@wtfalch/foundry 0.46.0 → 0.47.0

package/dist/plan/diff.js

@@ -1,5 +1,5 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, heldEnvRef, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { planBlueGreen } from './blue-green.js';
@@ -3161,7 +3161,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     // right now, and gating this on `mailHost` let a platform-apex org with an
     // already-recorded domain take the unprotected path the moment platform
     // mail went back to off.
-    if (entryKey === APP_ENTRY_KEY) {
+    if (entryKey === mainEntry(org.hosting)?.key) {
         const mailDomain = recordedIds[MAIL_DOMAIN_SCOPE_KEY];
         const platformApex = readiness.platformApex;
         const platformLettermintProjectId = readiness.platformLettermintProjectId;
@@ -3473,6 +3473,7 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
         .map((id) => id.slice(`coolify:app:${org.id}:`.length));
     const declared = new Set([APP_ENTRY_KEY, ...org.hosting.entries.map((e) => e.key)]);
     const keys = new Set([...declared, ...recordedKeys]);
+    const mainKey = mainEntry(org.hosting)?.key;
     for (const key of keys) {
         if (!declared.has(key)) {
             // The reader gives a parked app no `enabled` field, so only a running
@@ -3508,14 +3509,14 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
                 app.step.action.desired = { ...app.step.action.desired, authIssuer };
         }
         // #491: only the `app` entry's own step runs `ensureAppLettermintMail`
-        // (`executor.ts`'s own `entry.key === APP_ENTRY_KEY` gate). Unlike
+        // (`executor.ts`'s own `isMainEntry(entry)` gate). Unlike
         // `secretSources`/`authIssuer` above, these two are set unconditionally
         // -- `null` when no platform is declared, never omitted -- because
         // `executor.ts` treats the key being *absent* as a stale plan predating
         // this field and refuses to run (review round 2, finding 3): an omitted
         // key here would read identically to a stale plan and silently fall
         // back to the unprotected pre-#491 path instead.
-        if (key === APP_ENTRY_KEY && app.step && app.step.action.desired.enabled !== false) {
+        if (key === mainKey && app.step && app.step.action.desired.enabled !== false) {
             app.step.action.desired = {
                 ...app.step.action.desired,
                 platformApex: readiness.platformApex,
@@ -3527,7 +3528,7 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
         // edge: blocked, not planned, while edge is not applied.
         const appReason = edgeNeeded(readiness, ['zones', 'dns']);
         if (appReason &&
-            key === APP_ENTRY_KEY &&
+            key === mainKey &&
             app.step &&
             app.step.action.desired.enabled !== false &&
             recordedIds[MAIL_DOMAIN_SCOPE_KEY]) {

package/dist/plan/executor.js

@@ -4,7 +4,7 @@ import { URL } from 'node:url';
 import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appEntry, filesCollectionEnvName, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, filesCollectionEnvName, heldEnvRef, isMainEntry, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
@@ -211,7 +211,7 @@ export function callsHostnameFor(org) {
  */
 export function healthUrls(org) {
     // One URL per entry that has a public name; an internal entry has none.
-    if (org.hosting.enabled && appEntry(org.hosting)) {
+    if (org.hosting.enabled && org.hosting.entries.length > 0) {
         return org.hosting.entries.flatMap((entry) => {
             const [hostname] = entryHostnames(org, entry);
             if (!hostname)
@@ -3298,7 +3298,7 @@ export class FoundryStepExecutor {
         // actually resolved a mail domain for this org.
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
-        if (entry.key === APP_ENTRY_KEY) {
+        if (isMainEntry(entry)) {
             await this.ensureAppLettermintMail(appId, org, context, 
             // Deployed or started above on every path, a created app included
             // (#566), so it has read its env before the mail env is written.
@@ -3718,10 +3718,8 @@ export class FoundryStepExecutor {
     async pushAppEnv(appId, org, entry, context, authIssuer, secretSources) {
         const recorded = context.recordedIds();
         const envs = [
-            // Only the `app` entry has a public name; the others are internal.
-            ...(entry.key === APP_ENTRY_KEY
-                ? [{ key: 'APP_URL', value: `https://${appHostname(org)}` }]
-                : []),
+            // Only the main entry has a public name; the others are internal.
+            ...(isMainEntry(entry) ? [{ key: 'APP_URL', value: `https://${appHostname(org)}` }] : []),
             // #75: read back by the package-side pino sink (not this repo's job,
             // #75 "What belongs where") once `ensureLogVolume` has mounted the
             // matching volume.
@@ -4203,7 +4201,9 @@ export class FoundryStepExecutor {
         const { org, context, mailDomain, self, mailFrom } = args;
         const appName = `${org.slug}-app`;
         const recorded = context.recordedIds();
-        const appId = self.role === 'app' ? self.id : recorded[`coolify:app:${appStepKey(org)}`];
+        const appId = self.role === 'app'
+            ? self.id
+            : recorded[`coolify:app:${appStepKey(org, mainEntry(org.hosting)?.key)}`];
         const bouleId = self.role === 'boule' ? self.id : recorded[`coolify:boule:${org.id}`];
         const peerListEnvs = (id) => !id || id === self.id
             ? Promise.resolve(null)

package/dist/plan/health-targets.js

@@ -1,4 +1,3 @@
-import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
@@ -187,7 +186,7 @@ function hostingEntryTarget(org, entry) {
  * differently-written version of the same choice.
  */
 function appTargets(org) {
-    if (org.hosting.enabled && appEntry(org.hosting)) {
+    if (org.hosting.enabled && org.hosting.entries.length > 0) {
         return org.hosting.entries.map((entry) => hostingEntryTarget(org, entry));
     }
     if (org.site.enabled) {

package/dist/plan/hostnames.d.ts

@@ -1,7 +1,7 @@
 import type { DeclaredOrg, HostingEntry } from '../org.js';
 /**
  * The full names an entry is served at. With `hosting.usesDomain` off, or no
- * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * domain, `hostnames` is not read: the main entry is at `<slug>.oikos.host`
  * and every other entry is internal. `'*'` names nothing here; the wildcard is
  * acted on elsewhere.
  */
@@ -10,7 +10,7 @@ export declare function entryHostnames(org: DeclaredOrg, entry: HostingEntry): s
  * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
  * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
  * under `oikos.host`, so the free Universal certificate covers it), and
- * `<slug>.oikos.host` for the entry keyed `app`.
+ * `<slug>.oikos.host` for the main entry.
  */
 export declare function workerAppHostname(org: DeclaredOrg, entry: HostingEntry): string;
 /**

package/dist/plan/hostnames.js

@@ -1,10 +1,10 @@
-import { APP_ENTRY_KEY } from '../org.js';
+import { isMainEntry, mainEntry } from '../org.js';
 import { workerAppHostnameOf } from '../worker-app-config.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 /**
  * The full names an entry is served at. With `hosting.usesDomain` off, or no
- * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * domain, `hostnames` is not read: the main entry is at `<slug>.oikos.host`
  * and every other entry is internal. `'*'` names nothing here; the wildcard is
  * acted on elsewhere.
  */
@@ -13,7 +13,7 @@ export function entryHostnames(org, entry) {
     if (entry.workerApp)
         return [workerAppHostname(org, entry)];
     if (!org.hosting.usesDomain || !domain) {
-        return entry.key === APP_ENTRY_KEY ? [`${org.slug}.oikos.host`] : [];
+        return isMainEntry(entry) ? [`${org.slug}.oikos.host`] : [];
     }
     return entry.hostnames.flatMap((name) => name === '*' ? [] : name === '@' ? [domain] : [`${name}.${domain}`]);
 }
@@ -21,10 +21,10 @@ export function entryHostnames(org, entry) {
  * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
  * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
  * under `oikos.host`, so the free Universal certificate covers it), and
- * `<slug>.oikos.host` for the entry keyed `app`.
+ * `<slug>.oikos.host` for the main entry.
  */
 export function workerAppHostname(org, entry) {
-    return workerAppHostnameOf({ slug: org.slug, domain: org.domain, usesDomain: org.hosting.usesDomain }, entry.key, entry.workerApp?.host ?? '@');
+    return workerAppHostnameOf({ slug: org.slug, domain: org.domain, usesDomain: org.hosting.usesDomain }, entry, entry.workerApp?.host ?? '@');
 }
 /**
  * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
@@ -43,7 +43,7 @@ export function wildcardHostname(org) {
  * and the jobs registration read it.
  */
 export function appHostname(org) {
-    const entry = org.hosting.entries.find((e) => e.key === APP_ENTRY_KEY);
+    const entry = mainEntry(org.hosting);
     const first = entry ? entryHostnames(org, entry)[0] : undefined;
     return first ?? legacyAppHostname(org);
 }

package/dist/plan/index.d.ts

@@ -24,7 +24,7 @@ export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCO
 export type { OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
 export { OrgPostgresMigrationBackupMissingError } from './backup-gate.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
 export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';

package/dist/plan/index.js

@@ -11,7 +11,7 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.
 export { AdoptRefusedError } from './adopt.js';
 export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, } from './org-postgres-migrate.js';
 export { OrgPostgresMigrationBackupMissingError } from './backup-gate.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan-apply.js';
 export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';

package/dist/plan/plan-apply.d.ts

@@ -1,5 +1,5 @@
 import type { DestroyProgress, PlanApply } from '../apply.js';
-import type { DeclaredOrg, OrgId } from '../org.js';
+import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { ReleaseStore } from '../release/state.js';
@@ -443,6 +443,18 @@ export declare class PlatformConfirmationRequiredError extends Error {
 export interface FoundryApplyOptions {
     /** Service names (`VersionChangeItem.service`), matched exactly, whose version change the operator confirmed. */
     confirmUpgrade?: readonly string[];
+    /**
+     * A company's own confirmation for one of its apps, in place of the org's name. `apply` passes a
+     * destroying or migrating step only when {@link stepEntryKey} says it belongs to `entryKey` and
+     * `typed` equals `entryKey` exactly. Every other such step still needs the org's name, as does
+     * the whole plan when `typed` differs. It never passes a platform step.
+     */
+    entryConfirmation?: {
+        entryKey: string;
+        typed: string;
+        /** The removed entry's gate keys, read by the caller from the company before the change. */
+        gates?: readonly string[];
+    };
 }
 export interface FoundryPlanApplyOptions {
     store: DeclaredOrgStore;
@@ -947,3 +959,20 @@ export declare class FoundryPlanApply implements PlanApply {
  * than a second copy that could drift from it.
  */
 export declare function planNeedsConfirmation(steps: readonly PlanStep[]): boolean;
+/**
+ * The key of the hosting entry a step belongs to, or `null` for a step of the org or the platform.
+ * An entry's own steps are keyed `<orgId>:<entry key>` (its Coolify app, Worker, Worker app, and
+ * ai, edge and files keys); with `orgId` the prefix must be exactly that id. With `entries` (the
+ * declared ones) two more are known: the ZITADEL sign-in client named like an entry that declares
+ * `uses.auth`, and a gate named in an entry's `gates`. The org database, the org-wide files key,
+ * the customers organisation and the issuer belong to no entry. (`apply` lets an entry's
+ * confirmation pass the park of the org database once no declared entry uses a database.)
+ */
+export declare function stepEntryKey(step: {
+    action: Pick<StepAction, 'system' | 'kind' | 'key'>;
+}, orgId?: string, entries?: readonly Pick<HostingEntry, 'key' | 'uses' | 'gates'>[]): string | null;
+/** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
+export declare function entryConfirms(confirmation: FoundryApplyOptions['entryConfirmation'], steps: readonly {
+    step: PlanStep;
+    action: StepAction;
+}[], orgId: string, entries: readonly HostingEntry[]): boolean;

package/dist/plan/plan-apply.js

@@ -5,6 +5,7 @@ import { ORG_SERVICE_SCHEMAS, heldEnvRef, ownsServices, validateHosting } from '
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
 import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
+import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
@@ -577,7 +578,8 @@ export class FoundryPlanApply {
                 }
             }
             if (planNeedsConfirmation(plan.steps) &&
-                confirmedOrgName.trim() !== org.displayName.trim()) {
+                confirmedOrgName.trim() !== org.displayName.trim() &&
+                !entryConfirms(options.entryConfirmation, detail.plannedSteps, org.id, org.hosting.entries)) {
                 await this.refuse(plan, "destructive or migrating step without the org's name typed correctly");
                 throw new ConfirmationRequiredError(orgId);
             }
@@ -1859,6 +1861,73 @@ export class FoundryPlanApply {
 export function planNeedsConfirmation(steps) {
     return steps.some((step) => step.destroys || step.migrates);
 }
+/**
+ * The key of the hosting entry a step belongs to, or `null` for a step of the org or the platform.
+ * An entry's own steps are keyed `<orgId>:<entry key>` (its Coolify app, Worker, Worker app, and
+ * ai, edge and files keys); with `orgId` the prefix must be exactly that id. With `entries` (the
+ * declared ones) two more are known: the ZITADEL sign-in client named like an entry that declares
+ * `uses.auth`, and a gate named in an entry's `gates`. The org database, the org-wide files key,
+ * the customers organisation and the issuer belong to no entry. (`apply` lets an entry's
+ * confirmation pass the park of the org database once no declared entry uses a database.)
+ */
+export function stepEntryKey(step, orgId, entries = []) {
+    const { system, kind, key } = step.action;
+    if (system === 'zitadel' && kind === 'app') {
+        return entries.find((e) => e.key === key && e.uses?.auth)?.key ?? null;
+    }
+    const entryOwned = (system === 'coolify' && kind === 'app') ||
+        (system === 'cloudflare' && (kind === 'worker' || kind === 'worker-app' || kind === 'gate')) ||
+        (kind === 'key' && (system === 'ai' || system === 'edge' || system === 'files'));
+    if (!entryOwned)
+        return null;
+    const colon = key.indexOf(':');
+    if (colon < 1)
+        return null;
+    const prefix = key.slice(0, colon);
+    if (orgId === undefined ? prefix === 'platform' : prefix !== orgId)
+        return null;
+    const rest = key.slice(colon + 1);
+    if (rest === '' || rest.includes(':'))
+        return null;
+    if (kind === 'gate')
+        return entries.find((e) => e.gates?.some((g) => g.key === rest))?.key ?? null;
+    return rest;
+}
+/**
+ * The step that parks the org's one database. It belongs to the org, not to an entry, but the
+ * entry that removes the last use of it may confirm it (see `entryConfirms`).
+ */
+function isOrgDatabasePark(step, orgId) {
+    const { system, kind, key } = step.action;
+    return system === 'coolify' && kind === 'database' && key === orgId && step.step.destroys;
+}
+/**
+ * The delete of one of the org's gates that no entry declares any more. The step names only the
+ * gate, so the caller names the removed entry's gates (`entryConfirmation.gates`) and only those pass.
+ */
+function isUndeclaredGateDelete(step, orgId) {
+    const { system, kind, key, desired } = step.action;
+    return (system === 'cloudflare' &&
+        kind === 'gate' &&
+        key.startsWith(`${orgId}:`) &&
+        desired?.mode === 'delete');
+}
+/** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
+export function entryConfirms(confirmation, steps, orgId, entries) {
+    if (!confirmation ||
+        confirmation.entryKey === '' ||
+        confirmation.typed !== confirmation.entryKey) {
+        return false;
+    }
+    return steps
+        .filter(({ step }) => step.destroys || step.migrates)
+        .every((planned) => stepEntryKey(planned, orgId, entries) === confirmation.entryKey ||
+        (isOrgDatabasePark(planned, orgId) && !entries.some(entryHasDatabase)) ||
+        (isUndeclaredGateDelete(planned, orgId) &&
+            !planned.step.migrates &&
+            (confirmation.gates ?? []).includes(planned.action.key.slice(orgId.length + 1)) &&
+            !entries.some((e) => e.key === confirmation.entryKey)));
+}
 /** `AppliedState.serviceIds`' two flat ZITADEL scope keys (`executor.ts`'s `ensureZitadelProject`/`zitadelIssuer`) -- no `:`, unlike a resource key. */
 const ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_project';
 const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';

package/dist/plan/platform-providers.js

@@ -3892,6 +3892,9 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'reporting-collect', path: '/api/reporting/collect' },
     { name: 'org-changes', path: '/api/orgs/*/changes' },
     { name: 'org-settings', path: '/api/orgs/*/settings' },
+    { name: 'org-apps', path: '/api/orgs/*/apps' },
+    { name: 'org-requests', path: '/api/orgs/*/requests' },
+    { name: 'github-releases', path: '/api/github/releases' },
 ];
 const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
 const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;

package/dist/plan/providers-readers.js

@@ -280,12 +280,23 @@ async function withBouleEnvConfig(client, resource, recorded, liveKeys) {
     // Boule must hold too. In memory only, compared by `planBoule` and never
     // written to a step, description or log.
     const orgId = recorded[resource.key]?.slice('boule:'.length);
-    const appUuid = Object.entries(recorded).find(([, value]) => value === `app:${orgId}:${APP_ENTRY_KEY}`)?.[0];
+    // The token sits on the org's main app, whatever its key; the reader does not know the
+    // declaration, so it tries the `app` entry first and then each other recorded app.
+    const appPrefix = `app:${orgId}:`;
+    const appUuids = Object.entries(recorded)
+        .filter(([, value]) => value.startsWith(appPrefix))
+        .sort(([, a], [, b]) => Number(b === `${appPrefix}${APP_ENTRY_KEY}`) - Number(a === `${appPrefix}${APP_ENTRY_KEY}`))
+        .map(([uuid]) => uuid);
     // A recorded app that is not in the live listing is gone: no app token, and
     // no read of its envs. A listed app whose read fails fails like any read.
-    const appToken = appUuid && liveKeys.has(appUuid)
-        ? (await client.listEnvs(appUuid)).find((e) => !e.is_preview && e.key === BOULE_MAIL_TOKEN_ENV)?.value
-        : undefined;
+    let appToken;
+    for (const appUuid of appUuids) {
+        if (!liveKeys.has(appUuid))
+            continue;
+        appToken = (await client.listEnvs(appUuid)).find((e) => !e.is_preview && e.key === BOULE_MAIL_TOKEN_ENV)?.value;
+        if (appToken)
+            break;
+    }
     return {
         ...resource,
         config: { ...resource.config, env, ...(appToken ? { appMailToken: appToken } : {}) },

package/dist/plan/worker-app.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { WORKER_APP_HYPERDRIVE_BINDING, WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHostId, } from '../worker-app-config.js';
+import { WORKER_APP_HYPERDRIVE_BINDING, WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
 import { entryAuthEnv } from './broker-entries.js';
 import { workerAppHostname } from './hostnames.js';
 import { appStepKey } from './platform-diff.js';
@@ -315,6 +315,8 @@ export function planWorkerApps(org, recordedIds, input) {
             description: `${at} is blocked, not planned: ${why}`,
             key,
         });
+        if (!workerAppHasBuild(app))
+            continue;
         if (!input.available) {
             block('the host supplies no WorkerAppPort');
             continue;

package/dist/refuse-org.d.ts

@@ -0,0 +1,7 @@
+import { type DeclaredOrg, type OrgRefusal } from './org.js';
+/**
+ * The first refusal of the whole-company validation a store write runs for
+ * hosting (every entry, its sign-in included) and customers, or `null`. Locked
+ * names are the org's own; the platform's service names are not known here.
+ */
+export declare function refuseOrg(org: DeclaredOrg): OrgRefusal | null;

package/dist/refuse-org.js

@@ -0,0 +1,10 @@
+import { refuseCustomers, refuseHosting } from './org.js';
+import { hostingNames } from './plan/locked-hostnames.js';
+/**
+ * The first refusal of the whole-company validation a store write runs for
+ * hosting (every entry, its sign-in included) and customers, or `null`. Locked
+ * names are the org's own; the platform's service names are not known here.
+ */
+export function refuseOrg(org) {
+    return refuseHosting(org.hosting, hostingNames(org, [])) ?? refuseCustomers(org);
+}

package/dist/requested-changes.d.ts

@@ -1,4 +1,5 @@
-import { type DeclaredOrg, type MailMode, type OrgId } from './org.js';
+import type { BuildJson } from './build-json.js';
+import { type CustomersConfig, type DeclaredOrg, type HostingEntry, type MailMode, type OrgId } from './org.js';
 import type { PlanDetail } from './plan/diff.js';
 /**
  * The whitelist of `DeclaredOrg` fields a company's own Boule can request a
@@ -15,7 +16,7 @@ import type { PlanDetail } from './plan/diff.js';
  * lowering or leaving a limit unchanged -- raising either one needs
  * approval too, until a billing field exists to say what the raise costs.
  */
-export type RequestableField = 'calls' | 'customers' | 'storageLimit' | 'aiLimit' | 'domain' | 'mailTier';
+export type RequestableField = 'calls' | 'customers' | 'storageLimit' | 'aiLimit' | 'domain' | 'mailTier' | 'app' | 'build';
 export declare const REQUESTABLE_FIELDS: readonly RequestableField[];
 /** Turn the org's own calls Matrix stack (`org.ts`'s `CallsConfig.enabled`) on or off. */
 export interface CallsChange {
@@ -52,12 +53,34 @@ export interface MailTierChange {
     field: 'mailTier';
     mode: MailMode;
 }
+/**
+ * Put or remove one hosting entry of the company's own app (`org.ts`'s `HostingEntry`).
+ * `before` and `after` are the entry as the requester saw it and as it should be (null when absent).
+ * `customers` is the switches after the change when the request changes them, else null.
+ * Archon validates the whole company; {@link classifyChange} does not look at the org for this kind.
+ */
+export interface AppChange {
+    field: 'app';
+    key: string;
+    op: 'put' | 'remove';
+    before: HostingEntry | null;
+    after: HostingEntry | null;
+    customers: CustomersConfig | null;
+}
+/** Deploy one release of the company's app from its `build.json` (`build-json.ts`). */
+export interface BuildChange {
+    field: 'build';
+    key: string;
+    repo: string;
+    release: string;
+    build: BuildJson;
+}
 /**
  * One company-requested change to its own declared org, keyed by
  * {@link RequestableField}. `classifyChange` and the store both switch on
  * `.field`.
  */
-export type RequestedChangeValue = CallsChange | CustomersChange | StorageLimitChange | AiLimitChange | DomainChange | MailTierChange;
+export type RequestedChangeValue = CallsChange | CustomersChange | StorageLimitChange | AiLimitChange | DomainChange | MailTierChange | AppChange | BuildChange;
 /**
  * `auto`: nothing further is required -- archon may carry the request
  * straight into a plan and apply it. `approval`: a human must approve the
@@ -72,7 +95,21 @@ export type ChangeClassification = 'auto' | 'approval';
  * onward. Foundry only stores and classifies (#178 "Why"); nothing in this
  * package transitions a state past its initial value.
  */
-export type RequestedChangeState = 'auto' | 'needs_approval' | 'approved' | 'rejected' | 'applied';
+export type RequestedChangeState = 'auto' | 'needs_approval' | 'approved' | 'rejected' | 'applied' | 'applying' | 'failed';
+/** Why an `app` or `build` request is `failed`. */
+export type FailureCode = 'replaced' | 'refused' | 'busy' | 'timed_out' | 'apply_error';
+/** Who asked: a person in Boule, or a release build. `requestedBy` keeps the raw principal id for audit. */
+export type RequestedBy = {
+    via: 'boule';
+    person: {
+        id: string;
+        name: string;
+    };
+} | {
+    via: 'build';
+    repo: string;
+    release: string;
+};
 /**
  * One company-requested change to its own declared org, as stored --
  * `migrations/0017_requested_changes.sql`'s `foundry_requested_changes`
@@ -85,6 +122,15 @@ export interface RequestedChange {
     requestedBy: string;
     createdAt: string;
     state: RequestedChangeState;
+    /** Null for rows made before `app` and `build` requests. */
+    requester: RequestedBy | null;
+    idempotencyKey: string | null;
+    reason: {
+        code: FailureCode;
+        message: string;
+        replacedBy?: number;
+    } | null;
+    updatedAt: string;
 }
 /**
  * Thrown by {@link classifyChange} (and by the requested-change store's

package/dist/requested-changes.js

@@ -1,4 +1,4 @@
-import { validateCustomers } from './org.js';
+import { validateCustomers, } from './org.js';
 export const REQUESTABLE_FIELDS = [
     'calls',
     'customers',
@@ -6,6 +6,8 @@ export const REQUESTABLE_FIELDS = [
     'aiLimit',
     'domain',
     'mailTier',
+    'app',
+    'build',
 ];
 /**
  * Thrown by {@link classifyChange} (and by the requested-change store's
@@ -42,6 +44,9 @@ function applyRequestedChange(org, change) {
             return { ...org, domain: change.domain };
         case 'mailTier':
             return { ...org, mail: { ...org.mail, mode: change.mode } };
+        case 'app':
+        case 'build':
+            return org;
     }
 }
 /**
@@ -115,6 +120,9 @@ export function classifyChange(org, change, plan) {
     if (!REQUESTABLE_FIELDS.includes(change.field)) {
         throw new RequestedChangeError(`'${change.field}' is not a requestable field`);
     }
+    // Archon validates the whole company for these; nothing waits for approval.
+    if (change.field === 'app' || change.field === 'build')
+        return 'auto';
     if (change.field === 'customers') {
         validateCustomersChange(change);
         // The org after the change must still pass the rule apply checks, for example open registration

package/dist/store/postgres.d.ts

@@ -1,4 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
+import type { OrgRefusal, OrgRefusalCode } from '../org.js';
 import { type ReleaseStore } from '../release/state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore, type RequestedChangeStore } from '../store.js';
 /**
@@ -38,7 +39,10 @@ export declare function uniqueViolationConstraint(error: unknown): string | unde
  * is that throw.
  */
 export declare class DeclaredOrgError extends Error {
-    constructor(message: string);
+    /** Set when a hosting or customers validator refused the write: which rule, and where in the org. */
+    readonly code?: OrgRefusalCode;
+    readonly path?: string;
+    constructor(message: string, refusal?: Pick<OrgRefusal, 'code' | 'path'>);
 }
 /**
  * `DeclaredOrgStore` (`../store.ts`) on Postgres, for #18: create, read and