@wtfalch/foundry 0.6.0 → 0.7.1

package/dist/plan/executor.js

@@ -1,10 +1,12 @@
 import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
-import { AGORA_CLIENT_ID_SCOPE_KEY, agoraHostnameFor, desiredAgoraEnv, } from './agora.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, agoraHostnameFor, desiredAgoraEnv, } from './agora.js';
 import { MAS_IMAGE, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
+import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, } from './platform-diff.js';
+import { APP_ENV_APPLIED_SCOPE_KEY, DB_ENV_APPLIED_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, resolveAppEnv, } from './platform-diff.js';
 // ---------------------------------------------------------------------------
 // Errors
 // ---------------------------------------------------------------------------
@@ -228,27 +230,6 @@ const AGORA_APP_DOCKERFILE = 'apps/agora/Dockerfile';
  * restated rather than shared across the two files.
  */
 const LOG_DIR = '/app/logs';
-/**
- * The recorded OIDC app's `clientId` (level-1 app-env campaign, gap P2) —
- * not a `system:kind:key` resource id (that slot already holds the app's
- * `appId`, `zitadelApp`'s own `resourceId`) and not a secret (`deliverSecret`
- * is for that), so a flat scope id like `zitadel_org`/`zitadel_project`
- * above. A level-1 org declares exactly one web `issuerApps` entry for its
- * one standard app, so one flat key is enough; an org with more than one web
- * app would need a richer key, not built here (Finding, this campaign's
- * report).
- */
-const APP_CLIENT_ID_SCOPE_KEY = 'zitadel_app_client_id';
-/**
- * #139: the `cms` app's own ZITADEL web client's `clientId`, recorded
- * separately from {@link APP_CLIENT_ID_SCOPE_KEY} -- that key belongs to the
- * org's own hosted app (`diff.ts`'s `planIssuerApps`), a different
- * `zitadel:app` step from the fixed `cms` client `diff.ts`'s `planCmsClient`
- * plans. `cmsSite` reads this key to push `AUTH_CLIENT_ID` onto the cms app,
- * the same way `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` for the hosted
- * app.
- */
-const CMS_CLIENT_ID_SCOPE_KEY = 'cms_client_id';
 /**
  * `cmsSite` provisions two applications from one `cms:site` step, but
  * `execute`'s own return value auto-records only one `resourceId`, under
@@ -290,6 +271,13 @@ const CMS_DATABASE_SCOPE_KEY = 'coolify_cms_database';
  * `resend_mail_domain`.
  */
 const MAIL_DOMAIN_SCOPE_KEY = 'mail_domain';
+/**
+ * #235: the Coolify app running `cloudflared` for this org's own tunnel --
+ * one connector per org tunnel (Decided, William, 2026-10-01), the same
+ * `ensureCloudflaredConnector` every platform tunnel step already calls
+ * (`platform-providers.ts`), never a shared tunnel with appended ingress.
+ */
+const CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY = 'cloudflare_tunnel_connector_app';
 /**
  * #162: the owner's own mailbox, created once inside `coolify:mail` after
  * `applyOrgMail` succeeds, alongside {@link MAIL_DOMAIN_SCOPE_KEY} -- another
@@ -434,6 +422,8 @@ export class FoundryStepExecutor {
                 return this.zitadelIssuer(action, org, context);
             case 'zitadel:owner':
                 return this.zitadelOwner(action, org, context);
+            case 'zitadel:login-host':
+                return this.zitadelLoginHost(action, org, context);
             case 'zitadel:app':
                 return this.zitadelApp(action, org, context);
             case 'zitadel:customers':
@@ -603,6 +593,54 @@ export class FoundryStepExecutor {
         });
         return { resourceId: userId };
     }
+    /**
+     * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
+     * login host (`action.desired.host`) to the ZITADEL instance's trusted
+     * domains, writes zitadel-login's binding, then repoints the apps whose
+     * client id that binding holds. Apps created later are not in it yet:
+     * the next run replans (`diff.ts`'s `planLoginHost`) and moves them.
+     */
+    async zitadelLoginHost(action, org, context) {
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded.zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:login-host for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        // `planLoginHost` blocks the step while this port is not wired.
+        const bindings = this.ports.loginHostBindings;
+        if (!bindings) {
+            throw new Error(`zitadel:login-host for ${org.slug}: the loginHostBindings port is not wired`);
+        }
+        const host = action.desired.host;
+        await this.ports.zitadel.ensureTrustedDomain(host);
+        // zitadel-login's own routing table, written before any app is repointed
+        // so no app ever points at a host with no binding.
+        const clientIds = loginHostClientIds(recorded);
+        await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+        // Only apps whose client id the binding now holds: any other app in the
+        // project would lose sign-in. The rest move on a later run, once the
+        // recorded client ids differ from the binding and replan this step.
+        const boundAppIds = new Set([
+            ...(recorded[APP_CLIENT_ID_SCOPE_KEY]
+                ? org.hosting.issuerApps.filter((a) => a.kind === 'web').map((a) => a.name)
+                : []),
+            ...(recorded[CMS_CLIENT_ID_SCOPE_KEY] ? ['cms'] : []),
+            ...(recorded[AGORA_CLIENT_ID_SCOPE_KEY] ? ['agora'] : []),
+        ].map((name) => recorded[`zitadel:app:${name}`]));
+        const projectId = recorded.zitadel_project;
+        if (projectId) {
+            const apps = await this.ports.zitadel.listApps(zitadelOrgId, projectId);
+            for (const app of apps) {
+                if (app.state === 'APP_STATE_REMOVED' || !boundAppIds.has(app.id))
+                    continue;
+                await this.ports.zitadel.updateOidcAppLoginBaseUri(zitadelOrgId, projectId, app.id, `https://${host}/`);
+            }
+        }
+        // Last, so a crash above reruns the whole step. A client id recorded
+        // after this point differs from it and replans the step next run.
+        context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+        return { resourceId: host };
+    }
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
@@ -827,11 +865,17 @@ export class FoundryStepExecutor {
         // resource id is already recorded by the time this runs -- but this also
         // covers the database being turned on after the app already exists (the
         // app step still ran this apply, found the app by name, and lands here).
+        let dbPush = { pushed: false, changed: false };
         if (org.hosting.database) {
             const dbId = context.recordedIds()[`coolify:database:${action.key}`];
-            if (dbId)
-                await this.pushDatabaseUrl(appId, dbId);
+            if (dbId) {
+                dbPush = await this.pushDatabaseUrl(appId, dbId, org.slug.replace(/-/g, '_'));
+            }
         }
+        // Restart when the push changed something, or when no earlier run got as
+        // far as restarting after one (marker missing): a crash between the push
+        // and the restart leaves the env right and the container stale.
+        const dbNeedsRestart = dbPush.pushed && (dbPush.changed || !context.recordedIds()[DB_ENV_APPLIED_SCOPE_KEY]);
         // Every app keeps its own logs across a redeploy (#75). Unconditional,
         // like the env push below: found by mount path before create, so a
         // re-run (or the drift step `diff.ts`'s `planApp` plans for an app that
@@ -843,7 +887,17 @@ export class FoundryStepExecutor {
         // The app receives whatever it needs to sign in (gap P2). Unconditional,
         // unlike the database push above: every app has a hostname, and an
         // upsert of the same value on a later apply is a no-op, not a change.
-        await this.pushAppEnv(appId, org, context);
+        const appEnv = await this.pushAppEnv(appId, org, context);
+        // Rule 4 (#239, #243): a container reads its env only at start, so an app
+        // that was already there is restarted, once, when its database URLs or its
+        // declared appEnv changed.
+        if ((appEnv.changed || dbNeedsRestart) && existing)
+            await this.ports.coolify.restart(appId);
+        // Recorded only after the restart succeeded: a failed restart leaves the
+        // old value, so the next plan replans (rule 3). The db marker is not a URL.
+        context.recordScopeId(APP_ENV_APPLIED_SCOPE_KEY, appEnv.applied);
+        if (dbPush.pushed)
+            context.recordScopeId(DB_ENV_APPLIED_SCOPE_KEY, '1');
         // #140 rework (2026-09-28 lettermint-org-mail swap): the hosted app's own
         // Lettermint project, domain restriction and `MAIL_FROM` (only the app
         // started by this same step, per the design's "only apps that send mail
@@ -927,39 +981,80 @@ export class FoundryStepExecutor {
         // (`coolifyApp`'s own push handles the more common order, database
         // before app on the same apply -- `diff.ts`'s `computePlanDetail`).
         const appId = context.recordedIds()[`coolify:app:${action.key}`];
-        if (appId)
-            await this.pushDatabaseUrl(appId, dbId);
+        if (appId) {
+            const push = await this.pushDatabaseUrl(appId, dbId, org.slug.replace(/-/g, '_'));
+            if (push.pushed) {
+                if (push.changed || !context.recordedIds()[DB_ENV_APPLIED_SCOPE_KEY]) {
+                    await this.ports.coolify.restart(appId);
+                }
+                context.recordScopeId(DB_ENV_APPLIED_SCOPE_KEY, '1');
+            }
+        }
         return { resourceId: dbId };
     }
     /**
-     * Pushes the database's connection string into the app's environment as
-     * `DATABASE_URL` -- never also as `DATABASE_URL_OWNER` (Decision, this
-     * campaign's report). Archon's own boot script
-     * (`archon/scripts/migrate-and-start.sh`) treats a bare `DATABASE_URL` with
-     * no `DATABASE_URL_OWNER` as "before the split": it migrates and serves as
-     * the one role it has, which is exactly what a database Coolify just
-     * created (one superuser role, no separate runtime role yet) is. Setting
-     * both to the *same* superuser URL would instead take the split branch --
-     * `db-role-guard.sh` then refuses to boot, since `DATABASE_URL_OWNER` being
-     * set means it expects `DATABASE_URL` to connect as a distinct,
-     * non-superuser runtime role (`<database>_rt`), which nothing here creates.
-     * Minting that role's own password and URL is a provisioning step of its
-     * own, not built here (Finding, this campaign's report).
+     * Pushes the database's connection string into the app's environment,
+     * split the same way `cmsSite`'s own database is (#117, #239): the
+     * superuser connection as `DATABASE_URL_OWNER`, and a distinct, restricted
+     * `<dbName>_rt` role's connection as `DATABASE_URL`. Archon's and manage's
+     * own boot scripts (`db-role-guard.sh`) refuse to start against a
+     * superuser `DATABASE_URL`, and lokessmie's refuses to start without
+     * `DATABASE_URL_OWNER` at all -- a bare superuser `DATABASE_URL` with no
+     * `DATABASE_URL_OWNER` is "before the split" there too.
      *
-     * The connection string is a live credential
-     * (`postgres://user:password@host/db`): it is read from
-     * `CoolifyPort.getDatabase` and handed straight to `bulkUpsertEnvs` and
-     * nowhere else in this class -- never returned, never recorded in
-     * `serviceIds` (hence never in the store or an audit record), never logged,
-     * never interpolated into a thrown error.
+     * Both connection strings are live credentials
+     * (`postgres://user:password@host/db`): read from `CoolifyPort.getDatabase`
+     * (or minted here, for the runtime one) and handed straight to
+     * `bulkUpsertEnvs` and nowhere else in this class -- never returned, never
+     * recorded in `serviceIds` (hence never in the store or an audit record),
+     * never logged, never interpolated into a thrown error.
      */
-    async pushDatabaseUrl(appId, dbId) {
+    async pushDatabaseUrl(appId, dbId, dbName) {
         const db = await this.ports.coolify.getDatabase(dbId);
+        // Nothing to push; `planApp` reports this as blocked from the live reader.
         if (!db.internal_db_url)
-            return;
-        await this.ports.coolify.bulkUpsertEnvs(appId, [
-            { key: 'DATABASE_URL', value: db.internal_db_url },
-        ]);
+            return { pushed: false, changed: false };
+        const envs = [
+            { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
+        ];
+        const runtimeUrl = await this.ensureAppRuntimeUrl(appId, db.internal_db_url, dbName);
+        if (runtimeUrl)
+            envs.push({ key: 'DATABASE_URL', value: runtimeUrl });
+        // True when a value actually changed, so the caller restarts the app only
+        // then (the owner URL is upserted on every apply).
+        const ownerBefore = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview)?.value;
+        await this.ports.coolify.bulkUpsertEnvs(appId, envs);
+        return { pushed: true, changed: runtimeUrl !== null || ownerBefore !== db.internal_db_url };
+    }
+    /**
+     * `null` once the app already has a `DATABASE_URL` -- never rotated, the
+     * same rule `ensureCmsRuntimeUrl` follows and for the same reason: the
+     * app's own boot script creates or updates the live `<dbName>_rt` Postgres
+     * role from exactly the username/password this method mints, once:
+     * overwriting `DATABASE_URL` on a later apply would leave that
+     * already-created role's real password out of sync with whatever foundry
+     * hands the app next. See `ensureCmsRuntimeUrl`'s own doc comment for the
+     * parsing and encoding choices this mirrors exactly.
+     */
+    async ensureAppRuntimeUrl(appId, dbInternalUrl, dbName) {
+        const envs = await this.ports.coolify.listEnvs(appId);
+        // An existing `DATABASE_URL` that is still the superuser string is what an
+        // app got before the split (#239): treat it as absent so the runtime role
+        // is minted and replaces it, or the app's db-role-guard refuses to boot.
+        const already = envs.some((e) => e.key === 'DATABASE_URL' && !e.is_preview && e.value !== dbInternalUrl);
+        if (already)
+            return null;
+        let host;
+        let pathname;
+        let search;
+        try {
+            ({ host, pathname, search } = new URL(dbInternalUrl));
+        }
+        catch {
+            return null;
+        }
+        const password = randomBytes(24).toString('base64url');
+        return `postgres://${dbName}_rt:${password}@${host}${pathname}${search}`;
     }
     /**
      * Pushes what the org's app needs to sign a user in through ZITADEL (gap
@@ -977,8 +1072,10 @@ export class FoundryStepExecutor {
      * (`AUTH_CLIENT_ID`), all ordered before `coolify:app` for exactly this
      * reason. `AUTH_APP_KEY` (#206 -- which broker an org's app registers with
      * is its own design question, left out of #204's own "How" rather than
-     * guessed) and DATABASE_URL_OWNER (a runtime-role split not built yet,
-     * `pushDatabaseUrl`'s own doc comment) are out of scope here (task brief).
+     * guessed) is out of scope here (task brief). `DATABASE_URL_OWNER`/
+     * `DATABASE_URL` are pushed by `pushDatabaseUrl` instead, not here --
+     * that call runs only once `hosting.database` is declared and
+     * provisioned, where this one is unconditional (#239).
      */
     async pushAppEnv(appId, org, context) {
         const recorded = context.recordedIds();
@@ -1009,7 +1106,21 @@ export class FoundryStepExecutor {
         const cookieSecret = await this.ensureAuthCookieSecret(appId);
         if (cookieSecret)
             envs.push({ key: 'AUTH_COOKIE_SECRET', value: cookieSecret });
+        // #243: the app's own declared map from its env var names to values the
+        // plan already mints for this org (Files, AI, mail) -- each bespoke app
+        // names these differently (lokessmie uses STORAGE_*/AI_*). Nothing is
+        // minted here; a source with no value yet (its own step has not run,
+        // or has not run for this apply) is simply omitted, the same way every
+        // other optional entry above is.
+        const appEnv = resolveAppEnv(org, recorded).values;
+        for (const [key, value] of Object.entries(appEnv))
+            envs.push({ key, value });
         await this.ports.coolify.bulkUpsertEnvs(appId, envs);
+        // `coolifyApp` records `applied` once the restart succeeded, so `planApp`
+        // replans this step when the declared map changes (rule 3). Ids and a
+        // domain, never a secret.
+        const applied = JSON.stringify(appEnv);
+        return { changed: applied !== (recorded[APP_ENV_APPLIED_SCOPE_KEY] ?? '{}'), applied };
     }
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
@@ -2081,6 +2192,19 @@ export class FoundryStepExecutor {
             await this.ports.cloudflare.putTunnelConfig(tunnelId, {
                 ingress: [{ service: 'http_status:404' }],
             });
+            // #235: park stops the connector too -- an ingress with nothing
+            // routed is still a running container dialed into the tunnel.
+            const connectorAppId = context.recordedIds()[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY];
+            if (connectorAppId) {
+                try {
+                    await this.ports.coolify.raw('POST', `/applications/${connectorAppId}/stop`);
+                }
+                catch (error) {
+                    // Already gone (destroyed out of band): nothing left to stop.
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
             return { resourceId: tunnelId };
         }
         const tunnelName = `${org.slug}-tunnel`;
@@ -2110,6 +2234,29 @@ export class FoundryStepExecutor {
         await this.ports.cloudflare.putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
         });
+        // #235: a connector for this org's own tunnel, the same call every
+        // platform tunnel step already makes (Decided, William, 2026-10-01:
+        // one connector per org tunnel, never a shared tunnel with appended
+        // ingress). Without this, the tunnel exists and is configured but
+        // nothing is dialed into it, so `hostname` answers with a Cloudflare
+        // error -- #197's own gap, for an org's tunnel rather than a platform
+        // one.
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        await ensureCloudflaredConnector({
+            coolify: this.ports.coolify,
+            cloudflare: this.ports.cloudflare,
+            tunnelId: tunnel.id,
+            appName: `${org.slug}-cloudflared`,
+            projectUuid,
+            environment,
+            resolveServer: () => this.resolveServer(),
+            recordedConnectorAppId: context.recordedIds()[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY] ?? null,
+            recordAppId: async (appId) => {
+                context.recordScopeId(CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY, appId);
+                await context.persistScopeIds();
+            },
+        });
         return { resourceId: tunnel.id };
     }
     /**
@@ -2507,9 +2654,24 @@ export class FoundryStepExecutor {
         const { org, recordedIds } = context;
         try {
             switch (`${target.system}:${target.kind}`) {
-                case 'cloudflare:tunnel':
+                case 'cloudflare:tunnel': {
+                    // #235: the connector app first, its own 404 handled locally --
+                    // a retry where this already succeeded must still reach
+                    // `deleteTunnel` below, which the outer catch's own 404 handling
+                    // would otherwise short-circuit before it ran.
+                    const connectorAppId = recordedIds[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY];
+                    if (connectorAppId) {
+                        try {
+                            await this.ports.coolify.deleteApplication(connectorAppId);
+                        }
+                        catch (error) {
+                            if (!isNotFoundError(error))
+                                throw error;
+                        }
+                    }
                     await this.ports.cloudflare.deleteTunnel(target.id);
                     return;
+                }
                 case 'cloudflare:access':
                     await this.ports.cloudflare.deleteAccessApp(target.id);
                     return;

package/dist/plan/index.d.ts

@@ -24,6 +24,8 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 export type { ScopeResolver, RecordedIds } from './providers-readers.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
+export type { LoginHostBinding, LoginHostBindingsPort } from './login-host.js';
+export { loginHostnameFor } from './login-host.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './mail-identity.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export type { MailAllowlistApp } from './mail-identity-allowlist.js';

package/dist/plan/index.js

@@ -12,6 +12,7 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';

package/dist/plan/login-host.d.ts

@@ -0,0 +1,64 @@
+import type { DeclaredOrg } from '../org.js';
+/**
+ * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
+ * need to agree on for an org's own company login host -- the hostname and
+ * the shape of zitadel-login's own routing entry -- the same split
+ * `agora.ts` already makes for Agora's own hostname and env.
+ *
+ * Decided in https://github.com/wtfalch/auth/issues/137 (William,
+ * 2026-10-01): foundry owns company sign-in setup through
+ * `@wtfalch/providers`, not `auth`'s own `scripts/namespace-provisioner.mjs`.
+ * `auth/docs/company-login-hosts.md` is the enforcement side this hostname
+ * and binding feed.
+ */
+/**
+ * `auth.<domain>` once the org has its own domain and `issuer.usesDomain` is on, `<slug>-auth.oikos.host`
+ * otherwise -- the same per-tier shape `agora.ts`'s own `agoraHostnameFor`
+ * uses for Agora, and the two tiers #267's issue names directly
+ * ("auth.<domain>" on the org's own domain, "<slug>-auth.oikos.host" for
+ * tier 1, riding the shared `*.oikos.host` wildcard tunnel the same way
+ * `<slug>-agora.oikos.host` does). `../slug.ts`'s
+ * `RESERVED_AUTH_AND_ENVIRONMENTS` already reserves the `auth` *slug* so no
+ * org's own `<slug>.oikos.host` can collide with this subdomain, the same
+ * way `AGORA_SUFFIX` reserves `-agora`.
+ */
+export declare function loginHostnameFor(org: DeclaredOrg): string;
+/**
+ * One entry in zitadel-login's own `LOGIN_HOST_BINDINGS`
+ * (`auth/docs/company-login-hosts.md`) -- a single-line JSON document naming
+ * every company-bound host, its ZITADEL organization and the client ids
+ * allowed to use it. `host` is {@link loginHostnameFor}'s own value;
+ * `organizationId` is the org's ZITADEL org id (`executor.ts`'s
+ * `zitadelIssuer` recorded it as `zitadel_org`).
+ */
+export interface LoginHostBinding {
+    host: string;
+    organizationId: string;
+    clientIds: string[];
+}
+/**
+ * Host-supplied write access to zitadel-login's own `LOGIN_HOST_BINDINGS`
+ * env (`auth/docs/company-login-hosts.md`'s own "Set `LOGIN_HOST_BINDINGS`
+ * on zitadel-login", "today set by hand"). Optional on
+ * {@link FoundryStepExecutorPorts} the same way `jobsScheduler`/`mailCopy`
+ * are, but without it the login-host step is blocked, not partly applied:
+ * isolation between orgs rests on the binding, and an app repointed at a host
+ * with no binding cannot sign in. Wiring the port means the host routes to
+ * zitadel-login (DNS and ingress), because the first apply after wiring
+ * repoints the org's bound apps.
+ */
+export interface LoginHostBindingsPort {
+    upsertBinding(binding: LoginHostBinding): Promise<void>;
+}
+/**
+ * Scope id holding what the binding was last written with
+ * ({@link loginBindingState}). Client ids are not secrets. The planner
+ * replans the login-host step when the org's recorded client ids no longer
+ * match it, so an app created after the first apply is added to the binding
+ * on the next run.
+ */
+export declare const LOGIN_BINDING_SCOPE_KEY = "login_host_binding";
+/** The org's recorded app client ids (hosted app, cms, agora), sorted. */
+export declare function loginHostClientIds(recorded: Readonly<Record<string, string>>): string[];
+/** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
+export declare function loginBindingState(host: string, clientIds: readonly string[]): string;

package/dist/plan/login-host.js

@@ -0,0 +1,52 @@
+import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, } from './agora.js';
+/**
+ * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
+ * need to agree on for an org's own company login host -- the hostname and
+ * the shape of zitadel-login's own routing entry -- the same split
+ * `agora.ts` already makes for Agora's own hostname and env.
+ *
+ * Decided in https://github.com/wtfalch/auth/issues/137 (William,
+ * 2026-10-01): foundry owns company sign-in setup through
+ * `@wtfalch/providers`, not `auth`'s own `scripts/namespace-provisioner.mjs`.
+ * `auth/docs/company-login-hosts.md` is the enforcement side this hostname
+ * and binding feed.
+ */
+/**
+ * `auth.<domain>` once the org has its own domain and `issuer.usesDomain` is on, `<slug>-auth.oikos.host`
+ * otherwise -- the same per-tier shape `agora.ts`'s own `agoraHostnameFor`
+ * uses for Agora, and the two tiers #267's issue names directly
+ * ("auth.<domain>" on the org's own domain, "<slug>-auth.oikos.host" for
+ * tier 1, riding the shared `*.oikos.host` wildcard tunnel the same way
+ * `<slug>-agora.oikos.host` does). `../slug.ts`'s
+ * `RESERVED_AUTH_AND_ENVIRONMENTS` already reserves the `auth` *slug* so no
+ * org's own `<slug>.oikos.host` can collide with this subdomain, the same
+ * way `AGORA_SUFFIX` reserves `-agora`.
+ */
+export function loginHostnameFor(org) {
+    // `issuer.usesDomain` is the issuer's opt-in into the org's domain
+    // (`org.ts`'s `IssuerConfig`): a domain alone never moves it, so a domain
+    // with `usesDomain` false stays on the tier 1 host.
+    return org.domain && org.issuer.usesDomain ? `auth.${org.domain}` : `${org.slug}-auth.oikos.host`;
+}
+/**
+ * Scope id holding what the binding was last written with
+ * ({@link loginBindingState}). Client ids are not secrets. The planner
+ * replans the login-host step when the org's recorded client ids no longer
+ * match it, so an app created after the first apply is added to the binding
+ * on the next run.
+ */
+export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
+/** The org's recorded app client ids (hosted app, cms, agora), sorted. */
+export function loginHostClientIds(recorded) {
+    return [
+        recorded[APP_CLIENT_ID_SCOPE_KEY],
+        recorded[CMS_CLIENT_ID_SCOPE_KEY],
+        recorded[AGORA_CLIENT_ID_SCOPE_KEY],
+    ]
+        .filter((id) => Boolean(id))
+        .sort();
+}
+/** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
+export function loginBindingState(host, clientIds) {
+    return `${host} ${clientIds.join(',')}`;
+}

package/dist/plan/plan-apply.d.ts

@@ -17,14 +17,19 @@ export interface AuditActor {
 /**
  * The seam onto `@wtfalch/audit`.
  *
- * #19 asks for `@wtfalch/audit` itself, but that package's `record`/`ledger`
- * (see `app-template/src/lib/authz/audit.ts`) is bound to one app's Drizzle
- * table, session model and closed `EventName`/`ActorClass` vocabulary — none
- * of which foundry's SDK package has (it has no database of its own; #18
- * owns the store). Adopting it here is more than a small change, so this is
- * the interface instead, logged as a Finding on #19 rather than a half
- * adoption. A real implementation binds `@wtfalch/audit`'s `ledger.sign` to
- * foundry's own vocabulary and table once foundry has one.
+ * #19 asked for `@wtfalch/audit` itself, but at the time that package's
+ * `record`/`ledger` were bound to one app's Drizzle table, session model and
+ * closed `EventName`/`ActorClass` vocabulary -- none of which foundry's SDK
+ * package had. This interface was the stand-in, logged as a Finding on #19
+ * rather than a half adoption.
+ *
+ * #232: `@wtfalch/audit` now supports a service with no tenant database of
+ * its own (`ledgerVocabulary`, `tenantId: null`, the org as `target`) -- see
+ * `store/audit.ts`'s `createPostgresAuditLog`, which binds `ledger.sign` to
+ * foundry's own closed vocabulary and `foundry_audit_events`' replacement,
+ * `audit_events` (`@wtfalch/audit`'s own table, through migrations
+ * 0022-0026). This interface itself is unchanged -- `bootstrap.ts` and
+ * `redactingAudit` need no change either.
  */
 export interface AuditLog {
     recordPlan(entry: {
@@ -281,6 +286,13 @@ export interface FoundryPlanApplyOptions {
      * step never runs (and fails) where no scheduler is deployed.
      */
     jobsScheduler?: boolean;
+    /**
+     * #267: true when the host's executor was built with a `loginHostBindings`
+     * port. Optional, and false without it: each org's login host is then
+     * reported blocked instead of planned, so nothing is trusted or repointed
+     * before zitadel-login's binding can be written.
+     */
+    loginHostBindings?: boolean;
     /**
      * #177: true when the host's executor was built with its own `filesOrganisation`
      * / `aiOrganisation` port. Without one, the org step needs the platform's
@@ -334,6 +346,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly actor;
     private readonly agora;
     private readonly jobsScheduler;
+    private readonly loginHostBindings;
     private readonly hostFiles;
     private readonly hostAi;
     private readonly now;

package/dist/plan/plan-apply.js

@@ -78,6 +78,7 @@ export class FoundryPlanApply {
     actor;
     agora;
     jobsScheduler;
+    loginHostBindings;
     hostFiles;
     hostAi;
     now;
@@ -92,6 +93,7 @@ export class FoundryPlanApply {
         this.actor = options.actor;
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
+        this.loginHostBindings = options.loginHostBindings ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
         this.now = options.now ?? (() => new Date());
@@ -351,7 +353,7 @@ export class FoundryPlanApply {
             this.orgPlatformReadiness(),
             this.orgAgoraHost(id),
         ]);
-        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness);
+        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, { loginHostBindings: this.loginHostBindings });
         return { org, plan: toPlan(detail), detail };
     }
     /**
@@ -617,12 +619,13 @@ function stepField(action) {
  *
  * Three sources, in this order:
  * - fields no planner step exists for yet, so no apply can make them true:
- *   SSO, guests and solo when turned on, a bespoke app repo, an adopted app
- *   in the `repo` form (#7's `#15` comment: "declared but refused by
- *   `apply`"), and calls or hosting on a domain the org has not recorded
- *   (#145: calls on the org's own domain now has a planner step, the same
- *   way hosting's own domain does, so it only fails for that one missing-
- *   domain reason, not unconditionally);
+ *   SSO, guests and solo when turned on, an adopted app in the `repo` form
+ *   (#7's `#15` comment: "declared but refused by `apply`"), and calls or
+ *   hosting on a domain the org has not recorded (#145: calls on the org's
+ *   own domain now has a planner step, the same way hosting's own domain
+ *   does, so it only fails for that one missing-domain reason, not
+ *   unconditionally). `bespokeAppRepo` is not one of these: `coolify:app`
+ *   reads it (#240), so it converges with that step like any other field;
  * - chat's reverse re-key, which the planner surfaces but which is not built
  *   (#7 amendment 3), so it counts as failed even when no step threw;
  * - on a failed apply, the field of every planned step from the one that
@@ -646,8 +649,6 @@ function failedFields(org, detail, completed, serviceIds) {
         failed.add('guests.enabled');
     if (org.solo.enabled)
         failed.add('solo.enabled');
-    if (org.bespokeAppRepo !== null)
-        failed.add('bespokeAppRepo');
     if (org.adoptedApp?.form === 'repo')
         failed.add('adoptedApp');
     // `planCallsService`/`planTunnel`/`planZone` all share this same domain