@wtfalch/foundry 0.7.1 → 0.9.0

package/dist/org.js

@@ -2,6 +2,12 @@
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
 export const DEFAULT_NO_REPLY_LOCAL_PART = 'no-reply';
+/** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
+export const APP_ENTRY_KEY = 'app';
+/** The org's `app` entry: today's one app. */
+export function appEntry(hosting) {
+    return hosting.entries.find((entry) => entry.key === APP_ENTRY_KEY);
+}
 export const APP_ENV_SOURCES = new Set([
     'filesOrganisationId',
     'aiOrganisationId',
@@ -18,34 +24,18 @@ const HOSTING_BUILD_PACKS = new Set([
  * `null` when `hosting` is valid; otherwise the reason it is not (#71), same
  * shape as `validateBuyerIdentity` below.
  *
- * - `database` and `tunnel` each require `enabled` -- neither means anything
- *   without the app itself running.
- * - `gitBranch` is non-empty and `buildPack` is one of `HostingBuildPack`'s
- *   four values.
+ * - `tunnel` requires `enabled` -- it means nothing without the apps running.
  * - Every `issuerApps[]` entry has a non-empty `name`, unique within the
  *   list, and a `kind` that is one of `IssuerAppKind`'s three values.
+ * - `enabled` requires an entry keyed {@link APP_ENTRY_KEY}.
+ * - Every `entries[]` entry follows {@link validateHostingEntry}; keys are
+ *   unique, and at most one entry has a `database`, because the one
+ *   `<slug>_rt` runtime role cannot serve two apps.
  */
 export function validateHosting(hosting) {
-    if (hosting.database && !hosting.enabled) {
-        return 'hosting.database requires hosting.enabled';
-    }
     if (hosting.tunnel && !hosting.enabled) {
         return 'hosting.tunnel requires hosting.enabled';
     }
-    if (!hosting.gitBranch) {
-        return 'hosting.gitBranch must be non-empty';
-    }
-    if (!HOSTING_BUILD_PACKS.has(hosting.buildPack)) {
-        return `hosting.buildPack has an unknown value '${hosting.buildPack}'`;
-    }
-    if (hosting.accessEmails.length > 0 && !hosting.enabled) {
-        return 'hosting.accessEmails requires hosting.enabled';
-    }
-    for (const email of hosting.accessEmails) {
-        if (!/^[^@\s]+@[^@\s]+$/.test(email)) {
-            return `hosting.accessEmails has an invalid email '${email}'`;
-        }
-    }
     const seenNames = new Set();
     for (const app of hosting.issuerApps) {
         if (!app.name) {
@@ -67,16 +57,98 @@ export function validateHosting(hosting) {
             return `issuerApps '${app.name}' is reserved for the always-on Agora client every org gets`;
         }
     }
-    for (const [envName, source] of Object.entries(hosting.appEnv)) {
-        if (!envName) {
-            return 'every appEnv key needs a non-empty env var name';
+    if (hosting.enabled && !appEntry(hosting)) {
+        return `hosting.enabled requires an entry keyed '${APP_ENTRY_KEY}'`;
+    }
+    const seenKeys = new Set();
+    for (const entry of hosting.entries) {
+        if (seenKeys.has(entry.key)) {
+            return `hosting.entries key '${entry.key}' is not unique`;
+        }
+        seenKeys.add(entry.key);
+        const invalid = validateHostingEntry(entry, hosting.enabled);
+        if (invalid)
+            return invalid;
+    }
+    if (hosting.entries.filter((entry) => entry.database).length > 1) {
+        return 'at most one hosting entry may set database: the one runtime database role cannot serve two apps';
+    }
+    return null;
+}
+const ENTRY_KEY = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const REPO = /^wtfalch\/[A-Za-z0-9._-]+$/;
+// The env names `pushAppEnv` and `pushDatabaseUrl` set themselves.
+const FOUNDRY_ENV_NAME = /^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$/;
+const SECRET_ENV_NAME = /_(KEY|SECRET|TOKEN|PASSWORD)$/;
+const HELD_SECRETS = 'held secrets are not available yet';
+/** The rules for one {@link HostingEntry}; `null` when it is valid. */
+function validateHostingEntry(entry, enabled) {
+    const at = `hosting.entries '${entry.key}'`;
+    if (!ENTRY_KEY.test(entry.key)) {
+        return `hosting.entries key '${entry.key}' must be a DNS label (lowercase letters, digits and hyphens, 1-63 characters)`;
+    }
+    if (entry.repo !== null && !REPO.test(entry.repo)) {
+        return `${at} repo must be a repo under wtfalch, or null`;
+    }
+    if (entry.folder !== null && (entry.folder.startsWith('/') || entry.folder.includes('..'))) {
+        return `${at} folder must be a relative path inside the repo`;
+    }
+    if (!entry.branch) {
+        return `${at} branch must be non-empty`;
+    }
+    if (!HOSTING_BUILD_PACKS.has(entry.buildPack)) {
+        return `${at} buildPack has an unknown value '${entry.buildPack}'`;
+    }
+    if (entry.buildPack === 'dockercompose') {
+        return `${at} buildPack dockercompose is not available for an entry`;
+    }
+    if (entry.port !== null &&
+        !(Number.isInteger(entry.port) && entry.port >= 1 && entry.port <= 65535)) {
+        return `${at} port must be a whole number from 1 to 65535, or null`;
+    }
+    if (entry.healthPath !== null && !entry.healthPath.startsWith('/')) {
+        return `${at} healthPath must start with '/', or be null`;
+    }
+    if (entry.database && !enabled) {
+        return `${at} database requires hosting.enabled`;
+    }
+    if (entry.accessEmails.length > 0 && !enabled) {
+        return `${at} accessEmails requires hosting.enabled`;
+    }
+    if (entry.accessEmails.length > 0 && entry.key !== APP_ENTRY_KEY) {
+        return `${at} accessEmails is only available on the '${APP_ENTRY_KEY}' entry for now`;
+    }
+    for (const email of entry.accessEmails) {
+        if (!/^[^@\s]+@[^@\s]+$/.test(email)) {
+            return `${at} accessEmails has an invalid email '${email}'`;
+        }
+    }
+    for (const [name, value] of Object.entries(entry.env)) {
+        if (!name) {
+            return `${at} env needs a non-empty env var name`;
+        }
+        if (FOUNDRY_ENV_NAME.test(name)) {
+            return `${at} env '${name}' is set by foundry and cannot be declared`;
+        }
+        if (typeof value !== 'string') {
+            if (!APP_ENV_SOURCES.has(value?.from)) {
+                return `${at} env '${name}' has an unknown source '${value?.from}'`;
+            }
         }
-        if (!APP_ENV_SOURCES.has(source)) {
-            return `appEnv '${envName}' has an unknown source '${source}'`;
+        else if (SECRET_ENV_NAME.test(name) || (name.endsWith('_URL') && urlHasPassword(value))) {
+            return `${at} env '${name}' looks like a secret: ${HELD_SECRETS}`;
         }
     }
     return null;
 }
+function urlHasPassword(value) {
+    try {
+        return new URL(value).password !== '';
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * A DNS-label-per-segment format check for `DeclaredOrg.domain` (#131): every
  * dot-separated segment follows the exact rule `../slug.ts`'s `DNS_LABEL`

package/dist/plan/calls-matrix.d.ts

@@ -47,6 +47,8 @@
 export declare const SYNAPSE_IMAGE = "ghcr.io/element-hq/synapse";
 export declare const SYNAPSE_TAG: string;
 export declare const MAS_IMAGE: string;
+/** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
+export declare const MAS_TAG: string;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/calls-matrix.js

@@ -49,6 +49,8 @@ import { VERSIONS } from '../bootstrap/versions.js';
 export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
 export const SYNAPSE_TAG = VERSIONS.synapse;
 export const MAS_IMAGE = `ghcr.io/element-hq/matrix-authentication-service:${VERSIONS.mas}`;
+/** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
+export const MAS_TAG = VERSIONS.mas;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/diff.d.ts

@@ -1,5 +1,5 @@
 import type { DeclaredOrg, OrgId } from '../org.js';
-import type { Plan, PlanStep, UnmanagedItem } from '../plan.js';
+import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.js';
 import { type AgoraHostReading } from './agora.js';
 import type { LiveResource } from './live.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
@@ -39,6 +39,8 @@ export interface PlanDetail {
     orgId: OrgId;
     plannedSteps: PlannedStep[];
     unmanaged: UnmanagedItem[];
+    /** #251: see `VersionChangeItem` (`../plan.ts`). Never folded into `plannedSteps`. */
+    versionChanges: VersionChangeItem[];
 }
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export declare function toPlan(detail: PlanDetail): Plan;

package/dist/plan/diff.js

@@ -1,7 +1,9 @@
+import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
+import { appEntry } from '../org.js';
 import { NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, desiredAgoraEnv, } from './agora.js';
-import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { APP_ENV_APPLIED_SCOPE_KEY, DB_ENV_APPLIED_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, resolveAppEnv, } from './platform-diff.js';
+import { APP_ENV_APPLIED_SCOPE_KEY, CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, DB_ENV_APPLIED_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appStepKey, resolveAppEnv, versionNotAppliedLine, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS } from './platform-org.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export function toPlan(detail) {
@@ -9,6 +11,7 @@ export function toPlan(detail) {
         orgId: detail.orgId,
         steps: detail.plannedSteps.map((p) => p.step),
         unmanaged: detail.unmanaged,
+        versionChanges: detail.versionChanges,
     };
 }
 function resourceKey(system, kind, key) {
@@ -115,6 +118,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const callsService = planCallsService(org, byKey, claimed, platformReadiness.callsReady);
     if (callsService.step)
         plannedSteps.push(callsService.step);
+    // #251: same mechanism as the platform's own version-change lines -- see
+    // `planPlatform`'s own block in `platform-diff.ts`. Synapse and MAS never
+    // patch a running app's image tag once created, so this is
+    // `versionNotAppliedLine`, the same honest wording zitadel's own line
+    // uses, never `versionChangeLine`'s "X -> Y (redeploy)" -- nothing here
+    // ever performs that redeploy.
+    const versionChanges = [];
+    if (org.calls.enabled && !calls.blocked) {
+        const callsAppLive = Boolean(byKey.get(resourceKey('coolify', 'calls', org.id)));
+        const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.synapse);
+        if (synapseChange)
+            versionChanges.push(synapseChange);
+        const masChange = versionNotAppliedLine('mas', callsAppLive, recordedIds[CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.mas);
+        if (masChange)
+            versionChanges.push(masChange);
+    }
     const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader);
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
@@ -269,7 +288,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...zoneBlocked);
     // #243: an appEnv source nothing will record is reported, not silently skipped.
     unmanaged.push(...app.blocked);
-    return { orgId: org.id, plannedSteps, unmanaged };
+    return { orgId: org.id, plannedSteps, unmanaged, versionChanges };
 }
 /**
  * The org's own ZITADEL org (issuer), a per-org singleton like every other
@@ -420,8 +439,12 @@ function planOwner(org, recordedIds, authReady) {
  * for *this* apply, so an org moving from tier 1 onto its own domain (or
  * losing one) replans this step rather than staying silent forever once
  * first applied -- `executor.ts`'s `zitadelLoginHost` then also moves every
- * already-live app onto the new base URI. Mints nothing either way: adding
- * a trusted domain is not a one-time secret, so there is no "undelivered"
+ * already-live app onto the new base URI, and (#274) removes the *old* host
+ * from ZITADEL's trusted domains and zitadel-login's binding, reading it
+ * back from this same recorded value before overwriting it -- no separate
+ * action field or planning step of its own needed for that half. Mints
+ * nothing either way: adding a trusted domain is not a one-time secret, so
+ * there is no "undelivered"
  * guard to check the way `planJobsRegistration`'s own does.
  *
  * Ordered right after `planOwner` (not after mail, chat, or any hosting
@@ -437,11 +460,16 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     const none = { step: null, blocked: null };
     const key = resourceKey('zitadel', 'login-host', org.id);
     const host = loginHostnameFor(org);
-    // Already applied -- a re-run plans nothing unless the host changed or an app
-    // client id appeared since the binding was last written (#267, rule 4).
+    // Already applied -- a re-run plans nothing unless the host changed, an app
+    // client id appeared since the binding was last written (#267, rule 4), or
+    // an earlier host change still has a removal owed (#274 fix round 2):
+    // `zitadelLoginHost` always advances the recorded host to the current one,
+    // so a pending removal is the only way to know one is still owed, and
+    // nothing else here would replan the step to retry it.
     if (recordedIds[key] === host &&
         recordedIds[LOGIN_BINDING_SCOPE_KEY] ===
-            loginBindingState(host, loginHostClientIds(recordedIds))) {
+            loginBindingState(host, loginHostClientIds(recordedIds)) &&
+        pendingRemovalHosts(recordedIds).length === 0) {
         return none;
     }
     // #177: nothing to add a trusted domain to yet -- `planIssuer` already
@@ -494,6 +522,8 @@ const MAIL_OWNER_MAILBOX_SCOPE_KEY = 'mail_owner_mailbox';
 const MAIL_ROLE_MAILBOXES_SCOPE_KEY = 'mail_role_mailboxes';
 /** Restated from `executor.ts`, the same rule: the app id of the org tunnel's cloudflared connector. */
 const CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY = 'cloudflare_tunnel_connector_app';
+/** #236: restated from `executor.ts`, the same rule: the domain the org tunnel's DNS was last published under. */
+const CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY = 'cloudflare_tunnel_dns_domain';
 /** Restated from `executor.ts`, the same rule: the mail domain the last apply resolved. */
 const MAIL_DOMAIN_SCOPE_KEY = 'mail_domain';
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
@@ -754,6 +784,26 @@ function planCalls(org, byKey, claimed, callsReady) {
             blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
         };
     }
+    // #248: the two images this stack's own apply would run, checked the same
+    // way the platform's SFU checks LiveKit/cloudflared and ZITADEL checks its
+    // own tag -- a re-apply of the same declaration must not silently run a
+    // different version with no diff shown anywhere.
+    if (org.calls.enabled && !byKey.get(key)) {
+        const synapseBlocked = floatingTagBlocked('Synapse', VERSIONS.synapse, 'v1.161.0');
+        if (synapseBlocked) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${synapseBlocked}`,
+            };
+        }
+        const masBlocked = floatingTagBlocked('matrix-authentication-service', VERSIONS.mas, '1.24.0');
+        if (masBlocked) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${masBlocked}`,
+            };
+        }
+    }
     return {
         step: planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`),
         blocked: null,
@@ -1282,8 +1332,8 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
  * park-not-delete rule (#7 corrections 1) -- turning it off never deletes
  * the org's own app, database or tunnel configuration, it parks it.
  */
-function planHostingToggle(system, kind, desiredEnabled, org, byKey, claimed, describeProvision, describePark) {
-    const key = resourceKey(system, kind, org.id);
+function planHostingToggle(system, kind, desiredEnabled, org, byKey, claimed, describeProvision, describePark, stepKey = org.id) {
+    const key = resourceKey(system, kind, stepKey);
     const live = byKey.get(key);
     // A live resource is on unless it says it is parked. Providers' own
     // configs carry no `enabled` field at all, so only a park step's
@@ -1299,7 +1349,7 @@ function planHostingToggle(system, kind, desiredEnabled, org, byKey, claimed, de
         if (!liveEnabled)
             return null;
         return {
-            action: { system, kind, key: org.id, desired: { enabled: false } },
+            action: { system, kind, key: stepKey, desired: { enabled: false } },
             step: { description: describePark(), destroys: true, migrates: false },
         };
     }
@@ -1310,7 +1360,7 @@ function planHostingToggle(system, kind, desiredEnabled, org, byKey, claimed, de
     if (liveEnabled)
         return null;
     return {
-        action: { system, kind, key: org.id, desired: { enabled: true } },
+        action: { system, kind, key: stepKey, desired: { enabled: true } },
         step: { description: describeProvision(), destroys: false, migrates: false },
     };
 }
@@ -1345,8 +1395,12 @@ function planApp(org, byKey, claimed, recordedIds, plannedSteps) {
         aiOrganisationId: ['ai', 'organisation'],
         mailDomain: ['coolify', 'mail'],
     };
-    const { values: wantedEnv, unresolved } = resolveAppEnv(org, recordedIds);
-    const blocked = org.hosting.enabled
+    const entry = org.hosting.enabled ? appEntry(org.hosting) : undefined;
+    const { values: wantedEnv, unresolved } = entry
+        ? resolveAppEnv(org, entry, recordedIds)
+        : { values: {}, unresolved: [] };
+    const stepKey = appStepKey(org);
+    const blocked = entry
         ? unresolved
             .filter(([, source]) => !plannedSteps.some((p) => p.action.system === sourceStep[source][0] &&
             p.action.kind === sourceStep[source][1]))
@@ -1355,18 +1409,18 @@ function planApp(org, byKey, claimed, recordedIds, plannedSteps) {
             key: `coolify:app:env:${name}`,
         }))
         : [];
-    const toggled = planHostingToggle('coolify', 'app', org.hosting.enabled, org, byKey, claimed, () => `provision ${org.slug}'s app`, () => `park ${org.slug}'s app (stops serving; app data is retained, not deleted -- #7 corrections 1)`);
+    const toggled = planHostingToggle('coolify', 'app', entry !== undefined, org, byKey, claimed, () => `provision ${org.slug}'s app`, () => `park ${org.slug}'s app (stops serving; app data is retained, not deleted -- #7 corrections 1)`, stepKey);
     if (toggled)
         return { step: toggled, blocked };
-    if (!org.hosting.enabled)
+    if (!entry)
         return { step: null, blocked };
-    const live = byKey.get(resourceKey('coolify', 'app', org.id));
+    const live = byKey.get(resourceKey('coolify', 'app', stepKey));
     if (!live)
         return { step: null, blocked };
     const action = {
         system: 'coolify',
         kind: 'app',
-        key: org.id,
+        key: stepKey,
         desired: { enabled: true },
     };
     if (live.config.hasLogVolume === false) {
@@ -1388,7 +1442,7 @@ function planApp(org, byKey, claimed, recordedIds, plannedSteps) {
     // names (`envNames` absent) reads as compliant, like `hasLogVolume`.
     const envNames = live.config.envNames;
     const dbLive = byKey.get(resourceKey('coolify', 'database', org.id));
-    const dbReady = org.hosting.database && Boolean(recordedIds[`coolify:database:${org.id}`]);
+    const dbReady = entry.database && Boolean(recordedIds[`coolify:database:${org.id}`]);
     if (dbReady && dbLive?.config.hasInternalUrl === false) {
         // Rule 2: the push cannot succeed yet, so report it rather than replan
         // forever.
@@ -1417,7 +1471,7 @@ function planApp(org, byKey, claimed, recordedIds, plannedSteps) {
             blocked,
         };
     }
-    // #243 (rule 3): a changed `hosting.appEnv` reaches an app that is already
+    // #243 (rule 3): a changed entry `env` reaches an app that is already
     // live. `pushAppEnv` records what it pushed, so this plans the same step
     // again, with a redeploy, only once the resolved map differs from that.
     if (JSON.stringify(wantedEnv) !== (recordedIds[APP_ENV_APPLIED_SCOPE_KEY] ?? '{}')) {
@@ -1503,12 +1557,12 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
 }
 /**
  * A Postgres database beside the org's app (`org.ts`'s
- * `HostingConfig.database`, #71) -- `validateHosting` requires
+ * `HostingEntry.database`, #71) -- `validateHosting` requires
  * `hosting.enabled` before this can be true. Same park-not-delete shape as
  * {@link planApp}.
  */
 function planDatabase(org, byKey, claimed) {
-    return planHostingToggle('coolify', 'database', org.hosting.database, org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
+    return planHostingToggle('coolify', 'database', appEntry(org.hosting)?.database ?? false, org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
 }
 /**
  * A Cloudflare tunnel reaching the org's app (`org.ts`'s
@@ -1549,17 +1603,30 @@ function planTunnel(org, byKey, claimed, recordedIds) {
     const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`);
     if (toggled || !desired)
         return toggled;
-    // #235: a live, enabled tunnel with no connector recorded -- a first
-    // connector create that failed, or a tunnel that predates connectors --
-    // plans the same step again. The step finds or creates the connector by
-    // name, so it never makes a second one.
+    // A live, enabled tunnel re-plans the same step again when either:
+    // #235, no connector recorded -- a first connector create that failed, or
+    // a tunnel that predates connectors; or #236, its DNS was last published
+    // under a domain other than the one now declared -- never published at
+    // all (unset), or the org's domain has since changed. `org.domain` is set
+    // whenever `desired` is true above, in every branch. The step itself
+    // (`executor.ts`'s `cloudflareTunnel`) finds or creates the connector by
+    // name and upserts DNS idempotently (and, on a domain change, cleans up
+    // the old one once the new one is published -- round 3: publishing first
+    // means a conflict on the new domain leaves the old one still live rather
+    // than taking the org dark), so re-running it never duplicates either.
     const live = byKey.get(resourceKey('cloudflare', 'tunnel', org.id));
-    if (!live || recordedIds[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY])
+    if (!live)
+        return null;
+    const connectorMissing = !recordedIds[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY];
+    const dnsStale = recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain;
+    if (!connectorMissing && !dnsStale)
         return null;
     return {
         action: { system: 'cloudflare', kind: 'tunnel', key: org.id, desired: { enabled: true } },
         step: {
-            description: `run a cloudflared connector for ${org.slug}'s Cloudflare tunnel`,
+            description: connectorMissing
+                ? `run a cloudflared connector for ${org.slug}'s Cloudflare tunnel`
+                : `point ${org.slug}'s hostnames at its Cloudflare tunnel`,
             destroys: false,
             migrates: false,
         },
@@ -1728,17 +1795,18 @@ function planCustomers(org, live, claimed, recordedIds) {
 }
 /**
  * #84: a Cloudflare Access gate on the org's app hostname, letting only
- * `hosting.accessEmails` through. Idempotent on the recorded Access app id,
+ * the `app` entry's `accessEmails` through. Idempotent on the recorded Access app id,
  * like `planOwner`: Cloudflare's live listing has no Access apps. A later
  * change to the email list is not reconciled yet.
  */
 function planAccess(org, recordedIds) {
-    if (!org.hosting.enabled || org.hosting.accessEmails.length === 0)
+    const entry = org.hosting.enabled ? appEntry(org.hosting) : undefined;
+    if (!entry || entry.accessEmails.length === 0)
         return null;
-    if (recordedIds[resourceKey('cloudflare', 'access', org.id)])
+    if (recordedIds[resourceKey('cloudflare', 'access', appStepKey(org))])
         return null;
     return {
-        action: { system: 'cloudflare', kind: 'access', key: org.id, desired: {} },
+        action: { system: 'cloudflare', kind: 'access', key: appStepKey(org), desired: {} },
         step: {
             description: `put ${org.slug}'s app behind Cloudflare Access`,
             destroys: false,