@wtfalch/foundry 0.45.1 → 0.46.0

package/dist/plan/diff.js

@@ -1,30 +1,37 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { planBlueGreen } from './blue-green.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, desiredBouleEnv, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
 import { planCompanyBackups } from './company-backups.js';
+import { COOKIE_DOMAIN_WAITING_REASONS, LOGIN_COOKIE_DOMAIN_SCOPE_KEY, MIN_AUTH_FOR_CLIENT_ORGS, authAtLeast, cookieDomainAllowed, cookieDomainWaitingLine, } from './cookie-domain.js';
+import { DESKTOP_AUTH_HOME, planDesktopAuth } from './desktop-auth.js';
+import { planDesktopCallbacks } from './desktop-callback.js';
 import { onPlatformNetwork } from './destinations.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
 import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
+import { APP_GONE_KIND } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, agoraIssuerHostFor, clientOrganizationsState, companyLoginTunnelHost, customersClientOrganizations, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
 import { planMcp } from './mcp.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
+import { planOrgPostgresMigration } from './org-postgres-migrate.js';
+import { legacyUnmigrated, orgPostgresUndeliveredScopeKey, planOrgPostgresSteps, serviceOnServer, } from './org-postgres.js';
 import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, OWN_SIGNIN_DB_MOVE_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, planSigninDbMove, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
 import { ownHostnames } from './own-hostnames.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSecretAvailability, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
+import { companyAppPostLogoutUris, postLogoutUpdateOwed, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryRoutes, entryRoutesMarker, } from './proxy-labels.js';
 import { planRemoteDatabase } from './remote-database.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
@@ -234,14 +241,24 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
-    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false, platformReadiness.signInLoginReady ?? false);
+    const loginHost = planLoginHost(org, recordedIds, {
+        authReady: platformReadiness.authReady,
+        issuerPlanned: issuer.step !== null,
+        bindingsWired: options.loginHostBindings ?? false,
+        signInLoginReady: platformReadiness.signInLoginReady ?? false,
+        gates: {
+            authGitRef: platformReadiness.serviceGitRefs?.auth ?? '',
+            bindKeyReady: platformReadiness.signInBindKeyReady ?? false,
+            clientOrganizationsPort: options.loginHostClientOrganizations ?? false,
+        },
+    });
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
-    // #444a: the org's one shared Postgres server and its fixed schema
-    // topology -- dependent on nothing else planned here, but its own
-    // `OrgPostgresPlan`, never `plannedSteps` ({@link OrgPostgresPlan}'s own
-    // doc comment says why).
+    // #444: the org's one shared Postgres server and its databases. They need
+    // nothing else planned here; the report stays on `OrgPostgresPlan` too.
     const orgPostgres = planOrgPostgres(org, recordedIds);
+    const orgPostgresSteps = planOrgPostgresSteps(org, orgPostgres);
+    const orgPostgresMigration = planOrgPostgresMigration(org, recordedIds, orgPostgres.legacyUnmigrated);
     // Planned ahead of everything that needs the zone live (#238); its own step
     // is pushed just below, before mail.
     const zone = planZone(org, byKey, claimed);
@@ -254,7 +271,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #555: steps that write DNS records, which go through edge.
     const dnsBlocked = [];
     // #553: a ZITADEL app provision whose app id is recorded needs the typed confirmation.
-    const guardApp = (step) => guardAppProvision(step, org, recordedIds);
+    const appBlocked = [];
+    const guardApp = (step) => guardAppProvision(step, org, recordedIds, byKey, claimed, appBlocked);
     // #567: before the first step that reads the zone (mail, the tunnel, the
     // rate limit), so a domain with no zone yet gets it provisioned first.
     const zoneReason = zone.step ? edgeNeeded(platformReadiness, ['zones']) : null;
@@ -444,7 +462,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // string into the app's environment once the database exists -- it can
     // only do that if the database step already ran and recorded the
     // database's resource id.
-    const database = planDatabase(org, byKey, claimed);
+    const database = planDatabase(org, byKey, claimed, recordedIds);
     if (database)
         plannedSteps.push(database);
     const authIssuer = 'error' in agoraHost ? null : agoraHost.issuer;
@@ -548,6 +566,18 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null, platformReadiness, bouleCredentials.wants);
     if (boule.step)
         plannedSteps.push(boule.step);
+    // Boule owners, after the Boule step: needs the app deployed and the seeding secret in its env.
+    const bouleOwners = planBouleOwners(org, recordedIds, (byKey.get(resourceKey('coolify', 'boule', org.id))?.config.env ?? null));
+    if (bouleOwners.seed.length > 0) {
+        plannedSteps.push({
+            action: { system: 'coolify', kind: 'boule-owners', key: org.id, desired: {} },
+            step: {
+                description: `seed ${org.slug}'s declared owners into its Boule`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
     // After the apps and Boule -- an edge key needs its app recorded or planned,
     // the same dependency `planEntryAiKeys`/`planFilesKeys` have.
     const entryEdgeKeys = planEntryEdgeKeys(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)());
@@ -557,6 +587,17 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleBroker = planBouleBrokerEntry(org, recordedIds, plannedSteps, options.broker ?? false);
     if (bouleBroker.step)
         plannedSteps.push(bouleBroker.step);
+    // #440: Agora's desktop sign-in backend, after Agora and Boule: its readiness probe goes through Agora's proxy, and
+    // Agora writes the upstream only once the service ran healthy (so a first apply needs a second to turn it on).
+    const desktopAuth = planDesktopAuth(org, recordedIds, {
+        host: agora.host ?? null,
+        liveAgoraEnv: agora.liveEnv ?? null,
+        homePlanned: orgPostgresSteps.some((s) => s.action.kind === 'org-postgres-databases' &&
+            (s.action.desired.homes ?? []).includes(DESKTOP_AUTH_HOME)),
+    });
+    claimed.add(resourceKey('coolify', 'desktop-auth', org.id));
+    if (desktopAuth.step)
+        plannedSteps.push(desktopAuth.step);
     // An own org's scheduler, before its registration below.
     const ownJobs = planOwnJobs({
         org,
@@ -661,6 +702,15 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const idTokenUserinfo = planIdTokenUserinfo(org, live, recordedIds, plannedSteps, platformReadiness.authReady, options.zitadelIdTokenUserinfo ?? false);
     if (idTokenUserinfo)
         plannedSteps.push(idTokenUserinfo);
+    const postLogoutUris = planPostLogoutUris(org, live, recordedIds, plannedSteps, platformReadiness.authReady, options.zitadelPostLogoutUris ?? false);
+    if (postLogoutUris)
+        plannedSteps.push(postLogoutUris);
+    const desktopCallbacks = planDesktopCallbacks(org, live, recordedIds, plannedSteps, platformReadiness.authReady, options.zitadelRedirectUris ?? false);
+    if (desktopCallbacks)
+        plannedSteps.push(desktopCallbacks);
+    // #444, last: a Postgres step that fails must not stop the zone, mail, app, Agora and Boule steps of a live company.
+    plannedSteps.push(...orgPostgresSteps);
+    plannedSteps.push(...orgPostgresMigration.steps);
     // #10 (resolved): "foundry manages only what the declared org names";
     // anything left unclaimed is listed, never proposed for deletion.
     // A resource foundry made for the org is not a finding: only a resource
@@ -682,6 +732,16 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         .map((r) => ({
         description: `${r.system} ${r.kind} "${liveResourceName(r)}" is live but not named by the declared org`,
     }));
+    // A password the job set but nothing delivered: the step is still planned, it sets and delivers a new one.
+    for (const home of orgPostgres.missingSchemas) {
+        if (recordedIds[orgPostgresUndeliveredScopeKey(home.schema)]) {
+            unmanaged.push({
+                description: `${org.slug}'s ${home.schema} database password was set but not delivered; the next apply sets and delivers a new one`,
+                key: `org-postgres-undelivered:${org.slug}:${home.schema}`,
+            });
+        }
+    }
+    unmanaged.push(...orgPostgresMigration.unmanaged);
     // A blocked Agora is reported here, not planned: a step the executor must
     // refuse would halt every step after it. This is the plan's one non-step
     // item list, so it rides along with the unmanaged items.
@@ -689,8 +749,14 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         unmanaged.push({ description: agora.blocked, key: 'coolify:agora' });
     if (agora.issuerNote)
         unmanaged.push({ description: agora.issuerNote, key: 'coolify:agora' });
+    if (desktopAuth.blocked) {
+        unmanaged.push({ description: desktopAuth.blocked, key: 'coolify:desktop-auth' });
+    }
     if (boule.blocked)
         unmanaged.push({ description: boule.blocked, key: 'coolify:boule' });
+    for (const line of bouleOwners.blocked) {
+        unmanaged.push({ description: line, key: 'coolify:boule-owners' });
+    }
     for (const description of bouleCredentials.blocked) {
         unmanaged.push({ description, key: 'coolify:boule:credentials' });
     }
@@ -762,6 +828,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     if (loginHost.blocked) {
         unmanaged.push({ description: loginHost.blocked, key: 'zitadel:login-host' });
     }
+    for (const note of loginHost.notes)
+        unmanaged.push({ description: note, key: 'zitadel:login-host' });
     if (mail.blocked)
         unmanaged.push({ description: mail.blocked, key: 'coolify:mail' });
     // #162: reported separately from `mail.blocked` -- missing an owner
@@ -793,6 +861,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         unmanaged.push({ description: zone.blocked, key: 'cloudflare:zone' });
     unmanaged.push(...zoneBlocked);
     unmanaged.push(...dnsBlocked);
+    unmanaged.push(...appBlocked);
     // A legacy email-list Access app is no longer planned or removed: an operator deletes it by hand.
     const legacyAccessKey = resourceKey('cloudflare', 'access', appStepKey(org, APP_ENTRY_KEY));
     if (recordedIds[legacyAccessKey]) {
@@ -848,6 +917,7 @@ const NEEDS_OWN_ZITADEL = new Set([
     'zitadel:app',
     'zitadel:customers',
     'zitadel:id-token-userinfo',
+    'zitadel:desktop-callback',
     'zitadel:login-host',
     'coolify:chat',
     'coolify:calls-service',
@@ -857,17 +927,19 @@ const NEEDS_OWN_ZITADEL = new Set([
     'files:organisation',
 ]);
 /**
- * #553: a plain ZITADEL app provision (not a `recreate`) is planned only when
- * the live listing lacks the app by name. If an app id is recorded for it,
- * the listing may simply have missed a live app, and nothing can read an app
- * by id, so applying silently could replace a live sign-in client. The way
- * out is the destroying `recreate` path: the step is planned as a
- * replacement that asks for the typed confirmation, so a person who has
- * checked the app is gone (deleted by hand in ZITADEL) says so, and apply
- * then deletes the recorded id (a 404 is fine) and creates a new app.
- * (A failed recreate clears the recorded id, so it is not caught here.)
+ * #553, #557: a plain ZITADEL app provision (not a `recreate`) is planned only
+ * when the live listing lacks the app by name. If an app id is recorded for
+ * it, the listing may simply have missed a live app. The replacement is
+ * offered only when the reader proved the app gone with a direct read by app
+ * id (a live `zitadel:app-gone:<name>` resource, see
+ * `ProvidersZitadelReader`); without that proof the step is blocked and
+ * nothing is planned. With the proof, the way out is the destroying
+ * `recreate` path: the step is planned as a replacement that asks for the
+ * typed confirmation, then apply deletes the recorded id (a 404 is fine) and
+ * creates a new app. (A failed recreate clears the recorded id, so it is not
+ * caught here.)
  */
-function guardAppProvision(step, org, recordedIds) {
+function guardAppProvision(step, org, recordedIds, byKey, claimed, blocked) {
     if (!step || step.action.system !== 'zitadel' || step.action.kind !== 'app')
         return step;
     if (step.action.desired.recreate === true)
@@ -875,10 +947,19 @@ function guardAppProvision(step, org, recordedIds) {
     const recorded = recordedIds[`zitadel:app:${step.action.key}`];
     if (!recorded)
         return step;
+    const goneKey = resourceKey('zitadel', APP_GONE_KIND, step.action.key);
+    if (!byKey.has(goneKey)) {
+        blocked.push({
+            description: `${org.slug}'s ZITADEL app '${step.action.key}' is blocked, not planned: recorded app ${recorded} is not in ZITADEL's listing, and a direct read of it did not answer not-found, so it may be live (a listing can miss a live app)`,
+            key: `zitadel:app:${step.action.key}`,
+        });
+        return null;
+    }
+    claimed.add(goneKey);
     return {
         action: { ...step.action, desired: { ...step.action.desired, recreate: true } },
         step: {
-            description: `replace ZITADEL app '${step.action.key}' for ${org.slug}: recorded app ${recorded} is not in ZITADEL's listing (a listing can miss a live app; if it is live, do not confirm -- apply deletes it and creates a new client id)`,
+            description: `replace ZITADEL app '${step.action.key}' for ${org.slug}: recorded app ${recorded} is not in ZITADEL's listing and a direct read answered not-found`,
             destroys: true,
             migrates: false,
         },
@@ -1113,6 +1194,14 @@ function planOwners(org, recordedIds, authReady, authIssuer, ownerInviteMail, re
             });
             return;
         }
+        const nameProblem = ownerNameProblem(mailboxAddress, owner.givenName, owner.familyName);
+        if (nameProblem) {
+            blocked.push({
+                description: `${org.slug}'s owner ${position} is blocked, not planned: ${nameProblem}`,
+                key: `zitadel:owner:${position}`,
+            });
+            return;
+        }
         if (!ownerInviteMail) {
             blocked.push({
                 description: `${org.slug}'s owner ${position} is blocked, not planned: the host has no ownerInviteMail port, and the owner cannot open their work mailbox yet`,
@@ -1149,48 +1238,55 @@ function planOwners(org, recordedIds, authReady, authIssuer, ownerInviteMail, re
 export function isPlatformOwnOrg(org, platformOwnerOrgId) {
     return Boolean(platformOwnerOrgId && org.id === platformOwnerOrgId);
 }
-/**
- * #267: the org's own company login host (`login-host.ts`'s
- * `loginHostnameFor`) -- `auth.<domain>` once the org has one,
- * `<slug>-auth.oikos.host` for tier 1. Idempotent on the *recorded*
- * resource id, the same shape `planOwners` above uses and for the same
- * reason: `ZitadelReader.listResources` has no notion of a trusted domain
- * or a login binding, so there is nothing in `live` this step could ever
- * claim or compare against.
- *
- * Unlike `planOwners`, a re-run is not simply "already done or not": the
- * recorded value is compared against {@link loginHostnameFor}'s own value
- * for *this* apply, so an org moving from tier 1 onto its own domain (or
- * losing one) replans this step rather than staying silent forever once
- * first applied -- `executor.ts`'s `zitadelLoginHost` then also moves every
- * already-live app onto the new base URI, and (#274) removes the *old* host
- * from ZITADEL's trusted domains and zitadel-login's binding, reading it
- * back from this same recorded value before overwriting it -- no separate
- * action field or planning step of its own needed for that half. Mints
- * nothing either way: adding a trusted domain is not a one-time secret, so
- * there is no "undelivered"
- * guard to check the way `planJobsRegistration`'s own does.
- *
- * Ordered right after `planOwners` (not after mail, chat, or any hosting
- * step), for the same reason `planOwners`'s own doc comment gives: on a
- * first-ever apply the ZITADEL org this step's executor needs
- * (`context.recordedIds().zitadel_org`) has already been recorded by the
- * issuer step two steps before it in the same run, and this step itself
- * runs well before `planIssuerApps`/`planCmsClient`/`planAgoraClient`
- * create any app under the org's project -- #267's own "before any app's
- * issuer application".
- *
- * `platformAuthHostname` (#488) is threaded through to {@link
- * loginHostnameFor} so the platform's own org, declared with-domain on the
- * platform's own domain, never plans the shared ZITADEL instance's own login
- * host as its own -- `auth.companyincluded.com` colliding with itself.
- */
-function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, signInLoginReady = false) {
+function planLoginHost(org, recordedIds, options) {
+    const gates = options.gates ?? {
+        authGitRef: '',
+        bindKeyReady: false,
+        clientOrganizationsPort: false,
+    };
+    const core = planLoginHostCore(org, recordedIds, {
+        authReady: options.authReady,
+        issuerPlanned: options.issuerPlanned,
+        bindingsWired: options.bindingsWired,
+        signInLoginReady: options.signInLoginReady ?? false,
+        gates,
+    });
+    return { ...core, notes: loginHostNotes(org, recordedIds, gates) };
+}
+/** Fixed lines for what the login host cannot yet do: the organisation check (577) and the cookie domain (795). */
+function loginHostNotes(org, recordedIds, gates) {
+    const notes = [];
+    const mapped = Object.keys(customersClientOrganizations(org, recordedIds)).length > 0;
+    if (mapped && !authAtLeast(gates.authGitRef, MIN_AUTH_FOR_CLIENT_ORGS)) {
+        notes.push(`${org.slug}: the shared login host does not yet check customers clients' organisation: auth <${MIN_AUTH_FOR_CLIENT_ORGS}`);
+    }
+    else if (mapped && !ownsServices(org) && !gates.clientOrganizationsPort) {
+        notes.push(`${org.slug}: the shared login host does not yet check customers clients' organisation: the host cannot write the map`);
+    }
+    const cookie = cookieDomainAllowed({
+        org,
+        recorded: recordedIds,
+        authGitRef: gates.authGitRef,
+        bindKeyReady: gates.bindKeyReady,
+    });
+    if (cookie.domain === null && COOKIE_DOMAIN_WAITING_REASONS.has(cookie.reason)) {
+        notes.push(cookieDomainWaitingLine(org.slug, cookie.reason));
+    }
+    return notes;
+}
+/** True when the recorded organisation map differs from the wanted one and a port can write it. */
+function clientOrganizationsOwed(org, recordedIds, writable) {
+    return (writable &&
+        clientOrganizationsState(customersClientOrganizations(org, recordedIds)) !==
+            (recordedIds[LOGIN_CLIENT_ORGS_SCOPE_KEY] ?? ''));
+}
+function planLoginHostCore(org, recordedIds, options) {
+    const { authReady, issuerPlanned, bindingsWired, signInLoginReady, gates } = options;
     const none = { step: null, blocked: null };
     // An own org's instance has no shared login host to bind: its issuer is the sign-in service's own.
     // Only in-app sign-in plans a step for it: the app hosts, through its own in-app login app.
     if (ownsServices(org))
-        return planOwnLoginHost(org, recordedIds);
+        return planOwnLoginHost(org, recordedIds, gates);
     const key = resourceKey('zitadel', 'login-host', org.id);
     const host = loginHostnameFor(org);
     // In-app sign-in: each app host gets its own binding, trusted domain and base URI. Until the second
@@ -1200,6 +1296,23 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     const inAppWaiting = wantedApps.length > 0 && !signInLoginReady
         ? `${org.slug}'s in-app sign-in waits for the login app that serves ${SIGN_IN_BASE_PATH} (${SIGN_IN_LOGIN_INTERNAL_NAME}), which the platform has not applied`
         : null;
+    const targets = inAppTargets(apps, recordedIds);
+    const authReleased = authAtLeast(gates.authGitRef, MIN_AUTH_FOR_CLIENT_ORGS);
+    const cookie = cookieDomainAllowed({
+        org,
+        recorded: recordedIds,
+        authGitRef: gates.authGitRef,
+        bindKeyReady: gates.bindKeyReady,
+    });
+    const cookieDomain = targets.active !== '' && cookie.domain !== null ? cookie.domain : '';
+    const settled = recordedIds[key] === host &&
+        (recordedIds[LOGIN_COOKIE_DOMAIN_SCOPE_KEY] ?? '') === cookieDomain &&
+        !clientOrganizationsOwed(org, recordedIds, gates.clientOrganizationsPort) &&
+        recordedIds[LOGIN_BINDING_SCOPE_KEY] ===
+            loginBindingState(host, loginHostClientIds(org, recordedIds, inAppStatePairs(targets.active).map((pair) => pair.clientId))) &&
+        (recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
+        (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active;
+    const owed = pendingRemovalHosts(recordedIds);
     function stepFor() {
         return {
             step: {
@@ -1207,14 +1320,20 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
                     system: 'zitadel',
                     kind: 'login-host',
                     key: org.id,
-                    desired: apps.length > 0 ||
-                        recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ||
-                        recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY]
-                        ? { host, apps }
-                        : { host },
+                    desired: {
+                        ...(apps.length > 0 ||
+                            recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ||
+                            recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY]
+                            ? { host, apps }
+                            : { host }),
+                        ...(authReleased ? { authReleased: true } : {}),
+                        ...(cookieDomain ? { cookieDomain } : {}),
+                    },
                 },
                 step: {
-                    description: `set ${org.slug}'s login host to ${host}`,
+                    description: settled && owed.length > 0
+                        ? `retire ${org.slug}'s old login host ${owed.join(', ')} and record ${host}`
+                        : `set ${org.slug}'s login host to ${host}`,
                     destroys: false,
                     migrates: false,
                 },
@@ -1228,13 +1347,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // `zitadelLoginHost` always advances the recorded host to the current one,
     // so a pending removal is the only way to know one is still owed, and
     // nothing else here would replan the step to retry it.
-    const targets = inAppTargets(apps, recordedIds);
-    if (recordedIds[key] === host &&
-        recordedIds[LOGIN_BINDING_SCOPE_KEY] ===
-            loginBindingState(host, loginHostClientIds(org, recordedIds, inAppStatePairs(targets.active).map((pair) => pair.clientId))) &&
-        (recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
-        (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
-        pendingRemovalHosts(recordedIds).length === 0) {
+    if (settled && owed.length === 0) {
         return { step: null, blocked: inAppWaiting };
     }
     // #177: nothing to add a trusted domain to yet -- `planIssuer` already
@@ -1254,10 +1367,11 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
  * applied and that login app is recorded; until then one blocked line says what it waits for.
  * Archon's host is not here: the platform's Archon step owns it.
  */
-function planOwnLoginHost(org, recordedIds) {
+function planOwnLoginHost(org, recordedIds, gates) {
     const none = { step: null, blocked: null };
+    const mapOwed = clientOrganizationsOwed(org, recordedIds, true);
     // Nothing wanted and nothing owed.
-    if (!inAppSignIn(org) && !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY])
+    if (!inAppSignIn(org) && !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] && !mapOwed)
         return none;
     // The company's own sign-in is reported on its own line (`coolify:own-auth`).
     if (!ownAuthApplied(org, recordedIds))
@@ -1273,19 +1387,31 @@ function planOwnLoginHost(org, recordedIds) {
     const targets = inAppTargets(apps, recordedIds);
     if ((recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
         (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
+        !mapOwed &&
         pendingRemovalHosts(recordedIds).length === 0) {
         return { step: null, blocked: waiting };
     }
     // Nothing to trust a domain in, or to bind in, before the org exists in the company's ZITADEL.
-    if (!recordedIds.zitadel_org)
-        return { step: null, blocked: waiting };
+    if (!recordedIds.zitadel_org) {
+        return {
+            step: null,
+            blocked: waiting ??
+                `${org.slug}'s in-app sign-in waits for the company's ZITADEL organisation, which is not recorded yet`,
+        };
+    }
     return {
         step: {
             action: {
                 system: 'zitadel',
                 kind: 'login-host',
                 key: org.id,
-                desired: { host, apps },
+                desired: {
+                    host,
+                    apps,
+                    ...(authAtLeast(gates.authGitRef, MIN_AUTH_FOR_CLIENT_ORGS)
+                        ? { authReleased: true }
+                        : {}),
+                },
             },
             step: {
                 description: `set ${org.slug}'s app hosts to sign in on their own addresses`,
@@ -1335,6 +1461,46 @@ function planIdTokenUserinfo(org, live, recordedIds, plannedSteps, authReady, wi
         },
     };
 }
+/**
+ * Every live `@wtfalch/auth` web app (not Agora, which signs out locally) holds
+ * its root and `/auth/signed-out` as post-logout addresses. One
+ * `zitadel:post-logout-uris` step names the apps whose marker
+ * ({@link zitadelAppPostLogoutAppliedScopeKey}: id and set) differs from what
+ * the declared org wants, so a client made with only the root, or a host
+ * change, is updated once and the next plan is clean. Plans nothing when the
+ * host's ZITADEL client lacks the method, before the org and project are
+ * recorded, or while the platform's sign-in is not ready.
+ */
+function planPostLogoutUris(org, live, recordedIds, plannedSteps, authReady, wired) {
+    if (!wired || !authReady || !recordedIds.zitadel_org || !recordedIds.zitadel_project)
+        return null;
+    const apps = live
+        .filter((r) => r.system === 'zitadel' && r.kind === 'app' && r.config.appType === 'web')
+        .map((r) => r.key)
+        .filter((appKey) => appKey !== 'agora')
+        // An app this plan recreates gets its marker when it is made.
+        .filter((appKey) => !plannedSteps.some((s) => s.action.system === 'zitadel' &&
+        s.action.kind === 'app' &&
+        s.action.key === appKey &&
+        s.action.desired.recreate === true))
+        .filter((appKey) => {
+        const appId = recordedIds[`zitadel:app:${appKey}`];
+        const uris = companyAppPostLogoutUris(org, appKey);
+        return (Boolean(appId) &&
+            uris.length > 0 &&
+            postLogoutUpdateOwed(recordedIds[zitadelAppPostLogoutAppliedScopeKey(appKey)], appId, uris));
+    });
+    if (apps.length === 0)
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'post-logout-uris', key: org.id, desired: { apps } },
+        step: {
+            description: `update the post-logout addresses of ${org.slug}'s sign-in apps (${apps.join(', ')})`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /** Why a login-host step cannot run yet, or `null` when nothing is missing. */
 function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) {
     if (!bindingsWired) {
@@ -1374,6 +1540,7 @@ function orgServiceSchemaEnabled(org, schema) {
         return org.calls.enabled;
     if (schema.schema === 'app')
         return org.hosting.entries.some(entryHasDatabase);
+    // Agora always plans (planAgora): desktop-auth shares its gate, so it is on like Boule.
     return true;
 }
 /**
@@ -1395,6 +1562,7 @@ function planOrgPostgres(org, recordedIds) {
     return {
         serverMissing: !recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY],
         missingSchemas: ORG_SERVICE_SCHEMAS.filter((schema) => orgServiceSchemaEnabled(org, schema) && !recordedIds[schema.scopeKey]),
+        legacyUnmigrated: ORG_SERVICE_SCHEMAS.filter((schema) => orgServiceSchemaEnabled(org, schema) && legacyUnmigrated(org, schema, recordedIds)),
     };
 }
 /** #230: restated from `executor.ts`'s `MAIL_ROLE_MAILBOXES_SCOPE_KEY`, same rule: comma-joined local parts already created. */
@@ -2566,6 +2734,7 @@ function planAgora(org, byKey, claimed, recordedIds, reading, issuerSwitch) {
             },
             blocked: null,
             issuerNote,
+            host,
         };
     }
     const liveEnv = (live.config.env ?? {});
@@ -2594,7 +2763,7 @@ function planAgora(org, byKey, claimed, recordedIds, reading, issuerSwitch) {
     // planned no matter what Coolify's env store already shows.
     const activated = recordedIds[AGORA_ACTIVATED_ENV_SCOPE_KEY] === agoraEnvRevision(env);
     if (drift.length === 0 && activated && !portDrift) {
-        return { step: null, blocked: null, issuerNote };
+        return { step: null, blocked: null, issuerNote, host, liveEnv };
     }
     const reasons = [
         ...(drift.length > 0 ? [`${drift.join(', ')} missing or different`] : []),
@@ -2613,6 +2782,8 @@ function planAgora(org, byKey, claimed, recordedIds, reading, issuerSwitch) {
         },
         blocked: null,
         issuerNote,
+        host,
+        liveEnv,
     };
 }
 /** The issuer a live Agora's `AGORA_CONFIG` names, or null when it has none or is not JSON. */
@@ -2829,6 +3000,8 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         drift.push(BOULE_PEER_PASSWORD_ENV);
     if (platformOwner && !liveEnv[BOULE_BRIDGE_SECRET_ENV])
         drift.push(BOULE_BRIDGE_SECRET_ENV);
+    if (!liveEnv[BOULE_OWNER_SEED_SECRET_ENV])
+        drift.push(BOULE_OWNER_SEED_SECRET_ENV);
     // Secrets written but Boule not restarted since: plan the step so it restarts, minting nothing.
     if (platformOwner && !recordedIds[BOULE_SECRETS_RESTARTED_SCOPE_KEY]) {
         drift.push('restart after the peer password and bridge secret');
@@ -3145,8 +3318,10 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     // names (`envNames` absent) reads as compliant, like `hasLogVolume`.
     const envNames = live.config.envNames;
     const dbLive = byKey.get(resourceKey('coolify', 'database', org.id));
-    const dbReady = entry.database && Boolean(recordedIds[`coolify:database:${org.id}`]);
-    if (dbReady && dbLive?.config.hasInternalUrl === false) {
+    const appHome = ORG_SERVICE_SCHEMAS.find((home) => home.schema === 'app');
+    const dbOnServer = appHome !== undefined && serviceOnServer(org, appHome, recordedIds);
+    const dbReady = entry.database && (dbOnServer || Boolean(recordedIds[`coolify:database:${org.id}`]));
+    if (!dbOnServer && dbReady && dbLive?.config.hasInternalUrl === false) {
         // Rule 2: the push cannot succeed yet, so report it rather than replan
         // forever.
         blocked.push({
@@ -3157,7 +3332,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     else if (dbReady &&
         // Only a read that saw the URL replans: an unread database (a failed
         // read) would plan a step that pushes nothing, forever.
-        dbLive?.config.hasInternalUrl === true &&
+        (dbOnServer || dbLive?.config.hasInternalUrl === true) &&
         ((Array.isArray(envNames) && !envNames.includes('DATABASE_URL_OWNER')) ||
             // A crash between the push and the restart leaves the env right and no
             // marker: replan once more to restart and set it.
@@ -3450,7 +3625,19 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
  * `hosting.enabled` before this can be true. Same park-not-delete shape as
  * {@link planApp}.
  */
-function planDatabase(org, byKey, claimed) {
+function planDatabase(org, byKey, claimed, recordedIds) {
+    // #444: only a company whose app database is still its own Coolify database
+    // plans one. A new company, and one that has moved, has it on its Postgres
+    // server: recorded, or provisioned by a step earlier in this plan.
+    // A Worker app's database is reached through the Coolify database's id (its Hyperdrive route
+    // and tunnel), so a Worker app entry with a database always plans that database.
+    const workerAppDatabase = org.hosting.entries.some((entry) => entry.workerApp?.database);
+    const appHome = ORG_SERVICE_SCHEMAS.find((home) => home.schema === 'app');
+    const legacy = appHome?.legacyKey(org);
+    if (!workerAppDatabase &&
+        (!appHome || !legacy || !recordedIds[legacy] || serviceOnServer(org, appHome, recordedIds))) {
+        return null;
+    }
     return planHostingToggle('coolify', 'database', org.hosting.entries.some(entryHasDatabase), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
 }
 function sortedNames(names) {
@@ -3874,7 +4061,7 @@ function planBouleBrokerEntry(org, recordedIds, plannedSteps, brokerWired) {
 }
 /**
  * Plan gap A9: an org's customers sign in through a second ZITADEL org with
- * self-registration on, granted the org's app project. Planned once an entry
+ * self-registration open only when `customers.signUp` is declared (off by default), granted the org's app project. Planned once an entry
  * signs in its customers (`uses.auth.users: 'customers'`).
  * Idempotent on the recorded customers org id, like `planOwners`. Once
  * recorded, the live project grant to that org is claimed so it is not
@@ -4038,7 +4225,8 @@ function accessRuleDescription(org, rule) {
  * time this step's own action runs.
  */
 function planRateLimit(org, recordedIds) {
-    if (!(org.hosting.usesDomain || org.site.enabled) || !org.domain)
+    // In-app sign-in serves `/sign-in/` on the company's zone whatever else is hosted there, so it is limited too.
+    if (!(org.hosting.usesDomain || org.site.enabled || inAppSignIn(org)) || !org.domain)
         return null;
     // Recorded, and the rule is the variant the switch asks for (the in-app one also covers POSTs under `/sign-in/`).
     if (recordedIds[resourceKey('cloudflare', 'ratelimit', org.id)] &&