@wtfalch/foundry 0.26.4 → 0.27.0

package/dist/calls-sfu.d.ts

@@ -154,6 +154,19 @@ export declare const CALLS_SFU_PRIVATE_URL = "http://10.10.10.105:7880";
  * hostname out from under it.
  */
 export declare const CALLS_SFU_PUBLIC_URL = "https://calls-sfu.oikos.host";
+/**
+ * A host's own SFU addresses, for a stack where the shared SFU is not the
+ * estate's (a local run). Optional on `FoundryStepExecutorPorts`; absent, the
+ * two constants above apply unchanged.
+ */
+export interface CallsSfuUrls {
+    /** What a browser reaches: becomes the calls service's `LIVEKIT_PUBLIC_URL`. */
+    publicUrl: string;
+    /** What the calls service reaches: becomes its `LIVEKIT_URL`. */
+    privateUrl: string;
+}
+/** The SFU addresses to use: the override, validated, else the constants. Throws naming the bad field. */
+export declare function resolveCallsSfuUrls(override?: CallsSfuUrls): CallsSfuUrls;
 /**
  * Exported for the test file. Reads `ufw status`'s own report rather than
  * assuming the exit code of a blind `ufw delete allow 7880/tcp` -- real

package/dist/calls-sfu.js

@@ -144,6 +144,20 @@ export const CALLS_SFU_PRIVATE_URL = `http://10.10.10.105:${LIVEKIT_SIGNALLING_P
  * hostname out from under it.
  */
 export const CALLS_SFU_PUBLIC_URL = 'https://calls-sfu.oikos.host';
+/** The SFU addresses to use: the override, validated, else the constants. Throws naming the bad field. */
+export function resolveCallsSfuUrls(override) {
+    if (!override)
+        return { publicUrl: CALLS_SFU_PUBLIC_URL, privateUrl: CALLS_SFU_PRIVATE_URL };
+    for (const field of ['publicUrl', 'privateUrl']) {
+        const value = override[field];
+        if (typeof value !== 'string' ||
+            !URL.canParse(value) ||
+            !/^https?:$/.test(new URL(value).protocol)) {
+            throw new Error(`callsSfuUrls.${field} must be an absolute http(s) URL`);
+        }
+    }
+    return { publicUrl: override.publicUrl, privateUrl: override.privateUrl };
+}
 /**
  * Matches `ufw status`'s report of the exact wide-open rule PR 125 added
  * (`ufw allow 7880/tcp`) -- "Anywhere" in the From column -- and not the

package/dist/index.d.ts

@@ -41,13 +41,14 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './plan/index.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
+export type { CallsSfuUrls } from './calls-sfu.js';
 export type { CallsSfuSshSession } from './calls-sfu-ssh-adapter.js';
 export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export type { CallsSfuSshConnectOptions } from './calls-sfu-ssh-client.js';

package/dist/plan/diff.d.ts

@@ -43,6 +43,8 @@ export interface DraftStep {
 export interface PlanOrgOptions {
     /** #267: the executor was built with a `loginHostBindings` port. */
     loginHostBindings?: boolean;
+    /** The executor's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`; without it `planIdTokenUserinfo` plans nothing. */
+    zitadelIdTokenUserinfo?: boolean;
     /** F5: the executor was built with a `broker` port. */
     broker?: boolean;
     /** #161: the slugs of the other declared orgs, so a Boule whose hostname another org's slug would take is blocked. */

package/dist/plan/diff.js

@@ -12,7 +12,7 @@ import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } fro
 import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
@@ -441,6 +441,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
             plannedSteps.push(step);
         }
     }
+    // Last: a repair that fails must not stop any step after it (`runSteps` stops at the first failure).
+    const idTokenUserinfo = planIdTokenUserinfo(org, live, recordedIds, plannedSteps, platformReadiness.authReady, options.zitadelIdTokenUserinfo ?? false);
+    if (idTokenUserinfo)
+        plannedSteps.push(idTokenUserinfo);
     // #10 (resolved): "foundry manages only what the declared org names";
     // anything left unclaimed is listed, never proposed for deletion.
     // A resource foundry made for the org is not a finding: only a resource
@@ -861,6 +865,45 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // repoint nothing until the port that writes the binding is wired.
     return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor(false);
 }
+/**
+ * Every sign-in app this org already has live (web or native, not api) gets
+ * "user info inside the ID token" switched on once: apps made before the
+ * setting existed have none, and `@wtfalch/auth` builds the signed-in user
+ * from ID token claims only. One `zitadel:id-token-userinfo` step names the
+ * apps whose recorded id differs from their marker
+ * ({@link zitadelAppIdTokenUserinfoAppliedScopeKey}); a re-created app has a
+ * new id, so it is named again. Plans nothing when the host's ZITADEL client
+ * lacks the method, before the org and project are recorded, or while
+ * the platform's sign-in is not ready.
+ */
+function planIdTokenUserinfo(org, live, recordedIds, plannedSteps, authReady, wired) {
+    if (!wired || !authReady || !recordedIds.zitadel_org || !recordedIds.zitadel_project)
+        return null;
+    const apps = live
+        .filter((r) => r.system === 'zitadel' &&
+        r.kind === 'app' &&
+        (r.config.appType === 'web' || r.config.appType === 'native'))
+        .map((r) => r.key)
+        // An app this plan recreates gets its marker when it is made.
+        .filter((appKey) => !plannedSteps.some((s) => s.action.system === 'zitadel' &&
+        s.action.kind === 'app' &&
+        s.action.key === appKey &&
+        s.action.desired.recreate === true))
+        .filter((appKey) => {
+        const appId = recordedIds[`zitadel:app:${appKey}`];
+        return (Boolean(appId) && recordedIds[zitadelAppIdTokenUserinfoAppliedScopeKey(appKey)] !== appId);
+    });
+    if (apps.length === 0)
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'id-token-userinfo', key: org.id, desired: { apps } },
+        step: {
+            description: `switch on user info in the ID token for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /** Why a login-host step cannot run yet, or `null` when nothing is missing. */
 function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) {
     if (!bindingsWired) {

package/dist/plan/executor.d.ts

@@ -1,4 +1,5 @@
 import type { OrgMailOptions, OrgMailOrg, OrgMailResult } from '@wtfalch/email/postmaster';
+import { type CallsSfuUrls } from '../calls-sfu.js';
 import type { DeclaredOrg, HostingBuildPack } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import { type BrokerPort } from './broker-entries.js';
@@ -1009,6 +1010,18 @@ export interface ZitadelPort {
      * the binding holds; `zitadelApp` never sets it at creation.
      */
     updateOidcAppLoginBaseUri(orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;
+    /**
+     * Switches on "user info inside the ID token" for an already-created app,
+     * read-modify-write (`@wtfalch/providers`' `ZitadelClient.
+     * updateOidcAppIdTokenUserinfoAssertion`): ZITADEL defaults it to off, and
+     * `@wtfalch/auth` builds the signed-in user from ID token claims only, so
+     * an app made without it has no `email` claim. Resolves `true` when it
+     * wrote the setting, `false` when the app already had it on (no write).
+     * Optional: a host whose client lacks it gets no repair step planned
+     * (`FoundryPlanApplyOptions.zitadelIdTokenUserinfo`), and nothing throws.
+     * `createOidcApp` and `createOidcAppWithSecret` send it on themselves.
+     */
+    updateOidcAppIdTokenUserinfoAssertion?(orgId: string, projectId: string, appId: string): Promise<boolean>;
 }
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
@@ -1377,6 +1390,12 @@ export interface FoundryStepExecutorPorts {
     jobsScheduler?: JobsSchedulerPort;
     /** The shared calls SFU's own LiveKit credentials (#145) -- see {@link CallsSfuPort}'s own doc comment. */
     callsSfu: CallsSfuPort;
+    /**
+     * The calls service's `LIVEKIT_URL` / `LIVEKIT_PUBLIC_URL`, for a host whose
+     * SFU is not the estate's shared one. Absent, the estate's addresses apply.
+     * Refused (the calls-service step throws) unless both are absolute http(s) URLs.
+     */
+    callsSfuUrls?: CallsSfuUrls;
     /**
      * #113: the org's old-mail copy into Stalwart, ahead of a `received` ->
      * `hosted` MX cutover -- see {@link MailCopyPort}'s own doc comment.
@@ -1696,6 +1715,15 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * recorded).
      */
     private zitadelOwner;
+    /**
+     * Switches on "user info inside the ID token" for each live sign-in app
+     * the planner named. An app's marker (its ZITADEL app id) is recorded and
+     * persisted only after its call resolved to a boolean, so a call that throws
+     * or resolves to anything else leaves no marker and the next plan names the
+     * app again. The error names ids only,
+     * never the cause.
+     */
+    private zitadelIdTokenUserinfo;
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted

package/dist/plan/executor.js

@@ -1,6 +1,6 @@
 import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
-import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
+import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
@@ -24,7 +24,7 @@ import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
@@ -770,6 +770,8 @@ export class FoundryStepExecutor {
                 return this.zitadelLoginHost(action, org, context);
             case 'zitadel:app':
                 return this.zitadelApp(action, org, context);
+            case 'zitadel:id-token-userinfo':
+                return this.zitadelIdTokenUserinfo(action, org, context);
             case 'zitadel:customers':
                 return this.zitadelCustomers(org, context);
             case 'coolify:app':
@@ -1312,6 +1314,44 @@ export class FoundryStepExecutor {
         }
         return { resourceId: userId };
     }
+    /**
+     * Switches on "user info inside the ID token" for each live sign-in app
+     * the planner named. An app's marker (its ZITADEL app id) is recorded and
+     * persisted only after its call resolved to a boolean, so a call that throws
+     * or resolves to anything else leaves no marker and the next plan names the
+     * app again. The error names ids only,
+     * never the cause.
+     */
+    async zitadelIdTokenUserinfo(action, org, context) {
+        const update = this.ports.zitadel.updateOidcAppIdTokenUserinfoAssertion?.bind(this.ports.zitadel);
+        // The planner plans nothing without the method; a stale plan does nothing.
+        if (!update)
+            return {};
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded.zitadel_org;
+        const projectId = recorded.zitadel_project;
+        if (!zitadelOrgId || !projectId) {
+            throw new Error(`zitadel:id-token-userinfo for ${org.slug}: no ZITADEL org and project recorded yet -- the issuer must be provisioned first`);
+        }
+        for (const appKey of action.desired.apps) {
+            const appId = recorded[`zitadel:app:${appKey}`];
+            if (!appId)
+                continue;
+            let done;
+            try {
+                done = await update(zitadelOrgId, projectId, appId);
+            }
+            catch {
+                throw new Error(`zitadel:id-token-userinfo for ${org.slug}: switching on user info in the ID token failed for app '${appKey}' (${appId})`);
+            }
+            // A client that answers every property (`packages/local`) resolves to something else: no marker.
+            if (typeof done !== 'boolean')
+                continue;
+            context.recordScopeId(zitadelAppIdTokenUserinfoAppliedScopeKey(appKey), appId);
+            await context.persistScopeIds();
+        }
+        return {};
+    }
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted
@@ -1706,6 +1746,8 @@ export class FoundryStepExecutor {
             // never something an app's env needs.
             context.recordScopeId(clientIdScopeKey, created.clientId);
         }
+        // Made with the setting on (providers 0.9.0): nothing to repair on this id.
+        context.recordScopeId(zitadelAppIdTokenUserinfoAppliedScopeKey(action.key), created.appId);
         return { resourceId: created.appId };
     }
     /**
@@ -3771,6 +3813,8 @@ export class FoundryStepExecutor {
             await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
             return { resourceId: appId };
         }
+        // Refused before anything is created, like the missing-stack refusal below.
+        const sfuUrls = resolveCallsSfuUrls(this.ports.callsSfuUrls);
         const recorded = context.recordedIds();
         const synapseId = recorded[CALLS_SYNAPSE_SCOPE_KEY];
         const masId = recorded[CALLS_MAS_SCOPE_KEY];
@@ -3832,8 +3876,8 @@ export class FoundryStepExecutor {
         await this.ensureLogVolume(app.appId, org, app.existed);
         const bindingSecret = await this.ensureCallsBindingSecret(app.appId);
         const envs = [
-            { key: 'LIVEKIT_URL', value: CALLS_SFU_PRIVATE_URL },
-            { key: 'LIVEKIT_PUBLIC_URL', value: CALLS_SFU_PUBLIC_URL },
+            { key: 'LIVEKIT_URL', value: sfuUrls.privateUrl },
+            { key: 'LIVEKIT_PUBLIC_URL', value: sfuUrls.publicUrl },
             { key: 'LIVEKIT_API_KEY', value: sfu.apiKey },
             { key: 'LIVEKIT_API_SECRET', value: sfu.apiSecret },
             { key: 'MAS_URL', value: `http://${masHost}:8080/` },

package/dist/plan/index.d.ts

@@ -15,7 +15,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';

package/dist/plan/plan-apply.d.ts

@@ -361,6 +361,13 @@ export interface FoundryPlanApplyOptions {
      * before zitadel-login's binding can be written.
      */
     loginHostBindings?: boolean;
+    /**
+     * True when the host's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`
+     * (`@wtfalch/providers` at the version that has it). Optional, and false
+     * without it: no org plans the step that switches on user info in the ID
+     * token of its existing sign-in apps.
+     */
+    zitadelIdTokenUserinfo?: boolean;
     /**
      * F5: true when the host's executor was built with a `broker` port.
      * Optional, and false without it: each entry's broker entry is then
@@ -461,6 +468,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly agora;
     private readonly jobsScheduler;
     private readonly loginHostBindings;
+    private readonly zitadelIdTokenUserinfo;
     private readonly broker;
     private readonly edgeWorkers;
     private readonly hostFiles;

package/dist/plan/plan-apply.js

@@ -121,6 +121,7 @@ export class FoundryPlanApply {
     agora;
     jobsScheduler;
     loginHostBindings;
+    zitadelIdTokenUserinfo;
     broker;
     edgeWorkers;
     hostFiles;
@@ -142,6 +143,7 @@ export class FoundryPlanApply {
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
+        this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
         this.broker = options.broker ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
@@ -876,6 +878,7 @@ export class FoundryPlanApply {
         const platformHostnames = await this.platformServiceHostnames();
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
+            zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
             broker: this.broker,
             edgeWorkers: this.edgeWorkers,
             otherSlugs,
@@ -1301,6 +1304,7 @@ const STEP_FIELDS = {
     'zitadel:issuer': 'issuer.usesDomain',
     'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
+    'zitadel:id-token-userinfo': 'hosting.entries.uses.auth',
     'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',

package/dist/plan/platform-diff.d.ts

@@ -472,6 +472,22 @@ export declare function dbEnvAppliedScopeKey(entryKey: string): string;
  * service's own marker, and vice versa.
  */
 export declare function serviceDbEnvAppliedScopeKey(service: 'chat' | 'calls-service'): string;
+/**
+ * The ZITADEL app id of company app `appKey` once "user info inside the ID
+ * token" was switched on for it (`updateOidcAppIdTokenUserinfoAssertion`).
+ * `diff.ts` plans one step for the org while any live sign-in app's recorded
+ * id differs from its marker, so an app made before the setting existed, or
+ * made again under a new id, is repaired once.
+ */
+export declare function zitadelAppIdTokenUserinfoAppliedScopeKey(appKey: string): string;
+/** The ZITADEL app id of Archon's sign-in client in the platform's own ZITADEL. */
+export declare const PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY = "zitadel_platform_archon_app";
+/**
+ * The ZITADEL app id of Archon's sign-in client once "user info inside the
+ * ID token" was switched on for it. `planArchonIdTokenUserinfo` plans the
+ * repair while this differs from the recorded client app id.
+ */
+export declare const PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY = "archon_id_token_userinfo_applied";
 /**
  * The settings `coolifyApp` owns on an entry's app (`folder`, `port`,
  * `autoDeploy`) as the JSON the marker below holds. `coolifyApp` records it
@@ -988,6 +1004,12 @@ export interface PlanPlatformOptions {
         };
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
+        /**
+         * The Archon sign-in client's ZITADEL client has
+         * `updateOidcAppIdTokenUserinfoAssertion`. Not a block: without it the
+         * repair step is not planned.
+         */
+        archonIdTokenUserinfo?: boolean;
     };
     /**
      * Steps whose live state differs from the declared one in a way the recorded

package/dist/plan/platform-diff.js

@@ -521,6 +521,24 @@ export function dbEnvAppliedScopeKey(entryKey) {
 export function serviceDbEnvAppliedScopeKey(service) {
     return `service_db_env_applied.${service}`;
 }
+/**
+ * The ZITADEL app id of company app `appKey` once "user info inside the ID
+ * token" was switched on for it (`updateOidcAppIdTokenUserinfoAssertion`).
+ * `diff.ts` plans one step for the org while any live sign-in app's recorded
+ * id differs from its marker, so an app made before the setting existed, or
+ * made again under a new id, is repaired once.
+ */
+export function zitadelAppIdTokenUserinfoAppliedScopeKey(appKey) {
+    return `zitadel_app_id_token_userinfo_applied.${appKey}`;
+}
+/** The ZITADEL app id of Archon's sign-in client in the platform's own ZITADEL. */
+export const PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY = 'zitadel_platform_archon_app';
+/**
+ * The ZITADEL app id of Archon's sign-in client once "user info inside the
+ * ID token" was switched on for it. `planArchonIdTokenUserinfo` plans the
+ * repair while this differs from the recorded client app id.
+ */
+export const PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY = 'archon_id_token_userinfo_applied';
 export function appSettingsOf(entry) {
     return {
         folder: entry.folder,
@@ -1137,6 +1155,10 @@ export function planPlatform(platform, live, options = {}) {
         plannedSteps.push(uptime.step);
     if (archon.step && blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
+    // After Archon's own step: a repair that fails must not hold up the work before it.
+    const idTokenUserinfo = planArchonIdTokenUserinfo(platform, recordedIds, blocked.archonIdTokenUserinfo ?? false);
+    if (idTokenUserinfo)
+        plannedSteps.push(idTokenUserinfo);
     // #251: one line per service whose recorded applied ref no longer matches
     // what the next apply would use (or, for zitadel, what is actually live).
     // Never pushed into `plannedSteps` -- see `VersionChangeItem`'s own doc
@@ -2156,6 +2178,32 @@ function planEdge(platform, recordedIds, executorBlocked, drifted) {
         blocked: null,
     };
 }
+/**
+ * Archon's sign-in client, once it exists, gets "user info inside the ID
+ * token" switched on: a client made before the setting existed has none, so
+ * its ID token carries no `email` and the console stores none for its
+ * people. One `zitadel:id-token-userinfo` step keyed {@link PLATFORM_ARCHON_KEY},
+ * planned while the recorded client app id differs from
+ * {@link PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY} (a client made
+ * again has a new id). Not planned when the host's ZITADEL client lacks the
+ * method, and not blocked either: nothing is owed until the host wires it.
+ */
+function planArchonIdTokenUserinfo(platform, recordedIds, wired) {
+    if (!wired || !platform.archon.enabled)
+        return null;
+    const appId = recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!appId || recordedIds[PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY] === appId) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'id-token-userinfo', key: PLATFORM_ARCHON_KEY, desired: {} },
+        step: {
+            description: "switch on user info in the ID token for Archon's sign-in client",
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /**
  * #604: the platform's ZITADEL as a sign-in provider in Cloudflare Access: a
  * ZITADEL client for Cloudflare, then edge's `ensureProvider`. One

package/dist/plan/platform-providers.d.ts

@@ -66,7 +66,23 @@ export interface PlatformZitadelSmtp {
         changed: boolean;
     }>;
 }
+/**
+ * Where ZITADEL's SMTP provider sends mail, instead of Lettermint's relay
+ * (`smtp.lettermint.co:587`, STARTTLS, user `lettermint`).
+ */
+export interface PlatformAuthSmtp {
+    host: string;
+    /** An integer from 1 to 65535. */
+    port: number;
+    /** ZITADEL's "TLS" flag for the connection. */
+    tls: boolean;
+    user: string;
+    /** Resolves the SMTP password. Absent, the broker's mail key (held, else the broker's env) is the password. */
+    password?: () => Promise<string>;
+}
 export interface PlatformAuthDeps {
+    /** Overrides the Lettermint SMTP relay ZITADEL is given. Absent, Lettermint exactly as before. */
+    smtp?: PlatformAuthSmtp;
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
@@ -319,6 +335,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         };
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
+        archonIdTokenUserinfo?: boolean;
     }>;
     /**
      * foundry#542: why the uptime Worker cannot run yet, which optional secrets
@@ -516,7 +533,7 @@ export interface PlatformArchonDeps {
     access: PlatformAccessFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'>;
     /** {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client. */
     zitadelForInstance?: (issuerUrl: string) => PlatformArchonDeps['zitadel'];
     /**

package/dist/plan/platform-providers.js

@@ -9,7 +9,7 @@ import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrSta
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
@@ -350,6 +350,21 @@ export class FoundryPlatformStepExecutor {
                 }
             }
         }
+        // Not a block: without the method the planner plans no repair step for Archon's sign-in client.
+        if (this.archon &&
+            platform.archon.enabled &&
+            recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY]) {
+            try {
+                const zitadel = this.archon.zitadelForInstance?.(`https://${platform.auth.hostname}`) ??
+                    this.archon.zitadel;
+                if (zitadel.updateOidcAppIdTokenUserinfoAssertion)
+                    blocked.archonIdTokenUserinfo = true;
+            }
+            catch (e) {
+                // No ZITADEL client for this instance: the flag stays unset and the repair is not planned.
+                console.error(`platform:archon: could not reach the platform's ZITADEL client to plan the ID token repair: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
         // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
         if (this.archon?.runsInsideApp) {
             blocked.archonRunsInsideApp = true;
@@ -582,6 +597,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformHc(context, this.hc);
         }
+        if (action.system === 'zitadel' &&
+            action.kind === 'id-token-userinfo' &&
+            action.key === PLATFORM_ARCHON_KEY) {
+            if (!this.archon) {
+                throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
+            }
+            return switchOnArchonIdTokenUserinfo(context, this.archon);
+        }
         if (action.system === 'cloudflare' && action.kind === 'access-provider') {
             if (!this.accessProvider) {
                 throw new Error('cloudflare:access-provider needs FoundryPlatformStepExecutor to be constructed with its Access provider dependencies (#604)');
@@ -1725,25 +1748,29 @@ async function provisionPlatformAuth(context, deps, owners = []) {
     // The token is the held key, else the broker's live env. Absent, nothing
     // here can run; `authBrokerBlockedReason` already reports it by name.
     const mailToken = heldMailKey || (await currentEnvValue(deps.coolify, brokerAppId, 'LETTERMINT_API_TOKEN'));
+    const smtpTarget = resolveAuthSmtp(deps.smtp);
     if (mailToken) {
         const mailZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        let smtpPassword;
         try {
             // Runs every time the step does (idempotent), so a rotated token lands.
+            smtpPassword = (await deps.smtp?.password?.()) ?? mailToken;
             const smtp = await mailZitadel.ensureSmtpProvider({
-                host: PLATFORM_AUTH_SMTP_HOST,
-                user: PLATFORM_AUTH_SMTP_USER,
-                password: mailToken,
+                host: smtpTarget.host,
+                user: smtpTarget.user,
+                password: smtpPassword,
                 senderAddress: `noreply@${platform.apex}`,
                 senderName: PLATFORM_AUTH_MAIL_SENDER_NAME,
-                tls: true,
+                tls: smtpTarget.tls,
                 description: PLATFORM_AUTH_SMTP_DESCRIPTION,
             });
             await record(PLATFORM_AUTH_SMTP_SCOPE_KEY, smtp.id);
         }
         catch (error) {
-            // The cause, with the Lettermint key redacted, so a failure says why.
+            // The cause, with the Lettermint key (and an overriding SMTP password) redacted, so a failure says why.
             const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
                 mailToken,
+                ...(smtpPassword ? [smtpPassword] : []),
             ]);
             throw new Error(`platform:auth: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
         }
@@ -1773,6 +1800,7 @@ async function provisionPlatformAuth(context, deps, owners = []) {
                         owner.email,
                         owner.email.toLowerCase(),
                         mailToken,
+                        ...(smtpPassword ? [smtpPassword] : []),
                     ]);
                     throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerOrgId}: ${cause}`);
                 }
@@ -1785,6 +1813,29 @@ async function provisionPlatformAuth(context, deps, owners = []) {
 /** Lettermint's SMTP relay, as ZITADEL's SMTP provider wants it: `host:port`, STARTTLS. */
 const PLATFORM_AUTH_SMTP_HOST = 'smtp.lettermint.co:587';
 const PLATFORM_AUTH_SMTP_USER = 'lettermint';
+/**
+ * The SMTP target for ZITADEL's provider: Lettermint's, or the host's override
+ * once validated. Throws a message that never holds the password.
+ */
+function resolveAuthSmtp(override) {
+    if (!override) {
+        return { host: PLATFORM_AUTH_SMTP_HOST, user: PLATFORM_AUTH_SMTP_USER, tls: true };
+    }
+    const { host, port, tls, user } = override;
+    if (typeof host !== 'string' || !host.trim() || /[\s/:]/.test(host)) {
+        throw new Error('platform:auth: smtp.host must be a non-empty host name with no port or path');
+    }
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error('platform:auth: smtp.port must be an integer from 1 to 65535');
+    }
+    if (typeof tls !== 'boolean') {
+        throw new Error('platform:auth: smtp.tls must be true or false');
+    }
+    if (typeof user !== 'string' || !user.trim()) {
+        throw new Error('platform:auth: smtp.user must be non-empty');
+    }
+    return { host: `${host}:${port}`, user, tls };
+}
 /** Marks the provider as foundry's, so `ensureSmtpProvider` finds it again. */
 const PLATFORM_AUTH_SMTP_DESCRIPTION = 'foundry:platform:lettermint';
 /** The same name the broker's `from` uses (`Company Included <noreply@apex>`). */
@@ -2636,11 +2687,44 @@ const PLATFORM_ARCHON_ACCESS_SCOPE_KEY = 'cloudflare_platform_archon_access_app'
 /** The platform's own ZITADEL org (`foundry`, the one `provisionPlatformAuth` mints its admin user in). */
 export const PLATFORM_ZITADEL_ORG_SCOPE_KEY = 'zitadel_platform_org';
 const PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_platform_archon_project';
-const PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY = 'zitadel_platform_archon_app';
 /** The hostname the sign-in client's redirect URIs were made for; a change makes a new client. */
 const PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY = 'zitadel_platform_archon_client_hostname';
 /** Archon's OIDC client id: public, not a secret, so a plain scope id. */
 export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_client_id';
+/**
+ * Switches on "user info inside the ID token" for Archon's sign-in client
+ * (`zitadel:id-token-userinfo` keyed {@link PLATFORM_ARCHON_KEY}). The marker
+ * is the client's app id, recorded only after the call returned, so a call
+ * that throws leaves none and the next plan names the step again. The error
+ * names the ids only, never the cause.
+ */
+async function switchOnArchonIdTokenUserinfo(context, deps) {
+    const { platform } = context;
+    const recorded = context.recordedIds();
+    const zitadel = deps.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? deps.zitadel;
+    // The planner plans nothing without the method; a stale plan does nothing.
+    if (!zitadel.updateOidcAppIdTokenUserinfoAssertion)
+        return {};
+    const orgId = recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
+    const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!orgId || !projectId || !appId) {
+        throw new Error('platform:archon: the sign-in client is not recorded yet -- cannot switch on user info in its ID token');
+    }
+    let done;
+    try {
+        done = await zitadel.updateOidcAppIdTokenUserinfoAssertion(orgId, projectId, appId);
+    }
+    catch {
+        throw new Error(`platform:archon: switching on user info in the ID token failed for the sign-in client ${appId}`);
+    }
+    // A client that answers every property (`packages/local`) resolves to something else: no marker.
+    if (typeof done !== 'boolean')
+        return {};
+    context.recordScopeId(PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, appId);
+    await context.persist?.();
+    return {};
+}
 /**
  * #175: makes `coolify:app` keyed {@link PLATFORM_ARCHON_KEY} true: Archon
  * from https://github.com/wtfalch/archon on `platform.archon.gitRef`, its own
@@ -2916,6 +3000,8 @@ async function provisionPlatformArchon(context, deps) {
             postLogoutRedirectUris: [`https://${hostname}/`],
         });
         context.recordScopeId(PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, created.appId);
+        // Made with the setting on (providers 0.9.0): nothing to repair on this id.
+        context.recordScopeId(PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, created.appId);
         context.recordScopeId(PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY, hostname);
         await record(PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY, created.clientId);
         clientId = created.clientId;

package/dist/plan/providers-readers.d.ts

@@ -4,6 +4,8 @@ import { type ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import type { AiReader, CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
+/** The `CoolifyClient` methods the readers call, so a host's own implementation needs no cast. */
+type CoolifyReaderClient = Pick<CoolifyClient, 'listResources' | 'getApplication' | 'getDatabase' | 'listEnvs' | 'listStorages'>;
 /**
  * Real `CoolifyReader`, `CloudflareReader` and `ZitadelReader` implementations
  * (`live.ts:31-45`), backed by `@wtfalch/providers`' HTTP clients instead of
@@ -94,7 +96,7 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
+    constructor(client: CoolifyReaderClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
     /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
     listProject(projectUuid: string): Promise<LiveResource[]>;
@@ -229,6 +231,7 @@ export declare class ProvidersCmsReader implements CmsReader {
     private readonly resolveProjectScope;
     private readonly resolveCmsAppId;
     private readonly resolveSiteAppId;
-    constructor(client: CoolifyClient, resolveProjectScope: ScopeResolver, resolveCmsAppId: ScopeResolver, resolveSiteAppId: ScopeResolver);
+    constructor(client: CoolifyReaderClient, resolveProjectScope: ScopeResolver, resolveCmsAppId: ScopeResolver, resolveSiteAppId: ScopeResolver);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.26.4",
+  "version": "0.27.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",