@wtfalch/foundry 0.22.0 → 0.22.1

package/dist/plan/diff.js

@@ -7,7 +7,7 @@ import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
@@ -102,7 +102,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
     // Planned ahead of everything that needs the zone live (#238); its own step
-    // is still pushed in its usual place below.
+    // is pushed just below, before mail.
     const zone = planZone(org, byKey, claimed);
     const zoneWaiting = zone.blocked !== null;
     const zoneBlocked = [];
@@ -110,6 +110,15 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const dnsBlocked = [];
     // #553: a ZITADEL app provision whose app id is recorded needs the typed confirmation.
     const guardApp = (step) => guardAppProvision(step, org, recordedIds);
+    // #567: before the first step that reads the zone (mail, the tunnel, the
+    // rate limit), so a domain with no zone yet gets it provisioned first.
+    const zoneReason = zone.step ? edgeNeeded(platformReadiness, ['zones']) : null;
+    if (zone.step && zoneReason) {
+        dnsBlocked.push(edgeBlockedItem(org, 'Cloudflare zone', 'cloudflare:zone', zoneReason));
+    }
+    else if (zone.step) {
+        plannedSteps.push(zone.step);
+    }
     const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId);
     // #238: own-domain mail publishes DNS records into the zone, so it waits for
     // an active zone -- blocked, not planned (rule 2).
@@ -241,7 +250,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const edgeReservedLabels = planEdgeReservedLabels(org, recordedIds, platformReadiness, options.platformHostnames ?? []);
     if (edgeReservedLabels.step)
         plannedSteps.push(edgeReservedLabels.step);
-    const tunnel = planTunnel(org, byKey, claimed, recordedIds);
+    const tunnel = planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformReadiness.platformApex);
     // #238: a tunnel that is being provisioned waits for an active zone; parking
     // one never does.
     // #555: provisioning writes the tunnel config, the zone lookup and DNS; a
@@ -267,13 +276,6 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     else if (tunnel) {
         plannedSteps.push(tunnel);
     }
-    const zoneReason = zone.step ? edgeNeeded(platformReadiness, ['zones']) : null;
-    if (zone.step && zoneReason) {
-        dnsBlocked.push(edgeBlockedItem(org, 'Cloudflare zone', 'cloudflare:zone', zoneReason));
-    }
-    else if (zone.step) {
-        plannedSteps.push(zone.step);
-    }
     // Right after the zone (#43): `cloudflareRateLimit` resolves the zone by
     // apex domain, so the zone step above must already have run (or the zone
     // must already exist live) by the time this one's action executes.
@@ -741,7 +743,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // nothing else here would replan the step to retry it.
     if (recordedIds[key] === host &&
         recordedIds[LOGIN_BINDING_SCOPE_KEY] ===
-            loginBindingState(host, loginHostClientIds(recordedIds)) &&
+            loginBindingState(host, loginHostClientIds(org, recordedIds)) &&
         pendingRemovalHosts(recordedIds).length === 0) {
         return none;
     }
@@ -2432,7 +2434,7 @@ function sortedNames(names) {
  * domain) plans no per-org tunnel for Agora: `<slug>-agora.oikos.host` rides
  * the shared `*.oikos.host` wildcard tunnel (`scripts/shared-ingress.mjs`).
  */
-function planTunnel(org, byKey, claimed, recordedIds) {
+function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApex) {
     const desired = (org.hosting.tunnel && org.hosting.usesDomain && Boolean(org.domain)) ||
         (org.site.enabled && Boolean(org.domain)) ||
         (org.calls.enabled && org.calls.usesDomain && Boolean(org.domain)) ||
@@ -2449,6 +2451,16 @@ function planTunnel(org, byKey, claimed, recordedIds) {
             return live.config.enabled !== false;
         return desired ? status !== 'down' : status === 'healthy' || status === 'degraded';
     });
+    // #568: the company's own login host is routed by the step, so a first
+    // provision carries it too; a park does not. Without a known platform apex
+    // the platform's own org cannot be told apart, so none is planned.
+    const loginHost = platformApex ? companyLoginTunnelHost(org, isPlatformOrg) : null;
+    if (toggled && toggled.action.desired.enabled !== false && loginHost) {
+        return {
+            ...toggled,
+            action: { ...toggled.action, desired: { ...toggled.action.desired, loginHost } },
+        };
+    }
     if (toggled || !desired)
         return toggled;
     // A live, enabled tunnel re-plans the same step again when either:
@@ -2472,12 +2484,18 @@ function planTunnel(org, byKey, claimed, recordedIds) {
     const published = recordedIds[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY];
     const edgeChanged = published !== undefined &&
         org.domain !== null &&
-        sortedNames(published.split(',')) !== sortedNames(tunnelDnsHostnames(org, org.domain));
+        sortedNames(published.split(',')) !==
+            sortedNames(tunnelDnsHostnames(org, org.domain, loginHost));
     const dnsStale = recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain || edgeChanged;
     if (!connectorMissing && !dnsStale)
         return null;
     return {
-        action: { system: 'cloudflare', kind: 'tunnel', key: org.id, desired: { enabled: true } },
+        action: {
+            system: 'cloudflare',
+            kind: 'tunnel',
+            key: org.id,
+            desired: loginHost ? { enabled: true, loginHost } : { enabled: true },
+        },
         step: {
             description: connectorMissing
                 ? `run a cloudflared connector for ${org.slug}'s Cloudflare tunnel`

package/dist/plan/executor.d.ts

@@ -13,27 +13,6 @@ import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
-/**
- * The real {@link StepExecutor} (#20 "provision Company Factory end to
- * end"): makes each {@link StepAction} `diff.ts` plans true against a real
- * Coolify, Cloudflare and ZITADEL, plus per-org organisations, spend limits
- * and (for AI) offers on Files and AI (#80). Scope and design are exactly
- * what `.claude/decisions-2026-09-24-executor.md`'s "Executor decisions"
- * section settled, referenced by name at each dispatch branch below.
- *
- * Built entirely from narrow ports (interfaces), never a concrete
- * `@wtfalch/providers` client: this package holds no credential and never
- * will (executor decisions: "the executor is constructed with narrow ports
- * ... a host [archon] supplies real clients. How the host gets provider
- * tokens from the keys Worker is the host's job, not this campaign's").
- * Every port method here is named and shaped to match a real method on
- * `@wtfalch/providers`' `CoolifyClient`/`CloudflareClient`/`ZitadelClient`
- * (checked against `providers` `origin/main`, 2026-09-24), or on
- * `@wtfalch/files`'/`@wtfalch/ai`'s own SDK clients (#80, checked against
- * each repo's own `main`, 2026-09-25), so a real client satisfies the port
- * structurally, with no adapter needed — see each port's own doc comment for
- * the one real method it does not yet have.
- */
 /**
  * The Coolify calls this executor makes, shaped to match
  * `@wtfalch/providers/coolify`'s `CoolifyClient` method-for-method — a real
@@ -54,10 +33,19 @@ export interface CoolifyPort {
     findProjectByName(name: string): Promise<{
         uuid: string;
         name: string;
+        description?: string | null;
     } | null>;
     createProject(name: string, description?: string): Promise<{
         uuid: string;
     }>;
+    /**
+     * #569: what a project holds (`CoolifyClient.listResources`: its
+     * environments, applications and databases). Optional: without it an
+     * unmarked project cannot be shown empty, so it is refused.
+     */
+    listResources?(projectUuid: string): Promise<Array<{
+        kind: string;
+    }>>;
     findOrCreateEnvironment(projectUuid: string, name: string): Promise<{
         environment: {
             id: number;
@@ -1801,9 +1789,9 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * container itself still writing nowhere). `wasAlreadyRunning` tells this
      * method whether `appId` names an app `coolifyApp` found already there
      * (restart it once the volume is created) or one it just created fresh
-     * (already about to get its first deploy/start from
-     * `createGithubAppApplication`'s own instant-deploy path, so a restart
-     * here would only be a redundant extra one).
+     * (`coolifyApp` deploys it after this call, #566, and that first start
+     * carries the storage, so a restart here would only be a redundant extra
+     * one).
      */
     private ensureLogVolume;
     private coolifyDatabase;

package/dist/plan/executor.js

@@ -21,12 +21,38 @@ import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
-import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
+/**
+ * The real {@link StepExecutor} (#20 "provision Company Factory end to
+ * end"): makes each {@link StepAction} `diff.ts` plans true against a real
+ * Coolify, Cloudflare and ZITADEL, plus per-org organisations, spend limits
+ * and (for AI) offers on Files and AI (#80). Scope and design are exactly
+ * what `.claude/decisions-2026-09-24-executor.md`'s "Executor decisions"
+ * section settled, referenced by name at each dispatch branch below.
+ *
+ * Built entirely from narrow ports (interfaces), never a concrete
+ * `@wtfalch/providers` client: this package holds no credential and never
+ * will (executor decisions: "the executor is constructed with narrow ports
+ * ... a host [archon] supplies real clients. How the host gets provider
+ * tokens from the keys Worker is the host's job, not this campaign's").
+ * Every port method here is named and shaped to match a real method on
+ * `@wtfalch/providers`' `CoolifyClient`/`CloudflareClient`/`ZitadelClient`
+ * (checked against `providers` `origin/main`, 2026-09-24), or on
+ * `@wtfalch/files`'/`@wtfalch/ai`'s own SDK clients (#80, checked against
+ * each repo's own `main`, 2026-09-25), so a real client satisfies the port
+ * structurally, with no adapter needed — see each port's own doc comment for
+ * the one real method it does not yet have.
+ */
+/** #569: the description foundry gives the Coolify project it creates for an org. */
+const COOLIFY_PROJECT_MARK_PREFIX = 'foundry org ';
+function coolifyProjectMark(org) {
+    return `${COOLIFY_PROJECT_MARK_PREFIX}${org.id}`;
+}
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
@@ -1330,7 +1356,7 @@ export class FoundryStepExecutor {
         // The platform's own shared sign-in host: already trusted and routed by
         // the shared instance, so it gets no trusted domain or binding here.
         const shared = action.desired.shared === true;
-        const clientIds = loginHostClientIds(recorded);
+        const clientIds = loginHostClientIds(org, recorded);
         if (!shared) {
             await this.ports.zitadel.ensureTrustedDomain(host);
             // zitadel-login's own routing table, written before any app is repointed
@@ -1340,13 +1366,16 @@ export class FoundryStepExecutor {
         // Only apps whose client id the binding now holds: any other app in the
         // project would lose sign-in. The rest move on a later run, once the
         // recorded client ids differ from the binding and replan this step.
+        const customersKeys = customersEntryKeys(org);
         const boundAppIds = new Set([
             ...(recorded[APP_CLIENT_ID_SCOPE_KEY]
                 ? org.hosting.issuerApps.filter((a) => a.kind === 'web').map((a) => a.name)
                 : []),
             ...Object.keys(recorded)
                 .filter((key) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX))
-                .map((key) => key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length)),
+                .map((key) => key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length))
+                // #573: a customers entry signs in on the shared host.
+                .filter((name) => !customersKeys.has(name)),
             ...(recorded[CMS_CLIENT_ID_SCOPE_KEY] ? ['cms'] : []),
             ...(recorded[AGORA_CLIENT_ID_SCOPE_KEY] ? ['agora'] : []),
             ...(recorded[BOULE_CLIENT_ID_SCOPE_KEY] ? ['boule'] : []),
@@ -1669,9 +1698,19 @@ export class FoundryStepExecutor {
         if (existing)
             return existing;
         const found = await this.ports.coolify.findProjectByName(org.slug);
+        // #569: a project foundry did not create is never adopted. With no id
+        // recorded, a found project is reused only when it carries this org's
+        // mark, or holds no application or database (a crash between create and
+        // record). Refused before any write otherwise.
+        if (found && found.description !== coolifyProjectMark(org)) {
+            const resources = await this.ports.coolify.listResources?.(found.uuid);
+            if (!resources || resources.some((r) => r.kind !== 'environment')) {
+                throw new Error(`coolify project ${org.slug} (${found.uuid}) was not created by foundry for this org and may hold other resources: rename or delete it, then apply again`);
+            }
+        }
         const projectUuid = found
             ? found.uuid
-            : (await this.ports.coolify.createProject(org.slug)).uuid;
+            : (await this.ports.coolify.createProject(org.slug, coolifyProjectMark(org))).uuid;
         context.recordScopeId('coolify_project', projectUuid);
         return projectUuid;
     }
@@ -1755,6 +1794,10 @@ export class FoundryStepExecutor {
         let haveNames;
         let have;
         let appId;
+        // A stopped app with no settings marker was never deployed successfully
+        // (the marker is recorded only after the redeploy), e.g. a first deploy
+        // that failed: starting it builds nothing. A parked app has its marker.
+        let neverDeployed = false;
         if (existing) {
             appId = existing.uuid;
             // Found by name (rather than just created) is started back up if not
@@ -1766,6 +1809,7 @@ export class FoundryStepExecutor {
             live ??= await this.ports.coolify.getApplication(existing.uuid);
             if (!isRunningOrStarting(live.status)) {
                 await this.ports.coolify.raw('POST', `/applications/${existing.uuid}/start`);
+                neverDeployed = context.recordedIds()[settingsKey] === undefined;
             }
             have = appliedAppSettings(context.recordedIds(), entry.key);
             haveNames = appliedAppDomains(org, context.recordedIds(), entry.key);
@@ -1900,8 +1944,10 @@ export class FoundryStepExecutor {
         // that was already there is restarted, once, when its database URLs or its
         // declared appEnv changed.
         // A new folder needs a build, which a restart does not do, so a settings
-        // change deploys instead (rule 3), and that carries the env too.
-        if (settingsNeedDeploy) {
+        // change deploys instead (rule 3), and that carries the env too. A
+        // created app is never deployed by Coolify itself (create sends no
+        // `instant_deploy`), so it deploys here too (#566).
+        if (settingsNeedDeploy || !existing || neverDeployed) {
             // #543: every deploy waits for health through the shared helper, never
             // a fire-and-forget `deploy` call -- `names[0]` is the same hostname
             // `healthUrls` probes for this entry; an internal entry (no hostname)
@@ -1940,7 +1986,10 @@ export class FoundryStepExecutor {
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
         if (entry.key === APP_ENTRY_KEY) {
-            await this.ensureAppLettermintMail(appId, org, context, Boolean(existing), 
+            await this.ensureAppLettermintMail(appId, org, context, 
+            // Deployed or started above on every path, a created app included
+            // (#566), so it has read its env before the mail env is written.
+            true, 
             // #491 (review round 2, finding 3): `diff.ts`'s `planApps` always
             // sets `platformApex` on this step's `desired` once it's planned at
             // all -- `null` when no platform is declared, never omitted. The key
@@ -1969,9 +2018,9 @@ export class FoundryStepExecutor {
      * container itself still writing nowhere). `wasAlreadyRunning` tells this
      * method whether `appId` names an app `coolifyApp` found already there
      * (restart it once the volume is created) or one it just created fresh
-     * (already about to get its first deploy/start from
-     * `createGithubAppApplication`'s own instant-deploy path, so a restart
-     * here would only be a redundant extra one).
+     * (`coolifyApp` deploys it after this call, #566, and that first start
+     * carries the storage, so a restart here would only be a redundant extra
+     * one).
      */
     async ensureLogVolume(appId, org, wasAlreadyRunning, appName = org.slug) {
         const storages = await this.ports.coolify.listStorages(appId);
@@ -2481,7 +2530,7 @@ export class FoundryStepExecutor {
         await this.ports.coolify.bulkUpsertEnvs(appId, envUpdates);
         // A running container read its env at start and still holds the old
         // token, so a fresh one only reaches it through a restart -- before the
-        // old project is deleted below. A just-created app starts with the new env.
+        // old project is deleted below. A just-created app is deployed first (#566).
         if (!healthy && running)
             await this.ports.coolify.restart(appId);
         await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
@@ -4360,9 +4409,15 @@ export class FoundryStepExecutor {
         // (#115) gets one ingress entry per hostname `tunnelIngressHostnames`
         // returns, all routed to the same proxy -- Traefik itself, not this list,
         // is what tells the public site apart from the cms studio.
-        const ingress = tunnelIngressHostnames(org).map((hostname) => ({
+        // #568: the company's own login host goes straight to the platform's
+        // login app (the same container the platform auth tunnel routes to), not
+        // through Coolify's proxy, which has no route for it.
+        const loginHost = action.desired.loginHost ?? null;
+        const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
-            service: COOLIFY_PROXY_ORIGIN,
+            service: hostname === loginHost
+                ? `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`
+                : COOLIFY_PROXY_ORIGIN,
         }));
         await this.tunnelPort().putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
@@ -4427,7 +4482,7 @@ export class FoundryStepExecutor {
             const previousHostnamesRaw = recordedBefore[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY];
             const previousHostnames = previousHostnamesRaw ? previousHostnamesRaw.split(',') : [];
             const domainChanged = previousDomain !== undefined && previousDomain !== org.domain;
-            const publishedHostnames = await this.publishTunnelDnsRecords(org, org.domain, tunnel.id, 
+            const publishedHostnames = await this.publishTunnelDnsRecords(org, org.domain, loginHost, tunnel.id, 
             // Round 6 finding 2: every id this step has ever replaced, not only
             // the one `recordedTunnelId` captured above -- see the scope key's
             // own doc comment.
@@ -4590,7 +4645,7 @@ export class FoundryStepExecutor {
      * overwriting them. `destroy` and {@link deleteStaleTunnelDnsRecords}
      * both read this set.
      */
-    async publishTunnelDnsRecords(org, domain, tunnelId, previousIds, previousHostnames, context) {
+    async publishTunnelDnsRecords(org, domain, loginHost, tunnelId, previousIds, previousHostnames, context) {
         const dns = this.dnsPort();
         const zone = await this.zonePort().findZoneByApex(domain);
         if (!zone) {
@@ -4598,7 +4653,7 @@ export class FoundryStepExecutor {
         }
         const dnsTarget = `${tunnelId}.cfargotunnel.com`;
         const previousTargets = new Set([...previousIds].filter((id) => id !== tunnelId).map((id) => `${id}.cfargotunnel.com`));
-        const hostnames = tunnelDnsHostnames(org, domain);
+        const hostnames = tunnelDnsHostnames(org, domain, loginHost);
         const droppedHostnames = previousHostnames.filter((hostname) => !hostnames.includes(hostname));
         const conflicts = [];
         const toCreate = [];

package/dist/plan/hostnames.d.ts

@@ -36,8 +36,10 @@ export declare function filesShareHostname(org: DeclaredOrg): string | null;
  * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
  * #164): a site's two names, every entry's names, an own-domain calls name,
  * Agora's and Boule's, then the wildcard last. An org that does not host keeps the single
- * name it always had.
+ * name it always had. `loginHost` (#568) is the company's own `auth.<domain>`
+ * when it has one; it is listed before the wildcard, and the tunnel step routes
+ * it to the platform's login app, not to Coolify's proxy.
  */
-export declare function tunnelIngressHostnames(org: DeclaredOrg): string[];
+export declare function tunnelIngressHostnames(org: DeclaredOrg, loginHost?: string | null): string[];
 /** The ingress names that get a DNS record: those under the org's own domain. */
-export declare function tunnelDnsHostnames(org: DeclaredOrg, domain: string): string[];
+export declare function tunnelDnsHostnames(org: DeclaredOrg, domain: string, loginHost?: string | null): string[];

package/dist/plan/hostnames.js

@@ -61,9 +61,11 @@ export function filesShareHostname(org) {
  * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
  * #164): a site's two names, every entry's names, an own-domain calls name,
  * Agora's and Boule's, then the wildcard last. An org that does not host keeps the single
- * name it always had.
+ * name it always had. `loginHost` (#568) is the company's own `auth.<domain>`
+ * when it has one; it is listed before the wildcard, and the tunnel step routes
+ * it to the platform's login app, not to Coolify's proxy.
  */
-export function tunnelIngressHostnames(org) {
+export function tunnelIngressHostnames(org, loginHost = null) {
     const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [];
     if (org.hosting.enabled) {
         for (const entry of org.hosting.entries)
@@ -84,6 +86,8 @@ export function tunnelIngressHostnames(org) {
     const share = filesShareHostname(org);
     if (share)
         hostnames.push(share);
+    if (loginHost)
+        hostnames.push(loginHost);
     // The wildcard goes last: Cloudflare takes the first ingress rule that
     // matches, so every exact name above must come before `*.<domain>`.
     const wildcard = wildcardHostname(org);
@@ -92,6 +96,6 @@ export function tunnelIngressHostnames(org) {
     return [...new Set(hostnames)];
 }
 /** The ingress names that get a DNS record: those under the org's own domain. */
-export function tunnelDnsHostnames(org, domain) {
-    return tunnelIngressHostnames(org).filter((hostname) => hostname === domain || hostname.endsWith(`.${domain}`));
+export function tunnelDnsHostnames(org, domain, loginHost = null) {
+    return tunnelIngressHostnames(org, loginHost).filter((hostname) => hostname === domain || hostname.endsWith(`.${domain}`));
 }

package/dist/plan/login-host.d.ts

@@ -81,8 +81,15 @@ export interface LoginHostBindingsPort {
  * on the next run.
  */
 export declare const LOGIN_BINDING_SCOPE_KEY = "login_host_binding";
-/** The org's recorded app client ids (hosted app, each entry's own, cms, agora, boule), deduplicated and sorted. */
-export declare function loginHostClientIds(recorded: Readonly<Record<string, string>>): string[];
+/**
+ * #573: keys of the entries that sign in the customers organisation. The login
+ * host's binding admits the staff organisation only, so these entries stay
+ * out of it and sign in on the shared host. A recorded client id whose entry
+ * is no longer declared is not here, so it stays bound as before.
+ */
+export declare function customersEntryKeys(org: DeclaredOrg): Set<string>;
+/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
+export declare function loginHostClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string[];
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export declare function loginBindingState(host: string, clientIds: readonly string[]): string;
 /**
@@ -101,3 +108,11 @@ export declare const LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY = "zitadel_login_host_
 export declare function pendingRemovalHosts(recorded: Readonly<Record<string, string>>): string[];
 /** {@link pendingRemovalHosts}' own serialisation, sorted so the recorded value is stable regardless of check order. */
 export declare function pendingRemovalState(hosts: readonly string[]): string;
+/**
+ * #568: the company's own login host when the company tunnel has to publish
+ * it: `auth.<domain>`, only when it is under the org's own domain
+ * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
+ * the shared instance's and is routed by the platform auth tunnel. Otherwise
+ * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ */
+export declare function companyLoginTunnelHost(org: DeclaredOrg, isPlatformOrg: boolean): string | null;

package/dist/plan/login-host.js

@@ -55,15 +55,26 @@ export const LOGIN_HOST_SHARED_SCOPE_KEY = 'zitadel_login_host_shared';
  * on the next run.
  */
 export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
-/** The org's recorded app client ids (hosted app, each entry's own, cms, agora, boule), deduplicated and sorted. */
-export function loginHostClientIds(recorded) {
+/**
+ * #573: keys of the entries that sign in the customers organisation. The login
+ * host's binding admits the staff organisation only, so these entries stay
+ * out of it and sign in on the shared host. A recorded client id whose entry
+ * is no longer declared is not here, so it stays bound as before.
+ */
+export function customersEntryKeys(org) {
+    return new Set(org.hosting.entries.filter((e) => e.uses?.auth?.users === 'customers').map((e) => e.key));
+}
+/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
+export function loginHostClientIds(org, recorded) {
+    const customers = customersEntryKeys(org);
     const ids = [
         recorded[APP_CLIENT_ID_SCOPE_KEY],
         recorded[CMS_CLIENT_ID_SCOPE_KEY],
         recorded[AGORA_CLIENT_ID_SCOPE_KEY],
         recorded[BOULE_CLIENT_ID_SCOPE_KEY],
         ...Object.entries(recorded)
-            .filter(([key]) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX))
+            .filter(([key]) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX) &&
+            !customers.has(key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length)))
             .map(([, id]) => id),
     ].filter((id) => Boolean(id));
     return [...new Set(ids)].sort();
@@ -93,3 +104,13 @@ export function pendingRemovalHosts(recorded) {
 export function pendingRemovalState(hosts) {
     return [...hosts].sort().join(',');
 }
+/**
+ * #568: the company's own login host when the company tunnel has to publish
+ * it: `auth.<domain>`, only when it is under the org's own domain
+ * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
+ * the shared instance's and is routed by the platform auth tunnel. Otherwise
+ * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ */
+export function companyLoginTunnelHost(org, isPlatformOrg) {
+    return org.domain && org.issuer.usesDomain && !isPlatformOrg ? loginHostnameFor(org) : null;
+}

package/dist/plan/platform-providers.d.ts

@@ -330,6 +330,8 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private executeSfu;
     private coolifyJobs;
 }
+export declare const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = "platform-auth-login";
+export declare const AUTH_LOGIN_PORT = "3000";
 /**
  * Every ZITADEL OIDC/management/console/asset path -- `deploy/proxy/Caddyfile`'s
  * own explicit list, restated here as one regex since the tunnel routes by a

package/dist/plan/platform-providers.js

@@ -695,7 +695,7 @@ const PLATFORM_AUTH_BROKER_APP_NAME = 'platform-auth-broker';
  * header and so cannot give two different apps the same public hostname.
  */
 const PLATFORM_AUTH_ZITADEL_INTERNAL_NAME = 'platform-auth-zitadel';
-const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = 'platform-auth-login';
+export const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = 'platform-auth-login';
 const PLATFORM_AUTH_BROKER_INTERNAL_NAME = 'platform-auth-broker';
 const PLATFORM_AUTH_TUNNEL_NAME = 'platform-auth-tunnel';
 /** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_AUTH_TUNNEL_NAME}. */
@@ -714,7 +714,7 @@ const AUTH_BROKER_DOCKERFILE = '/broker/Dockerfile';
  * own `ZITADEL_PORT: 8080` and the login image's own `EXPOSE`.
  */
 const AUTH_ZITADEL_PORT = '8080';
-const AUTH_LOGIN_PORT = '3000';
+export const AUTH_LOGIN_PORT = '3000';
 /** `broker/Dockerfile`'s own `ENV PORT=3000` / `EXPOSE 3000`. */
 const AUTH_BROKER_PORT = '3000';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",