@wtfalch/foundry 0.45.1 → 0.46.0

package/dist/plan/company-backups.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg } from '../org.js';
+import { type DeclaredOrg } from '../org.js';
 import type { UnmanagedItem } from '../plan.js';
 import type { DraftStep } from './diff.js';
 /**
@@ -11,6 +11,8 @@ import type { DraftStep } from './diff.js';
  * `app` is the hosting entry's database, recorded as a resource id.
  */
 export declare function companyDatabaseKeys(org: Pick<DeclaredOrg, 'id'>): Readonly<Record<string, string>>;
+/** The {@link companyDatabaseKeys} name of each home's legacy Coolify database, which its backup schedule is recorded under. */
+export declare const LEGACY_BACKUP_NAMES: Readonly<Record<string, string>>;
 /**
  * The database a company backup schedule must name when the Coolify resource
  * is not left to pick its first database. Absent: the resource's first database.
@@ -20,6 +22,10 @@ export declare const COMPANY_BACKUP_DATABASE_NAMES: Readonly<Record<string, stri
 export declare const BACKUP_SCOPE_PREFIX = "backup_";
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
 export declare function backupScopeKey(db: string): string;
+/** The recorded-id key that holds the database list the company server's schedule was last set to. */
+export declare const BACKUP_POSTGRES_DATABASES_SCOPE_KEY = "backup_postgres_databases";
+/** Comma-separated `databases_to_backup` for the server schedule: every home on the server, sorted. */
+export declare function serverBackupDatabases(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): string;
 /** The databases an upgrade of `service` can migrate, by the names in {@link companyDatabaseKeys}. Empty: not coverable here. */
 export declare function databasesForService(service: string): readonly string[] | 'all';
 /**

package/dist/plan/company-backups.js

@@ -1,6 +1,8 @@
+import { ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, orgServiceDatabase, } from '../org.js';
 import { BOULE_DATABASE_SCOPE_KEY } from './boule.js';
 import { CHAT_REKEY_MAS_DB_SCOPE_KEY, CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY } from './executor.js';
 import { MAIL_DATABASE_NAME, MAIL_DATABASE_SCOPE_KEY } from './mail-store.js';
+import { serviceOnServer } from './org-postgres.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db-tls.js';
 /**
@@ -29,8 +31,21 @@ export function companyDatabaseKeys(org) {
         boule: BOULE_DATABASE_SCOPE_KEY,
         chat_rekey_synapse: CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY,
         chat_rekey_mas: CHAT_REKEY_MAS_DB_SCOPE_KEY,
+        postgres: ORG_POSTGRES_SERVER_SCOPE_KEY,
     };
 }
+/** The {@link companyDatabaseKeys} name of each home's legacy Coolify database, which its backup schedule is recorded under. */
+export const LEGACY_BACKUP_NAMES = {
+    app: 'app',
+    cms: 'cms',
+    boule: 'boule',
+    chat_service: 'chat',
+    calls_service: 'calls',
+    chat_synapse: 'chat_synapse',
+    chat_mas: 'chat_mas',
+    calls_synapse: 'synapse',
+    calls_mas: 'mas',
+};
 /**
  * The database a company backup schedule must name when the Coolify resource
  * is not left to pick its first database. Absent: the resource's first database.
@@ -44,6 +59,15 @@ export const BACKUP_SCOPE_PREFIX = 'backup_';
 export function backupScopeKey(db) {
     return `${BACKUP_SCOPE_PREFIX}${db}`;
 }
+/** The recorded-id key that holds the database list the company server's schedule was last set to. */
+export const BACKUP_POSTGRES_DATABASES_SCOPE_KEY = 'backup_postgres_databases';
+/** Comma-separated `databases_to_backup` for the server schedule: every home on the server, sorted. */
+export function serverBackupDatabases(org, recordedIds) {
+    return ORG_SERVICE_SCHEMAS.filter((home) => serviceOnServer(org, home, recordedIds))
+        .map((home) => orgServiceDatabase(org, home).database)
+        .sort()
+        .join(',');
+}
 /** The databases an upgrade of `service` can migrate, by the names in {@link companyDatabaseKeys}. Empty: not coverable here. */
 export function databasesForService(service) {
     switch (service) {
@@ -80,7 +104,18 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
         return { steps, blocked };
     for (const [db, key] of Object.entries(companyDatabaseKeys(org))) {
         const databaseId = recordedIds[key];
-        if (!databaseId || recordedIds[backupScopeKey(db)])
+        if (!databaseId)
+            continue;
+        let databaseNames;
+        if (db === 'postgres') {
+            databaseNames = serverBackupDatabases(org, recordedIds);
+            if (!databaseNames)
+                continue;
+            if (recordedIds[backupScopeKey(db)] &&
+                recordedIds[BACKUP_POSTGRES_DATABASES_SCOPE_KEY] === databaseNames)
+                continue;
+        }
+        else if (recordedIds[backupScopeKey(db)])
             continue;
         if (!storageUuid) {
             blocked.push({
@@ -94,7 +129,12 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
                 system: 'coolify',
                 kind: 'backup',
                 key: `${org.slug}:${db}`,
-                desired: { databaseId, database: db, storageUuid },
+                desired: {
+                    databaseId,
+                    database: db,
+                    storageUuid,
+                    ...(databaseNames ? { databaseNames } : {}),
+                },
             },
             step: {
                 description: `schedule a nightly backup of ${org.slug}'s ${db} database to the platform's backup bucket`,

package/dist/plan/cookie-domain.d.ts

@@ -0,0 +1,41 @@
+import { type DeclaredOrg } from '../org.js';
+/** The auth release that holds both the shared-host organisation check (577) and the session binding (795). */
+export declare const MIN_AUTH_FOR_SESSION_BINDING = "0.28.0";
+export declare const MIN_AUTH_FOR_CLIENT_ORGS = "0.28.0";
+/**
+ * Scope id set to `'1'` once `LOGIN_SESSION_BIND_KEY` is live on the in-app login app (written, and the
+ * app deployed after it). No binding carries a cookie domain before it.
+ */
+export declare const SIGN_IN_BIND_KEY_SCOPE_KEY = "sign_in_bind_key_ready";
+/** The env that holds the key: at least 32 characters, secret, on the in-app login app only. */
+export declare const SIGN_IN_BIND_KEY_ENV = "LOGIN_SESSION_BIND_KEY";
+export declare const SIGN_IN_BIND_KEY_MIN_LENGTH = 32;
+/** The cookie domain the app-host bindings were last written with (`''` for none). */
+export declare const LOGIN_COOKIE_DOMAIN_SCOPE_KEY = "login_cookie_domain";
+/**
+ * True only for a `vX.Y.Z` tag at or above `min`. A branch, a sha or anything else is false, so a
+ * platform on `main` never passes a gate that needs a release.
+ */
+export declare function authAtLeast(gitRef: string, min: string): boolean;
+export type CookieDomainDecision = {
+    domain: string;
+} | {
+    domain: null;
+    reason: string;
+};
+/** Reasons that wait on a release or a key; the planner reports these. The others are the declaration's own shape. */
+export declare const COOKIE_DOMAIN_WAITING_REASONS: Set<string>;
+/**
+ * The company-wide cookie domain for an org's app-host bindings, or why there is none. A domain is
+ * returned only when the sign-in is in-app with app hosts bound, the org has its own domain, nothing
+ * but estate apps is public under it, the login is a release that binds sessions to the host, and the
+ * bind key is live. A company on a shared domain never gets one: a cookie there would span companies.
+ */
+export declare function cookieDomainAllowed(input: {
+    org: DeclaredOrg;
+    recorded: Readonly<Record<string, string>>;
+    authGitRef: string;
+    bindKeyReady: boolean;
+}): CookieDomainDecision;
+/** The fixed line the planner reports while a cookie domain waits on the login. */
+export declare function cookieDomainWaitingLine(slug: string, reason: string): string;

package/dist/plan/cookie-domain.js

@@ -0,0 +1,71 @@
+import { ownsServices } from '../org.js';
+import { inAppApps } from './login-host.js';
+/** The auth release that holds both the shared-host organisation check (577) and the session binding (795). */
+export const MIN_AUTH_FOR_SESSION_BINDING = '0.28.0';
+export const MIN_AUTH_FOR_CLIENT_ORGS = '0.28.0';
+/**
+ * Scope id set to `'1'` once `LOGIN_SESSION_BIND_KEY` is live on the in-app login app (written, and the
+ * app deployed after it). No binding carries a cookie domain before it.
+ */
+export const SIGN_IN_BIND_KEY_SCOPE_KEY = 'sign_in_bind_key_ready';
+/** The env that holds the key: at least 32 characters, secret, on the in-app login app only. */
+export const SIGN_IN_BIND_KEY_ENV = 'LOGIN_SESSION_BIND_KEY';
+export const SIGN_IN_BIND_KEY_MIN_LENGTH = 32;
+/** The cookie domain the app-host bindings were last written with (`''` for none). */
+export const LOGIN_COOKIE_DOMAIN_SCOPE_KEY = 'login_cookie_domain';
+const TAG = /^v(\d+)\.(\d+)\.(\d+)$/;
+/**
+ * True only for a `vX.Y.Z` tag at or above `min`. A branch, a sha or anything else is false, so a
+ * platform on `main` never passes a gate that needs a release.
+ */
+export function authAtLeast(gitRef, min) {
+    const have = TAG.exec(gitRef);
+    const want = /^(\d+)\.(\d+)\.(\d+)$/.exec(min);
+    if (!have || !want)
+        return false;
+    for (let i = 1; i <= 3; i++) {
+        const a = Number(have[i]);
+        const b = Number(want[i]);
+        if (a !== b)
+            return a > b;
+    }
+    return true;
+}
+/** Reasons that wait on a release or a key; the planner reports these. The others are the declaration's own shape. */
+export const COOKIE_DOMAIN_WAITING_REASONS = new Set([
+    'auth below 0.28.0',
+    'the session bind key is not live on the in-app login',
+]);
+/**
+ * The company-wide cookie domain for an org's app-host bindings, or why there is none. A domain is
+ * returned only when the sign-in is in-app with app hosts bound, the org has its own domain, nothing
+ * but estate apps is public under it, the login is a release that binds sessions to the host, and the
+ * bind key is live. A company on a shared domain never gets one: a cookie there would span companies.
+ */
+export function cookieDomainAllowed(input) {
+    const { org, recorded } = input;
+    if (inAppApps(org, recorded).length === 0) {
+        return { domain: null, reason: 'in-app sign-in has no app host bound' };
+    }
+    if (!org.domain)
+        return { domain: null, reason: 'the company has no domain of its own' };
+    // An own org's in-app login app is not given the key by the platform.
+    if (ownsServices(org)) {
+        return { domain: null, reason: 'the company runs its own sign-in' };
+    }
+    const publicApps = org.hosting.entries.some((e) => e.hostnames.length > 0 || e.worker !== undefined || e.workerApp !== undefined);
+    if (publicApps) {
+        return { domain: null, reason: 'a hosted app is public under the company domain' };
+    }
+    if (!authAtLeast(input.authGitRef, MIN_AUTH_FOR_SESSION_BINDING)) {
+        return { domain: null, reason: 'auth below 0.28.0' };
+    }
+    if (!input.bindKeyReady) {
+        return { domain: null, reason: 'the session bind key is not live on the in-app login' };
+    }
+    return { domain: org.domain };
+}
+/** The fixed line the planner reports while a cookie domain waits on the login. */
+export function cookieDomainWaitingLine(slug, reason) {
+    return `${slug}'s company-wide sign-in cookie waits: ${reason}`;
+}

package/dist/plan/desktop-auth.d.ts

@@ -0,0 +1,58 @@
+import { type DeclaredOrg } from '../org.js';
+import { type AgoraHostValues, DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, desktopAuthInternalName, desktopAuthUpstream } from './agora.js';
+import type { DraftStep } from './diff.js';
+export { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, desktopAuthInternalName, desktopAuthUpstream, };
+/**
+ * #440: Agora's desktop sign-in backend (`apps/desktop-auth` of the agora repo), one internal app per
+ * company on its Postgres server's `desktop_auth` home. Agora proxies `/auth/desktop/*` to it. Its own
+ * secrets (cookie, handoff key) live in its env only and are generated once.
+ */
+export declare const DESKTOP_AUTH_DOCKERFILE = "/apps/desktop-auth/Dockerfile";
+export declare const DESKTOP_AUTH_HOME = "desktop_auth";
+/** The digest of the non-secret env last written; a changed hostname, issuer or id plans the step again. */
+export declare const DESKTOP_AUTH_REVISION_SCOPE_KEY = "coolify_desktop_auth_revision";
+/** The Agora origin the app was last written for (CLAUDE.md rule 3: the applied hostname is a scope id). */
+export declare const DESKTOP_AUTH_ORIGIN_SCOPE_KEY = "coolify_desktop_auth_origin";
+/** The callback URI last put on Agora's client, or `unsupported:<uri>` when the providers client cannot. */
+export declare const DESKTOP_AUTH_REDIRECT_SCOPE_KEY = "coolify_desktop_auth_redirect";
+/** Recorded once the readiness probe through Agora answered. */
+export declare const DESKTOP_AUTH_READY_SCOPE_KEY = "coolify_desktop_auth_ready";
+/** `https://<agora host>/auth/desktop/callback`. */
+export declare function desktopAuthCallbackUri(agoraOrigin: string): string;
+export declare const desktopAuthOrigin: (org: DeclaredOrg) => string;
+/** The route desktop-auth answers 200 on without a session; foundry probes it through Agora. */
+export declare const DESKTOP_AUTH_READY_PATH = "/auth/desktop/error";
+export declare const desktopAuthRedirectUnsupported: (uri: string) => string;
+/** The values both the plan and the executor derive the env from. */
+export interface DesktopAuthInputs {
+    origin: string;
+    issuer: string;
+    clientId: string;
+    organisationId: string;
+    projectId: string;
+    mailProjectId: string;
+    filesProjectId: string | null;
+}
+/** The inputs from the host values and recorded ids, and the names of those still missing. */
+export declare function desktopAuthInputs(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, rawHost: AgoraHostValues): {
+    inputs: DesktopAuthInputs | null;
+    missing: string[];
+};
+/** The env that is not a secret and not a connection URL. `APP_URL` is the origin with its slash: the app refuses any other form. */
+export declare function desktopAuthEnv(inputs: DesktopAuthInputs, runtimeRole: string): Record<string, string>;
+export declare function desktopAuthRevision(env: Readonly<Record<string, string>>): string;
+/**
+ * The `coolify:desktop-auth` step. Planned when the app is not recorded, when the env it was written for
+ * differs (a rename moves the origin), when it never ran healthy, when the callback URI is not on Agora's
+ * client, and when Agora carries the upstream but the readiness probe never answered. Not planned while
+ * Agora is blocked (its own line says why) or while the `desktop_auth` home cannot exist yet (blocked).
+ * `homePlanned` is true when the databases step in this plan creates the home.
+ */
+export declare function planDesktopAuth(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, input: {
+    host: AgoraHostValues | null;
+    liveAgoraEnv: Readonly<Record<string, string>> | null;
+    homePlanned: boolean;
+}): {
+    step: DraftStep | null;
+    blocked: string | null;
+};

package/dist/plan/desktop-auth.js

@@ -0,0 +1,144 @@
+import { createHash } from 'node:crypto';
+import { ORG_SERVICE_SCHEMAS, orgServiceDatabase } from '../org.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor, desktopAuthInternalName, desktopAuthUpstream, withRecordedMessagingProject, } from './agora.js';
+import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
+export { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, desktopAuthInternalName, desktopAuthUpstream, };
+/**
+ * #440: Agora's desktop sign-in backend (`apps/desktop-auth` of the agora repo), one internal app per
+ * company on its Postgres server's `desktop_auth` home. Agora proxies `/auth/desktop/*` to it. Its own
+ * secrets (cookie, handoff key) live in its env only and are generated once.
+ */
+export const DESKTOP_AUTH_DOCKERFILE = '/apps/desktop-auth/Dockerfile';
+export const DESKTOP_AUTH_HOME = 'desktop_auth';
+/** The digest of the non-secret env last written; a changed hostname, issuer or id plans the step again. */
+export const DESKTOP_AUTH_REVISION_SCOPE_KEY = 'coolify_desktop_auth_revision';
+/** The Agora origin the app was last written for (CLAUDE.md rule 3: the applied hostname is a scope id). */
+export const DESKTOP_AUTH_ORIGIN_SCOPE_KEY = 'coolify_desktop_auth_origin';
+/** The callback URI last put on Agora's client, or `unsupported:<uri>` when the providers client cannot. */
+export const DESKTOP_AUTH_REDIRECT_SCOPE_KEY = 'coolify_desktop_auth_redirect';
+/** Recorded once the readiness probe through Agora answered. */
+export const DESKTOP_AUTH_READY_SCOPE_KEY = 'coolify_desktop_auth_ready';
+/** `https://<agora host>/auth/desktop/callback`. */
+export function desktopAuthCallbackUri(agoraOrigin) {
+    return `${agoraOrigin}/auth/desktop/callback`;
+}
+export const desktopAuthOrigin = (org) => `https://${agoraHostnameFor(org)}`;
+/** The route desktop-auth answers 200 on without a session; foundry probes it through Agora. */
+export const DESKTOP_AUTH_READY_PATH = '/auth/desktop/error';
+export const desktopAuthRedirectUnsupported = (uri) => `unsupported:${uri}`;
+/** The inputs from the host values and recorded ids, and the names of those still missing. */
+export function desktopAuthInputs(org, recorded, rawHost) {
+    const host = withRecordedMessagingProject(rawHost, recorded);
+    const clientId = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    const organisationId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    const missing = [];
+    if (!host.issuer)
+        missing.push('issuer');
+    if (!clientId)
+        missing.push('clientId');
+    if (!organisationId)
+        missing.push('zitadelOrgId');
+    if (!host.messagingProjectId)
+        missing.push('messagingProjectId');
+    if (!host.mailProjectId)
+        missing.push('mailProjectId');
+    if (missing.length > 0 || !host.issuer || !clientId || !organisationId) {
+        return { inputs: null, missing };
+    }
+    return {
+        inputs: {
+            origin: desktopAuthOrigin(org),
+            issuer: host.issuer,
+            clientId,
+            organisationId,
+            projectId: host.messagingProjectId,
+            mailProjectId: host.mailProjectId,
+            filesProjectId: recorded[ZITADEL_FILES_PROJECT_SCOPE_KEY] ?? null,
+        },
+        missing,
+    };
+}
+/** The env that is not a secret and not a connection URL. `APP_URL` is the origin with its slash: the app refuses any other form. */
+export function desktopAuthEnv(inputs, runtimeRole) {
+    return {
+        APP_URL: `${inputs.origin}/`,
+        AUTH_ISSUER: inputs.issuer,
+        AUTH_CLIENT_ID: inputs.clientId,
+        AUTH_ORGANIZATION_ID: inputs.organisationId,
+        AUTH_PROJECT_ID: inputs.projectId,
+        MAIL_PROJECT_ID: inputs.mailProjectId,
+        ...(inputs.filesProjectId ? { FILES_PROJECT_ID: inputs.filesProjectId } : {}),
+        DESKTOP_AUTH_RUNTIME_ROLE: runtimeRole,
+        PORT: DESKTOP_AUTH_PORT,
+    };
+}
+export function desktopAuthRevision(env) {
+    const sorted = Object.entries(env).sort(([a], [b]) => (a < b ? -1 : 1));
+    return createHash('sha256').update(JSON.stringify(sorted)).digest('hex').slice(0, 16);
+}
+/** The desktop-auth runtime role's name; the plan needs it for the revision before any URL exists. */
+function runtimeRoleFor(org) {
+    const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === DESKTOP_AUTH_HOME);
+    if (!home)
+        throw new Error('the desktop_auth home is missing from the topology');
+    return orgServiceDatabase(org, home).runtimeRole;
+}
+/**
+ * The `coolify:desktop-auth` step. Planned when the app is not recorded, when the env it was written for
+ * differs (a rename moves the origin), when it never ran healthy, when the callback URI is not on Agora's
+ * client, and when Agora carries the upstream but the readiness probe never answered. Not planned while
+ * Agora is blocked (its own line says why) or while the `desktop_auth` home cannot exist yet (blocked).
+ * `homePlanned` is true when the databases step in this plan creates the home.
+ */
+export function planDesktopAuth(org, recorded, input) {
+    if (!input.host)
+        return { step: null, blocked: null };
+    const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === DESKTOP_AUTH_HOME);
+    if (!home || (!recorded[home.scopeKey] && !input.homePlanned)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s desktop sign-in service is blocked, not planned: its database on the company Postgres server is not recorded yet`,
+        };
+    }
+    const { inputs } = desktopAuthInputs(org, recorded, input.host);
+    const callback = desktopAuthCallbackUri(desktopAuthOrigin(org));
+    const redirect = recorded[DESKTOP_AUTH_REDIRECT_SCOPE_KEY];
+    const blocked = recorded[DESKTOP_AUTH_APP_SCOPE_KEY] && redirect === desktopAuthRedirectUnsupported(callback)
+        ? `${org.slug}'s Agora client lacks the desktop callback ${callback}: the providers client cannot change redirect URIs; add it by hand in ZITADEL or update @wtfalch/providers, then remove the recorded key ${DESKTOP_AUTH_REDIRECT_SCOPE_KEY}`
+        : null;
+    const revision = inputs ? desktopAuthRevision(desktopAuthEnv(inputs, runtimeRoleFor(org))) : null;
+    const upstreamLive = Boolean(input.liveAgoraEnv?.AGORA_DESKTOP_AUTH_UPSTREAM);
+    const reasons = [];
+    if (!recorded[DESKTOP_AUTH_APP_SCOPE_KEY])
+        reasons.push('provision');
+    else {
+        if (revision && recorded[DESKTOP_AUTH_REVISION_SCOPE_KEY] !== revision)
+            reasons.push('env');
+        if (!recorded[DESKTOP_AUTH_DEPLOYED_SCOPE_KEY])
+            reasons.push('never ran healthy');
+        if (redirect !== callback && !blocked)
+            reasons.push('callback URI not on the Agora client');
+        if (upstreamLive && !recorded[DESKTOP_AUTH_READY_SCOPE_KEY])
+            reasons.push('not probed');
+    }
+    if (reasons.length === 0)
+        return { step: null, blocked };
+    return {
+        step: {
+            action: {
+                system: 'coolify',
+                kind: 'desktop-auth',
+                key: org.id,
+                desired: { host: input.host, agoraOrigin: desktopAuthOrigin(org) },
+            },
+            step: {
+                description: reasons[0] === 'provision'
+                    ? `provision ${org.slug}'s desktop sign-in service`
+                    : `update ${org.slug}'s desktop sign-in service (${reasons.join('; ')})`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked,
+    };
+}

package/dist/plan/desktop-callback.d.ts

@@ -0,0 +1,26 @@
+import type { DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { LiveResource } from './live.js';
+/**
+ * #339: the desktop app signs in through the company's web app, so every
+ * `@wtfalch/auth` web client foundry makes registers this path beside
+ * `/auth/callback`. Agora's own client (`/callback`) is not one of them.
+ */
+export declare const DESKTOP_CALLBACK_PATH = "/auth/desktop/callback";
+export declare function desktopCallbackUri(host: string): string;
+/** The URIs to add to an app's current list: current first, then each wanted one it lacks. */
+export declare function unionRedirectUris(current: readonly string[], wanted: readonly string[]): string[];
+/**
+ * The ZITADEL app id of company app `appKey` once its desktop callback was
+ * registered. `planDesktopCallbacks` names an app while its recorded id
+ * differs, so an app made before the callback existed, or made again under a
+ * new id, is repaired once.
+ */
+export declare function zitadelAppDesktopCallbackAppliedScopeKey(appKey: string): string;
+/**
+ * One `zitadel:desktop-callback` step names every live web sign-in app whose
+ * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * client lacks the two redirect URI calls (`wired`), before the org and
+ * project are recorded, or while the platform's sign-in is not ready.
+ */
+export declare function planDesktopCallbacks(org: DeclaredOrg, live: readonly LiveResource[], recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], authReady: boolean, wired: boolean): DraftStep | null;

package/dist/plan/desktop-callback.js

@@ -0,0 +1,59 @@
+/**
+ * #339: the desktop app signs in through the company's web app, so every
+ * `@wtfalch/auth` web client foundry makes registers this path beside
+ * `/auth/callback`. Agora's own client (`/callback`) is not one of them.
+ */
+export const DESKTOP_CALLBACK_PATH = '/auth/desktop/callback';
+export function desktopCallbackUri(host) {
+    return `https://${host}${DESKTOP_CALLBACK_PATH}`;
+}
+/** The URIs to add to an app's current list: current first, then each wanted one it lacks. */
+export function unionRedirectUris(current, wanted) {
+    return [...new Set([...current, ...wanted])];
+}
+/**
+ * The ZITADEL app id of company app `appKey` once its desktop callback was
+ * registered. `planDesktopCallbacks` names an app while its recorded id
+ * differs, so an app made before the callback existed, or made again under a
+ * new id, is repaired once.
+ */
+export function zitadelAppDesktopCallbackAppliedScopeKey(appKey) {
+    return `zitadel_app_desktop_callback_applied.${appKey}`;
+}
+/** The fixed Agora client keeps its own `/callback`; it is not built on `@wtfalch/auth`. */
+const NO_DESKTOP_CALLBACK_APPS = new Set(['agora']);
+/**
+ * One `zitadel:desktop-callback` step names every live web sign-in app whose
+ * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * client lacks the two redirect URI calls (`wired`), before the org and
+ * project are recorded, or while the platform's sign-in is not ready.
+ */
+export function planDesktopCallbacks(org, live, recordedIds, plannedSteps, authReady, wired) {
+    if (!wired || !authReady || !recordedIds.zitadel_org || !recordedIds.zitadel_project)
+        return null;
+    const apps = live
+        .filter((r) => r.system === 'zitadel' &&
+        r.kind === 'app' &&
+        r.config.appType === 'web' &&
+        !NO_DESKTOP_CALLBACK_APPS.has(r.key))
+        .map((r) => r.key)
+        // An app this plan recreates gets its marker when it is made.
+        .filter((appKey) => !plannedSteps.some((s) => s.action.system === 'zitadel' &&
+        s.action.kind === 'app' &&
+        s.action.key === appKey &&
+        s.action.desired.recreate === true))
+        .filter((appKey) => {
+        const appId = recordedIds[`zitadel:app:${appKey}`];
+        return (Boolean(appId) && recordedIds[zitadelAppDesktopCallbackAppliedScopeKey(appKey)] !== appId);
+    });
+    if (apps.length === 0)
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'desktop-callback', key: org.id, desired: { apps } },
+        step: {
+            description: `register the desktop sign-in callback for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}

package/dist/plan/diff.d.ts

@@ -2,7 +2,7 @@ import type { DeclaredOrg, OrgId, OrgServiceSchema } from '../org.js';
 import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.js';
 import { type AgoraHostReading } from './agora.js';
 import { type BlueGreenServer } from './blue-green.js';
-import type { LiveResource } from './live.js';
+import { type LiveResource } from './live.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
 import { type RemoteDatabaseFacts } from './remote-database.js';
 /**
@@ -49,10 +49,16 @@ export interface PlanOrgOptions {
     oikosZoneReady?: boolean;
     /** #267: the executor was built with a `loginHostBindings` port. */
     loginHostBindings?: boolean;
+    /** The `loginHostBindings` port writes the `clientOrganizations` map (577). */
+    loginHostClientOrganizations?: boolean;
     /** A live read said the org's login host serves OIDC discovery as `https://<host>`. Absent: not read, so Agora keeps the platform issuer. */
     loginHostServesDiscovery?: boolean;
     /** The executor's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`; without it `planIdTokenUserinfo` plans nothing. */
     zitadelIdTokenUserinfo?: boolean;
+    /** The executor's ZITADEL client has `updateOidcAppPostLogoutRedirectUris`; without it `planPostLogoutUris` plans nothing. */
+    zitadelPostLogoutUris?: boolean;
+    /** The executor's ZITADEL client has `getOidcAppRedirectUris` and `updateOidcAppRedirectUris` (providers 0.12.0); without them `planDesktopCallbacks` plans nothing. */
+    zitadelRedirectUris?: boolean;
     /** The executor's ZITADEL client has `ensureOidcAppMcpAccess` and `ensureAccessTokenLifetime`; without them `planMcp` is blocked. */
     zitadelMcp?: boolean;
     /** The executor's ZITADEL client has `setOrgMetadata` and `removeOrgMetadata`; without them the customers organisation's sign-in metadata is reported blocked. */
@@ -203,9 +209,10 @@ export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]
 export declare function isPlatformOwnOrg(org: Pick<DeclaredOrg, 'id'>, platformOwnerOrgId: string | null): boolean;
 /**
  * What {@link planOrgPostgres} reports about the org's one shared Postgres
- * server and its fixed schema topology (#444a, "manifest-and-plan-only"):
- * missing only, nothing applied. Deliberately **not** folded into
- * `plannedSteps` -- the same reason {@link VersionChangeItem} (`../plan.ts`)
+ * server and its fixed schema topology (#444a). Since #444 `planOrgPostgresSteps`
+ * turns it into `coolify:org-postgres` and `coolify:org-postgres-databases` steps; this
+ * report stays. The old note below on why it was **not** folded into
+ * `plannedSteps` is kept for the history -- the same reason {@link VersionChangeItem} (`../plan.ts`)
  * never is, restated in `computePlanDetail`'s own doc comment below, but
  * sharper here: `plan-apply.ts`'s `runSteps` executes every
  * `detail.plannedSteps` entry through `StepExecutor.execute`, which
@@ -236,6 +243,8 @@ export interface OrgPostgresPlan {
      * it as part of the full topology.
      */
     missingSchemas: readonly OrgServiceSchema[];
+    /** Homes whose data is still in a legacy Coolify database. Empty for a new company. Informational; a step exists only after the confirmation. */
+    legacyUnmigrated: readonly OrgServiceSchema[];
 }
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";