@wtfalch/foundry 0.32.0 → 0.33.1

package/dist/bootstrap/bootstrap.d.ts

@@ -1,5 +1,5 @@
 import type { Plan } from '../plan.js';
-import type { PlatformLiveReaders, PlatformStepExecutor, StepSystem } from '../plan/index.js';
+import type { FoundryPlanApplyOptions, LiveReaders, PlatformLiveReaders, PlatformStepExecutor, StepExecutor, StepSystem } from '../plan/index.js';
 import type { FoundryPlatformStepExecutorOptions } from '../plan/platform-providers.js';
 import type { FoundryStoreDb } from '../store/postgres.js';
 import type { BootstrapCompany, BootstrapOwner } from './declare.js';
@@ -38,6 +38,17 @@ export interface BootstrapProgress {
 }
 /** Everything foundry's per-step executors take besides the two clients and `deliverSecret`. */
 export type BootstrapExecutorDeps = Omit<FoundryPlatformStepExecutorOptions, 'coolify' | 'deliverSecret'>;
+/**
+ * What phase two needs to apply the platform's own org (Company Included):
+ * the org-side readers and step executor a host already builds for any org.
+ * Without it the run applies the platform only.
+ */
+export interface BootstrapCompanyDeps {
+    readers: LiveReaders;
+    executor: StepExecutor;
+    /** The same flags `FoundryPlanApply` takes: a step whose port the host did not build is reported blocked. */
+    options?: Pick<FoundryPlanApplyOptions, 'ownerInviteMail' | 'broker'>;
+}
 export interface BootstrapPlatformDeps {
     /** Foundry's tables live here, already migrated by the host; the store, the audit log and the plan all use it. */
     db: FoundryStoreDb;
@@ -54,6 +65,12 @@ export interface BootstrapPlatformDeps {
     };
     /** Per-step dependencies (auth, mail, files, ai, integrations, archon, sfu). A step without its own is reported blocked. */
     executor?: BootstrapExecutorDeps;
+    /**
+     * Phase two: after the platform, apply the platform's own org's database,
+     * sign-in client, owner and Boule, then the platform once more so Archon
+     * picks up the keys that slice produced. Absent: platform only.
+     */
+    company?: BootstrapCompanyDeps;
     /**
      * Passed to `createPostgresAuditLog`. Omit it in a real deployment: `db` is
      * the runtime role the host made with `ensureRuntimeRole`, and the default

package/dist/bootstrap/bootstrap.js

@@ -1,9 +1,12 @@
 import { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { CoolifyClient } from '@wtfalch/providers/coolify';
+import { validateMail } from '../org.js';
+import { BOULE_BROKER_ENTRY_KEY } from '../plan/boule.js';
+import { brokerEntryAppliedScopeKey } from '../plan/broker-entries.js';
 import { FoundryPlanApply, FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, } from '../plan/index.js';
 import { createPostgresAuditLog } from '../store/audit.js';
 import { createPostgresDeclaredOrgStore, createPostgresPlatformStore } from '../store/postgres.js';
-import { COMPANY_INCLUDED_ORG_ID, declaredCompanyOrg, declaredPlatformFor, ownerIdentity, } from './declare.js';
+import { COMPANY_INCLUDED_ORG_ID, declaredCompanyOrg, declaredPlatformFor } from './declare.js';
 import { driveApply } from './drive.js';
 const REDACTED = '<redacted>';
 /** Shorter strings in `deps.executor` are settings ("main", ports), not secrets, and would mangle every message. */
@@ -41,17 +44,47 @@ export class Redactor {
         return out;
     }
 }
-const allowPlatformApply = {
-    async canApply() {
-        return false;
-    },
-    async canDestroy() {
-        return false;
-    },
-    async canApplyPlatform() {
-        return true;
-    },
+/** The platform, and the platform's own org when the host gave phase two its dependencies. */
+function allowBootstrapApply(withCompany) {
+    return {
+        async canApply(_actor, orgId) {
+            return withCompany && orgId === COMPANY_INCLUDED_ORG_ID;
+        },
+        async canDestroy() {
+            return false;
+        },
+        async canApplyPlatform() {
+            return true;
+        },
+    };
+}
+/**
+ * The org steps phase two applies: the sign-in org and its domain, the owner
+ * (whose user id Boule's `AUTHZ_FIRST_OWNER` carries), Boule's sign-in client,
+ * and Boule with its database. Everything else the company declares (chat,
+ * mail, Boule's broker entry, which waits for the org's mail domain, ...) is
+ * for a later, ordinary org apply.
+ */
+const COMPANY_SLICE_STEPS = new Set([
+    'zitadel:issuer',
+    'zitadel:registration-closed',
+    'zitadel:domain',
+    'zitadel:owner',
+    'zitadel:app:boule',
+    'coolify:boule',
+]);
+const companySliceOnly = {
+    step: (action) => COMPANY_SLICE_STEPS.has(`${action.system}:${action.kind}`) ||
+        COMPANY_SLICE_STEPS.has(`${action.system}:${action.kind}:${action.key}`),
+    // `coolify:boule:mail` only says Boule runs without mail for now.
+    blocked: (key) => key !== 'coolify:boule:mail' &&
+        [...COMPANY_SLICE_STEPS].some((step) => key === step || key.startsWith(`${step}:`)),
 };
+/** Shown instead of a phase-two error that could carry a value; the failing step's own name and redacted text are in `failed`. */
+const COMPANY_NOT_FINISHED = "the company's own slice did not finish, so Archon has no people-store keys yet; run onboarding again";
+/** The step key and fixed text of the blocked item for Boule's missing broker entry. */
+const BOULE_BROKER_ENTRY_BLOCKED_STEP = 'coolify:boule-broker-entry';
+const BOULE_SIGN_IN_BLOCKED = "Boule is deployed but nobody can sign in to it yet: its broker entry waits for the company's mail domain, which the company's mail step records. Apply the company's mail, then its Boule broker entry (an ordinary org apply)";
 /** `FoundryPlanApply` needs org-scoped parts this run never uses; each refuses if called. */
 const unusedOrgExecutor = {
     async execute() {
@@ -68,6 +101,25 @@ export function roundSystem(plan) {
     return systems.size === 1 && only ? only : 'foundry';
 }
 const unusedOrgReader = { listResources: async () => [] };
+/** Counts the org steps a round starts and ends, as the platform executor is wrapped below. */
+function trackedOrgExecutor(inner, progress, redactor) {
+    return {
+        execute: async (action, context) => {
+            const p = progress();
+            p.started++;
+            try {
+                const result = await inner.execute(action, context);
+                p.completed++;
+                return result;
+            }
+            finally {
+                // After a failure too: the secrets it minted before failing must be masked in its error.
+                redactor.add(...(inner.secretsHandled?.() ?? []));
+            }
+        },
+        ...(inner.ownEdgePorts ? { ownEdgePorts: () => inner.ownEdgePorts?.() ?? {} } : {}),
+    };
+}
 /** The audit log with every free-text field run through the redactor before it is stored. */
 function redactingAudit(inner, redactor) {
     const plan = (p) => ({
@@ -115,6 +167,16 @@ export function guardStepDeps(executor, redactor, deliverSecret, heldKeys) {
         const copy = { ...deps };
         if ('deliverSecret' in copy)
             copy.deliverSecret = deliverSecret;
+        const inviteMail = copy.ownerInviteMail;
+        if (inviteMail) {
+            // The link carries the invite code; both are masked from the first moment they exist.
+            copy.ownerInviteMail = {
+                send: (to, link) => {
+                    redactor.add(link, new URL(link).searchParams.get('code'));
+                    return inviteMail.send(to, link);
+                },
+            };
+        }
         // #201: ai's own default minter needs heldKeys too, to re-sign a mint
         // request against its signing key when an earlier run pinned it but
         // crashed before the management key itself was minted and delivered.
@@ -170,8 +232,14 @@ export async function bootstrapPlatform(input, deps) {
         });
     };
     try {
-        ownerIdentity(input.owner);
+        // Refused here, before a credential is read or a row written: the work and
+        // personal addresses must be valid and not clash on the company's domain.
+        const mailProblem = validateMail(declaredCompanyOrg(input.company, input.owner));
+        if (mailProblem)
+            throw new Error(`bootstrapPlatform: ${mailProblem}`);
         redactor.addDeep(deps.executor);
+        // The company executor's own tokens (its ports hold the Coolify and ZITADEL credentials).
+        redactor.addDeep(deps.company?.executor);
         const credentials = await deps.rootCredentials();
         redactor.add(credentials.coolifyToken, credentials.cloudflareApiToken, credentials.cloudflareAccountId, ...Object.values(credentials.accessHeaders ?? {}));
         const deliverSecret = async (ref, secret) => {
@@ -272,9 +340,11 @@ export async function bootstrapPlatform(input, deps) {
                 ? { driftedSteps: (platform, ids) => inner.driftedSteps?.(platform, ids) ?? {} }
                 : {}),
         };
+        let orgProgress = { started: 0, completed: 0 };
+        const companyDeps = deps.company;
         const planApply = new FoundryPlanApply({
             store: orgStore,
-            readers: {
+            readers: companyDeps?.readers ?? {
                 zitadel: unusedOrgReader,
                 coolify: unusedOrgReader,
                 cloudflare: unusedOrgReader,
@@ -282,14 +352,17 @@ export async function bootstrapPlatform(input, deps) {
                 ai: unusedOrgReader,
                 cms: unusedOrgReader,
             },
-            executor: unusedOrgExecutor,
+            executor: companyDeps
+                ? trackedOrgExecutor(companyDeps.executor, () => orgProgress, redactor)
+                : unusedOrgExecutor,
             destroyer: unusedOrgExecutor,
             audit: redactingAudit(createPostgresAuditLog(deps.db, { checkRuntimeRole: deps.checkRuntimeRole }), redactor),
-            authz: allowPlatformApply,
+            authz: allowBootstrapApply(Boolean(companyDeps)),
             actor: { id: 'bootstrap-platform', display: 'bootstrapPlatform' },
             platform: { store: platformStore, readers: runtime.readers, executor },
+            ...(companyDeps ? { ...companyDeps.options, onlySteps: companySliceOnly } : {}),
         });
-        const driven = await driveApply({
+        const drivePlatform = (label) => driveApply({
             plan: () => planApply.planPlatform(),
             apply: (plan, stepProgress) => {
                 progress = stepProgress;
@@ -300,32 +373,98 @@ export async function bootstrapPlatform(input, deps) {
                 phase: 'plan',
                 system: roundSystem(plan),
                 round,
-                message: `round ${round}: ${plan.steps.length} step(s) planned`,
+                message: `${label}round ${round}: ${plan.steps.length} step(s) planned`,
                 steps: plan.steps.map((s) => s.description),
             }),
             onApplied: (round, plan) => emit({
                 phase: 'apply',
                 system: roundSystem(plan),
                 round,
-                message: `round ${round}: applied`,
+                message: `${label}round ${round}: applied`,
                 steps: plan.steps.map((s) => s.description),
             }),
         });
-        const blocked = (driven.failed ? [] : (driven.lastPlan?.unmanaged ?? []))
+        // Phase one: the platform.
+        const driven = await drivePlatform('');
+        const applied = [...driven.applied];
+        let failed = driven.failed;
+        let lastPlan = driven.lastPlan;
+        const blockedRaw = (driven.failed ? [] : (driven.lastPlan?.unmanaged ?? []))
             .filter((item) => item.key !== undefined)
-            .map((item) => ({
-            step: item.key,
-            message: redactor.text(item.description),
+            .map((item) => ({ step: item.key, message: item.description }));
+        if (companyDeps && !failed) {
+            // Phase two: the platform's own org. Its Boule needs the platform's
+            // sign-in, and Archon's people-store keys need that Boule.
+            const company = await driveApply({
+                plan: () => planApply.plan(COMPANY_INCLUDED_ORG_ID),
+                apply: (plan, stepProgress) => {
+                    orgProgress = stepProgress;
+                    return planApply.apply(plan, '');
+                },
+                maxRounds: deps.maxRounds,
+                onPlan: (round, plan) => emit({
+                    phase: 'plan',
+                    system: roundSystem(plan),
+                    round,
+                    message: `company round ${round}: ${plan.steps.length} step(s) planned`,
+                    steps: plan.steps.map((s) => s.description),
+                }),
+                onApplied: (round, plan) => emit({
+                    phase: 'apply',
+                    system: roundSystem(plan),
+                    round,
+                    message: `company round ${round}: applied`,
+                    steps: plan.steps.map((s) => s.description),
+                }),
+            });
+            applied.push(...company.applied);
+            if (company.failed) {
+                failed = company.failed;
+                blockedRaw.push({ step: 'company', message: COMPANY_NOT_FINISHED });
+            }
+            else {
+                for (const item of company.lastPlan?.unmanaged ?? []) {
+                    if (item.key !== undefined)
+                        blockedRaw.push({ step: item.key, message: item.description });
+                }
+                // Boule's broker entry needs the org's mail domain, which only the org's mail step
+                // records, so it is outside this slice. Until it is applied nobody can sign in to Boule:
+                // say so, and never report the onboarding complete.
+                const companyApplied = await orgStore.getAppliedState(COMPANY_INCLUDED_ORG_ID);
+                if (!companyApplied?.serviceIds[brokerEntryAppliedScopeKey(BOULE_BROKER_ENTRY_KEY)]) {
+                    blockedRaw.push({
+                        step: BOULE_BROKER_ENTRY_BLOCKED_STEP,
+                        message: BOULE_SIGN_IN_BLOCKED,
+                    });
+                }
+                // Phase three: the same platform plan again. Archon's step now sees
+                // the keys Boule holds and writes its own copies.
+                const again = await drivePlatform('after the company: ');
+                applied.push(...again.applied);
+                failed = again.failed;
+                lastPlan = again.lastPlan;
+                if (!again.failed) {
+                    for (const item of again.lastPlan?.unmanaged ?? []) {
+                        if (item.key !== undefined && !blockedRaw.some((b) => b.step === item.key)) {
+                            blockedRaw.push({ step: item.key, message: item.description });
+                        }
+                    }
+                }
+            }
+        }
+        const blocked = blockedRaw.map((item) => ({
+            step: item.step,
+            message: redactor.text(item.message),
         }));
         const result = {
-            applied: driven.applied.map((s) => redactor.text(s)),
+            applied: applied.map((s) => redactor.text(s)),
             blocked,
-            complete: !driven.failed && blocked.length === 0 && driven.lastPlan?.steps.length === 0,
-            ...(driven.failed
+            complete: !failed && blocked.length === 0 && lastPlan?.steps.length === 0,
+            ...(failed
                 ? {
                     failed: {
-                        step: redactor.text(driven.failed.step),
-                        message: redactor.text(driven.failed.message),
+                        step: redactor.text(failed.step),
+                        message: redactor.text(failed.message),
                     },
                 }
                 : {}),
@@ -333,7 +472,7 @@ export async function bootstrapPlatform(input, deps) {
         emit({
             phase: 'done',
             system: 'foundry',
-            message: driven.failed
+            message: failed
                 ? `stopped: ${result.failed?.message}`
                 : `${result.applied.length} step(s) applied, ${blocked.length} blocked`,
         });

package/dist/bootstrap/declare.d.ts

@@ -42,11 +42,15 @@ export interface BootstrapCompany {
 export interface BootstrapOwner {
     givenName: string;
     familyName: string;
+    /** The owner's personal address: the first-sign-in link is mailed here. */
     email: string;
+    /** The owner's work address on the company's domain; their sign-in name is its local part. */
+    mailboxAddress: string;
 }
 /**
  * The owner as `OwnerIdentity`, trimmed. Throws a plain error naming the
- * field when one is empty or the email is not an address.
+ * field when one is empty or an address is not an address. The work address
+ * is required: the owner signs in as its local part.
  */
 export declare function ownerIdentity(owner: BootstrapOwner): OwnerIdentity;
 /**

package/dist/bootstrap/declare.js

@@ -59,13 +59,15 @@ const SERVICES_ENABLED_BY_DEFAULT = new Set([
 ]);
 /**
  * The owner as `OwnerIdentity`, trimmed. Throws a plain error naming the
- * field when one is empty or the email is not an address.
+ * field when one is empty or an address is not an address. The work address
+ * is required: the owner signs in as its local part.
  */
 export function ownerIdentity(owner) {
     const identity = {
         email: owner.email?.trim() ?? '',
         givenName: owner.givenName?.trim() ?? '',
         familyName: owner.familyName?.trim() ?? '',
+        mailboxAddress: owner.mailboxAddress?.trim() ?? '',
     };
     const problem = validateOwners([identity]);
     if (problem)

package/dist/bootstrap/index.d.ts

@@ -1,3 +1,3 @@
 export type { BootstrapCompany, BootstrapOwner, } from './declare.js';
-export type { BootstrapExecutorDeps, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap.js';
+export type { BootstrapCompanyDeps, BootstrapExecutorDeps, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap.js';
 export { bootstrapPlatform } from './bootstrap.js';

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requ
 export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export type { Checkpoint, LastApplied, AppliedState, DestroyRecord, DestroyStepRecord, } from './state.js';
-export type { PlanStep, UnmanagedItem, Plan, VersionChangeItem } from './plan.js';
+export type { PlanStep, UnmanagedItem, PlanNote, Plan, VersionChangeItem } from './plan.js';
 export type { AppliedVersion, AppliedVersionsStore, DeclaredOrgStore, HeldLease, MutationLease, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
 export { StaleLeaseError } from './store.js';
 export type { PlanApply, DestroyProgress } from './apply.js';
@@ -29,6 +29,8 @@ export type { PlatformOrgClientFactories } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
+export type { EnsureSignInOrgOptions } from './plan/index.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
@@ -58,7 +60,7 @@ export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './plan/index.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
 export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
-export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
+export type { BootstrapCompany, BootstrapCompanyDeps, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export type { OrgAppVersionRef, OrgAppVersionStatus, WtfalchPackageDrift, PlatformVersionStatus, ReadPlatformVersionStatusOptions, StatusCoolifyPort, StatusGithubPort, StatusGhExec, } from './plan/index.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './plan/index.js';

package/dist/index.js

@@ -17,6 +17,7 @@ export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';

package/dist/org.d.ts

@@ -674,8 +674,12 @@ export declare function validateBuyerIdentity(buyer: BuyerIdentity): string | nu
  * recorded invited user id, not on this declared value, so editing an owner
  * after the invite has gone out does not send a second one.
  *
- * `mailboxAddress` is the owner's own mailbox, when mail is on. The first
- * owner falls back to `mail.ownerMailboxAddress` when it is unset.
+ * `email` is the owner's personal address: it receives the first-sign-in link
+ * and is kept as the user's `personal_email` metadata. `mailboxAddress` is the
+ * owner's work address; the owner signs in as its local part on the org's domain.
+ * The first owner falls back to `mail.ownerMailboxAddress` when it is unset. An
+ * owner with neither is a blocked item in the plan, not refused here, because a
+ * stored owner from before this rule has none.
  */
 export interface OwnerIdentity {
     email: string;

package/dist/org.js

@@ -746,6 +746,7 @@ const OWNER_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 export function validateOwners(owners) {
     const seen = new Set();
     const boxes = new Set();
+    const names = new Set();
     for (const owner of owners) {
         if (!OWNER_EMAIL_PATTERN.test(owner.email)) {
             return `owner email '${owner.email}' is not a valid email address`;
@@ -762,6 +763,12 @@ export function validateOwners(owners) {
             if (boxes.has(box))
                 return `owner mailboxAddress '${owner.mailboxAddress}' is listed more than once`;
             boxes.add(box);
+            // One sign-in account per local part: the account's username is the part before the @.
+            const name = box.slice(0, box.indexOf('@'));
+            if (names.has(name)) {
+                return `owner work addresses must have different names before the @: '${name}' is used twice`;
+            }
+            names.add(name);
         }
         const key = owner.email.toLowerCase();
         if (seen.has(key))
@@ -814,6 +821,15 @@ function validateOwnerMailboxes(org) {
         const address = owner.mailboxAddress;
         if (address === undefined || !OWNER_EMAIL_PATTERN.test(address))
             continue;
+        // Only an owner with a work address is checked: a stored owner without one predates the
+        // rule, and refusing it would stop every later update of its org.
+        if (org.domain && OWNER_EMAIL_PATTERN.test(owner.email)) {
+            const personalDomain = owner.email.slice(owner.email.indexOf('@') + 1).toLowerCase();
+            const orgDomain = org.domain.toLowerCase();
+            if (personalDomain === orgDomain || personalDomain.endsWith(`.${orgDomain}`)) {
+                return `owner ${owner.email} personal address must not be on ${org.domain} or a subdomain of it`;
+            }
+        }
         if (mail.usesDomain && org.domain) {
             const addressDomain = address.slice(address.indexOf('@') + 1).toLowerCase();
             if (addressDomain !== org.domain.toLowerCase()) {

package/dist/plan/boule.d.ts

@@ -28,6 +28,14 @@ export declare const BOULE_DATABASE_SCOPE_KEY = "coolify_boule_database";
  * sat built but never started, and `restart` cannot fix that.
  */
 export declare const BOULE_DEPLOYED_SCOPE_KEY = "coolify_boule_deployed";
+/**
+ * Recorded once the platform's own Boule was restarted (or deployed) after its
+ * peer password and bridge secret were written. Boule creates its people-store
+ * role from the password only at boot, so a password written without that
+ * restart is useless; without this marker a failed restart was never repeated,
+ * because the next run finds the secrets present and mints and changes nothing.
+ */
+export declare const BOULE_SECRETS_RESTARTED_SCOPE_KEY = "coolify_boule_secrets_restarted";
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s
@@ -56,8 +64,23 @@ export declare function bouleMailFrom(org: DeclaredOrg, mailDomain: string): str
  * values in memory only; the result names nothing secret.
  */
 export declare function bouleMailTokenDrift(liveToken: string | undefined, appToken: string | undefined): boolean;
+/**
+ * The password of the Postgres role Archon connects to the owner company's
+ * people store with. Minted once, only for the platform's own org, and held in
+ * Boule's env; the plan compares its presence in memory and never plans with
+ * its value. Not in {@link desiredBouleEnv}: it is a secret.
+ */
+export declare const BOULE_PEER_PASSWORD_ENV = "AUTHZ_PEER_PASSWORD_OPERATOR";
+/**
+ * The secret Archon sends to Boule's invite route as a bearer token. Minted
+ * once, only for the platform's own org, held in Boule's env and in Archon's
+ * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
+ */
+export declare const BOULE_BRIDGE_SECRET_ENV = "ARCHON_BRIDGE_SECRET";
+/** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
+export declare const BOULE_PEER_ROLE = "authz_operator_rt";
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a

package/dist/plan/boule.js

@@ -28,6 +28,14 @@ export const BOULE_DATABASE_SCOPE_KEY = 'coolify_boule_database';
  * sat built but never started, and `restart` cannot fix that.
  */
 export const BOULE_DEPLOYED_SCOPE_KEY = 'coolify_boule_deployed';
+/**
+ * Recorded once the platform's own Boule was restarted (or deployed) after its
+ * peer password and bridge secret were written. Boule creates its people-store
+ * role from the password only at boot, so a password written without that
+ * restart is useless; without this marker a failed restart was never repeated,
+ * because the next run finds the secrets present and mints and changes nothing.
+ */
+export const BOULE_SECRETS_RESTARTED_SCOPE_KEY = 'coolify_boule_secrets_restarted';
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s
@@ -66,6 +74,21 @@ export function bouleMailFrom(org, mailDomain) {
 export function bouleMailTokenDrift(liveToken, appToken) {
     return !liveToken || (Boolean(appToken) && appToken !== liveToken);
 }
+/**
+ * The password of the Postgres role Archon connects to the owner company's
+ * people store with. Minted once, only for the platform's own org, and held in
+ * Boule's env; the plan compares its presence in memory and never plans with
+ * its value. Not in {@link desiredBouleEnv}: it is a secret.
+ */
+export const BOULE_PEER_PASSWORD_ENV = 'AUTHZ_PEER_PASSWORD_OPERATOR';
+/**
+ * The secret Archon sends to Boule's invite route as a bearer token. Minted
+ * once, only for the platform's own org, held in Boule's env and in Archon's
+ * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
+ */
+export const BOULE_BRIDGE_SECRET_ENV = 'ARCHON_BRIDGE_SECRET';
+/** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
+export const BOULE_PEER_ROLE = 'authz_operator_rt';
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
 export const BOULE_MANAGED_ENV_KEYS = [
     'APP_URL',
@@ -74,9 +97,12 @@ export const BOULE_MANAGED_ENV_KEYS = [
     'AUTH_CLIENT_ID',
     'BOULE_ORG_NAME',
     'AUTHZ_BOOTSTRAP_OPERATOR',
+    'AUTHZ_FIRST_OWNER',
     'ARCHON_URL',
     'MAIL_FROM',
     BOULE_MAIL_TOKEN_ENV,
+    BOULE_PEER_PASSWORD_ENV,
+    BOULE_BRIDGE_SECRET_ENV,
 ];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
@@ -129,8 +155,10 @@ export function desiredBouleEnv(org, recorded, issuer, archonUrl, mailWanted = f
     const ownerUserId = owner
         ? recorded[`zitadel:owner:${org.id}:${owner.email.toLowerCase()}`]
         : undefined;
-    if (ownerUserId)
+    if (ownerUserId) {
         env.AUTHZ_BOOTSTRAP_OPERATOR = ownerUserId;
+        env.AUTHZ_FIRST_OWNER = ownerUserId;
+    }
     const mailDomain = recorded[MAIL_DOMAIN_RECORDED_KEY];
     if (mailWanted && mailDomain)
         env.MAIL_FROM = bouleMailFrom(org, mailDomain);

package/dist/plan/diff.d.ts

@@ -55,6 +55,8 @@ export interface PlanOrgOptions {
     archonUrl?: string | null;
     /** #318: the executor was built with a `WorkersPort`, read by `planWorkers`. */
     edgeWorkers?: boolean;
+    /** The executor was built with an `ownerInviteMail` port; without it each owner's invite is blocked. */
+    ownerInviteMail?: boolean;
     /** The platform's own service hostnames: `edgeReservedLabels` reserves them under the org's domain, and a wildcard Worker route (`planWorkers`) keeps them out. */
     platformHostnames?: readonly string[];
 }
@@ -134,7 +136,7 @@ export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
-export declare function isPlatformOwnOrg(org: DeclaredOrg, platformApex: string | null): boolean;
+export declare function isPlatformOwnOrg(org: Pick<DeclaredOrg, 'id'>, platformOwnerOrgId: string | null): boolean;
 /**
  * What {@link planOrgPostgres} reports about the org's one shared Postgres
  * server and its fixed schema topology (#444a, "manifest-and-plan-only"):