@wtfalch/foundry 0.41.2 → 0.43.0

package/dist/plan/platform-org.d.ts

@@ -102,6 +102,8 @@ export interface OrgPlatformReadiness {
      * platform's, not as strangers. Absent when none is recorded.
      */
     platformZitadelIds?: readonly string[];
+    /** The second login app that serves `/sign-in` for companies with `signIn.inApp` is applied. Absent reads as false. */
+    signInLoginReady?: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
     /**
@@ -310,6 +312,10 @@ export interface OwnerSignIn {
      * is declared, absent while the owner step has recorded nothing.
      */
     firstOwnerUserId?: string | null;
+    /** The company's in-app login app (`<slug>-auth-login-sign-in`), once it is applied. Absent before. */
+    signInLoginAppId?: string;
+    /** True when the company has `signIn.inApp` and that login app is applied: Archon signs in on its own address. */
+    signInInApp?: true;
 }
 /** The owner company's own files host, as Archon's `FILES_*` env reads it. */
 export interface OwnerFiles {

package/dist/plan/platform-org.js

@@ -7,6 +7,7 @@ import { oikosIngressApplied } from './oikos-ingress.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
+import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -159,6 +160,7 @@ edgePortPresent = false) {
         ...(coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY)
             ? { platformAuthRecordedHost: platform.auth.hostname }
             : {}),
+        ...(platformRecordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY] ? { signInLoginReady: true } : {}),
         authReady,
         authIssuer: authReady ? `https://${platform.auth.hostname}` : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
@@ -314,6 +316,7 @@ export function ownerSignInFrom(owner, recorded) {
     if (!applied || applied !== ownHostnames(owner).auth)
         return null;
     const hostname = applied;
+    const signInLoginAppId = recorded[SIGN_IN_LOGIN_APP_SCOPE_KEY];
     return {
         issuerUrl: `https://${applied}`,
         organisationId,
@@ -321,6 +324,8 @@ export function ownerSignInFrom(owner, recorded) {
         bearerRef: orgTarget(owner).refs.instanceBearer,
         hostname,
         firstOwnerUserId: platformOwnerUserIdFrom(owner, recorded),
+        ...(signInLoginAppId ? { signInLoginAppId } : {}),
+        ...(signInLoginAppId && inAppSignIn(owner) ? { signInInApp: true } : {}),
     };
 }
 /**

package/dist/plan/platform-providers.d.ts

@@ -2,6 +2,7 @@ import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { type DeclaredOrg } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { DeclaredOrgStore, PlatformStore } from '../store.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import type { StepAction } from './diff.js';
 import type { AccessPort } from './edge-access.js';
@@ -10,6 +11,7 @@ import type { RateLimitPort } from './edge-ratelimits.js';
 import type { TunnelPort } from './edge-tunnels.js';
 import type { ZonePort } from './edge-zones.js';
 import type { CloudflarePort, CoolifyPort, FoundryStepExecutorPorts, ZitadelPort } from './executor.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } from './live.js';
 import { type OikosIngressPorts } from './oikos-ingress.js';
@@ -349,6 +351,14 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private onPlatform;
     /** `deps` with its Coolify port placed on the platform destination, then limited by `profile`. */
     private limitedOnPlatform;
+    /** Every Coolify server and why platform-archon's blue/green cannot run here, for the planner. */
+    archonBlueGreen(): Promise<{
+        servers?: BlueGreenServer[];
+        blocked?: string;
+    }>;
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`). The token is only read. */
+    releaseHost(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    private archonBlueGreenStep;
     blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<{
         auth?: string;
         authExecutorMissing?: boolean;
@@ -408,6 +418,14 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
      * (or the runner was never applied).
      */
     refreshFilesShare(_platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<Record<string, string> | null>;
+    /** True while a company signs in on its apps' own addresses through the platform's login. */
+    private signInLoginWanted;
+    /**
+     * In-app sign-in: the login app that serves `/sign-in` is wanted and either not recorded, gone from
+     * Coolify, or holding a host table other than the login's. The step then plans again and repairs it.
+     * A Coolify read that fails counts as not drifted, with one fixed log line (the error can carry values).
+     */
+    private signInLoginDrifted;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -510,6 +528,13 @@ export interface AuthStackInput {
     defaultRedirectUri: string | null;
     /** The company whose owner is invited into its own sign-in org; null for a company's own stack. */
     ownerCompany: DeclaredOrg | null;
+    /**
+     * In-app sign-in: a second login app serves `/sign-in` next to the login app. Absent: none is made.
+     * `bindings` is its `LOGIN_HOST_BINDINGS` document; `null` copies the login app's live one.
+     */
+    signInLogin?: {
+        bindings: string | null;
+    };
 }
 /**
  * #168: makes `coolify:app` keyed {@link PLATFORM_AUTH_KEY} true -- a Coolify
@@ -881,7 +906,9 @@ export declare function ownerInviteBlockedReason(ownerCompany: DeclaredOrg | nul
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'listEnvironments' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'listEnvironments' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment' | 'listStorages' | 'createPersistentStorage' | 'createFileStorage' | 'updateFileStorage'> & {
+        listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
+    };
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -890,7 +917,7 @@ export interface PlatformArchonDeps {
     access: PlatformAccessFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri'>>;
     /**
      * {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client:
      * the owner company's own ZITADEL, by its issuer and the held-key reference of
@@ -957,6 +984,8 @@ export interface PlatformArchonRuntime {
     readyTimeoutMs?: number;
     /** Pause between readiness polls (default 5 seconds). */
     readyIntervalMs?: number;
+    /** Called with every secret the blue/green steps read or mint (the health token, copied env), so the host can redact it. */
+    onSecret?: (value: string) => void;
 }
 /**
  * The name of foundry's own Cloudflare Access app in front of Archon. Same