@wtfalch/foundry 0.32.0 → 0.33.1

package/dist/plan/diff.js

@@ -1,7 +1,7 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
@@ -16,6 +16,7 @@ import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
+import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
@@ -165,11 +166,19 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // The platform's own org: its domain is the platform apex (the same fact
     // #491 reads for mail). It signs in on the shared instance's own host, so
     // `issuer.usesDomain` never moves it.
-    const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformApex);
+    const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId);
     const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady, isPlatformOrg);
     if (issuer.step)
         plannedSteps.push(issuer.step);
-    plannedSteps.push(...planOwners(org, recordedIds, platformReadiness.authReady, platformReadiness.authIssuer));
+    // Before the domain and the owners: no invite runs on an org still open to registration.
+    const registrationClosed = planOrgRegistrationClosed(org, recordedIds, platformReadiness.authReady, issuer.step);
+    if (registrationClosed)
+        plannedSteps.push(registrationClosed);
+    const orgDomain = planOrgDomain(org, recordedIds, platformReadiness.authReady, issuer.step);
+    if (orgDomain)
+        plannedSteps.push(orgDomain);
+    const owners = planOwners(org, recordedIds, platformReadiness.authReady, platformReadiness.authIssuer, options.ownerInviteMail ?? false, registrationClosed !== null);
+    plannedSteps.push(...owners.steps);
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
@@ -506,6 +515,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // budget, key) would otherwise also have nothing to act on.
     if (issuer.blocked)
         unmanaged.push({ description: issuer.blocked, key: 'zitadel:issuer' });
+    unmanaged.push(...owners.blocked);
+    const domainBlocked = orgDomainBlocked(org, recordedIds);
+    if (domainBlocked)
+        unmanaged.push(domainBlocked);
     // #267 (rule 2): a login host with no ZITADEL org to trust it in is blocked, not planned to throw.
     if (loginHost.blocked) {
         unmanaged.push({ description: loginHost.blocked, key: 'zitadel:login-host' });
@@ -698,6 +711,70 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
         blocked: null,
     };
 }
+/**
+ * Closes self-registration on a ZITADEL org that already exists and has no
+ * recorded close: one made before foundry closed it, or one whose close failed
+ * inside the issuer step. A fresh org is closed inside the issuer step, so
+ * nothing is planned beside that step. While this step is planned no owner is
+ * invited ({@link planOwners}).
+ */
+function planOrgRegistrationClosed(org, recordedIds, authReady, issuerStep) {
+    if (!authReady)
+        return null;
+    if (issuerStep?.action.desired.provision === true)
+        return null;
+    if (!recordedIds.zitadel_org)
+        return null;
+    if (recordedIds[ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY] === recordedIds.zitadel_org) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'registration-closed', key: org.id, desired: {} },
+        step: {
+            description: `switch self-registration off on ${org.slug}'s sign-in org`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
+/** The blocked item for an org sign-in domain the sign-in server refused to make primary. */
+function orgDomainBlocked(org, recordedIds) {
+    const domain = signInOrgDomain(org);
+    if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() !== domain)
+        return null;
+    if (recordedIds[ZITADEL_ORG_DOMAIN_SCOPE_KEY]?.toLowerCase() === domain)
+        return null;
+    return { description: signInDomainBlockedText(org.slug, domain), key: 'zitadel:domain' };
+}
+/**
+ * Registers the org's sign-in domain (its own, or `<slug>.oikos.host`) on its ZITADEL org
+ * and makes it primary, so an owner signs in as `name@<domain>`. Idempotent on the
+ * *recorded* `zitadel_org_domain`: a changed declared domain plans it again. A fresh
+ * org gets its domain inside the issuer step, so nothing is planned beside that step.
+ * Nothing is planned until the ZITADEL org exists.
+ */
+function planOrgDomain(org, recordedIds, authReady, issuerStep) {
+    if (!authReady)
+        return null;
+    if (issuerStep?.action.desired.provision === true)
+        return null;
+    if (!recordedIds.zitadel_org)
+        return null;
+    const domain = signInOrgDomain(org);
+    if (recordedIds[ZITADEL_ORG_DOMAIN_SCOPE_KEY]?.toLowerCase() === domain)
+        return null;
+    // Refused once: reported as blocked (see `orgDomainBlocked`), not planned again.
+    if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() === domain)
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'domain', key: org.id, desired: { domain } },
+        step: {
+            description: `register ${domain} as ${org.slug}'s sign-in domain`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /**
  * The org's owners, one step each, each invited by ZITADEL email once the org's ZITADEL org
  * exists (goal line: "the org's owner is invited by ZITADEL email and sets a
@@ -718,6 +795,11 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
  * issuer step immediately before it in the same run: `plan-apply.ts`'s
  * `runSteps` awaits each planned step in array order, one at a time.
  *
+ * An owner signs in as `name@<org domain>`, so each unrecorded owner needs a work
+ * address (`mailboxAddress`, or `mail.ownerMailboxAddress` for the first owner) and the
+ * host needs an `ownerInviteMail` port to send the first-sign-in link to the personal
+ * address. Without either, that owner is a blocked item named by position (rule 2).
+ *
  * `desired` carries the owner's email so the executor can pass it to
  * `ZitadelClient.inviteOrgOwner` — but the step's own `description` never
  * does. `Plan` (the public contract `AuditLog.recordPlan`/`recordApply`
@@ -726,19 +808,40 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
  * nothing here puts it anywhere beyond what audit already records for the
  * org.
  */
-function planOwners(org, recordedIds, authReady, authIssuer) {
+function planOwners(org, recordedIds, authReady, authIssuer, ownerInviteMail, registrationOpen = false) {
+    const steps = [];
+    const blocked = [];
+    // The close step is planned in this plan; the invites come with the next one, after it succeeded.
+    if (registrationOpen)
+        return { steps, blocked };
     // #177: nothing to invite into yet -- `planIssuer` already reports the
     // platform's sign-in as blocked, so these steps stay silent rather than
     // repeating it.
     if (!authReady)
-        return [];
-    const steps = [];
+        return { steps, blocked };
+    const mailboxes = ownerMailboxes(org);
     org.owners.forEach((owner, index) => {
         // Every owner is keyed by its lowercased email (as `validateOwners` compares
         // it), so reordering the list never moves a key onto another person.
         const key = `${org.id}:${owner.email.toLowerCase()}`;
         if (recordedIds[resourceKey('zitadel', 'owner', key)])
             return; // already invited.
+        const position = index + 1;
+        const mailboxAddress = mailboxes[index]?.address;
+        if (!mailboxAddress) {
+            blocked.push({
+                description: `${org.slug}'s owner ${position} is blocked, not planned: no mailboxAddress is declared, and the owner signs in as name@<the org's domain>`,
+                key: `zitadel:owner:${position}`,
+            });
+            return;
+        }
+        if (!ownerInviteMail) {
+            blocked.push({
+                description: `${org.slug}'s owner ${position} is blocked, not planned: the host has no ownerInviteMail port, and the owner cannot open their work mailbox yet`,
+                key: `zitadel:owner:${position}`,
+            });
+            return;
+        }
         steps.push({
             action: {
                 system: 'zitadel',
@@ -746,6 +849,7 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
                 key,
                 desired: {
                     email: owner.email,
+                    mailboxAddress,
                     givenName: owner.givenName,
                     familyName: owner.familyName,
                     // The platform's login app, where the invite link must land (it serves `/verify`).
@@ -761,7 +865,7 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
             },
         });
     });
-    return steps;
+    return { steps, blocked };
 }
 /**
  * #488: the bare hostname out of an issuer URL (`https://<hostname>`, the
@@ -771,8 +875,8 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
-export function isPlatformOwnOrg(org, platformApex) {
-    return Boolean(org.domain && platformApex && org.domain.toLowerCase() === platformApex.toLowerCase());
+export function isPlatformOwnOrg(org, platformOwnerOrgId) {
+    return Boolean(platformOwnerOrgId && org.id === platformOwnerOrgId);
 }
 function platformAuthHostnameFrom(issuer) {
     if (!issuer)
@@ -2237,6 +2341,7 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         ? `${org.slug}'s Boule mail is blocked, not planned: ${mailBlockedReason}`
         : null;
     const mailOn = mailWanted && !mailBlocked;
+    const platformOwner = isPlatformOwnOrg(org, readiness.platformOwnerOrgId);
     const action = {
         system: 'coolify',
         kind: 'boule',
@@ -2249,6 +2354,8 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
             platformApex: readiness.platformApex,
             platformLettermintProjectId: readiness.platformLettermintProjectId,
             mailBlocked: mailBlocked !== null,
+            // Only the platform's own org's Boule gets the peer password for Archon.
+            platformOwner,
         },
     };
     if (!live) {
@@ -2269,6 +2376,15 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         bouleMailTokenDrift(liveEnv[BOULE_MAIL_TOKEN_ENV], live.config.appMailToken)) {
         drift.push(BOULE_MAIL_TOKEN_ENV);
     }
+    // The peer password is secret, so only its absence is compared.
+    if (platformOwner && !liveEnv[BOULE_PEER_PASSWORD_ENV])
+        drift.push(BOULE_PEER_PASSWORD_ENV);
+    if (platformOwner && !liveEnv[BOULE_BRIDGE_SECRET_ENV])
+        drift.push(BOULE_BRIDGE_SECRET_ENV);
+    // Secrets written but Boule not restarted since: plan the step so it restarts, minting nothing.
+    if (platformOwner && !recordedIds[BOULE_SECRETS_RESTARTED_SCOPE_KEY]) {
+        drift.push('restart after the peer password and bridge secret');
+    }
     if (drift.length === 0)
         return { step: null, blocked: null, mailBlocked };
     return {

package/dist/plan/executor.d.ts

@@ -14,6 +14,7 @@ import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
+export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
 /**
  * The Coolify calls this executor makes, shaped to match
  * `@wtfalch/providers/coolify`'s `CoolifyClient` method-for-method — a real
@@ -36,6 +37,12 @@ export interface CoolifyPort {
         name: string;
         description?: string | null;
     } | null>;
+    /** A project's environments (`CoolifyClient.listEnvironments`), read-only. */
+    listEnvironments(projectUuid: string): Promise<Array<{
+        id: number;
+        uuid: string;
+        name: string;
+    }>>;
     createProject(name: string, description?: string): Promise<{
         uuid: string;
     }>;
@@ -878,10 +885,22 @@ export interface ZitadelPort {
         givenName: string;
         familyName: string;
         email: string;
-    }, urlTemplate?: string): Promise<{
+        username?: string;
+    }, urlTemplate?: string, returnCode?: boolean): Promise<{
         userId: string;
         created: boolean;
+        inviteCode?: string;
     }>;
+    /** Adds a domain to the org. Idempotent: a domain already on the org is a no-op. */
+    addOrgDomain(orgId: string, domain: string): Promise<void>;
+    /** Makes a domain already on the org its primary one. Idempotent: no-op when it already is. */
+    setPrimaryOrgDomain(orgId: string, domain: string): Promise<void>;
+    setUserMetadata(orgId: string, userId: string, key: string, value: string): Promise<void>;
+    getUserMetadata(orgId: string, userId: string, key: string): Promise<string | null>;
+    findUserByEmail(orgId: string, email: string): Promise<{
+        userId: string;
+        state: string;
+    } | null>;
     /**
      * Adds a role to a project. Idempotent: a role that already exists is not
      * an error. `@wtfalch/providers`' `ZitadelClient` has no project-role API,
@@ -1456,6 +1475,16 @@ export interface FoundryStepExecutorPorts {
      * compilation over one dependency nothing else needs.
      */
     mailCopy?: MailCopyPort;
+    /**
+     * Mails an owner's first-sign-in link to their personal address. The link
+     * carries the one-time invite code `inviteOrgOwner` returned, so an error
+     * from `send` must not repeat `link`. Optional: without it the planner
+     * reports each owner's invite as blocked, because the owner's work address
+     * is not a mailbox they can open yet.
+     */
+    ownerInviteMail?: {
+        send(to: string, link: string): Promise<void>;
+    };
     /**
      * #463: the cross-homeserver copy chat's forward re-key needs -- see
      * {@link ChatRekeyPort}'s own doc comment. Optional the same way
@@ -1661,7 +1690,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private edgeRateLimits;
     private edgeZones;
     private edgeWriteSlot;
+    /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
+    private readonly handledSecrets;
     constructor(ports: FoundryStepExecutorPorts);
+    secretsHandled(): readonly string[];
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts(): Partial<Record<EdgePortName, boolean>>;
     execute(action: StepAction, context: StepExecutionContext): Promise<{
@@ -1765,12 +1797,30 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private teardownWorker;
     private zitadelIssuer;
     /**
-     * `plan/diff.ts`'s `planOwner`: invites the org's owner into its ZITADEL
-     * org by email. Never logs, returns or throws the email itself -- only the
-     * invited user id, handed back as `resourceId` so `runSteps` records it
-     * under `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
-     * `plan()` call idempotent (`planOwner` plans nothing once that key is
-     * recorded).
+     * `plan/diff.ts`'s `planOrgRegistrationClosed`: closes self-registration on
+     * the recorded ZITADEL org, for an org made before foundry did this or whose
+     * close failed in the issuer step. Recorded only after the close returned.
+     */
+    private zitadelRegistrationClosed;
+    /**
+     * `plan/diff.ts`'s `planOrgDomain`: registers the org's sign-in domain on
+     * its recorded ZITADEL org and makes it primary, for an org whose ZITADEL
+     * org was made before foundry did this. Records the domain only after both
+     * calls succeeded.
+     */
+    private zitadelDomain;
+    /**
+     * `plan/diff.ts`'s `planOwners`: makes the owner's account in the org's
+     * ZITADEL org and mails the first-sign-in link to their personal address.
+     * The account's username is the local part of `mailboxAddress` and its email
+     * is `mailboxAddress`, so the owner signs in as `name@<org domain>`; the
+     * personal address is kept as the `personal_email` metadata. The invite code
+     * ZITADEL returns goes only into that mail. Nothing here logs, returns or
+     * throws the personal address or the code -- only the invited user id, handed
+     * back as `resourceId` so `runSteps` records it under
+     * `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
+     * `plan()` call idempotent. A failure after the account exists records
+     * nothing: the next apply finds the account by username and mints a new code.
      */
     private zitadelOwner;
     /**
@@ -1992,6 +2042,14 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private bouleBrokerEntry;
     /** The shared tail of both broker-entry steps: read the app's key, write the entry, record what was written. */
     private writeAppBrokerEntry;
+    /**
+     * `null` once the app already has `AUTHZ_PEER_PASSWORD_OPERATOR`: minted only
+     * the first time and never rotated, like {@link ensureAuthCookieSecret}.
+     */
+    private ensurePeerPassword;
+    /** Same rule for the secret Archon's invite form sends to Boule. */
+    private ensureBridgeSecret;
+    private mintIfAbsent;
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
      * only the first time (task brief), never regenerated or overwritten, so a

package/dist/plan/executor.js

@@ -1,9 +1,10 @@
 import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
+import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -27,6 +28,7 @@ import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyC
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
@@ -51,7 +53,7 @@ import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerR
  */
 /** #569: the description foundry gives the Coolify project it creates for an org. */
 const COOLIFY_PROJECT_MARK_PREFIX = 'foundry org ';
-function coolifyProjectMark(org) {
+export function coolifyProjectMark(org) {
     return `${COOLIFY_PROJECT_MARK_PREFIX}${org.id}`;
 }
 /**
@@ -761,9 +763,14 @@ export class FoundryStepExecutor {
     edgeRateLimits;
     edgeZones;
     edgeWriteSlot;
+    /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
+    handledSecrets = new Set();
     constructor(ports) {
         this.ports = ports;
     }
+    secretsHandled() {
+        return [...this.handledSecrets];
+    }
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts() {
         return {
@@ -779,6 +786,10 @@ export class FoundryStepExecutor {
         switch (`${action.system}:${action.kind}`) {
             case 'zitadel:issuer':
                 return this.zitadelIssuer(action, org, context);
+            case 'zitadel:registration-closed':
+                return this.zitadelRegistrationClosed(org, context);
+            case 'zitadel:domain':
+                return this.zitadelDomain(action, org, context);
             case 'zitadel:owner':
                 return this.zitadelOwner(action, org, context);
             case 'zitadel:login-host':
@@ -1290,17 +1301,60 @@ export class FoundryStepExecutor {
             // their own design" -- not built in v1).
             throw new NotBuiltError(`zitadel:issuer move for ${org.slug}`, 'moving the issuer onto or off the org\'s own domain is not built in v1; see foundry\'s .claude/decisions-2026-09-24-executor.md, "Executor decisions"');
         }
-        const { org: zOrg } = await this.ports.zitadel.findOrCreateOrg(org.slug);
-        context.recordScopeId('zitadel_org', zOrg.id);
-        return { resourceId: zOrg.id };
+        const { orgId } = await ensureSignInOrg({
+            zitadel: this.ports.zitadel,
+            name: org.slug,
+            domain: signInOrgDomain(org),
+            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            persistScopeIds: () => context.persistScopeIds(),
+            registrationClosedScopeKey: ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY,
+        });
+        return { resourceId: orgId };
+    }
+    /**
+     * `plan/diff.ts`'s `planOrgRegistrationClosed`: closes self-registration on
+     * the recorded ZITADEL org, for an org made before foundry did this or whose
+     * close failed in the issuer step. Recorded only after the close returned.
+     */
+    async zitadelRegistrationClosed(org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:registration-closed for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        await closeSignInOrgRegistration(this.ports.zitadel, zitadelOrgId, (key, id) => context.recordScopeId(key, id));
+        return {};
+    }
+    /**
+     * `plan/diff.ts`'s `planOrgDomain`: registers the org's sign-in domain on
+     * its recorded ZITADEL org and makes it primary, for an org whose ZITADEL
+     * org was made before foundry did this. Records the domain only after both
+     * calls succeeded.
+     */
+    async zitadelDomain(action, org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:domain for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        const domain = action.desired.domain;
+        // A refusal (the sign-in server's domain policy wants proof) is recorded and reported as
+        // blocked by the planner; it does not fail every apply.
+        const registered = await registerSignInDomainOrBlock(this.ports.zitadel, zitadelOrgId, domain, (key, id) => context.recordScopeId(key, id));
+        if (registered)
+            context.recordScopeId(ZITADEL_ORG_DOMAIN_SCOPE_KEY, domain);
+        return {};
     }
     /**
-     * `plan/diff.ts`'s `planOwner`: invites the org's owner into its ZITADEL
-     * org by email. Never logs, returns or throws the email itself -- only the
-     * invited user id, handed back as `resourceId` so `runSteps` records it
-     * under `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
-     * `plan()` call idempotent (`planOwner` plans nothing once that key is
-     * recorded).
+     * `plan/diff.ts`'s `planOwners`: makes the owner's account in the org's
+     * ZITADEL org and mails the first-sign-in link to their personal address.
+     * The account's username is the local part of `mailboxAddress` and its email
+     * is `mailboxAddress`, so the owner signs in as `name@<org domain>`; the
+     * personal address is kept as the `personal_email` metadata. The invite code
+     * ZITADEL returns goes only into that mail. Nothing here logs, returns or
+     * throws the personal address or the code -- only the invited user id, handed
+     * back as `resourceId` so `runSteps` records it under
+     * `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
+     * `plan()` call idempotent. A failure after the account exists records
+     * nothing: the next apply finds the account by username and mints a new code.
      */
     async zitadelOwner(action, org, context) {
         const zitadelOrgId = context.recordedIds().zitadel_org;
@@ -1313,11 +1367,31 @@ export class FoundryStepExecutor {
         if (!authIssuer) {
             throw new Error(`zitadel:owner for ${org.slug}: no invite template issuer -- refusing to send ZITADEL's default invite link, which 404s on this platform`);
         }
-        const { userId } = await this.ports.zitadel.inviteOrgOwner(zitadelOrgId, {
-            givenName: action.desired.givenName,
-            familyName: action.desired.familyName,
-            email: action.desired.email,
-        }, `${authIssuer}/verify?userId={{.UserID}}&code={{.Code}}&organization={{.OrgID}}&invite=true`);
+        const mailboxAddress = action.desired.mailboxAddress;
+        if (!mailboxAddress) {
+            throw new Error(`zitadel:owner for ${org.slug}: no mailboxAddress -- the planner reports this as blocked, so it should not reach the executor`);
+        }
+        const inviteMail = this.ports.ownerInviteMail;
+        if (!inviteMail) {
+            throw new Error(`zitadel:owner for ${org.slug}: no ownerInviteMail port -- the owner's work mailbox cannot be opened yet, so the invite is not sent there`);
+        }
+        // foundry's own record of this owner's account, so a returning owner is not mistaken for a stranger.
+        const invitedBefore = context.recordedIds()[`zitadel:owner:${action.key}`];
+        const { userId } = await inviteOwnerWithLink({
+            zitadel: this.ports.zitadel,
+            mail: inviteMail,
+            orgId: zitadelOrgId,
+            authIssuer,
+            owner: {
+                givenName: action.desired.givenName,
+                familyName: action.desired.familyName,
+                mailboxAddress,
+                personalEmail: action.desired.email,
+            },
+            label: `zitadel:owner for ${org.slug}`,
+            onSecret: (value) => this.handledSecrets.add(value),
+            ...(invitedBefore ? { invitedUserId: invitedBefore } : {}),
+        });
         // An owner invited after chat was built never reaches `coolifyChat`
         // again, so the role is granted here once the messaging project exists.
         const messagingProjectId = context.recordedIds()[ZITADEL_MESSAGING_PROJECT_SCOPE_KEY];
@@ -2493,6 +2567,23 @@ export class FoundryStepExecutor {
         // Last: a run that failed above plans the step again.
         context.recordScopeId(brokerEntryAppliedScopeKey(entryKey), JSON.stringify(want));
     }
+    /**
+     * `null` once the app already has `AUTHZ_PEER_PASSWORD_OPERATOR`: minted only
+     * the first time and never rotated, like {@link ensureAuthCookieSecret}.
+     */
+    async ensurePeerPassword(appId) {
+        return this.mintIfAbsent(appId, BOULE_PEER_PASSWORD_ENV, 24);
+    }
+    /** Same rule for the secret Archon's invite form sends to Boule. */
+    async ensureBridgeSecret(appId) {
+        return this.mintIfAbsent(appId, BOULE_BRIDGE_SECRET_ENV, 32);
+    }
+    async mintIfAbsent(appId, key, bytes) {
+        const envs = await this.ports.coolify.listEnvs(appId);
+        if (envs.some((e) => e.key === key && !e.is_preview))
+            return null;
+        return randomBytes(bytes).toString('base64url');
+    }
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
      * only the first time (task brief), never regenerated or overwritten, so a
@@ -4707,7 +4798,29 @@ export class FoundryStepExecutor {
         const appKey = await this.ensureAuthAppKey(app.appId);
         if (appKey)
             envs.push({ key: 'AUTH_APP_KEY', value: appKey });
-        await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        // Archon's way into this Boule's people store: only the platform's own
+        // org's Boule gets it, minted once and never rotated (the role Boule's boot
+        // creates from it would otherwise keep the old password).
+        const peerPassword = action.desired.platformOwner === true ? await this.ensurePeerPassword(app.appId) : null;
+        if (peerPassword) {
+            this.handledSecrets.add(peerPassword);
+            envs.push({ key: BOULE_PEER_PASSWORD_ENV, value: peerPassword });
+        }
+        // Archon's invite form calls Boule with this secret; same rule as the password.
+        const bridgeSecret = action.desired.platformOwner === true ? await this.ensureBridgeSecret(app.appId) : null;
+        if (bridgeSecret) {
+            this.handledSecrets.add(bridgeSecret);
+            envs.push({ key: BOULE_BRIDGE_SECRET_ENV, value: bridgeSecret });
+        }
+        try {
+            await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        }
+        catch (error) {
+            const minted = [peerPassword, bridgeSecret].filter((v) => v !== null);
+            if (minted.length === 0)
+                throw error;
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), minted));
+        }
         const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName);
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
@@ -4723,6 +4836,8 @@ export class FoundryStepExecutor {
         // that a previous apply created but crashed before deploying) sat built
         // but never started. Deployed once this executor has confirmed, never
         // again -- a live app is only ever restarted from here on.
+        const secretsNotRestarted = action.desired.platformOwner === true &&
+            !context.recordedIds()[BOULE_SECRETS_RESTARTED_SCOPE_KEY];
         if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
             // #543: every deploy waits for health -- Boule's own public hostname.
             const runtime = this.ports.runtime ?? {};
@@ -4731,10 +4846,21 @@ export class FoundryStepExecutor {
         }
         else if (app.existed &&
             !mail.restarted &&
-            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed || mail.changed)) {
+            (envChanged ||
+                cookieSecret !== null ||
+                appKey !== null ||
+                peerPassword !== null ||
+                bridgeSecret !== null ||
+                secretsNotRestarted ||
+                dbPush.changed ||
+                mail.changed)) {
             // A restart inside the mail rule already came after every env write above.
             await this.ports.coolify.restart(app.appId);
         }
+        // Last, after the restart or deploy: a run that failed before here repeats it, minting nothing.
+        if (action.desired.platformOwner === true) {
+            context.recordScopeId(BOULE_SECRETS_RESTARTED_SCOPE_KEY, '1');
+        }
         return { resourceId: app.appId };
     }
     /**

package/dist/plan/health-targets.js

@@ -28,7 +28,7 @@ const CALLS_HEALTH_PATH = '/healthz';
 function alwaysOnTargets(org, platform) {
     // The platform's own org signs in on the shared instance host, not its own
     // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
-    const loginHost = platform && isPlatformOwnOrg(org, platform.apex)
+    const loginHost = platform && isPlatformOwnOrg(org, platform.ownerOrgId)
         ? platform.auth.hostname
         : loginHostnameFor(org);
     return [

package/dist/plan/index.d.ts

@@ -41,6 +41,8 @@ export type { MailAllowlistApp } from './mail-identity-allowlist.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export type { EnsureSignInOrgOptions } from './sign-in-org.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './sign-in-org.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './health-targets.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
 export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';

package/dist/plan/index.js

@@ -21,6 +21,7 @@ export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './sign-in-org.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
 export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
 export { createEdgeAccess } from './edge-access.js';