@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/plan/health-check-settings.d.ts

@@ -45,3 +45,31 @@ export declare const DEFAULT_HEALTH_CHECK_START_PERIOD_SECONDS = 30;
  * Dockerfile's `EXPOSE`) names, not a public one.
  */
 export declare function healthCheckSettings(path: string, port: number, startPeriodSeconds?: number): HealthCheckPatch;
+/**
+ * For an app built from a Dockerfile that has its own HEALTHCHECK: Coolify's check off. Coolify then keeps the
+ * Dockerfile's check, and its rolling update waits on that check's state (with Coolify's check on it would replace
+ * the Dockerfile's, so two checks would never both be live). Coolify reads the Dockerfile only while its own check is
+ * off, so this goes on before the first deploy.
+ */
+export declare const IMAGE_HEALTHCHECK_SETTINGS: {
+    readonly health_check_enabled: false;
+};
+/** The four `updateApplication` fields that turn on a Coolify health check that runs a command inside the container. */
+export interface CommandHealthCheckPatch {
+    health_check_enabled: true;
+    health_check_type: 'cmd';
+    health_check_command: string;
+    health_check_start_period: number;
+}
+/**
+ * The same fields as {@link healthCheckSettings}, for an image whose HTTP
+ * check cannot work: no `curl`, or an app that answers 401 on every route.
+ * Coolify's own HTTP check calls `localhost`, which `wget` in an Alpine image
+ * resolves to `::1` first, so a server that listens on IPv4 only is never
+ * reached. A command names `127.0.0.1` itself.
+ */
+export declare function commandHealthCheckSettings(command: string, startPeriodSeconds?: number): CommandHealthCheckPatch;
+/** A GET on `127.0.0.1` that fails on any status of 400 or more; the `wget` of a busybox image. */
+export declare const wgetProbe: (port: number | string, path: string) => string;
+/** A TCP connect to `127.0.0.1`, for a server with no route that answers without a token. */
+export declare const tcpProbe: (port: number | string) => string;

package/dist/plan/health-check-settings.js

@@ -45,3 +45,39 @@ export function healthCheckSettings(path, port, startPeriodSeconds = DEFAULT_HEA
         health_check_start_period: startPeriodSeconds,
     };
 }
+/**
+ * For an app built from a Dockerfile that has its own HEALTHCHECK: Coolify's check off. Coolify then keeps the
+ * Dockerfile's check, and its rolling update waits on that check's state (with Coolify's check on it would replace
+ * the Dockerfile's, so two checks would never both be live). Coolify reads the Dockerfile only while its own check is
+ * off, so this goes on before the first deploy.
+ */
+export const IMAGE_HEALTHCHECK_SETTINGS = { health_check_enabled: false };
+/**
+ * What Coolify accepts as `health_check_command`: letters, digits, space and
+ * `- _ . / : = @ , +`, at most 1000 characters (its `generate_healthcheck_commands`
+ * falls back to the HTTP check on anything else, without an error). It runs as
+ * `sh -c`, so the image needs a shell and the tool the command names.
+ */
+const COOLIFY_COMMAND = /^[a-zA-Z0-9 \-_./:=@,+]+$/;
+/**
+ * The same fields as {@link healthCheckSettings}, for an image whose HTTP
+ * check cannot work: no `curl`, or an app that answers 401 on every route.
+ * Coolify's own HTTP check calls `localhost`, which `wget` in an Alpine image
+ * resolves to `::1` first, so a server that listens on IPv4 only is never
+ * reached. A command names `127.0.0.1` itself.
+ */
+export function commandHealthCheckSettings(command, startPeriodSeconds = DEFAULT_HEALTH_CHECK_START_PERIOD_SECONDS) {
+    if (!COOLIFY_COMMAND.test(command) || command.length > 1000) {
+        throw new Error(`health check command ${JSON.stringify(command)} is not one Coolify accepts`);
+    }
+    return {
+        health_check_enabled: true,
+        health_check_type: 'cmd',
+        health_check_command: command,
+        health_check_start_period: startPeriodSeconds,
+    };
+}
+/** A GET on `127.0.0.1` that fails on any status of 400 or more; the `wget` of a busybox image. */
+export const wgetProbe = (port, path) => `wget -q -O /dev/null http://127.0.0.1:${port}${path}`;
+/** A TCP connect to `127.0.0.1`, for a server with no route that answers without a token. */
+export const tcpProbe = (port) => `nc -z 127.0.0.1 ${port}`;

package/dist/plan/health-gaps.d.ts

@@ -0,0 +1,33 @@
+/** An app as Coolify keeps it: its name and everything create and update sent. */
+export interface StoredApp {
+    name: string;
+    fields: Record<string, unknown>;
+}
+/**
+ * Apps that run once and then idle or exit, so Docker has no service to check. Matched by what the app is built
+ * from (repo and Dockerfile target), never by its name, so no look-alike name is exempt.
+ */
+export declare const EXIT_JOBS: ReadonlyArray<{
+    repo: string;
+    target: string;
+    reason: string;
+}>;
+/**
+ * Apps built from a Dockerfile in another repo that carries a HEALTHCHECK line. Foundry cannot read that file
+ * here, so each entry names the app by repo and Dockerfile and says where the line was seen. With the Coolify
+ * check off, Coolify keeps the image's check and its rolling update follows it.
+ */
+export declare const REPO_DOCKERFILE_CHECKED: ReadonlyArray<{
+    repo: string;
+    dockerfile?: string;
+    target?: string;
+    seen: string;
+}>;
+/**
+ * A check that can fail. Either Coolify's own, on and with something to probe (a command that does something,
+ * or HTTP on a port; Coolify falls back to the exposed port and to `/`), or Coolify's off over a Dockerfile that
+ * carries its own HEALTHCHECK, which Coolify then keeps.
+ */
+export declare function hasRealCheck(fields: Record<string, unknown>): boolean;
+/** The names of the long-running apps with no real check, not counting the exit jobs. */
+export declare function healthGaps(apps: ReadonlyArray<StoredApp>): string[];

package/dist/plan/health-gaps.js

@@ -0,0 +1,89 @@
+/**
+ * Apps that run once and then idle or exit, so Docker has no service to check. Matched by what the app is built
+ * from (repo and Dockerfile target), never by its name, so no look-alike name is exempt.
+ */
+export const EXIT_JOBS = [
+    {
+        repo: 'wtfalch/files',
+        target: 'migration',
+        reason: 'runs the migrations once; its image HEALTHCHECK reports done',
+    },
+    {
+        repo: 'wtfalch/ai',
+        target: 'migration',
+        reason: 'runs the migrations once; its image HEALTHCHECK reports done',
+    },
+    {
+        repo: 'wtfalch/integrations',
+        target: 'migration',
+        reason: 'runs the migrations once; its image HEALTHCHECK reports done',
+    },
+    {
+        repo: 'wtfalch/integrations',
+        target: 'worker',
+        reason: 'a finite pass (work-once.ts) that exits 0; nothing waits on it',
+    },
+];
+/**
+ * Apps built from a Dockerfile in another repo that carries a HEALTHCHECK line. Foundry cannot read that file
+ * here, so each entry names the app by repo and Dockerfile and says where the line was seen. With the Coolify
+ * check off, Coolify keeps the image's check and its rolling update follows it.
+ */
+export const REPO_DOCKERFILE_CHECKED = [
+    { repo: 'wtfalch/auth', dockerfile: '/login/Dockerfile', seen: 'login image, docker inspect' },
+    { repo: 'wtfalch/auth', dockerfile: '/broker/Dockerfile', seen: 'broker image, docker inspect' },
+    { repo: 'wtfalch/ai', target: 'worker', seen: 'ai-worker image, docker inspect' },
+    { repo: 'wtfalch/integrations', target: 'runner', seen: 'integrations/Dockerfile line 49' },
+    {
+        repo: 'wtfalch/chat',
+        dockerfile: '/apps/chat-service/synapse-module/Dockerfile',
+        seen: 'chat Synapse image, docker inspect',
+    },
+];
+/** Commands that succeed whatever the container is doing. */
+const NO_OP = /^(?:true|:|exit 0|\/bin\/true|\/usr\/bin\/true|sh -c true)$/;
+/** A `HEALTHCHECK` instruction that is not `HEALTHCHECK NONE`. */
+const DOCKERFILE_HEALTHCHECK = /^\s*HEALTHCHECK\s+(?!NONE\b)/im;
+const same = (a, b) => b === undefined || a === b;
+function exitJob(f) {
+    return EXIT_JOBS.some((e) => f.git_repository === e.repo && f.dockerfile_target_build === e.target);
+}
+function repoDockerfileChecked(f) {
+    return REPO_DOCKERFILE_CHECKED.some((e) => f.git_repository === e.repo &&
+        same(f.dockerfile_location, e.dockerfile) &&
+        same(f.dockerfile_target_build, e.target));
+}
+/**
+ * A check that can fail. Either Coolify's own, on and with something to probe (a command that does something,
+ * or HTTP on a port; Coolify falls back to the exposed port and to `/`), or Coolify's off over a Dockerfile that
+ * carries its own HEALTHCHECK, which Coolify then keeps.
+ */
+export function hasRealCheck(fields) {
+    if (fields.health_check_enabled === true) {
+        if (fields.health_check_type === 'cmd') {
+            const command = fields.health_check_command;
+            return typeof command === 'string' && command.trim() !== '' && !NO_OP.test(command.trim());
+        }
+        const exposed = typeof fields.ports_exposes === 'string' && fields.ports_exposes.trim() !== '';
+        return typeof fields.health_check_port === 'number' || exposed;
+    }
+    if (fields.health_check_enabled === false) {
+        const dockerfile = fields.dockerfile;
+        if (typeof dockerfile === 'string') {
+            // An inline Dockerfile may arrive base64 (a PATCH), as plain text on create.
+            const text = DOCKERFILE_HEALTHCHECK.test(dockerfile)
+                ? dockerfile
+                : Buffer.from(dockerfile, 'base64').toString('utf8');
+            return DOCKERFILE_HEALTHCHECK.test(text);
+        }
+        return repoDockerfileChecked(fields);
+    }
+    return false;
+}
+/** The names of the long-running apps with no real check, not counting the exit jobs. */
+export function healthGaps(apps) {
+    return apps
+        .filter((a) => !exitJob(a.fields) && !hasRealCheck(a.fields))
+        .map((a) => a.name)
+        .sort();
+}

package/dist/plan/health-targets.js

@@ -28,7 +28,7 @@ const CALLS_HEALTH_PATH = '/healthz';
 function alwaysOnTargets(org, platform) {
     // The platform's own org signs in on the shared instance host, not its own
     // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
-    const loginHost = platform && isPlatformOwnOrg(org, platform.apex)
+    const loginHost = platform && isPlatformOwnOrg(org, platform.ownerOrgId)
         ? platform.auth.hostname
         : loginHostnameFor(org);
     return [

package/dist/plan/held-key-refs.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The held-key refs the platform's steps deliver under and an org step reads back. A leaf module:
+ * platform-providers.ts and platform-org.ts import each other, so a constant read at load lives here.
+ */
+/** The ref the scheduler's admin token is delivered under: the host's real `JobsSchedulerPort` adapter reads it back. */
+export declare const JOBS_ADMIN_TOKEN_REF = "jobs:scheduler:adminToken";
+/** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
+export declare const PLATFORM_AI_MANAGEMENT_KEY_REF = "ai:platform:managementKey";
+/** The ref the management private key (PKCS#8 PEM) is delivered under. */
+export declare const FILES_MANAGEMENT_KEY_REF = "files:platform:managementKey";

package/dist/plan/held-key-refs.js

@@ -0,0 +1,10 @@
+/**
+ * The held-key refs the platform's steps deliver under and an org step reads back. A leaf module:
+ * platform-providers.ts and platform-org.ts import each other, so a constant read at load lives here.
+ */
+/** The ref the scheduler's admin token is delivered under: the host's real `JobsSchedulerPort` adapter reads it back. */
+export const JOBS_ADMIN_TOKEN_REF = 'jobs:scheduler:adminToken';
+/** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
+export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
+/** The ref the management private key (PKCS#8 PEM) is delivered under. */
+export const FILES_MANAGEMENT_KEY_REF = 'files:platform:managementKey';

package/dist/plan/index.d.ts

@@ -4,10 +4,18 @@ export type { StepAction, PlannedStep, PlanDetail, OrgPostgresPlan } from './dif
 export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
-export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
+export type { PlatformPlanDetail, MailRoute } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './platform-org.js';
+export type { PlanOwnAuthOptions, PlanOwnFilesOptions, PlanOwnFilesR2Options, PlanOwnJobsOptions, } from './own-diff.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, } from './own-diff.js';
+export type { PlanOwnSfuOptions } from './own-diff.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu } from './own-diff.js';
+export type { SfuAppDeps, SfuAppInput } from './own-sfu.js';
+export { provisionSfuApp, sfuConfig, sfuPortsMappings } from './own-sfu.js';
+export type { OwnAuthInstance, FilesKeysMint, FilesKeysMinted, OwnFilesDeps, OwnFilesR2Key, OwnFilesR2Keys, OwnServicePorts, OwnServicesPort, OwnServicesProvision, OwnSfuDeps, ProjectSource, ServiceNetwork, ServiceTarget, StepScope, } from './own-services.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformNetwork, platformTarget, scopeFromOrg, scopeFromPlatform, } from './own-services.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export type { AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot } from './adopt.js';
@@ -15,8 +23,8 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
+export type { FilesHostInput, JobsHostDeps, JobsHostInput, MailServerInput, PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
@@ -33,7 +41,7 @@ export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, Provi
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
 export type { BrokerPort } from './broker-entries.js';
 export { PlatformBrokerPort } from './broker-entries.js';
-export type { LoginHostBinding, LoginHostBindingsPort } from './login-host.js';
+export type { LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './login-host.js';
 export { loginHostnameFor } from './login-host.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './mail-identity.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
@@ -41,6 +49,8 @@ export type { MailAllowlistApp } from './mail-identity-allowlist.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export type { EnsureSignInOrgOptions } from './sign-in-org.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './sign-in-org.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './health-targets.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
 export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';

package/dist/plan/index.js

@@ -1,12 +1,16 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './platform-org.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, } from './own-diff.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu } from './own-diff.js';
+export { provisionSfuApp, sfuConfig, sfuPortsMappings } from './own-sfu.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformNetwork, platformTarget, scopeFromOrg, scopeFromPlatform, } from './own-services.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
@@ -21,6 +25,7 @@ export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './sign-in-org.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
 export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
 export { createEdgeAccess } from './edge-access.js';

package/dist/plan/live.d.ts

@@ -1,4 +1,5 @@
-import type { OrgId } from '../org.js';
+import { type DeclaredOrg, type OrgId } from '../org.js';
+import { type OwnAuthInstance } from './own-services.js';
 /**
  * One resource as seen live in one of foundry's seven systems.
  *
@@ -87,6 +88,8 @@ export interface CmsReader {
 }
 export interface LiveReaders {
     zitadel: ZitadelReader;
+    /** The reader for one own org's ZITADEL instance. Without it an own org's ZITADEL is not read. */
+    zitadelFor?: (instance: OwnAuthInstance) => ZitadelReader;
     coolify: CoolifyReader;
     cloudflare: CloudflareReader;
     files: FilesReader;
@@ -94,7 +97,7 @@ export interface LiveReaders {
     cms: CmsReader;
 }
 /** Every live resource foundry can see for `orgId`, across all six systems. */
-export declare function readLiveResources(orgId: OrgId, readers: LiveReaders): Promise<LiveResource[]>;
+export declare function readLiveResources(orgId: OrgId, readers: LiveReaders, org?: DeclaredOrg, orgRecordedIds?: Readonly<Record<string, string>>): Promise<LiveResource[]>;
 /**
  * #167: one narrow interface per system reading the shared platform's own
  * resources (`platform.ts`'s `DeclaredPlatform`) -- the platform-scoped

package/dist/plan/live.js

@@ -1,7 +1,11 @@
+import { ownsServices } from '../org.js';
+import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
 /** Every live resource foundry can see for `orgId`, across all six systems. */
-export async function readLiveResources(orgId, readers) {
+export async function readLiveResources(orgId, readers, org, orgRecordedIds) {
     const [zitadel, coolify, cloudflare, files, ai, cms] = await Promise.all([
-        readers.zitadel.listResources(orgId),
+        org && ownsServices(org)
+            ? readOwnZitadel(orgId, readers, org, orgRecordedIds ?? {})
+            : readers.zitadel.listResources(orgId),
         readers.coolify.listResources(orgId),
         readers.cloudflare.listResources(orgId),
         readers.files.listResources(orgId),
@@ -10,6 +14,15 @@ export async function readLiveResources(orgId, readers) {
     ]);
     return [...zitadel, ...coolify, ...cloudflare, ...files, ...ai, ...cms];
 }
+/** An own org's ZITADEL is its own instance: nothing is read until it is applied, and never from the shared one. */
+async function readOwnZitadel(orgId, readers, org, recordedIds) {
+    if (!readers.zitadelFor || !org.domain || !recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY])
+        return [];
+    const refs = orgTarget(org).refs;
+    return readers
+        .zitadelFor({ issuerUrl: `https://auth.${org.domain}`, bearerRef: refs.instanceBearer })
+        .listResources(orgId);
+}
 /** Every live resource foundry can see for the platform, across every wired reader (#167, #173). */
 export async function readLivePlatformResources(readers) {
     const [cloudflare, coolify] = await Promise.all([

package/dist/plan/locked-hostnames.d.ts

@@ -1,8 +1,11 @@
-import type { DeclaredOrg } from '../org.js';
+import { type DeclaredOrg } from '../org.js';
+/** The labels an own org's services answer on, so no hosting entry may take them. */
+export declare const OWN_SERVICE_LABELS: readonly ["auth", "mail", "files", "sfu"];
 /**
  * The names under the org's domain that foundry owns, so no hosting entry may
  * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
- * domain, the sign-in host when the issuer does, and every platform service
+ * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
+ * `sfu.` for an org that runs its own services, and every platform service
  * hostname that falls under the domain. Empty for an org with no domain.
  */
 export declare function lockedHostnames(org: DeclaredOrg, platformHostnames: readonly string[]): Set<string>;

package/dist/plan/locked-hostnames.js

@@ -1,10 +1,14 @@
+import { ownsServices } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { loginHostnameFor } from './login-host.js';
+/** The labels an own org's services answer on, so no hosting entry may take them. */
+export const OWN_SERVICE_LABELS = ['auth', 'mail', 'files', 'sfu'];
 /**
  * The names under the org's domain that foundry owns, so no hosting entry may
  * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
- * domain, the sign-in host when the issuer does, and every platform service
+ * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
+ * `sfu.` for an org that runs its own services, and every platform service
  * hostname that falls under the domain. Empty for an org with no domain.
  */
 export function lockedHostnames(org, platformHostnames) {
@@ -20,6 +24,10 @@ export function lockedHostnames(org, platformHostnames) {
         locked.add(`calls.${domain}`);
     if (org.issuer.usesDomain)
         locked.add(loginHostnameFor(org));
+    if (ownsServices(org)) {
+        for (const label of OWN_SERVICE_LABELS)
+            locked.add(`${label}.${domain}`);
+    }
     for (const hostname of platformHostnames) {
         if (hostname.endsWith(`.${domain}`))
             locked.add(hostname);

package/dist/plan/login-host.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg } from '../org.js';
+import { type DeclaredOrg } from '../org.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -32,6 +32,66 @@ import type { DeclaredOrg } from '../org.js';
  * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
  */
 export declare function loginHostnameFor(org: DeclaredOrg): string;
+/**
+ * The login host the login-host step plans for an org: the shared instance's
+ * own host when `sharedHost` is given (the platform's own org), the company's
+ * own host otherwise. `planLoginHost` and {@link agoraIssuerHostFor} both
+ * read it here, so Agora's issuer and the login host cannot disagree.
+ */
+export declare function orgLoginHost(org: DeclaredOrg, sharedHost: string | null): string;
+/**
+ * The login host Agora may take as its issuer, and whether the org's pair is
+ * one Agora refuses. Agora accepts an issuer host on its own address's
+ * registrable domain, or `<slug>-auth.oikos.host` for `<slug>-agora.oikos.host`.
+ * `host` is null for the platform's own org (it keeps the platform issuer) and
+ * for a domain with `issuer.usesDomain` off, where the login host
+ * `<slug>-auth.oikos.host` and the Agora address `agora.<domain>` are
+ * refused together (`mismatch`).
+ */
+export declare function agoraIssuerHostFor(org: DeclaredOrg, isPlatformOrg: boolean): {
+    host: string | null;
+    mismatch: boolean;
+};
+/** Milliseconds the discovery read may take before the host counts as not serving. */
+export declare const LOGIN_HOST_DISCOVERY_TIMEOUT_MS = 5000;
+/**
+ * Host-supplied read of `GET https://<host>/.well-known/openid-configuration`:
+ * the status and the body text. Optional on `FoundryPlanApplyOptions`; absent
+ * means "not read", so Agora keeps the platform issuer. The port may throw.
+ */
+export interface LoginHostDiscoveryPort {
+    discovery(host: string): Promise<{
+        status: number;
+        body: string;
+    }>;
+}
+/** True when the answer is a 200 whose JSON `issuer` is exactly `https://<host>`. */
+export declare function discoveryNamesHost(host: string, answer: {
+    status: number;
+    body: string;
+}): boolean;
+/**
+ * Reads the port once, with a {@link LOGIN_HOST_DISCOVERY_TIMEOUT_MS} limit.
+ * An absent port, a throw, a timeout or any answer that is not a discovery
+ * document for `host` is false. Never throws; nothing is logged, so no value
+ * leaves.
+ */
+export declare function readLoginHostDiscovery(port: LoginHostDiscoveryPort | undefined, host: string, timeoutMs?: number): Promise<boolean>;
+/**
+ * True once the org's own sign-in step has applied (`coolify:own-auth:<org.id>`
+ * in its recorded ids). An own org has no login-host step: its issuer host is
+ * the sign-in service's own, so this marker is what Agora and every ZITADEL
+ * step of the org wait for.
+ */
+export declare function ownAuthApplied(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
+/**
+ * True once the login-host step has applied `host` for the org, and, when
+ * Agora's client is already made, the binding it wrote names that client.
+ * The binding admits client ids only, so a host whose binding lacks Agora's
+ * client cannot sign Agora in. An org with no Agora client yet has nothing
+ * to wait for beyond the host itself.
+ */
+export declare function loginHostServesAgora(host: string, org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
 /**
  * Scope id set to `'1'` once an org's recorded login host is the platform's
  * shared instance host: that host's trusted domain belongs to the shared
@@ -113,6 +173,6 @@ export declare function pendingRemovalState(hosts: readonly string[]): string;
  * it: `auth.<domain>`, only when it is under the org's own domain
  * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
  * the shared instance's and is routed by the platform auth tunnel. Otherwise
- * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ * `null`, and always `null` for an own org. The tier 1 host rides the shared `*.oikos.host` tunnel.
  */
 export declare function companyLoginTunnelHost(org: DeclaredOrg, isPlatformOrg: boolean): string | null;

package/dist/plan/login-host.js

@@ -1,3 +1,4 @@
+import { ownsServices } from '../org.js';
 import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, } from './agora.js';
 import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
 /**
@@ -41,6 +42,105 @@ export function loginHostnameFor(org) {
     }
     return `${org.slug}-auth.oikos.host`;
 }
+/**
+ * The login host the login-host step plans for an org: the shared instance's
+ * own host when `sharedHost` is given (the platform's own org), the company's
+ * own host otherwise. `planLoginHost` and {@link agoraIssuerHostFor} both
+ * read it here, so Agora's issuer and the login host cannot disagree.
+ */
+export function orgLoginHost(org, sharedHost) {
+    return sharedHost ?? loginHostnameFor(org);
+}
+/**
+ * The login host Agora may take as its issuer, and whether the org's pair is
+ * one Agora refuses. Agora accepts an issuer host on its own address's
+ * registrable domain, or `<slug>-auth.oikos.host` for `<slug>-agora.oikos.host`.
+ * `host` is null for the platform's own org (it keeps the platform issuer) and
+ * for a domain with `issuer.usesDomain` off, where the login host
+ * `<slug>-auth.oikos.host` and the Agora address `agora.<domain>` are
+ * refused together (`mismatch`).
+ */
+export function agoraIssuerHostFor(org, isPlatformOrg) {
+    if (isPlatformOrg)
+        return { host: null, mismatch: false };
+    if (org.domain && !org.issuer.usesDomain)
+        return { host: null, mismatch: true };
+    return { host: loginHostnameFor(org), mismatch: false };
+}
+/** Milliseconds the discovery read may take before the host counts as not serving. */
+export const LOGIN_HOST_DISCOVERY_TIMEOUT_MS = 5_000;
+/** True when the answer is a 200 whose JSON `issuer` is exactly `https://<host>`. */
+export function discoveryNamesHost(host, answer) {
+    if (answer.status !== 200)
+        return false;
+    try {
+        const parsed = JSON.parse(answer.body);
+        return (typeof parsed === 'object' &&
+            parsed !== null &&
+            parsed.issuer === `https://${host}`);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Reads the port once, with a {@link LOGIN_HOST_DISCOVERY_TIMEOUT_MS} limit.
+ * An absent port, a throw, a timeout or any answer that is not a discovery
+ * document for `host` is false. Never throws; nothing is logged, so no value
+ * leaves.
+ */
+export async function readLoginHostDiscovery(port, host, timeoutMs = LOGIN_HOST_DISCOVERY_TIMEOUT_MS) {
+    if (!port)
+        return false;
+    let timer;
+    try {
+        const answer = await Promise.race([
+            port.discovery(host),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), timeoutMs);
+            }),
+        ]);
+        return discoveryNamesHost(host, answer);
+    }
+    catch {
+        // Any failure is "not serving": the plan keeps the platform issuer and says so in a fixed line.
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * True once the org's own sign-in step has applied (`coolify:own-auth:<org.id>`
+ * in its recorded ids). An own org has no login-host step: its issuer host is
+ * the sign-in service's own, so this marker is what Agora and every ZITADEL
+ * step of the org wait for.
+ */
+export function ownAuthApplied(org, recorded) {
+    return Boolean(recorded[`coolify:own-auth:${org.id}`]);
+}
+/**
+ * True once the login-host step has applied `host` for the org, and, when
+ * Agora's client is already made, the binding it wrote names that client.
+ * The binding admits client ids only, so a host whose binding lacks Agora's
+ * client cannot sign Agora in. An org with no Agora client yet has nothing
+ * to wait for beyond the host itself.
+ */
+export function loginHostServesAgora(host, org, recorded) {
+    if (ownsServices(org))
+        return ownAuthApplied(org, recorded);
+    if (recorded[`zitadel:login-host:${org.id}`] !== host)
+        return false;
+    const bound = recorded[LOGIN_BINDING_SCOPE_KEY];
+    if (!bound?.startsWith(`${host} `))
+        return false;
+    const clientId = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    return (!clientId ||
+        bound
+            .slice(host.length + 1)
+            .split(',')
+            .includes(clientId));
+}
 /**
  * Scope id set to `'1'` once an org's recorded login host is the platform's
  * shared instance host: that host's trusted domain belongs to the shared
@@ -109,8 +209,11 @@ export function pendingRemovalState(hosts) {
  * it: `auth.<domain>`, only when it is under the org's own domain
  * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
  * the shared instance's and is routed by the platform auth tunnel. Otherwise
- * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ * `null`, and always `null` for an own org. The tier 1 host rides the shared `*.oikos.host` tunnel.
  */
 export function companyLoginTunnelHost(org, isPlatformOrg) {
+    // An own org's sign-in stack publishes `auth.<domain>` through its own tunnel.
+    if (ownsServices(org))
+        return null;
     return org.domain && org.issuer.usesDomain && !isPlatformOrg ? loginHostnameFor(org) : null;
 }