@wtfalch/foundry 0.34.0 → 0.35.2

package/dist/plan/oikos-ingress.d.ts

@@ -0,0 +1,111 @@
+import type { DeclaredPlatform } from '../platform.js';
+import type { DraftStep } from './diff.js';
+import type { DnsPort } from './edge-dns.js';
+import type { RateLimitPort, RateLimitRuleInput } from './edge-ratelimits.js';
+import type { TunnelIngress, TunnelPort } from './edge-tunnels.js';
+import type { ZonePort } from './edge-zones.js';
+import type { CoolifyPort } from './executor.js';
+import type { PlatformStepExecutionContext } from './plan-apply.js';
+/**
+ * The shared `oikos.host` ingress: one Cloudflare tunnel, its connector app on
+ * Coolify, one proxied wildcard record `*.oikos.host` and one zone-wide rate
+ * limiting rule for the sign-in paths. Every company without a domain of its
+ * own is reached through it, so a fresh platform needs it before such a company
+ * can be planned. It is the platform step that `scripts/shared-ingress.mjs`
+ * used to be run by hand for. The script keeps its own copy of the rate limit
+ * constants (it runs outside this package) and a test here keeps them equal.
+ *
+ * The three names below are found by name, and the tunnel's whole ingress is
+ * replaced. They differ from the script's (`oikos-shared`) on purpose: a hand-made
+ * project or tunnel of that name may carry other traffic, and this step must only
+ * ever find its own.
+ *
+ * One `coolify:app` step keyed {@link PLATFORM_OIKOS_INGRESS_KEY}. Its applied
+ * id (the connector app) is recorded by the runner only when the whole step
+ * returns, so a run that fails halfway is planned again and finds what it made
+ * by name.
+ */
+export declare const PLATFORM_OIKOS_INGRESS_KEY = "platform:oikos-ingress";
+export declare const OIKOS_INGRESS_ZONE = "oikos.host";
+export declare const OIKOS_INGRESS_TUNNEL_NAME = "platform-oikos-ingress";
+export declare const OIKOS_INGRESS_WILDCARD = "*.oikos.host";
+export declare const OIKOS_INGRESS_CONNECTOR_APP_NAME = "platform-oikos-ingress-cloudflared";
+export declare const OIKOS_INGRESS_PROJECT = "platform-oikos-ingress";
+export declare const OIKOS_INGRESS_ENVIRONMENT = "production";
+/** Bookkeeping of what the last run finished; none of these is the applied marker. */
+export declare const OIKOS_INGRESS_PROJECT_SCOPE_KEY = "oikos_ingress_project";
+export declare const OIKOS_INGRESS_TUNNEL_SCOPE_KEY = "oikos_ingress_tunnel";
+export declare const OIKOS_INGRESS_CONNECTOR_APP_SCOPE_KEY = "oikos_ingress_connector_app";
+export declare const OIKOS_INGRESS_DNS_SCOPE_KEY = "oikos_ingress_dns";
+export declare const OIKOS_INGRESS_RATELIMIT_SCOPE_KEY = "oikos_ingress_ratelimit";
+/** True once the step has finished: the readiness a company without a domain waits for. */
+export declare function oikosIngressApplied(recordedIds: Readonly<Record<string, string>>): boolean;
+/** Fixed texts. None carries a provider's error. */
+export declare const OIKOS_INGRESS_BLOCKED: {
+    readonly edgeNotApplied: "the shared oikos.host ingress is blocked, not planned: every DNS record and tunnel is written through edge, and edge is not applied yet";
+    readonly zoneMissing: "the shared oikos.host ingress is blocked, not planned: the oikos.host zone is not on the Cloudflare account the platform's edge reaches; add the zone to that account";
+    readonly zoneUnchecked: "the shared oikos.host ingress is blocked, not planned: the oikos.host zone could not be looked up through edge just now; apply again";
+    readonly executorMissing: "the shared oikos.host ingress is blocked, not planned: the host built the platform executor without its oikos ingress dependencies";
+};
+/**
+ * The step, or the reason it cannot be planned. Nothing when the platform has
+ * no edge (it could not write a record) or the step is already applied.
+ * `edgeApplied` is whether edge has recorded its address.
+ */
+export declare function planOikosIngress(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, input: {
+    edgeApplied: boolean;
+    executorBlocked?: string;
+}): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+/** The tunnel's ingress: the wildcard to Coolify's proxy, then the mandatory catch-all. */
+export declare function oikosIngressTunnelIngress(): TunnelIngress[];
+/** What the wildcard record needs: nothing, a create, or an update. */
+export declare function planWildcardRecord(live: {
+    content: string;
+    proxied?: boolean;
+} | undefined, tunnelId: string): 'exists' | 'create' | 'update';
+export declare const OIKOS_INGRESS_RATE_LIMIT_DESCRIPTION = "foundry: rate limit sign-in paths (oikos.host, shared)";
+/** The Free plan allows one rule per zone, with only "Path" in the expression, a 10 second period and IP counting. */
+export declare const OIKOS_INGRESS_RATE_LIMIT_PERIOD_SECONDS = 10;
+export declare const OIKOS_INGRESS_RATE_LIMIT_REQUESTS = 10;
+export declare const OIKOS_INGRESS_SIGN_IN_EXPRESSION = "starts_with(http.request.uri.path, \"/auth/\")";
+export declare function oikosIngressRateLimitRule(): RateLimitRuleInput;
+/** Ours is there, nothing is there, or a rule that is not ours holds the zone's one Free-plan slot. */
+export declare function planOikosRateLimit(rules: ReadonlyArray<{
+    id: string;
+    description: string | null;
+}>): {
+    status: 'exists';
+    ruleId: string;
+} | {
+    status: 'create' | 'conflict';
+    ruleId: null;
+};
+export interface OikosIngressPorts {
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
+    tunnels: Pick<TunnelPort, 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken'>;
+    dns: Pick<DnsPort, 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord'>;
+    ratelimits: RateLimitPort;
+    zones: Pick<ZonePort, 'findZoneByApex'>;
+    resolveServer: () => Promise<{
+        uuid: string;
+    }>;
+    /** One outside call's limit in milliseconds; 60 s by default. The connector step gets five times it. */
+    callTimeoutMs?: number;
+}
+/**
+ * Why the step cannot be planned for want of its zone, or `null` when the zone
+ * is on the account edge reaches. The texts are fixed; a lookup error is never carried.
+ */
+export declare function oikosIngressZoneBlocked(zones: Pick<ZonePort, 'findZoneByApex'>, callTimeoutMs?: number): Promise<string | null>;
+/**
+ * Makes the ingress, in this order: tunnel, its ingress, the connector app, the
+ * wildcard record, the rate limit rule. Each is found by name or content before
+ * it is made, so a second run makes nothing twice. Returns the connector app id,
+ * which the runner records as the step's applied marker only on success.
+ */
+export declare function provisionOikosIngress(context: Pick<PlatformStepExecutionContext, 'recordedIds' | 'recordScopeId' | 'persist'>, ports: OikosIngressPorts): Promise<{
+    resourceId: string;
+}>;

package/dist/plan/oikos-ingress.js

@@ -0,0 +1,231 @@
+import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { COOLIFY_PROXY_ORIGIN } from './executor.js';
+/**
+ * The shared `oikos.host` ingress: one Cloudflare tunnel, its connector app on
+ * Coolify, one proxied wildcard record `*.oikos.host` and one zone-wide rate
+ * limiting rule for the sign-in paths. Every company without a domain of its
+ * own is reached through it, so a fresh platform needs it before such a company
+ * can be planned. It is the platform step that `scripts/shared-ingress.mjs`
+ * used to be run by hand for. The script keeps its own copy of the rate limit
+ * constants (it runs outside this package) and a test here keeps them equal.
+ *
+ * The three names below are found by name, and the tunnel's whole ingress is
+ * replaced. They differ from the script's (`oikos-shared`) on purpose: a hand-made
+ * project or tunnel of that name may carry other traffic, and this step must only
+ * ever find its own.
+ *
+ * One `coolify:app` step keyed {@link PLATFORM_OIKOS_INGRESS_KEY}. Its applied
+ * id (the connector app) is recorded by the runner only when the whole step
+ * returns, so a run that fails halfway is planned again and finds what it made
+ * by name.
+ */
+export const PLATFORM_OIKOS_INGRESS_KEY = 'platform:oikos-ingress';
+export const OIKOS_INGRESS_ZONE = 'oikos.host';
+export const OIKOS_INGRESS_TUNNEL_NAME = 'platform-oikos-ingress';
+export const OIKOS_INGRESS_WILDCARD = `*.${OIKOS_INGRESS_ZONE}`;
+export const OIKOS_INGRESS_CONNECTOR_APP_NAME = 'platform-oikos-ingress-cloudflared';
+export const OIKOS_INGRESS_PROJECT = 'platform-oikos-ingress';
+export const OIKOS_INGRESS_ENVIRONMENT = 'production';
+/** Bookkeeping of what the last run finished; none of these is the applied marker. */
+export const OIKOS_INGRESS_PROJECT_SCOPE_KEY = 'oikos_ingress_project';
+export const OIKOS_INGRESS_TUNNEL_SCOPE_KEY = 'oikos_ingress_tunnel';
+export const OIKOS_INGRESS_CONNECTOR_APP_SCOPE_KEY = 'oikos_ingress_connector_app';
+export const OIKOS_INGRESS_DNS_SCOPE_KEY = 'oikos_ingress_dns';
+export const OIKOS_INGRESS_RATELIMIT_SCOPE_KEY = 'oikos_ingress_ratelimit';
+/** The key the runner records the step's result under (`system:kind:key`). */
+const APPLIED_KEY = `coolify:app:${PLATFORM_OIKOS_INGRESS_KEY}`;
+/** True once the step has finished: the readiness a company without a domain waits for. */
+export function oikosIngressApplied(recordedIds) {
+    return Boolean(recordedIds[APPLIED_KEY]);
+}
+/** Fixed texts. None carries a provider's error. */
+export const OIKOS_INGRESS_BLOCKED = {
+    edgeNotApplied: 'the shared oikos.host ingress is blocked, not planned: every DNS record and tunnel is written through edge, and edge is not applied yet',
+    zoneMissing: `the shared oikos.host ingress is blocked, not planned: the ${OIKOS_INGRESS_ZONE} zone is not on the Cloudflare account the platform's edge reaches; add the zone to that account`,
+    zoneUnchecked: `the shared oikos.host ingress is blocked, not planned: the ${OIKOS_INGRESS_ZONE} zone could not be looked up through edge just now; apply again`,
+    executorMissing: 'the shared oikos.host ingress is blocked, not planned: the host built the platform executor without its oikos ingress dependencies',
+};
+/**
+ * The step, or the reason it cannot be planned. Nothing when the platform has
+ * no edge (it could not write a record) or the step is already applied.
+ * `edgeApplied` is whether edge has recorded its address.
+ */
+export function planOikosIngress(platform, recordedIds, input) {
+    if (!platform.edge.enabled)
+        return { step: null, blocked: null };
+    if (oikosIngressApplied(recordedIds))
+        return { step: null, blocked: null };
+    if (!input.edgeApplied)
+        return { step: null, blocked: OIKOS_INGRESS_BLOCKED.edgeNotApplied };
+    if (input.executorBlocked)
+        return { step: null, blocked: input.executorBlocked };
+    return {
+        step: {
+            action: { system: 'coolify', kind: 'app', key: PLATFORM_OIKOS_INGRESS_KEY, desired: {} },
+            step: {
+                description: `set up the shared ${OIKOS_INGRESS_ZONE} ingress: its tunnel and connector, the ${OIKOS_INGRESS_WILDCARD} record and the sign-in rate limit`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
+// ---- the decisions of scripts/shared-ingress.mjs, as pure functions --------
+/** The tunnel's ingress: the wildcard to Coolify's proxy, then the mandatory catch-all. */
+export function oikosIngressTunnelIngress() {
+    return [
+        { hostname: OIKOS_INGRESS_WILDCARD, service: COOLIFY_PROXY_ORIGIN },
+        { service: 'http_status:404' },
+    ];
+}
+/** What the wildcard record needs: nothing, a create, or an update. */
+export function planWildcardRecord(live, tunnelId) {
+    if (!live)
+        return 'create';
+    return live.content === `${tunnelId}.cfargotunnel.com` && live.proxied === true
+        ? 'exists'
+        : 'update';
+}
+export const OIKOS_INGRESS_RATE_LIMIT_DESCRIPTION = 'foundry: rate limit sign-in paths (oikos.host, shared)';
+/** The Free plan allows one rule per zone, with only "Path" in the expression, a 10 second period and IP counting. */
+export const OIKOS_INGRESS_RATE_LIMIT_PERIOD_SECONDS = 10;
+export const OIKOS_INGRESS_RATE_LIMIT_REQUESTS = 10;
+export const OIKOS_INGRESS_SIGN_IN_EXPRESSION = 'starts_with(http.request.uri.path, "/auth/")';
+export function oikosIngressRateLimitRule() {
+    return {
+        description: OIKOS_INGRESS_RATE_LIMIT_DESCRIPTION,
+        expression: OIKOS_INGRESS_SIGN_IN_EXPRESSION,
+        action: 'block',
+        ratelimit: {
+            characteristics: ['cf.colo.id', 'ip.src'],
+            period: OIKOS_INGRESS_RATE_LIMIT_PERIOD_SECONDS,
+            requests_per_period: OIKOS_INGRESS_RATE_LIMIT_REQUESTS,
+            mitigation_timeout: OIKOS_INGRESS_RATE_LIMIT_PERIOD_SECONDS,
+        },
+    };
+}
+/** Ours is there, nothing is there, or a rule that is not ours holds the zone's one Free-plan slot. */
+export function planOikosRateLimit(rules) {
+    const own = rules.find((r) => r.description === OIKOS_INGRESS_RATE_LIMIT_DESCRIPTION);
+    if (own)
+        return { status: 'exists', ruleId: own.id };
+    return { status: rules.length > 0 ? 'conflict' : 'create', ruleId: null };
+}
+const DEFAULT_CALL_TIMEOUT_MS = 60_000;
+class CallTimeout extends Error {
+}
+/**
+ * One outside call, with a limit. A failure is reported by name only: a provider
+ * error can echo a token or a request body, so it is never carried on.
+ */
+async function call(label, ms, work) {
+    let timer;
+    try {
+        return await Promise.race([
+            work(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new CallTimeout()), ms);
+            }),
+        ]);
+    }
+    catch (error) {
+        const how = error instanceof CallTimeout ? 'timed out' : 'failed';
+        throw new Error(`platform:oikos-ingress: ${label} ${how}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Why the step cannot be planned for want of its zone, or `null` when the zone
+ * is on the account edge reaches. The texts are fixed; a lookup error is never carried.
+ */
+export async function oikosIngressZoneBlocked(zones, callTimeoutMs = DEFAULT_CALL_TIMEOUT_MS) {
+    try {
+        const zone = await call('zone lookup', callTimeoutMs, () => zones.findZoneByApex(OIKOS_INGRESS_ZONE));
+        return zone && zone.name === OIKOS_INGRESS_ZONE ? null : OIKOS_INGRESS_BLOCKED.zoneMissing;
+    }
+    catch {
+        // The error is dropped on purpose: it may carry provider detail, and the fixed text says enough.
+        return OIKOS_INGRESS_BLOCKED.zoneUnchecked;
+    }
+}
+/**
+ * Makes the ingress, in this order: tunnel, its ingress, the connector app, the
+ * wildcard record, the rate limit rule. Each is found by name or content before
+ * it is made, so a second run makes nothing twice. Returns the connector app id,
+ * which the runner records as the step's applied marker only on success.
+ */
+export async function provisionOikosIngress(context, ports) {
+    const ms = ports.callTimeoutMs ?? DEFAULT_CALL_TIMEOUT_MS;
+    const record = async (key, id) => {
+        context.recordScopeId(key, id);
+        await context.persist?.();
+    };
+    const recorded = context.recordedIds();
+    const zone = await call('zone lookup', ms, () => ports.zones.findZoneByApex(OIKOS_INGRESS_ZONE));
+    if (!zone || zone.name !== OIKOS_INGRESS_ZONE) {
+        throw new Error(`platform:oikos-ingress: ${OIKOS_INGRESS_BLOCKED.zoneMissing}`);
+    }
+    let projectUuid = recorded[OIKOS_INGRESS_PROJECT_SCOPE_KEY];
+    if (!projectUuid) {
+        const found = await call('project lookup', ms, () => ports.coolify.findProjectByName(OIKOS_INGRESS_PROJECT));
+        projectUuid = found
+            ? found.uuid
+            : (await call('project create', ms, () => ports.coolify.createProject(OIKOS_INGRESS_PROJECT)))
+                .uuid;
+        await record(OIKOS_INGRESS_PROJECT_SCOPE_KEY, projectUuid);
+    }
+    const projectId = projectUuid;
+    const { environment } = await call('environment', ms, () => ports.coolify.findOrCreateEnvironment(projectId, OIKOS_INGRESS_ENVIRONMENT));
+    const found = await call('tunnel lookup', ms, () => ports.tunnels.findTunnelByName(OIKOS_INGRESS_TUNNEL_NAME));
+    const tunnel = found ??
+        (await call('tunnel create', ms, () => ports.tunnels.createTunnel(OIKOS_INGRESS_TUNNEL_NAME)));
+    await record(OIKOS_INGRESS_TUNNEL_SCOPE_KEY, tunnel.id);
+    await call('tunnel ingress', ms, () => ports.tunnels.putTunnelConfig(tunnel.id, { ingress: oikosIngressTunnelIngress() }));
+    const connector = await call('connector app', ms * 5, () => ensureCloudflaredConnector({
+        coolify: ports.coolify,
+        tunnels: ports.tunnels,
+        tunnelId: tunnel.id,
+        appName: OIKOS_INGRESS_CONNECTOR_APP_NAME,
+        projectUuid: projectId,
+        environment,
+        resolveServer: ports.resolveServer,
+        recordedConnectorAppId: recorded[OIKOS_INGRESS_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (appId) => record(OIKOS_INGRESS_CONNECTOR_APP_SCOPE_KEY, appId),
+    }));
+    const [live] = await call('wildcard lookup', ms, () => ports.dns.findDnsRecord(OIKOS_INGRESS_ZONE, OIKOS_INGRESS_WILDCARD, 'CNAME'));
+    const wanted = {
+        type: 'CNAME',
+        name: OIKOS_INGRESS_WILDCARD,
+        content: `${tunnel.id}.cfargotunnel.com`,
+        proxied: true,
+    };
+    const dnsPlan = planWildcardRecord(live, tunnel.id);
+    if (dnsPlan === 'create') {
+        const made = await call('wildcard create', ms, () => ports.dns.createDnsRecord(OIKOS_INGRESS_ZONE, wanted));
+        await record(OIKOS_INGRESS_DNS_SCOPE_KEY, made.id);
+    }
+    else if (dnsPlan === 'update' && live) {
+        const id = live.id;
+        await call('wildcard update', ms, () => ports.dns.updateDnsRecord(OIKOS_INGRESS_ZONE, id, wanted));
+        await record(OIKOS_INGRESS_DNS_SCOPE_KEY, id);
+    }
+    else if (live) {
+        await record(OIKOS_INGRESS_DNS_SCOPE_KEY, live.id);
+    }
+    const rules = await call('rate limit lookup', ms, () => ports.ratelimits.listRateLimitRules(zone.id));
+    const limit = planOikosRateLimit(rules);
+    if (limit.status === 'conflict') {
+        throw new Error(`platform:oikos-ingress: the ${OIKOS_INGRESS_ZONE} zone already has a rate limiting rule foundry did not make, and the Free plan allows one; it is not adopted or replaced`);
+    }
+    if (limit.status === 'create') {
+        const made = await call('rate limit create', ms, () => ports.ratelimits.createRateLimitRule(zone.id, oikosIngressRateLimitRule()));
+        await record(OIKOS_INGRESS_RATELIMIT_SCOPE_KEY, made.id);
+    }
+    else if (limit.ruleId) {
+        await record(OIKOS_INGRESS_RATELIMIT_SCOPE_KEY, limit.ruleId);
+    }
+    return { resourceId: connector.appId };
+}

package/dist/plan/org-names.d.ts

@@ -1,12 +1,18 @@
 import { type DeclaredOrg } from '../org.js';
 /** Which side of an org a derived name belongs to: its own services or its hosting entries. */
 export type OrgNameSource = 'own' | 'hosting';
+/**
+ * The names foundry gives the services every company can run beside its own
+ * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
+ * calls and the cms site while they are on.
+ */
+export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site'>): string[];
 /**
  * Every container name, network alias, database, tunnel and bucket name that
  * foundry derives for an org: its own-service names when it owns services,
  * and its hosting-entry and database names.
  */
-export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting'>): {
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
     name: string;
     source: OrgNameSource;
 }[];
@@ -20,5 +26,5 @@ export interface NameClash {
     source: OrgNameSource;
 }
 /** Every name `org` derives that another org or the platform also derives. */
-export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting'>, others: readonly Pick<DeclaredOrg, 'slug' | 'services' | 'hosting'>[]): NameClash[];
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
 export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -1,6 +1,25 @@
 import { ownsServices } from '../org.js';
+import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
 import { orgTarget, platformTarget } from './own-services.js';
 import { appNameFor } from './platform-diff.js';
+/**
+ * The names foundry gives the services every company can run beside its own
+ * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
+ * calls and the cms site while they are on.
+ */
+export function companyServiceNames(org) {
+    const s = org.slug;
+    const names = [`${s}-agora`, `${s}-boule`, `${s}-boule-db`, `${s}-tunnel`, `${s}-cloudflared`];
+    if (org.chat?.enabled) {
+        names.push(...Object.values(chatInternalNames(s)), ...Object.values(chatRekeyedInternalNames(s)));
+    }
+    if (org.calls?.enabled) {
+        names.push(`${s}-calls`, `${s}-calls-synapse`, `${s}-calls-mas`, `${s}-calls-synapse-db`, `${s}-calls-mas-db`);
+    }
+    if (org.site?.enabled)
+        names.push(`${s}-site`, `${s}-cms`, `${s}-cms-db`);
+    return names;
+}
 /**
  * Every container name, network alias, database, tunnel and bucket name that
  * foundry derives for an org: its own-service names when it owns services,
@@ -8,6 +27,8 @@ import { appNameFor } from './platform-diff.js';
  */
 export function orgDerivedNames(org) {
     const names = [];
+    for (const name of companyServiceNames(org))
+        names.push({ name, source: 'own' });
     if (ownsServices(org)) {
         const target = orgTarget(org);
         for (const name of [...Object.values(target.names), ...Object.values(target.internal)]) {
@@ -22,10 +43,35 @@ export function orgDerivedNames(org) {
     }
     return names;
 }
+/** Names the platform's own steps give apps, tunnels, connectors, databases and projects outside `platformTarget()`. */
+const PLATFORM_STEP_NAMES = [
+    'platform',
+    'platform-archon',
+    'platform-archon-db',
+    'platform-archon-tunnel',
+    'platform-archon-cloudflared',
+    'platform-hc',
+    'platform-hc-db',
+    'platform-hc-tunnel',
+    'platform-hc-cloudflared',
+    'platform-edge',
+    'platform-edge-db',
+    'platform-edge-tunnel',
+    'platform-edge-cloudflared',
+    'platform-ai',
+    'platform-ai-migrate',
+    'platform-ai-worker',
+    'platform-backups',
+    'platform-oikos-ingress',
+];
 /** Every name the platform's shared services take. */
 export function platformDerivedNames() {
     const target = platformTarget();
-    return [...Object.values(target.names), ...Object.values(target.internal)];
+    return [
+        ...Object.values(target.names),
+        ...Object.values(target.internal),
+        ...PLATFORM_STEP_NAMES,
+    ];
 }
 /** Every name `org` derives that another org or the platform also derives. */
 export function findNameClashes(org, others) {
@@ -36,6 +82,13 @@ export function findNameClashes(org, others) {
         if (platform.has(name))
             clashes.push({ name, other: 'platform', source });
     }
+    // A hosting entry may not take a name foundry runs a service under for the same company.
+    const ownServices = new Set(companyServiceNames(org));
+    for (const { name, source } of mine) {
+        if (source === 'hosting' && ownServices.has(name)) {
+            clashes.push({ name, other: org.slug, source });
+        }
+    }
     for (const other of others) {
         if (other.slug === org.slug)
             continue;
@@ -48,5 +101,8 @@ export function findNameClashes(org, others) {
     return clashes;
 }
 export function nameClashMessage(slug, clash) {
+    if (clash.other === slug) {
+        return `name '${clash.name}' is taken by both a hosting entry and a service foundry runs for '${slug}'`;
+    }
     return `name '${clash.name}' is taken by both '${slug}' and '${clash.other}'`;
 }

package/dist/plan/own-diff.d.ts

@@ -1,5 +1,6 @@
 import { type DeclaredOrg } from '../org.js';
 import type { DraftStep } from './diff.js';
+import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY } from './login-host.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
 /** `unmanaged` key of the one line `planOwnJobs` reports. */
 export declare const OWN_JOBS_BLOCKED_KEY = "own-jobs";
@@ -7,7 +8,6 @@ export interface PlanOwnJobsOptions {
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
     readiness: OrgPlatformReadiness;
-    isPlatformOrg: boolean;
     /** The executor was built with an `ownServices` port. */
     ownServices: boolean;
     /** The admin token's held-key ref holds a value, so an undelivered marker is resumed, not blocked. */
@@ -26,21 +26,21 @@ export declare function planOwnJobs(options: PlanOwnJobsOptions): {
 };
 /** `unmanaged` key of the one line `planOwnAuth` reports. */
 export declare const OWN_AUTH_BLOCKED_KEY = "own-auth";
-/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
-export declare const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = "own_auth_applied_hostname";
+export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export declare const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = "own_auth_applied_git_ref";
 export interface PlanOwnAuthOptions {
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
     readiness: OrgPlatformReadiness;
-    isPlatformOrg: boolean;
     /** The executor was built with an `ownServices` port. */
     ownServices: boolean;
     /** The org's Cloudflare zone as the live read shows it, or null when none exists yet. */
     zone: {
         active: boolean;
     } | null;
+    /** The platform's edge has the `oikos.host` zone: the zone gate of a company without a domain. */
+    oikosZoneReady?: boolean;
     /** The org's own Lettermint key (`orgTarget(org).refs.brokerMailKey`) is held. */
     mailKeyHeld: boolean;
     /** The host can mint that key itself (a Lettermint port and a held-key reader): the step plans without it. */
@@ -65,13 +65,17 @@ export interface PlanOwnMailOptions {
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
     readiness: OrgPlatformReadiness;
-    isPlatformOrg: boolean;
     /** The executor was built with an `ownServices` port. */
     ownServices: boolean;
     /** `platform.mail.relay` is declared and the relay recorded a route list as applied. */
     mailRelayApplied: boolean;
     /** The org's zone is live and active. */
     zoneActive: boolean;
+    /**
+     * The host port the company's Stalwart publishes for the relay (`plan-apply.ts` gives the one the
+     * company already has, else the lowest free). Absent: the first port of the range.
+     */
+    smtpPort?: number;
 }
 /**
  * An own org (`services.own`) with mail on gets its own Stalwart in its own
@@ -92,7 +96,6 @@ export declare const OWN_SFU_FIREWALL_KEY = "own-sfu:firewall";
 export interface PlanOwnSfuOptions {
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
-    isPlatformOrg: boolean;
     /** The executor was built with an `ownServices` port. */
     ownServices: boolean;
     /** The org's zone is live and active: none is planned and none is waiting. */
@@ -122,7 +125,6 @@ export interface PlanOwnFilesOptions {
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
     readiness: OrgPlatformReadiness;
-    isPlatformOrg: boolean;
     /** The executor was built with an `ownServices` port. */
     ownServices: boolean;
     /** What the host's own files dependencies supply: valid keys worker settings, and a bucket port. */
@@ -149,7 +151,6 @@ export declare const OWN_FILES_R2_BLOCKED_KEY = "own-files-r2";
 export interface PlanOwnFilesR2Options {
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
-    isPlatformOrg: boolean;
     /** The executor was built with an `ownServices` port. */
     ownServices: boolean;
     /** Which ports the step needs the host supplied: the R2 key port, and the files-organisation `storeR2Credentials`. */