@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/plan/health-targets.d.ts

@@ -71,9 +71,7 @@ export interface HealthTarget {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export declare function healthTargets(org: DeclaredOrg, options?: {
-    platform?: DeclaredPlatform | null;
-}): HealthTarget[];
+export declare function healthTargets(org: DeclaredOrg): HealthTarget[];
 /**
  * The seven platform services #541 names (`platform:auth`, `platform:archon`,
  * `platform:mail`, `platform:ai`, `platform:files`, `platform:integrations`,

package/dist/plan/health-targets.js

@@ -1,10 +1,9 @@
 import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
-import { isPlatformOwnOrg } from './diff.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
 import { isBehindGate } from './gates.js';
-import { entryHostnames } from './hostnames.js';
+import { entryHostnames, siteHostnameFor } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
 function okExpect() {
     return { status: 200 };
@@ -25,12 +24,8 @@ const STALWART_READY_PATH = '/healthz/ready';
 const CHAT_SERVICE_HEALTH_PATH = '/_chat/health';
 const CALLS_HEALTH_PATH = '/healthz';
 /** Boule, Agora and the company's own login host: every org gets these, with no flag to check (the "Why" this issue opens with). */
-function alwaysOnTargets(org, platform) {
-    // The platform's own org signs in on the shared instance host, not its own
-    // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
-    const loginHost = platform && isPlatformOwnOrg(org, platform.ownerOrgId)
-        ? platform.auth.hostname
-        : loginHostnameFor(org);
+function alwaysOnTargets(org) {
+    const loginHost = loginHostnameFor(org);
     return [
         {
             service: 'boule',
@@ -62,14 +57,10 @@ function alwaysOnTargets(org, platform) {
     ];
 }
 /**
- * The shared sign-in broker (`broker-entries.ts`), when this company depends
- * on it: any hosting entry declaring `uses.auth` signs in through it. The
- * broker is the platform's one app, not a per-company address `org` alone
- * can build -- its real, reachable URL is `platformHealthTargets`'s own
- * `'auth-broker'` target, under `platform.auth.hostname`. This target still
- * belongs in a company's own list (#541: "Include ... the broker when the
- * company has them") so a status page scoped to one company shows every
- * service that company's sign-in actually depends on, even a shared one.
+ * The company's own sign-in broker (`broker-entries.ts`), when it depends on
+ * it: any hosting entry declaring `uses.auth` signs in through it. Its
+ * `/healthy` is not routed to the outside, so no URL is built here (#541:
+ * "Include ... the broker when the company has them").
  */
 function brokerTarget(org) {
     const usesBroker = org.hosting.entries.some((entry) => Boolean(entry.uses?.auth));
@@ -82,14 +73,13 @@ function brokerTarget(org) {
         depth: 'shallow',
         restartSafe: false,
         behindAccess: false,
-        reason: "the sign-in broker is the platform's one shared app (broker-entries.ts), not a per-company address this function can build from `org` alone -- see platformHealthTargets's 'auth-broker' target",
+        reason: "the company's own sign-in broker answers on its internal network only (broker-entries.ts): its /healthy is not routed to the outside, so there is no URL to probe",
     };
 }
 /**
- * Mail, when this company's mail is not off. Every org's mail is served by
- * the one shared Stalwart instance (`executor.ts`'s `mailOrgFor`), never a
- * per-org app, so there is no per-company hostname to build here either --
- * `platformHealthTargets`'s own `'mail'` target is the real, reachable one.
+ * Mail, when this company's mail is not off. The company runs its own
+ * Stalwart (`own-mail`), reached only by the shared relay on the internal
+ * network, so there is no public URL to build here.
  */
 function mailTarget(org) {
     if (org.mail.mode === 'off')
@@ -101,7 +91,7 @@ function mailTarget(org) {
         depth: 'deep',
         restartSafe: false,
         behindAccess: false,
-        reason: "mail is the platform's one shared Stalwart instance, not a per-company address this function can build from `org` alone -- see platformHealthTargets's 'mail' target",
+        reason: "the company's own Stalwart is reached by the shared relay on the internal network only, so it has no public address to probe",
     };
 }
 /**
@@ -200,11 +190,11 @@ function appTargets(org) {
     if (org.hosting.enabled && appEntry(org.hosting)) {
         return org.hosting.entries.map((entry) => hostingEntryTarget(org, entry));
     }
-    if (org.site.enabled && org.domain) {
+    if (org.site.enabled) {
         return [
             {
                 service: 'site',
-                url: `https://${org.domain}${DEFAULT_API_HEALTH_PATH}`,
+                url: `https://${siteHostnameFor(org)}${DEFAULT_API_HEALTH_PATH}`,
                 expect: okExpect(),
                 depth: 'deep',
                 restartSafe: true,
@@ -228,8 +218,8 @@ function appTargets(org) {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export function healthTargets(org, options = {}) {
-    const targets = alwaysOnTargets(org, options.platform ?? null);
+export function healthTargets(org) {
+    const targets = alwaysOnTargets(org);
     const broker = brokerTarget(org);
     if (broker)
         targets.push(broker);
@@ -308,8 +298,10 @@ function internalOnlyTarget(service, reason) {
  * one anyway.
  */
 export function platformHealthTargets(platform) {
+    // The platform's own sign-in, mail and files are off (each company runs its own), so a target
+    // for a service that is not enabled would point at a host that does not exist.
     return [
-        ...authTargets(platform),
+        ...(platform.auth.enabled ? authTargets(platform) : []),
         {
             service: 'archon',
             // `provisionPlatformArchon` always puts a Cloudflare Access app in front
@@ -322,16 +314,24 @@ export function platformHealthTargets(platform) {
             restartSafe: false,
             behindAccess: true,
         },
-        {
-            service: 'mail',
-            url: `https://${platform.mail.hostname}${STALWART_READY_PATH}`,
-            expect: okExpect(),
-            depth: 'deep',
-            restartSafe: false,
-            behindAccess: false,
-        },
+        ...(platform.mail.enabled
+            ? [
+                {
+                    service: 'mail',
+                    url: `https://${platform.mail.hostname}${STALWART_READY_PATH}`,
+                    expect: okExpect(),
+                    depth: 'deep',
+                    restartSafe: false,
+                    behindAccess: false,
+                },
+            ]
+            : []),
         internalOnlyTarget('ai', "platform:ai's runner is created with no Coolify domains, tunnel, DNS record or Access app (platform-providers.ts) -- nothing public to probe yet"),
-        internalOnlyTarget('files', "platform:files' runner is created with no domains either, the same as platform:auth's apps (platform-providers.ts) -- nothing public to probe yet"),
+        ...(platform.files.enabled
+            ? [
+                internalOnlyTarget('files', "platform:files' runner is created with no domains either, the same as platform:auth's apps (platform-providers.ts) -- nothing public to probe yet"),
+            ]
+            : []),
         {
             service: 'integrations',
             url: null,

package/dist/plan/held-key-refs.d.ts

@@ -6,5 +6,10 @@
 export declare const JOBS_ADMIN_TOKEN_REF = "jobs:scheduler:adminToken";
 /** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
 export declare const PLATFORM_AI_MANAGEMENT_KEY_REF = "ai:platform:managementKey";
+/**
+ * The install's edge label token (`proxy-labels.ts` `EDGE_LABEL`): minted once, held, and written into the
+ * labels of every container foundry routes, so Traefik can be told to route only those.
+ */
+export declare const PROXY_LABEL_TOKEN_REF = "proxy:labels:token";
 /** The ref the management private key (PKCS#8 PEM) is delivered under. */
 export declare const FILES_MANAGEMENT_KEY_REF = "files:platform:managementKey";

package/dist/plan/held-key-refs.js

@@ -6,5 +6,10 @@
 export const JOBS_ADMIN_TOKEN_REF = 'jobs:scheduler:adminToken';
 /** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
 export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
+/**
+ * The install's edge label token (`proxy-labels.ts` `EDGE_LABEL`): minted once, held, and written into the
+ * labels of every container foundry routes, so Traefik can be told to route only those.
+ */
+export const PROXY_LABEL_TOKEN_REF = 'proxy:labels:token';
 /** The ref the management private key (PKCS#8 PEM) is delivered under. */
 export const FILES_MANAGEMENT_KEY_REF = 'files:platform:managementKey';

package/dist/plan/hostnames.d.ts

@@ -38,6 +38,16 @@ export declare function tunnelDomainList(names: readonly string[]): string[];
 export declare function coolifyTunnelDomains(names: readonly string[]): string;
 /** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
 export declare function legacyAppHostname(org: DeclaredOrg): string;
+/**
+ * The public address of the org's cms site: its domain, or `<slug>.oikos.host`
+ * for a company without one (served by the shared `*.oikos.host` wildcard).
+ */
+export declare function siteHostnameFor(org: DeclaredOrg): string;
+/**
+ * The cms studio's address: `cms.<domain>`, or `<slug>-cms.oikos.host` for a
+ * company without a domain (one label, so the free wildcard certificate covers it).
+ */
+export declare function cmsStudioHostnameFor(org: DeclaredOrg): string;
 /**
  * `share.<domain>` when hosting is on and an entry declares
  * `uses.files.shareHost`, else `null`. The files service answers public

package/dist/plan/hostnames.js

@@ -63,6 +63,20 @@ export function coolifyTunnelDomains(names) {
 export function legacyAppHostname(org) {
     return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
 }
+/**
+ * The public address of the org's cms site: its domain, or `<slug>.oikos.host`
+ * for a company without one (served by the shared `*.oikos.host` wildcard).
+ */
+export function siteHostnameFor(org) {
+    return org.site.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
+}
+/**
+ * The cms studio's address: `cms.<domain>`, or `<slug>-cms.oikos.host` for a
+ * company without a domain (one label, so the free wildcard certificate covers it).
+ */
+export function cmsStudioHostnameFor(org) {
+    return org.site.usesDomain && org.domain ? `cms.${org.domain}` : `${org.slug}-cms.oikos.host`;
+}
 /**
  * `share.<domain>` when hosting is on and an entry declares
  * `uses.files.shareHost`, else `null`. The files service answers public

package/dist/plan/index.d.ts

@@ -23,6 +23,8 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
+export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
+export type { BackupGatePorts, MoveGatePorts } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
 export type { FilesHostInput, JobsHostDeps, JobsHostInput, MailServerInput, PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
@@ -43,6 +45,8 @@ export type { BrokerPort } from './broker-entries.js';
 export { PlatformBrokerPort } from './broker-entries.js';
 export type { LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './login-host.js';
 export { loginHostnameFor } from './login-host.js';
+export { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
+export type { OwnHostnames } from './own-hostnames.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './mail-identity.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export type { MailAllowlistApp } from './mail-identity-allowlist.js';
@@ -71,3 +75,4 @@ export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';
 export type { OrgAppVersionRef, OrgAppVersionStatus, WtfalchPackageDrift, PlatformVersionStatus, ReadPlatformVersionStatusOptions, StatusCoolifyPort, StatusGithubPort, GhExec as StatusGhExec, } from './version-status.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './version-status.js';
+export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './destinations.js';

package/dist/plan/index.js

@@ -10,6 +10,7 @@ export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICE
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
@@ -22,6 +23,7 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';
 export { loginHostnameFor } from './login-host.js';
+export { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
@@ -36,3 +38,4 @@ export { createEdgeTunnels } from './edge-tunnels.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';
 export { readPlatformVersionStatus, wtfalchVersionsFromPnpmLockfile, providersStatusCoolifyPort, ghCliStatusGithubPort, } from './version-status.js';
+export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './destinations.js';

package/dist/plan/live.d.ts

@@ -121,6 +121,12 @@ export interface PlatformCloudflareReader {
 /** #173: the platform's own Coolify-hosted jobs scheduler (`platform-diff.ts`'s `planJobs`). */
 export interface PlatformCoolifyReader {
     listResources(): Promise<LiveResource[]>;
+    /** Optional: with it the platform plan reads each recorded app's running commit and notes a build that differs (`build-record.ts`). */
+    listApplicationDeployments?(uuid: string, take?: number): Promise<Array<{
+        deployment_uuid: string;
+        commit?: string;
+        status: string;
+    }>>;
 }
 export interface PlatformLiveReaders {
     cloudflare: PlatformCloudflareReader;

package/dist/plan/live.js

@@ -1,4 +1,5 @@
 import { ownsServices } from '../org.js';
+import { ownHostnames } from './own-hostnames.js';
 import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
 /** Every live resource foundry can see for `orgId`, across all six systems. */
 export async function readLiveResources(orgId, readers, org, orgRecordedIds) {
@@ -16,11 +17,11 @@ export async function readLiveResources(orgId, readers, org, orgRecordedIds) {
 }
 /** An own org's ZITADEL is its own instance: nothing is read until it is applied, and never from the shared one. */
 async function readOwnZitadel(orgId, readers, org, recordedIds) {
-    if (!readers.zitadelFor || !org.domain || !recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY])
+    if (!readers.zitadelFor || !recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY])
         return [];
     const refs = orgTarget(org).refs;
     return readers
-        .zitadelFor({ issuerUrl: `https://auth.${org.domain}`, bearerRef: refs.instanceBearer })
+        .zitadelFor({ issuerUrl: ownHostnames(org).issuerUrl, bearerRef: refs.instanceBearer })
         .listResources(orgId);
 }
 /** Every live resource foundry can see for the platform, across every wired reader (#167, #173). */

package/dist/plan/locked-hostnames.d.ts

@@ -6,6 +6,7 @@ export declare const OWN_SERVICE_LABELS: readonly ["auth", "mail", "files", "sfu
  * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
  * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
  * `sfu.` for an org that runs its own services, and every platform service
- * hostname that falls under the domain. Empty for an org with no domain.
+ * hostname that falls under the domain. An own org with no domain holds its
+ * oikos.host service names; any other org with no domain holds none.
  */
 export declare function lockedHostnames(org: DeclaredOrg, platformHostnames: readonly string[]): Set<string>;

package/dist/plan/locked-hostnames.js

@@ -1,7 +1,9 @@
 import { ownsServices } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
+import { cmsStudioHostnameFor, siteHostnameFor } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
+import { ownHostnames } from './own-hostnames.js';
 /** The labels an own org's services answer on, so no hosting entry may take them. */
 export const OWN_SERVICE_LABELS = ['auth', 'mail', 'files', 'sfu'];
 /**
@@ -9,17 +11,28 @@ export const OWN_SERVICE_LABELS = ['auth', 'mail', 'files', 'sfu'];
  * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
  * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
  * `sfu.` for an org that runs its own services, and every platform service
- * hostname that falls under the domain. Empty for an org with no domain.
+ * hostname that falls under the domain. An own org with no domain holds its
+ * oikos.host service names; any other org with no domain holds none.
  */
 export function lockedHostnames(org, platformHostnames) {
     const { domain } = org;
     const locked = new Set();
-    if (!domain)
+    if (!domain) {
+        if (ownsServices(org)) {
+            const own = ownHostnames(org);
+            for (const hostname of [own.auth, own.mail, own.files, own.sfu])
+                locked.add(hostname);
+        }
+        if (org.site.enabled) {
+            locked.add(siteHostnameFor(org));
+            locked.add(cmsStudioHostnameFor(org));
+        }
         return locked;
+    }
     locked.add(agoraHostnameFor(org));
     locked.add(bouleHostnameFor(org));
     if (org.site.enabled)
-        locked.add(`cms.${domain}`);
+        locked.add(cmsStudioHostnameFor(org));
     if (org.calls.enabled && org.calls.usesDomain)
         locked.add(`calls.${domain}`);
     if (org.issuer.usesDomain)

package/dist/plan/login-host.d.ts

@@ -22,33 +22,20 @@ import { type DeclaredOrg } from '../org.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: the platform's own org is not handled here: it signs in on the shared
- * ZITADEL instance's own host (`platformAuthHostname`), whatever
- * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
- * that host itself. That host must never get a trusted
- * domain or a login binding of its own:
- * Archon's login-host write throws on a duplicate host, and `auth`'s own
- * `company-host.ts` denies every request through one, the shared one
- * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
+ * Every company, the platform owner included, signs in on its own sign-in
+ * server at this host (`ownHostnames(org).auth` is this function): a domain is
+ * never required.
  */
-export declare function loginHostnameFor(org: DeclaredOrg): string;
-/**
- * The login host the login-host step plans for an org: the shared instance's
- * own host when `sharedHost` is given (the platform's own org), the company's
- * own host otherwise. `planLoginHost` and {@link agoraIssuerHostFor} both
- * read it here, so Agora's issuer and the login host cannot disagree.
- */
-export declare function orgLoginHost(org: DeclaredOrg, sharedHost: string | null): string;
+export declare function loginHostnameFor(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'issuer'>): string;
 /**
  * The login host Agora may take as its issuer, and whether the org's pair is
  * one Agora refuses. Agora accepts an issuer host on its own address's
  * registrable domain, or `<slug>-auth.oikos.host` for `<slug>-agora.oikos.host`.
- * `host` is null for the platform's own org (it keeps the platform issuer) and
- * for a domain with `issuer.usesDomain` off, where the login host
+ * `host` is null for a domain with `issuer.usesDomain` off, where the login host
  * `<slug>-auth.oikos.host` and the Agora address `agora.<domain>` are
  * refused together (`mismatch`).
  */
-export declare function agoraIssuerHostFor(org: DeclaredOrg, isPlatformOrg: boolean): {
+export declare function agoraIssuerHostFor(org: DeclaredOrg): {
     host: string | null;
     mismatch: boolean;
 };
@@ -77,6 +64,8 @@ export declare function discoveryNamesHost(host: string, answer: {
  * leaves.
  */
 export declare function readLoginHostDiscovery(port: LoginHostDiscoveryPort | undefined, host: string, timeoutMs?: number): Promise<boolean>;
+/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
+export declare const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = "own_auth_applied_hostname";
 /**
  * True once the org's own sign-in step has applied (`coolify:own-auth:<org.id>`
  * in its recorded ids). An own org has no login-host step: its issuer host is
@@ -175,4 +164,4 @@ export declare function pendingRemovalState(hosts: readonly string[]): string;
  * the shared instance's and is routed by the platform auth tunnel. Otherwise
  * `null`, and always `null` for an own org. The tier 1 host rides the shared `*.oikos.host` tunnel.
  */
-export declare function companyLoginTunnelHost(org: DeclaredOrg, isPlatformOrg: boolean): string | null;
+export declare function companyLoginTunnelHost(org: DeclaredOrg): string | null;

package/dist/plan/login-host.js

@@ -24,14 +24,9 @@ import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: the platform's own org is not handled here: it signs in on the shared
- * ZITADEL instance's own host (`platformAuthHostname`), whatever
- * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
- * that host itself. That host must never get a trusted
- * domain or a login binding of its own:
- * Archon's login-host write throws on a duplicate host, and `auth`'s own
- * `company-host.ts` denies every request through one, the shared one
- * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
+ * Every company, the platform owner included, signs in on its own sign-in
+ * server at this host (`ownHostnames(org).auth` is this function): a domain is
+ * never required.
  */
 export function loginHostnameFor(org) {
     // `issuer.usesDomain` is the issuer's opt-in into the org's domain
@@ -42,27 +37,15 @@ export function loginHostnameFor(org) {
     }
     return `${org.slug}-auth.oikos.host`;
 }
-/**
- * The login host the login-host step plans for an org: the shared instance's
- * own host when `sharedHost` is given (the platform's own org), the company's
- * own host otherwise. `planLoginHost` and {@link agoraIssuerHostFor} both
- * read it here, so Agora's issuer and the login host cannot disagree.
- */
-export function orgLoginHost(org, sharedHost) {
-    return sharedHost ?? loginHostnameFor(org);
-}
 /**
  * The login host Agora may take as its issuer, and whether the org's pair is
  * one Agora refuses. Agora accepts an issuer host on its own address's
  * registrable domain, or `<slug>-auth.oikos.host` for `<slug>-agora.oikos.host`.
- * `host` is null for the platform's own org (it keeps the platform issuer) and
- * for a domain with `issuer.usesDomain` off, where the login host
+ * `host` is null for a domain with `issuer.usesDomain` off, where the login host
  * `<slug>-auth.oikos.host` and the Agora address `agora.<domain>` are
  * refused together (`mismatch`).
  */
-export function agoraIssuerHostFor(org, isPlatformOrg) {
-    if (isPlatformOrg)
-        return { host: null, mismatch: false };
+export function agoraIssuerHostFor(org) {
     if (org.domain && !org.issuer.usesDomain)
         return { host: null, mismatch: true };
     return { host: loginHostnameFor(org), mismatch: false };
@@ -110,6 +93,8 @@ export async function readLoginHostDiscovery(port, host, timeoutMs = LOGIN_HOST_
         clearTimeout(timer);
     }
 }
+/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
+export const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = 'own_auth_applied_hostname';
 /**
  * True once the org's own sign-in step has applied (`coolify:own-auth:<org.id>`
  * in its recorded ids). An own org has no login-host step: its issuer host is
@@ -211,9 +196,9 @@ export function pendingRemovalState(hosts) {
  * the shared instance's and is routed by the platform auth tunnel. Otherwise
  * `null`, and always `null` for an own org. The tier 1 host rides the shared `*.oikos.host` tunnel.
  */
-export function companyLoginTunnelHost(org, isPlatformOrg) {
-    // An own org's sign-in stack publishes `auth.<domain>` through its own tunnel.
+export function companyLoginTunnelHost(org) {
+    // An own org's sign-in stack publishes its host through its own tunnel.
     if (ownsServices(org))
         return null;
-    return org.domain && org.issuer.usesDomain && !isPlatformOrg ? loginHostnameFor(org) : null;
+    return org.domain && org.issuer.usesDomain ? loginHostnameFor(org) : null;
 }