@wtfalch/foundry 0.22.1 → 0.22.3

package/dist/index.d.ts

@@ -22,7 +22,7 @@ export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, File
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';

package/dist/index.js

@@ -13,7 +13,7 @@ export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';

package/dist/plan/diff.js

@@ -6,10 +6,10 @@ import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv,
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
-import { appHostname, entryHostnames, tunnelDnsHostnames } from './hostnames.js';
+import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
@@ -326,7 +326,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #173: register the org's own app with the platform's jobs scheduler.
     // After Agora, so a failing registration can never stop Agora from
     // provisioning (`runSteps` stops at the first failing step).
-    const jobsRegistration = planJobsRegistration(org, recordedIds, jobsAvailable || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader);
+    const jobsRegistration = planJobsRegistration(org, recordedIds, jobsAvailable || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
     if (jobsRegistration.step)
         plannedSteps.push(jobsRegistration.step);
     // F8 (#318), after Agora and Boule, not right after the zone: a route
@@ -2186,7 +2186,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     }
     // A changed hostname reaches an app that is already live: its domains are
     // patched and it is redeployed.
-    if (JSON.stringify(entryHostnames(org, entry)) !==
+    if (JSON.stringify(tunnelDomainList(entryHostnames(org, entry))) !==
         JSON.stringify(appliedAppDomains(org, recordedIds, entryKey))) {
         return {
             step: {
@@ -2229,7 +2229,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             key: blockedKey('port'),
         });
     }
-    if (want.folder !== have.folder ||
+    if (appFolderDiffers(want, have) ||
         want.autoDeploy !== have.autoDeploy ||
         (want.port !== null && want.port !== have.port)) {
         return {
@@ -2344,7 +2344,7 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
  * {@link planSite}'s own `hostname` local does: `DeclaredOrg.domain` once
  * `hosting.usesDomain` is true, `<slug>.oikos.host` otherwise.
  */
-function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = null, noKeyReader = false) {
+function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = null, noKeyReader = false, addressMissing = false) {
     if (!org.hosting.enabled)
         return { step: null, blocked: null };
     const key = resourceKey('jobs', 'registration', org.id);
@@ -2366,11 +2366,13 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
     if (!jobsAvailable) {
         return {
             step: null,
-            blocked: !missingKeyRef
-                ? `${org.slug}'s jobs registration is blocked, not planned: the host supplies no jobs scheduler`
-                : `${org.slug}'s jobs registration is blocked, not planned: ${noKeyReader
-                    ? `the host gave no held-keys reader and no jobs scheduler port, so the platform's jobs admin token ${missingKeyRef} cannot be checked`
-                    : `the platform's jobs admin token ${missingKeyRef} is not held yet`}`,
+            blocked: addressMissing
+                ? `${org.slug}'s jobs registration is blocked, not planned: the platform's jobs scheduler has not recorded its internal address yet; apply the platform's jobs step first`
+                : !missingKeyRef
+                    ? `${org.slug}'s jobs registration is blocked, not planned: the host supplies no jobs scheduler`
+                    : `${org.slug}'s jobs registration is blocked, not planned: ${noKeyReader
+                        ? `the host gave no held-keys reader and no jobs scheduler port, so the platform's jobs admin token ${missingKeyRef} cannot be checked`
+                        : `the platform's jobs admin token ${missingKeyRef} is not held yet`}`,
         };
     }
     const hostname = appHostname(org);

package/dist/plan/executor.d.ts

@@ -117,8 +117,6 @@ export interface CoolifyPort {
         ports_exposes?: string;
         /** `false` for an internal entry: Coolify makes no domain for it. */
         autogenerate_domain?: boolean;
-        /** The folder a `static` entry serves (`HostingEntry.folder`). */
-        publish_directory?: string;
         /** Whether a push to `git_branch` deploys (`HostingEntry.autoDeploy`). */
         is_auto_deploy_enabled?: boolean;
         /**

package/dist/plan/executor.js

@@ -20,10 +20,10 @@ import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScope
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { healthCheckSettings } from './health-check-settings.js';
-import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
+import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
@@ -1787,11 +1787,11 @@ export class FoundryStepExecutor {
         // An entry with no names is internal: the other entries reach it as
         // `<slug>-<key>`, and it gets no domain, route or DNS record.
         const names = entryHostnames(org, entry);
+        const wantDomains = tunnelDomainList(names);
         const isStatic = entry.buildPack === 'static';
-        const folderField = isStatic ? 'publish_directory' : 'base_directory';
         const settingsKey = appSettingsAppliedScopeKey(entry.key);
         const domainsKey = appDomainsAppliedScopeKey(entry.key);
-        let haveNames;
+        let haveDomains;
         let have;
         let appId;
         // A stopped app with no settings marker was never deployed successfully
@@ -1812,7 +1812,7 @@ export class FoundryStepExecutor {
                 neverDeployed = context.recordedIds()[settingsKey] === undefined;
             }
             have = appliedAppSettings(context.recordedIds(), entry.key);
-            haveNames = appliedAppDomains(org, context.recordedIds(), entry.key);
+            haveDomains = appliedAppDomains(org, context.recordedIds(), entry.key);
         }
         else {
             const server = await this.resolveServer(org, context);
@@ -1827,12 +1827,15 @@ export class FoundryStepExecutor {
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
                 name: appNameFor(org, entry),
-                domains: names.length > 0 ? coolifyDomains(names) : undefined,
+                domains: names.length > 0 ? coolifyTunnelDomains(names) : undefined,
                 autogenerate_domain: names.length > 0 ? undefined : false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
                 is_auto_deploy_enabled: entry.autoDeploy,
-                [folderField]: entry.folder === null ? undefined : `/${entry.folder}`,
+                // Also the folder a static entry serves: Coolify's static build
+                // copies `base_directory`, and reads `publish_directory` only for a
+                // built app.
+                base_directory: entry.folder === null ? undefined : `/${entry.folder}`,
                 // Only the shared standard app builds from this repo; a bespoke
                 // app's Dockerfile is at its own repo's root.
                 dockerfile_location: entry.repo ? undefined : DEFAULT_APP_DOCKERFILE,
@@ -1840,15 +1843,15 @@ export class FoundryStepExecutor {
             appId = created.uuid;
             // Create sent every setting, so nothing is left to patch.
             have = appSettingsOf(entry);
-            haveNames = names;
+            haveDomains = wantDomains;
         }
         // Patch what differs from what the app has. A crash before the marker is
         // recorded below leaves the old one, so the retry patches the same
         // difference again.
         const want = appSettingsOf(entry);
         const patch = {};
-        if (want.folder !== have.folder)
-            patch[folderField] = want.folder ? `/${want.folder}` : '/';
+        if (appFolderDiffers(want, have))
+            patch.base_directory = want.folder ? `/${want.folder}` : '/';
         if (want.port !== have.port && want.port !== null && !isStatic) {
             patch.ports_exposes = String(want.port);
         }
@@ -1869,10 +1872,12 @@ export class FoundryStepExecutor {
             Object.assign(patch, healthCheckSettings(entry.healthPath ?? (isStatic ? '/' : '/api/health'), healthCheckPort));
         }
         // Create names the app after `domains`; a changed name reaches a live app
-        // here (rule 3). The internal name is set after create, as the calls
-        // stack's apps do.
-        if (JSON.stringify(names) !== JSON.stringify(haveNames))
-            patch.domains = coolifyDomains(names);
+        // here (rule 3), and so does an app made with the `https://` form, whose
+        // redirect loops behind the tunnel. The internal name is set after
+        // create, as the calls stack's apps do.
+        if (JSON.stringify(wantDomains) !== JSON.stringify(haveDomains)) {
+            patch.domains = coolifyTunnelDomains(names);
+        }
         if (names.length === 0 && (!existing || patch.domains !== undefined)) {
             patch.custom_internal_name = appNameFor(org, entry);
         }
@@ -1901,7 +1906,6 @@ export class FoundryStepExecutor {
             await this.ports.coolify.updateApplication(appId, patch);
         // The container builds and listens from these only at its next deploy.
         const settingsNeedDeploy = Boolean(patch.base_directory ||
-            patch.publish_directory ||
             patch.ports_exposes ||
             patch.domains !== undefined ||
             patch.custom_internal_name ||
@@ -1969,7 +1973,7 @@ export class FoundryStepExecutor {
         // A port taken back to null was not patched, so the marker keeps the old
         // one and `planApp` reports it instead of planning it.
         context.recordScopeId(settingsKey, JSON.stringify({ ...want, port: want.port ?? have.port }));
-        context.recordScopeId(domainsKey, JSON.stringify(names));
+        context.recordScopeId(domainsKey, JSON.stringify(wantDomains));
         if (wantLabelsHash)
             context.recordScopeId(labelsKey, wantLabelsHash);
         context.recordScopeId(appEnvAppliedScopeKey(entry.key), appEnv.applied);
@@ -3043,7 +3047,7 @@ export class FoundryStepExecutor {
             git_branch: 'main',
             build_pack: 'dockerfile',
             name: input.name,
-            domains: coolifyDomains([input.domain]),
+            domains: coolifyTunnelDomains([input.domain]),
             dockerfile_location: input.dockerfileLocation,
         });
         return { appId: created.uuid, existed: false };
@@ -3739,7 +3743,7 @@ export class FoundryStepExecutor {
             git_branch: 'main',
             build_pack: 'dockerfile',
             name,
-            domains: coolifyDomains([callsHostnameFor(org)]),
+            domains: coolifyTunnelDomains([callsHostnameFor(org)]),
             dockerfile_location: CALLS_SERVICE_DOCKERFILE,
         }));
         // A fixed internal name, like Synapse and MAS above, so the org's Agora
@@ -4022,7 +4026,7 @@ export class FoundryStepExecutor {
             git_branch: 'main',
             build_pack: 'dockerfile',
             name,
-            domains: coolifyDomains([agoraHostnameFor(org)]),
+            domains: coolifyTunnelDomains([agoraHostnameFor(org)]),
             dockerfile_location: AGORA_APP_DOCKERFILE,
             ports_exposes: AGORA_APP_PORTS_EXPOSES,
         }));
@@ -4132,7 +4136,7 @@ export class FoundryStepExecutor {
             git_branch: 'main',
             build_pack: 'dockerfile',
             name,
-            domains: coolifyDomains([bouleHostnameFor(org)]),
+            domains: coolifyTunnelDomains([bouleHostnameFor(org)]),
             dockerfile_location: BOULE_APP_DOCKERFILE,
         }));
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.

package/dist/plan/hostnames.d.ts

@@ -20,10 +20,22 @@ export declare function wildcardHostname(org: DeclaredOrg): string | null;
 export declare function appHostname(org: DeclaredOrg): string;
 /**
  * Coolify's `domains` field: comma-separated full URLs. A bare hostname is a
- * 422 ("Invalid URL"), so every write names each host as `https://<host>`.
+ * 422 ("Invalid URL"), so every write names each host as a URL. This helper
+ * writes `https://<host>` for the platform's apps; a company's apps are reached
+ * through `coolify-proxy:80` and use {@link coolifyTunnelDomains} (`http://`).
  * Foundry's own records and proxy labels keep the bare names.
  */
 export declare function coolifyDomains(names: readonly string[]): string;
+/**
+ * The `domains` entries of a company's app, one URL per host. Every company
+ * tunnel delivers plain http to Traefik (`COOLIFY_PROXY_ORIGIN`), and Coolify
+ * puts a redirect-to-https on the http entry point of an `https://` domain,
+ * so a request through the tunnel would be redirected to itself forever. The
+ * `http://` form is served as it is; Cloudflare terminates TLS in front.
+ */
+export declare function tunnelDomainList(names: readonly string[]): string[];
+/** {@link tunnelDomainList} as Coolify's comma-separated `domains` field. */
+export declare function coolifyTunnelDomains(names: readonly string[]): string;
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export declare function legacyAppHostname(org: DeclaredOrg): string;
 /**

package/dist/plan/hostnames.js

@@ -37,12 +37,28 @@ export function appHostname(org) {
 }
 /**
  * Coolify's `domains` field: comma-separated full URLs. A bare hostname is a
- * 422 ("Invalid URL"), so every write names each host as `https://<host>`.
+ * 422 ("Invalid URL"), so every write names each host as a URL. This helper
+ * writes `https://<host>` for the platform's apps; a company's apps are reached
+ * through `coolify-proxy:80` and use {@link coolifyTunnelDomains} (`http://`).
  * Foundry's own records and proxy labels keep the bare names.
  */
 export function coolifyDomains(names) {
     return names.map((name) => `https://${name}`).join(',');
 }
+/**
+ * The `domains` entries of a company's app, one URL per host. Every company
+ * tunnel delivers plain http to Traefik (`COOLIFY_PROXY_ORIGIN`), and Coolify
+ * puts a redirect-to-https on the http entry point of an `https://` domain,
+ * so a request through the tunnel would be redirected to itself forever. The
+ * `http://` form is served as it is; Cloudflare terminates TLS in front.
+ */
+export function tunnelDomainList(names) {
+    return names.map((name) => `http://${name}`);
+}
+/** {@link tunnelDomainList} as Coolify's comma-separated `domains` field. */
+export function coolifyTunnelDomains(names) {
+    return tunnelDomainList(names).join(',');
+}
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export function legacyAppHostname(org) {
     return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';

package/dist/plan/platform-diff.d.ts

@@ -482,23 +482,36 @@ export interface AppSettings {
     folder: string | null;
     port: number | null;
     autoDeploy: boolean;
+    /**
+     * Set for a `static` entry whose folder is written as `base_directory`,
+     * the field Coolify's static build serves from. A static marker without it
+     * was written as `publish_directory`, which that build ignores (it served
+     * the repo root), so the app is patched and redeployed once.
+     */
+    staticFolderIn?: 'base_directory';
 }
 export declare function appSettingsOf(entry: HostingEntry): AppSettings;
+/** Whether the app's folder is not yet where Coolify reads it: a changed folder, or a static one written to the old field. */
+export declare function appFolderDiffers(want: AppSettings, have: AppSettings): boolean;
 /** What an app that predates the marker has: Coolify's own defaults, so it plans no change. */
 export declare const DEFAULT_APP_SETTINGS: AppSettings;
 export declare function appSettingsAppliedScopeKey(entryKey: string): string;
 /** The settings the app has: the marker, or the defaults when there is none. */
 export declare function appliedAppSettings(recorded: Readonly<Record<string, string>>, entryKey: string): AppSettings;
 /**
- * The names `coolifyApp` last put in the entry's Coolify `domains`, as a JSON
- * array (`[]` for an internal entry). `planApp` plans the step again, with a
- * redeploy, when {@link entryHostnames} differs from it.
+ * The URLs `coolifyApp` last put in the entry's Coolify `domains`
+ * (`tunnelDomainList`), as a JSON array (`[]` for an internal entry). `planApp`
+ * plans the step again, with a redeploy, when the wanted URLs differ from it.
+ * A marker of bare names, written before the `http://` form, never equals
+ * them, so an app made with the `https://` form is patched once.
  */
 export declare function appDomainsAppliedScopeKey(entryKey: string): string;
 /**
- * The names the app has: the marker, or for an app that predates it the one
- * name it was created with (the `app` entry's address, nothing for any other
- * entry), so an app that runs today plans no change.
+ * The domains the app has: the marker, or for an app with no marker the one
+ * bare name it was created with (the `app` entry's address, nothing for any
+ * other entry). A bare name is never a URL `tunnelDomainList` writes, so an
+ * app with no marker is patched once: the scheme it was created with is
+ * unknown, bare before 4b2380f and `https://` after it.
  */
 export declare function appliedAppDomains(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, entryKey: string): string[];
 /** Whether the secret sources can be filled right now: the mail key is held, and a new shared secret can be held. */
@@ -935,6 +948,13 @@ export declare function planPlatform(platform: DeclaredPlatform, live: LiveResou
  * it, so the planner and the executor/reader can never key it apart).
  */
 export declare const JOBS_SCHEDULER_KEY = "jobs";
+/**
+ * The scheduler's address on the Coolify network (`http://<custom_internal_name>:8080`),
+ * the value the org steps' jobs port and Archon's `JOBS_URL` are read from.
+ * Not a secret. The scheduler's public hostname has no tunnel and no DNS
+ * record, so nothing on the platform can reach it there.
+ */
+export declare const JOBS_INTERNAL_URL_SCOPE_KEY = "jobs_internal_url";
 /**
  * #257: the six platform databases foundry itself creates, each keyed by
  * the scope id `platform-providers.ts`'s own `createPostgresDatabase` call

package/dist/plan/platform-diff.js

@@ -520,7 +520,17 @@ export function serviceDbEnvAppliedScopeKey(service) {
     return `service_db_env_applied.${service}`;
 }
 export function appSettingsOf(entry) {
-    return { folder: entry.folder, port: entry.port, autoDeploy: entry.autoDeploy };
+    return {
+        folder: entry.folder,
+        port: entry.port,
+        autoDeploy: entry.autoDeploy,
+        ...(entry.buildPack === 'static' ? { staticFolderIn: 'base_directory' } : {}),
+    };
+}
+/** Whether the app's folder is not yet where Coolify reads it: a changed folder, or a static one written to the old field. */
+export function appFolderDiffers(want, have) {
+    return (want.folder !== have.folder ||
+        (want.folder !== null && want.staticFolderIn !== have.staticFolderIn));
 }
 /** What an app that predates the marker has: Coolify's own defaults, so it plans no change. */
 export const DEFAULT_APP_SETTINGS = { folder: null, port: null, autoDeploy: true };
@@ -533,17 +543,21 @@ export function appliedAppSettings(recorded, entryKey) {
     return marker ? JSON.parse(marker) : DEFAULT_APP_SETTINGS;
 }
 /**
- * The names `coolifyApp` last put in the entry's Coolify `domains`, as a JSON
- * array (`[]` for an internal entry). `planApp` plans the step again, with a
- * redeploy, when {@link entryHostnames} differs from it.
+ * The URLs `coolifyApp` last put in the entry's Coolify `domains`
+ * (`tunnelDomainList`), as a JSON array (`[]` for an internal entry). `planApp`
+ * plans the step again, with a redeploy, when the wanted URLs differ from it.
+ * A marker of bare names, written before the `http://` form, never equals
+ * them, so an app made with the `https://` form is patched once.
  */
 export function appDomainsAppliedScopeKey(entryKey) {
     return `app_domains_applied.${entryKey}`;
 }
 /**
- * The names the app has: the marker, or for an app that predates it the one
- * name it was created with (the `app` entry's address, nothing for any other
- * entry), so an app that runs today plans no change.
+ * The domains the app has: the marker, or for an app with no marker the one
+ * bare name it was created with (the `app` entry's address, nothing for any
+ * other entry). A bare name is never a URL `tunnelDomainList` writes, so an
+ * app with no marker is patched once: the scheme it was created with is
+ * unknown, bare before 4b2380f and `https://` after it.
  */
 export function appliedAppDomains(org, recorded, entryKey) {
     const marker = recorded[appDomainsAppliedScopeKey(entryKey)];
@@ -1129,6 +1143,13 @@ function planApexZone(platform, byKey, claimed) {
  * it, so the planner and the executor/reader can never key it apart).
  */
 export const JOBS_SCHEDULER_KEY = 'jobs';
+/**
+ * The scheduler's address on the Coolify network (`http://<custom_internal_name>:8080`),
+ * the value the org steps' jobs port and Archon's `JOBS_URL` are read from.
+ * Not a secret. The scheduler's public hostname has no tunnel and no DNS
+ * record, so nothing on the platform can reach it there.
+ */
+export const JOBS_INTERNAL_URL_SCOPE_KEY = 'jobs_internal_url';
 /**
  * #173: the jobs scheduler (https://github.com/wtfalch/jobs) itself, as a
  * platform-level Coolify application with its own database -- provision-only,
@@ -1159,8 +1180,11 @@ function planJobs(platform, byKey, claimed, observable, recordedIds) {
         // So does a recorded pending deploy: the step wrote its env and died
         // before the deploy finished.
         const databaseStatus = live.config.databaseStatus;
+        // So does a missing internal address: a scheduler applied before the
+        // address was recorded gets it from the next apply.
         if (live.config.ownerUrlMissing !== true &&
             !recordedIds[JOBS_DEPLOY_PENDING_SCOPE_KEY] &&
+            recordedIds[JOBS_INTERNAL_URL_SCOPE_KEY] &&
             (typeof databaseStatus !== 'string' || databaseStatus.startsWith('running'))) {
             return { step: null, blocked: null };
         }

package/dist/plan/platform-org-ports.js

@@ -1,5 +1,5 @@
 import { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';
-import { PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, } from './platform-diff.js';
+import { JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, } from './platform-diff.js';
 import { FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
 /**
  * #177: what `platform-org.ts`'s readiness could not see between a plan and
@@ -44,8 +44,9 @@ export class PlatformOrgPorts {
         if (!platform?.jobs.enabled) {
             throw new PlatformOrgBlockedError('jobs', 'the platform does not declare a jobs scheduler');
         }
+        const baseUrl = await this.recorded('jobs', JOBS_INTERNAL_URL_SCOPE_KEY);
         const token = await this.held('jobs', JOBS_ADMIN_TOKEN_REF);
-        return new HttpJobsSchedulerClient(`https://${platform.jobs.hostname}`, token, this.options.fetch);
+        return new HttpJobsSchedulerClient(baseUrl, token, this.options.fetch);
     }
     async authHostname() {
         return (await this.options.store.get())?.auth.hostname ?? null;

package/dist/plan/platform-org.d.ts

@@ -87,8 +87,14 @@ export interface OrgPlatformReadiness {
     callsReady: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
-    /** The jobs scheduler (#173) is enabled, applied, and its admin token is held. */
+    /** The jobs scheduler (#173) is enabled, applied, has recorded its internal address, and its admin token is held. */
     jobsReady: boolean;
+    /**
+     * The scheduler is applied but has recorded no internal address, so the
+     * org's registration cannot reach it; `diff.ts` reports the registration
+     * blocked with that reason. Absent when false.
+     */
+    jobsUrlMissing?: boolean;
     /**
      * #317 (F7) and #478: the edge service is declared `enabled`, its own
      * `coolify:app` deploy step has applied (`provisionPlatformEdge`), and

package/dist/plan/platform-org.js

@@ -1,4 +1,4 @@
-import { JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
+import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
@@ -103,6 +103,7 @@ edgePortPresent = false) {
     const filesApplied = platform.files.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_FILES_KEY);
     const aiApplied = platform.ai.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_AI_KEY);
     const jobsApplied = platform.jobs.enabled && Boolean(platformRecordedIds[`coolify:jobs:${JOBS_SCHEDULER_KEY}`]);
+    const jobsUrl = platformRecordedIds[JOBS_INTERNAL_URL_SCOPE_KEY];
     const edgeApplied = platform.edge.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_EDGE_KEY);
     const missing = (applied, ref) => applied && heldRefs !== undefined && !heldRefs.has(ref) ? ref : null;
     const missingKeys = {
@@ -129,7 +130,8 @@ edgePortPresent = false) {
         aiUrl: aiApplied ? (platformRecordedIds[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY] ?? null) : null,
         callsReady: platform.sfu.enabled,
         authReady: platform.auth.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY),
-        jobsReady: jobsApplied && missingKeys.jobs === null,
+        jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
+        ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),
         edgeReady: edgeApplied && edgePortPresent,
         edgeUrl: edgeApplied && edgePortPresent ? `https://${platform.edge.hostname}` : null,
         missingKeys,

package/dist/plan/platform-providers.d.ts

@@ -2,6 +2,7 @@ import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import type { DeclaredOrg } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { DeclaredOrgStore, PlatformStore } from '../store.js';
+import { type DeployHealthRuntime } from './deploy-health.js';
 import type { StepAction } from './diff.js';
 import type { AccessPort } from './edge-access.js';
 import type { DnsPort } from './edge-dns.js';
@@ -117,7 +118,7 @@ export declare const JOBS_ADMIN_TOKEN_REF = "jobs:scheduler:adminToken";
  * org's own app, reused here for the platform's one scheduler instead of once
  * per org.
  */
-type JobsCoolifyPort = Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'requireGithubApp' | 'findApplicationByName' | 'createGithubAppApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'getApplication' | 'deploy'>;
+type JobsCoolifyPort = Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'requireGithubApp' | 'findApplicationByName' | 'createGithubAppApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'getApplication' | 'updateApplication' | 'deployAndWait'>;
 /**
  * Options for {@link FoundryPlatformStepExecutor}'s constructor, replacing
  * four positional arguments that shifted on every merge that added a
@@ -133,6 +134,8 @@ export interface FoundryPlatformStepExecutorOptions {
      * an error). Needed by `coolify:jobs` for the scheduler's admin token.
      */
     deliverSecret?: (ref: string, secret: string) => Promise<void>;
+    /** Clock, sleep and deployment wait for `coolify:jobs`; real ones by default. */
+    runtime?: DeployHealthRuntime;
     sfu?: CallsSfuPlatformDeps;
     /**
      * #168: dependencies for `coolify:app` keyed {@link PLATFORM_AUTH_KEY} --
@@ -264,6 +267,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly declaredOrgStore;
     private readonly coolify?;
     private readonly deliverSecret?;
+    private readonly runtime;
     private readonly sfu?;
     private readonly auth?;
     private readonly mail?;

package/dist/plan/platform-providers.js

@@ -7,8 +7,8 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { healthCheckSettings } from './health-check-settings.js';
-import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
+import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -71,6 +71,9 @@ export const JOBS_ADMIN_TOKEN_REF = 'jobs:scheduler:adminToken';
 const PLATFORM_COOLIFY_PROJECT_NAME = 'platform';
 /** https://github.com/wtfalch/jobs -- the scheduler's own repo, Dockerfile at its root (its own `Dockerfile`'s doc comment). */
 const JOBS_SCHEDULER_REPO = 'wtfalch/jobs';
+/** The scheduler's fixed `custom_internal_name` and the port it listens on (jobs' `PORT`, default 8080). */
+const JOBS_INTERNAL_NAME = 'platform-jobs';
+const JOBS_PORT = '8080';
 /**
  * The real {@link PlatformStepExecutor} for the two steps built so far:
  * `cloudflare:zone` for the platform's apex (#167) and `coolify:jobs` for the
@@ -140,6 +143,7 @@ export class FoundryPlatformStepExecutor {
     declaredOrgStore;
     coolify;
     deliverSecret;
+    runtime;
     sfu;
     auth;
     mail;
@@ -156,6 +160,7 @@ export class FoundryPlatformStepExecutor {
         this.declaredOrgStore = declaredOrgStore;
         this.coolify = options.coolify;
         this.deliverSecret = options.deliverSecret;
+        this.runtime = options.runtime ?? {};
         this.sfu = options.sfu;
         this.auth = options.auth;
         this.mail = options.mail;
@@ -615,6 +620,12 @@ export class FoundryPlatformStepExecutor {
             });
             appId = created.uuid;
         }
+        // Set on every run, like `platform:files`' runner: the name another
+        // container reaches the scheduler by. It only takes effect on a deploy.
+        await coolify.updateApplication(appId, {
+            custom_internal_name: JOBS_INTERNAL_NAME,
+            ports_exposes: JOBS_PORT,
+        });
         const db = await getDatabaseStarted(coolify, dbId);
         if (!db.internal_db_url) {
             throw new Error(`platform step coolify:jobs: database ${dbId} has no internal_db_url yet; not deploying the scheduler without a database`);
@@ -670,12 +681,23 @@ export class FoundryPlatformStepExecutor {
         // a redeploy, so deploy after a create or a new token. Also when it is not
         // running, so a deploy that failed on an earlier run is retried.
         const running = (await coolify.getApplication(appId)).status?.startsWith('running') ?? false;
-        if (!existingApp || tokenJustSet || pending || !running)
-            await coolify.deploy(appId);
+        // An app applied before its internal address was recorded has no fixed
+        // name yet, so it deploys once to get it; after that it deploys on the
+        // other conditions only.
+        const addressNew = !context.recordedIds()[JOBS_INTERNAL_URL_SCOPE_KEY];
+        // The address is recorded only once the deployment finished: the scheduler
+        // has no route that answers without its admin token (every other path is a
+        // 401, 404 or 405), so the deployment record is the whole check, as for
+        // the AI worker. A deploy that fails or times out throws here, records
+        // nothing and leaves the step planned.
+        if (!existingApp || tokenJustSet || pending || !running || addressNew) {
+            await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, this.runtime, this.runtime.sleep ?? defaultSleep, 'platform step coolify:jobs', 'the scheduler keeps its old address');
+        }
         if (pending) {
             context.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '');
             await context.persist?.();
         }
+        context.recordScopeId(JOBS_INTERNAL_URL_SCOPE_KEY, `http://${JOBS_INTERNAL_NAME}:${JOBS_PORT}`);
         return { resourceId: appId };
     }
 }
@@ -3698,7 +3720,7 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
         const needs = service === 'jobs'
             ? {
                 stepKey: null,
-                scopeKeys: [],
+                scopeKeys: [JOBS_INTERNAL_URL_SCOPE_KEY],
                 refs: [JOBS_ADMIN_TOKEN_REF],
             }
             : ARCHON_SERVICE_INPUTS[service];
@@ -3784,7 +3806,11 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
             }, { key: 'INTEGRATIONS_MANAGEMENT_AUDIENCE', value: url });
         }
         else {
-            envs.push({ key: 'JOBS_URL', value: `https://${platform.jobs.hostname}` }, { key: 'JOBS_ADMIN_TOKEN', value: held(JOBS_ADMIN_TOKEN_REF) });
+            envs.push(
+            // Known gap: an Archon that is already applied keeps its old `JOBS_URL`
+            // until its step runs again, because the planner does not compare it.
+            // Tracked in a separate issue.
+            { key: 'JOBS_URL', value: recorded[JOBS_INTERNAL_URL_SCOPE_KEY] }, { key: 'JOBS_ADMIN_TOKEN', value: held(JOBS_ADMIN_TOKEN_REF) });
         }
     }
     return { envs };
@@ -7326,10 +7352,15 @@ export const PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY = 'platform_files_share_doma
 function normalHosts(hosts) {
     return [...new Set((hosts ?? []).map((h) => h.trim().toLowerCase()).filter(Boolean))].sort();
 }
-/** The runner's Coolify `domains`, written only when the share set changed (a runner nobody gave a share host keeps none). */
+/**
+ * The runner's Coolify `domains`, written only when the share set changed (a
+ * runner nobody gave a share host keeps none). The share host is in the
+ * company tunnel, which dials the proxy over plain http, so it is written
+ * `http://`.
+ */
 function filesShareDomainsPatch(recorded, shareDomains) {
     return shareDomainsChanged(recorded, shareDomains)
-        ? { domains: coolifyDomains(normalHosts(shareDomains)) }
+        ? { domains: coolifyTunnelDomains(normalHosts(shareDomains)) }
         : {};
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.22.1",
+  "version": "0.22.3",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",