@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/health-check-settings.d.ts

@@ -45,3 +45,31 @@ export declare const DEFAULT_HEALTH_CHECK_START_PERIOD_SECONDS = 30;
  * Dockerfile's `EXPOSE`) names, not a public one.
  */
 export declare function healthCheckSettings(path: string, port: number, startPeriodSeconds?: number): HealthCheckPatch;
+/**
+ * For an app built from a Dockerfile that has its own HEALTHCHECK: Coolify's check off. Coolify then keeps the
+ * Dockerfile's check, and its rolling update waits on that check's state (with Coolify's check on it would replace
+ * the Dockerfile's, so two checks would never both be live). Coolify reads the Dockerfile only while its own check is
+ * off, so this goes on before the first deploy.
+ */
+export declare const IMAGE_HEALTHCHECK_SETTINGS: {
+    readonly health_check_enabled: false;
+};
+/** The four `updateApplication` fields that turn on a Coolify health check that runs a command inside the container. */
+export interface CommandHealthCheckPatch {
+    health_check_enabled: true;
+    health_check_type: 'cmd';
+    health_check_command: string;
+    health_check_start_period: number;
+}
+/**
+ * The same fields as {@link healthCheckSettings}, for an image whose HTTP
+ * check cannot work: no `curl`, or an app that answers 401 on every route.
+ * Coolify's own HTTP check calls `localhost`, which `wget` in an Alpine image
+ * resolves to `::1` first, so a server that listens on IPv4 only is never
+ * reached. A command names `127.0.0.1` itself.
+ */
+export declare function commandHealthCheckSettings(command: string, startPeriodSeconds?: number): CommandHealthCheckPatch;
+/** A GET on `127.0.0.1` that fails on any status of 400 or more; the `wget` of a busybox image. */
+export declare const wgetProbe: (port: number | string, path: string) => string;
+/** A TCP connect to `127.0.0.1`, for a server with no route that answers without a token. */
+export declare const tcpProbe: (port: number | string) => string;

package/dist/plan/health-check-settings.js

@@ -45,3 +45,39 @@ export function healthCheckSettings(path, port, startPeriodSeconds = DEFAULT_HEA
         health_check_start_period: startPeriodSeconds,
     };
 }
+/**
+ * For an app built from a Dockerfile that has its own HEALTHCHECK: Coolify's check off. Coolify then keeps the
+ * Dockerfile's check, and its rolling update waits on that check's state (with Coolify's check on it would replace
+ * the Dockerfile's, so two checks would never both be live). Coolify reads the Dockerfile only while its own check is
+ * off, so this goes on before the first deploy.
+ */
+export const IMAGE_HEALTHCHECK_SETTINGS = { health_check_enabled: false };
+/**
+ * What Coolify accepts as `health_check_command`: letters, digits, space and
+ * `- _ . / : = @ , +`, at most 1000 characters (its `generate_healthcheck_commands`
+ * falls back to the HTTP check on anything else, without an error). It runs as
+ * `sh -c`, so the image needs a shell and the tool the command names.
+ */
+const COOLIFY_COMMAND = /^[a-zA-Z0-9 \-_./:=@,+]+$/;
+/**
+ * The same fields as {@link healthCheckSettings}, for an image whose HTTP
+ * check cannot work: no `curl`, or an app that answers 401 on every route.
+ * Coolify's own HTTP check calls `localhost`, which `wget` in an Alpine image
+ * resolves to `::1` first, so a server that listens on IPv4 only is never
+ * reached. A command names `127.0.0.1` itself.
+ */
+export function commandHealthCheckSettings(command, startPeriodSeconds = DEFAULT_HEALTH_CHECK_START_PERIOD_SECONDS) {
+    if (!COOLIFY_COMMAND.test(command) || command.length > 1000) {
+        throw new Error(`health check command ${JSON.stringify(command)} is not one Coolify accepts`);
+    }
+    return {
+        health_check_enabled: true,
+        health_check_type: 'cmd',
+        health_check_command: command,
+        health_check_start_period: startPeriodSeconds,
+    };
+}
+/** A GET on `127.0.0.1` that fails on any status of 400 or more; the `wget` of a busybox image. */
+export const wgetProbe = (port, path) => `wget -q -O /dev/null http://127.0.0.1:${port}${path}`;
+/** A TCP connect to `127.0.0.1`, for a server with no route that answers without a token. */
+export const tcpProbe = (port) => `nc -z 127.0.0.1 ${port}`;

package/dist/plan/health-gaps.d.ts

@@ -0,0 +1,33 @@
+/** An app as Coolify keeps it: its name and everything create and update sent. */
+export interface StoredApp {
+    name: string;
+    fields: Record<string, unknown>;
+}
+/**
+ * Apps that run once and then idle or exit, so Docker has no service to check. Matched by what the app is built
+ * from (repo and Dockerfile target), never by its name, so no look-alike name is exempt.
+ */
+export declare const EXIT_JOBS: ReadonlyArray<{
+    repo: string;
+    target: string;
+    reason: string;
+}>;
+/**
+ * Apps built from a Dockerfile in another repo that carries a HEALTHCHECK line. Foundry cannot read that file
+ * here, so each entry names the app by repo and Dockerfile and says where the line was seen. With the Coolify
+ * check off, Coolify keeps the image's check and its rolling update follows it.
+ */
+export declare const REPO_DOCKERFILE_CHECKED: ReadonlyArray<{
+    repo: string;
+    dockerfile?: string;
+    target?: string;
+    seen: string;
+}>;
+/**
+ * A check that can fail. Either Coolify's own, on and with something to probe (a command that does something,
+ * or HTTP on a port; Coolify falls back to the exposed port and to `/`), or Coolify's off over a Dockerfile that
+ * carries its own HEALTHCHECK, which Coolify then keeps.
+ */
+export declare function hasRealCheck(fields: Record<string, unknown>): boolean;
+/** The names of the long-running apps with no real check, not counting the exit jobs. */
+export declare function healthGaps(apps: ReadonlyArray<StoredApp>): string[];

package/dist/plan/health-gaps.js

@@ -0,0 +1,89 @@
+/**
+ * Apps that run once and then idle or exit, so Docker has no service to check. Matched by what the app is built
+ * from (repo and Dockerfile target), never by its name, so no look-alike name is exempt.
+ */
+export const EXIT_JOBS = [
+    {
+        repo: 'wtfalch/files',
+        target: 'migration',
+        reason: 'runs the migrations once; its image HEALTHCHECK reports done',
+    },
+    {
+        repo: 'wtfalch/ai',
+        target: 'migration',
+        reason: 'runs the migrations once; its image HEALTHCHECK reports done',
+    },
+    {
+        repo: 'wtfalch/integrations',
+        target: 'migration',
+        reason: 'runs the migrations once; its image HEALTHCHECK reports done',
+    },
+    {
+        repo: 'wtfalch/integrations',
+        target: 'worker',
+        reason: 'a finite pass (work-once.ts) that exits 0; nothing waits on it',
+    },
+];
+/**
+ * Apps built from a Dockerfile in another repo that carries a HEALTHCHECK line. Foundry cannot read that file
+ * here, so each entry names the app by repo and Dockerfile and says where the line was seen. With the Coolify
+ * check off, Coolify keeps the image's check and its rolling update follows it.
+ */
+export const REPO_DOCKERFILE_CHECKED = [
+    { repo: 'wtfalch/auth', dockerfile: '/login/Dockerfile', seen: 'login image, docker inspect' },
+    { repo: 'wtfalch/auth', dockerfile: '/broker/Dockerfile', seen: 'broker image, docker inspect' },
+    { repo: 'wtfalch/ai', target: 'worker', seen: 'ai-worker image, docker inspect' },
+    { repo: 'wtfalch/integrations', target: 'runner', seen: 'integrations/Dockerfile line 49' },
+    {
+        repo: 'wtfalch/chat',
+        dockerfile: '/apps/chat-service/synapse-module/Dockerfile',
+        seen: 'chat Synapse image, docker inspect',
+    },
+];
+/** Commands that succeed whatever the container is doing. */
+const NO_OP = /^(?:true|:|exit 0|\/bin\/true|\/usr\/bin\/true|sh -c true)$/;
+/** A `HEALTHCHECK` instruction that is not `HEALTHCHECK NONE`. */
+const DOCKERFILE_HEALTHCHECK = /^\s*HEALTHCHECK\s+(?!NONE\b)/im;
+const same = (a, b) => b === undefined || a === b;
+function exitJob(f) {
+    return EXIT_JOBS.some((e) => f.git_repository === e.repo && f.dockerfile_target_build === e.target);
+}
+function repoDockerfileChecked(f) {
+    return REPO_DOCKERFILE_CHECKED.some((e) => f.git_repository === e.repo &&
+        same(f.dockerfile_location, e.dockerfile) &&
+        same(f.dockerfile_target_build, e.target));
+}
+/**
+ * A check that can fail. Either Coolify's own, on and with something to probe (a command that does something,
+ * or HTTP on a port; Coolify falls back to the exposed port and to `/`), or Coolify's off over a Dockerfile that
+ * carries its own HEALTHCHECK, which Coolify then keeps.
+ */
+export function hasRealCheck(fields) {
+    if (fields.health_check_enabled === true) {
+        if (fields.health_check_type === 'cmd') {
+            const command = fields.health_check_command;
+            return typeof command === 'string' && command.trim() !== '' && !NO_OP.test(command.trim());
+        }
+        const exposed = typeof fields.ports_exposes === 'string' && fields.ports_exposes.trim() !== '';
+        return typeof fields.health_check_port === 'number' || exposed;
+    }
+    if (fields.health_check_enabled === false) {
+        const dockerfile = fields.dockerfile;
+        if (typeof dockerfile === 'string') {
+            // An inline Dockerfile may arrive base64 (a PATCH), as plain text on create.
+            const text = DOCKERFILE_HEALTHCHECK.test(dockerfile)
+                ? dockerfile
+                : Buffer.from(dockerfile, 'base64').toString('utf8');
+            return DOCKERFILE_HEALTHCHECK.test(text);
+        }
+        return repoDockerfileChecked(fields);
+    }
+    return false;
+}
+/** The names of the long-running apps with no real check, not counting the exit jobs. */
+export function healthGaps(apps) {
+    return apps
+        .filter((a) => !exitJob(a.fields) && !hasRealCheck(a.fields))
+        .map((a) => a.name)
+        .sort();
+}

package/dist/plan/health-targets.d.ts

@@ -71,9 +71,7 @@ export interface HealthTarget {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export declare function healthTargets(org: DeclaredOrg, options?: {
-    platform?: DeclaredPlatform | null;
-}): HealthTarget[];
+export declare function healthTargets(org: DeclaredOrg): HealthTarget[];
 /**
  * The seven platform services #541 names (`platform:auth`, `platform:archon`,
  * `platform:mail`, `platform:ai`, `platform:files`, `platform:integrations`,

package/dist/plan/health-targets.js

@@ -1,10 +1,9 @@
 import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
-import { isPlatformOwnOrg } from './diff.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
 import { isBehindGate } from './gates.js';
-import { entryHostnames } from './hostnames.js';
+import { entryHostnames, siteHostnameFor } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
 function okExpect() {
     return { status: 200 };
@@ -25,12 +24,8 @@ const STALWART_READY_PATH = '/healthz/ready';
 const CHAT_SERVICE_HEALTH_PATH = '/_chat/health';
 const CALLS_HEALTH_PATH = '/healthz';
 /** Boule, Agora and the company's own login host: every org gets these, with no flag to check (the "Why" this issue opens with). */
-function alwaysOnTargets(org, platform) {
-    // The platform's own org signs in on the shared instance host, not its own
-    // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
-    const loginHost = platform && isPlatformOwnOrg(org, platform.ownerOrgId)
-        ? platform.auth.hostname
-        : loginHostnameFor(org);
+function alwaysOnTargets(org) {
+    const loginHost = loginHostnameFor(org);
     return [
         {
             service: 'boule',
@@ -62,14 +57,10 @@ function alwaysOnTargets(org, platform) {
     ];
 }
 /**
- * The shared sign-in broker (`broker-entries.ts`), when this company depends
- * on it: any hosting entry declaring `uses.auth` signs in through it. The
- * broker is the platform's one app, not a per-company address `org` alone
- * can build -- its real, reachable URL is `platformHealthTargets`'s own
- * `'auth-broker'` target, under `platform.auth.hostname`. This target still
- * belongs in a company's own list (#541: "Include ... the broker when the
- * company has them") so a status page scoped to one company shows every
- * service that company's sign-in actually depends on, even a shared one.
+ * The company's own sign-in broker (`broker-entries.ts`), when it depends on
+ * it: any hosting entry declaring `uses.auth` signs in through it. Its
+ * `/healthy` is not routed to the outside, so no URL is built here (#541:
+ * "Include ... the broker when the company has them").
  */
 function brokerTarget(org) {
     const usesBroker = org.hosting.entries.some((entry) => Boolean(entry.uses?.auth));
@@ -82,14 +73,13 @@ function brokerTarget(org) {
         depth: 'shallow',
         restartSafe: false,
         behindAccess: false,
-        reason: "the sign-in broker is the platform's one shared app (broker-entries.ts), not a per-company address this function can build from `org` alone -- see platformHealthTargets's 'auth-broker' target",
+        reason: "the company's own sign-in broker answers on its internal network only (broker-entries.ts): its /healthy is not routed to the outside, so there is no URL to probe",
     };
 }
 /**
- * Mail, when this company's mail is not off. Every org's mail is served by
- * the one shared Stalwart instance (`executor.ts`'s `mailOrgFor`), never a
- * per-org app, so there is no per-company hostname to build here either --
- * `platformHealthTargets`'s own `'mail'` target is the real, reachable one.
+ * Mail, when this company's mail is not off. The company runs its own
+ * Stalwart (`own-mail`), reached only by the shared relay on the internal
+ * network, so there is no public URL to build here.
  */
 function mailTarget(org) {
     if (org.mail.mode === 'off')
@@ -101,7 +91,7 @@ function mailTarget(org) {
         depth: 'deep',
         restartSafe: false,
         behindAccess: false,
-        reason: "mail is the platform's one shared Stalwart instance, not a per-company address this function can build from `org` alone -- see platformHealthTargets's 'mail' target",
+        reason: "the company's own Stalwart is reached by the shared relay on the internal network only, so it has no public address to probe",
     };
 }
 /**
@@ -200,11 +190,11 @@ function appTargets(org) {
     if (org.hosting.enabled && appEntry(org.hosting)) {
         return org.hosting.entries.map((entry) => hostingEntryTarget(org, entry));
     }
-    if (org.site.enabled && org.domain) {
+    if (org.site.enabled) {
         return [
             {
                 service: 'site',
-                url: `https://${org.domain}${DEFAULT_API_HEALTH_PATH}`,
+                url: `https://${siteHostnameFor(org)}${DEFAULT_API_HEALTH_PATH}`,
                 expect: okExpect(),
                 depth: 'deep',
                 restartSafe: true,
@@ -228,8 +218,8 @@ function appTargets(org) {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export function healthTargets(org, options = {}) {
-    const targets = alwaysOnTargets(org, options.platform ?? null);
+export function healthTargets(org) {
+    const targets = alwaysOnTargets(org);
     const broker = brokerTarget(org);
     if (broker)
         targets.push(broker);
@@ -308,8 +298,10 @@ function internalOnlyTarget(service, reason) {
  * one anyway.
  */
 export function platformHealthTargets(platform) {
+    // The platform's own sign-in, mail and files are off (each company runs its own), so a target
+    // for a service that is not enabled would point at a host that does not exist.
     return [
-        ...authTargets(platform),
+        ...(platform.auth.enabled ? authTargets(platform) : []),
         {
             service: 'archon',
             // `provisionPlatformArchon` always puts a Cloudflare Access app in front
@@ -322,16 +314,24 @@ export function platformHealthTargets(platform) {
             restartSafe: false,
             behindAccess: true,
         },
-        {
-            service: 'mail',
-            url: `https://${platform.mail.hostname}${STALWART_READY_PATH}`,
-            expect: okExpect(),
-            depth: 'deep',
-            restartSafe: false,
-            behindAccess: false,
-        },
+        ...(platform.mail.enabled
+            ? [
+                {
+                    service: 'mail',
+                    url: `https://${platform.mail.hostname}${STALWART_READY_PATH}`,
+                    expect: okExpect(),
+                    depth: 'deep',
+                    restartSafe: false,
+                    behindAccess: false,
+                },
+            ]
+            : []),
         internalOnlyTarget('ai', "platform:ai's runner is created with no Coolify domains, tunnel, DNS record or Access app (platform-providers.ts) -- nothing public to probe yet"),
-        internalOnlyTarget('files', "platform:files' runner is created with no domains either, the same as platform:auth's apps (platform-providers.ts) -- nothing public to probe yet"),
+        ...(platform.files.enabled
+            ? [
+                internalOnlyTarget('files', "platform:files' runner is created with no domains either, the same as platform:auth's apps (platform-providers.ts) -- nothing public to probe yet"),
+            ]
+            : []),
         {
             service: 'integrations',
             url: null,

package/dist/plan/held-key-refs.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The held-key refs the platform's steps deliver under and an org step reads back. A leaf module:
+ * platform-providers.ts and platform-org.ts import each other, so a constant read at load lives here.
+ */
+/** The ref the scheduler's admin token is delivered under: the host's real `JobsSchedulerPort` adapter reads it back. */
+export declare const JOBS_ADMIN_TOKEN_REF = "jobs:scheduler:adminToken";
+/** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
+export declare const PLATFORM_AI_MANAGEMENT_KEY_REF = "ai:platform:managementKey";
+/**
+ * The install's edge label token (`proxy-labels.ts` `EDGE_LABEL`): minted once, held, and written into the
+ * labels of every container foundry routes, so Traefik can be told to route only those.
+ */
+export declare const PROXY_LABEL_TOKEN_REF = "proxy:labels:token";
+/** The ref the management private key (PKCS#8 PEM) is delivered under. */
+export declare const FILES_MANAGEMENT_KEY_REF = "files:platform:managementKey";

package/dist/plan/held-key-refs.js

@@ -0,0 +1,15 @@
+/**
+ * The held-key refs the platform's steps deliver under and an org step reads back. A leaf module:
+ * platform-providers.ts and platform-org.ts import each other, so a constant read at load lives here.
+ */
+/** The ref the scheduler's admin token is delivered under: the host's real `JobsSchedulerPort` adapter reads it back. */
+export const JOBS_ADMIN_TOKEN_REF = 'jobs:scheduler:adminToken';
+/** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
+export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
+/**
+ * The install's edge label token (`proxy-labels.ts` `EDGE_LABEL`): minted once, held, and written into the
+ * labels of every container foundry routes, so Traefik can be told to route only those.
+ */
+export const PROXY_LABEL_TOKEN_REF = 'proxy:labels:token';
+/** The ref the management private key (PKCS#8 PEM) is delivered under. */
+export const FILES_MANAGEMENT_KEY_REF = 'files:platform:managementKey';

package/dist/plan/hostnames.d.ts

@@ -38,6 +38,16 @@ export declare function tunnelDomainList(names: readonly string[]): string[];
 export declare function coolifyTunnelDomains(names: readonly string[]): string;
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export declare function legacyAppHostname(org: DeclaredOrg): string;
+/**
+ * The public address of the org's cms site: its domain, or `<slug>.oikos.host`
+ * for a company without one (served by the shared `*.oikos.host` wildcard).
+ */
+export declare function siteHostnameFor(org: DeclaredOrg): string;
+/**
+ * The cms studio's address: `cms.<domain>`, or `<slug>-cms.oikos.host` for a
+ * company without a domain (one label, so the free wildcard certificate covers it).
+ */
+export declare function cmsStudioHostnameFor(org: DeclaredOrg): string;
 /**
  * `share.<domain>` when hosting is on and an entry declares
  * `uses.files.shareHost`, else `null`. The files service answers public

package/dist/plan/hostnames.js

@@ -63,6 +63,20 @@ export function coolifyTunnelDomains(names) {
 export function legacyAppHostname(org) {
     return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
 }
+/**
+ * The public address of the org's cms site: its domain, or `<slug>.oikos.host`
+ * for a company without one (served by the shared `*.oikos.host` wildcard).
+ */
+export function siteHostnameFor(org) {
+    return org.site.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
+}
+/**
+ * The cms studio's address: `cms.<domain>`, or `<slug>-cms.oikos.host` for a
+ * company without a domain (one label, so the free wildcard certificate covers it).
+ */
+export function cmsStudioHostnameFor(org) {
+    return org.site.usesDomain && org.domain ? `cms.${org.domain}` : `${org.slug}-cms.oikos.host`;
+}
 /**
  * `share.<domain>` when hosting is on and an entry declares
  * `uses.files.shareHost`, else `null`. The files service answers public

package/dist/plan/index.d.ts

@@ -4,10 +4,18 @@ export type { StepAction, PlannedStep, PlanDetail, OrgPostgresPlan } from './dif
 export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
-export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
+export type { PlatformPlanDetail, MailRoute } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './platform-org.js';
+export type { PlanOwnAuthOptions, PlanOwnFilesOptions, PlanOwnFilesR2Options, PlanOwnJobsOptions, } from './own-diff.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, } from './own-diff.js';
+export type { PlanOwnSfuOptions } from './own-diff.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu } from './own-diff.js';
+export type { SfuAppDeps, SfuAppInput } from './own-sfu.js';
+export { provisionSfuApp, sfuConfig, sfuPortsMappings } from './own-sfu.js';
+export type { OwnAuthInstance, FilesKeysMint, FilesKeysMinted, OwnFilesDeps, OwnFilesR2Key, OwnFilesR2Keys, OwnServicePorts, OwnServicesPort, OwnServicesProvision, OwnSfuDeps, ProjectSource, ServiceNetwork, ServiceTarget, StepScope, } from './own-services.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformNetwork, platformTarget, scopeFromOrg, scopeFromPlatform, } from './own-services.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export type { AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot } from './adopt.js';
@@ -15,8 +23,10 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
+export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
+export type { BackupGatePorts, MoveGatePorts } from './backup-gate.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
+export type { FilesHostInput, JobsHostDeps, JobsHostInput, MailServerInput, PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
@@ -33,8 +43,10 @@ export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, Provi
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
 export type { BrokerPort } from './broker-entries.js';
 export { PlatformBrokerPort } from './broker-entries.js';
-export type { LoginHostBinding, LoginHostBindingsPort } from './login-host.js';
+export type { LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './login-host.js';
 export { loginHostnameFor } from './login-host.js';
+export { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
+export type { OwnHostnames } from './own-hostnames.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './mail-identity.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export type { MailAllowlistApp } from './mail-identity-allowlist.js';
@@ -63,3 +75,4 @@ export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';
 export type { OrgAppVersionRef, OrgAppVersionStatus, WtfalchPackageDrift, PlatformVersionStatus, ReadPlatformVersionStatusOptions, StatusCoolifyPort, StatusGithubPort, GhExec as StatusGhExec, } from './version-status.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './version-status.js';
+export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './destinations.js';

package/dist/plan/index.js

@@ -1,12 +1,17 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
-export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
+export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './platform-org.js';
+export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, } from './own-diff.js';
+export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu } from './own-diff.js';
+export { provisionSfuApp, sfuConfig, sfuPortsMappings } from './own-sfu.js';
+export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformNetwork, platformTarget, scopeFromOrg, scopeFromPlatform, } from './own-services.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
+export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
@@ -18,6 +23,7 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';
 export { loginHostnameFor } from './login-host.js';
+export { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
@@ -32,3 +38,4 @@ export { createEdgeTunnels } from './edge-tunnels.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './version-status.js';
+export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './destinations.js';

package/dist/plan/live.d.ts

@@ -1,4 +1,5 @@
-import type { OrgId } from '../org.js';
+import { type DeclaredOrg, type OrgId } from '../org.js';
+import { type OwnAuthInstance } from './own-services.js';
 /**
  * One resource as seen live in one of foundry's seven systems.
  *
@@ -87,6 +88,8 @@ export interface CmsReader {
 }
 export interface LiveReaders {
     zitadel: ZitadelReader;
+    /** The reader for one own org's ZITADEL instance. Without it an own org's ZITADEL is not read. */
+    zitadelFor?: (instance: OwnAuthInstance) => ZitadelReader;
     coolify: CoolifyReader;
     cloudflare: CloudflareReader;
     files: FilesReader;
@@ -94,7 +97,7 @@ export interface LiveReaders {
     cms: CmsReader;
 }
 /** Every live resource foundry can see for `orgId`, across all six systems. */
-export declare function readLiveResources(orgId: OrgId, readers: LiveReaders): Promise<LiveResource[]>;
+export declare function readLiveResources(orgId: OrgId, readers: LiveReaders, org?: DeclaredOrg, orgRecordedIds?: Readonly<Record<string, string>>): Promise<LiveResource[]>;
 /**
  * #167: one narrow interface per system reading the shared platform's own
  * resources (`platform.ts`'s `DeclaredPlatform`) -- the platform-scoped
@@ -118,6 +121,12 @@ export interface PlatformCloudflareReader {
 /** #173: the platform's own Coolify-hosted jobs scheduler (`platform-diff.ts`'s `planJobs`). */
 export interface PlatformCoolifyReader {
     listResources(): Promise<LiveResource[]>;
+    /** Optional: with it the platform plan reads each recorded app's running commit and notes a build that differs (`build-record.ts`). */
+    listApplicationDeployments?(uuid: string, take?: number): Promise<Array<{
+        deployment_uuid: string;
+        commit?: string;
+        status: string;
+    }>>;
 }
 export interface PlatformLiveReaders {
     cloudflare: PlatformCloudflareReader;

package/dist/plan/live.js

@@ -1,7 +1,12 @@
+import { ownsServices } from '../org.js';
+import { ownHostnames } from './own-hostnames.js';
+import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
 /** Every live resource foundry can see for `orgId`, across all six systems. */
-export async function readLiveResources(orgId, readers) {
+export async function readLiveResources(orgId, readers, org, orgRecordedIds) {
     const [zitadel, coolify, cloudflare, files, ai, cms] = await Promise.all([
-        readers.zitadel.listResources(orgId),
+        org && ownsServices(org)
+            ? readOwnZitadel(orgId, readers, org, orgRecordedIds ?? {})
+            : readers.zitadel.listResources(orgId),
         readers.coolify.listResources(orgId),
         readers.cloudflare.listResources(orgId),
         readers.files.listResources(orgId),
@@ -10,6 +15,15 @@ export async function readLiveResources(orgId, readers) {
     ]);
     return [...zitadel, ...coolify, ...cloudflare, ...files, ...ai, ...cms];
 }
+/** An own org's ZITADEL is its own instance: nothing is read until it is applied, and never from the shared one. */
+async function readOwnZitadel(orgId, readers, org, recordedIds) {
+    if (!readers.zitadelFor || !recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY])
+        return [];
+    const refs = orgTarget(org).refs;
+    return readers
+        .zitadelFor({ issuerUrl: ownHostnames(org).issuerUrl, bearerRef: refs.instanceBearer })
+        .listResources(orgId);
+}
 /** Every live resource foundry can see for the platform, across every wired reader (#167, #173). */
 export async function readLivePlatformResources(readers) {
     const [cloudflare, coolify] = await Promise.all([

package/dist/plan/locked-hostnames.d.ts

@@ -1,8 +1,12 @@
-import type { DeclaredOrg } from '../org.js';
+import { type DeclaredOrg } from '../org.js';
+/** The labels an own org's services answer on, so no hosting entry may take them. */
+export declare const OWN_SERVICE_LABELS: readonly ["auth", "mail", "files", "sfu"];
 /**
  * The names under the org's domain that foundry owns, so no hosting entry may
  * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
- * domain, the sign-in host when the issuer does, and every platform service
- * hostname that falls under the domain. Empty for an org with no domain.
+ * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
+ * `sfu.` for an org that runs its own services, and every platform service
+ * hostname that falls under the domain. An own org with no domain holds its
+ * oikos.host service names; any other org with no domain holds none.
  */
 export declare function lockedHostnames(org: DeclaredOrg, platformHostnames: readonly string[]): Set<string>;