8 +81,15 @@ export interface LoginHostBindingsPort {
  * on the next run.
  */
 export declare const LOGIN_BINDING_SCOPE_KEY = "login_host_binding";
-/** The org's recorded app client ids (hosted app, each entry's own, cms, agora, boule), deduplicated and sorted. */
-export declare function loginHostClientIds(recorded: Readonly<Record<string, string>>): string[];
+/**
+ * #573: keys of the entries that sign in the customers organisation. The login
+ * host's binding admits the staff organisation only, so these entries stay
+ * out of it and sign in on the shared host. A recorded client id whose entry
+ * is no longer declared is not here, so it stays bound as before.
+ */
+export declare function customersEntryKeys(org: DeclaredOrg): Set<string>;
+/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
+export declare function loginHostClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string[];
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export declare function loginBindingState(host: string, clientIds: readonly string[]): string;
 /**
@@ -101,3 +108,11 @@ export declare const LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY = "zitadel_login_host_
 export declare function pendingRemovalHosts(recorded: Readonly<Record<string, string>>): string[];
 /** {@link pendingRemovalHosts}' own serialisation, sorted so the recorded value is stable regardless of check order. */
 export declare function pendingRemovalState(hosts: readonly string[]): string;
+/**
+ * #568: the company's own login host when the company tunnel has to publish
+ * it: `auth.<domain>`, only when it is under the org's own domain
+ * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
+ * the shared instance's and is routed by the platform auth tunnel. Otherwise
+ * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ */
+export declare function companyLoginTunnelHost(org: DeclaredOrg, isPlatformOrg: boolean): string | null;

package/dist/plan/login-host.js

@@ -55,15 +55,26 @@ export const LOGIN_HOST_SHARED_SCOPE_KEY = 'zitadel_login_host_shared';
  * on the next run.
  */
 export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
-/** The org's recorded app client ids (hosted app, each entry's own, cms, agora, boule), deduplicated and sorted. */
-export function loginHostClientIds(recorded) {
+/**
+ * #573: keys of the entries that sign in the customers organisation. The login
+ * host's binding admits the staff organisation only, so these entries stay
+ * out of it and sign in on the shared host. A recorded client id whose entry
+ * is no longer declared is not here, so it stays bound as before.
+ */
+export function customersEntryKeys(org) {
+    return new Set(org.hosting.entries.filter((e) => e.uses?.auth?.users === 'customers').map((e) => e.key));
+}
+/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
+export function loginHostClientIds(org, recorded) {
+    const customers = customersEntryKeys(org);
     const ids = [
         recorded[APP_CLIENT_ID_SCOPE_KEY],
         recorded[CMS_CLIENT_ID_SCOPE_KEY],
         recorded[AGORA_CLIENT_ID_SCOPE_KEY],
         recorded[BOULE_CLIENT_ID_SCOPE_KEY],
         ...Object.entries(recorded)
-            .filter(([key]) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX))
+            .filter(([key]) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX) &&
+            !customers.has(key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length)))
             .map(([, id]) => id),
     ].filter((id) => Boolean(id));
     return [...new Set(ids)].sort();
@@ -93,3 +104,13 @@ export function pendingRemovalHosts(recorded) {
 export function pendingRemovalState(hosts) {
     return [...hosts].sort().join(',');
 }
+/**
+ * #568: the company's own login host when the company tunnel has to publish
+ * it: `auth.<domain>`, only when it is under the org's own domain
+ * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
+ * the shared instance's and is routed by the platform auth tunnel. Otherwise
+ * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ */
+export function companyLoginTunnelHost(org, isPlatformOrg) {
+    return org.domain && org.issuer.usesDomain && !isPlatformOrg ? loginHostnameFor(org) : null;
+}

package/dist/plan/plan-apply.d.ts

@@ -9,7 +9,7 @@ import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js
 import { type AgoraHostPort } from './agora.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
-import { type HeldKeyResolver } from './platform-org.js';
+import { type EdgePortName, type HeldKeyResolver } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
@@ -142,6 +142,8 @@ export interface StepExecutionContext {
      * scope key can never collide with the `system:kind:key` form.
      */
     recordScopeId(key: string, id: string): void;
+    /** Removes a recorded id (any key form). Optional: a context without it cannot forget one. */
+    forgetId?(key: string): void;
     /**
      * Writes every id recorded so far to the store now, not only at the end of
      * the run. For an id that must survive a crash mid-step: the ai key's id
@@ -161,6 +163,14 @@ export interface StepExecutor {
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
+    /**
+     * #555: which of the edge-routed ports (`dns`, `zones`, `access`,
+     * `ratelimits`, `tunnels`) this executor was built with its own
+     * implementation of, which it uses before edge. The planner blocks a step
+     * that needs edge only if the port it needs is not listed here. Optional:
+     * an executor without it supplies none.
+     */
+    ownEdgePorts?(): Partial<Record<EdgePortName, boolean>>;
 }
 /**
  * #167: {@link StepExecutionContext}'s platform-scoped counterpart -- what
@@ -212,6 +222,10 @@ export interface PlatformStepExecutor {
         hc?: string;
         /** #540: see `PlanPlatformOptions.blocked.heartbeatsExecutorMissing` (`platform-diff.ts`). */
         heartbeatsExecutorMissing?: boolean;
+        /** See `PlanPlatformOptions.blocked.archonRunsInsideApp`. */
+        archonRunsInsideApp?: boolean;
+        /** See `PlanPlatformOptions.blocked.archonDeployRunning`. */
+        archonDeployRunning?: string;
     }>;
     /**
      * Steps whose live state differs from the declared one in a way the recorded

package/dist/plan/plan-apply.js

@@ -13,7 +13,7 @@ import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, dnsBlockedReason, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
@@ -773,6 +773,9 @@ export class FoundryPlanApply {
             recordScopeId: (key, id) => {
                 serviceIds[key] = id;
             },
+            forgetId: (key) => {
+                delete serviceIds[key];
+            },
             persistScopeIds: async () => {
                 await this.store.putAppliedState({
                     orgId,
@@ -938,7 +941,13 @@ export class FoundryPlanApply {
         catch {
             // not held
         }
-        return { ...readiness, mailKeyHeld, canHoldSecrets: typeof heldKeys?.put === 'function' };
+        return {
+            ...readiness,
+            mailKeyHeld,
+            canHoldSecrets: typeof heldKeys?.put === 'function',
+            dnsBlocked: dnsBlockedReason(platform, recorded),
+            ownEdgePorts: this.executor.ownEdgePorts?.(),
+        };
     }
     /**
      * #177: `AgoraHostValues` from the applied platform, the same
@@ -1171,7 +1180,7 @@ function destroyTargets(serviceIds, orgId) {
             continue;
         }
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
-            if (!resourceKey.startsWith(prefix))
+            if (!resourceKey.startsWith(prefix) || !id)
                 continue;
             // Archon#271: foundry did not create an adopted app or database, so it never deletes it.
             if (adopted.has(resourceKey))
@@ -1224,7 +1233,7 @@ function destroyTargets(serviceIds, orgId) {
         targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
     }
     for (const [resourceKey, id] of Object.entries(serviceIds)) {
-        if (!resourceKey.startsWith('zitadel:app:'))
+        if (!resourceKey.startsWith('zitadel:app:') || !id)
             continue;
         targets.push({
             system: 'zitadel',