@wtfalch/foundry 0.8.0 → 0.10.0

package/dist/plan/hostnames.d.ts

@@ -0,0 +1,24 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+/**
+ * The full names an entry is served at. With `hosting.usesDomain` off, or no
+ * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * and every other entry is internal. `'*'` names nothing here; the wildcard is
+ * acted on elsewhere.
+ */
+export declare function entryHostnames(org: DeclaredOrg, entry: HostingEntry): string[];
+/**
+ * The one primary name of the org's app: its first, or the name the app was
+ * served at before entries had hostnames. `APP_URL`, the ZITADEL redirect URI
+ * and the jobs registration read it.
+ */
+export declare function appHostname(org: DeclaredOrg): string;
+/** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
+export declare function legacyAppHostname(org: DeclaredOrg): string;
+/**
+ * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
+ * #164): a site's two names, every entry's names, an own-domain calls name and
+ * Agora's. An org that does not host keeps the single name it always had.
+ */
+export declare function tunnelIngressHostnames(org: DeclaredOrg): string[];
+/** The ingress names that get a DNS record: those under the org's own domain. */
+export declare function tunnelDnsHostnames(org: DeclaredOrg, domain: string): string[];

package/dist/plan/hostnames.js

@@ -0,0 +1,56 @@
+import { APP_ENTRY_KEY } from '../org.js';
+import { agoraHostnameFor } from './agora.js';
+/**
+ * The full names an entry is served at. With `hosting.usesDomain` off, or no
+ * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * and every other entry is internal. `'*'` names nothing here; the wildcard is
+ * acted on elsewhere.
+ */
+export function entryHostnames(org, entry) {
+    const { domain } = org;
+    if (!org.hosting.usesDomain || !domain) {
+        return entry.key === APP_ENTRY_KEY ? [`${org.slug}.oikos.host`] : [];
+    }
+    return entry.hostnames.flatMap((name) => name === '*' ? [] : name === '@' ? [domain] : [`${name}.${domain}`]);
+}
+/**
+ * The one primary name of the org's app: its first, or the name the app was
+ * served at before entries had hostnames. `APP_URL`, the ZITADEL redirect URI
+ * and the jobs registration read it.
+ */
+export function appHostname(org) {
+    const entry = org.hosting.entries.find((e) => e.key === APP_ENTRY_KEY);
+    const first = entry ? entryHostnames(org, entry)[0] : undefined;
+    return first ?? legacyAppHostname(org);
+}
+/** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
+export function legacyAppHostname(org) {
+    return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
+}
+/**
+ * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
+ * #164): a site's two names, every entry's names, an own-domain calls name and
+ * Agora's. An org that does not host keeps the single name it always had.
+ */
+export function tunnelIngressHostnames(org) {
+    const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [];
+    if (org.hosting.enabled) {
+        for (const entry of org.hosting.entries)
+            hostnames.push(...entryHostnames(org, entry));
+    }
+    else if (hostnames.length === 0) {
+        hostnames.push(legacyAppHostname(org));
+    }
+    if (org.calls.enabled && org.calls.usesDomain && org.domain) {
+        hostnames.push(`calls.${org.domain}`);
+    }
+    // #164: Agora always moves onto `agora.<domain>` once `org.domain` is set.
+    if (org.domain) {
+        hostnames.push(agoraHostnameFor(org));
+    }
+    return [...new Set(hostnames)];
+}
+/** The ingress names that get a DNS record: those under the org's own domain. */
+export function tunnelDnsHostnames(org, domain) {
+    return tunnelIngressHostnames(org).filter((hostname) => hostname === domain || hostname.endsWith(`.${domain}`));
+}

package/dist/plan/index.d.ts

@@ -13,7 +13,7 @@ export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, Confirmatio
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './platform-providers.js';
 export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
-export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, } from './platform-providers.js';
+export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
@@ -24,6 +24,8 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 export type { ScopeResolver, RecordedIds } from './providers-readers.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
+export type { BrokerPort } from './broker-entries.js';
+export { PlatformBrokerPort } from './broker-entries.js';
 export type { LoginHostBinding, LoginHostBindingsPort } from './login-host.js';
 export { loginHostnameFor } from './login-host.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './mail-identity.js';

package/dist/plan/index.js

@@ -6,12 +6,13 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.
-export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, } from './platform-providers.js';
+export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
 export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { PlatformBrokerPort } from './broker-entries.js';
 export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';

package/dist/plan/locked-hostnames.d.ts

@@ -0,0 +1,8 @@
+import type { DeclaredOrg } from '../org.js';
+/**
+ * The names under the org's domain that foundry owns, so no hosting entry may
+ * take one: Agora, the cms studio when the site is on, calls when it uses the
+ * domain, the sign-in host when the issuer does, and every platform service
+ * hostname that falls under the domain. Empty for an org with no domain.
+ */
+export declare function lockedHostnames(org: DeclaredOrg, platformHostnames: readonly string[]): Set<string>;

package/dist/plan/locked-hostnames.js

@@ -0,0 +1,26 @@
+import { agoraHostnameFor } from './agora.js';
+import { loginHostnameFor } from './login-host.js';
+/**
+ * The names under the org's domain that foundry owns, so no hosting entry may
+ * take one: Agora, the cms studio when the site is on, calls when it uses the
+ * domain, the sign-in host when the issuer does, and every platform service
+ * hostname that falls under the domain. Empty for an org with no domain.
+ */
+export function lockedHostnames(org, platformHostnames) {
+    const { domain } = org;
+    const locked = new Set();
+    if (!domain)
+        return locked;
+    locked.add(agoraHostnameFor(org));
+    if (org.site.enabled)
+        locked.add(`cms.${domain}`);
+    if (org.calls.enabled && org.calls.usesDomain)
+        locked.add(`calls.${domain}`);
+    if (org.issuer.usesDomain)
+        locked.add(loginHostnameFor(org));
+    for (const hostname of platformHostnames) {
+        if (hostname.endsWith(`.${domain}`))
+            locked.add(hostname);
+    }
+    return locked;
+}

package/dist/plan/login-host.d.ts

@@ -66,7 +66,7 @@ export interface LoginHostBindingsPort {
  * on the next run.
  */
 export declare const LOGIN_BINDING_SCOPE_KEY = "login_host_binding";
-/** The org's recorded app client ids (hosted app, cms, agora), sorted. */
+/** The org's recorded app client ids (hosted app, each entry's own, cms, agora), sorted. */
 export declare function loginHostClientIds(recorded: Readonly<Record<string, string>>): string[];
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export declare function loginBindingState(host: string, clientIds: readonly string[]): string;

package/dist/plan/login-host.js

@@ -1,4 +1,4 @@
-import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, } from './agora.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, } from './agora.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -36,12 +36,15 @@ export function loginHostnameFor(org) {
  * on the next run.
  */
 export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
-/** The org's recorded app client ids (hosted app, cms, agora), sorted. */
+/** The org's recorded app client ids (hosted app, each entry's own, cms, agora), sorted. */
 export function loginHostClientIds(recorded) {
     return [
         recorded[APP_CLIENT_ID_SCOPE_KEY],
         recorded[CMS_CLIENT_ID_SCOPE_KEY],
         recorded[AGORA_CLIENT_ID_SCOPE_KEY],
+        ...Object.entries(recorded)
+            .filter(([key]) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX))
+            .map(([, id]) => id),
     ]
         .filter((id) => Boolean(id))
         .sort();

package/dist/plan/plan-apply.d.ts

@@ -202,6 +202,9 @@ export interface PlatformStepExecutor {
     driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<{
         archon?: boolean;
         auth?: boolean;
+        backupStorage?: boolean;
+        /** #257 fix round 4: see `PlanPlatformOptions.drifted.backupStorageBlocked` (`platform-diff.ts`). */
+        backupStorageBlocked?: string;
     }>;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
@@ -295,6 +298,12 @@ export interface FoundryPlanApplyOptions {
      * before zitadel-login's binding can be written.
      */
     loginHostBindings?: boolean;
+    /**
+     * F5: true when the host's executor was built with a `broker` port.
+     * Optional, and false without it: each entry's broker entry is then
+     * reported blocked instead of planned.
+     */
+    broker?: boolean;
     /**
      * #177: true when the host's executor was built with its own `filesOrganisation`
      * / `aiOrganisation` port. Without one, the org step needs the platform's
@@ -349,6 +358,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly agora;
     private readonly jobsScheduler;
     private readonly loginHostBindings;
+    private readonly broker;
     private readonly hostFiles;
     private readonly hostAi;
     private readonly now;
@@ -388,6 +398,12 @@ export declare class FoundryPlanApply implements PlanApply {
     private refuseDestroy;
     private runSteps;
     private computeFreshPlan;
+    /**
+     * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
+     * store checks the names it knows; this adds the platform's own hostnames,
+     * which only the plan can read.
+     */
+    private invalidHosting;
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`

package/dist/plan/plan-apply.js

@@ -1,8 +1,11 @@
 import { createHash } from 'node:crypto';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
+import { validateHosting } from '../org.js';
+import { PLATFORM_SERVICE_KEYS } from '../platform.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
+import { lockedHostnames } from './locked-hostnames.js';
 import { planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export class DeclaredOrgNotFoundError extends Error {
@@ -63,6 +66,15 @@ export class PlatformConfirmationRequiredError extends Error {
         this.name = 'PlatformConfirmationRequiredError';
     }
 }
+/** The steps that read an entry's hostnames: `computeFreshPlan` drops them for an org whose hosting is invalid. */
+const HOSTNAME_STEPS = new Set([
+    'coolify:app',
+    'coolify:broker-entry',
+    'coolify:database',
+    'cloudflare:tunnel',
+    'cloudflare:access',
+    'jobs:registration',
+]);
 /**
  * The #19 implementation of {@link PlanApply}: computes a plan against live
  * state, and refuses to apply one that has gone stale, one that touches a
@@ -80,6 +92,7 @@ export class FoundryPlanApply {
     agora;
     jobsScheduler;
     loginHostBindings;
+    broker;
     hostFiles;
     hostAi;
     now;
@@ -95,6 +108,7 @@ export class FoundryPlanApply {
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
+        this.broker = options.broker ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
         this.now = options.now ?? (() => new Date());
@@ -354,9 +368,34 @@ export class FoundryPlanApply {
             this.orgPlatformReadiness(),
             this.orgAgoraHost(id),
         ]);
-        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, { loginHostBindings: this.loginHostBindings });
+        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, { loginHostBindings: this.loginHostBindings, broker: this.broker });
+        const invalid = await this.invalidHosting(org);
+        if (invalid) {
+            // Rule 2: reported in `unmanaged`, not thrown. Steps that read the
+            // hostnames are dropped, so `apply` does not act on them.
+            detail.plannedSteps = detail.plannedSteps.filter(({ action }) => !HOSTNAME_STEPS.has(`${action.system}:${action.kind}`));
+            detail.unmanaged.push({
+                description: `${org.slug}'s hosting is blocked, not planned: ${invalid}`,
+                key: 'hosting:invalid',
+            });
+        }
         return { org, plan: toPlan(detail), detail };
     }
+    /**
+     * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
+     * store checks the names it knows; this adds the platform's own hostnames,
+     * which only the plan can read.
+     */
+    async invalidHosting(org) {
+        const platform = await this.platformDeps?.store.get();
+        const platformHostnames = platform
+            ? PLATFORM_SERVICE_KEYS.map((k) => platform[k].hostname)
+            : [];
+        return validateHosting(org.hosting, {
+            domain: org.domain,
+            locked: lockedHostnames(org, platformHostnames),
+        });
+    }
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`
@@ -604,7 +643,8 @@ function destroyServiceIdKey(target) {
 const STEP_FIELDS = {
     'zitadel:issuer': 'issuer.usesDomain',
     'zitadel:owner': 'owner',
-    'zitadel:customers': 'hosting.issuerApps',
+    'zitadel:customers': 'hosting.entries.uses.auth',
+    'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
     'coolify:calls': 'calls.enabled',
@@ -633,13 +673,12 @@ function stepField(action) {
  *
  * Three sources, in this order:
  * - fields no planner step exists for yet, so no apply can make them true:
- *   SSO, guests and solo when turned on, an adopted app in the `repo` form
- *   (#7's `#15` comment: "declared but refused by `apply`"), and calls or
- *   hosting on a domain the org has not recorded (#145: calls on the org's
- *   own domain now has a planner step, the same way hosting's own domain
- *   does, so it only fails for that one missing-domain reason, not
- *   unconditionally). `bespokeAppRepo` is not one of these: `coolify:app`
- *   reads it (#240), so it converges with that step like any other field;
+ *   SSO, guests and solo when turned on, and calls or hosting on a domain
+ *   the org has not recorded (#145: calls on the org's own domain now has a
+ *   planner step, the same way hosting's own domain does, so it only fails
+ *   for that one missing-domain reason, not unconditionally). An app repo is
+ *   not one of these: `coolify:app` reads the `app` entry's `repo`, so it
+ *   converges with that step like any other field;
  * - chat's reverse re-key, which the planner surfaces but which is not built
  *   (#7 amendment 3), so it counts as failed even when no step threw;
  * - on a failed apply, the field of every planned step from the one that
@@ -663,8 +702,6 @@ function failedFields(org, detail, completed, serviceIds) {
         failed.add('guests.enabled');
     if (org.solo.enabled)
         failed.add('solo.enabled');
-    if (org.adoptedApp?.form === 'repo')
-        failed.add('adoptedApp');
     // `planCallsService`/`planTunnel`/`planZone` all share this same domain
     // requirement (#145): a declared `usesDomain: true` with no recorded
     // domain plans no step for any of them either.

package/dist/plan/platform-diff.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg, OrgId } from '../org.js';
+import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import { type Plan, type UnmanagedItem, type VersionChangeItem } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { PlannedStep } from './diff.js';
@@ -118,6 +118,10 @@ export declare const PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY = "archon_applied_
 export declare const PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY = "archon_gate_closed";
 export declare const PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY = "zitadel_platform_admin_user_id";
 export declare const PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY = "zitadel_platform_admin_user_undelivered";
+/** #283: the created instance's id, recorded once its owner token is delivered. */
+export declare const PLATFORM_AUTH_INSTANCE_SCOPE_KEY = "zitadel_platform_instance_id";
+/** #283: an instance that may exist without a delivered owner token; blocks creating another. */
+export declare const PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY = "zitadel_platform_instance_undelivered";
 /**
  * #216 (building on #209/#215): the `IAM_LOGIN_CLIENT` machine user minted
  * for the login app and the broker, mirroring
@@ -312,24 +316,67 @@ export declare function platformMailMxHost(apex: string): string;
 export declare const ORG_MAIL_APPLIED_APEX_SCOPE_KEY = "mail_applied_apex";
 export declare const ORG_MAIL_APPLIED_HOST_SCOPE_KEY = "mail_applied_host";
 /**
- * #243: the org's `hosting.appEnv` values the last `coolify:app` apply pushed,
+ * The key of a hosting entry in a `coolify:app` or `cloudflare:access` step
+ * and in the ids recorded for it: `<orgId>:<entry key>`, so a second entry
+ * cannot collide with the first.
+ */
+export declare function appStepKey(org: DeclaredOrg, entryKey?: string): string;
+/**
+ * The Coolify name of a hosting entry's app: `<slug>` for the `app` entry, so
+ * the move to a list finds the app that runs today, `<slug>-<key>` for any
+ * other.
+ */
+export declare function appNameFor(org: DeclaredOrg, entry: HostingEntry): string;
+/**
+ * #243: the entry's `env` values the last `coolify:app` apply pushed,
  * recorded as one JSON object (env name to value; ids and a domain, never a
  * secret). `planApp` plans the step again when {@link resolveAppEnv} differs
- * from it, so a changed map reaches an app that is already live.
+ * from it, so a changed map reaches an app that is already live. The `.<key>`
+ * suffix is the entry key; a scope key holds no `:`, so `storeRecordedIds`
+ * still filters it out.
  */
-export declare const APP_ENV_APPLIED_SCOPE_KEY = "app_env_applied";
+export declare function appEnvAppliedScopeKey(entryKey: string): string;
 /**
  * #239: set to '1' once an app has been restarted after its database URLs
  * were pushed. Not a URL. Without it a crash between the push and the restart
  * would leave a stale container that no plan notices.
  */
-export declare const DB_ENV_APPLIED_SCOPE_KEY = "db_env_applied";
+export declare function dbEnvAppliedScopeKey(entryKey: string): string;
+/**
+ * The settings `coolifyApp` owns on an entry's app (`folder`, `port`,
+ * `autoDeploy`) as the JSON the marker below holds. `coolifyApp` records it
+ * on create and after it patches the app, and `planApp` plans the step again
+ * when the declared settings differ from it.
+ */
+export interface AppSettings {
+    folder: string | null;
+    port: number | null;
+    autoDeploy: boolean;
+}
+export declare function appSettingsOf(entry: HostingEntry): AppSettings;
+/** What an app that predates the marker has: Coolify's own defaults, so it plans no change. */
+export declare const DEFAULT_APP_SETTINGS: AppSettings;
+export declare function appSettingsAppliedScopeKey(entryKey: string): string;
+/** The settings the app has: the marker, or the defaults when there is none. */
+export declare function appliedAppSettings(recorded: Readonly<Record<string, string>>, entryKey: string): AppSettings;
+/**
+ * The names `coolifyApp` last put in the entry's Coolify `domains`, as a JSON
+ * array (`[]` for an internal entry). `planApp` plans the step again, with a
+ * redeploy, when {@link entryHostnames} differs from it.
+ */
+export declare function appDomainsAppliedScopeKey(entryKey: string): string;
+/**
+ * The names the app has: the marker, or for an app that predates it the one
+ * name it was created with (the `app` entry's address, nothing for any other
+ * entry), so an app that runs today plans no change.
+ */
+export declare function appliedAppDomains(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, entryKey: string): string[];
 /**
- * The `hosting.appEnv` entries whose source has a recorded value, in env-name
- * order, and the env names whose source has none yet. Shared by `planApp` and
- * the executor's `pushAppEnv` so both read the same recorded ids.
+ * The entry's `env` values that have a value, in env-name order, and the env
+ * names whose source has none yet. Shared by `planApp` and the executor's
+ * `pushAppEnv` so both read the same recorded ids.
  */
-export declare function resolveAppEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): {
+export declare function resolveAppEnv(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>): {
     values: Record<string, string>;
     unresolved: Array<[string, string]>;
 };
@@ -498,11 +545,23 @@ export interface PlanPlatformOptions {
      * include list is not the declared one. `auth` (#216 round 4): the
      * login-client PAT recorded under
      * {@link PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY} is no longer the sole
-     * live PAT on that ZITADEL machine user.
+     * live PAT on that ZITADEL machine user. `backupStorage` (#257 fix round
+     * 2): the registered R2 storage's live fingerprint no longer matches the
+     * host's configured bucket/endpoint/key/secret, or the recorded storage
+     * uuid is no longer in Coolify's live list -- see `planBackups`'s own doc
+     * comment for why this is the one drift flag that can fire even once
+     * every per-service backup step is claimed. `backupStorageBlocked` (#257
+     * fix round 4, point 4): set instead of `backupStorage` when the liveness
+     * check itself failed (Coolify unreachable, credentials revoked) -- the
+     * plan is never failed over it, but it is reported in `unmanaged` rather
+     * than only logged, so a persistent failure is visible instead of silently
+     * retried forever.
      */
     drifted?: {
         archon?: boolean;
         auth?: boolean;
+        backupStorage?: boolean;
+        backupStorageBlocked?: string;
     };
 }
 /**