@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/proxy-labels.d.ts

@@ -8,22 +8,55 @@ export interface EntryLabelSpec {
     wildcardDomain: string | null;
     port: number;
 }
+/**
+ * The label every routed container carries, with the install's token as its value. Traefik is told
+ * (`--providers.docker.constraints=Label(`foundry.edge`,`<token>`)`) to route only containers that carry
+ * it, so a route an image declares in its own `LABEL`s, which cannot know the token, is ignored.
+ */
+export declare const EDGE_LABEL = "foundry.edge";
 /**
  * The scope key holding the hash of the label set last patched onto an
  * entry's app. Present only for an entry that has had a custom label set.
  */
 export declare function appLabelsAppliedScopeKey(entryKey: string): string;
+/** The entry routes ({@link entryRoutesMarker}) the company tunnel's ingress was last written with. */
+export declare const CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY = "cloudflare_tunnel_entry_routes";
+/**
+ * The entry names in the platform's oikos.host zone ({@link entryOikosHostnames}) the company tunnel's records were
+ * last written for, comma-joined. Recorded only once every record is in place.
+ */
+export declare const CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY = "cloudflare_tunnel_oikos_hostnames";
+/**
+ * The run label every customer hosting-entry container gets. A run label overrides the image's own
+ * `LABEL` of the same key, so Traefik ignores the container whatever its image says: a customer image
+ * cannot route a hostname it does not own. The company's tunnel reaches the container directly
+ * ({@link entryRoutes}); no Traefik router and no Coolify `domains` are involved.
+ */
+export declare const ENTRY_CONTAINER_LABELS = "traefik.enable=false";
+/**
+ * What an entry's routing is built from: the names it is served at, the wildcard domain when it
+ * declares `'*'`, and the port its container listens on. Every entry has one, because every entry
+ * carries {@link ENTRY_CONTAINER_LABELS}. Coolify's default port for an app is 80.
+ */
+export declare function entryLabelSpec(org: DeclaredOrg, entry: HostingEntry): EntryLabelSpec;
+/**
+ * The company tunnel's ingress for the hosting entries: each name, and the wildcard last, goes straight to
+ * `http://<container name>:<port>` on the company network, never through `coolify-proxy`. A wildcard
+ * entry gets a wildcard hostname rule; the first entry that declares `'*'` owns it, and the first entry
+ * that declares a name owns it. An entry with no name (internal) has no rule. This holds for a company
+ * without a domain too: its `<slug>.oikos.host` name is routed by the company's own tunnel
+ * ({@link entryOikosHostnames}), not by the platform's shared ingress.
+ */
+export declare function entryRoutes(org: DeclaredOrg): Array<{
+    hostname: string;
+    service: string;
+}>;
+/** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
+export declare function entryRoutesMarker(org: DeclaredOrg): string;
 /**
- * The label set an entry's app needs, or `null` when it needs none. Coolify
- * replaces the labels it generates from `domains` once `custom_labels` is
- * set, so an entry with `'*'` carries its exact `Host` rules as well. An entry
- * that already has a custom set (`hadLabels`) keeps one, without the wildcard
- * rule, so a removed `'*'` stops matching and a later name change still
- * reaches the app: an empty `custom_labels` is refused by Coolify's API.
- * Coolify's default port for an app is 80.
+ * A short digest of the spec; the same spec always gives the same hash. The token is left out: the
+ * planner has none, and a changed token reaches a live app through the comparison of its live labels.
  */
-export declare function entryLabelSpec(org: DeclaredOrg, entry: HostingEntry, hadLabels: boolean): EntryLabelSpec | null;
-/** A short digest of the spec; the same spec always gives the same hash. */
 export declare function entryLabelHash(spec: EntryLabelSpec): string;
 /**
  * The Traefik labels for an entry's app, one per line. Coolify reaches an app
@@ -32,11 +65,24 @@ export declare function entryLabelHash(spec: EntryLabelSpec): string;
  * `Host(name) && PathPrefix(/)`, default priority. The wildcard is one
  * `HostRegexp` router at `priority=1`, so any exact name, this app's or
  * another's, wins over it. The regex matches one label (`[a-z0-9-]+`), the
- * same depth Cloudflare's Universal certificate covers.
+ * same depth Cloudflare's Universal certificate covers. A set that routes
+ * anything carries {@link EDGE_LABEL}; the "no route" set does not need it.
  */
-export declare function entryProxyLabels(appUuid: string, spec: EntryLabelSpec): string;
+export declare function entryProxyLabels(appUuid: string, spec: EntryLabelSpec, token: string): string;
+/** Whether a label set routes something but does not carry the token: Traefik would ignore it once the constraint is on. */
+export declare function routesWithoutToken(labels: string, token: string): boolean;
 /**
  * Whether two label sets hold the same labels. Order and the `coolify.*`
  * lines Coolify adds and strips itself do not count.
  */
 export declare function sameLabelSets(a: string, b: string): boolean;
+/**
+ * The entry names that live in the platform's `oikos.host` zone (a company with no domain of its own, or with
+ * `usesDomain` off): the names the company's tunnel gets a proxied CNAME for. Sorted.
+ */
+export declare function entryOikosHostnames(org: DeclaredOrg): string[];
+/**
+ * Whether `name` is one the company may write in the platform's `oikos.host` zone: exactly its own
+ * `<slug>.oikos.host`. A company writes no other company's name, whatever an entry declares.
+ */
+export declare function ownsOikosName(org: DeclaredOrg, name: string): boolean;

package/dist/plan/proxy-labels.js

@@ -1,5 +1,19 @@
 import { createHash } from 'node:crypto';
 import { entryHostnames, wildcardHostname } from './hostnames.js';
+import { NO_DOMAIN_ZONE } from './own-hostnames.js';
+import { appNameFor } from './platform-diff.js';
+/**
+ * The label every routed container carries, with the install's token as its value. Traefik is told
+ * (`--providers.docker.constraints=Label(`foundry.edge`,`<token>`)`) to route only containers that carry
+ * it, so a route an image declares in its own `LABEL`s, which cannot know the token, is ignored.
+ */
+export const EDGE_LABEL = 'foundry.edge';
+/** The token is a base64url string; anything else would not survive a label line or Traefik's constraint syntax. */
+const TOKEN_SHAPE = /^[A-Za-z0-9_-]{32,128}$/;
+function checkToken(token) {
+    if (!TOKEN_SHAPE.test(token))
+        throw new Error('proxy labels: the label token is malformed');
+}
 /**
  * The scope key holding the hash of the label set last patched onto an
  * entry's app. Present only for an entry that has had a custom label set.
@@ -7,26 +21,68 @@ import { entryHostnames, wildcardHostname } from './hostnames.js';
 export function appLabelsAppliedScopeKey(entryKey) {
     return `app_labels_applied.${entryKey}`;
 }
+/** The entry routes ({@link entryRoutesMarker}) the company tunnel's ingress was last written with. */
+export const CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY = 'cloudflare_tunnel_entry_routes';
 /**
- * The label set an entry's app needs, or `null` when it needs none. Coolify
- * replaces the labels it generates from `domains` once `custom_labels` is
- * set, so an entry with `'*'` carries its exact `Host` rules as well. An entry
- * that already has a custom set (`hadLabels`) keeps one, without the wildcard
- * rule, so a removed `'*'` stops matching and a later name change still
- * reaches the app: an empty `custom_labels` is refused by Coolify's API.
- * Coolify's default port for an app is 80.
+ * The entry names in the platform's oikos.host zone ({@link entryOikosHostnames}) the company tunnel's records were
+ * last written for, comma-joined. Recorded only once every record is in place.
  */
-export function entryLabelSpec(org, entry, hadLabels) {
+export const CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY = 'cloudflare_tunnel_oikos_hostnames';
+/**
+ * The run label every customer hosting-entry container gets. A run label overrides the image's own
+ * `LABEL` of the same key, so Traefik ignores the container whatever its image says: a customer image
+ * cannot route a hostname it does not own. The company's tunnel reaches the container directly
+ * ({@link entryRoutes}); no Traefik router and no Coolify `domains` are involved.
+ */
+export const ENTRY_CONTAINER_LABELS = 'traefik.enable=false';
+/**
+ * What an entry's routing is built from: the names it is served at, the wildcard domain when it
+ * declares `'*'`, and the port its container listens on. Every entry has one, because every entry
+ * carries {@link ENTRY_CONTAINER_LABELS}. Coolify's default port for an app is 80.
+ */
+export function entryLabelSpec(org, entry) {
     const wildcard = entry.hostnames.includes('*') ? wildcardHostname(org) : null;
-    if (!wildcard && !hadLabels)
-        return null;
     return {
         names: entryHostnames(org, entry),
         wildcardDomain: wildcard ? wildcard.slice(2) : null,
         port: entry.buildPack === 'static' ? 80 : (entry.port ?? 80),
     };
 }
-/** A short digest of the spec; the same spec always gives the same hash. */
+/**
+ * The company tunnel's ingress for the hosting entries: each name, and the wildcard last, goes straight to
+ * `http://<container name>:<port>` on the company network, never through `coolify-proxy`. A wildcard
+ * entry gets a wildcard hostname rule; the first entry that declares `'*'` owns it, and the first entry
+ * that declares a name owns it. An entry with no name (internal) has no rule. This holds for a company
+ * without a domain too: its `<slug>.oikos.host` name is routed by the company's own tunnel
+ * ({@link entryOikosHostnames}), not by the platform's shared ingress.
+ */
+export function entryRoutes(org) {
+    if (!org.hosting.enabled)
+        return [];
+    const routes = [];
+    let wildcard;
+    for (const entry of org.hosting.entries) {
+        const service = `http://${appNameFor(org, entry)}:${entryLabelSpec(org, entry).port}`;
+        for (const hostname of entryHostnames(org, entry)) {
+            if (!routes.some((r) => r.hostname === hostname))
+                routes.push({ hostname, service });
+        }
+        const wildcardName = entry.hostnames.includes('*') ? wildcardHostname(org) : null;
+        if (wildcardName && !wildcard)
+            wildcard = { hostname: wildcardName, service };
+    }
+    if (wildcard)
+        routes.push(wildcard);
+    return routes;
+}
+/** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
+export function entryRoutesMarker(org) {
+    return JSON.stringify(entryRoutes(org));
+}
+/**
+ * A short digest of the spec; the same spec always gives the same hash. The token is left out: the
+ * planner has none, and a changed token reaches a live app through the comparison of its live labels.
+ */
 export function entryLabelHash(spec) {
     return createHash('sha256').update(JSON.stringify(spec)).digest('hex').slice(0, 16);
 }
@@ -37,9 +93,11 @@ export function entryLabelHash(spec) {
  * `Host(name) && PathPrefix(/)`, default priority. The wildcard is one
  * `HostRegexp` router at `priority=1`, so any exact name, this app's or
  * another's, wins over it. The regex matches one label (`[a-z0-9-]+`), the
- * same depth Cloudflare's Universal certificate covers.
+ * same depth Cloudflare's Universal certificate covers. A set that routes
+ * anything carries {@link EDGE_LABEL}; the "no route" set does not need it.
  */
-export function entryProxyLabels(appUuid, spec) {
+export function entryProxyLabels(appUuid, spec, token) {
+    checkToken(token);
     const labels = [];
     const route = (id, rule, priority) => {
         const router = `traefik.http.routers.${id}`;
@@ -56,9 +114,14 @@ export function entryProxyLabels(appUuid, spec) {
     }
     if (labels.length === 0)
         return 'traefik.enable=false';
-    labels.push('traefik.enable=true', 'traefik.http.middlewares.gzip.compress=true');
+    labels.push('traefik.enable=true', 'traefik.http.middlewares.gzip.compress=true', `${EDGE_LABEL}=${token}`);
     return labels.sort().join('\n');
 }
+/** Whether a label set routes something but does not carry the token: Traefik would ignore it once the constraint is on. */
+export function routesWithoutToken(labels, token) {
+    const lines = labels.split(/\r\n|\n|\r/);
+    return lines.includes('traefik.enable=true') && !lines.includes(`${EDGE_LABEL}=${token}`);
+}
 /**
  * Whether two label sets hold the same labels. Order and the `coolify.*`
  * lines Coolify adds and strips itself do not count.
@@ -71,3 +134,20 @@ export function sameLabelSets(a, b) {
         .join('\n');
     return lines(a) === lines(b);
 }
+/**
+ * The entry names that live in the platform's `oikos.host` zone (a company with no domain of its own, or with
+ * `usesDomain` off): the names the company's tunnel gets a proxied CNAME for. Sorted.
+ */
+export function entryOikosHostnames(org) {
+    return entryRoutes(org)
+        .map((r) => r.hostname)
+        .filter((h) => h.endsWith(`.${NO_DOMAIN_ZONE}`))
+        .sort();
+}
+/**
+ * Whether `name` is one the company may write in the platform's `oikos.host` zone: exactly its own
+ * `<slug>.oikos.host`. A company writes no other company's name, whatever an entry declares.
+ */
+export function ownsOikosName(org, name) {
+    return name.toLowerCase() === `${org.slug}.${NO_DOMAIN_ZONE}`;
+}

package/dist/plan/run-options.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The Linux capabilities of every container foundry makes through an application call, sent in
+ * Coolify's `custom_docker_run_options`. Coolify turns `--cap-drop`, `--cap-add` and `--security-opt`
+ * into compose keys; its parser reads a value up to the first dash, so `no-new-privileges:true` is
+ * not sent. A Coolify database has no such field and keeps Docker's defaults.
+ */
+/** What no foundry service needs: raw sockets, device nodes, file capabilities, chroot, audit writes. */
+export declare const CAPS_TIER_A: readonly string[];
+/** A customer's own app: nothing, then back what nginx, node and `gosu` style entrypoints need. */
+export declare const CAPS_TIER_B: readonly string[];
+export type CapabilityTier = 'A' | 'B';
+/**
+ * `existing` with its capability options replaced by the tier's. Everything else in it (the
+ * `--entrypoint "..."`) stays as it was, so a step that sends its own entrypoint and the capability
+ * wrapper can both write the field. Running it twice gives the same string.
+ */
+export declare function withCapabilities(existing: string | null | undefined, tier: CapabilityTier): string;
+/** Whether `existing` holds exactly the tier's capability options. */
+export declare function hasCapabilities(existing: string | null | undefined, tier: CapabilityTier): boolean;

package/dist/plan/run-options.js

@@ -0,0 +1,46 @@
+/**
+ * The Linux capabilities of every container foundry makes through an application call, sent in
+ * Coolify's `custom_docker_run_options`. Coolify turns `--cap-drop`, `--cap-add` and `--security-opt`
+ * into compose keys; its parser reads a value up to the first dash, so `no-new-privileges:true` is
+ * not sent. A Coolify database has no such field and keeps Docker's defaults.
+ */
+/** What no foundry service needs: raw sockets, device nodes, file capabilities, chroot, audit writes. */
+export const CAPS_TIER_A = [
+    '--cap-drop=NET_RAW',
+    '--cap-drop=MKNOD',
+    '--cap-drop=SETFCAP',
+    '--cap-drop=SYS_CHROOT',
+    '--cap-drop=AUDIT_WRITE',
+];
+/** A customer's own app: nothing, then back what nginx, node and `gosu` style entrypoints need. */
+export const CAPS_TIER_B = [
+    '--cap-drop=ALL',
+    '--cap-add=CHOWN',
+    '--cap-add=DAC_OVERRIDE',
+    '--cap-add=FOWNER',
+    '--cap-add=SETGID',
+    '--cap-add=SETUID',
+    '--cap-add=NET_BIND_SERVICE',
+];
+const tokens = (tier) => tier === 'B' ? CAPS_TIER_B : CAPS_TIER_A;
+/** One `--cap-drop` or `--cap-add` option, with the space or equals sign and its value. */
+const CAP_OPTION = /\s*--cap-(?:drop|add)(?:=|\s+)\S+/g;
+/** The cap options of a run options string, in the order they stand. */
+function capOptionsOf(options) {
+    return (options ?? '').match(CAP_OPTION)?.map((o) => o.trim().replace(/\s+/, '=')) ?? [];
+}
+/**
+ * `existing` with its capability options replaced by the tier's. Everything else in it (the
+ * `--entrypoint "..."`) stays as it was, so a step that sends its own entrypoint and the capability
+ * wrapper can both write the field. Running it twice gives the same string.
+ */
+export function withCapabilities(existing, tier) {
+    const rest = (existing ?? '').replace(CAP_OPTION, '').trim();
+    return [rest, ...tokens(tier)].filter(Boolean).join(' ');
+}
+/** Whether `existing` holds exactly the tier's capability options. */
+export function hasCapabilities(existing, tier) {
+    const have = capOptionsOf(existing);
+    const want = tokens(tier);
+    return have.length === want.length && want.every((t) => have.includes(t));
+}

package/dist/plan/sign-in-org.d.ts

@@ -23,7 +23,7 @@ export declare function signInOrgDomain(org: {
  * idempotent. A failure after the add leaves the domain on the org but not
  * primary, and nothing is recorded, so the next run repeats both.
  */
-export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string): Promise<void>;
+export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain
  * primary (the sign-in server's domain policy wants proof) is recorded under

package/dist/plan/sign-in-org.js

@@ -21,6 +21,12 @@ export function signInDomainBlockedText(orgName, domain) {
 function isPrimaryDomainRefused(error) {
     return error instanceof Error && /is not verified/.test(error.message);
 }
+/** True for the providers' "domain is not on org" answer of `setPrimaryOrgDomain`. */
+function isDomainNotListed(error) {
+    return error instanceof Error && /is not on org/.test(error.message);
+}
+const DOMAIN_LISTED_TRIES = 10;
+const DOMAIN_LISTED_WAIT_MS = 500;
 /** The domain an org's owners sign in on: its own, or `<slug>.oikos.host` when it has none. */
 export function signInOrgDomain(org) {
     return (org.domain ?? `${org.slug}.oikos.host`).toLowerCase();
@@ -30,9 +36,21 @@ export function signInOrgDomain(org) {
  * idempotent. A failure after the add leaves the domain on the org but not
  * primary, and nothing is recorded, so the next run repeats both.
  */
-export async function registerSignInDomain(zitadel, orgId, domain) {
+export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
     await zitadel.addOrgDomain(orgId, domain);
-    await zitadel.setPrimaryOrgDomain(orgId, domain);
+    // The sign-in server lists a domain a moment after it accepts the add, and
+    // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await zitadel.setPrimaryOrgDomain(orgId, domain);
+            return;
+        }
+        catch (error) {
+            if (attempt >= DOMAIN_LISTED_TRIES || !isDomainNotListed(error))
+                throw error;
+            await sleep(DOMAIN_LISTED_WAIT_MS);
+        }
+    }
 }
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain

package/dist/plan/zitadel-login-policy.d.ts

@@ -20,4 +20,4 @@ export interface ZitadelLoginPolicyOptions {
  * policy (POST), so a later change to the default cannot turn registration
  * back on. A custom policy keeps its own factors and IdPs (PUT).
  */
-export declare function createZitadelLoginPolicy(options: ZitadelLoginPolicyOptions): Pick<ZitadelPort, 'closeSelfRegistration'>;
+export declare function createZitadelLoginPolicy(options: ZitadelLoginPolicyOptions): Pick<ZitadelPort, 'closeSelfRegistration' | 'enforceSecondFactor'>;

package/dist/plan/zitadel-login-policy.js

@@ -20,6 +20,21 @@ const LOGIN_POLICY_SETTINGS = [
     'forceMfaLocalOnly',
 ];
 const CALL_TIMEOUT_MS = 30_000;
+/** What {@link ZitadelPort.enforceSecondFactor} sets. The two lists are exact: any other factor (email or SMS code) is removed. */
+const SECOND_FACTOR_SETTINGS = {
+    forceMfa: true,
+    allowRegister: false,
+    allowExternalIdp: false,
+    allowUsernamePassword: true,
+    passwordlessType: 'PASSWORDLESS_TYPE_ALLOWED',
+    mfaInitSkipLifetime: '0s',
+};
+const SECOND_FACTORS = ['SECOND_FACTOR_TYPE_OTP', 'SECOND_FACTOR_TYPE_U2F'];
+const MULTI_FACTORS = ['MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION'];
+/** ZITADEL leaves false booleans and zero durations out of a read. */
+const isZeroDuration = (value) => value === undefined || (typeof value === 'string' && /^0+(\.0+)?s$/.test(value));
+const stringList = (value) => Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+const sameSet = (a, b) => a.length === b.length && b.every((v) => a.includes(v));
 /**
  * The real {@link ZitadelPort.closeSelfRegistration}: the mirror of
  * `ZitadelClient.allowSelfRegistration` in `@wtfalch/providers`, with
@@ -35,8 +50,7 @@ const CALL_TIMEOUT_MS = 30_000;
  */
 export function createZitadelLoginPolicy(options) {
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-    async function call(method, orgId, body) {
-        const path = '/management/v1/policies/login';
+    async function call(method, orgId, body, path = '/management/v1/policies/login') {
         const response = await fetchImpl(`${options.url}${path}`, {
             method,
             signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
@@ -67,22 +81,76 @@ export function createZitadelLoginPolicy(options) {
         }
         return data;
     }
+    /** Every setting of the policy in force, as the write bodies take them. */
+    const settingsOf = (policy) => {
+        const settings = {};
+        for (const key of LOGIN_POLICY_SETTINGS) {
+            if (policy[key] !== undefined)
+                settings[key] = policy[key];
+        }
+        return settings;
+    };
     return {
+        async enforceSecondFactor(orgId) {
+            if (!orgId)
+                throw new Error('enforceSecondFactor: orgId is required');
+            const data = await call('GET', orgId, undefined);
+            const policy = data.policy ?? {};
+            const isDefault = data.isDefault === true || policy.isDefault === true;
+            const secondFactors = stringList(policy.secondFactors);
+            const multiFactors = stringList(policy.multiFactors);
+            const want = SECOND_FACTOR_SETTINGS;
+            const settingsDiffer = (policy.forceMfa === true) !== want.forceMfa ||
+                (policy.allowRegister === true) !== want.allowRegister ||
+                (policy.allowExternalIdp === true) !== want.allowExternalIdp ||
+                (policy.allowUsernamePassword === true) !== want.allowUsernamePassword ||
+                policy.passwordlessType !== want.passwordlessType ||
+                !isZeroDuration(policy.mfaInitSkipLifetime);
+            const factorsDiffer = !sameSet(secondFactors, SECOND_FACTORS) || !sameSet(multiFactors, MULTI_FACTORS);
+            if (!isDefault && !settingsDiffer && !factorsDiffer)
+                return { changed: false };
+            const settings = { ...settingsOf(policy), ...want };
+            if (isDefault) {
+                // The org's own policy, written whole: the factor lists go in the same body.
+                await call('POST', orgId, {
+                    ...settings,
+                    secondFactors: SECOND_FACTORS,
+                    multiFactors: MULTI_FACTORS,
+                    idps: (policy.idps ?? []).map((idp) => ({
+                        idpId: idp.idpId,
+                        ownerType: 'IDP_OWNER_TYPE_SYSTEM',
+                    })),
+                });
+                return { changed: true };
+            }
+            if (settingsDiffer)
+                await call('PUT', orgId, settings);
+            // Add before remove, so the org is never left with no second factor.
+            const factorPath = '/management/v1/policies/login';
+            for (const type of SECOND_FACTORS.filter((t) => !secondFactors.includes(t))) {
+                await call('POST', orgId, { type }, `${factorPath}/second_factors`);
+            }
+            for (const type of MULTI_FACTORS.filter((t) => !multiFactors.includes(t))) {
+                await call('POST', orgId, { type }, `${factorPath}/multi_factors`);
+            }
+            for (const type of secondFactors.filter((t) => !SECOND_FACTORS.includes(t))) {
+                await call('DELETE', orgId, undefined, `${factorPath}/second_factors/${encodeURIComponent(type)}`);
+            }
+            for (const type of multiFactors.filter((t) => !MULTI_FACTORS.includes(t))) {
+                await call('DELETE', orgId, undefined, `${factorPath}/multi_factors/${encodeURIComponent(type)}`);
+            }
+            return { changed: true };
+        },
         async closeSelfRegistration(orgId) {
             if (!orgId)
                 throw new Error('closeSelfRegistration: orgId is required');
             const data = await call('GET', orgId, undefined);
             const policy = data.policy ?? {};
             const isDefault = data.isDefault === true || policy.isDefault === true;
-            if (!isDefault && policy.allowRegister === false) {
+            if (!isDefault && policy.allowRegister !== true) {
                 return { changed: false };
             }
-            const settings = {};
-            for (const key of LOGIN_POLICY_SETTINGS) {
-                if (policy[key] !== undefined)
-                    settings[key] = policy[key];
-            }
-            settings.allowRegister = false;
+            const settings = { ...settingsOf(policy), allowRegister: false };
             if (isDefault) {
                 await call('POST', orgId, {
                     ...settings,

package/dist/plan/zitadel-system-api.d.ts

@@ -36,13 +36,32 @@ export declare class CreateInstanceError extends Error {
     constructor(kind: 'rejected' | 'exists' | 'uncertain', message: string);
 }
 /** What a person does when an instance exists without a delivered bearer. Nothing is deleted automatically. */
-export declare function instanceWithoutBearerMessage(hostname: string, detail: string): string;
+export declare function instanceWithoutBearerMessage(hostname: string, detail: string, label?: string): string;
 export interface CreateInstanceRuntime {
     fetch?: typeof fetch;
     now: () => number;
     /** Fetch timeout for the one create call (default 30s). */
     timeoutMs?: number;
 }
+/**
+ * Waits until ZITADEL's system API answers, before the one create call. `/debug/healthz` and `/debug/ready`
+ * answer as soon as the HTTP server listens, but the gateway behind the system API reaches its gRPC server a
+ * moment later and answers 503 until then (seen: `POST /instances/_create` 503 about 100 ms after "server is
+ * listening"). A 503 on the create leaves the instance marked as possibly created, so the wait asks first with a
+ * read that changes nothing: `POST /system/v1/instances/_search`. Any answer other than a failed request or a
+ * 5xx counts (a 401 is the key being refused, which the create reports itself). Times out with an error that
+ * names the last answer.
+ */
+export declare function waitForSystemApi(input: {
+    customDomain: string;
+    privateKey: string;
+    label?: string;
+}, runtime: CreateInstanceRuntime & {
+    sleep: (ms: number) => Promise<void>;
+    timeoutMs?: number;
+    intervalMs?: number;
+    requestTimeoutMs?: number;
+}): Promise<void>;
 /**
  * Creates the platform's ZITADEL instance on `customDomain` with one machine
  * owner and returns its id and the owner's PAT. Sends exactly one request,
@@ -54,6 +73,8 @@ export declare function createZitadelInstance(input: {
     privateKey: string;
     instanceName: string;
     firstOrgName: string;
+    /** Names the target in error texts (default `platform:auth`). */
+    label?: string;
     owner: {
         userName: string;
         name: string;

package/dist/plan/zitadel-system-api.js

@@ -61,8 +61,48 @@ export class CreateInstanceError extends Error {
     }
 }
 /** What a person does when an instance exists without a delivered bearer. Nothing is deleted automatically. */
-export function instanceWithoutBearerMessage(hostname, detail) {
-    return `platform:auth: a ZITADEL instance may already exist for ${hostname} without a delivered bearer (${detail}). To recover, delete the instance with the system API (DELETE /system/v1/instances/{id}) or redeploy the ZITADEL database, remove the recorded key zitadel_platform_instance_undelivered, then apply again`;
+export function instanceWithoutBearerMessage(hostname, detail, label = 'platform:auth') {
+    return `${label}: a ZITADEL instance may already exist for ${hostname} without a delivered bearer (${detail}). To recover, delete the instance with the system API (DELETE /system/v1/instances/{id}) or redeploy the ZITADEL database, remove the recorded key zitadel_platform_instance_undelivered, then apply again`;
+}
+/**
+ * Waits until ZITADEL's system API answers, before the one create call. `/debug/healthz` and `/debug/ready`
+ * answer as soon as the HTTP server listens, but the gateway behind the system API reaches its gRPC server a
+ * moment later and answers 503 until then (seen: `POST /instances/_create` 503 about 100 ms after "server is
+ * listening"). A 503 on the create leaves the instance marked as possibly created, so the wait asks first with a
+ * read that changes nothing: `POST /system/v1/instances/_search`. Any answer other than a failed request or a
+ * 5xx counts (a 401 is the key being refused, which the create reports itself). Times out with an error that
+ * names the last answer.
+ */
+export async function waitForSystemApi(input, runtime) {
+    const fetchImpl = runtime.fetch ?? globalThis.fetch;
+    const url = `https://${input.customDomain}`;
+    const timeout = runtime.timeoutMs ?? 300_000;
+    const interval = runtime.intervalMs ?? 2_000;
+    const deadline = runtime.now() + timeout;
+    let last = 'no answer';
+    for (;;) {
+        try {
+            const response = await fetchImpl(`${url}/system/v1/instances/_search`, {
+                method: 'POST',
+                signal: AbortSignal.timeout(runtime.requestTimeoutMs ?? 10_000),
+                headers: {
+                    authorization: `Bearer ${signSystemApiJwt(input.privateKey, url, runtime.now())}`,
+                    'content-type': 'application/json',
+                },
+                body: '{}',
+            });
+            if (response.status < 500)
+                return;
+            last = `HTTP ${response.status}`;
+        }
+        catch {
+            last = 'the request failed';
+        }
+        if (runtime.now() >= deadline) {
+            throw new Error(`${input.label ?? 'platform:auth'}: ZITADEL's system API did not answer at ${url} within ${Math.round(timeout / 1000)}s (${last}); nothing was created, retry this apply`);
+        }
+        await runtime.sleep(interval);
+    }
 }
 /**
  * Creates the platform's ZITADEL instance on `customDomain` with one machine
@@ -73,6 +113,7 @@ export function instanceWithoutBearerMessage(hostname, detail) {
 export async function createZitadelInstance(input, runtime) {
     const fetchImpl = runtime.fetch ?? globalThis.fetch;
     const url = `https://${input.customDomain}`;
+    const label = input.label ?? 'platform:auth';
     let response;
     try {
         response = await fetchImpl(`${url}/system/v1/instances/_create`, {
@@ -97,19 +138,19 @@ export async function createZitadelInstance(input, runtime) {
         });
     }
     catch {
-        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the create request timed out or failed'));
+        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the create request timed out or failed', label));
     }
     if (response.status === 401) {
-        throw new CreateInstanceError('rejected', 'platform:auth: system API key rejected (HTTP 401); nothing was created');
+        throw new CreateInstanceError('rejected', `${label}: system API key rejected (HTTP 401); nothing was created`);
     }
     if (response.status === 409) {
-        throw new CreateInstanceError('exists', instanceWithoutBearerMessage(input.customDomain, 'ZITADEL answered 409, already exists'));
+        throw new CreateInstanceError('exists', instanceWithoutBearerMessage(input.customDomain, 'ZITADEL answered 409, already exists', label));
     }
     if (!response.ok) {
         // A 4xx is a refusal before anything was created; a 5xx may not be.
         throw new CreateInstanceError(response.status < 500 ? 'rejected' : 'uncertain', response.status < 500
-            ? `platform:auth: ZITADEL refused to create the instance (HTTP ${response.status}); nothing was created`
-            : instanceWithoutBearerMessage(input.customDomain, `ZITADEL answered HTTP ${response.status}`));
+            ? `${label}: ZITADEL refused to create the instance (HTTP ${response.status}); nothing was created`
+            : instanceWithoutBearerMessage(input.customDomain, `ZITADEL answered HTTP ${response.status}`, label));
     }
     let body = {};
     try {
@@ -119,7 +160,7 @@ export async function createZitadelInstance(input, runtime) {
         // Handled below.
     }
     if (!body.instanceId || !body.pat) {
-        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the answer had no instance id or token'));
+        throw new CreateInstanceError('uncertain', instanceWithoutBearerMessage(input.customDomain, 'the answer had no instance id or token', label));
     }
     return { instanceId: body.instanceId, pat: body.pat };
 }