@wtfalch/foundry 0.28.0 → 0.30.0

package/dist/plan/index.d.ts

@@ -1,6 +1,6 @@
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, } from './live.js';
 export { readLiveResources, readLivePlatformResources } from './live.js';
-export type { StepAction, PlannedStep, PlanDetail } from './diff.js';
+export type { StepAction, PlannedStep, PlanDetail, OrgPostgresPlan } from './diff.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
@@ -21,13 +21,14 @@ export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEME
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
+export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';
-export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
 export type { BrokerPort } from './broker-entries.js';
 export { PlatformBrokerPort } from './broker-entries.js';
@@ -57,3 +58,5 @@ export type { EdgePlatformTunnels, TunnelIngress, TunnelPort, TunnelSummary, } f
 export type { ZitadelListAppsRawApp } from './executor.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';
+export type { OrgAppVersionRef, OrgAppVersionStatus, WtfalchPackageDrift, PlatformVersionStatus, ReadPlatformVersionStatusOptions, StatusCoolifyPort, StatusGithubPort, GhExec as StatusGhExec, } from './version-status.js';
+export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './version-status.js';

package/dist/plan/index.js

@@ -11,10 +11,11 @@ export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, Provide
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
+export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';
 export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
@@ -29,3 +30,4 @@ export { createEdgeZones } from './edge-zones.js';
 export { createEdgeTunnels } from './edge-tunnels.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';
+export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './version-status.js';

package/dist/plan/plan-apply.js

@@ -1314,6 +1314,7 @@ const STEP_FIELDS = {
     'coolify:chat': 'chat.usesDomain',
     'coolify:calls': 'calls.enabled',
     'coolify:calls-service': 'calls.enabled',
+    'coolify:calls-chat': 'calls.enabled',
     'ai:budget': 'ai',
     'ai:key': 'ai',
     'cms:site': 'site',

package/dist/plan/platform-diff.d.ts

@@ -207,6 +207,15 @@ export declare const PLATFORM_AUTH_SMTP_SCOPE_KEY = "zitadel_platform_smtp_provi
  * requested, so the invite goes out once. `none` when no owner is declared.
  */
 export declare const PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY = "zitadel_platform_owner_invite_user_id";
+/**
+ * #394: the id of the role-less ZITADEL machine user that reserves the
+ * username `admin` in the platform's own org, so nobody can sign up under a
+ * name Stalwart maps onto its Admin account. `foundry-admin` is reserved by
+ * the admin machine user itself.
+ */
+export declare const PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY = "zitadel_platform_reserved_admin_username";
+/** #394: recorded once the platform's own ZITADEL org has self-registration forced off. */
+export declare const PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_platform_registration_closed";
 export declare const PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY = "zitadel_platform_admin_user_id";
 export declare const PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY = "zitadel_platform_admin_user_undelivered";
 /** #283: the created instance's id, recorded once its owner token is delivered. */

package/dist/plan/platform-diff.js

@@ -234,6 +234,15 @@ export const PLATFORM_AUTH_SMTP_SCOPE_KEY = 'zitadel_platform_smtp_provider_id';
  * requested, so the invite goes out once. `none` when no owner is declared.
  */
 export const PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY = 'zitadel_platform_owner_invite_user_id';
+/**
+ * #394: the id of the role-less ZITADEL machine user that reserves the
+ * username `admin` in the platform's own org, so nobody can sign up under a
+ * name Stalwart maps onto its Admin account. `foundry-admin` is reserved by
+ * the admin machine user itself.
+ */
+export const PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY = 'zitadel_platform_reserved_admin_username';
+/** #394: recorded once the platform's own ZITADEL org has self-registration forced off. */
+export const PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY = 'zitadel_platform_registration_closed';
 export const PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY = 'zitadel_platform_admin_user_id';
 export const PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY = 'zitadel_platform_admin_user_undelivered';
 /** #283: the created instance's id, recorded once its owner token is delivered. */
@@ -1708,7 +1717,10 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
         Boolean(recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY]) &&
         // The ZITADEL run options reach the container only through the auth
         // step's redeploy, so a platform recorded before them still plans it.
-        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
+        // #394: a platform applied before these existed plans the step again.
+        Boolean(recordedIds[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY]) &&
+        Boolean(recordedIds[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY])) {
         return { step: null, blocked: null };
     }
     // The admin key was minted but never reached the host. ZITADEL shows a
@@ -2284,7 +2296,7 @@ function planAccessProvider(platform, recordedIds, executorBlocked) {
  * auth/ZITADEL client: `hc` is an internal operational tool, not something
  * an organisation member signs into. Whether this stays the platform's
  * heartbeat server long-term, instead of or alongside the hand-set-up
- * `hc.wtfalch.dev` instance, and what happens to that instance's own data,
+ * heartbeat instance, and what happens to that instance's own data,
  * are both still open "Decide" items on issue #540's own thread -- not
  * settled by this code.
  *
@@ -2598,7 +2610,7 @@ function planAi(platform, recordedIds, executorBlocked) {
 /**
  * #175: Archon (https://github.com/wtfalch/archon), the one shared console,
  * built fresh at `platform.archon.hostname` (`archon.<apex>`) rather than the
- * hand-deployed `operator.wtfalch.dev` it replaces (#165). One step,
+ * hand-deployed `operator` app it replaces (#165). One step,
  * `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}, covers the app, its
  * database, its Cloudflare tunnel, Access app and DNS record, and its sign-in
  * client in the platform's own ZITADEL -- the same bundling {@link planAuth}

package/dist/plan/platform-org.d.ts

@@ -86,6 +86,8 @@ export interface OrgPlatformReadiness {
     callsReady: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
+    /** `https://<platform.auth.hostname>`, the platform's own sign-in issuer; `null` until {@link authReady}. The owner invite reads its issuer here, never from Agora's host config. */
+    authIssuer: string | null;
     /** The Access provider id the platform recorded (`ACCESS_PROVIDER_RECORD_KEY`), which every gate requires. `null` or absent until the platform has recorded it. */
     accessProviderId?: string | null;
     /** The jobs scheduler (#173) is enabled, applied, has recorded its internal address, and its admin token is held. */

package/dist/plan/platform-org.js

@@ -32,6 +32,7 @@ export const DEFAULT_ORG_PLATFORM_READINESS = {
     aiReady: false,
     callsReady: false,
     authReady: false,
+    authIssuer: null,
     jobsReady: false,
     edgeReady: false,
     missingKeys: { files: null, ai: null, jobs: null },
@@ -106,6 +107,7 @@ edgePortPresent = false) {
     const jobsApplied = platform.jobs.enabled && Boolean(platformRecordedIds[`coolify:jobs:${JOBS_SCHEDULER_KEY}`]);
     const jobsUrl = platformRecordedIds[JOBS_INTERNAL_URL_SCOPE_KEY];
     const edgeApplied = platform.edge.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_EDGE_KEY);
+    const authReady = platform.auth.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY);
     const missing = (applied, ref) => applied && heldRefs !== undefined && !heldRefs.has(ref) ? ref : null;
     const missingKeys = {
         files: missing(filesApplied, ORG_PLATFORM_KEY_REFS.files),
@@ -133,7 +135,8 @@ edgePortPresent = false) {
         ...(platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY]
             ? { accessProviderId: platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY] }
             : {}),
-        authReady: platform.auth.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY),
+        authReady,
+        authIssuer: authReady ? `https://${platform.auth.hostname}` : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
         ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),
         edgeReady: edgeApplied && edgePortPresent,

package/dist/plan/platform-providers.d.ts

@@ -90,7 +90,7 @@ export interface PlatformAuthDeps {
     tunnels: PlatformTunnelsFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'inviteOrgOwner'> & PlatformZitadelSmtp;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'inviteOrgOwner'> & PlatformZitadelSmtp;
     /**
      * Builds the ZITADEL port for the new instance from its issuer URL
      * (`https://<auth.hostname>`). When set it is used instead of

package/dist/plan/platform-providers.js

@@ -9,7 +9,7 @@ import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrSta
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
@@ -500,10 +500,13 @@ export class FoundryPlatformStepExecutor {
         if (platform.files.enabled && this.files && recordedIds[`coolify:app:${PLATFORM_FILES_KEY}`]) {
             // A Coolify read error must not fail the whole plan: treat it as not drifted.
             try {
-                if (await filesRunnerEnvDrifted(this.files.coolify, recordedIds, {
+                const envDrifted = await filesRunnerEnvDrifted(this.files.coolify, recordedIds, {
                     publicHosts: this.files.publicHosts,
                     shareDomains: filesShareDomains(await this.declaredOrgStore.list()),
-                }))
+                });
+                const bootstrapOperatorDrifted = !envDrifted &&
+                    (await filesBootstrapOperatorDrifted(this.files.coolify, recordedIds[`coolify:app:${PLATFORM_FILES_KEY}`], recordedIds));
+                if (envDrifted || bootstrapOperatorDrifted)
                     result.files = true;
             }
             catch {
@@ -903,6 +906,8 @@ const PLATFORM_AUTH_TUNNEL_SCOPE_KEY = 'cloudflare_platform_auth_tunnel';
 /** Recorded once the ZITADEL app has been deployed, so ZITADEL may have written to its database. */
 const PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY = 'zitadel_platform_auth_deployed';
 const PLATFORM_AUTH_ADMIN_USER_NAME = 'foundry-admin';
+/** #394: reserved so nobody signs up as the name Stalwart maps onto its Admin account. */
+const PLATFORM_AUTH_RESERVED_USERNAME = 'admin';
 /** #216 (building on #209/#215): the narrower `IAM_LOGIN_CLIENT` machine user for the login app and the broker. */
 const PLATFORM_AUTH_LOGIN_CLIENT_USER_NAME = 'foundry-login-client';
 const PLATFORM_AUTH_ORG_NAME = 'foundry';
@@ -1125,7 +1130,7 @@ async function liveLoginClientTokenHash(coolify, appId) {
  * `platform.auth.hostname`, then (only the first time) foundry's own admin
  * machine user, handed to {@link PlatformAuthDeps.deliverSecret}. Env values
  * and instance settings are `wtfalch/auth`'s own `docker-compose.yml`
- * (checked 2026-09-29), with `ZITADEL_DOMAIN`/`wtfalch.dev` replaced by this
+ * (checked 2026-09-29), with `ZITADEL_DOMAIN`/`companyincluded.com` replaced by this
  * platform's own `apex`/`auth.hostname` wherever the compose named one --
  * every other setting it leaves open (login v2 required, external port 443,
  * TLS terminated at Cloudflare, `PASSWORDCHANGEREQUIRED` false) is kept
@@ -1815,6 +1820,28 @@ async function provisionPlatformAuth(context, deps, owners = []) {
             }
         }
     }
+    // ---- reserved username and closed registration, once each (#394) ----------
+    // Outside the blocks above so a platform applied before this existed gets
+    // it on its next apply; `planAuth` plans the step until both keys exist.
+    // Last, so a failure here holds up neither the SMTP provider nor the invite.
+    const policyRecorded = context.recordedIds();
+    if (!policyRecorded[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY] ||
+        !policyRecorded[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY]) {
+        const policyZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        let policyOrgId = policyRecorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+        if (!policyOrgId) {
+            policyOrgId = (await policyZitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME)).org.id;
+            await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, policyOrgId);
+        }
+        if (!policyRecorded[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY]) {
+            const { userId } = await policyZitadel.reserveUserName(policyOrgId, PLATFORM_AUTH_RESERVED_USERNAME);
+            await record(PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, userId);
+        }
+        if (!policyRecorded[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY]) {
+            await policyZitadel.closeSelfRegistration(policyOrgId);
+            await record(PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, 'closed');
+        }
+    }
     return { resourceId: zitadelAppId };
 }
 /** Lettermint's SMTP relay, as ZITADEL's SMTP provider wants it: `host:port`, STARTTLS. */
@@ -2034,7 +2061,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  *
  * **Why not `@wtfalch/email/postmaster`'s `mailObjects`/`applyObjects`**, the
  * instance-bootstrap helper `wtfalch-manage` already uses for the hand-built
- * `mail.wtfalch.dev`: that plan also wires an `AcmeProvider` and `DnsServer`
+ * `mail.companyincluded.com`: that plan also wires an `AcmeProvider` and `DnsServer`
  * for Stalwart's own DNS-01 ACME challenge, and an `MtaRoute` that relays
  * every outbound message through the earlier mail provider -- the estate moved transactional
  * mail off it onto Lettermint before this issue (`@wtfalch/mailer` ADR
@@ -2056,7 +2083,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  *   `StepExecutionContext` to carry the platform, which `plan-apply.ts`'s
  *   own doc comment already scoped out of #167 as more than a small change
  *   -- a follow-up issue, not this one. (#205 removed the org step
- *   `coolify:mail`'s own fallback to the hand-built `wtfalch.dev`
+ *   `coolify:mail`'s own fallback to the hand-built mail
  *   instance -- `diff.ts`'s `planMail` already blocks the step until the
  *   platform's own mail is applied, so the fallback only ever served a
  *   plan recorded before that, and now fails loudly instead.)
@@ -2809,7 +2836,7 @@ async function switchOnArchonIdTokenUserinfo(context, deps) {
  * - No API updates an app's Access policy, so a changed include list closes
  *   the tunnel hostname, deletes the Access app and builds it again.
  * - #197: a `cloudflared` connector runs for this tunnel, as in `provisionPlatformAuth`.
- * - Retiring `operator.wtfalch.dev` stays a human step.
+ * - Retiring the hand-deployed `operator` app stays a human step.
  * - #475: deploys this app with a stable `custom_network_aliases` instead of a
  *   fixed `custom_internal_name`, so Coolify runs its rolling update (start
  *   the new container, wait for health, then stop the old one) instead of
@@ -3096,10 +3123,23 @@ async function provisionPlatformArchon(context, deps) {
     if (ownerInviteUserId && ownerInviteUserId !== 'none') {
         envs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: ownerInviteUserId });
     }
+    // #501: a FILES_URL or FILES_AUDIENCE already on the app is kept (the #265
+    // rule above), and hashed as the live value so it never reads as a changed
+    // env.
+    const keepLiveFilesEnv = new Set();
+    for (const key of ['FILES_URL', 'FILES_AUDIENCE']) {
+        const live = await currentEnvValue(deps.coolify, appId, key);
+        if (live) {
+            keepLiveFilesEnv.add(key);
+            archonEnvHashOverrides.set(key, live);
+        }
+    }
     // A value with a line break (the PEM management keys) must be flagged:
     // unflagged, Coolify writes it into `.env` unquoted and the container never
     // starts.
-    envs.push(...inputs.envs.map((e) => (e.value.includes('\n') ? { ...e, multiline: true } : e)));
+    envs.push(...inputs.envs
+        .filter((e) => !keepLiveFilesEnv.has(e.key))
+        .map((e) => (e.value.includes('\n') ? { ...e, multiline: true } : e)));
     // #436: /backups needs a Coolify token scoped to read only, never the
     // root token `putArchonMasterKeys` above already held. Nothing mints that
     // token over Coolify's API (this ref's own doc comment), so until a human
@@ -3196,7 +3236,7 @@ async function provisionPlatformArchon(context, deps) {
         clientIds: [clientId],
         origins: [`https://${hostname}`],
         // #211: `wtfalch/auth`'s broker (`broker/src/apps.ts`'s `parseAppFields`)
-        // falls back to `wtfalch <noreply@wtfalch.dev>` for an entry with no
+        // falls back to its own default sender for an entry with no
         // `from`, and (`wtfalch/auth#179`) an entry with no `from` is dropped
         // entirely -- either way, unset here means Archon's mail comes from
         // the wrong platform or not at all.
@@ -3900,6 +3940,23 @@ async function archonBootstrapOperatorDrifted(coolify, appId, recordedIds) {
         return false;
     }
 }
+/**
+ * #501: {@link archonBootstrapOperatorDrifted} for the files runner. The owner
+ * invite can record after the files step's app id does, so an owner invited
+ * later still gets `AUTHZ_BOOTSTRAP_OPERATOR`. A failed read is not drift.
+ */
+async function filesBootstrapOperatorDrifted(coolify, appId, recordedIds) {
+    const invitedUserId = recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    if (!appId || !invitedUserId || invitedUserId === 'none')
+        return false;
+    try {
+        const live = await currentEnvValue(coolify, appId, 'AUTHZ_BOOTSTRAP_OPERATOR');
+        return live !== invitedUserId;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * #480: whether the live app disagrees with the patch
  * `provisionPlatformArchon` sends on every run -- `is_consistent_container_name_enabled`
@@ -4021,15 +4078,10 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
     for (const service of services) {
         if (service === 'files') {
             envs.push(
-            // #436 round 2: not `PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY`'s
-            // internal `http://<name>:3000` -- Archon's signed path needs an
-            // exact HTTPS origin (`filesOrigin()`/`filesBaseUrl()`,
-            // `wtfalch/archon`'s `src/lib/authz/files-management.ts` and
-            // `src/lib/files-admin/client.ts`), and that origin is also the
-            // signing audience, so it must equal Files' own `APP_URL` exactly
-            // (this file, the files runner env above: `https://${platform.
-            // files.hostname}`).
-            { key: 'FILES_URL', value: `https://${platform.files.hostname}` }, 
+            // #501: Files is private and has no DNS, so FILES_URL is the recorded
+            // internal address; FILES_AUDIENCE is the exact HTTPS origin the
+            // signature is made for, equal to Files' own `APP_URL`.
+            { key: 'FILES_URL', value: recorded[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] }, { key: 'FILES_AUDIENCE', value: `https://${platform.files.hostname}` }, 
             // #436: Company Included's own Files organisation, provisioned by
             // the ordinary per-org `planFilesOrganisation` step under its own
             // org id -- `executor.ts`'s `filesOrganisation` calls
@@ -5357,10 +5409,10 @@ const PLATFORM_FILES_RUNNER_SCOPE_KEY = 'coolify_platform_files_runner_app';
  *   and the optional `KEYS_AUDIT_TOKEN`), `R2_BUCKET`/`R2_ENDPOINT` from
  *   {@link PlatformFilesDeps.r2} (#380, also required), the optional
  *   `FILES_CLAMD_HOST`/`FILES_CLAMD_PORT`, `FILES_PUBLIC_HOSTS` and
- *   `JOBS_SIGNING_SECRETS` the host may supply (#380), and the three
- *   {@link PLATFORM_FILES_RUNNER_DEFAULTS} (#380, written only when absent).
- *   `AUTHZ_BOOTSTRAP_OPERATOR` and the rest of files' `.env.example` are
- *   still set by a person on the runner.
+ *   `JOBS_SIGNING_SECRETS` the host may supply (#380), the three
+ *   {@link PLATFORM_FILES_RUNNER_DEFAULTS} (#380, written only when absent),
+ *   and (#501) `AUTHZ_BOOTSTRAP_OPERATOR`, the same person `platform:archon`
+ *   names. The rest of files' `.env.example` is still set by a person.
  * - The files project lives in the platform's `foundry` ZITADEL org. An
  *   org's Agora requests it as an audience scope from its own ZITADEL org;
  *   whether that needs a project grant per org is not decided here.
@@ -5539,6 +5591,11 @@ shareDomains) {
             key: 'JOBS_SIGNING_SECRETS',
             value: deps.jobsSigningSecrets,
         });
+    // #501: the same person platform:archon names; Files has no sign-in page.
+    const ownerInviteUserId = recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    if (ownerInviteUserId && ownerInviteUserId !== 'none') {
+        runnerOptionalEnvs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: ownerInviteUserId });
+    }
     const runnerEnvs = [
         { key: 'DATABASE_URL', value: runtimeUrl },
         // The management verifier's audience, which must be an HTTPS origin. The

package/dist/plan/providers-readers.d.ts

@@ -1,7 +1,7 @@
 import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import type { CoolifyClient } from '@wtfalch/providers/coolify';
 import { type ZitadelClient } from '@wtfalch/providers/zitadel';
-import type { OrgId } from '../org.js';
+import { type OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import type { AiReader, CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
 /** The `CoolifyClient` methods the readers call, so a host's own implementation needs no cast. */
@@ -68,6 +68,13 @@ export type ScopeResolver = (orgId: OrgId) => Promise<string | null>;
  * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export declare function storeScopeResolver(store: DeclaredOrgStore, serviceKey: string): ScopeResolver;
+/**
+ * #517: resolves the login host an org's sign-in is recorded on
+ * (`zitadel:login-host:<orgId>`, written by `zitadelLoginHost`), for
+ * {@link ProvidersZitadelReader}. The key holds the org id, so it cannot be a
+ * fixed {@link storeScopeResolver} `serviceKey`.
+ */
+export declare function storeLoginHostResolver(store: DeclaredOrgStore): ScopeResolver;
 /**
  * Resolves an estate {@link OrgId} to the provider ids this org's applied
  * state has recorded for one reader's `system`, inverted so a reader can
@@ -131,12 +138,18 @@ export declare class ProvidersCloudflareReader implements CloudflareReader {
  * resource per project and per project grant in a ZITADEL org (v1 scope —
  * see that method's own doc comment), plus (#510) a synthesized `issuer`
  * resource once the org's own ZITADEL org is confirmed live.
+ *
+ * `resolveLoginHost` (#517) is optional; without it the issuer carries no
+ * host. A recorded host under `auth.` is the org's own domain, so the issuer
+ * then also says `usesDomain: true`; any other host (tier 1, shared) says
+ * nothing about `usesDomain`, which `planIssuer` reads as no move.
  */
 export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
+    private readonly resolveLoginHost;
+    constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds, resolveLoginHost?: ScopeResolver);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
     /**
      * #510: `client.listResources` reports only what is *inside* a ZITADEL org

package/dist/plan/providers-readers.js

@@ -1,5 +1,6 @@
 import { ZitadelError } from '@wtfalch/providers/zitadel';
-import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
+import { APP_ENTRY_KEY } from '../org.js';
+import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
  * — the one place foundry records a provider's own id for an org today,
@@ -30,6 +31,18 @@ export function storeScopeResolver(store, serviceKey) {
         return applied?.serviceIds[serviceKey] || null;
     };
 }
+/**
+ * #517: resolves the login host an org's sign-in is recorded on
+ * (`zitadel:login-host:<orgId>`, written by `zitadelLoginHost`), for
+ * {@link ProvidersZitadelReader}. The key holds the org id, so it cannot be a
+ * fixed {@link storeScopeResolver} `serviceKey`.
+ */
+export function storeLoginHostResolver(store) {
+    return async (orgId) => {
+        const applied = await store.getAppliedState(orgId);
+        return applied?.serviceIds[`zitadel:login-host:${orgId}`] || null;
+    };
+}
 export function storeRecordedIds(store, system) {
     return async (orgId) => {
         const applied = await store.getAppliedState(orgId);
@@ -247,7 +260,7 @@ async function withAgoraEnvConfig(client, resource, recorded) {
  * `executor.ts` would write. Gated and failing exactly like
  * {@link withAgoraEnvConfig}.
  */
-async function withBouleEnvConfig(client, resource, recorded) {
+async function withBouleEnvConfig(client, resource, recorded, liveKeys) {
     if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('boule:')) {
         return resource;
     }
@@ -257,7 +270,20 @@ async function withBouleEnvConfig(client, resource, recorded) {
         if (!e.is_preview && managed.includes(e.key))
             env[e.key] = e.value;
     }
-    return { ...resource, config: { ...resource.config, env } };
+    // The hosted app's Lettermint token, as `config.appMailToken`: the one
+    // Boule must hold too. In memory only, compared by `planBoule` and never
+    // written to a step, description or log.
+    const orgId = recorded[resource.key]?.slice('boule:'.length);
+    const appUuid = Object.entries(recorded).find(([, value]) => value === `app:${orgId}:${APP_ENTRY_KEY}`)?.[0];
+    // A recorded app that is not in the live listing is gone: no app token, and
+    // no read of its envs. A listed app whose read fails fails like any read.
+    const appToken = appUuid && liveKeys.has(appUuid)
+        ? (await client.listEnvs(appUuid)).find((e) => !e.is_preview && e.key === BOULE_MAIL_TOKEN_ENV)?.value
+        : undefined;
+    return {
+        ...resource,
+        config: { ...resource.config, env, ...(appToken ? { appMailToken: appToken } : {}) },
+    };
 }
 /** `@wtfalch/providers`' own `LiveResource` (`resource.ts`) has no `system` field — foundry's adds it at this boundary. */
 function toFoundryResources(system, resources) {
@@ -290,7 +316,8 @@ export class ProvidersCoolifyReader {
         const withEnvNames = await Promise.all(withHealthCheck.map((r) => withEnvNamesConfig(this.client, r, recorded)));
         const withDbUrl = await Promise.all(withEnvNames.map((r) => withDatabaseUrlConfig(this.client, r, recorded)));
         const withAgoraConfig = await Promise.all(withDbUrl.map((r) => withAgoraEnvConfig(this.client, r, recorded)));
-        const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded)));
+        const liveKeys = new Set(withAgoraConfig.map((r) => r.key));
+        const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded, liveKeys)));
         return applyRecordedIds(withBouleConfig, recorded);
     }
     /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
@@ -350,15 +377,22 @@ export class ProvidersCloudflareReader {
  * resource per project and per project grant in a ZITADEL org (v1 scope —
  * see that method's own doc comment), plus (#510) a synthesized `issuer`
  * resource once the org's own ZITADEL org is confirmed live.
+ *
+ * `resolveLoginHost` (#517) is optional; without it the issuer carries no
+ * host. A recorded host under `auth.` is the org's own domain, so the issuer
+ * then also says `usesDomain: true`; any other host (tier 1, shared) says
+ * nothing about `usesDomain`, which `planIssuer` reads as no move.
  */
 export class ProvidersZitadelReader {
     client;
     resolveScope;
     resolveRecordedIds;
-    constructor(client, resolveScope, resolveRecordedIds) {
+    resolveLoginHost;
+    constructor(client, resolveScope, resolveRecordedIds, resolveLoginHost = async () => null) {
         this.client = client;
         this.resolveScope = resolveScope;
         this.resolveRecordedIds = resolveRecordedIds;
+        this.resolveLoginHost = resolveLoginHost;
     }
     async listResources(orgId) {
         const zitadelOrgId = await this.resolveScope(orgId);
@@ -402,7 +436,11 @@ export class ProvidersZitadelReader {
                 return null;
             throw err;
         }
-        return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
+        const host = await this.resolveLoginHost(orgId);
+        if (!host)
+            return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
+        const config = host.startsWith('auth.') ? { usesDomain: true, host } : { host };
+        return { system: 'zitadel', kind: 'issuer', key: orgId, config };
     }
 }
 /**

package/dist/plan/step-system.js

@@ -15,6 +15,7 @@ export function stepSystemOf(action) {
         case 'chat':
         case 'calls':
         case 'calls-service':
+        case 'calls-chat':
             return 'matrix';
         case 'database':
         case 'adopt-database':