@wtfalch/foundry 0.5.0 → 0.7.1

package/dist/migrations/0028_audit_rls.sql

@@ -0,0 +1,111 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: row-level security on audit_events.
+--
+-- Mirrors src/ledger.ts (scopeAuditTenant). Every statement is idempotent.
+-- Applied by the host's own migrate script after the host copies this file
+-- into its drizzle/ directory as the next number (audit-migrations); never
+-- edited there.
+--
+-- Until this file, tenant isolation was only the `tenantId` a caller
+-- remembered to pass to ledger.page(). One missed predicate showed a
+-- customer another company's trail. With RLS on, the database holds the
+-- line for every role that is not the table's owner -- the runtime role
+-- <database>_rt, and any read-only role a host adds:
+--
+--   audit.tenant_id       -- set per transaction by the host
+--                            (scopeAuditTenant, or
+--                            set_config('audit.tenant_id', $1, true)).
+--                            While set, a SELECT sees that tenant's rows and
+--                            nothing else -- not another tenant's, and not
+--                            the estate's own tenant_id-null rows.
+--   audit.require_tenant  -- 'on' makes an unscoped SELECT see nothing
+--                            instead of everything. Set it on a role, once:
+--                              alter role <database>_rt set audit.require_tenant = 'on';
+--                            That is the setting that survives a forgotten
+--                            scope. It is not set here because an operator
+--                            surface reads across tenants on purpose, and
+--                            which role does that is the host's decision.
+--
+-- Unset and not required, a SELECT sees every row, exactly as before this
+-- file: applying it changes nothing for a host until the host scopes.
+--
+-- INSERT is not restricted: a request scoped to one tenant may still record
+-- an estate-level (tenant_id null) event, and the ledger's own vocabulary
+-- checks already decide what may be written. UPDATE and DELETE have no
+-- policy, so they stay refused for the runtime role -- which 0001's revoke
+-- already did.
+--
+-- Not FORCE: the owner, and the security definer functions it owns
+-- (audit_erase_person, audit_seal_erasure, and the two below), bypass RLS.
+-- Erasure is by subject, across tenants, by design.
+
+alter table audit_events enable row level security;
+
+drop policy if exists audit_events_read on audit_events;
+create policy audit_events_read on audit_events
+  for select
+  using (
+    case
+      when coalesce(current_setting('audit.tenant_id', true), '') <> ''
+        then tenant_id is not null
+         and tenant_id = current_setting('audit.tenant_id', true)::uuid
+      when coalesce(current_setting('audit.require_tenant', true), '') = 'on'
+        then false
+      else true
+    end
+  );
+
+drop policy if exists audit_events_append on audit_events;
+create policy audit_events_append on audit_events
+  for insert
+  with check (true);
+
+-- The hash chain is one chain across every tenant. Under a tenant scope the
+-- runtime role can no longer see the true tail, so ledger.sign() with
+-- hashChain on would chain onto that tenant's last row and fork the chain.
+-- This reads the tail as the owner. It returns a hash, never content.
+create or replace function audit_chain_tail()
+returns text
+language sql
+stable
+security definer
+set search_path = pg_catalog, public
+as $$
+  select row_hash from audit_events order by id desc limit 1
+$$;
+revoke all on function audit_chain_tail() from public;
+
+-- The same for ledger.erase()'s pending-erasure sweep, which must find
+-- every tenant's pending rows, scoped or not. Ids, hashes and erasure
+-- instants only.
+create or replace function audit_pending_erasures()
+returns table (id bigint, row_hash text, erased_at timestamptz)
+language sql
+stable
+security definer
+set search_path = pg_catalog, public
+as $$
+  select e.id, e.row_hash, e.erased_at
+    from audit_events e
+   where e.row_hash is not null
+     and e.erased_at is not null
+     and e.erasure_hash is null
+   order by e.id
+$$;
+revoke all on function audit_pending_erasures() from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('grant execute on function audit_chain_tail() to %I', rt);
+    execute format('grant execute on function audit_pending_erasures() to %I', rt);
+  end if;
+end
+$$;

package/dist/org.d.ts

@@ -32,11 +32,61 @@ export type MailMode = 'off' | 'received' | 'hosted';
  * Decided in #7 amendment 1: setting `domain` alone never starts a mail
  * change. `usesDomain` is mail's own field for that, independent of
  * `mode` — a domain can be recorded before mail is ever pointed at it.
+ *
+ * `mailApps`: which ZITADEL apps in the org's audience project may read a
+ * person's mail. Decided by William (2026-09-30, #34): only listed apps
+ * may read a person's mail, and the org's own declared config holds the
+ * list -- ZITADEL puts a project's own id into the default audience of
+ * every app signed in to that project, so a matching `requireAudience`
+ * value alone says nothing about *who* carries it (`manage` had exactly
+ * this hole until it moved to its own project, wtfalch/agora#100;
+ * `operator` has it today, wtfalch/operator#11). `undefined` means the org
+ * declares none of its own and {@link DEFAULT_MAIL_APPS} applies --
+ * optional so every existing declared org, and every test fixture that
+ * builds a `MailConfig` literal, keeps working unchanged; a caller that
+ * cares reads `mail.mailApps ?? DEFAULT_MAIL_APPS`, the same fallback
+ * `plan/mail-identity-allowlist.ts`'s own doc comment names.
  */
 export interface MailConfig {
     mode: MailMode;
     usesDomain: boolean;
+    mailApps?: string[];
+    /**
+     * The owner's mailbox address on this org's mail domain. Decided
+     * 2026-09-29 on #162: nothing is guessed any more, replacing the
+     * hardcoded `owner@<domain>` PR 163 shipped first. `null` (the default)
+     * until an operator names one -- `plan/diff.ts`'s `planMail` then reports
+     * the owner's mailbox alone as blocked, naming this field, while every
+     * other part of the org's mail still applies. Optional so a caller that
+     * builds a `MailConfig` for anything other than the owner's mailbox (most
+     * existing call sites, before this field existed) is unaffected; absent
+     * is treated the same as `null` everywhere this is read.
+     */
+    ownerMailboxAddress?: string | null;
+    /**
+     * The local part of the org's send-only no-reply address (no inbox),
+     * read by `plan/executor.ts`'s `ensureAppLettermintMail` for `MAIL_FROM`.
+     * Defaults to `'no-reply'` when absent -- #162: a localised default via
+     * `@wtfalch/i18n` (a Norwegian company's own word for it, say) is
+     * deferred, since that package has none yet. An operator's own value
+     * always wins once set.
+     */
+    noReplyLocalPart?: string;
+    /**
+     * Local parts of the role mailboxes this org wants pre-created on its mail
+     * domain (#230) -- `postmaster`, `abuse`, `security` and the like. Role
+     * mailboxes have no person behind them, so unlike {@link ownerMailboxAddress}
+     * they are not tied to `owner` and are never invited through the broker.
+     * Foundry holds no default set: every org declares its own. `undefined` or
+     * empty means none. Each name is a local part, not an address, so the
+     * address is always on the org's own resolved mail domain.
+     */
+    roleMailboxes?: string[];
 }
+/** {@link MailConfig.mailApps} when the org declares none of its own (#34, decided 2026-09-30). */
+export declare const DEFAULT_MAIL_APPS: readonly string[];
+/** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
+export declare const DEFAULT_NO_REPLY_LOCAL_PART = "no-reply";
 /**
  * Chat's per-service opt-in into the org's `domain` fact.
  *
@@ -49,6 +99,12 @@ export interface MailConfig {
  * Never fired by `domain` alone (#7 amendment 1).
  */
 export interface ChatConfig {
+    /**
+     * Chat is not in v1 (decided 2026-10-01): off by default for every org.
+     * While off, `apply` plans no chat step and leaves a live chat resource
+     * alone, listed in `unmanaged`; Agora hides all chat and call UI.
+     */
+    enabled: boolean;
     usesDomain: boolean;
 }
 /**
@@ -164,7 +220,25 @@ export interface HostingConfig {
      * means no Access gate. Requires `enabled`.
      */
     accessEmails: string[];
+    /**
+     * Maps the app's own env var name to one of `AppEnvSource`'s values --
+     * each a value the plan already mints for this org (Files, AI, mail) but
+     * never used to push an app's own env (#243). Each bespoke app names these
+     * differently (lokessmie uses `STORAGE_*`/`AI_*`); this is how an org
+     * declares its own app's names for them. `{}` means the app names none of
+     * them, so `pushAppEnv` pushes nothing from this map.
+     */
+    appEnv: Record<string, AppEnvSource>;
 }
+/**
+ * The closed set of values the plan already mints that `HostingConfig.appEnv`
+ * may map an app's env var name to (#243): the org's own Files organisation
+ * id, its AI organisation id, and the mail domain its Lettermint project
+ * sends from. Each is read from `StepExecutionContext.recordedIds()` in
+ * `executor.ts`'s `pushAppEnv`, never minted again there.
+ */
+export type AppEnvSource = 'filesOrganisationId' | 'aiOrganisationId' | 'mailDomain';
+export declare const APP_ENV_SOURCES: ReadonlySet<AppEnvSource>;
 /**
  * `null` when `hosting` is valid; otherwise the reason it is not (#71), same
  * shape as `validateBuyerIdentity` below.
@@ -329,6 +403,37 @@ export interface OwnerIdentity {
  * null` (no owner named yet) is always valid.
  */
 export declare function validateOwner(owner: OwnerIdentity | null): string | null;
+/**
+ * `null` when `mail` is valid; otherwise the reason it is not (#162,
+ * decided 2026-09-29).
+ *
+ * `ownerMailboxAddress`, when set, must be a valid email address; when
+ * `usesDomain` is also true and `domain` is set, it must be on that exact
+ * domain ("validate it is on the org's own domain", #162's "How"). A
+ * level-1 org's mail domain is `<slug>.<platform apex>` -- the platform's
+ * own fact, not this file's -- so that case is left for `plan/diff.ts`'s
+ * `planMail` to resolve and block on, the same way it already resolves
+ * `mailHost` itself.
+ *
+ * Deliberately NOT required just because `mode` is not `'off'`: an org can
+ * have mail on with no address declared yet, same as it can have an owner
+ * named with no ZITADEL invite sent yet -- `planMail` reports the mailbox
+ * alone as blocked in that case rather than this function refusing to let
+ * the org be saved at all (#162 "Done when": "mail on with no owner address
+ * plans a blocked item and still applies the other steps").
+ *
+ * `noReplyLocalPart`, when set, must be non-empty and contain neither `@`
+ * nor whitespace.
+ *
+ * `roleMailboxes`, when set (#230), has only plain local parts (no `@`, `,` or
+ * whitespace) and no duplicate, ignoring case.
+ *
+ * `mailApps`, when set (#34), has no empty entry and no duplicate -- same
+ * two rules `validateHosting` already applies to `issuerApps`' names, for
+ * the same reason: a duplicate or blank entry can never mean anything
+ * different from leaving it out.
+ */
+export declare function validateMail(org: Pick<DeclaredOrg, 'mail' | 'domain'>): string | null;
 /**
  * The form an app foundry does not own takes. Decided in #7's `#15`
  * refinement comment:

package/dist/org.js

@@ -1,3 +1,12 @@
+/** {@link MailConfig.mailApps} when the org declares none of its own (#34, decided 2026-09-30). */
+export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
+/** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
+export const DEFAULT_NO_REPLY_LOCAL_PART = 'no-reply';
+export const APP_ENV_SOURCES = new Set([
+    'filesOrganisationId',
+    'aiOrganisationId',
+    'mailDomain',
+]);
 const ISSUER_APP_KINDS = new Set(['web', 'native', 'api']);
 const HOSTING_BUILD_PACKS = new Set([
     'dockerfile',
@@ -58,6 +67,14 @@ export function validateHosting(hosting) {
             return `issuerApps '${app.name}' is reserved for the always-on Agora client every org gets`;
         }
     }
+    for (const [envName, source] of Object.entries(hosting.appEnv)) {
+        if (!envName) {
+            return 'every appEnv key needs a non-empty env var name';
+        }
+        if (!APP_ENV_SOURCES.has(source)) {
+            return `appEnv '${envName}' has an unknown source '${source}'`;
+        }
+    }
     return null;
 }
 /**
@@ -185,3 +202,87 @@ export function validateOwner(owner) {
         return 'owner.familyName must not be empty';
     return null;
 }
+/** A local part has no `@` and no whitespace -- loose on purpose, the same restraint {@link OWNER_EMAIL_PATTERN}'s own doc comment states. */
+const LOCAL_PART_PATTERN = /^[^\s@]+$/;
+/**
+ * `null` when `mail` is valid; otherwise the reason it is not (#162,
+ * decided 2026-09-29).
+ *
+ * `ownerMailboxAddress`, when set, must be a valid email address; when
+ * `usesDomain` is also true and `domain` is set, it must be on that exact
+ * domain ("validate it is on the org's own domain", #162's "How"). A
+ * level-1 org's mail domain is `<slug>.<platform apex>` -- the platform's
+ * own fact, not this file's -- so that case is left for `plan/diff.ts`'s
+ * `planMail` to resolve and block on, the same way it already resolves
+ * `mailHost` itself.
+ *
+ * Deliberately NOT required just because `mode` is not `'off'`: an org can
+ * have mail on with no address declared yet, same as it can have an owner
+ * named with no ZITADEL invite sent yet -- `planMail` reports the mailbox
+ * alone as blocked in that case rather than this function refusing to let
+ * the org be saved at all (#162 "Done when": "mail on with no owner address
+ * plans a blocked item and still applies the other steps").
+ *
+ * `noReplyLocalPart`, when set, must be non-empty and contain neither `@`
+ * nor whitespace.
+ *
+ * `roleMailboxes`, when set (#230), has only plain local parts (no `@`, `,` or
+ * whitespace) and no duplicate, ignoring case.
+ *
+ * `mailApps`, when set (#34), has no empty entry and no duplicate -- same
+ * two rules `validateHosting` already applies to `issuerApps`' names, for
+ * the same reason: a duplicate or blank entry can never mean anything
+ * different from leaving it out.
+ */
+export function validateMail(org) {
+    const { mail } = org;
+    const address = mail.ownerMailboxAddress ?? null;
+    if (address !== null) {
+        if (!OWNER_EMAIL_PATTERN.test(address)) {
+            return `mail.ownerMailboxAddress '${address}' is not a valid email address`;
+        }
+        if (mail.usesDomain && org.domain) {
+            const addressDomain = address.slice(address.indexOf('@') + 1).toLowerCase();
+            if (addressDomain !== org.domain.toLowerCase()) {
+                return `mail.ownerMailboxAddress '${address}' must be on ${org.domain}`;
+            }
+        }
+    }
+    if (mail.noReplyLocalPart !== undefined && !LOCAL_PART_PATTERN.test(mail.noReplyLocalPart)) {
+        return `mail.noReplyLocalPart '${mail.noReplyLocalPart}' must not be empty or contain '@' or whitespace`;
+    }
+    if (mail.roleMailboxes) {
+        const seen = new Set();
+        const reserved = new Map([
+            [(mail.noReplyLocalPart ?? DEFAULT_NO_REPLY_LOCAL_PART).toLowerCase(), 'no-reply'],
+        ]);
+        if (address !== null)
+            reserved.set(address.slice(0, address.indexOf('@')).toLowerCase(), 'owner');
+        for (const name of mail.roleMailboxes) {
+            if (!LOCAL_PART_PATTERN.test(name) || name.includes(',')) {
+                return `mail.roleMailboxes entry '${name}' must be a non-empty local part without '@', ',' or whitespace`;
+            }
+            if (seen.has(name.toLowerCase())) {
+                return `mail.roleMailboxes name '${name}' is not unique`;
+            }
+            const clash = reserved.get(name.toLowerCase());
+            if (clash) {
+                return `mail.roleMailboxes name '${name}' clashes with the ${clash} mailbox`;
+            }
+            seen.add(name.toLowerCase());
+        }
+    }
+    if (mail.mailApps) {
+        const seen = new Set();
+        for (const name of mail.mailApps) {
+            if (!name) {
+                return 'mail.mailApps entry needs a non-empty name';
+            }
+            if (seen.has(name)) {
+                return `mail.mailApps name '${name}' is not unique`;
+            }
+            seen.add(name);
+        }
+    }
+    return null;
+}

package/dist/plan/agora.d.ts

@@ -13,6 +13,27 @@ import type { DeclaredOrg, OrgId } from '../org.js';
  */
 export declare const ZITADEL_ORG_SCOPE_KEY = "zitadel_org";
 export declare const AGORA_CLIENT_ID_SCOPE_KEY = "agora_client_id";
+/**
+ * The recorded OIDC app's `clientId` (level-1 app-env campaign, gap P2) —
+ * not a `system:kind:key` resource id (that slot already holds the app's
+ * `appId`, `zitadelApp`'s own `resourceId`) and not a secret (`deliverSecret`
+ * is for that), so a flat scope id like `zitadel_org`/`zitadel_project`
+ * above. A level-1 org declares exactly one web `issuerApps` entry for its
+ * one standard app, so one flat key is enough; an org with more than one web
+ * app would need a richer key, not built here (Finding, this campaign's
+ * report).
+ */
+export declare const APP_CLIENT_ID_SCOPE_KEY = "zitadel_app_client_id";
+/**
+ * #139: the `cms` app's own ZITADEL web client's `clientId`, recorded
+ * separately from {@link APP_CLIENT_ID_SCOPE_KEY} -- that key belongs to the
+ * org's own hosted app (`diff.ts`'s `planIssuerApps`), a different
+ * `zitadel:app` step from the fixed `cms` client `diff.ts`'s `planCmsClient`
+ * plans. `cmsSite` reads this key to push `AUTH_CLIENT_ID` onto the cms app,
+ * the same way `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` for the hosted
+ * app.
+ */
+export declare const CMS_CLIENT_ID_SCOPE_KEY = "cms_client_id";
 /**
  * The accent every org's Agora wears until orgs choose their own: the house
  * theme's `--accent` (`@wtfalch/house`, `HOUSE_THEMES['good-company']` in

package/dist/plan/agora.js

@@ -12,6 +12,27 @@
  */
 export const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
 export const AGORA_CLIENT_ID_SCOPE_KEY = 'agora_client_id';
+/**
+ * The recorded OIDC app's `clientId` (level-1 app-env campaign, gap P2) —
+ * not a `system:kind:key` resource id (that slot already holds the app's
+ * `appId`, `zitadelApp`'s own `resourceId`) and not a secret (`deliverSecret`
+ * is for that), so a flat scope id like `zitadel_org`/`zitadel_project`
+ * above. A level-1 org declares exactly one web `issuerApps` entry for its
+ * one standard app, so one flat key is enough; an org with more than one web
+ * app would need a richer key, not built here (Finding, this campaign's
+ * report).
+ */
+export const APP_CLIENT_ID_SCOPE_KEY = 'zitadel_app_client_id';
+/**
+ * #139: the `cms` app's own ZITADEL web client's `clientId`, recorded
+ * separately from {@link APP_CLIENT_ID_SCOPE_KEY} -- that key belongs to the
+ * org's own hosted app (`diff.ts`'s `planIssuerApps`), a different
+ * `zitadel:app` step from the fixed `cms` client `diff.ts`'s `planCmsClient`
+ * plans. `cmsSite` reads this key to push `AUTH_CLIENT_ID` onto the cms app,
+ * the same way `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` for the hosted
+ * app.
+ */
+export const CMS_CLIENT_ID_SCOPE_KEY = 'cms_client_id';
 /**
  * The accent every org's Agora wears until orgs choose their own: the house
  * theme's `--accent` (`@wtfalch/house`, `HOUSE_THEMES['good-company']` in
@@ -85,6 +106,8 @@ export function desiredAgoraEnv(org, recorded, host) {
             organisationId: zitadelOrgId,
             mailProjectId: host.mailProjectId,
             messagingProjectId: host.messagingProjectId,
+            // Chat is not in v1: Agora hides all chat UI unless this is true.
+            chat: { enabled: org.chat.enabled },
         });
     }
     if (org.mail.mode !== 'off' && host.mailUpstream) {

package/dist/plan/calls-matrix.d.ts

@@ -45,8 +45,8 @@
  * (`executor.ts`'s `callsHostnameFor`).
  */
 export declare const SYNAPSE_IMAGE = "ghcr.io/element-hq/synapse";
-export declare const SYNAPSE_TAG = "v1.161.0";
-export declare const MAS_IMAGE = "ghcr.io/element-hq/matrix-authentication-service:1.24.0";
+export declare const SYNAPSE_TAG: string;
+export declare const MAS_IMAGE: string;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/calls-matrix.js

@@ -1,4 +1,5 @@
 import { generateKeyPairSync, randomBytes } from 'node:crypto';
+import { VERSIONS } from '../bootstrap/versions.js';
 /**
  * The calls Matrix stack (#128, part 1 of 2 -- see that issue's "If this
  * passes about 800 changed lines, split it" note): pure config generation
@@ -46,8 +47,8 @@ import { generateKeyPairSync, randomBytes } from 'node:crypto';
  * (`executor.ts`'s `callsHostnameFor`).
  */
 export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
-export const SYNAPSE_TAG = 'v1.161.0';
-export const MAS_IMAGE = 'ghcr.io/element-hq/matrix-authentication-service:1.24.0';
+export const SYNAPSE_TAG = VERSIONS.synapse;
+export const MAS_IMAGE = `ghcr.io/element-hq/matrix-authentication-service:${VERSIONS.mas}`;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/cloudflared-connector.d.ts

@@ -2,9 +2,10 @@ import type { CloudflarePort, CoolifyPort } from './executor.js';
 /**
  * #197: the pinned `cloudflared` image, the same release tag as
  * `scripts/shared-ingress.mjs`'s and `calls-sfu.ts`'s own
- * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal.
+ * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal. Pinned in
+ * `versions.json` (#247).
  */
-export declare const CLOUDFLARED_IMAGE_REF = "cloudflare/cloudflared:2026.9.3";
+export declare const CLOUDFLARED_IMAGE_REF: string;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published

package/dist/plan/cloudflared-connector.js

@@ -1,10 +1,12 @@
+import { VERSIONS } from '../bootstrap/versions.js';
 import { isNotFoundError } from './executor.js';
 /**
  * #197: the pinned `cloudflared` image, the same release tag as
  * `scripts/shared-ingress.mjs`'s and `calls-sfu.ts`'s own
- * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal.
+ * `CLOUDFLARED_IMAGE_REF`. A test in each keeps the three equal. Pinned in
+ * `versions.json` (#247).
  */
-export const CLOUDFLARED_IMAGE_REF = 'cloudflare/cloudflared:2026.9.3';
+export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -72,7 +74,7 @@ export async function ensureCloudflaredConnector(input) {
             environment_uuid: input.environment.uuid,
             dockerfile: cloudflaredDockerfile(),
             name: input.appName,
-            description: 'cloudflared connector for this platform tunnel (#197)',
+            description: 'cloudflared connector for a Cloudflare tunnel',
             instant_deploy: false,
         });
         appId = created.uuid;

package/dist/plan/diff.d.ts

@@ -26,6 +26,15 @@ export interface PlannedStep {
     step: PlanStep;
     action: StepAction;
 }
+/**
+ * Facts about the host's executor ports that an org's plan needs, so a step
+ * whose port is not wired is reported blocked instead of planned (rule 2).
+ * New ones go here, not in new positional arguments (rule 7).
+ */
+export interface PlanOrgOptions {
+    /** #267: the executor was built with a `loginHostBindings` port. */
+    loginHostBindings?: boolean;
+}
 export interface PlanDetail {
     orgId: OrgId;
     plannedSteps: PlannedStep[];
@@ -73,7 +82,11 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * app with the platform's jobs scheduler, idempotent on the *recorded*
  * resource id like {@link planOwner} rather than a live resource, since
  * nothing in `live` can report a scheduler registration (no reader exists for
- * it). Everything
+ * it). #267 adds one more, right after {@link planOwner} and before every
+ * app-creating step below: {@link planLoginHost}, the org's own company
+ * login host -- also idempotent on the *recorded* resource id, since
+ * `live` has no notion of a ZITADEL trusted domain or a login binding
+ * either. Everything
  * else in `live` that none of these eighteen singletons and however many
  * declared issuer apps claim is unmanaged. The full field-by-field provisioning surface (SSO,
  * guests, calls on the org's own domain, adopted/bespoke apps, the actual
@@ -81,7 +94,7 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * Company Factory end to end", which wires real readers and executors
  * against this seam.
  */
-export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>, agoraHost?: AgoraHostReading, jobsAvailable?: boolean, platformReadiness?: OrgPlatformReadiness): PlanDetail;
+export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>, agoraHost?: AgoraHostReading, jobsAvailable?: boolean, platformReadiness?: OrgPlatformReadiness, options?: PlanOrgOptions): PlanDetail;
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */