@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/edge-access.d.ts

@@ -10,6 +10,10 @@ export interface AccessAppSummary {
     id: string;
     name: string;
     domain: string;
+    /** The identity providers the app accepts; `[]` means Cloudflare lists none (any provider). */
+    allowedIdps: string[];
+    /** Whether a visitor goes straight to the one provider. */
+    autoRedirectToIdentity: boolean;
 }
 /**
  * Foundry's Cloudflare Access calls. Every Access call in foundry goes through
@@ -19,13 +23,24 @@ export interface AccessAppSummary {
 export interface AccessPort {
     /** Every live Access app foundry may use: the platform's own, and ones nobody adopted yet. */
     listAccessApps(): Promise<AccessAppSummary[]>;
+    /**
+     * Edge keeps `allowedIdps` of an app that already exists: a repeat create
+     * only reports the live value, so a caller compares it from
+     * {@link listAccessApps} and rebuilds the app on a difference.
+     */
     createAccessApp(app: {
         name: string;
         domain: string;
         type: 'self_hosted';
+        allowedIdps?: string[];
+        autoRedirectToIdentity?: boolean;
     }): Promise<{
         id: string;
     }>;
+    /** The account's one-time-PIN identity provider (edge 0.13.0 finds or makes it). Safe to repeat. */
+    ensureOneTimePinProvider(): Promise<{
+        id: string;
+    }>;
     listAccessPolicies(appId: string): Promise<Array<{
         id: string;
         name: string;

package/dist/plan/edge-access.js

@@ -31,6 +31,7 @@ export function createEdgeAccess(client, options = {}) {
         adopt: (input) => retrying(() => client.adopt(input)),
         readiness: () => retrying(() => client.readiness()),
         ensureProvider: (input) => retrying(() => client.ensureProvider(input)),
+        oneTimePinProvider: () => retrying(() => client.oneTimePinProvider()),
         createGate: (input) => retrying(() => client.createGate(input)),
         replaceGateHostnames: (id, input) => retrying(() => client.replaceGateHostnames(id, input)),
         deleteGate: (id) => retrying(() => client.deleteGate(id)),
@@ -80,13 +81,27 @@ export function createEdgeAccess(client, options = {}) {
     const listAccessApps = async () => {
         const { apps } = await access.list();
         remember(apps);
-        return apps.map((a) => ({ id: a.id, name: a.name, domain: a.domain }));
+        return apps.map((a) => ({
+            id: a.id,
+            name: a.name,
+            domain: a.domain,
+            allowedIdps: a.allowedIdps,
+            autoRedirectToIdentity: a.autoRedirectToIdentity,
+        }));
     };
     return {
         listAccessApps,
         async createAccessApp(app) {
             try {
-                const created = await writeSlot(() => access.create({ name: app.name, domain: app.domain, type: app.type }));
+                const created = await writeSlot(() => access.create({
+                    name: app.name,
+                    domain: app.domain,
+                    type: app.type,
+                    ...(app.allowedIdps === undefined ? {} : { allowedIdps: app.allowedIdps }),
+                    ...(app.autoRedirectToIdentity === undefined
+                        ? {}
+                        : { autoRedirectToIdentity: app.autoRedirectToIdentity }),
+                }));
                 return { id: created.id };
             }
             catch (error) {
@@ -155,6 +170,10 @@ export function createEdgeAccess(client, options = {}) {
             const { authDomain } = await access.readiness();
             return { authDomain };
         },
+        async ensureOneTimePinProvider() {
+            const { id } = await access.oneTimePinProvider();
+            return { id };
+        },
         async ensureProvider(input) {
             const { id } = await writeSlot(() => access.ensureProvider(input));
             return { id };

package/dist/plan/executor.d.ts

@@ -12,6 +12,7 @@ import { type EdgePlatformTunnels, type TunnelPort } from './edge-tunnels.js';
 import { type EdgePlatformZones, type ZonePort } from './edge-zones.js';
 import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
+import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
@@ -53,6 +54,8 @@ export interface CoolifyPort {
      */
     listResources?(projectUuid: string): Promise<Array<{
         kind: string;
+        key?: string;
+        config?: Record<string, unknown>;
     }>>;
     findOrCreateEnvironment(projectUuid: string, name: string): Promise<{
         environment: {
@@ -107,10 +110,19 @@ export interface CoolifyPort {
         custom_network_aliases?: string | null;
         health_check_enabled?: boolean;
         ports_exposes?: string;
+        /** Coolify's own record of the resource limits (`plan/own-limits.ts`). */
+        limits_memory?: string;
+        limits_cpus?: string;
+        git_repository?: string;
+        is_auto_deploy_enabled?: boolean;
+        /** Coolify's record of the run options, where the capability options live (`plan/run-options.ts`). */
+        custom_docker_run_options?: string | null;
     }>;
     createGithubAppApplication(input: {
         project_uuid: string;
         server_uuid: string;
+        /** The Docker network the app joins (`plan/destinations.ts`); absent: the server's default. */
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         github_app_uuid: string;
@@ -121,6 +133,8 @@ export interface CoolifyPort {
         domains?: string;
         /** Selects which of two Dockerfiles in one repo to build (`cmsSite`'s own site/cms apps). */
         dockerfile_location?: string;
+        /** Extra `docker run` options; the capability options are added by `plan/own-limits.ts`. */
+        custom_docker_run_options?: string;
         /** The port the app listens on (`HostingEntry.port`). */
         ports_exposes?: string;
         /** `false` for an internal entry: Coolify makes no domain for it. */
@@ -138,6 +152,7 @@ export interface CoolifyPort {
     createPostgresDatabase(input: {
         project_uuid: string;
         server_uuid: string;
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         name: string;
@@ -162,6 +177,8 @@ export interface CoolifyPort {
         uuid: string;
         internal_db_url?: string;
         status?: string;
+        limits_memory?: string;
+        limits_cpus?: string;
     }>;
     /**
      * Every database Coolify holds. `coolifyDatabase` finds its own by name and
@@ -217,6 +234,16 @@ export interface CoolifyPort {
     deleteEnv(applicationUuid: string, envUuid: string): Promise<unknown>;
     /** Escape hatch (`CoolifyClient.raw`) — used for stop/start, which have no typed method yet. */
     raw(method: string, path: string, body?: unknown): Promise<unknown>;
+    /**
+     * F6: the dumps one scheduled backup has run, newest first. A host may wrap
+     * `raw('GET', '/databases/{uuid}/backups/{backup}/executions')`; absent, the
+     * backup gate (`backup-gate.ts`) makes that call through `raw` itself.
+     */
+    listDatabaseBackupExecutions?(databaseUuid: string, backupUuid: string): Promise<Array<{
+        uuid: string;
+        status: string;
+        created_at: string;
+    }>>;
     /**
      * Persistent (named volume) and file storages already attached to an
      * application (#75) — `ensureLogVolume` reads this before creating one, so
@@ -257,6 +284,7 @@ export interface CoolifyPort {
     createDockerImageApplication(input: {
         project_uuid: string;
         server_uuid: string;
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         docker_registry_image_name: string;
@@ -288,12 +316,14 @@ export interface CoolifyPort {
     createDockerfileApplication(input: {
         project_uuid: string;
         server_uuid: string;
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         dockerfile: string;
         name?: string;
         description?: string;
         instant_deploy?: boolean;
+        custom_docker_run_options?: string;
     }): Promise<{
         uuid: string;
     }>;
@@ -425,6 +455,17 @@ export interface CoolifyPort {
     getDeployment(deploymentUuid: string): Promise<{
         status: string;
     }>;
+    /**
+     * An application's deployment history, newest first -- matches
+     * `CoolifyClient.listApplicationDeployments`. `build-record.ts` finds the
+     * deployment a deploy started by its uuid and records its commit. Optional:
+     * a port without it records no built commit.
+     */
+    listApplicationDeployments?(uuid: string, take?: number): Promise<Array<{
+        deployment_uuid: string;
+        commit?: string;
+        status: string;
+    }>>;
 }
 /**
  * The Cloudflare zone calls the platform steps make directly, shaped to match
@@ -933,6 +974,21 @@ export interface ZitadelPort {
     closeSelfRegistration(orgId: string): Promise<{
         changed: boolean;
     }>;
+    /**
+     * Makes the org require a second factor at sign-in: `forceMfa` on, no
+     * registration, no external identity provider, username and password kept
+     * (the invite and a password reset need them), passkeys allowed, and
+     * `mfaInitSkipLifetime` zero so enrolment cannot be skipped. The second
+     * factors are an authenticator app and a security key, the multi factor a
+     * user-verified passkey; every other factor (email or SMS code) is removed.
+     * An org on the instance default gets its own policy. Idempotent: a policy
+     * already so set is no write. A failure halfway is repaired by a repeat,
+     * which reads the policy again. `zitadel-login-policy.ts` is the real
+     * implementation.
+     */
+    enforceSecondFactor(orgId: string): Promise<{
+        changed: boolean;
+    }>;
     /** Grants another ZITADEL org access to a project (plan gap A9). Idempotent. */
     findOrCreateProjectGrant(orgId: string, projectId: string, grantedOrgId: string): Promise<{
         created: boolean;
@@ -1144,6 +1200,16 @@ export interface ZitadelListAppsRawApp {
  * an operator's `MANAGEMENT_PUBLIC_KEYS`/`MANAGEMENT_ISSUER` pins.
  */
 export interface FilesOrganisationPort {
+    /**
+     * An own files host's R2 storage key, sent to that host once (the files route
+     * `PUT /v1/manage/r2-credentials`). Absent on a port that cannot: the own R2 key step is then
+     * blocked by name. The same pair may be sent again after a failed send.
+     */
+    storeR2Credentials?(input: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        tokenId: string;
+    }): Promise<void>;
     provisionOrganisation(input: {
         organisationId: string;
         ceilingBytes: string | null;
@@ -1447,6 +1513,12 @@ export interface PlatformOrgPortSource {
 }
 export interface FoundryStepExecutorPorts {
     coolify: CoolifyPort;
+    /**
+     * Ports for the instances an own org (`services.own`) runs itself. Without
+     * it, a step for an own org is refused rather than run against the shared
+     * services, and the planner reports the org's own services blocked.
+     */
+    ownServices?: OwnServicesPort;
     zitadel: ZitadelPort;
     mail: MailPort;
     lettermint: LettermintPort;
@@ -1574,7 +1646,7 @@ export interface FoundryStepExecutorPorts {
     deliverSecret(ref: string, secret: string): Promise<void>;
     /**
      * Archon's held keys, for an entry env from `sharedSecret` (read, else
-     * generate and `put`) and `platformMailKey` (read only). Optional: without
+     * generate and `put`). Optional: without
      * it, or without `put`, such an env is omitted and the plan reports it
      * blocked. A value goes to the entry's env and nowhere else.
      */
@@ -1590,6 +1662,27 @@ export interface FoundryStepExecutorPorts {
      * passes the same store instance it constructs `FoundryPlanApply` with.
      */
     declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone'>;
+    /**
+     * The `<host>:<port>` the shared mail relay dials for a company's mail server, given the Coolify
+     * server's address and the host port the server publishes. Absent: `<server address>:<port>`. A
+     * host whose containers cannot reach the server by its address (the local stack, where it is a
+     * loopback address) supplies its own. The answer is checked like any relay target
+     * (`normalizeMailTarget`): a host name or an IPv4 address and a port, nothing else.
+     */
+    mailRelayTarget?(input: {
+        serverAddress: string | undefined;
+        port: number;
+    }): string;
+    /**
+     * The address of the server's Docker bridge gateway (an IPv4 address, `172.17.0.1` unless the
+     * daemon's `bip` says otherwise). With it a company's Stalwart publishes SMTP as
+     * `<address>:<port>:25`, which Coolify 4.3.23 passes to Docker unchanged, so the port is reachable
+     * from containers on the server but not on the server's public address; the relay is given
+     * `<address>:<port>` unless `mailRelayTarget` says otherwise. Absent: `<port>:25` on every interface,
+     * and the host firewall must close the range (`docs/runbooks/network-move.md`). The local stack
+     * leaves it unset.
+     */
+    mailBindAddress?: string;
     /**
      * #543: clock, sleep and `fetch` for the health-check wait every company
      * app's own redeploy now goes through (`deploy-health.ts`'s
@@ -1616,9 +1709,8 @@ export declare class NotBuiltError extends Error {
  * `cms.<domain>` -- the cms studio's own hostname (`cmsSite` below), apart
  * from the public site itself at `org.domain` (used directly there). Called
  * from `cmsSite` and from `zitadelApp` for the fixed `cms` client (#139),
- * both of which only run once `org.site.enabled` is true, so `org.domain`
- * is non-null by the same `validateSite` guarantee
- * {@link tunnelIngressHostnames}'s own doc comment cites.
+ * both of which only run once `org.site.enabled` is true. A company without
+ * a domain has its studio at `<slug>-cms.oikos.host` (`cmsStudioHostnameFor`).
  */
 export declare function cmsHostnameFor(org: DeclaredOrg): string;
 /**
@@ -1641,8 +1733,24 @@ export declare function callsHostnameFor(org: DeclaredOrg): string;
  * this file's hostname rules.
  */
 export declare function healthUrls(org: DeclaredOrg): string[];
+/**
+ * Every app on the Coolify box shares one Traefik reverse proxy, and Coolify
+ * itself points that proxy's routing at whatever `domains` an application
+ * declares (`coolifyApp`'s `appHostname(org)`) -- so a tunnel's ingress only
+ * has to reach the proxy, never a specific app container.
+ * `wtfalch/app-template`'s bootstrap (`bootstrap/steps/cf-tunnel.ts`, prior
+ * art for the exact org this file's `cloudflareTunnel` implements, cited by
+ * https://github.com/wtfalch/foundry/issues/71) names this same constant and
+ * value.
+ */
+export declare const COOLIFY_PROXY_ORIGIN = "http://coolify-proxy:80";
 /** The one Access policy foundry puts on a platform Access app (#84). */
 export declare const ACCESS_POLICY_NAME = "foundry: allowed emails";
+export declare const LOG_DIR = "/app/logs";
+/** The company's Coolify destination (its Docker network `co-<slug>`), recorded when its first resource is created. */
+export declare const COOLIFY_DESTINATION_SCOPE_KEY = "coolify_destination";
+export declare const CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY = "coolify_chat_rekey_synapse_database";
+export declare const CHAT_REKEY_MAS_DB_SCOPE_KEY = "coolify_chat_rekey_mas_database";
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
  * `exited:unhealthy` `` -- `@wtfalch/providers`' own doc comment) means it is
@@ -1683,7 +1791,6 @@ export declare const databaseStartWait: {
     graceMs: number;
 };
 export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer {
-    private readonly ports;
     private edgeDns;
     private edgeTunnels;
     private edgeAccess;
@@ -1692,13 +1799,50 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private edgeWriteSlot;
     /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
     private readonly handledSecrets;
+    private readonly ports;
+    private get rawCoolify();
     constructor(ports: FoundryStepExecutorPorts);
     secretsHandled(): readonly string[];
+    /**
+     * An own org's step runs on a copy of this executor whose ZITADEL, mail,
+     * broker, files, jobs and calls ports are the org's own. A port the org has
+     * not got yet is absent or throws, never the shared one.
+     */
+    private executeScoped;
+    /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
+    ownMailKeyMintable(): boolean;
+    /** What the executor's own files dependencies supply, for the planner's blocked lines. */
+    ownFilesDeps(): {
+        keys: boolean;
+        bucket: boolean;
+    };
+    /** Which ports the own files storage key step needs this executor has, for the planner's blocked line. */
+    ownFilesR2Ports(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<{
+        r2Keys: boolean;
+        storeR2Credentials: boolean;
+    }>;
+    /** Whether the host's scoped ports for this own org include a files-organisation port. A held key still missing counts as no port. */
+    ownFilesOrganisationPort(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /** Whether the host's scoped ports for this own org include a broker port: the company's own broker, which its broker entries are written to. */
+    ownBrokerPort(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts(): Partial<Record<EdgePortName, boolean>>;
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
+    private run;
+    /**
+     * The company's destination on `serverUuid`: its Docker network `co-<slug>`, made when absent and
+     * recorded as {@link COOLIFY_DESTINATION_SCOPE_KEY}. Called before the first create of a step;
+     * a server that already holds too many networks fails here (`DestinationCapacityError`), before
+     * the destination or the resource exists. A crash after the destination is made and before it is
+     * recorded leaves a destination the next run finds by its network name, so a re-run converges.
+     * Each Coolify call has a 60 second timeout (`destinations.ts`).
+     */
+    private companyDestination;
+    /** `coolify` for an own-services step: its creates go to the company's destination. */
+    private placedForCompany;
+    private dispatch;
     /**
      * `plan/diff.ts`'s `planAccess` (#246): puts a `hosting.access` rule's
      * hostname behind a Cloudflare Access app named
@@ -1922,6 +2066,17 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private findRecreatedApp;
     private ensureZitadelProject;
     private ensureCoolifyProject;
+    /**
+     * `plan/network-move.ts`'s `planNetworkMove`: a company built on the shared network is moved to its
+     * own. Coolify cannot move a resource in production, so every application and database in the
+     * company's project that foundry did not adopt is deleted, applications first, and the ids recorded
+     * for them are forgotten; the next apply builds them again on `co-<slug>`. Apply has already asked
+     * for the typed company name and checked a fresh backup of every database. A failure part way
+     * leaves what is left recorded and the marker unset, so the same step is planned again and goes on
+     * from there (a 404 counts as deleted). The marker is recorded last. No new timeout: each delete
+     * has the Coolify port's own.
+     */
+    private coolifyNetwork;
     /**
      * #445: one company lands on one Coolify server. The first call for an
      * org picks a usable, reachable server and records it
@@ -1960,6 +2115,15 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * one).
      */
     private ensureLogVolume;
+    /**
+     * F6: a nightly dump of one of the company's databases to the platform's
+     * backup bucket. The schedule is found before it is created
+     * (`provisionDatabaseBackup`), so a run that died after the create and
+     * before `backup_<db>` was recorded reuses the schedule on the next apply
+     * instead of adding a second. The error carries the database's name, never
+     * the connection URL or a response body.
+     */
+    private coolifyBackup;
     private coolifyDatabase;
     /**
      * Pushes the database's connection string into the app's environment,
@@ -2012,6 +2176,19 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * provisioned, where this one is unconditional (#239).
      */
     private pushAppEnv;
+    /**
+     * The install's edge label token: read from the held keys, else minted and held first, so a crash
+     * after the `put` hands the same value out on the next apply. Read once more after the `put`, so two
+     * runs that mint at the same moment end on the value that was held last. An error names the ref,
+     * never a value.
+     */
+    private edgeLabelToken;
+    /**
+     * The `custom_labels` patch of an app foundry routes through Traefik at `hostname`: the same http
+     * router a `domains` entry gets, plus the edge token. Coolify uses these instead of the labels it
+     * generates from `domains`. The router names use the app's own name, which is unique per company.
+     */
+    private routedLabels;
     /**
      * The org's shared secret `name`: read from the held keys, else generated
      * and held first, so a crash after the `put` and before the env write
@@ -2189,6 +2366,22 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * (which must never delete the platform's own project) change.
      */
     private ensureOrgLettermintRelay;
+    /**
+     * The company's own sign-in mail token: a Lettermint project `<slug>-auth`
+     * whose token goes to `orgTarget(org).refs.brokerMailKey`, where the broker
+     * and ZITADEL's SMTP settings read it. The platform-wide Lettermint key
+     * stays with the executor and never reaches a company. A held ref is left
+     * alone. Otherwise the mint rule of {@link ensureOrgAppMailToken}: create
+     * the project, restrict the domain, deliver its token, and only then
+     * delete every other `<slug>-auth` project (a token cannot be read back,
+     * so a project without a held token is a leftover). The restriction comes
+     * before the delivery so a failure there leaves no held ref: the next run
+     * starts over instead of skipping it. A failure before the delivery leaves
+     * that project for the next run to delete. Every Lettermint call is
+     * bounded; the token is registered for redaction before anything can throw
+     * with it.
+     */
+    private ensureOwnAuthMailToken;
     /**
      * Deletes a just-minted project from inside a `catch`. A failed delete is
      * dropped so it never replaces the error being rethrown; the orphan is
@@ -2684,10 +2877,70 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private zonePort;
     private jobsPort;
+    /**
+     * `plan/own-diff.ts`'s `planOwnJobs`: the org's own scheduler, in the org's
+     * own project, with the names and the held-key ref of `orgTarget(org)`. The
+     * admin token goes to `jobs:org:<slug>:adminToken` and nowhere else.
+     */
+    private ownJobs;
+    /**
+     * `plan/own-diff.ts`'s `planOwnFiles`: the org's own files host in the
+     * org's own project, trusting the company's issuer `https://auth.<domain>`.
+     * Its ZITADEL project `<slug>-files` and introspection app are made in the
+     * company's instance (`ownServices.zitadelFor`), never the shared one. The
+     * bucket comes from the host's bucket port under the target's name. The
+     * management key goes to `files:org:<slug>:managementKey` and the
+     * introspection secret to `zitadel:org:<slug>:files:introspection`, both
+     * once, and neither is recorded or returned.
+     */
+    private ownFiles;
+    /**
+     * `plan/own-diff.ts`'s `planOwnFilesR2`: the storage key of the org's own files bucket. A token
+     * recorded as undelivered is deleted first (its secret cannot be read back, so it can never be
+     * finished), then one is minted, registered as a secret, recorded by id as undelivered and
+     * persisted, and only then sent to the files host, the same pair on every retry. The secret is
+     * never recorded and never written to a Coolify env. The id is recorded once the host has it.
+     */
+    private ownFilesR2;
+    /**
+     * `plan/own-diff.ts`'s `planOwnAuth`: the org's own sign-in at
+     * `auth.<domain>`, in the org's own project, through the org's own edge
+     * routed DNS and tunnel ports. The instance owner token goes to
+     * `zitadel:org:<slug>:instanceBearer` and is never recorded. A changed
+     * declared auth ref patches both git apps' branch and redeploys them; the
+     * applied marker comes last, so a run that died halfway is planned again.
+     */
+    private ownAuth;
+    /**
+     * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own
+     * project, publishing its port 25 on one host port of the server (the shared
+     * relay is on another network and dials the server's address) and a directory
+     * that trusts the org's own sign-in. The admin key goes to
+     * `orgTarget(org).refs.mailAdminKey` and nowhere else. The address the relay
+     * routes to is recorded last, and the step's marker after it.
+     */
+    private ownMail;
+    /**
+     * `plan/own-diff.ts`'s `planOwnSfu`: the org's own LiveKit server in the
+     * org's project, on the ports of its slot. The company's key pair goes to
+     * `livekit:org:<slug>:keys` and the app's env, nowhere else.
+     */
+    private ownSfu;
     private jobsRegistration;
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     private deliverWithRetry;
     private cloudflareTunnel;
+    /**
+     * The entry names a company has in the platform's `oikos.host` zone (a company with no domain of its own):
+     * one proxied CNAME each, to this company's tunnel, which routes them straight to the entry container. A
+     * specific record beats the shared `*.oikos.host` wildcard, so the shared ingress stops carrying the name
+     * without being edited. The company writes only its own `<slug>.oikos.host` ({@link ownsOikosName}); an
+     * A or AAAA record, or a CNAME that points anywhere but this tunnel, an earlier id of it or the shared
+     * wildcard's target, blocks the step. A name the company no longer declares has its record deleted when
+     * it still points at this tunnel. The names are recorded only after every record is in place, so a failure
+     * halfway is planned again.
+     */
+    private publishOikosEntryRecords;
     /**
      * #236: when this tunnel's DNS was last published under a domain that
      * differs from the one `org` now declares, deletes every CNAME in the
@@ -2900,6 +3153,19 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * publishes it.
      */
     private publishMailDnsRecords;
+    /**
+     * A company without a domain keeps its web address at `<slug>.oikos.host`,
+     * which only the shared `*.oikos.host` wildcard answers. A wildcard applies
+     * only to a name that holds no record of its own, so the MX and TXT records
+     * of the company's mail domain on that same name would take the web address
+     * away. This writes the name's own proxied CNAME, to wherever the wildcard
+     * points, before any mail record. Found by name and type, so a rerun after a
+     * half-finished apply never doubles it. Cloudflare lists only A, AAAA and
+     * CNAME as clashing with a CNAME, so MX and TXT sit beside it.
+     * https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/
+     * https://developers.cloudflare.com/dns/manage-dns-records/troubleshooting/records-with-same-name/
+     */
+    private ensureOwnWebAddressRecord;
     /**
      * Creates or updates one mail record (Stalwart's or Lettermint's).
      *
@@ -2937,6 +3203,11 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * #491: when `mailDomain` is the platform's own apex, this must never
      * delete the platform's own project (the delete loop skips it by id) or
      * the platform's own domain (returns before the domain lookup/delete).
+     *
+     * An org whose own sign-in is applied keeps its `<slug>-auth` project, and
+     * keeps the Lettermint domain when that is the domain the sign-in sends
+     * from. Every other org deletes `<slug>-auth` too, which only a failed
+     * first sign-in run can have left behind.
      */
     private parkLettermintMail;
     /**