@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/plan/platform-org.js

@@ -1,8 +1,12 @@
 import { ownsServices } from '../org.js';
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
+import { oikosIngressApplied } from './oikos-ingress.js';
+import { ownHostnames } from './own-hostnames.js';
 import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
-import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
+import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -128,18 +132,33 @@ edgePortPresent = false) {
         // enabled or applied.
         platformApex: platform.apex,
         platformOwnerOrgId: platform.ownerOrgId || null,
-        platformOwnerUserId: platformRecordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY] || null,
         platformLettermintProjectId: platform.mail.lettermintProjectId ?? null,
         filesReady: filesApplied && missingKeys.files === null,
         filesUrl: filesApplied
             ? (platformRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] ?? null)
             : null,
         aiReady: aiApplied && missingKeys.ai === null,
-        aiUrl: aiApplied ? (platformRecordedIds[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY] ?? null) : null,
+        // An entry runs on its company's own network and cannot dial the platform's container name, so it
+        // is given the host's public origin.
+        // Only once the route (tunnel, connector, DNS record) is recorded: before it the hostname answers nothing.
+        aiUrl: aiApplied && platformRecordedIds[PLATFORM_AI_TUNNEL_SCOPE_KEY]
+            ? `https://${platform.ai.hostname}`
+            : null,
         callsReady: platform.sfu.enabled,
+        oikosIngressApplied: oikosIngressApplied(platformRecordedIds),
+        archonBrokerAppId: platformRecordedIds[PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY] ?? null,
+        platformZitadelIds: [
+            PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY,
+            PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY,
+            PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY,
+            PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY,
+        ].flatMap((key) => platformRecordedIds[key] || []),
         ...(platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY]
             ? { accessProviderId: platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY] }
             : {}),
+        ...(coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY)
+            ? { platformAuthRecordedHost: platform.auth.hostname }
+            : {}),
         authReady,
         authIssuer: authReady ? `https://${platform.auth.hostname}` : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
@@ -150,13 +169,13 @@ edgePortPresent = false) {
         ...(noKeyReader ? { noKeyReader } : {}),
     };
 }
-/** The git refs the platform declares for the services an own org deploys. */
-export function serviceGitRefsOf(platform) {
+/** The git refs the platform declares for the services an own org deploys; a company's `pin` wins per part. */
+export function serviceGitRefsOf(platform, pin) {
     return {
-        auth: platform.auth.gitRef,
-        mail: platform.mail.gitRef,
-        files: platform.files.gitRef,
-        jobs: platform.jobs.gitRef,
+        auth: pin?.auth ?? platform.auth.gitRef,
+        mail: pin?.mail ?? platform.mail.gitRef,
+        files: pin?.files ?? platform.files.gitRef,
+        jobs: pin?.jobs ?? platform.jobs.gitRef,
     };
 }
 /** The runner app both the platform's and an own org's files step record. */
@@ -202,14 +221,19 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
     return {
         ...rest,
         authReady,
-        authIssuer: authReady && org.domain ? `https://auth.${org.domain}` : null,
+        authIssuer: authReady ? ownHostnames(org).issuerUrl : null,
         filesReady: filesApplied && filesUrl !== undefined && missingKeys.files === null,
         filesUrl: filesApplied ? (filesUrl ?? null) : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
         ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),
         callsReady: ownStepRecorded(orgRecordedIds, org, 'own-sfu'),
-        mailHost: mailApplied && org.domain && base.mailHost
-            ? { apex: org.domain, mailHost: base.mailHost.mailHost }
+        // The MX name is the shared relay's, `mx.<platform apex>`: no platform mail step is needed.
+        // The apex is the company's mail zone: its domain when mail runs on it, else oikos.host.
+        mailHost: mailApplied && base.platformApex
+            ? {
+                apex: org.domain && org.mail.usesDomain ? org.domain : NO_DOMAIN_MAIL_APEX,
+                mailHost: platformMailMxHost(base.platformApex),
+            }
             : null,
         missingKeys,
     };
@@ -232,7 +256,7 @@ export async function heldOwnKeyRefs(heldKeys, org) {
 export function agoraHostValuesForOwn(org, orgRecordedIds) {
     const authReady = ownAuthReady(orgRecordedIds);
     return {
-        issuer: authReady && org.domain ? `https://auth.${org.domain}` : null,
+        issuer: authReady ? ownHostnames(org).issuerUrl : null,
         mailProjectId: orgRecordedIds[PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY] ?? null,
         messagingProjectId: null,
         mailUpstream: orgRecordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] ?? null,
@@ -272,3 +296,59 @@ export function agoraHostValuesFromPlatform(platform, platformRecordedIds) {
             : null,
     };
 }
+/**
+ * The owner's sign-in from its declared org and the ids its own steps recorded.
+ * The host and issuer are the host the own-auth step last applied, and only
+ * while that is the declared `ownHostnames(org).auth`: a domain edit gives
+ * `null` until the step has applied the new host, so the owner's instance
+ * token is never sent to a host the step has not set up.
+ */
+export function ownerSignInFrom(owner, recorded) {
+    if (!owner || !ownsServices(owner) || !ownAuthApplied(owner, recorded))
+        return null;
+    const organisationId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    const brokerAppId = recorded[PLATFORM_AUTH_BROKER_SCOPE_KEY];
+    if (!organisationId || !brokerAppId)
+        return null;
+    const applied = recorded[OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY];
+    if (!applied || applied !== ownHostnames(owner).auth)
+        return null;
+    const hostname = applied;
+    return {
+        issuerUrl: `https://${applied}`,
+        organisationId,
+        brokerAppId,
+        bearerRef: orgTarget(owner).refs.instanceBearer,
+        hostname,
+        firstOwnerUserId: platformOwnerUserIdFrom(owner, recorded),
+    };
+}
+/**
+ * The platform's operator identity for a company's files host: the owner company's first owner,
+ * as the owner's `zitadel:owner` step recorded it in the owner company's own ZITADEL. `'none'`
+ * when the owner company declares no owner; `null` until the step has recorded the id, and
+ * when there is no owner company running its own services.
+ */
+export function platformOwnerUserIdFrom(owner, recorded) {
+    if (!owner || !ownsServices(owner))
+        return null;
+    const first = owner.owners[0];
+    if (!first)
+        return 'none';
+    return recorded[`zitadel:owner:${owner.id}:${first.email.toLowerCase()}`] || null;
+}
+/** The owner's files host once its own files step has applied; `null` before. */
+export function ownerFilesFrom(owner, recorded) {
+    if (!owner || !ownsServices(owner) || !recorded[`coolify:own-files:${owner.id}`])
+        return null;
+    const internalUrl = recorded[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY];
+    const hostname = recorded[PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY];
+    if (!internalUrl || !hostname)
+        return null;
+    return {
+        internalUrl,
+        audience: `https://${hostname}`,
+        organisationId: owner.id,
+        managementKeyRef: orgTarget(owner).refs.filesManagement,
+    };
+}

package/dist/plan/platform-providers.d.ts

@@ -6,13 +6,17 @@ import { type DeployHealthRuntime } from './deploy-health.js';
 import type { StepAction } from './diff.js';
 import type { AccessPort } from './edge-access.js';
 import type { DnsPort } from './edge-dns.js';
+import type { RateLimitPort } from './edge-ratelimits.js';
 import type { TunnelPort } from './edge-tunnels.js';
+import type { ZonePort } from './edge-zones.js';
 import type { CloudflarePort, CoolifyPort, FoundryStepExecutorPorts, ZitadelPort } from './executor.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } from './live.js';
+import { type OikosIngressPorts } from './oikos-ingress.js';
 import { type FilesKeysMinted, type ProjectSource, type ServiceNetwork, type ServiceTarget, type StepScope } from './own-services.js';
 import type { PlatformDriftedSteps, PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
 import { type BrokerDeployRecord, PLATFORM_ZITADEL_ORG_SCOPE_KEY } from './platform-diff.js';
+import type { PlatformOwnerInput } from './platform-org.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
@@ -64,7 +68,7 @@ export declare function platformTunnels(deps: {
  */
 export type PlatformAccessFactory = (edgeUrl: string) => PlatformAccessPort | Promise<PlatformAccessPort>;
 /** The Access calls a platform step makes. */
-export type PlatformAccessPort = Pick<AccessPort, 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'deleteAccessApp'>;
+export type PlatformAccessPort = Pick<AccessPort, 'listAccessApps' | 'createAccessApp' | 'ensureOneTimePinProvider' | 'listAccessPolicies' | 'createAccessPolicy' | 'deleteAccessApp'>;
 /**
  * The SMTP call `provisionPlatformAuth` makes on the instance's ZITADEL.
  * `@wtfalch/providers` gains it in 0.7.2; stated here so foundry compiles
@@ -108,7 +112,7 @@ export interface PlatformAuthDeps {
     tunnels: PlatformTunnelsFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'inviteOrgOwner' | 'addOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'addOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;
     /**
      * Mails the owner's first-sign-in link to their personal address (the same
      * port as `FoundryStepExecutorPorts.ownerInviteMail`). The link carries the
@@ -261,71 +265,12 @@ export interface FoundryPlatformStepExecutorOptions {
      * gets the step reported as blocked.
      */
     accessProvider?: PlatformAccessProviderDeps;
+    /**
+     * The shared oikos.host ingress step. Optional like `auth`; with edge enabled and this
+     * unset, the step is reported blocked.
+     */
+    oikosIngress?: PlatformOikosIngressDeps;
 }
-/**
- * The real {@link PlatformStepExecutor} for the two steps built so far:
- * `cloudflare:zone` for the platform's apex (#167) and `coolify:jobs` for the
- * jobs scheduler (#173). `coolify` is optional so every #167-era caller --
- * anything that only ever plans the apex zone -- keeps constructing this with
- * two arguments; a `coolify:jobs` step reaching this executor with no
- * `coolify` port configured throws, naming what is missing, rather than
- * silently doing nothing.
- *
- * `cloudflareZone` mirrors `executor.ts`'s `cloudflareZone`: find the zone by
- * apex and adopt it, create it only when absent. companyincluded.com already
- * exists on Cloudflare, empty, so the first apply adopts it. The owner org
- * (Company Included, whose own domain is the apex) may record the same zone
- * under its own applied state, so that owner is allowed. Any other org that
- * recorded it makes this refuse to adopt. There is no delete here and
- * `PlatformStepExecutor` has none: neither path ever removes the zone.
- *
- * `coolifyJobs` mirrors `executor.ts`'s `coolifyApp`/`coolifyDatabase`,
- * simplified for one platform-level singleton rather than one per org: find
- * or create a dedicated `platform` Coolify project, find or create the
- * scheduler's own database, find or create the scheduler app itself (from
- * https://github.com/wtfalch/jobs, one Dockerfile at its repo root, on the
- * declared `gitRef`), then push the database's `internal_db_url` in as
- * `DATABASE_URL`. There is no park branch yet, matching `planJobs`'s own
- * scope note -- `platform.jobs.enabled` going from true to false plans
- * nothing, so this method is never asked to stop or delete anything.
- *
- * #170 adds `sfu:livekit`, the platform's shared calls SFU. `sfu` is
- * optional: an existing host that constructs this executor for the zone step
- * alone keeps compiling, and a plan that includes an `sfu:livekit` step
- * without it configured refuses clearly rather than silently doing nothing.
- * #152: the step mints one LiveKit key per org with calls enabled rather
- * than one shared pair, so it also needs `declaredOrgStore.list()` -- the
- * same store this class already takes for `findOrgIdForZone`.
- *
- * #168 adds `coolify:app` keyed {@link PLATFORM_AUTH_KEY}, the platform's own
- * sign-in ({@link provisionPlatformAuth}), once a host passes
- * {@link PlatformAuthDeps}.
- *
- * #169 adds `coolify:app` keyed {@link PLATFORM_MAIL_KEY}, the platform's own
- * mail server ({@link provisionPlatformMail}), once a host passes
- * {@link PlatformMailDeps}.
- *
- * #174 adds `coolify:app` keyed {@link PLATFORM_INTEGRATIONS_KEY},
- * the integrations host ({@link provisionPlatformIntegrations}), once a host
- * passes {@link PlatformIntegrationsDeps}.
- *
- * #171 adds `coolify:app` keyed {@link PLATFORM_FILES_KEY}, the files host
- * ({@link provisionPlatformFiles}), once a host passes {@link PlatformFilesDeps}.
- *
- * #172 adds `coolify:app` keyed {@link PLATFORM_AI_KEY}, the platform's AI
- * host ({@link provisionPlatformAi}), once a host passes {@link PlatformAiDeps}.
- *
- * #478 adds `coolify:app` keyed {@link PLATFORM_EDGE_KEY}, the edge host
- * ({@link provisionPlatformEdge}), once a host passes {@link PlatformEdgeDeps}.
- *
- * #175 adds `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}, Archon itself
- * ({@link provisionPlatformArchon}), once a host passes
- * {@link PlatformArchonDeps}.
- *
- * #257 adds `coolify:backup:<service>`, a nightly R2 backup of each
- * platform database ({@link provisionPlatformBackup}), once a host passes
- * {@link PlatformBackupDeps}.
- */
 export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor {
     private readonly cloudflare;
     private readonly declaredOrgStore;
@@ -345,8 +290,14 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly heartbeats?;
     private readonly uptime?;
     private readonly accessProvider?;
+    private readonly oikosIngress?;
     constructor(cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'createZone'>, declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone' | 'list' | 'get'>, options?: FoundryPlatformStepExecutorOptions);
-    blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<{
+    private readonly platformPorts;
+    /** The port placed on the platform's destination, made once per port so a server is listed once. */
+    private onPlatform;
+    /** `deps` with its Coolify port placed on the platform destination, then limited by `profile`. */
+    private limitedOnPlatform;
+    blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<{
         auth?: string;
         authExecutorMissing?: boolean;
         authOtherInputsMissing?: string[];
@@ -359,6 +310,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         mail?: string;
         relay?: string;
         accessProvider?: string;
+        oikosIngress?: string;
         backupExecutorMissing?: boolean;
         hc?: string;
         heartbeatsExecutorMissing?: boolean;
@@ -374,6 +326,8 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         archonDeployRunning?: string;
         archonIdTokenUserinfo?: boolean;
         authSignInPolicy?: boolean;
+        archonOrg?: string;
+        archonOrgInvite?: string;
     }>;
     /**
      * foundry#542: why the uptime Worker cannot run yet, which optional secrets
@@ -390,7 +344,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
      * login-client token is no longer the sole live PAT on its ZITADEL machine
      * user.
      */
-    driftedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<PlatformDriftedSteps>;
+    driftedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<PlatformDriftedSteps>;
     /**
      * Gives the files runner a changed share-domain set and nothing else: its
      * Coolify `domains`, `FILES_PUBLIC_HOSTS` and one redeploy of the runner.
@@ -578,6 +532,9 @@ export interface AuthStackInput {
 export declare function provisionAuthStack(scope: StepScope, deps: PlatformAuthDeps, target: ServiceTarget, input: AuthStackInput): Promise<{
     resourceId?: string;
 }>;
+export declare const PLATFORM_MAIL_INTERNAL_NAME = "platform-mail-stalwart";
+/** Where the server the app was created on is recorded, so the MX record follows the app, not a later pick. */
+export declare const PLATFORM_MAIL_SERVER_SCOPE_KEY = "coolify_platform_mail_server";
 /**
  * The fixed description Stalwart's admin API key is minted under
  * (`StalwartClient.createApiKey`'s own signature returns only the secret,
@@ -653,7 +610,7 @@ export declare function defaultStalwartForInstance(input: {
  * own shape.
  */
 export interface PlatformMailDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'raw' | 'listStorages' | 'createPersistentStorage' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'raw' | 'listStorages' | 'createPersistentStorage' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'restart' | 'getDeployment'>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -706,6 +663,8 @@ export interface MailServerInput {
     hostname: string;
     /** The domain the server's admin account and default domain belong to. */
     apex: string;
+    /** The Cloudflare zone `hostname` goes in. Absent: `apex`. A company without a domain has mail domain `<slug>.oikos.host` in zone `oikos.host`. */
+    zone?: string;
     /** The MX name: the A record `mxRecord` publishes. The server announces `hostname`, not this. */
     mailHost: string;
     /** The Stalwart image tag. */
@@ -789,6 +748,20 @@ export interface MailServerInput {
 export declare function provisionMailServer(scope: StepScope, deps: PlatformMailDeps, target: ServiceTarget, input: MailServerInput): Promise<{
     resourceId?: string;
 }>;
+/**
+ * The shared oikos.host ingress step's ports: its Coolify calls, and the tunnel, DNS,
+ * rate limit and zone calls, which go through edge at its recorded address like every
+ * other platform step's.
+ */
+export interface PlatformOikosIngressDeps {
+    coolify: OikosIngressPorts['coolify'] & Pick<CoolifyPort, 'listServers'>;
+    dns: PlatformDnsFactory;
+    tunnels: PlatformTunnelsFactory;
+    ratelimits: (edgeUrl: string) => RateLimitPort | Promise<RateLimitPort>;
+    zones: (edgeUrl: string) => Pick<ZonePort, 'findZoneByApex'> | Promise<Pick<ZonePort, 'findZoneByApex'>>;
+    /** One outside call's limit in milliseconds; 60 s by default. */
+    callTimeoutMs?: number;
+}
 /**
  * #211: the broker cannot start without `ZITADEL_SERVICE_USER_TOKEN`/`_FILE`,
  * `LETTERMINT_API_TOKEN` and `AUTH_APPS`. `provisionPlatformAuth` already
@@ -843,8 +816,12 @@ export interface PlatformArchonDeps {
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'>;
-    /** {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client. */
-    zitadelForInstance?: (issuerUrl: string) => PlatformArchonDeps['zitadel'];
+    /**
+     * {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client:
+     * the owner company's own ZITADEL, by its issuer and the held-key reference of
+     * its instance bearer. Required to apply Archon; `zitadel` is never used for it.
+     */
+    zitadelForInstance?: (issuerUrl: string, bearerRef?: string) => PlatformArchonDeps['zitadel'];
     /**
      * Who the Cloudflare Access app in front of Archon lets through. Host
      * config, not `DeclaredPlatform`: the platform record edge services, not
@@ -912,6 +889,21 @@ export interface PlatformArchonRuntime {
  * org (`foundry:<orgId>`), with the platform's step key in the org id's place.
  */
 export declare const PLATFORM_ARCHON_ACCESS_APP_NAME = "foundry:platform:archon";
+/**
+ * Archon paths a machine calls and Archon authenticates itself (its `proxy.ts`:
+ * `PUBLIC_EXACT` and `ORG_CHANGES_PATH_RE`). Each gets its own Access app with
+ * one bypass policy, because the hostname app would otherwise ask a machine for
+ * an emailed code. `/api/uptime/targets` and `/api/uptime/results` are left out
+ * on purpose: they pass the hostname app through the uptime service-token
+ * policy, and a bypass would make that token meaningless. `*` is one path
+ * segment (the organisation id).
+ */
+export declare const PLATFORM_ARCHON_PUBLIC_PATHS: ReadonlyArray<{
+    name: string;
+    path: string;
+}>;
+/** The scope key one bypass app's id is recorded under. */
+export declare const archonPublicAccessScopeKey: (name: string) => string;
 /** Archon's OIDC client id: public, not a secret, so a plain scope id. */
 export declare const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = "zitadel_platform_archon_client_id";
 /**
@@ -948,6 +940,24 @@ type BrokerAppEntry = Record<string, unknown> & {
  * `TypeError` instead of this named error.
  */
 export declare function validateBrokerAppEntry(entry: unknown, brokerAppId: string, index: number): BrokerAppEntry;
+/**
+ * Who Archon's Access app lets through. Each person is let in on the personal
+ * address their invite was mailed to, never on a work address: the work
+ * mailbox is on the platform's own mail, which the platform's own sign-in
+ * reaches. So the owner company's first owner's work addresses leave the host's
+ * list and their personal address joins it; every other address stays as the
+ * host gave it. Case-insensitive, de-duplicated, order kept.
+ */
+export declare function archonAccessEmails(hostEmails: readonly string[], ownerCompany: DeclaredOrg | null): string[];
+/**
+ * The names of the broker entries that sign in Archon's organisation without
+ * being Archon's own. There must be none: a key of another app would then
+ * reach Archon's people (passkeys, password reset, deactivation).
+ */
+export declare function archonOrgConflicts(entries: ReadonlyArray<{
+    name: string;
+    organizationId: string;
+}>, archonOrgId: string | undefined): string[];
 /**
  * #172/#201: mints Archon's own AI management key -- the plain bearer key
  * (`wtfk_...`) `AiOrganisationPort` (`executor.ts`) authenticates with,
@@ -1018,7 +1028,11 @@ export declare class AiManagementKeyUntrustedError extends Error {
 }
 /** #172: everything {@link provisionPlatformAi} needs beyond {@link PlatformStepExecutionContext}. */
 export interface PlatformAiDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'raw'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'raw'>;
+    /** F4.dns: the DNS record of the AI hostname, through edge (see {@link PlatformDnsFactory}). */
+    dns: PlatformDnsFactory;
+    /** F4.tunnels: the AI hostname's tunnel, through edge (see {@link PlatformTunnelsFactory}). */
+    tunnels: PlatformTunnelsFactory;
     deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
     /**
      * Reads back a secret this step delivered on an earlier apply -- needed
@@ -1381,13 +1395,21 @@ export interface PlatformAccessProviderDeps {
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'listApps' | 'deleteApp'> & Required<Pick<ZitadelPort, 'createOidcAppWithSecret'>>;
     /** {@link PlatformArchonDeps.zitadelForInstance}: the ZITADEL client for the sign-in at `issuerUrl`. */
-    zitadelForInstance?: (issuerUrl: string) => PlatformAccessProviderDeps['zitadel'];
+    zitadelForInstance?: (issuerUrl: string, bearerRef?: string) => PlatformAccessProviderDeps['zitadel'];
     /** Sleep and delivery tries for the one call that carries the secret; real ones by default. */
     runtime?: {
         sleep?: (ms: number) => Promise<void>;
         deliverAttempts?: number;
     };
 }
+/**
+ * The only paths the AI host's public route serves; everything else answers 404 at the tunnel. A company entry's key
+ * holds `ai.runs:create` and `ai.offerings:invoke` (`AI_ENTRY_PERMISSIONS`), and `@wtfalch/ai`'s client reaches them
+ * through `POST /v1/runs` (also `?wait=`), `POST /v1/runs/batch`, `GET /v1/runs`, `GET /v1/runs/:id` and
+ * `GET /v1/offerings`. The management routes (`/v1/organisations`, `/v1/keys`, `/v1/budgets`, `/v1/webhooks`,
+ * `/v1/connections`, `/v1/platform/keys`, ...) and `/api/health` are not on the internet.
+ */
+export declare const AI_ENTRY_PATH_PATTERN = "^/v1/(runs(/|$)|offerings$)";
 export interface PlatformHcRuntime {
     fetch?: typeof fetch;
     sleep?: (ms: number) => Promise<void>;
@@ -1467,6 +1489,8 @@ export declare const INTEGRATIONS_MANAGEMENT_ISSUER = "foundry";
  * its signed request; fixed, since there is one key until rotation is built.
  */
 export declare const INTEGRATIONS_MANAGEMENT_KEY_ID = "foundry-1";
+/** The uuid `provisionPlatformBackup` records once {@link PLATFORM_BACKUP_S3_STORAGE_NAME} is registered on Coolify, so a later apply never re-registers it. */
+export declare const PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY = "coolify_platform_backup_s3_storage";
 /**
  * #257: everything {@link provisionPlatformBackup} needs beyond
  * {@link PlatformStepExecutionContext} -- the narrow Coolify slice for the
@@ -1500,6 +1524,27 @@ export interface PlatformBackupDeps {
     /** A cron string or one of Coolify's names (`daily`, `weekly`, ...). Default `'daily'`. */
     frequency?: string;
 }
+/**
+ * F6: one nightly schedule of one database to a registered S3 storage, the
+ * body `provisionPlatformBackup` had and every company database now shares.
+ * An existing enabled, `save_s3` schedule is reused, never doubled: the lookup
+ * runs before the create, so a run that created a schedule and died before
+ * the caller recorded its uuid finds it again on the next apply. The
+ * `PATCH` names the database to dump, because `createDatabaseBackup` takes no
+ * database name; it also repairs an existing schedule that dumps the wrong
+ * one. Returns the schedule's uuid.
+ */
+export declare function provisionDatabaseBackup(coolify: Pick<CoolifyPort, 'listDatabaseBackups' | 'createDatabaseBackup' | 'raw'>, input: {
+    databaseUuid: string;
+    /** Names the database in an error, e.g. `platform jobs`. Never a URL or a secret. */
+    label: string;
+    storageUuid: string;
+    frequency?: string;
+    /** The database to dump. Absent: the resource's first database. */
+    databaseName?: string;
+}): Promise<{
+    uuid: string;
+}>;
 /** One check as self-hosted Healthchecks' own Management API reports it. */
 export interface HeartbeatCheck {
     id: string;