@wtfalch/foundry 0.29.0 → 0.30.0

package/dist/plan/platform-providers.js

@@ -9,7 +9,7 @@ import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrSta
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
@@ -500,10 +500,13 @@ export class FoundryPlatformStepExecutor {
         if (platform.files.enabled && this.files && recordedIds[`coolify:app:${PLATFORM_FILES_KEY}`]) {
             // A Coolify read error must not fail the whole plan: treat it as not drifted.
             try {
-                if (await filesRunnerEnvDrifted(this.files.coolify, recordedIds, {
+                const envDrifted = await filesRunnerEnvDrifted(this.files.coolify, recordedIds, {
                     publicHosts: this.files.publicHosts,
                     shareDomains: filesShareDomains(await this.declaredOrgStore.list()),
-                }))
+                });
+                const bootstrapOperatorDrifted = !envDrifted &&
+                    (await filesBootstrapOperatorDrifted(this.files.coolify, recordedIds[`coolify:app:${PLATFORM_FILES_KEY}`], recordedIds));
+                if (envDrifted || bootstrapOperatorDrifted)
                     result.files = true;
             }
             catch {
@@ -903,6 +906,8 @@ const PLATFORM_AUTH_TUNNEL_SCOPE_KEY = 'cloudflare_platform_auth_tunnel';
 /** Recorded once the ZITADEL app has been deployed, so ZITADEL may have written to its database. */
 const PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY = 'zitadel_platform_auth_deployed';
 const PLATFORM_AUTH_ADMIN_USER_NAME = 'foundry-admin';
+/** #394: reserved so nobody signs up as the name Stalwart maps onto its Admin account. */
+const PLATFORM_AUTH_RESERVED_USERNAME = 'admin';
 /** #216 (building on #209/#215): the narrower `IAM_LOGIN_CLIENT` machine user for the login app and the broker. */
 const PLATFORM_AUTH_LOGIN_CLIENT_USER_NAME = 'foundry-login-client';
 const PLATFORM_AUTH_ORG_NAME = 'foundry';
@@ -1125,7 +1130,7 @@ async function liveLoginClientTokenHash(coolify, appId) {
  * `platform.auth.hostname`, then (only the first time) foundry's own admin
  * machine user, handed to {@link PlatformAuthDeps.deliverSecret}. Env values
  * and instance settings are `wtfalch/auth`'s own `docker-compose.yml`
- * (checked 2026-09-29), with `ZITADEL_DOMAIN`/`wtfalch.dev` replaced by this
+ * (checked 2026-09-29), with `ZITADEL_DOMAIN`/`companyincluded.com` replaced by this
  * platform's own `apex`/`auth.hostname` wherever the compose named one --
  * every other setting it leaves open (login v2 required, external port 443,
  * TLS terminated at Cloudflare, `PASSWORDCHANGEREQUIRED` false) is kept
@@ -1815,6 +1820,28 @@ async function provisionPlatformAuth(context, deps, owners = []) {
             }
         }
     }
+    // ---- reserved username and closed registration, once each (#394) ----------
+    // Outside the blocks above so a platform applied before this existed gets
+    // it on its next apply; `planAuth` plans the step until both keys exist.
+    // Last, so a failure here holds up neither the SMTP provider nor the invite.
+    const policyRecorded = context.recordedIds();
+    if (!policyRecorded[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY] ||
+        !policyRecorded[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY]) {
+        const policyZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        let policyOrgId = policyRecorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+        if (!policyOrgId) {
+            policyOrgId = (await policyZitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME)).org.id;
+            await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, policyOrgId);
+        }
+        if (!policyRecorded[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY]) {
+            const { userId } = await policyZitadel.reserveUserName(policyOrgId, PLATFORM_AUTH_RESERVED_USERNAME);
+            await record(PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, userId);
+        }
+        if (!policyRecorded[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY]) {
+            await policyZitadel.closeSelfRegistration(policyOrgId);
+            await record(PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, 'closed');
+        }
+    }
     return { resourceId: zitadelAppId };
 }
 /** Lettermint's SMTP relay, as ZITADEL's SMTP provider wants it: `host:port`, STARTTLS. */
@@ -2034,7 +2061,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  *
  * **Why not `@wtfalch/email/postmaster`'s `mailObjects`/`applyObjects`**, the
  * instance-bootstrap helper `wtfalch-manage` already uses for the hand-built
- * `mail.wtfalch.dev`: that plan also wires an `AcmeProvider` and `DnsServer`
+ * `mail.companyincluded.com`: that plan also wires an `AcmeProvider` and `DnsServer`
  * for Stalwart's own DNS-01 ACME challenge, and an `MtaRoute` that relays
  * every outbound message through the earlier mail provider -- the estate moved transactional
  * mail off it onto Lettermint before this issue (`@wtfalch/mailer` ADR
@@ -2056,7 +2083,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  *   `StepExecutionContext` to carry the platform, which `plan-apply.ts`'s
  *   own doc comment already scoped out of #167 as more than a small change
  *   -- a follow-up issue, not this one. (#205 removed the org step
- *   `coolify:mail`'s own fallback to the hand-built `wtfalch.dev`
+ *   `coolify:mail`'s own fallback to the hand-built mail
  *   instance -- `diff.ts`'s `planMail` already blocks the step until the
  *   platform's own mail is applied, so the fallback only ever served a
  *   plan recorded before that, and now fails loudly instead.)
@@ -2809,7 +2836,7 @@ async function switchOnArchonIdTokenUserinfo(context, deps) {
  * - No API updates an app's Access policy, so a changed include list closes
  *   the tunnel hostname, deletes the Access app and builds it again.
  * - #197: a `cloudflared` connector runs for this tunnel, as in `provisionPlatformAuth`.
- * - Retiring `operator.wtfalch.dev` stays a human step.
+ * - Retiring the hand-deployed `operator` app stays a human step.
  * - #475: deploys this app with a stable `custom_network_aliases` instead of a
  *   fixed `custom_internal_name`, so Coolify runs its rolling update (start
  *   the new container, wait for health, then stop the old one) instead of
@@ -3096,10 +3123,23 @@ async function provisionPlatformArchon(context, deps) {
     if (ownerInviteUserId && ownerInviteUserId !== 'none') {
         envs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: ownerInviteUserId });
     }
+    // #501: a FILES_URL or FILES_AUDIENCE already on the app is kept (the #265
+    // rule above), and hashed as the live value so it never reads as a changed
+    // env.
+    const keepLiveFilesEnv = new Set();
+    for (const key of ['FILES_URL', 'FILES_AUDIENCE']) {
+        const live = await currentEnvValue(deps.coolify, appId, key);
+        if (live) {
+            keepLiveFilesEnv.add(key);
+            archonEnvHashOverrides.set(key, live);
+        }
+    }
     // A value with a line break (the PEM management keys) must be flagged:
     // unflagged, Coolify writes it into `.env` unquoted and the container never
     // starts.
-    envs.push(...inputs.envs.map((e) => (e.value.includes('\n') ? { ...e, multiline: true } : e)));
+    envs.push(...inputs.envs
+        .filter((e) => !keepLiveFilesEnv.has(e.key))
+        .map((e) => (e.value.includes('\n') ? { ...e, multiline: true } : e)));
     // #436: /backups needs a Coolify token scoped to read only, never the
     // root token `putArchonMasterKeys` above already held. Nothing mints that
     // token over Coolify's API (this ref's own doc comment), so until a human
@@ -3196,7 +3236,7 @@ async function provisionPlatformArchon(context, deps) {
         clientIds: [clientId],
         origins: [`https://${hostname}`],
         // #211: `wtfalch/auth`'s broker (`broker/src/apps.ts`'s `parseAppFields`)
-        // falls back to `wtfalch <noreply@wtfalch.dev>` for an entry with no
+        // falls back to its own default sender for an entry with no
         // `from`, and (`wtfalch/auth#179`) an entry with no `from` is dropped
         // entirely -- either way, unset here means Archon's mail comes from
         // the wrong platform or not at all.
@@ -3900,6 +3940,23 @@ async function archonBootstrapOperatorDrifted(coolify, appId, recordedIds) {
         return false;
     }
 }
+/**
+ * #501: {@link archonBootstrapOperatorDrifted} for the files runner. The owner
+ * invite can record after the files step's app id does, so an owner invited
+ * later still gets `AUTHZ_BOOTSTRAP_OPERATOR`. A failed read is not drift.
+ */
+async function filesBootstrapOperatorDrifted(coolify, appId, recordedIds) {
+    const invitedUserId = recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    if (!appId || !invitedUserId || invitedUserId === 'none')
+        return false;
+    try {
+        const live = await currentEnvValue(coolify, appId, 'AUTHZ_BOOTSTRAP_OPERATOR');
+        return live !== invitedUserId;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * #480: whether the live app disagrees with the patch
  * `provisionPlatformArchon` sends on every run -- `is_consistent_container_name_enabled`
@@ -4021,15 +4078,10 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
     for (const service of services) {
         if (service === 'files') {
             envs.push(
-            // #436 round 2: not `PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY`'s
-            // internal `http://<name>:3000` -- Archon's signed path needs an
-            // exact HTTPS origin (`filesOrigin()`/`filesBaseUrl()`,
-            // `wtfalch/archon`'s `src/lib/authz/files-management.ts` and
-            // `src/lib/files-admin/client.ts`), and that origin is also the
-            // signing audience, so it must equal Files' own `APP_URL` exactly
-            // (this file, the files runner env above: `https://${platform.
-            // files.hostname}`).
-            { key: 'FILES_URL', value: `https://${platform.files.hostname}` }, 
+            // #501: Files is private and has no DNS, so FILES_URL is the recorded
+            // internal address; FILES_AUDIENCE is the exact HTTPS origin the
+            // signature is made for, equal to Files' own `APP_URL`.
+            { key: 'FILES_URL', value: recorded[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] }, { key: 'FILES_AUDIENCE', value: `https://${platform.files.hostname}` }, 
             // #436: Company Included's own Files organisation, provisioned by
             // the ordinary per-org `planFilesOrganisation` step under its own
             // org id -- `executor.ts`'s `filesOrganisation` calls
@@ -5357,10 +5409,10 @@ const PLATFORM_FILES_RUNNER_SCOPE_KEY = 'coolify_platform_files_runner_app';
  *   and the optional `KEYS_AUDIT_TOKEN`), `R2_BUCKET`/`R2_ENDPOINT` from
  *   {@link PlatformFilesDeps.r2} (#380, also required), the optional
  *   `FILES_CLAMD_HOST`/`FILES_CLAMD_PORT`, `FILES_PUBLIC_HOSTS` and
- *   `JOBS_SIGNING_SECRETS` the host may supply (#380), and the three
- *   {@link PLATFORM_FILES_RUNNER_DEFAULTS} (#380, written only when absent).
- *   `AUTHZ_BOOTSTRAP_OPERATOR` and the rest of files' `.env.example` are
- *   still set by a person on the runner.
+ *   `JOBS_SIGNING_SECRETS` the host may supply (#380), the three
+ *   {@link PLATFORM_FILES_RUNNER_DEFAULTS} (#380, written only when absent),
+ *   and (#501) `AUTHZ_BOOTSTRAP_OPERATOR`, the same person `platform:archon`
+ *   names. The rest of files' `.env.example` is still set by a person.
  * - The files project lives in the platform's `foundry` ZITADEL org. An
  *   org's Agora requests it as an audience scope from its own ZITADEL org;
  *   whether that needs a project grant per org is not decided here.
@@ -5539,6 +5591,11 @@ shareDomains) {
             key: 'JOBS_SIGNING_SECRETS',
             value: deps.jobsSigningSecrets,
         });
+    // #501: the same person platform:archon names; Files has no sign-in page.
+    const ownerInviteUserId = recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    if (ownerInviteUserId && ownerInviteUserId !== 'none') {
+        runnerOptionalEnvs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: ownerInviteUserId });
+    }
     const runnerEnvs = [
         { key: 'DATABASE_URL', value: runtimeUrl },
         // The management verifier's audience, which must be an HTTPS origin. The

package/dist/plan/providers-readers.d.ts

@@ -68,6 +68,13 @@ export type ScopeResolver = (orgId: OrgId) => Promise<string | null>;
  * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export declare function storeScopeResolver(store: DeclaredOrgStore, serviceKey: string): ScopeResolver;
+/**
+ * #517: resolves the login host an org's sign-in is recorded on
+ * (`zitadel:login-host:<orgId>`, written by `zitadelLoginHost`), for
+ * {@link ProvidersZitadelReader}. The key holds the org id, so it cannot be a
+ * fixed {@link storeScopeResolver} `serviceKey`.
+ */
+export declare function storeLoginHostResolver(store: DeclaredOrgStore): ScopeResolver;
 /**
  * Resolves an estate {@link OrgId} to the provider ids this org's applied
  * state has recorded for one reader's `system`, inverted so a reader can
@@ -131,12 +138,18 @@ export declare class ProvidersCloudflareReader implements CloudflareReader {
  * resource per project and per project grant in a ZITADEL org (v1 scope —
  * see that method's own doc comment), plus (#510) a synthesized `issuer`
  * resource once the org's own ZITADEL org is confirmed live.
+ *
+ * `resolveLoginHost` (#517) is optional; without it the issuer carries no
+ * host. A recorded host under `auth.` is the org's own domain, so the issuer
+ * then also says `usesDomain: true`; any other host (tier 1, shared) says
+ * nothing about `usesDomain`, which `planIssuer` reads as no move.
  */
 export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
+    private readonly resolveLoginHost;
+    constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds, resolveLoginHost?: ScopeResolver);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
     /**
      * #510: `client.listResources` reports only what is *inside* a ZITADEL org

package/dist/plan/providers-readers.js

@@ -31,6 +31,18 @@ export function storeScopeResolver(store, serviceKey) {
         return applied?.serviceIds[serviceKey] || null;
     };
 }
+/**
+ * #517: resolves the login host an org's sign-in is recorded on
+ * (`zitadel:login-host:<orgId>`, written by `zitadelLoginHost`), for
+ * {@link ProvidersZitadelReader}. The key holds the org id, so it cannot be a
+ * fixed {@link storeScopeResolver} `serviceKey`.
+ */
+export function storeLoginHostResolver(store) {
+    return async (orgId) => {
+        const applied = await store.getAppliedState(orgId);
+        return applied?.serviceIds[`zitadel:login-host:${orgId}`] || null;
+    };
+}
 export function storeRecordedIds(store, system) {
     return async (orgId) => {
         const applied = await store.getAppliedState(orgId);
@@ -365,15 +377,22 @@ export class ProvidersCloudflareReader {
  * resource per project and per project grant in a ZITADEL org (v1 scope —
  * see that method's own doc comment), plus (#510) a synthesized `issuer`
  * resource once the org's own ZITADEL org is confirmed live.
+ *
+ * `resolveLoginHost` (#517) is optional; without it the issuer carries no
+ * host. A recorded host under `auth.` is the org's own domain, so the issuer
+ * then also says `usesDomain: true`; any other host (tier 1, shared) says
+ * nothing about `usesDomain`, which `planIssuer` reads as no move.
  */
 export class ProvidersZitadelReader {
     client;
     resolveScope;
     resolveRecordedIds;
-    constructor(client, resolveScope, resolveRecordedIds) {
+    resolveLoginHost;
+    constructor(client, resolveScope, resolveRecordedIds, resolveLoginHost = async () => null) {
         this.client = client;
         this.resolveScope = resolveScope;
         this.resolveRecordedIds = resolveRecordedIds;
+        this.resolveLoginHost = resolveLoginHost;
     }
     async listResources(orgId) {
         const zitadelOrgId = await this.resolveScope(orgId);
@@ -417,7 +436,11 @@ export class ProvidersZitadelReader {
                 return null;
             throw err;
         }
-        return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
+        const host = await this.resolveLoginHost(orgId);
+        if (!host)
+            return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
+        const config = host.startsWith('auth.') ? { usesDomain: true, host } : { host };
+        return { system: 'zitadel', kind: 'issuer', key: orgId, config };
     }
 }
 /**

package/dist/plan/step-system.js

@@ -15,6 +15,7 @@ export function stepSystemOf(action) {
         case 'chat':
         case 'calls':
         case 'calls-service':
+        case 'calls-chat':
             return 'matrix';
         case 'database':
         case 'adopt-database':

package/dist/plan/version-status.d.ts

@@ -0,0 +1,200 @@
+import type { OrgId } from '../org.js';
+import type { VersionChangeItem } from '../plan.js';
+/**
+ * #263: a read-only view of which `@wtfalch/*` versions each org's hosted
+ * app is actually running, beside the platform's own version-change lines
+ * (`plan.ts`'s {@link VersionChangeItem}, #251) -- the data behind Archon's
+ * "Shared platform page" (wtfalch/archon#133). Nothing here mutates
+ * anything; it only reads.
+ *
+ * The problem this exists for: a shared service (ZITADEL, Synapse, the
+ * jobs scheduler, ...) has one declared version on `DeclaredPlatform`, but
+ * each org's own hosted app pulls its `@wtfalch/*` dependencies from
+ * whatever its own `pnpm-lock.yaml` pinned the day it was last deployed --
+ * and nothing before this listed who is actually on what.
+ */
+/**
+ * One org app this reads status for. The caller resolves `repo` and
+ * `coolifyApplicationUuid` itself, the same way every other reader in this
+ * package is handed an already-resolved scope id rather than resolving one
+ * itself (`providers-readers.ts`'s `ScopeResolver` doc comment) --
+ * `coolifyApplicationUuid` is the id `plan/diff.ts`'s `appStepKey` keys an
+ * org's hosting entry under in `AppliedState.serviceIds`
+ * (`` `coolify:app:${appStepKey(org, entry.key)}` ``, `org.ts`); `repo` is
+ * `HostingEntry.repo`, falling back to whatever default an app with none
+ * declared resolves to (`plan/executor.ts`'s own `DEFAULT_APP_REPO`).
+ */
+export interface OrgAppVersionRef {
+    orgId: OrgId;
+    orgSlug: string;
+    /** The hosting entry's own key, e.g. `'app'` (`org.ts`'s `APP_ENTRY_KEY`). */
+    entryKey: string;
+    /** The repo under `wtfalch` this app builds from, e.g. `'wtfalch/lokessmie'`. */
+    repo: string;
+    coolifyApplicationUuid: string;
+}
+/** One org app's read status: what is actually deployed, and what it depends on. */
+export interface OrgAppVersionStatus {
+    orgId: OrgId;
+    orgSlug: string;
+    entryKey: string;
+    repo: string;
+    /**
+     * The full 40-character commit sha Coolify's own deployment history
+     * reports as currently deployed (Choice A, #263's "Decide": Coolify's
+     * application record is live truth over foundry's own last-applied
+     * record, at the cost of a Coolify call this function always makes).
+     * `null` when there is no finished deployment yet -- a brand new app, or
+     * one whose only deploy so far failed.
+     */
+    deployedSha: string | null;
+    /**
+     * `@wtfalch/*` package name to resolved version, read from this app's
+     * `pnpm-lock.yaml` at {@link deployedSha}. `null` when there is nothing to
+     * read it from yet (`deployedSha` is `null`) or the read itself failed --
+     * {@link error} says which.
+     */
+    wtfalchVersions: Record<string, string> | null;
+    /** Set when this app's status could not be fully read; `wtfalchVersions` is `null` in this case too. */
+    error: string | null;
+}
+/** Across every app a call named, one `@wtfalch/*` package's spread of versions. */
+export interface WtfalchPackageDrift {
+    package: string;
+    /** Every distinct version seen, each with the org slugs running it, so a human reads who's on what with no cross-reference against `apps`. */
+    versionsBySlug: Record<string, string[]>;
+    /**
+     * The version a caller declared as the intended one for this package, if
+     * it passed one in `declaredVersions` (#263's "or from the declared
+     * one") -- never guessed here: this package has no fixed mapping from a
+     * `PlatformServiceKey` to an npm package name, so a caller that has one
+     * (or none) decides.
+     */
+    declaredVersion?: string;
+    /** True once more than one version is in use across `apps`, or an app's version differs from `declaredVersion`. */
+    drifted: boolean;
+}
+/** The combined view {@link readPlatformVersionStatus} returns. */
+export interface PlatformVersionStatus {
+    apps: OrgAppVersionStatus[];
+    /** Sorted by package name. */
+    packageDrift: WtfalchPackageDrift[];
+    /**
+     * The platform's own version-change lines (#251), carried through
+     * unchanged so a caller can render them on the same page with one call
+     * instead of two -- `toPlatformPlan`'s own `Plan.versionChanges`, or
+     * `PlatformPlanDetail.versionChanges` directly.
+     */
+    platformVersionChanges: VersionChangeItem[];
+}
+/**
+ * Reads one application's currently deployed commit sha.
+ *
+ * Narrow on purpose, the same shape every other port in `executor.ts`
+ * takes (`CoolifyPort`, `CloudflarePort`, ...): a real implementation is
+ * {@link providersStatusCoolifyPort}, over `@wtfalch/providers/coolify`'s
+ * `CoolifyClient`; a fake satisfies this directly in a test.
+ */
+export interface StatusCoolifyPort {
+    /**
+     * `null` when there is no *finished* deployment yet
+     * (`@wtfalch/providers/coolify`'s own doc comment on
+     * `CoolifyDeploymentRecord`: an application's bare `status` field reports
+     * on the container that is currently *running*, not on whether the last
+     * deploy actually landed, so a failed build leaves the previous image
+     * running and healthy with nothing in that field to say so -- this reads
+     * the deployment history instead, exactly as that doc comment advises).
+     */
+    deployedSha(applicationUuid: string): Promise<string | null>;
+}
+/**
+ * Reads one file's text contents in a GitHub repo, at a git ref.
+ *
+ * `@wtfalch/providers` 0.6.0's `GitHubClient` (`dist/github.d.ts`) has no
+ * such method yet, and this repo cannot add one to that published package
+ * from here -- so this is foundry's own minimal port for exactly the one
+ * capability #263 needs, built the same injectable way `GitHubClient`
+ * itself is (its own `GhExec`), so a host can later swap in a real
+ * `providers` method with no change to anything that depends on this
+ * interface.
+ */
+export interface StatusGithubPort {
+    /** `null` when `path` does not exist at `ref` (or `ref` itself does not exist). */
+    getFileContents(repo: string, path: string, ref: string): Promise<string | null>;
+}
+/**
+ * Extracts every `@wtfalch/*` package's resolved version out of a pnpm
+ * lockfile's text, without parsing YAML in general.
+ *
+ * pnpm lockfile v9 (`lockfileVersion: '9.0'`, this estate's own) writes each
+ * resolved package as a two-space-indented, single-quoted
+ * `'<name>@<version>'` key in its `packages:` section, and again --
+ * peer-qualified, e.g. `'<name>@<version>(<peer>@<peer-version>...)'` -- in
+ * its `snapshots:` section. Both carry the same base version for a given
+ * package, so reading either (or both, as this does) and keeping the last
+ * value seen per package name is lossless for what this exists to compare:
+ * *which version* an app is on, never which peer graph it resolved to.
+ * Verified against this very repo's own `pnpm-lock.yaml`.
+ */
+export declare function wtfalchVersionsFromPnpmLockfile(lockfile: string): Record<string, string>;
+export interface ReadPlatformVersionStatusOptions {
+    /** Default `'pnpm-lock.yaml'`. */
+    lockfilePath?: string;
+    /**
+     * The intended version for a package, keyed by its `@wtfalch/*` name --
+     * #263's "or from the declared one". Optional: without it, drift is
+     * computed across `apps` alone.
+     */
+    declaredVersions?: Readonly<Record<string, string>>;
+    /** Carried straight through onto {@link PlatformVersionStatus.platformVersionChanges}; defaults to none. */
+    platformVersionChanges?: readonly VersionChangeItem[];
+}
+/**
+ * Reads every named app's deployed sha and the `@wtfalch/*` versions its
+ * lockfile pins at that sha, then flags which packages have drifted --
+ * across the named apps, or against a declared version when the caller
+ * passes one (#263's "Done when": two orgs on different `@wtfalch/auth`
+ * versions is flagged).
+ *
+ * One app's read failing (its sha cannot be found, or its lockfile fetch
+ * errors) is recorded on that app alone (`OrgAppVersionStatus.error`) and
+ * never stops another app's read, or the drift computed from whichever
+ * apps did resolve.
+ */
+export declare function readPlatformVersionStatus(apps: readonly OrgAppVersionRef[], ports: {
+    coolify: StatusCoolifyPort;
+    github: StatusGithubPort;
+}, options?: ReadPlatformVersionStatusOptions): Promise<PlatformVersionStatus>;
+/**
+ * The real {@link StatusCoolifyPort}, over `@wtfalch/providers/coolify`'s
+ * `CoolifyClient` (Choice A, #263's "Decide"). Narrowed to the one method
+ * this needs, the same `Pick`-shaped narrowing nothing else in this package
+ * happened to need before -- `CoolifyClient` itself is never imported as a
+ * type here, so a fake in a test needs no part of its surface this doesn't use.
+ */
+export declare function providersStatusCoolifyPort(client: {
+    listApplicationDeployments(uuid: string, take?: number): Promise<Array<{
+        commit: string;
+        status: string;
+    }>>;
+}): StatusCoolifyPort;
+/**
+ * The `gh` CLI call {@link ghCliStatusGithubPort} makes -- same shape as
+ * `@wtfalch/providers/github`'s own `GhExec`, so a host that already has a
+ * real one wired for `GitHubClient` can hand the identical function to
+ * both. Injectable so a test never spawns a real process.
+ */
+export type GhExec = (args: string[]) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * The real {@link StatusGithubPort}, built on `gh api repos/{repo}/contents/{path}`
+ * the way GitHub's own REST API serves a file's contents at a ref --
+ * `{ content: '<base64>' }` on success, a non-zero exit with `404` in `gh`'s
+ * own error text when `path` or `ref` doesn't exist (checked against a real
+ * `gh` CLI, not GitHub's docs, matching this package's `coolify.ts`'s own
+ * "verified against a live instance, not the docs" standard for an API this
+ * cannot run against the network in CI).
+ */
+export declare function ghCliStatusGithubPort(exec?: GhExec): StatusGithubPort;