@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/locked-hostnames.js

@@ -1,25 +1,46 @@
+import { ownsServices } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
+import { cmsStudioHostnameFor, siteHostnameFor } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
+import { ownHostnames } from './own-hostnames.js';
+/** The labels an own org's services answer on, so no hosting entry may take them. */
+export const OWN_SERVICE_LABELS = ['auth', 'mail', 'files', 'sfu'];
 /**
  * The names under the org's domain that foundry owns, so no hosting entry may
  * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
- * domain, the sign-in host when the issuer does, and every platform service
- * hostname that falls under the domain. Empty for an org with no domain.
+ * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
+ * `sfu.` for an org that runs its own services, and every platform service
+ * hostname that falls under the domain. An own org with no domain holds its
+ * oikos.host service names; any other org with no domain holds none.
  */
 export function lockedHostnames(org, platformHostnames) {
     const { domain } = org;
     const locked = new Set();
-    if (!domain)
+    if (!domain) {
+        if (ownsServices(org)) {
+            const own = ownHostnames(org);
+            for (const hostname of [own.auth, own.mail, own.files, own.sfu])
+                locked.add(hostname);
+        }
+        if (org.site.enabled) {
+            locked.add(siteHostnameFor(org));
+            locked.add(cmsStudioHostnameFor(org));
+        }
         return locked;
+    }
     locked.add(agoraHostnameFor(org));
     locked.add(bouleHostnameFor(org));
     if (org.site.enabled)
-        locked.add(`cms.${domain}`);
+        locked.add(cmsStudioHostnameFor(org));
     if (org.calls.enabled && org.calls.usesDomain)
         locked.add(`calls.${domain}`);
     if (org.issuer.usesDomain)
         locked.add(loginHostnameFor(org));
+    if (ownsServices(org)) {
+        for (const label of OWN_SERVICE_LABELS)
+            locked.add(`${label}.${domain}`);
+    }
     for (const hostname of platformHostnames) {
         if (hostname.endsWith(`.${domain}`))
             locked.add(hostname);

package/dist/plan/login-host.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg } from '../org.js';
+import { type DeclaredOrg } from '../org.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -22,16 +22,65 @@ import type { DeclaredOrg } from '../org.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: the platform's own org is not handled here: it signs in on the shared
- * ZITADEL instance's own host (`platformAuthHostname`), whatever
- * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
- * that host itself. That host must never get a trusted
- * domain or a login binding of its own:
- * Archon's login-host write throws on a duplicate host, and `auth`'s own
- * `company-host.ts` denies every request through one, the shared one
- * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
+ * Every company, the platform owner included, signs in on its own sign-in
+ * server at this host (`ownHostnames(org).auth` is this function): a domain is
+ * never required.
  */
-export declare function loginHostnameFor(org: DeclaredOrg): string;
+export declare function loginHostnameFor(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'issuer'>): string;
+/**
+ * The login host Agora may take as its issuer, and whether the org's pair is
+ * one Agora refuses. Agora accepts an issuer host on its own address's
+ * registrable domain, or `<slug>-auth.oikos.host` for `<slug>-agora.oikos.host`.
+ * `host` is null for a domain with `issuer.usesDomain` off, where the login host
+ * `<slug>-auth.oikos.host` and the Agora address `agora.<domain>` are
+ * refused together (`mismatch`).
+ */
+export declare function agoraIssuerHostFor(org: DeclaredOrg): {
+    host: string | null;
+    mismatch: boolean;
+};
+/** Milliseconds the discovery read may take before the host counts as not serving. */
+export declare const LOGIN_HOST_DISCOVERY_TIMEOUT_MS = 5000;
+/**
+ * Host-supplied read of `GET https://<host>/.well-known/openid-configuration`:
+ * the status and the body text. Optional on `FoundryPlanApplyOptions`; absent
+ * means "not read", so Agora keeps the platform issuer. The port may throw.
+ */
+export interface LoginHostDiscoveryPort {
+    discovery(host: string): Promise<{
+        status: number;
+        body: string;
+    }>;
+}
+/** True when the answer is a 200 whose JSON `issuer` is exactly `https://<host>`. */
+export declare function discoveryNamesHost(host: string, answer: {
+    status: number;
+    body: string;
+}): boolean;
+/**
+ * Reads the port once, with a {@link LOGIN_HOST_DISCOVERY_TIMEOUT_MS} limit.
+ * An absent port, a throw, a timeout or any answer that is not a discovery
+ * document for `host` is false. Never throws; nothing is logged, so no value
+ * leaves.
+ */
+export declare function readLoginHostDiscovery(port: LoginHostDiscoveryPort | undefined, host: string, timeoutMs?: number): Promise<boolean>;
+/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
+export declare const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = "own_auth_applied_hostname";
+/**
+ * True once the org's own sign-in step has applied (`coolify:own-auth:<org.id>`
+ * in its recorded ids). An own org has no login-host step: its issuer host is
+ * the sign-in service's own, so this marker is what Agora and every ZITADEL
+ * step of the org wait for.
+ */
+export declare function ownAuthApplied(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
+/**
+ * True once the login-host step has applied `host` for the org, and, when
+ * Agora's client is already made, the binding it wrote names that client.
+ * The binding admits client ids only, so a host whose binding lacks Agora's
+ * client cannot sign Agora in. An org with no Agora client yet has nothing
+ * to wait for beyond the host itself.
+ */
+export declare function loginHostServesAgora(host: string, org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
 /**
  * Scope id set to `'1'` once an org's recorded login host is the platform's
  * shared instance host: that host's trusted domain belongs to the shared
@@ -113,6 +162,6 @@ export declare function pendingRemovalState(hosts: readonly string[]): string;
  * it: `auth.<domain>`, only when it is under the org's own domain
  * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
  * the shared instance's and is routed by the platform auth tunnel. Otherwise
- * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ * `null`, and always `null` for an own org. The tier 1 host rides the shared `*.oikos.host` tunnel.
  */
-export declare function companyLoginTunnelHost(org: DeclaredOrg, isPlatformOrg: boolean): string | null;
+export declare function companyLoginTunnelHost(org: DeclaredOrg): string | null;

package/dist/plan/login-host.js

@@ -1,3 +1,4 @@
+import { ownsServices } from '../org.js';
 import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, } from './agora.js';
 import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
 /**
@@ -23,14 +24,9 @@ import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: the platform's own org is not handled here: it signs in on the shared
- * ZITADEL instance's own host (`platformAuthHostname`), whatever
- * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
- * that host itself. That host must never get a trusted
- * domain or a login binding of its own:
- * Archon's login-host write throws on a duplicate host, and `auth`'s own
- * `company-host.ts` denies every request through one, the shared one
- * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
+ * Every company, the platform owner included, signs in on its own sign-in
+ * server at this host (`ownHostnames(org).auth` is this function): a domain is
+ * never required.
  */
 export function loginHostnameFor(org) {
     // `issuer.usesDomain` is the issuer's opt-in into the org's domain
@@ -41,6 +37,95 @@ export function loginHostnameFor(org) {
     }
     return `${org.slug}-auth.oikos.host`;
 }
+/**
+ * The login host Agora may take as its issuer, and whether the org's pair is
+ * one Agora refuses. Agora accepts an issuer host on its own address's
+ * registrable domain, or `<slug>-auth.oikos.host` for `<slug>-agora.oikos.host`.
+ * `host` is null for a domain with `issuer.usesDomain` off, where the login host
+ * `<slug>-auth.oikos.host` and the Agora address `agora.<domain>` are
+ * refused together (`mismatch`).
+ */
+export function agoraIssuerHostFor(org) {
+    if (org.domain && !org.issuer.usesDomain)
+        return { host: null, mismatch: true };
+    return { host: loginHostnameFor(org), mismatch: false };
+}
+/** Milliseconds the discovery read may take before the host counts as not serving. */
+export const LOGIN_HOST_DISCOVERY_TIMEOUT_MS = 5_000;
+/** True when the answer is a 200 whose JSON `issuer` is exactly `https://<host>`. */
+export function discoveryNamesHost(host, answer) {
+    if (answer.status !== 200)
+        return false;
+    try {
+        const parsed = JSON.parse(answer.body);
+        return (typeof parsed === 'object' &&
+            parsed !== null &&
+            parsed.issuer === `https://${host}`);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Reads the port once, with a {@link LOGIN_HOST_DISCOVERY_TIMEOUT_MS} limit.
+ * An absent port, a throw, a timeout or any answer that is not a discovery
+ * document for `host` is false. Never throws; nothing is logged, so no value
+ * leaves.
+ */
+export async function readLoginHostDiscovery(port, host, timeoutMs = LOGIN_HOST_DISCOVERY_TIMEOUT_MS) {
+    if (!port)
+        return false;
+    let timer;
+    try {
+        const answer = await Promise.race([
+            port.discovery(host),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), timeoutMs);
+            }),
+        ]);
+        return discoveryNamesHost(host, answer);
+    }
+    catch {
+        // Any failure is "not serving": the plan keeps the platform issuer and says so in a fixed line.
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
+export const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = 'own_auth_applied_hostname';
+/**
+ * True once the org's own sign-in step has applied (`coolify:own-auth:<org.id>`
+ * in its recorded ids). An own org has no login-host step: its issuer host is
+ * the sign-in service's own, so this marker is what Agora and every ZITADEL
+ * step of the org wait for.
+ */
+export function ownAuthApplied(org, recorded) {
+    return Boolean(recorded[`coolify:own-auth:${org.id}`]);
+}
+/**
+ * True once the login-host step has applied `host` for the org, and, when
+ * Agora's client is already made, the binding it wrote names that client.
+ * The binding admits client ids only, so a host whose binding lacks Agora's
+ * client cannot sign Agora in. An org with no Agora client yet has nothing
+ * to wait for beyond the host itself.
+ */
+export function loginHostServesAgora(host, org, recorded) {
+    if (ownsServices(org))
+        return ownAuthApplied(org, recorded);
+    if (recorded[`zitadel:login-host:${org.id}`] !== host)
+        return false;
+    const bound = recorded[LOGIN_BINDING_SCOPE_KEY];
+    if (!bound?.startsWith(`${host} `))
+        return false;
+    const clientId = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    return (!clientId ||
+        bound
+            .slice(host.length + 1)
+            .split(',')
+            .includes(clientId));
+}
 /**
  * Scope id set to `'1'` once an org's recorded login host is the platform's
  * shared instance host: that host's trusted domain belongs to the shared
@@ -109,8 +194,11 @@ export function pendingRemovalState(hosts) {
  * it: `auth.<domain>`, only when it is under the org's own domain
  * (`issuer.usesDomain`) and the org is not the platform's own, whose host is
  * the shared instance's and is routed by the platform auth tunnel. Otherwise
- * `null`. The tier 1 host rides the shared `*.oikos.host` tunnel.
+ * `null`, and always `null` for an own org. The tier 1 host rides the shared `*.oikos.host` tunnel.
  */
-export function companyLoginTunnelHost(org, isPlatformOrg) {
-    return org.domain && org.issuer.usesDomain && !isPlatformOrg ? loginHostnameFor(org) : null;
+export function companyLoginTunnelHost(org) {
+    // An own org's sign-in stack publishes its host through its own tunnel.
+    if (ownsServices(org))
+        return null;
+    return org.domain && org.issuer.usesDomain ? loginHostnameFor(org) : null;
 }

package/dist/plan/mail-relay.d.ts

@@ -0,0 +1,139 @@
+import type { DeclaredPlatform } from '../platform.js';
+import type { DeployHealthRuntime } from './deploy-health.js';
+import type { DraftStep } from './diff.js';
+import type { CoolifyPort } from './executor.js';
+/**
+ * The shared mail relay: one Postfix container that owns host port 25 and
+ * hands each message to the mail server that serves its recipient's domain,
+ * on the Docker network. One server address has one inbound mail port, so a
+ * company's own mail server cannot bind it; this container does, for all.
+ *
+ * It is a platform step (`coolify:app` keyed {@link PLATFORM_MAIL_RELAY_KEY}),
+ * planned only when `platform.mail.relay` is true. It mints no secret.
+ * Everything it knows reaches the container as env the step writes.
+ */
+export declare const PLATFORM_MAIL_RELAY_KEY = "platform:mail-relay";
+/** Fingerprint of the sorted routes the last successful apply put live. */
+export declare const PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY = "mail_relay_routes_applied";
+/**
+ * Fingerprint of what forces an image rebuild (the Dockerfile text, which holds
+ * the base image pin) and the spool volume the last successful apply put live.
+ * A routes change leaves it alone, so it restarts the container and rebuilds nothing.
+ */
+export declare const PLATFORM_MAIL_RELAY_BUILD_SCOPE_KEY = "mail_relay_build_applied";
+/** Postfix's queue. On a volume, so mail not yet handed on survives a restart and a rebuild. */
+export declare const MAIL_RELAY_SPOOL_DIR = "/var/spool/postfix";
+export declare const MAIL_RELAY_SPOOL_VOLUME = "platform-mail-relay-spool";
+/**
+ * The org-applied-state key the company mail step records its server's SMTP address under: `<server address>:<port>`,
+ * the port the company's Stalwart publishes on the server for the relay ({@link OWN_MAIL_SMTP_PORT_SCOPE_KEY}).
+ * The relay is on the platform's network and a company's mail server on the company's own, so the relay
+ * reaches it through the server, not by its container name.
+ */
+export declare const OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY = "mail_smtp_internal";
+/** The host port a company's Stalwart publishes (mapped to its port 25) for the relay. */
+export declare const OWN_MAIL_SMTP_PORT_SCOPE_KEY = "mail_smtp_port";
+/** The host ports companies' mail servers take, one each: the lowest free one in this range. */
+export declare const OWN_MAIL_SMTP_PORT_BASE = 25000;
+export declare const OWN_MAIL_SMTP_PORT_MAX = 25999;
+/** Whether `port` is one of the ports a company's mail server may publish. */
+export declare function isOwnMailSmtpPort(port: unknown): port is number;
+export declare const MAIL_RELAY_APP_NAME = "platform-mail-relay";
+/** One recipient domain and the mail server that receives it: `target` is `<host>:<port>`. */
+export interface MailRoute {
+    domain: string;
+    target: string;
+}
+/** Lower-cases and checks a recipient domain; `null` for anything that is not a plain DNS name. */
+export declare function normalizeMailDomain(domain: string): string | null;
+/** Lower-cases and checks `<host>:<port>`; `null` for whitespace, metacharacters, a port outside 1..65535 or no host. */
+export declare function normalizeMailTarget(target: string): string | null;
+/**
+ * The routes, checked and sorted by domain. `null` when any entry is invalid or
+ * one domain has two targets (a message could not know where to go).
+ */
+export declare function normalizeMailRoutes(routes: readonly MailRoute[]): MailRoute[] | null;
+/**
+ * What the relay was last built to do, as one value. Order of the inputs does
+ * not matter; a changed target or a new route does.
+ * Never empty, so a platform with no company route still records one.
+ */
+export declare function mailRelayFingerprint(routes: readonly MailRoute[]): string;
+/**
+ * The relay's container start script. It renders Postfix's config from env
+ * only and refuses to start on a value that is not a plain domain or host, so
+ * nothing from env reaches a config line unchecked. The relay accepts mail for
+ * the listed domains and nothing else (`reject_unauth_destination`), so it
+ * cannot be used to send to a third party.
+ *
+ * Mail for a domain no company routes is refused: there is no platform mail
+ * server to fall back on, so no default target exists.
+ *
+ * Env: `MAIL_RELAY_HOSTNAME`, `MAIL_RELAY_ROUTES` (`domain=host:port`, comma
+ * separated). `MAIL_RELAY_RENDER_ONLY=1` writes the files and stops, and
+ * `MAIL_RELAY_CONF_DIR` moves them; both are for tests.
+ */
+export declare const MAIL_RELAY_ENTRYPOINT = "#!/bin/sh\nset -eu\nset -f\nconf=\"${MAIL_RELAY_CONF_DIR:-/etc/postfix}\"\nfail() { echo \"mail relay: $1\" >&2; exit 1; }\nok_name() {\n  case \"$1\" in\n    ''|*[!a-z0-9.-]*|.*|*.|*..*|-*|*.-*|*-.*) return 1 ;;\n  esac\n  return 0\n}\nok_domain() { ok_name \"$1\" && case \"$1\" in *.*) return 0 ;; esac; return 1; }\nok_target() {\n  h=\"${1%:*}\"\n  p=\"${1##*:}\"\n  [ \"$h\" != \"$1\" ] || return 1\n  case \"$p\" in ''|0*|*[!0-9]*) return 1 ;; esac\n  [ \"${#p}\" -le 5 ] || return 1\n  [ \"$p\" -le 65535 ] || return 1\n  ok_name \"$h\"\n}\nok_name \"${MAIL_RELAY_HOSTNAME:-}\" || fail \"MAIL_RELAY_HOSTNAME is not a host name\"\n: > \"$conf/relay_domains\"\n: > \"$conf/transport\"\nIFS=','\nfor entry in ${MAIL_RELAY_ROUTES:-}; do\n  d=\"${entry%%=*}\"\n  t=\"${entry#*=}\"\n  ok_domain \"$d\" || fail \"a route domain is not a plain domain\"\n  ok_target \"$t\" || fail \"a route target is not <host>:<port>\"\n  printf '%s OK\\n' \"$d\" >> \"$conf/relay_domains\"\n  printf '%s smtp:[%s]:%s\\n' \"$d\" \"${t%:*}\" \"${t##*:}\" >> \"$conf/transport\"\ndone\nunset IFS\ncat > \"$conf/main.cf\" <<CONF\nmyhostname = $MAIL_RELAY_HOSTNAME\nmyorigin = \\$myhostname\ninet_interfaces = all\ninet_protocols = ipv4\nmydestination =\nmynetworks = 127.0.0.0/8\nlocal_recipient_maps =\nalias_maps =\nalias_database =\nrelay_domains = texthash:$conf/relay_domains\nparent_domain_matches_subdomains =\ntransport_maps = texthash:$conf/transport\nrelay_recipient_maps =\nsmtpd_relay_restrictions = reject_unauth_destination\nsmtpd_recipient_restrictions = reject_unauth_destination\ndisable_vrfy_command = yes\nmaillog_file = /dev/stdout\nCONF\n[ \"${MAIL_RELAY_RENDER_ONLY:-}\" = \"1\" ] && exit 0\nexec postfix start-fg\n";
+/** The inline Dockerfile Coolify builds. The start script travels base64-encoded so no quoting can alter it. */
+export declare function mailRelayDockerfile(): string;
+/** What a rebuild depends on: the Dockerfile and the spool mount. Routes, domains and hostname are not in it. */
+export declare function mailRelayBuildFingerprint(): string;
+/** The env the step writes; the only input the container reads. */
+export declare function mailRelayEnv(input: {
+    hostname: string;
+    routes: readonly MailRoute[];
+}): Array<{
+    key: string;
+    value: string;
+    literal: boolean;
+}>;
+export declare const MAIL_RELAY_BLOCKED: {
+    readonly executorMissing: "the platform's mail relay is blocked, not planned: the host built the platform executor without its mail dependencies";
+    readonly invalidRoutes: "the platform's mail relay is blocked, not planned: a mail route is not valid (a domain must be a plain DNS name, a target must be <host>:25, one domain needs one target)";
+};
+/**
+ * Plans the relay: nothing unless `mail.relay` is true. Planned when it was
+ * never applied, when the fingerprint of its routes differs from the recorded
+ * one, or when the base image pin changed. Blocked (reported, not planned) while
+ * the platform mail server is not applied, the executor cannot run it, or an
+ * input is invalid.
+ */
+export declare function planMailRelay(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, input: {
+    routes: readonly MailRoute[];
+    executorBlocked: string | undefined;
+}): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+export interface MailRelayDeps {
+    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'findOrCreateEnvironment' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'listStorages' | 'createPersistentStorage' | 'restart' | 'getDeployment' | 'deployAndWait' | 'raw'>;
+    runtime?: DeployHealthRuntime;
+}
+/**
+ * Makes the relay true: finds or creates the app, sets its internal name and
+ * host port 25, mounts the queue volume once, writes env, and then does the
+ * least that makes it true (decided from the live app):
+ * - a rebuild (stop, deploy) when the app was just created, the Dockerfile or
+ *   volume changed, or the volume was just added. The old container is stopped
+ *   first, because two containers cannot both bind port 25;
+ * - a deploy when the container is not running;
+ * - a restart of the same container when only the routes, domains or hostname
+ *   changed. Postfix reads its routes at start, nothing else is needed.
+ * The two fingerprints are recorded last, so a run that fails halfway (env
+ * written, restart failed) leaves the step planned and the next apply
+ * finishes it. No secret exists here.
+ */
+export declare function provisionMailRelay(action: {
+    desired: Record<string, unknown>;
+}, context: {
+    recordedIds(): Readonly<Record<string, string>>;
+    recordScopeId(key: string, id: string): void;
+    persist?(): Promise<void>;
+}, deps: MailRelayDeps, input: {
+    projectUuid: string;
+    serverUuid: string;
+    hostname: string;
+    appScopeKey: string;
+}): Promise<{
+    resourceId: string;
+}>;