@wtfalch/foundry 0.34.0 → 0.35.2

package/dist/plan/diff.js

@@ -4,20 +4,24 @@ import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPEC
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
+import { planCompanyBackups } from './company-backups.js';
+import { onPlatformNetwork } from './destinations.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
 import { hasWildcardGate, planGates } from './gates.js';
-import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
+import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, orgLoginHost, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
+import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
 import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
+import { ownHostnames } from './own-hostnames.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
-import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryRoutes, entryRoutesMarker, } from './proxy-labels.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 import { planWorkers } from './worker.js';
@@ -182,26 +186,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
-    // The platform's own org: its domain is the platform apex (the same fact
-    // #491 reads for mail). It signs in on the shared instance's own host, so
-    // `issuer.usesDomain` never moves it.
-    const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId);
     // An own org's sign-in comes before every step that signs in through it.
     const ownAuth = planOwnAuth({
         org,
         recordedIds,
         readiness: platformReadiness,
-        isPlatformOrg,
         ownServices: options.ownServices ?? false,
         zone: org.domain ? zoneReadiness(org.domain, byKey) : null,
+        oikosZoneReady: options.oikosZoneReady ?? false,
         mailKeyHeld: options.ownMailKeyHeld ?? false,
         mailKeyMintable: options.ownMailKeyMintable ?? false,
     });
     if (ownAuth.step)
         plannedSteps.push(ownAuth.step);
     // An own org's ZITADEL is the company's own instance: nothing that needs it plans before it exists.
-    const ownSignInPending = ownsServices(org) && !isPlatformOrg && !ownAuthApplied(org, recordedIds);
-    const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady, isPlatformOrg);
+    const ownSignInPending = ownsServices(org) && !ownAuthApplied(org, recordedIds);
+    const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady);
     if (issuer.step)
         plannedSteps.push(issuer.step);
     // Before the domain and the owners: no invite runs on an org still open to registration.
@@ -216,12 +216,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
-    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false, 
-    // #488: `agoraHost.issuer` is the shared ZITADEL instance's own issuer
-    // URL (`https://<platform.auth.hostname>`), the same value every org's
-    // sign-in already reads through `planOwners` above -- no separate port
-    // or plumbing needed to know the platform's own auth hostname.
-    platformAuthHostnameFrom('error' in agoraHost ? null : agoraHost.issuer), isPlatformOrg);
+    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false);
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
     // #444a: the org's one shared Postgres server and its fixed schema
@@ -233,6 +228,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // is pushed just below, before mail.
     const zone = planZone(org, byKey, claimed);
     const zoneWaiting = zone.blocked !== null;
+    // A company without a domain has no zone of its own: it waits for the `oikos.host` zone at the platform's edge.
+    const ownZoneActive = org.domain
+        ? zone.step === null && !zoneWaiting
+        : (options.oikosZoneReady ?? false);
     const zoneBlocked = [];
     // #555: steps that write DNS records, which go through edge.
     const dnsBlocked = [];
@@ -251,14 +250,16 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         org,
         recordedIds,
         readiness: platformReadiness,
-        isPlatformOrg,
         ownServices: options.ownServices ?? false,
         mailRelayApplied: options.mailRelayApplied ?? false,
-        zoneActive: zone.step === null && !zoneWaiting,
+        zoneActive: ownZoneActive,
+        ...(options.ownMailSmtpPort !== undefined ? { smtpPort: options.ownMailSmtpPort } : {}),
     });
     if (ownMail.step)
         plannedSteps.push(ownMail.step);
-    const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId);
+    const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId, options.mailRelayRoute === false
+        ? `the mail relay has no route for ${ownHostnames(org).mailDomain} yet: apply the platform`
+        : undefined);
     // #238: own-domain mail publishes DNS records into the zone, so it waits for
     // an active zone -- blocked, not planned (rule 2).
     if (mail.step && zoneWaiting && org.mail.usesDomain && org.domain) {
@@ -277,19 +278,19 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const mailCopy = planMailCopy(org, byKey, recordedIds);
     if (mailCopy)
         plannedSteps.push(mailCopy);
+    const versionPin = org.versionPin;
     const chat = planChat(org, byKey, claimed, recordedIds, agoraHost, issuer.step !== null);
     if (chat.step)
         plannedSteps.push(chat.step);
-    const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady);
+    const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady, versionPin?.calls);
     if (calls.step)
         plannedSteps.push(calls.step);
     // An own org's media server, before the calls service that reads its addresses.
     const ownSfu = planOwnSfu({
         org,
         recordedIds,
-        isPlatformOrg,
         ownServices: options.ownServices ?? false,
-        zoneActive: zone.step === null && !zoneWaiting,
+        zoneActive: ownZoneActive,
         readiness: platformReadiness,
         sfuPortsOpen: options.sfuPortsOpen ?? false,
         keysHeld: options.ownSfuKeysHeld ?? false,
@@ -320,7 +321,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const versionChanges = [];
     if (org.calls.enabled && !calls.blocked) {
         const callsAppLive = Boolean(byKey.get(resourceKey('coolify', 'calls', org.id)));
-        const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.synapse);
+        const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], versionPin?.calls ?? VERSIONS.synapse);
         if (synapseChange)
             versionChanges.push(synapseChange);
         const masChange = versionNotAppliedLine('mas', callsAppLive, recordedIds[CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.mas);
@@ -332,7 +333,6 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         org,
         recordedIds,
         readiness: platformReadiness,
-        isPlatformOrg,
         ownServices: options.ownServices ?? false,
         filesDeps: options.ownFilesDeps ?? { keys: false, bucket: false },
     });
@@ -343,14 +343,13 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         ? planOwnFilesR2({
             org,
             recordedIds,
-            isPlatformOrg,
             ownServices: options.ownServices ?? false,
             ports: options.ownFilesR2Ports,
         })
         : { step: null, blocked: null };
     if (ownFilesR2.step)
         plannedSteps.push(ownFilesR2.step);
-    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader, ownsServices(org) && !isPlatformOrg && !recordedIds[`coolify:own-files:${org.id}`]);
+    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader, ownsServices(org) && !recordedIds[`coolify:own-files:${org.id}`]);
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
     const aiOrganisation = planAiOrganisation(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader);
@@ -441,7 +440,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const edgeReservedLabels = planEdgeReservedLabels(org, recordedIds, platformReadiness, options.platformHostnames ?? []);
     if (edgeReservedLabels.step)
         plannedSteps.push(edgeReservedLabels.step);
-    const tunnel = planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformReadiness.platformApex);
+    const tunnel = planTunnel(org, byKey, claimed, recordedIds, platformReadiness.platformApex);
     // #238: a tunnel that is being provisioned waits for an active zone; parking
     // one never does.
     // #555: provisioning writes the tunnel config, the zone lookup and DNS; a
@@ -492,7 +491,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const agoraGuarded = guardApp(agoraClient);
     if (agoraGuarded)
         plannedSteps.push(agoraGuarded);
-    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost, isPlatformOrg, {
+    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost, {
         servesDiscovery: options.loginHostServesDiscovery ?? false,
     });
     if (agora.step)
@@ -521,7 +520,6 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         org,
         recordedIds,
         readiness: platformReadiness,
-        isPlatformOrg,
         ownServices: options.ownServices ?? false,
         tokenHeld: options.ownJobsTokenHeld ?? false,
     });
@@ -572,6 +570,11 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const recordedValues = new Set(Object.values(recordedIds));
     for (const own of ['', org.id, org.slug, org.domain ?? ''])
         recordedValues.delete(own);
+    // Archon's and the Access provider's project and client live in the owner company's ZITADEL.
+    if (platformReadiness.platformOwnerOrgId === org.id) {
+        for (const id of platformReadiness.platformZitadelIds ?? [])
+            recordedValues.add(id);
+    }
     const platformNames = new Set([...(options.platformHostnames ?? []), platformReadiness.mailHost?.mailHost ?? ''].map((h) => h.toLowerCase()));
     platformNames.delete('');
     const unmanaged = live
@@ -691,11 +694,28 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...app.blocked);
     unmanaged.push(...brokerEntries.blocked);
     unmanaged.push(...bouleBroker.blocked);
+    // F6: last, so every database step above runs before the backup of its database.
+    const backups = planCompanyBackups(org, recordedIds, options.backupStorageUuid);
+    plannedSteps.push(...backups.steps);
+    unmanaged.push(...backups.blocked);
+    // A company built on the shared network plans the move and nothing else: its other steps would act on
+    // resources the move deletes.
+    // The platform's own company stays on the platform network, so it is never moved.
+    const ownerCompany = onPlatformNetwork(isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId));
+    const networkMove = ownerCompany ? null : planNetworkMove(org, recordedIds);
+    if (!ownerCompany && networkMoveNeeded(recordedIds) && hasAdoptedResources(recordedIds)) {
+        unmanaged.push({
+            description: `${org.slug}'s adopted app and database stay on the shared Docker network: foundry did not create them and does not move them`,
+            key: 'coolify:network',
+        });
+    }
     return {
         orgId: org.id,
-        plannedSteps: (ownSignInPending
-            ? plannedSteps.filter((s) => !NEEDS_OWN_ZITADEL.has(`${s.action.system}:${s.action.kind}`))
-            : plannedSteps).map(withStepSystem),
+        plannedSteps: (networkMove
+            ? [networkMove]
+            : ownSignInPending
+                ? plannedSteps.filter((s) => !NEEDS_OWN_ZITADEL.has(`${s.action.system}:${s.action.kind}`))
+                : plannedSteps).map(withStepSystem),
         unmanaged,
         versionChanges,
         orgPostgres,
@@ -787,7 +807,7 @@ function edgeBlockedItem(org, what, key, reason) {
  * already exists live is unaffected: its own domain-move logic runs
  * regardless, since that never re-provisions the ZITADEL org itself.
  */
-function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
+function planIssuer(org, byKey, claimed, authReady) {
     const key = resourceKey('zitadel', 'issuer', org.id);
     const live = byKey.get(key);
     const desiredUsesDomain = org.issuer.usesDomain;
@@ -825,10 +845,8 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
         Boolean(org.domain) &&
         liveHost !== null &&
         liveHost !== loginHostnameFor(org);
-    // The platform's own org already signs in on the shared host: no move. A
-    // live issuer that does not say is not read as a different one either.
-    if (isPlatformOrg ||
-        live.config.usesDomain === undefined ||
+    // A live issuer that does not say is not read as a different one either.
+    if (live.config.usesDomain === undefined ||
         (Boolean(live.config.usesDomain) === desiredUsesDomain && !domainMoved)) {
         return { step: null, blocked: null };
     }
@@ -1011,27 +1029,10 @@ function planOwners(org, recordedIds, authReady, authIssuer, ownerInviteMail, re
     });
     return { steps, blocked };
 }
-/**
- * #488: the bare hostname out of an issuer URL (`https://<hostname>`, the
- * only shape {@link agoraHostValuesFromPlatform} or a host-supplied
- * `AgoraHostPort` ever hands back), or `null` when there is no issuer to
- * read one from. What {@link loginHostnameFor} compares the org's own
- * computed `auth.<domain>` against, so the platform's own org never plans
- * its login host equal to the shared ZITADEL instance's own.
- */
+/** True when `org` is the platform's owner company. */
 export function isPlatformOwnOrg(org, platformOwnerOrgId) {
     return Boolean(platformOwnerOrgId && org.id === platformOwnerOrgId);
 }
-function platformAuthHostnameFrom(issuer) {
-    if (!issuer)
-        return null;
-    try {
-        return new URL(issuer).hostname;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * #267: the org's own company login host (`login-host.ts`'s
  * `loginHostnameFor`) -- `auth.<domain>` once the org has one,
@@ -1068,54 +1069,24 @@ function platformAuthHostnameFrom(issuer) {
  * platform's own domain, never plans the shared ZITADEL instance's own login
  * host as its own -- `auth.companyincluded.com` colliding with itself.
  */
-function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, platformAuthHostname, isPlatformOrg) {
+function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired) {
     const none = { step: null, blocked: null };
     // An own org's instance has no shared login host to bind: its issuer is the sign-in service's own.
-    if (ownsServices(org) && !isPlatformOrg)
+    if (ownsServices(org))
         return none;
     const key = resourceKey('zitadel', 'login-host', org.id);
-    // The platform's own org signs in on the shared instance's host whatever
-    // `issuer.usesDomain` says (turning it on would move the issuer).
-    // Before that host is known, plan nothing: a guessed host would delete the
-    // working one, and a normal step would trust a domain `destroy` later deletes.
-    if (isPlatformOrg && platformAuthHostname === null) {
-        return {
-            step: null,
-            blocked: `${org.slug}'s login host is waiting for the platform auth host`,
-        };
-    }
-    const sharedInstanceHost = isPlatformOrg && platformAuthHostname !== null;
-    const host = orgLoginHost(org, sharedInstanceHost ? platformAuthHostname : null);
-    // #488: the guard in `loginHostnameFor` fired -- the org's own domain host
-    // would have been the platform's shared ZITADEL instance host.
-    if (sharedInstanceHost) {
-        // The host is the shared instance's own: nothing to trust or bind, and an
-        // org with no recorded host already signs in there. Only an org recorded
-        // on another host (the old `<slug>-auth.oikos.host`) plans one step, to
-        // move its apps over and remove the old host; then it plans nothing.
-        const recordedHost = recordedIds[key];
-        const moving = recordedHost !== undefined && recordedHost !== host;
-        const removalOwed = pendingRemovalHosts(recordedIds).length > 0;
-        if (!authReady || !(moving || removalOwed))
-            return none;
-        // The same gates as the normal branch: the executor's shared step also
-        // needs the binding port and the ZITADEL org.
-        const waiting = loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned);
-        return waiting ?? stepFor(true);
-    }
-    function stepFor(shared) {
+    const host = loginHostnameFor(org);
+    function stepFor() {
         return {
             step: {
                 action: {
                     system: 'zitadel',
                     kind: 'login-host',
                     key: org.id,
-                    desired: shared ? { host, shared: true } : { host },
+                    desired: { host },
                 },
                 step: {
-                    description: shared
-                        ? `move ${org.slug}'s apps onto the platform's own sign-in host ${host}`
-                        : `set ${org.slug}'s login host to ${host}`,
+                    description: `set ${org.slug}'s login host to ${host}`,
                     destroys: false,
                     migrates: false,
                 },
@@ -1143,7 +1114,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // Isolation between orgs rests on zitadel-login's binding, and repointing
     // an app at a host with no binding breaks its sign-in: trust nothing and
     // repoint nothing until the port that writes the binding is wired.
-    return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor(false);
+    return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor();
 }
 /**
  * Every sign-in app this org already has live (web or native, not api) gets
@@ -1273,7 +1244,9 @@ export const JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY = 'jobs_registration_undeli
  */
 function planMail(org, byKey, claimed, recordedIds, mailHost, 
 /** #491 (review round 2): read off `platformReadiness` directly, not off `mailHost` -- see `OrgPlatformReadiness.platformApex`'s own doc comment for why. */
-platformApex, platformLettermintProjectId) {
+platformApex, platformLettermintProjectId, 
+/** Why the MX cannot be published yet: the relay does not route this org's mail domain. */
+relayBlocked) {
     const key = resourceKey('coolify', 'mail', org.id);
     const live = byKey.get(key);
     // `off` means mail is not foundry's concern here (org.ts's MailMode doc);
@@ -1289,7 +1262,14 @@ platformApex, platformLettermintProjectId) {
     if (!mailHost) {
         return {
             step: null,
-            blocked: `${org.slug}'s mail is blocked, not planned: the platform's mail server is off or not yet applied`,
+            blocked: `${org.slug}'s mail is blocked, not planned: its own mail server is not applied yet`,
+            mailboxBlocked: null,
+        };
+    }
+    if (relayBlocked) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s mail is blocked, not planned: ${relayBlocked}`,
             mailboxBlocked: null,
         };
     }
@@ -1637,14 +1617,14 @@ function planChat(org, byKey, claimed, recordedIds, reading, issuerPlanned) {
  * `sfu:livekit` step is declared. Parking, and an already-provisioned stack,
  * are unaffected.
  */
-function planCalls(org, byKey, claimed, callsReady) {
+function planCalls(org, byKey, claimed, callsReady, synapseTag) {
     const key = resourceKey('coolify', 'calls', org.id);
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return {
             step: null,
             blocked: ownsServices(org)
                 ? `${org.slug}'s calls Matrix stack is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`
-                : `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
+                : `${org.slug}'s calls Matrix stack is blocked, not planned: the platform owner's calls SFU (the platform's) is off`,
         };
     }
     // #248: the two images this stack's own apply would run, checked the same
@@ -1652,7 +1632,7 @@ function planCalls(org, byKey, claimed, callsReady) {
     // own tag -- a re-apply of the same declaration must not silently run a
     // different version with no diff shown anywhere.
     if (org.calls.enabled && !byKey.get(key)) {
-        const synapseBlocked = floatingTagBlocked('Synapse', VERSIONS.synapse, 'v1.161.0');
+        const synapseBlocked = floatingTagBlocked('Synapse', synapseTag ?? VERSIONS.synapse, 'v1.161.0');
         if (synapseBlocked) {
             return {
                 step: null,
@@ -1667,10 +1647,12 @@ function planCalls(org, byKey, claimed, callsReady) {
             };
         }
     }
-    return {
-        step: planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`),
-        blocked: null,
-    };
+    const toggle = planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`);
+    // A held Synapse tag rides in the provisioning step; a parking step carries none.
+    if (toggle && synapseTag && toggle.action.desired.enabled === true) {
+        toggle.action.desired = { ...toggle.action.desired, synapseTag };
+    }
+    return { step: toggle, blocked: null };
 }
 /**
  * The org's own calls service (#145, part 2 of #128) -- `wtfalch/calls`'s
@@ -2314,12 +2296,12 @@ function planAgoraClient(org, byKey, claimed) {
  * message naming each missing value, which `computePlanDetail` lists with the
  * plan's non-step items, so every other step still applies.
  */
-function planAgora(org, byKey, claimed, recordedIds, reading, isPlatformOrg, issuerSwitch) {
+function planAgora(org, byKey, claimed, recordedIds, reading, issuerSwitch) {
     const key = resourceKey('coolify', 'agora', org.id);
     const live = byKey.get(key);
     if (live)
         claimed.add(key);
-    const ownSignIn = ownsServices(org) && !isPlatformOrg;
+    const ownSignIn = ownsServices(org);
     if (ownSignIn && !ownAuthApplied(org, recordedIds)) {
         return {
             step: null,
@@ -2329,8 +2311,8 @@ function planAgora(org, byKey, claimed, recordedIds, reading, isPlatformOrg, iss
     }
     // The files host records its internal URL only while it applies, and Agora's
     // env takes its files upstream from it: planned in the same pass, the first
-    // deploy would start without one. The company's files host exists only with a domain.
-    if (ownSignIn && org.domain && !recordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY]) {
+    // deploy would start without one.
+    if (ownSignIn && !recordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY]) {
         return {
             step: null,
             blocked: `${org.slug}'s Agora is blocked, not planned: its own files host is not applied yet`,
@@ -2360,7 +2342,7 @@ function planAgora(org, byKey, claimed, recordedIds, reading, isPlatformOrg, iss
     // stays applied: a later failing read never flips it back (no oscillation).
     let host = platformHost;
     let issuerNote = null;
-    const choice = agoraIssuerHostFor(org, isPlatformOrg);
+    const choice = agoraIssuerHostFor(org);
     if (choice.mismatch) {
         issuerNote = `${org.slug}'s Agora cannot sign in: its login host ${loginHostnameFor(org)} is not on its Agora address ${agoraHostnameFor(org)}; the login host must be on the org's domain`;
     }
@@ -2717,7 +2699,6 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     const blockedKey = (rest) => entryKey === APP_ENTRY_KEY ? `coolify:app:${rest}` : `coolify:app:${entryKey}:${rest}`;
     const { marker: wantedEnv, unresolved, unresolvedSecrets, } = entry
         ? resolveAppEnv(org, entry, recordedIds, {
-            platformMailKey: readiness.mailKeyHeld === true,
             sharedSecret: readiness.canHoldSecrets === true,
         })
         : { marker: {}, unresolved: [], unresolvedSecrets: [] };
@@ -2733,9 +2714,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             .concat(
         // Never a value: the ref of the missing key, or what the host lacks.
         unresolvedSecrets.map(([name, source]) => ({
-            description: `${org.slug}'s ${label} env ${name} is blocked, not planned: ${source === 'platformMailKey'
-                ? `the platform's Lettermint key is not held yet (held-key ref ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF})`
-                : `its source ${source} needs a held-key store that can put, and the host has none`}`,
+            description: `${org.slug}'s ${label} env ${name} is blocked, not planned: ${`its source ${source} needs a held-key store that can put, and the host has none`}`,
             key: blockedKey(`env:${name}`),
         })))
         : [];
@@ -2775,7 +2754,18 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             key: blockedKey('repo'),
         });
     }
-    const toggled = planHostingToggle('coolify', 'app', entry !== undefined && !noRepo, org, byKey, claimed, () => `provision ${org.slug}'s ${label}`, () => `park ${org.slug}'s ${label} (stops serving; app data is retained, not deleted -- #7 corrections 1)`, stepKey);
+    // A compose file can set `privileged`, host networking or a Docker socket mount, and its labels are
+    // its own. `validateHosting` refuses the build pack on write; an entry stored before that rule is
+    // held here too, and a live app of it is parked like one whose entry was removed.
+    const composeBuilt = entry !== undefined && entry.buildPack === 'dockercompose';
+    if (composeBuilt) {
+        blocked.push({
+            description: `${org.slug}'s ${label} is blocked, not planned: a compose-built app is refused until its compose file is checked`,
+            key: blockedKey('compose'),
+        });
+    }
+    const refused = noRepo || composeBuilt;
+    const toggled = planHostingToggle('coolify', 'app', entry !== undefined && !refused, org, byKey, claimed, () => `provision ${org.slug}'s ${label}`, () => `park ${org.slug}'s ${label} (stops serving; app data is retained, not deleted -- #7 corrections 1)`, stepKey);
     // #447: only the live app's own `git_repository` decides, never the
     // declared entry (a `repo: null` entry can sit over a bespoke app, which is
     // parked as before). Only the `app` key ever held the default app, and an
@@ -2807,7 +2797,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     }
     if (toggled)
         return { step: toggled, blocked };
-    if (!entry || noRepo)
+    if (!entry || refused)
         return { step: null, blocked };
     const live = byKey.get(resourceKey('coolify', 'app', stepKey));
     if (!live)
@@ -2922,15 +2912,14 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             blocked,
         };
     }
-    // A changed hostname reaches an app that is already live: its domains are
-    // patched and it is redeployed.
-    if (JSON.stringify(tunnelDomainList(entryHostnames(org, entry))) !==
-        JSON.stringify(appliedAppDomains(org, recordedIds, entryKey))) {
+    // No entry carries Coolify `domains`: the company's tunnel routes its names straight to the container.
+    // An app that still holds some (made before that) has them cleared and is redeployed.
+    if (appliedAppDomains(org, recordedIds, entryKey).length > 0) {
         return {
             step: {
                 action,
                 step: {
-                    description: `apply ${org.slug}'s ${label} hostnames and redeploy the app`,
+                    description: `remove ${org.slug}'s ${label} Coolify domains (the tunnel routes it directly) and redeploy the app`,
                     destroys: false,
                     migrates: false,
                 },
@@ -2938,17 +2927,16 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             blocked,
         };
     }
-    // A `*` entry's proxy labels reach an app that is already live: the label
-    // set is patched and the app redeployed once its hash differs from the one
-    // `coolifyApp` recorded.
+    // A changed hostname, wildcard or port, or a container still open to Traefik: the label set
+    // (`traefik.enable=false`) is patched and the app redeployed once the marker `coolifyApp`
+    // recorded differs from the wanted one.
     const appliedLabels = recordedIds[appLabelsAppliedScopeKey(entryKey)];
-    const labelSpec = entryLabelSpec(org, entry, appliedLabels !== undefined);
-    if (labelSpec && entryLabelHash(labelSpec) !== appliedLabels) {
+    if (entryLabelHash(entryLabelSpec(org, entry)) !== appliedLabels) {
         return {
             step: {
                 action,
                 step: {
-                    description: `apply ${org.slug}'s ${label} proxy labels and redeploy the app`,
+                    description: `apply ${org.slug}'s ${label} routing (hostnames, port, no Traefik route) and redeploy the app`,
                     destroys: false,
                     migrates: false,
                 },
@@ -3014,12 +3002,11 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
         // The same availability the plan's marker used: the executor records its
         // marker from this, never from its own port, so the two cannot disagree.
         const usesSecrets = org.hosting.entries.some((e) => e.key === key &&
-            Object.values(e.env).some((v) => typeof v !== 'string' && (v.from === 'sharedSecret' || v.from === 'platformMailKey')));
+            Object.values(e.env).some((v) => typeof v !== 'string' && v.from === 'sharedSecret'));
         if (usesSecrets && app.step && app.step.action.desired.enabled !== false) {
             app.step.action.desired = {
                 ...app.step.action.desired,
                 secretSources: {
-                    platformMailKey: readiness.mailKeyHeld === true,
                     sharedSecret: readiness.canHoldSecrets === true,
                 },
             };
@@ -3184,11 +3171,13 @@ function sortedNames(names) {
  * domain) plans no per-org tunnel for Agora: `<slug>-agora.oikos.host` rides
  * the shared `*.oikos.host` wildcard tunnel (`scripts/shared-ingress.mjs`).
  */
-function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApex) {
+function planTunnel(org, byKey, claimed, recordedIds, platformApex) {
     const desired = (org.hosting.tunnel && org.hosting.usesDomain && Boolean(org.domain)) ||
         (org.site.enabled && Boolean(org.domain)) ||
         (org.calls.enabled && org.calls.usesDomain && Boolean(org.domain)) ||
-        Boolean(org.domain);
+        Boolean(org.domain) ||
+        // A company without a domain still gets a tunnel of its own for an entry at `<slug>.oikos.host`.
+        entryRoutes(org).length > 0;
     const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`, org.id, 
     // Cloudflare's status, read against what is declared: a park cannot change
     // it, so judging on/off by status alone would never let the plan empty.
@@ -3204,7 +3193,7 @@ function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApe
     // #568: the company's own login host is routed by the step, so a first
     // provision carries it too; a park does not. Without a known platform apex
     // the platform's own org cannot be told apart, so none is planned.
-    const loginHost = platformApex ? companyLoginTunnelHost(org, isPlatformOrg) : null;
+    const loginHost = platformApex ? companyLoginTunnelHost(org) : null;
     if (toggled && toggled.action.desired.enabled !== false && loginHost) {
         return {
             ...toggled,
@@ -3236,8 +3225,17 @@ function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApe
         org.domain !== null &&
         sortedNames(published.split(',')) !==
             sortedNames(tunnelDnsHostnames(org, org.domain, loginHost));
-    const dnsStale = recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain || edgeChanged;
-    if (!connectorMissing && !dnsStale)
+    // The entry names in the platform's oikos.host zone are recorded apart from the company's own zone.
+    const oikosStale = (recordedIds[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY] ?? '') !==
+        entryOikosHostnames(org).join(',');
+    const dnsStale = (org.domain !== null && recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain) ||
+        edgeChanged ||
+        oikosStale;
+    // An entry's hostname goes straight to its container, so a changed port, key or name, or an ingress
+    // written before entries were routed that way, needs the ingress written again. Nothing recorded
+    // equals no routes.
+    const routesStale = (recordedIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') !== entryRoutesMarker(org);
+    if (!connectorMissing && !dnsStale && !routesStale)
         return null;
     return {
         action: {
@@ -3249,7 +3247,9 @@ function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApe
         step: {
             description: connectorMissing
                 ? `run a cloudflared connector for ${org.slug}'s Cloudflare tunnel`
-                : `point ${org.slug}'s hostnames at its Cloudflare tunnel`,
+                : dnsStale
+                    ? `point ${org.slug}'s hostnames at its Cloudflare tunnel`
+                    : `route ${org.slug}'s entry hostnames straight to their containers`,
             destroys: false,
             migrates: false,
         },

package/dist/plan/edge-access.d.ts

@@ -10,6 +10,10 @@ export interface AccessAppSummary {
     id: string;
     name: string;
     domain: string;
+    /** The identity providers the app accepts; `[]` means Cloudflare lists none (any provider). */
+    allowedIdps: string[];
+    /** Whether a visitor goes straight to the one provider. */
+    autoRedirectToIdentity: boolean;
 }
 /**
  * Foundry's Cloudflare Access calls. Every Access call in foundry goes through
@@ -19,13 +23,24 @@ export interface AccessAppSummary {
 export interface AccessPort {
     /** Every live Access app foundry may use: the platform's own, and ones nobody adopted yet. */
     listAccessApps(): Promise<AccessAppSummary[]>;
+    /**
+     * Edge keeps `allowedIdps` of an app that already exists: a repeat create
+     * only reports the live value, so a caller compares it from
+     * {@link listAccessApps} and rebuilds the app on a difference.
+     */
     createAccessApp(app: {
         name: string;
         domain: string;
         type: 'self_hosted';
+        allowedIdps?: string[];
+        autoRedirectToIdentity?: boolean;
     }): Promise<{
         id: string;
     }>;
+    /** The account's one-time-PIN identity provider (edge 0.13.0 finds or makes it). Safe to repeat. */
+    ensureOneTimePinProvider(): Promise<{
+        id: string;
+    }>;
     listAccessPolicies(appId: string): Promise<Array<{
         id: string;
         name: string;