@wtfalch/foundry 0.31.0 → 0.33.1

package/dist/plan/executor.js

@@ -1,9 +1,10 @@
 import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
+import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -27,6 +28,7 @@ import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyC
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
@@ -51,7 +53,7 @@ import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerR
  */
 /** #569: the description foundry gives the Coolify project it creates for an org. */
 const COOLIFY_PROJECT_MARK_PREFIX = 'foundry org ';
-function coolifyProjectMark(org) {
+export function coolifyProjectMark(org) {
     return `${COOLIFY_PROJECT_MARK_PREFIX}${org.id}`;
 }
 /**
@@ -230,24 +232,6 @@ const RATE_LIMIT_RULE_DESCRIPTION = 'foundry: rate limit sign-in paths';
  */
 const RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS = 10;
 const RATE_LIMIT_REQUESTS_PER_PERIOD = 10;
-/**
- * The shared standard app a level-1 org with no `bespokeAppRepo` gets
- * deployed (gap P1, `.plans/2026-09-26-level-1-org-map.md`): one repo, the
- * same for every such org, decided by William 2026-09-26. `coolifyApp` below
- * names it as the git source in exactly the shape `bespokeAppRepo` itself
- * uses (`org.ts`'s `DeclaredOrg.bespokeAppRepo: string | null`) whenever an
- * org declares none of its own — the repo may not exist yet at decision
- * time, and Coolify's own GitHub App create call is what will fail loudly
- * against it, the same as any other repo name that does not exist.
- *
- * Hestia moved into this repo's own `apps/hestia` (estate DECISIONS.md,
- * 2026-09-28; the hestia repo archives once this move lands), so the
- * standard app now builds from foundry's own repo, told apart from
- * `packages/foundry` by `dockerfile_location` — the same one-repo,
- * multiple-apps shape `cmsSite`/`CMS_APP_DOCKERFILE` already use below.
- */
-const DEFAULT_APP_REPO = 'wtfalch/foundry';
-const DEFAULT_APP_DOCKERFILE = '/apps/hestia/Dockerfile';
 /**
  * The shared repo `cmsSite` builds its cms admin app from, always, and its
  * site app from by default (https://github.com/wtfalch/cms) -- the
@@ -275,7 +259,7 @@ const CMS_APP_PORT = 3000;
  * #164: the repo `coolifyAgora` builds the org's Agora from
  * (https://github.com/wtfalch/agora) -- the issue's own "How" names this
  * exact Dockerfile, and it is the only build strategy any app this file
- * provisions ever uses ({@link DEFAULT_APP_DOCKERFILE}/{@link CMS_APP_DOCKERFILE}/
+ * provisions ever uses ({@link CMS_APP_DOCKERFILE}/
  * `CALLS_SERVICE_DOCKERFILE` below are all `dockerfile_location` into a
  * `createGithubAppApplication` build-from-repo call, never a registry
  * image): "Coolify builds each org's Agora from the agora repo" is not a
@@ -779,9 +763,14 @@ export class FoundryStepExecutor {
     edgeRateLimits;
     edgeZones;
     edgeWriteSlot;
+    /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
+    handledSecrets = new Set();
     constructor(ports) {
         this.ports = ports;
     }
+    secretsHandled() {
+        return [...this.handledSecrets];
+    }
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts() {
         return {
@@ -797,6 +786,10 @@ export class FoundryStepExecutor {
         switch (`${action.system}:${action.kind}`) {
             case 'zitadel:issuer':
                 return this.zitadelIssuer(action, org, context);
+            case 'zitadel:registration-closed':
+                return this.zitadelRegistrationClosed(org, context);
+            case 'zitadel:domain':
+                return this.zitadelDomain(action, org, context);
             case 'zitadel:owner':
                 return this.zitadelOwner(action, org, context);
             case 'zitadel:login-host':
@@ -1308,17 +1301,60 @@ export class FoundryStepExecutor {
             // their own design" -- not built in v1).
             throw new NotBuiltError(`zitadel:issuer move for ${org.slug}`, 'moving the issuer onto or off the org\'s own domain is not built in v1; see foundry\'s .claude/decisions-2026-09-24-executor.md, "Executor decisions"');
         }
-        const { org: zOrg } = await this.ports.zitadel.findOrCreateOrg(org.slug);
-        context.recordScopeId('zitadel_org', zOrg.id);
-        return { resourceId: zOrg.id };
+        const { orgId } = await ensureSignInOrg({
+            zitadel: this.ports.zitadel,
+            name: org.slug,
+            domain: signInOrgDomain(org),
+            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            persistScopeIds: () => context.persistScopeIds(),
+            registrationClosedScopeKey: ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY,
+        });
+        return { resourceId: orgId };
+    }
+    /**
+     * `plan/diff.ts`'s `planOrgRegistrationClosed`: closes self-registration on
+     * the recorded ZITADEL org, for an org made before foundry did this or whose
+     * close failed in the issuer step. Recorded only after the close returned.
+     */
+    async zitadelRegistrationClosed(org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:registration-closed for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        await closeSignInOrgRegistration(this.ports.zitadel, zitadelOrgId, (key, id) => context.recordScopeId(key, id));
+        return {};
     }
     /**
-     * `plan/diff.ts`'s `planOwner`: invites the org's owner into its ZITADEL
-     * org by email. Never logs, returns or throws the email itself -- only the
-     * invited user id, handed back as `resourceId` so `runSteps` records it
-     * under `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
-     * `plan()` call idempotent (`planOwner` plans nothing once that key is
-     * recorded).
+     * `plan/diff.ts`'s `planOrgDomain`: registers the org's sign-in domain on
+     * its recorded ZITADEL org and makes it primary, for an org whose ZITADEL
+     * org was made before foundry did this. Records the domain only after both
+     * calls succeeded.
+     */
+    async zitadelDomain(action, org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:domain for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        const domain = action.desired.domain;
+        // A refusal (the sign-in server's domain policy wants proof) is recorded and reported as
+        // blocked by the planner; it does not fail every apply.
+        const registered = await registerSignInDomainOrBlock(this.ports.zitadel, zitadelOrgId, domain, (key, id) => context.recordScopeId(key, id));
+        if (registered)
+            context.recordScopeId(ZITADEL_ORG_DOMAIN_SCOPE_KEY, domain);
+        return {};
+    }
+    /**
+     * `plan/diff.ts`'s `planOwners`: makes the owner's account in the org's
+     * ZITADEL org and mails the first-sign-in link to their personal address.
+     * The account's username is the local part of `mailboxAddress` and its email
+     * is `mailboxAddress`, so the owner signs in as `name@<org domain>`; the
+     * personal address is kept as the `personal_email` metadata. The invite code
+     * ZITADEL returns goes only into that mail. Nothing here logs, returns or
+     * throws the personal address or the code -- only the invited user id, handed
+     * back as `resourceId` so `runSteps` records it under
+     * `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
+     * `plan()` call idempotent. A failure after the account exists records
+     * nothing: the next apply finds the account by username and mints a new code.
      */
     async zitadelOwner(action, org, context) {
         const zitadelOrgId = context.recordedIds().zitadel_org;
@@ -1331,11 +1367,31 @@ export class FoundryStepExecutor {
         if (!authIssuer) {
             throw new Error(`zitadel:owner for ${org.slug}: no invite template issuer -- refusing to send ZITADEL's default invite link, which 404s on this platform`);
         }
-        const { userId } = await this.ports.zitadel.inviteOrgOwner(zitadelOrgId, {
-            givenName: action.desired.givenName,
-            familyName: action.desired.familyName,
-            email: action.desired.email,
-        }, `${authIssuer}/verify?userId={{.UserID}}&code={{.Code}}&organization={{.OrgID}}&invite=true`);
+        const mailboxAddress = action.desired.mailboxAddress;
+        if (!mailboxAddress) {
+            throw new Error(`zitadel:owner for ${org.slug}: no mailboxAddress -- the planner reports this as blocked, so it should not reach the executor`);
+        }
+        const inviteMail = this.ports.ownerInviteMail;
+        if (!inviteMail) {
+            throw new Error(`zitadel:owner for ${org.slug}: no ownerInviteMail port -- the owner's work mailbox cannot be opened yet, so the invite is not sent there`);
+        }
+        // foundry's own record of this owner's account, so a returning owner is not mistaken for a stranger.
+        const invitedBefore = context.recordedIds()[`zitadel:owner:${action.key}`];
+        const { userId } = await inviteOwnerWithLink({
+            zitadel: this.ports.zitadel,
+            mail: inviteMail,
+            orgId: zitadelOrgId,
+            authIssuer,
+            owner: {
+                givenName: action.desired.givenName,
+                familyName: action.desired.familyName,
+                mailboxAddress,
+                personalEmail: action.desired.email,
+            },
+            label: `zitadel:owner for ${org.slug}`,
+            onSecret: (value) => this.handledSecrets.add(value),
+            ...(invitedBefore ? { invitedUserId: invitedBefore } : {}),
+        });
         // An owner invited after chat was built never reaches `coolifyChat`
         // again, so the role is granted here once the messaging project exists.
         const messagingProjectId = context.recordedIds()[ZITADEL_MESSAGING_PROJECT_SCOPE_KEY];
@@ -1868,7 +1924,19 @@ export class FoundryStepExecutor {
         const recordedAppId = context.recordedIds()[`coolify:app:${action.key}`];
         if (action.desired.enabled === false) {
             if (!recordedAppId) {
-                throw new Error(`coolify:app for ${org.slug}: no live app recorded, nothing to park`);
+                throw new Error(`coolify:app for ${org.slug}: no live app recorded, nothing to ${action.desired.delete === true ? 'delete' : 'park'}`);
+            }
+            // `planApp` sets `delete` only on the retired default app. A 404 counts
+            // as deleted, so a retry after a crash past the Coolify delete succeeds.
+            if (action.desired.delete === true) {
+                try {
+                    await this.ports.coolify.deleteApplication(recordedAppId);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+                return {};
             }
             await this.ports.coolify.raw('POST', `/applications/${recordedAppId}/stop`);
             return { resourceId: recordedAppId };
@@ -1876,10 +1944,12 @@ export class FoundryStepExecutor {
         const entry = org.hosting.entries.find((e) => appStepKey(org, e.key) === action.key);
         if (!entry)
             throw new Error(`coolify:app for ${org.slug}: no hosting entry for ${action.key}`);
-        // A level-1 org with no bespoke app of its own gets the shared standard
-        // app instead (gap P1, `.plans/2026-09-26-level-1-org-map.md`): an entry
-        // with no `repo`.
-        const appRepo = entry.repo ?? DEFAULT_APP_REPO;
+        // `planApp` blocks a `repo: null` entry at plan time; reaching here with
+        // one means a stale or hand-built plan.
+        if (entry.repo === null) {
+            throw new Error(`coolify:app for ${org.slug}: entry '${entry.key}' has no repo`);
+        }
+        const appRepo = entry.repo;
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         // The recorded id first; the name when nothing is recorded, or when the
@@ -1953,9 +2023,6 @@ export class FoundryStepExecutor {
                 // copies `base_directory`, and reads `publish_directory` only for a
                 // built app.
                 base_directory: entry.folder === null ? undefined : `/${entry.folder}`,
-                // Only the shared standard app builds from this repo; a bespoke
-                // app's Dockerfile is at its own repo's root.
-                dockerfile_location: entry.repo ? undefined : DEFAULT_APP_DOCKERFILE,
             });
             appId = created.uuid;
             // Create sent every setting, so nothing is left to patch.
@@ -2500,6 +2567,23 @@ export class FoundryStepExecutor {
         // Last: a run that failed above plans the step again.
         context.recordScopeId(brokerEntryAppliedScopeKey(entryKey), JSON.stringify(want));
     }
+    /**
+     * `null` once the app already has `AUTHZ_PEER_PASSWORD_OPERATOR`: minted only
+     * the first time and never rotated, like {@link ensureAuthCookieSecret}.
+     */
+    async ensurePeerPassword(appId) {
+        return this.mintIfAbsent(appId, BOULE_PEER_PASSWORD_ENV, 24);
+    }
+    /** Same rule for the secret Archon's invite form sends to Boule. */
+    async ensureBridgeSecret(appId) {
+        return this.mintIfAbsent(appId, BOULE_BRIDGE_SECRET_ENV, 32);
+    }
+    async mintIfAbsent(appId, key, bytes) {
+        const envs = await this.ports.coolify.listEnvs(appId);
+        if (envs.some((e) => e.key === key && !e.is_preview))
+            return null;
+        return randomBytes(bytes).toString('base64url');
+    }
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
      * only the first time (task brief), never regenerated or overwritten, so a
@@ -4714,7 +4798,29 @@ export class FoundryStepExecutor {
         const appKey = await this.ensureAuthAppKey(app.appId);
         if (appKey)
             envs.push({ key: 'AUTH_APP_KEY', value: appKey });
-        await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        // Archon's way into this Boule's people store: only the platform's own
+        // org's Boule gets it, minted once and never rotated (the role Boule's boot
+        // creates from it would otherwise keep the old password).
+        const peerPassword = action.desired.platformOwner === true ? await this.ensurePeerPassword(app.appId) : null;
+        if (peerPassword) {
+            this.handledSecrets.add(peerPassword);
+            envs.push({ key: BOULE_PEER_PASSWORD_ENV, value: peerPassword });
+        }
+        // Archon's invite form calls Boule with this secret; same rule as the password.
+        const bridgeSecret = action.desired.platformOwner === true ? await this.ensureBridgeSecret(app.appId) : null;
+        if (bridgeSecret) {
+            this.handledSecrets.add(bridgeSecret);
+            envs.push({ key: BOULE_BRIDGE_SECRET_ENV, value: bridgeSecret });
+        }
+        try {
+            await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        }
+        catch (error) {
+            const minted = [peerPassword, bridgeSecret].filter((v) => v !== null);
+            if (minted.length === 0)
+                throw error;
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), minted));
+        }
         const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName);
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
@@ -4730,6 +4836,8 @@ export class FoundryStepExecutor {
         // that a previous apply created but crashed before deploying) sat built
         // but never started. Deployed once this executor has confirmed, never
         // again -- a live app is only ever restarted from here on.
+        const secretsNotRestarted = action.desired.platformOwner === true &&
+            !context.recordedIds()[BOULE_SECRETS_RESTARTED_SCOPE_KEY];
         if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
             // #543: every deploy waits for health -- Boule's own public hostname.
             const runtime = this.ports.runtime ?? {};
@@ -4738,10 +4846,21 @@ export class FoundryStepExecutor {
         }
         else if (app.existed &&
             !mail.restarted &&
-            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed || mail.changed)) {
+            (envChanged ||
+                cookieSecret !== null ||
+                appKey !== null ||
+                peerPassword !== null ||
+                bridgeSecret !== null ||
+                secretsNotRestarted ||
+                dbPush.changed ||
+                mail.changed)) {
             // A restart inside the mail rule already came after every env write above.
             await this.ports.coolify.restart(app.appId);
         }
+        // Last, after the restart or deploy: a run that failed before here repeats it, minting nothing.
+        if (action.desired.platformOwner === true) {
+            context.recordScopeId(BOULE_SECRETS_RESTARTED_SCOPE_KEY, '1');
+        }
         return { resourceId: app.appId };
     }
     /**

package/dist/plan/health-targets.js

@@ -28,7 +28,7 @@ const CALLS_HEALTH_PATH = '/healthz';
 function alwaysOnTargets(org, platform) {
     // The platform's own org signs in on the shared instance host, not its own
     // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
-    const loginHost = platform && isPlatformOwnOrg(org, platform.apex)
+    const loginHost = platform && isPlatformOwnOrg(org, platform.ownerOrgId)
         ? platform.auth.hostname
         : loginHostnameFor(org);
     return [

package/dist/plan/index.d.ts

@@ -12,8 +12,9 @@ export type { PlatformOrgClientFactories } from './platform-org-ports.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export type { AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot } from './adopt.js';
 export { AdoptRefusedError } from './adopt.js';
-export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
@@ -40,6 +41,8 @@ export type { MailAllowlistApp } from './mail-identity-allowlist.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export type { EnsureSignInOrgOptions } from './sign-in-org.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './sign-in-org.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './health-targets.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
 export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';

package/dist/plan/index.js

@@ -5,7 +5,7 @@ export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDUL
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
@@ -21,6 +21,7 @@ export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './sign-in-org.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
 export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
 export { createEdgeAccess } from './edge-access.js';

package/dist/plan/plan-apply.d.ts

@@ -7,6 +7,7 @@ import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
 import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js';
 import { type AgoraHostPort } from './agora.js';
+import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type EdgePortName, type HeldKeyResolver } from './platform-org.js';
@@ -171,6 +172,12 @@ export interface StepExecutor {
      * an executor without it supplies none.
      */
     ownEdgePorts?(): Partial<Record<EdgePortName, boolean>>;
+    /**
+     * Every secret this executor minted or read so far (peer password, bridge
+     * secret, invite code and link). The host's run adds them to its redactor
+     * after each step, so an error or progress line that quotes one is masked.
+     */
+    secretsHandled?(): readonly string[];
 }
 /**
  * #167: {@link StepExecutionContext}'s platform-scoped counterpart -- what
@@ -313,6 +320,15 @@ export declare class StalePlanError extends Error {
 export declare class ConfirmationRequiredError extends Error {
     constructor(orgId: OrgId);
 }
+/**
+ * A plan holds a version change that needs confirmation
+ * (`VersionChangeItem.needsConfirmation`) and `confirmUpgrade` does not name
+ * its service exactly. `upgrades` lists every such service with its versions.
+ */
+export declare class UpgradeConfirmationRequiredError extends Error {
+    readonly upgrades: readonly UnconfirmedUpgrade[];
+    constructor(upgrades: readonly UnconfirmedUpgrade[]);
+}
 export declare class NotAuthorizedError extends Error {
     constructor(actor: AuditActor, orgId: OrgId);
 }
@@ -336,6 +352,11 @@ export declare class PlatformStalePlanError extends Error {
 export declare class PlatformConfirmationRequiredError extends Error {
     constructor();
 }
+/** The third argument of `apply` and `applyPlatform`. */
+export interface FoundryApplyOptions {
+    /** Service names (`VersionChangeItem.service`), matched exactly, whose version change the operator confirmed. */
+    confirmUpgrade?: readonly string[];
+}
 export interface FoundryPlanApplyOptions {
     store: DeclaredOrgStore;
     readers: LiveReaders;
@@ -380,6 +401,12 @@ export interface FoundryPlanApplyOptions {
      * reported blocked instead of planned.
      */
     edgeWorkers?: boolean;
+    /**
+     * True when the host's executor was built with `ownerInviteMail`. Optional,
+     * and false without it: each owner's invite is then reported blocked
+     * instead of planned.
+     */
+    ownerInviteMail?: boolean;
     /**
      * #177: true when the host's executor was built with its own `filesOrganisation`
      * / `aiOrganisation` port. Without one, the org step needs the platform's
@@ -393,6 +420,15 @@ export interface FoundryPlanApplyOptions {
      * reported blocked instead of planned to fail.
      */
     edge?: boolean;
+    /**
+     * Narrows every org plan to the steps `step` accepts, and its blocked items
+     * to the keys `blocked` accepts, so a plan, its stale check and its apply
+     * all see the same slice. Absent: the whole plan.
+     */
+    onlySteps?: {
+        step(action: StepAction): boolean;
+        blocked(key: string): boolean;
+    };
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -471,9 +507,11 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly zitadelIdTokenUserinfo;
     private readonly broker;
     private readonly edgeWorkers;
+    private readonly ownerInviteMail;
     private readonly hostFiles;
     private readonly hostAi;
     private readonly hostEdge;
+    private readonly onlySteps;
     private readonly now;
     private readonly leaseTtlMs;
     private readonly appliedVersions;
@@ -518,7 +556,7 @@ export declare class FoundryPlanApply implements PlanApply {
      */
     release(id: OrgId, entryKey: string): Promise<AppliedState>;
     private computeAdopt;
-    apply(plan: Plan, confirmedOrgName: string): Promise<AppliedState>;
+    apply(plan: Plan, confirmedOrgName: string, options?: FoundryApplyOptions): Promise<AppliedState>;
     /**
      * After an org apply: gives the platform files runner a changed share-domain
      * set (its Coolify `domains` and `FILES_PUBLIC_HOSTS`, derived from the
@@ -543,7 +581,7 @@ export declare class FoundryPlanApply implements PlanApply {
      * shape of their own. `confirmedName` must be the literal word `platform`
      * rather than a declared name -- `DeclaredPlatform` has none.
      */
-    applyPlatform(plan: Plan, confirmedName: string): Promise<{
+    applyPlatform(plan: Plan, confirmedName: string, options?: FoundryApplyOptions): Promise<{
         serviceIds: Record<string, string>;
     }>;
     /**

package/dist/plan/plan-apply.js

@@ -6,6 +6,7 @@ import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
+import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
@@ -53,6 +54,21 @@ export class ConfirmationRequiredError extends Error {
         this.name = 'ConfirmationRequiredError';
     }
 }
+/**
+ * A plan holds a version change that needs confirmation
+ * (`VersionChangeItem.needsConfirmation`) and `confirmUpgrade` does not name
+ * its service exactly. `upgrades` lists every such service with its versions.
+ */
+export class UpgradeConfirmationRequiredError extends Error {
+    upgrades;
+    constructor(upgrades) {
+        super(`the plan changes versions that must be confirmed by service name: ${upgrades
+            .map((u) => `${u.service} ${u.from ?? 'unknown'} -> ${u.to ?? 'unknown'}`)
+            .join(', ')}; pass confirmUpgrade naming each one`);
+        this.upgrades = upgrades;
+        this.name = 'UpgradeConfirmationRequiredError';
+    }
+}
 export class NotAuthorizedError extends Error {
     constructor(actor, orgId) {
         super(`${actor.display} does not hold the permission to apply org ${orgId} (#9, #19)`);
@@ -124,9 +140,11 @@ export class FoundryPlanApply {
     zitadelIdTokenUserinfo;
     broker;
     edgeWorkers;
+    ownerInviteMail;
     hostFiles;
     hostAi;
     hostEdge;
+    onlySteps;
     now;
     leaseTtlMs;
     appliedVersions;
@@ -146,9 +164,11 @@ export class FoundryPlanApply {
         this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
         this.broker = options.broker ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
+        this.ownerInviteMail = options.ownerInviteMail ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
         this.hostEdge = options.edge ?? false;
+        this.onlySteps = options.onlySteps;
         this.now = options.now ?? (() => new Date());
         this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
         this.appliedVersions = options.appliedVersions;
@@ -341,7 +361,7 @@ export class FoundryPlanApply {
             previous,
         };
     }
-    async apply(plan, confirmedOrgName) {
+    async apply(plan, confirmedOrgName, options = {}) {
         const orgId = plan.orgId;
         const authorized = await this.authz.canApply(this.actor, orgId);
         if (!authorized) {
@@ -354,6 +374,11 @@ export class FoundryPlanApply {
                 await this.refuse(plan, 'stale: live state has moved since this plan was computed');
                 throw new StalePlanError(orgId);
             }
+            const unconfirmed = unconfirmedUpgrades(freshPlan.versionChanges, options.confirmUpgrade);
+            if (unconfirmed.length > 0) {
+                await this.refuse(plan, `version change without confirmUpgrade naming: ${unconfirmed.map((u) => u.service).join(', ')}`);
+                throw new UpgradeConfirmationRequiredError(unconfirmed);
+            }
             if (planNeedsConfirmation(plan.steps) &&
                 confirmedOrgName.trim() !== org.displayName.trim()) {
                 await this.refuse(plan, "destructive or migrating step without the org's name typed correctly");
@@ -426,7 +451,7 @@ export class FoundryPlanApply {
      * shape of their own. `confirmedName` must be the literal word `platform`
      * rather than a declared name -- `DeclaredPlatform` has none.
      */
-    async applyPlatform(plan, confirmedName) {
+    async applyPlatform(plan, confirmedName, options = {}) {
         const { store, executor } = this.requirePlatformDeps();
         const declared = await store.get();
         if (!declared)
@@ -449,6 +474,11 @@ export class FoundryPlanApply {
                 await this.refusePlatform(plan, platform.ownerOrgId, 'stale: live state has moved since this plan was computed');
                 throw new PlatformStalePlanError();
             }
+            const unconfirmed = unconfirmedUpgrades(freshPlan.versionChanges, options.confirmUpgrade);
+            if (unconfirmed.length > 0) {
+                await this.refusePlatform(plan, platform.ownerOrgId, `version change without confirmUpgrade naming: ${unconfirmed.map((u) => u.service).join(', ')}`);
+                throw new UpgradeConfirmationRequiredError(unconfirmed);
+            }
             if (planNeedsConfirmation(plan.steps) && confirmedName.trim() !== 'platform') {
                 await this.refusePlatform(plan, platform.ownerOrgId, "destructive or migrating step without 'platform' typed correctly");
                 throw new PlatformConfirmationRequiredError();
@@ -803,6 +833,10 @@ export class FoundryPlanApply {
                     const { system, kind, key } = planned.action;
                     serviceIds[`${system}:${kind}:${key}`] = result.resourceId;
                 }
+                else if (planned.action.desired.delete === true) {
+                    const { system, kind, key } = planned.action;
+                    delete serviceIds[`${system}:${kind}:${key}`];
+                }
                 checkpoints.push({ step: planned.step.description, completedAt: this.now().toISOString() });
             }
         }
@@ -881,6 +915,7 @@ export class FoundryPlanApply {
             zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
             broker: this.broker,
             edgeWorkers: this.edgeWorkers,
+            ownerInviteMail: this.ownerInviteMail,
             otherSlugs,
             now: () => this.now().getTime(),
             archonUrl,
@@ -896,6 +931,11 @@ export class FoundryPlanApply {
                 key: 'hosting:invalid',
             });
         }
+        if (this.onlySteps) {
+            const { step, blocked } = this.onlySteps;
+            detail.plannedSteps = detail.plannedSteps.filter(({ action }) => step(action));
+            detail.unmanaged = detail.unmanaged.filter((item) => item.key === undefined || blocked(item.key));
+        }
         return { org, plan: toPlan(detail), detail };
     }
     /**
@@ -1459,6 +1499,7 @@ function canonical(plan) {
         // version-change line must still be caught as stale, the same as any
         // other field here.
         versionChanges: [...(plan.versionChanges ?? [])].sort((x, y) => x.description.localeCompare(y.description)),
+        notes: [...(plan.notes ?? [])].sort((x, y) => x.key.localeCompare(y.key)),
     };
 }
 /**