@wtfalch/foundry 0.35.1 → 0.36.0

package/dist/plan/diff.js

@@ -899,7 +899,7 @@ function planOrgRegistrationClosed(org, recordedIds, authReady, issuerStep) {
         },
     };
 }
-/** The blocked item for an org sign-in domain the sign-in server refused to make primary. */
+/** The note for an org sign-in domain the sign-in server refused to make primary, while it is not registered. */
 function orgDomainBlocked(org, recordedIds) {
     const domain = signInOrgDomain(org);
     if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() !== domain)
@@ -925,9 +925,7 @@ function planOrgDomain(org, recordedIds, authReady, issuerStep) {
     const domain = signInOrgDomain(org);
     if (recordedIds[ZITADEL_ORG_DOMAIN_SCOPE_KEY]?.toLowerCase() === domain)
         return null;
-    // Refused once: reported as blocked (see `orgDomainBlocked`), not planned again.
-    if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() === domain)
-        return null;
+    // A refused domain is planned again (and reported, see `orgDomainBlocked`): the step sets the policy it needs.
     return {
         action: { system: 'zitadel', kind: 'domain', key: org.id, desired: { domain } },
         step: {

package/dist/plan/executor.d.ts

@@ -936,6 +936,15 @@ export interface ZitadelPort {
     addOrgDomain(orgId: string, domain: string): Promise<void>;
     /** Makes a domain already on the org its primary one. Idempotent: no-op when it already is. */
     setPrimaryOrgDomain(orgId: string, domain: string): Promise<void>;
+    /** Removes a domain from the org. The server refuses the primary one. */
+    removeOrgDomain(orgId: string, domain: string): Promise<void>;
+    /** Sets the instance's domain policy. Writes only when a field differs. */
+    ensureDomainPolicy(want: {
+        userLoginMustBeDomain: boolean;
+        validateOrgDomains: boolean;
+    }): Promise<{
+        changed: boolean;
+    }>;
     setUserMetadata(orgId: string, userId: string, key: string, value: string): Promise<void>;
     getUserMetadata(orgId: string, userId: string, key: string): Promise<string | null>;
     findUserByEmail(orgId: string, email: string): Promise<{

package/dist/plan/platform-diff.js

@@ -9,7 +9,7 @@ import { legacyAppHostname } from './hostnames.js';
 import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
-import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, signInDomainBlockedText } from './sign-in-org.js';
+import { signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 /**
  * The `Plan` (#19's public contract) a {@link PlatformPlanDetail} carries,
@@ -2905,8 +2905,8 @@ export const ARCHON_ORG_BLOCKED = 'Archon is blocked, not planned: its own sign-
  * {@link PLATFORM_ARCHON_KEY}, planned while any of those is not recorded
  * against the recorded org, and always before `platform:archon`. Blocked, not
  * planned, while the host cannot reach the instance. A refused domain is
- * reported as a standing note (as the owner org's is) and does not hold the
- * step; an invite that cannot be sent (no work address, no mail port) is a
+ * reported as a standing note (as the owner org's is) and planned again, since
+ * the step sets the domain policy it needs; an invite that cannot be sent (no work address, no mail port) is a
  * standing note and does not hold it either.
  */
 function planArchonOrg(platform, recordedIds, executorBlocked, inviteBlocked, ownerSignIn) {
@@ -2914,7 +2914,8 @@ function planArchonOrg(platform, recordedIds, executorBlocked, inviteBlocked, ow
         return { step: null, blocked: null };
     const orgId = recordedIds[PLATFORM_ARCHON_ORG_SCOPE_KEY];
     const blockedDomain = recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY];
-    const domainDone = Boolean(recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY]) || Boolean(blockedDomain);
+    // A refused domain is planned again: the step sets the domain policy it needs.
+    const domainDone = Boolean(recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY]);
     const inviteRecorded = recordedIds[PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY];
     const inviteDone = Boolean(inviteBlocked) ||
         inviteRecorded === 'none' ||
@@ -2922,7 +2923,7 @@ function planArchonOrg(platform, recordedIds, executorBlocked, inviteBlocked, ow
     const standing = [
         inviteBlocked,
         blockedDomain && !recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY]
-            ? `Archon's sign-in domain ${blockedDomain} is blocked, not planned: the sign-in server refused to make it primary because its domain policy wants proof of ownership. Set the policy ValidateOrgDomains to false on the sign-in server, then remove the recorded key ${PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY}`
+            ? signInDomainBlockedText('Archon', blockedDomain)
             : null,
     ].filter((v) => Boolean(v));
     const standingNote = standing.length > 0 ? standing.join('; ') : null;
@@ -3042,5 +3043,5 @@ function ownerDomainBlockedText(recordedIds) {
         return null;
     if (recordedIds[PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY] === blockedDomain)
         return null;
-    return signInDomainBlockedText('the platform owner', blockedDomain).replace(ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY);
+    return signInDomainBlockedText('the platform owner', blockedDomain);
 }

package/dist/plan/platform-providers.d.ts

@@ -112,7 +112,7 @@ export interface PlatformAuthDeps {
     tunnels: PlatformTunnelsFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'addOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;
     /**
      * Mails the owner's first-sign-in link to their personal address (the same
      * port as `FoundryStepExecutorPorts.ownerInviteMail`). The link carries the

package/dist/plan/platform-providers.js

@@ -3210,14 +3210,13 @@ const PLATFORM_ARCHON_PROJECT = 'platform';
 const PLATFORM_ARCHON_APP_NAME = 'platform-archon';
 const PLATFORM_ARCHON_DB_NAME = 'platform-archon-db';
 /**
- * The database Archon runs on. Live platform-archon moved to `archon_v2` on
- * the same server (2026-10-02, the move onto `@wtfalch/db`), while its Coolify
- * resource still names `archon` as its first database. So both URLs built
- * here set this database themselves, never `internal_db_url`'s path.
- * Archon's own migrations grant to `current_database() || '_rt'`, so
- * {@link ARCHON_RUNTIME_ROLE} follows.
- */
-const ARCHON_POSTGRES_DB = 'archon_v2';
+ * The database Archon runs on, and its owner. A platform made from zero
+ * (2026-10-12) creates `platform-archon-db` with this as its first database,
+ * so both URLs built here set it themselves and never read
+ * `internal_db_url`'s path. Archon's own migrations grant to
+ * `current_database() || '_rt'`, so {@link ARCHON_RUNTIME_ROLE} follows.
+ */
+const ARCHON_POSTGRES_DB = 'archon';
 const ARCHON_RUNTIME_ROLE = `${ARCHON_POSTGRES_DB}_rt`;
 /** Fixed so the tunnel addresses the container directly (see `provisionPlatformAuth`). */
 const PLATFORM_ARCHON_INTERNAL_NAME = 'platform-archon';
@@ -3691,6 +3690,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const ownerUrl = archonDatabaseUrl(db.internal_db_url);
     if (liveOwnerUrl) {
         assertSameDatabaseHost('DATABASE_URL_OWNER', liveOwnerUrl, db.internal_db_url);
+        assertArchonDatabasePath('DATABASE_URL_OWNER', liveOwnerUrl);
     }
     else {
         envs.push({ key: 'DATABASE_URL_OWNER', value: ownerUrl });
@@ -5070,12 +5070,30 @@ function assertSameDatabaseHost(key, liveUrl, dbInternalUrl) {
         throw new Error(`platform:archon: ${key} on the app points at host ${liveHost ?? '(unparseable)'}, but the adopted database ${PLATFORM_ARCHON_DB_NAME} is at host ${dbHost ?? '(unparseable)'}; refusing to leave the app's database URLs on different databases`);
     }
 }
+/**
+ * Throws when `liveUrl`, kept as it is on the app, names another database than
+ * {@link ARCHON_POSTGRES_DB}: a hand-set URL on the wrong path, or a platform
+ * still on the retired `archon_v2`. Names the two databases only, never the URL.
+ */
+function assertArchonDatabasePath(key, liveUrl) {
+    let database;
+    try {
+        database = decodeURIComponent(new URL(liveUrl).pathname.slice(1));
+    }
+    catch {
+        database = null;
+    }
+    if (database !== ARCHON_POSTGRES_DB) {
+        throw new Error(`platform:archon: ${key} on the app names database ${database ?? '(unparseable)'}, but Archon runs on database ${ARCHON_POSTGRES_DB}; refusing to keep it. Point ${key} at ${ARCHON_POSTGRES_DB} in Coolify and apply again`);
+    }
+}
 async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
     const envs = await coolify.listEnvs(appId);
     const live = envs.find((e) => e.key === 'DATABASE_URL' && !e.is_preview);
     if (live) {
         // #265: kept as it is, but it must name the adopted database's host.
         assertSameDatabaseHost('DATABASE_URL', live.value, dbInternalUrl);
+        assertArchonDatabasePath('DATABASE_URL', live.value);
         return null;
     }
     let host;
@@ -8130,9 +8148,10 @@ const PLATFORM_BACKUP_S3_STORAGE_PENDING_SCOPE_KEY = 'coolify_platform_backup_s3
 const PLATFORM_BACKUP_DEFAULT_FREQUENCY = 'daily';
 /**
  * The database a service's schedule must name. A schedule that names none
- * dumps the Coolify resource's first database, which for live Archon is the
- * abandoned `archon`, not the one it runs on (see {@link ARCHON_POSTGRES_DB}).
- * Every other service runs on its resource's first database and needs no entry.
+ * dumps the Coolify resource's first database; Archon's is named here anyway,
+ * so a resource whose first database is not {@link ARCHON_POSTGRES_DB} is still
+ * dumped right. Every other service runs on its resource's first database and
+ * needs no entry.
  */
 const PLATFORM_BACKUP_DATABASE_NAMES = {
     archon: ARCHON_POSTGRES_DB,

package/dist/plan/sign-in-org.d.ts

@@ -9,30 +9,41 @@ export declare const ZITADEL_ORG_DOMAIN_SCOPE_KEY = "zitadel_org_domain";
 export declare const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_org_registration_closed";
 /** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
 export declare function closeSignInOrgRegistration(zitadel: Pick<ZitadelPort, 'closeSelfRegistration'>, orgId: string, recordScopeId: (key: string, id: string) => void, scopeKey?: string): Promise<void>;
-/** Scope id: the domain the sign-in server refused to make primary (its domain policy wants proof). Set instead of failing; the planner reports it as blocked. */
+/** Scope id: the domain the sign-in server still refused to make primary after foundry set its domain policy and added the domain again. Set instead of failing; the planner reports it and plans the domain again. */
 export declare const ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY = "zitadel_org_domain_blocked";
-/** The fixed text of the blocked item for a refused sign-in domain. No cause, no value but names. */
+/** The fixed text of the note for a refused sign-in domain. No cause, no value but names. */
 export declare function signInDomainBlockedText(orgName: string, domain: string): string;
+/**
+ * The domain policy a sign-in server needs before foundry gives an org its
+ * domain. The server holds only orgs foundry made, so a domain needs no proof
+ * of ownership, and a person's login name carries their org's domain.
+ */
+export declare const SIGN_IN_DOMAIN_POLICY: {
+    userLoginMustBeDomain: boolean;
+    validateOrgDomains: boolean;
+};
 /** The domain an org's owners sign in on: its own, or `<slug>.oikos.host` when it has none. */
 export declare function signInOrgDomain(org: {
     slug: string;
     domain: string | null;
 }): string;
 /**
- * Adds `domain` to the ZITADEL org and makes it primary. Both calls are
- * idempotent. A failure after the add leaves the domain on the org but not
- * primary, and nothing is recorded, so the next run repeats both.
+ * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
+ * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
+ * A domain added while the policy still wanted proof stays unverified, so it
+ * is removed and added again. A failure after the add leaves the domain on
+ * the org but not primary, and nothing is recorded, so the next run repeats.
  */
-export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
+export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain
- * primary (the sign-in server's domain policy wants proof) is recorded under
+ * primary (still unverified after the policy and the second add) is recorded under
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */
-export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string): Promise<boolean>;
+export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string): Promise<boolean>;
 export interface EnsureSignInOrgOptions {
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'addOrgDomain' | 'setPrimaryOrgDomain' | 'closeSelfRegistration'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'closeSelfRegistration'>;
     /** Where the successful close is recorded (the org id). Absent: not recorded; the caller closes on every run. */
     registrationClosedScopeKey?: string;
     /** Defaults to {@link ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY}. */

package/dist/plan/sign-in-org.js

@@ -11,12 +11,18 @@ export async function closeSignInOrgRegistration(zitadel, orgId, recordScopeId,
     await zitadel.closeSelfRegistration(orgId);
     recordScopeId(scopeKey, orgId);
 }
-/** Scope id: the domain the sign-in server refused to make primary (its domain policy wants proof). Set instead of failing; the planner reports it as blocked. */
+/** Scope id: the domain the sign-in server still refused to make primary after foundry set its domain policy and added the domain again. Set instead of failing; the planner reports it and plans the domain again. */
 export const ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY = 'zitadel_org_domain_blocked';
-/** The fixed text of the blocked item for a refused sign-in domain. No cause, no value but names. */
+/** The fixed text of the note for a refused sign-in domain. No cause, no value but names. */
 export function signInDomainBlockedText(orgName, domain) {
-    return `${orgName}'s sign-in domain ${domain} is blocked, not planned: the sign-in server refused to make it primary because its domain policy wants proof of ownership. Set the policy ValidateOrgDomains to false (and UserLoginMustBeDomain to true) on the sign-in server, then remove the recorded key ${ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY}`;
+    return `${orgName}'s sign-in domain ${domain} was refused: the sign-in server would not make it primary even after foundry turned off its proof of ownership (ValidateOrgDomains) and added the domain again. The next apply tries again`;
 }
+/**
+ * The domain policy a sign-in server needs before foundry gives an org its
+ * domain. The server holds only orgs foundry made, so a domain needs no proof
+ * of ownership, and a person's login name carries their org's domain.
+ */
+export const SIGN_IN_DOMAIN_POLICY = { userLoginMustBeDomain: true, validateOrgDomains: false };
 /** True for the providers' "domain is not verified" refusal of `setPrimaryOrgDomain`. */
 function isPrimaryDomainRefused(error) {
     return error instanceof Error && /is not verified/.test(error.message);
@@ -31,30 +37,51 @@ const DOMAIN_LISTED_WAIT_MS = 500;
 export function signInOrgDomain(org) {
     return (org.domain ?? `${org.slug}.oikos.host`).toLowerCase();
 }
-/**
- * Adds `domain` to the ZITADEL org and makes it primary. Both calls are
- * idempotent. A failure after the add leaves the domain on the org but not
- * primary, and nothing is recorded, so the next run repeats both.
- */
-export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
-    await zitadel.addOrgDomain(orgId, domain);
-    // The sign-in server lists a domain a moment after it accepts the add, and
-    // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
+/** Retries `work` while `retry` accepts its error, for five seconds. */
+async function untilListed(work, retry, sleep) {
     for (let attempt = 1;; attempt += 1) {
         try {
-            await zitadel.setPrimaryOrgDomain(orgId, domain);
+            await work();
             return;
         }
         catch (error) {
-            if (attempt >= DOMAIN_LISTED_TRIES || !isDomainNotListed(error))
+            if (attempt >= DOMAIN_LISTED_TRIES || !retry(error))
                 throw error;
             await sleep(DOMAIN_LISTED_WAIT_MS);
         }
     }
 }
+/**
+ * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
+ * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
+ * A domain added while the policy still wanted proof stays unverified, so it
+ * is removed and added again. A failure after the add leaves the domain on
+ * the org but not primary, and nothing is recorded, so the next run repeats.
+ */
+export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    await zitadel.ensureDomainPolicy(SIGN_IN_DOMAIN_POLICY);
+    await zitadel.addOrgDomain(orgId, domain);
+    // The sign-in server lists a domain a moment after it accepts the add, and
+    // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
+    try {
+        await untilListed(() => zitadel.setPrimaryOrgDomain(orgId, domain), isDomainNotListed, sleep);
+        return;
+    }
+    catch (error) {
+        if (!isPrimaryDomainRefused(error))
+            throw error;
+    }
+    await zitadel.removeOrgDomain(orgId, domain);
+    // Until the server lists the removal, the add sees the old unverified
+    // domain and skips: both answers are a moment late, so ask again.
+    await untilListed(async () => {
+        await zitadel.addOrgDomain(orgId, domain);
+        await zitadel.setPrimaryOrgDomain(orgId, domain);
+    }, (error) => isDomainNotListed(error) || isPrimaryDomainRefused(error), sleep);
+}
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain
- * primary (the sign-in server's domain policy wants proof) is recorded under
+ * primary (still unverified after the policy and the second add) is recorded under
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.35.1",
+  "version": "0.36.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -38,7 +38,7 @@
     "status": "node scripts/status.mjs"
   },
   "peerDependencies": {
-    "@wtfalch/providers": ">=0.7.4",
+    "@wtfalch/providers": ">=0.10.0",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
@@ -46,7 +46,7 @@
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/edge": "0.13.0",
     "@wtfalch/email": "^0.20.0",
-    "@wtfalch/providers": "0.7.5",
+    "@wtfalch/providers": "0.10.0",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },