@wtfalch/foundry 0.21.1 → 0.22.1

package/dist/plan/platform-diff.d.ts

@@ -135,6 +135,15 @@ export declare const PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY = "archon
  * values until someone redeploys by hand (#467).
  */
 export declare const PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY = "archon_envs_deployed_hash";
+/**
+ * The uuid of the deployment Archon's step triggered without waiting
+ * (`PlatformArchonDeps.runsInsideApp`), `pending` between the trigger and the
+ * moment its uuid is known. The next plan reads that deployment's status:
+ * running blocks the step, failed or unknown plans it again, finished lets the
+ * next run of the step confirm it (the integrations key-synced marker) and
+ * clear this.
+ */
+export declare const PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY = "archon_deployment";
 /**
  * #211 round 4: the broker app id Archon last registered its entry with.
  * `provisionPlatformArchon` reads the broker to register with from
@@ -414,6 +423,16 @@ export declare function platformMailMxHost(apex: string): string;
  */
 export declare const ORG_MAIL_APPLIED_APEX_SCOPE_KEY = "mail_applied_apex";
 export declare const ORG_MAIL_APPLIED_HOST_SCOPE_KEY = "mail_applied_host";
+/**
+ * #554: the mode and `usesDomain` the step last applied. No reader lists a
+ * live `coolify mail <org>` resource, so `planMail` decides "applied" from
+ * the record. Records written before these keys existed lack them; a
+ * missing mode vouches for `hosted` only, a missing `usesDomain` only when
+ * the declared domain equals the recorded `mail_domain`. A park records
+ * mode `off`.
+ */
+export declare const ORG_MAIL_APPLIED_MODE_SCOPE_KEY = "mail_applied_mode";
+export declare const ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY = "mail_applied_uses_domain";
 /**
  * The key of a hosting entry in a `coolify:app` or `cloudflare:access` step
  * and in the ids recorded for it: `<orgId>:<entry key>`, so a second entry
@@ -845,6 +864,15 @@ export interface PlanPlatformOptions {
          * steps" note in `platform-providers.ts`'s `FoundryPlatformStepExecutor.blockedSteps`.
          */
         heartbeatsApiKeyMissing?: boolean;
+        /**
+         * The host runs inside Archon's app (`PlatformArchonDeps.runsInsideApp`):
+         * Archon's step redeploys it, so it is ordered last in the plan, after
+         * every step that would otherwise be lost when the old container stops.
+         * Not a block.
+         */
+        archonRunsInsideApp?: boolean;
+        /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
+        archonDeployRunning?: string;
     };
     /**
      * Steps whose live state differs from the declared one in a way the recorded

package/dist/plan/platform-diff.js

@@ -156,6 +156,15 @@ export const PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY = 'archon_integra
  * values until someone redeploys by hand (#467).
  */
 export const PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY = 'archon_envs_deployed_hash';
+/**
+ * The uuid of the deployment Archon's step triggered without waiting
+ * (`PlatformArchonDeps.runsInsideApp`), `pending` between the trigger and the
+ * moment its uuid is known. The next plan reads that deployment's status:
+ * running blocks the step, failed or unknown plans it again, finished lets the
+ * next run of the step confirm it (the integrations key-synced marker) and
+ * clear this.
+ */
+export const PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY = 'archon_deployment';
 /**
  * #211 round 4: the broker app id Archon last registered its entry with.
  * `provisionPlatformArchon` reads the broker to register with from
@@ -451,6 +460,16 @@ export function platformMailMxHost(apex) {
  */
 export const ORG_MAIL_APPLIED_APEX_SCOPE_KEY = 'mail_applied_apex';
 export const ORG_MAIL_APPLIED_HOST_SCOPE_KEY = 'mail_applied_host';
+/**
+ * #554: the mode and `usesDomain` the step last applied. No reader lists a
+ * live `coolify mail <org>` resource, so `planMail` decides "applied" from
+ * the record. Records written before these keys existed lack them; a
+ * missing mode vouches for `hosted` only, a missing `usesDomain` only when
+ * the declared domain equals the recorded `mail_domain`. A park records
+ * mode `off`.
+ */
+export const ORG_MAIL_APPLIED_MODE_SCOPE_KEY = 'mail_applied_mode';
+export const ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY = 'mail_applied_uses_domain';
 /**
  * The key of a hosting entry in a `coolify:app` or `cloudflare:access` step
  * and in the ids recorded for it: `<orgId>:<entry key>`, so a second entry
@@ -969,8 +988,10 @@ export function planPlatform(platform, live, options = {}) {
     // #175: last, on purpose. Archon's sign-in client lives in the sign-in
     // `planAuth` builds, and its env reads what every other service's step
     // records or delivers, so in one apply it runs after all of them.
-    const archon = planArchon(platform, recordedIds, blocked.archon ?? dnsBlocked?.('Archon'), authReady, drifted.archon);
-    if (archon.step)
+    const archon = planArchon(platform, recordedIds, blocked.archon ?? dnsBlocked?.('Archon'), authReady, drifted.archon, blocked.archonDeployRunning);
+    // The host runs inside this app: its step ends by redeploying the process
+    // that runs the plan, so it goes after everything else (pushed below).
+    if (archon.step && !blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
     // #257: after every service above, so a database any of them just
     // recorded is already visible to `recordedIds` on this same plan.
@@ -982,6 +1003,8 @@ export function planPlatform(platform, live, options = {}) {
     const heartbeats = planHeartbeats(platform, recordedIds, hcReady, blocked.heartbeatsExecutorMissing ?? false, blocked.heartbeatsApiKeyMissing ?? false);
     if (heartbeats.step)
         plannedSteps.push(heartbeats.step);
+    if (archon.step && blocked.archonRunsInsideApp)
+        plannedSteps.push(archon.step);
     // #251: one line per service whose recorded applied ref no longer matches
     // what the next apply would use (or, for zitadel, what is actually live).
     // Never pushed into `plannedSteps` -- see `VersionChangeItem`'s own doc
@@ -2227,9 +2250,12 @@ function planAi(platform, recordedIds, executorBlocked) {
  * ({@link PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY}) plans the step again, as
  * {@link planAuth} does.
  */
-function planArchon(platform, recordedIds, executorBlocked, authReady, drifted) {
+function planArchon(platform, recordedIds, executorBlocked, authReady, drifted, deployRunning) {
     if (!platform.archon.enabled)
         return { step: null, blocked: null };
+    // A deploy the step triggered is still running: planning it again would deploy twice.
+    if (deployRunning)
+        return { step: null, blocked: deployRunning };
     const key = resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY);
     const applied = Boolean(recordedIds[key]) &&
         Boolean(recordedIds[PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY]) &&

package/dist/plan/platform-org.d.ts

@@ -35,6 +35,8 @@ export declare const NO_DOMAIN_MAIL_APEX = "oikos.host";
  * names the same "positional arguments that shifted on every merge" problem
  * this avoids).
  */
+/** The edge-routed ports an executor may be given its own implementation of. */
+export type EdgePortName = 'dns' | 'zones' | 'access' | 'ratelimits' | 'tunnels';
 export interface OrgPlatformReadiness {
     /**
      * `null` until the platform's own mail server (#169) is enabled and
@@ -96,6 +98,22 @@ export interface OrgPlatformReadiness {
      * used to say there was none; N1 is no longer deployed by hand).
      */
     edgeReady: boolean;
+    /**
+     * #555: why a company step that writes through edge cannot run yet, `null`
+     * or absent when none is blocked. DNS records, zones, Access apps, rate
+     * limit rules and tunnels all go through edge unless the host supplies its
+     * own port ({@link ownEdgePorts}); while edge is not applied, `diff.ts`
+     * reports each such step blocked instead of planning one that would fail
+     * half way.
+     */
+    dnsBlocked?: string | null;
+    /**
+     * #555: the edge-routed ports the host's executor supplies itself
+     * (`FoundryStepExecutorPorts.dns` / `zones` / `access` / `ratelimits` /
+     * `tunnels`). The executor uses these before edge, so a step that needs
+     * only these is not blocked by {@link dnsBlocked}.
+     */
+    ownEdgePorts?: Partial<Record<EdgePortName, boolean>>;
     /** `https://<platform.edge.hostname>`, which an entry with `uses.edge` gets as `EDGE_URL`. `null` until `edgeReady`. */
     edgeUrl?: string | null;
     /**
@@ -149,6 +167,16 @@ export interface HeldKeyResolver {
  * (which could carry provider detail) goes nowhere.
  */
 export declare function heldPlatformKeyRefs(heldKeys: HeldKeyResolver): Promise<Set<string>>;
+/**
+ * #555: the reason no company step may write DNS yet, `null` when one may.
+ * Every DNS record, zone, Access app, rate limit rule and tunnel call goes
+ * through edge unless the host supplies its own port
+ * ({@link OrgPlatformReadiness.ownEdgePorts}), so edge must be enabled and
+ * applied (the same check as `edgeReady`, without the host-port half). {@link FoundryPlanApply} sets
+ * {@link OrgPlatformReadiness.dnsBlocked} from this; the pure
+ * {@link orgPlatformReadinessFrom} leaves it unset (nothing blocked).
+ */
+export declare function dnsBlockedReason(platform: DeclaredPlatform, platformRecordedIds: Readonly<Record<string, string>>): string | null;
 /**
  * `FoundryPlanApply.computeFreshPlan`'s own precedent for turning a
  * `PlatformStore`'s `get()`/`getServiceIds()` into what an org's plan needs.

package/dist/plan/platform-org.js

@@ -63,6 +63,23 @@ export async function heldPlatformKeyRefs(heldKeys) {
 function coolifyAppApplied(platformRecordedIds, key) {
     return Boolean(platformRecordedIds[`coolify:app:${key}`]);
 }
+/**
+ * #555: the reason no company step may write DNS yet, `null` when one may.
+ * Every DNS record, zone, Access app, rate limit rule and tunnel call goes
+ * through edge unless the host supplies its own port
+ * ({@link OrgPlatformReadiness.ownEdgePorts}), so edge must be enabled and
+ * applied (the same check as `edgeReady`, without the host-port half). {@link FoundryPlanApply} sets
+ * {@link OrgPlatformReadiness.dnsBlocked} from this; the pure
+ * {@link orgPlatformReadinessFrom} leaves it unset (nothing blocked).
+ */
+export function dnsBlockedReason(platform, platformRecordedIds) {
+    if (!platform.edge.enabled) {
+        return 'every DNS record is written through edge, and the platform does not enable edge';
+    }
+    return coolifyAppApplied(platformRecordedIds, PLATFORM_EDGE_KEY)
+        ? null
+        : 'every DNS record is written through edge, and edge is not applied yet';
+}
 /**
  * `FoundryPlanApply.computeFreshPlan`'s own precedent for turning a
  * `PlatformStore`'s `get()`/`getServiceIds()` into what an org's plan needs.

package/dist/plan/platform-providers.d.ts

@@ -290,6 +290,8 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         hc?: string;
         heartbeatsExecutorMissing?: boolean;
         heartbeatsApiKeyMissing?: boolean;
+        archonRunsInsideApp?: boolean;
+        archonDeployRunning?: string;
     }>;
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
@@ -328,6 +330,8 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private executeSfu;
     private coolifyJobs;
 }
+export declare const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = "platform-auth-login";
+export declare const AUTH_LOGIN_PORT = "3000";
 /**
  * Every ZITADEL OIDC/management/console/asset path -- `deploy/proxy/Caddyfile`'s
  * own explicit list, restated here as one regex since the tunnel routes by a
@@ -474,7 +478,7 @@ export interface PlatformMailRuntime {
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment'>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -493,6 +497,15 @@ export interface PlatformArchonDeps {
      * Access app nobody can pass.
      */
     accessEmails: readonly string[];
+    /**
+     * True when the host process runs inside the Coolify app this step
+     * redeploys (Archon's console is `platform:archon`). A deploy that waits
+     * would be killed with the old container, so the step then records every
+     * applied marker first, and triggers the deploy last, without waiting.
+     * The planner puts the step last in the plan. Next plan: the step runs
+     * again only if the app is not running (`archonRedeployFailed`).
+     */
+    runsInsideApp?: boolean;
     /**
      * Reads a secret an earlier step handed to the host through
      * `deliverSecret`, or `null` when none is held under `ref` yet -- the same

package/dist/plan/platform-providers.js

@@ -8,7 +8,7 @@ import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment,
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -318,6 +318,18 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
+        // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
+        if (this.archon?.runsInsideApp) {
+            blocked.archonRunsInsideApp = true;
+            // A deploy the step triggered and did not wait for: while it runs, a
+            // second deploy must not be planned.
+            const deployment = recordedIds[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY];
+            if (platform.archon.enabled &&
+                deployment &&
+                (await archonDeploymentState(this.archon.coolify, deployment)) === 'running') {
+                blocked.archonDeployRunning = `Archon is blocked, not planned: its deployment ${deployment} is still running; plan again when it has finished`;
+            }
+        }
         return blocked;
     }
     /**
@@ -347,7 +359,18 @@ export class FoundryPlatformStepExecutor {
                 !brokerDrifted &&
                 !bootstrapOperatorDrifted &&
                 (await archonRollingUpdateDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]));
-            if (accessDrifted || brokerDrifted || bootstrapOperatorDrifted || rollingUpdateDrifted)
+            // The deployment the step triggered failed or Coolify does not know it:
+            // plan the step again, which deploys again. A finished one is confirmed
+            // by the next run of the step (keys-synced), see `provisionPlatformArchon`.
+            const deployment = recordedIds[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY];
+            const redeployFailed = this.archon.runsInsideApp === true &&
+                Boolean(deployment) &&
+                (await archonDeploymentState(this.archon.coolify, deployment)) === 'failed';
+            if (accessDrifted ||
+                brokerDrifted ||
+                bootstrapOperatorDrifted ||
+                rollingUpdateDrifted ||
+                redeployFailed)
                 result.archon = true;
         }
         if (platform.auth.enabled && this.auth) {
@@ -672,7 +695,7 @@ const PLATFORM_AUTH_BROKER_APP_NAME = 'platform-auth-broker';
  * header and so cannot give two different apps the same public hostname.
  */
 const PLATFORM_AUTH_ZITADEL_INTERNAL_NAME = 'platform-auth-zitadel';
-const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = 'platform-auth-login';
+export const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = 'platform-auth-login';
 const PLATFORM_AUTH_BROKER_INTERNAL_NAME = 'platform-auth-broker';
 const PLATFORM_AUTH_TUNNEL_NAME = 'platform-auth-tunnel';
 /** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_AUTH_TUNNEL_NAME}. */
@@ -691,7 +714,7 @@ const AUTH_BROKER_DOCKERFILE = '/broker/Dockerfile';
  * own `ZITADEL_PORT: 8080` and the login image's own `EXPOSE`.
  */
 const AUTH_ZITADEL_PORT = '8080';
-const AUTH_LOGIN_PORT = '3000';
+export const AUTH_LOGIN_PORT = '3000';
 /** `broker/Dockerfile`'s own `ENV PORT=3000` / `EXPOSE 3000`. */
 const AUTH_BROKER_PORT = '3000';
 /**
@@ -2600,6 +2623,7 @@ async function provisionPlatformArchon(context, deps) {
     const appliedGitRef = recorded[PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY];
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
+    const selfRedeploy = deps.runsInsideApp === true;
     if (deps.accessEmails.length === 0) {
         throw new Error('platform:archon: no Access emails given; refusing to put Archon behind an Access app nobody can pass');
     }
@@ -3030,7 +3054,17 @@ async function provisionPlatformArchon(context, deps) {
     // patch above actually takes effect on the running container, not just on
     // Coolify's stored config.
     const rollingUpdateApplied = recorded[PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY] === '1';
-    const archonDeployedNow = keyUnsynced ||
+    // The deployment an earlier run triggered without waiting: read before
+    // deciding whether to deploy again.
+    const priorDeployment = selfRedeploy ? recorded[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY] : undefined;
+    const deployState = priorDeployment
+        ? await archonDeploymentState(deps.coolify, priorDeployment)
+        : 'none';
+    if (deployState === 'running' || deployState === 'unreadable') {
+        throw new Error(`platform:archon: the deployment ${priorDeployment} cannot be confirmed yet (${deployState === 'running' ? 'still running' : 'status unreadable'}); plan again later`);
+    }
+    const archonDeployedNow = (keyUnsynced && deployState !== 'finished') ||
+        deployState === 'failed' ||
         app.justCreated ||
         !app.running ||
         changed ||
@@ -3039,7 +3073,7 @@ async function provisionPlatformArchon(context, deps) {
         appliedGitRef !== gitRef ||
         !rollingUpdateApplied ||
         recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] !== hostname;
-    if (archonDeployedNow) {
+    if (archonDeployedNow && !selfRedeploy) {
         // #467: cleared before the deploy below is even attempted, not after --
         // a deploy that then fails, or a crash before `waitForHealthyVersion`
         // passes, must leave this run's attempt unconfirmed. Recording it only
@@ -3111,13 +3145,14 @@ async function provisionPlatformArchon(context, deps) {
     // Coolify's own deployment record finished, which is what actually closes
     // the loophole named in #252 (an old container staying healthy while the
     // deployment itself fails).
-    if (archonDeployedNow) {
+    if (archonDeployedNow && !selfRedeploy) {
         await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
     }
     // #398: the deployment finished and answers health, so Archon now runs with
     // the key id its env carries. `provisionPlatformIntegrations` drops the
     // previous public key only on this marker.
-    if (keyUnsynced && integrationsKeyId) {
+    // With `runsInsideApp` only once Coolify's deployment record says it finished.
+    if (keyUnsynced && integrationsKeyId && (!selfRedeploy || deployState === 'finished')) {
         await record(PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, integrationsKeyId);
     }
     // #475: confirmed only now, after the health check above has passed on a
@@ -3140,6 +3175,36 @@ async function provisionPlatformArchon(context, deps) {
     // it.
     await record(PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, brokerAppId);
     await record(PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, bootstrapOperator ?? 'none');
+    // The host runs inside this app: every marker is recorded above, so the
+    // deploy goes last and is not waited for -- the old container stops during
+    // it, and the response, the lease and the audit row must be done first.
+    if (selfRedeploy && !archonDeployedNow && deployState === 'finished') {
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, ''); // confirmed above
+    }
+    if (selfRedeploy && archonDeployedNow) {
+        await record(`coolify:app:${PLATFORM_ARCHON_KEY}`, appId);
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, 'pending');
+        let deploymentUuid;
+        try {
+            // `force` takes the branch that always creates a real deployment record
+            // (a skipped one answers with a uuid Coolify never stored).
+            const started = (await deps.coolify.deploy(appId, true));
+            const uuid = Array.isArray(started) ? started[0]?.deployment_uuid : undefined;
+            if (typeof uuid !== 'string' || !uuid) {
+                throw new Error('platform:archon: Coolify answered the deploy with no deployment_uuid');
+            }
+            deploymentUuid = uuid;
+        }
+        catch (error) {
+            // Not triggered: forget the applied ref so the next plan runs the step again.
+            await record(PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, '');
+            await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, '');
+            throw error;
+        }
+        // The next plan reads this deployment's status; a kill before this write
+        // leaves `pending`, which that plan reads as unconfirmed and plans again.
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, deploymentUuid);
+    }
     return { resourceId: appId };
 }
 // #211 round 6: mirrors `wtfalch/auth/broker/src/apps.ts`'s own `isValidFrom`
@@ -3560,6 +3625,28 @@ async function archonBootstrapOperatorDrifted(coolify, appId, recordedIds) {
  * version of this check never actually fired. `custom_network_aliases` and
  * `health_check_enabled` are both top-level there.
  */
+/**
+ * The state of the deployment Archon's step triggered without waiting
+ * (`PlatformArchonDeps.runsInsideApp`), from Coolify's own deployment record:
+ * `running` (queued or in progress), `finished`, `failed` (failed, cancelled,
+ * its uuid never recorded, or unknown to Coolify -- a 404), or `unreadable`
+ * for any other error. Status and a served request cannot tell a failed build
+ * from a success (the old container keeps serving), so this record is the
+ * only honest answer.
+ */
+async function archonDeploymentState(coolify, deploymentUuid) {
+    if (deploymentUuid === 'pending')
+        return 'failed';
+    try {
+        const { status } = await coolify.getDeployment(deploymentUuid);
+        if (status === 'queued' || status === 'in_progress')
+            return 'running';
+        return status === 'finished' ? 'finished' : 'failed';
+    }
+    catch (error) {
+        return isNotFoundError(error) ? 'failed' : 'unreadable';
+    }
+}
 async function archonRollingUpdateDrifted(coolify, appId) {
     if (!appId)
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.21.1",
+  "version": "0.22.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -37,6 +37,7 @@
     "calls-sfu:deploy": "node scripts/calls-sfu-deploy.mjs"
   },
   "peerDependencies": {
+    "@wtfalch/providers": ">=0.7.4",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
@@ -44,7 +45,7 @@
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/edge": "0.9.0",
     "@wtfalch/email": "^0.17.0",
-    "@wtfalch/providers": "0.7.3",
+    "@wtfalch/providers": "0.7.5",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },