@wtfalch/foundry 0.26.0 → 0.26.1

package/dist/plan/diff.d.ts

@@ -117,6 +117,15 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * against this seam.
  */
 export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>, agoraHost?: AgoraHostReading, jobsAvailable?: boolean, platformReadiness?: OrgPlatformReadiness, options?: PlanOrgOptions): PlanDetail;
+/**
+ * #488: the bare hostname out of an issuer URL (`https://<hostname>`, the
+ * only shape {@link agoraHostValuesFromPlatform} or a host-supplied
+ * `AgoraHostPort` ever hands back), or `null` when there is no issuer to
+ * read one from. What {@link loginHostnameFor} compares the org's own
+ * computed `auth.<domain>` against, so the platform's own org never plans
+ * its login host equal to the shared ZITADEL instance's own.
+ */
+export declare function isPlatformOwnOrg(org: DeclaredOrg, platformApex: string | null): boolean;
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */

package/dist/plan/diff.js

@@ -734,7 +734,7 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
-function isPlatformOwnOrg(org, platformApex) {
+export function isPlatformOwnOrg(org, platformApex) {
     return Boolean(org.domain && platformApex && org.domain.toLowerCase() === platformApex.toLowerCase());
 }
 function platformAuthHostnameFrom(issuer) {

package/dist/plan/health-targets.d.ts

@@ -71,7 +71,9 @@ export interface HealthTarget {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export declare function healthTargets(org: DeclaredOrg): HealthTarget[];
+export declare function healthTargets(org: DeclaredOrg, options?: {
+    platform?: DeclaredPlatform | null;
+}): HealthTarget[];
 /**
  * The seven platform services #541 names (`platform:auth`, `platform:archon`,
  * `platform:mail`, `platform:ai`, `platform:files`, `platform:integrations`,

package/dist/plan/health-targets.js

@@ -1,6 +1,7 @@
 import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
+import { isPlatformOwnOrg } from './diff.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
 import { isBehindGate } from './gates.js';
 import { entryHostnames } from './hostnames.js';
@@ -12,8 +13,6 @@ const DEFAULT_API_HEALTH_PATH = '/api/health';
 const STATIC_PAGE_PATH = '/';
 /** zitadel-login's own readiness route (#541's "Real paths today"). `depth: 'shallow'`, not `'deep'`: login holds no database of its own (`login-host.ts`), whatever its name suggests. */
 const LOGIN_READY_PATH = '/ready';
-/** The broker answers on `platform.auth.hostname` under `AUTH_BROKER_PATH_PATTERN` (`platform-providers.ts`, `'^/api(/|$)'`), so its own health path carries that prefix. */
-const BROKER_HEALTH_PATH = '/api/healthy';
 /** `platform-providers.ts`'s own `waitForInstance` call target (`` `https://${hostname}/debug/healthz}` ``), also the one path `AUTH_ZITADEL_PATH_PATTERN` names by name. */
 const ZITADEL_HEALTH_PATH = '/debug/healthz';
 /**
@@ -26,7 +25,12 @@ const STALWART_READY_PATH = '/healthz/ready';
 const CHAT_SERVICE_HEALTH_PATH = '/_chat/health';
 const CALLS_HEALTH_PATH = '/healthz';
 /** Boule, Agora and the company's own login host: every org gets these, with no flag to check (the "Why" this issue opens with). */
-function alwaysOnTargets(org) {
+function alwaysOnTargets(org, platform) {
+    // The platform's own org signs in on the shared instance host, not its own
+    // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
+    const loginHost = platform && isPlatformOwnOrg(org, platform.apex)
+        ? platform.auth.hostname
+        : loginHostnameFor(org);
     return [
         {
             service: 'boule',
@@ -49,7 +53,7 @@ function alwaysOnTargets(org) {
         },
         {
             service: 'login',
-            url: `https://${loginHostnameFor(org)}${LOGIN_READY_PATH}`,
+            url: `https://${loginHost}${LOGIN_READY_PATH}`,
             expect: okExpect(),
             depth: 'shallow',
             restartSafe: false,
@@ -224,8 +228,8 @@ function appTargets(org) {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export function healthTargets(org) {
-    const targets = alwaysOnTargets(org);
+export function healthTargets(org, options = {}) {
+    const targets = alwaysOnTargets(org, options.platform ?? null);
     const broker = brokerTarget(org);
     if (broker)
         targets.push(broker);
@@ -265,12 +269,18 @@ function authTargets(platform) {
             behindAccess: false,
         },
         {
+            // The broker's only unauthenticated route is `/healthy` at its own root
+            // (auth's `broker/src/server.ts`), but the tunnel hands it only
+            // `AUTH_BROKER_PATH_PATTERN` ('^/api(/|$)') unchanged: `/api/healthy`
+            // reaches the broker and answers 401, and bare `/healthy` reaches
+            // zitadel-login instead, which would read as the broker being up.
             service: 'auth-broker',
-            url: `https://${hostname}${BROKER_HEALTH_PATH}`,
+            url: null,
             expect: okExpect(),
             depth: 'shallow',
             restartSafe: false,
             behindAccess: false,
+            reason: "the broker's health route (/healthy) is not reachable from outside: the tunnel sends it only /api/*, which answers 401 without a session, and /healthy on this host is zitadel-login's",
         },
     ];
 }
@@ -302,11 +312,15 @@ export function platformHealthTargets(platform) {
         ...authTargets(platform),
         {
             service: 'archon',
+            // `provisionPlatformArchon` always puts a Cloudflare Access app in front
+            // of this hostname (it throws with no Access emails), so a prober with no
+            // service token reads a redirect: it proves Access and the tunnel are up,
+            // not that Archon answers.
             url: `https://${platform.archon.hostname}${DEFAULT_API_HEALTH_PATH}`,
             expect: okExpect(),
-            depth: 'deep',
+            depth: 'shallow',
             restartSafe: false,
-            behindAccess: false,
+            behindAccess: true,
         },
         {
             service: 'mail',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",