@wtfalch/foundry 0.42.1 → 0.44.0

package/dist/plan/broker-entries.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { isFoundryOwnedBrokerEntryName, } from '../org.js';
 import { entryClientIdScopeKey } from './agora.js';
 import { entryHostnames } from './hostnames.js';
+import { loginHostnameFor } from './login-host.js';
 import { PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, parseBrokerDeployRecord, } from './platform-diff.js';
 import { archonOrgConflicts, brokerDeployNeeded, brokerDeployRecordValue, missingBrokerInputs, validateBrokerAppEntry, } from './platform-providers.js';
 /**
@@ -28,6 +29,31 @@ export function brokerEntryAppliedScopeKey(entryKey) {
 export function brokerEntryWarningsScopeKey(entryKey) {
     return `broker_entry_warnings.${entryKey}`;
 }
+/** The ZITADEL project id that is an MCP entry's token audience, recorded by `zitadel:mcp-project`. */
+export const entryMcpProjectScopeKey = (entryKey) => `mcp_project_id.${entryKey}`;
+/** The marker for the entry's app having JWT access tokens and the MCP callback (`zitadel:mcp-access`). */
+export const entryMcpAccessAppliedScopeKey = (entryKey) => `mcp_access_applied.${entryKey}`;
+/** The instance access-token lifetime the MCP flow wants, in seconds (auth ADR 0002, 4). */
+export const MCP_ACCESS_TOKEN_LIFETIME_SECONDS = 3600;
+/** Records the lifetime foundry last set; the value is {@link MCP_ACCESS_TOKEN_LIFETIME_SECONDS}. */
+export const ACCESS_TOKEN_LIFETIME_APPLIED_SCOPE_KEY = 'access_token_lifetime_applied';
+/** The broker's callback on the org's login host. It joins the entry app's redirect URIs. */
+export const mcpCallbackUri = (org) => `https://${loginHostnameFor(org)}/mcp-oauth/callback`;
+/**
+ * What an entry's MCP resource is, from the one recorded project id. The
+ * broker entry (`wantedBrokerEntry`) and the app's env (`entryAuthEnv`) both
+ * read it here, so the audience the broker checks and the audience the app
+ * compares are the same value. `null` without `mcp`, or until the project
+ * exists.
+ */
+export function entryMcp(org, entry, recorded) {
+    const mcp = entry.uses?.auth?.mcp;
+    const projectId = recorded[entryMcpProjectScopeKey(entry.key)];
+    const host = entryHostnames(org, entry)[0];
+    if (!mcp || !projectId || !host)
+        return null;
+    return { resource: `https://${host}${mcp.path}`, projectId, loginHost: loginHostnameFor(org) };
+}
 /** What the app's env says about who signs in, as recorded so far. Missing values are left out. */
 export function entryAuthEnv(org, entry, recorded, issuer) {
     const auth = entry.uses?.auth;
@@ -39,6 +65,15 @@ export function entryAuthEnv(org, entry, recorded, issuer) {
         AUTH_CLIENT_ID: recorded[entryClientIdScopeKey(entry.key)],
         AUTH_ISSUER: issuer ?? undefined,
     };
+    const mcp = entryMcp(org, entry, recorded);
+    const mcpValues = mcp
+        ? {
+            MCP_AUDIENCE: mcp.projectId,
+            MCP_RESOURCE: mcp.resource,
+            MCP_ISSUER: `https://${mcp.loginHost}`,
+        }
+        : {};
+    Object.assign(values, mcpValues);
     return Object.fromEntries(Object.entries(values).filter(([, value]) => Boolean(value)));
 }
 /** The marker `pushAppEnv` records for an entry's sign-in env; the planner compares against it. */
@@ -60,7 +95,11 @@ export function wantedBrokerEntry(org, entry, recorded) {
         missing.push({ what: 'its sign-in client id', producedBy: ['zitadel', 'app'] });
     if (!mailDomain)
         missing.push({ what: 'the org mail domain', producedBy: ['coolify', 'mail'] });
-    if (!organizationId || !clientId || !mailDomain)
+    const mcp = entryMcp(org, entry, recorded);
+    if (auth.mcp && !mcp) {
+        missing.push({ what: 'its MCP audience project id', producedBy: ['zitadel', 'mcp-project'] });
+    }
+    if (!organizationId || !clientId || !mailDomain || (auth.mcp && !mcp))
         return { missing };
     return {
         want: {
@@ -71,6 +110,7 @@ export function wantedBrokerEntry(org, entry, recorded) {
             from: `${org.mail.noReplyLocalPart || 'noreply'}@${mailDomain}`,
             registration: auth.registration === 'open',
             replaces: auth.replacesBrokerEntry ?? null,
+            ...(mcp ? { mcp } : {}),
         },
     };
 }
@@ -182,6 +222,11 @@ export async function writeBrokerEntry(broker, input) {
         from: want.from,
         registration: want.registration,
     };
+    // The previous write's `mcp` goes when the entry no longer declares it.
+    if (want.mcp)
+        entry.mcp = want.mcp;
+    else
+        entry.mcp = undefined;
     try {
         validateBrokerAppEntry(entry, brokerAppId, 0);
     }

package/dist/plan/cloudflared-connector.d.ts

@@ -76,3 +76,29 @@ export declare function ensureCloudflaredConnector(input: EnsureCloudflaredConne
     appId: string;
     deployed: boolean;
 }>;
+/** The scope key of a non-primary server's connector: the tunnel's own key plus the server uuid. */
+export declare function serverConnectorScopeKey(baseScopeKey: string, serverUuid: string): string;
+/** A non-primary server's connector app name: the tunnel's own name plus the first eight characters of the uuid. */
+export declare function serverConnectorAppName(baseAppName: string, serverUuid: string): string;
+export interface EnsureConnectorsOnServersInput extends Omit<EnsureCloudflaredConnectorInput, 'resolveServer' | 'recordedConnectorAppId' | 'recordAppId' | 'appName'> {
+    /** The primary's connector keeps its name and scope key, so a record made before servers were many is still its record. */
+    baseAppName: string;
+    baseScopeKey: string;
+    primaryUuid: string;
+    serverUuids: readonly string[];
+    recorded: Readonly<Record<string, string>>;
+    /** Records the app id as soon as it exists; the caller persists it. */
+    record: (key: string, appId: string) => Promise<void>;
+}
+/**
+ * One connector app for the tunnel on each server, all with the tunnel's one token. Each server's connector
+ * reaches that server's own containers, so a request lands on a server with the app on it. The primary's
+ * connector is the existing one (found by its recorded id, never created again); every other server gets its
+ * own name and scope key. A failure on one server stops the loop there: the ones before it are recorded,
+ * and the next run repeats from the failed one.
+ */
+export declare function ensureConnectorsOnServers(input: EnsureConnectorsOnServersInput): Promise<Array<{
+    serverUuid: string;
+    appId: string;
+    deployed: boolean;
+}>>;

package/dist/plan/cloudflared-connector.js

@@ -119,3 +119,40 @@ async function tunnelTokenDiffers(coolify, appId, token) {
     const live = (await coolify.listEnvs(appId)).find((e) => e.key === 'TUNNEL_TOKEN' && !e.is_preview);
     return !live || live.value !== token;
 }
+/** The scope key of a non-primary server's connector: the tunnel's own key plus the server uuid. */
+export function serverConnectorScopeKey(baseScopeKey, serverUuid) {
+    return `${baseScopeKey}.${serverUuid}`;
+}
+/** A non-primary server's connector app name: the tunnel's own name plus the first eight characters of the uuid. */
+export function serverConnectorAppName(baseAppName, serverUuid) {
+    return `${baseAppName}-${serverUuid.slice(0, 8)}`;
+}
+/**
+ * One connector app for the tunnel on each server, all with the tunnel's one token. Each server's connector
+ * reaches that server's own containers, so a request lands on a server with the app on it. The primary's
+ * connector is the existing one (found by its recorded id, never created again); every other server gets its
+ * own name and scope key. A failure on one server stops the loop there: the ones before it are recorded,
+ * and the next run repeats from the failed one.
+ */
+export async function ensureConnectorsOnServers(input) {
+    const results = [];
+    for (const serverUuid of input.serverUuids) {
+        const primary = serverUuid === input.primaryUuid;
+        const scopeKey = primary
+            ? input.baseScopeKey
+            : serverConnectorScopeKey(input.baseScopeKey, serverUuid);
+        const { appId, deployed } = await ensureCloudflaredConnector({
+            coolify: input.coolify,
+            tunnels: input.tunnels,
+            tunnelId: input.tunnelId,
+            projectUuid: input.projectUuid,
+            environment: input.environment,
+            appName: primary ? input.baseAppName : serverConnectorAppName(input.baseAppName, serverUuid),
+            resolveServer: async () => ({ uuid: serverUuid }),
+            recordedConnectorAppId: input.recorded[scopeKey] ?? null,
+            recordAppId: (appId) => input.record(scopeKey, appId),
+        });
+        results.push({ serverUuid, appId, deployed });
+    }
+    return results;
+}

package/dist/plan/diff.d.ts

@@ -1,8 +1,10 @@
 import type { DeclaredOrg, OrgId, OrgServiceSchema } from '../org.js';
 import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.js';
 import { type AgoraHostReading } from './agora.js';
+import { type BlueGreenServer } from './blue-green.js';
 import type { LiveResource } from './live.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
+import { type RemoteDatabaseFacts } from './remote-database.js';
 /**
  * What a {@link StepExecutor} (see `plan-apply.ts`) needs to actually make a
  * step true, alongside the public {@link PlanStep} an operator reads.
@@ -41,6 +43,8 @@ export interface DraftStep {
  * New ones go here, not in new positional arguments (rule 7).
  */
 export interface PlanOrgOptions {
+    /** What the blue/green database route needs (`plan/remote-database.ts`). Absent: nothing is planned. */
+    remoteDatabase?: RemoteDatabaseFacts;
     /** The platform's edge has the `oikos.host` zone: a company without a domain waits on it for its own services. */
     oikosZoneReady?: boolean;
     /** #267: the executor was built with a `loginHostBindings` port. */
@@ -49,6 +53,8 @@ export interface PlanOrgOptions {
     loginHostServesDiscovery?: boolean;
     /** The executor's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`; without it `planIdTokenUserinfo` plans nothing. */
     zitadelIdTokenUserinfo?: boolean;
+    /** The executor's ZITADEL client has `ensureOidcAppMcpAccess` and `ensureAccessTokenLifetime`; without them `planMcp` is blocked. */
+    zitadelMcp?: boolean;
     /** F5: the executor was built with a `broker` port. */
     broker?: boolean;
     /** #161: the slugs of the other declared orgs, so a Boule whose hostname another org's slug would take is blocked. */
@@ -59,6 +65,14 @@ export interface PlanOrgOptions {
     archonUrl?: string | null;
     /** #318: the executor was built with a `WorkersPort`, read by `planWorkers`. */
     edgeWorkers?: boolean;
+    /** ADR 0002: the executor was built with a `WorkerAppPort`, read by `planWorkerApps`. */
+    workerApps?: boolean;
+    /** ADR 0002: the keys service address, when the executor has a keys port. */
+    workerAppKeysUrl?: string;
+    /** C2: true when the executor was built with a `WorkerAppDatabasePort`; a `workerApp.database` is blocked without it. */
+    workerAppDatabase?: boolean;
+    /** ADR 0002: the platform's Cloudflare account id; a container image must live in its registry. */
+    workerAppRegistryAccountId?: string;
     /** The executor was built with an `ownerInviteMail` port; without it each owner's invite is blocked. */
     ownerInviteMail?: boolean;
     /** The platform's own service hostnames: `edgeReservedLabels` reserves them under the org's domain, and a wildcard Worker route (`planWorkers`) keeps them out. */
@@ -69,6 +83,10 @@ export interface PlanOrgOptions {
     ownMailKeyHeld?: boolean;
     /** The executor can mint an own org's Lettermint key (`FoundryStepExecutor.ownMailKeyMintable`). */
     ownMailKeyMintable?: boolean;
+    /** C3: the executor can mint a customers directory credential (`ZitadelPort.mintOrgDirectoryReader`). */
+    customersDirectory?: boolean;
+    /** C3: the executor can mint Boule's Archon credential (`FoundryStepExecutorPorts.mintBouleArchonCredential`). */
+    bouleArchonCredential?: boolean;
     /** The executor can store the sign-in database's CA and certificate (`FoundryStepExecutor.ownSigninDbKeysPuttable`). Absent: true. */
     ownSigninDbKeysPuttable?: boolean;
     /** The host supplies the backup bucket the sign-in database dumps into (`FoundryStepExecutor.ownSigninDbBackupConfigured`). Absent: true. */
@@ -108,6 +126,8 @@ export interface PlanOrgOptions {
      * but the storage is not registered, so each database is reported blocked.
      */
     backupStorageUuid?: string | null;
+    /** Every Coolify server the host lists, for blue/green (`plan/blue-green.ts`). Absent: the host cannot list them. */
+    blueGreenServers?: readonly BlueGreenServer[];
 }
 export interface PlanDetail {
     orgId: OrgId;

package/dist/plan/diff.js

@@ -1,7 +1,9 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, } from '../org.js';
+import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
-import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { planBlueGreen } from './blue-green.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, desiredBouleEnv, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
 import { planCompanyBackups } from './company-backups.js';
@@ -15,6 +17,7 @@ import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
+import { planMcp } from './mcp.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
 import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, OWN_SIGNIN_DB_MOVE_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, planSigninDbMove, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
@@ -23,9 +26,11 @@ import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryRoutes, entryRoutesMarker, } from './proxy-labels.js';
+import { planRemoteDatabase } from './remote-database.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_IMAGE_TAG_SUFFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_LOGIN_INTERNAL_NAME, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, inAppSignIn, inAppStatePairs, inAppTargets, } from './sign-in.js';
 import { withStepSystem } from './step-system.js';
+import { brokerKeyDelivered, planWorkerApps } from './worker-app.js';
 import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export function toPlan(detail) {
@@ -406,6 +411,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         if (guarded)
             plannedSteps.push(guarded);
     }
+    // Auth ADR 0002: the MCP project and the JWT app, after the app they change
+    // and before the broker entry and the Worker that read the project id.
+    const mcp = planMcp(org, recordedIds, plannedSteps, options.zitadelMcp ?? false);
+    plannedSteps.push(...mcp.steps);
     // The Access gate before the database, app, tunnel and zone (#84): on a
     // first apply the hostname is gated before anything answers on it.
     // An Access gate that cannot be planned must not leave the hostname it
@@ -456,6 +465,18 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const edgeReservedLabels = planEdgeReservedLabels(org, recordedIds, platformReadiness, options.platformHostnames ?? []);
     if (edgeReservedLabels.step)
         plannedSteps.push(edgeReservedLabels.step);
+    // Blue/green (`blue-green.ts`): the apps and balancers before the tunnel routes to them, a second
+    // server's connector after the tunnel exists.
+    const blueGreen = planBlueGreen({
+        org,
+        recordedIds,
+        servers: options.blueGreenServers,
+        canHoldSecrets: platformReadiness.canHoldSecrets === true,
+        appPlanned: (entryKey) => plannedSteps.some((p) => p.action.system === 'coolify' &&
+            p.action.kind === 'app' &&
+            p.action.key === appStepKey(org, entryKey)),
+    });
+    plannedSteps.push(...blueGreen.steps.filter((x) => x.phase === 'before').map(blueGreenDraft()));
     const tunnel = planTunnel(org, byKey, claimed, recordedIds, platformReadiness.platformApex);
     // #238: a tunnel that is being provisioned waits for an active zone; parking
     // one never does.
@@ -482,6 +503,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     else if (tunnel) {
         plannedSteps.push(tunnel);
     }
+    plannedSteps.push(...blueGreen.steps.filter((x) => x.phase === 'after').map(blueGreenDraft()));
     // Right after the zone (#43): `cloudflareRateLimit` resolves the zone by
     // apex domain, so the zone step above must already have run (or the zone
     // must already exist live) by the time this one's action executes.
@@ -519,7 +541,11 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleGuarded = guardApp(bouleClient);
     if (bouleGuarded)
         plannedSteps.push(bouleGuarded);
-    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null, platformReadiness);
+    const bouleCredentials = planBouleCredentials(org, recordedIds, {
+        archon: options.bouleArchonCredential === true,
+        directory: options.customersDirectory === true,
+    }, platformReadiness.canHoldSecrets === true, (options.now ?? Date.now)());
+    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null, platformReadiness, bouleCredentials.wants);
     if (boule.step)
         plannedSteps.push(boule.step);
     // After the apps and Boule -- an edge key needs its app recorded or planned,
@@ -549,6 +575,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     (jobsAvailable && !ownsServices(org)) || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
     if (jobsRegistration.step)
         plannedSteps.push(jobsRegistration.step);
+    const remoteDatabase = planRemoteDatabase(org, options.remoteDatabase, recordedIds);
+    if (remoteDatabase.step)
+        plannedSteps.push(remoteDatabase.step);
     // F8 (#318), after Agora and Boule, not right after the zone: a route
     // already bound by a hand-made entry, another entry's route, a taken
     // script name, or no Workers token all throw at apply, and `runSteps`
@@ -574,6 +603,60 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
             plannedSteps.push(step);
         }
     }
+    // ADR 0002: Worker apps, after the Workers for the same reason: a route, record
+    // or script name that is not ours throws at apply and `runSteps` stops there.
+    const workerApps = planWorkerApps(org, recordedIds, {
+        available: options.workerApps ?? false,
+        ...(options.workerAppKeysUrl !== undefined ? { keysUrl: options.workerAppKeysUrl } : {}),
+        ...(options.workerAppRegistryAccountId !== undefined
+            ? { registryAccountId: options.workerAppRegistryAccountId }
+            : {}),
+        canHoldSecrets: platformReadiness.canHoldSecrets === true,
+        issuer: authIssuer,
+        ...(options.workerAppDatabase
+            ? {
+                database: {
+                    databaseReady: Boolean(recordedIds[`coolify:database:${org.id}`]) ||
+                        plannedSteps.some((s) => s.action.system === 'coolify' && s.action.kind === 'database'),
+                    tunnelReady: Boolean(recordedIds[`cloudflare:tunnel:${org.id}`]) ||
+                        plannedSteps.some((s) => s.action.system === 'cloudflare' && s.action.kind === 'tunnel'),
+                    accessReady: edgeNeeded(platformReadiness, ['access', 'tunnels', 'dns', 'zones']) === null,
+                },
+            }
+            : {}),
+    });
+    for (const step of workerApps.steps) {
+        const stepEntry = step.action.key.slice(org.id.length + 1);
+        const ownZone = org.hosting.usesDomain && Boolean(org.domain);
+        const apply = step.action.desired.mode === 'apply';
+        // Retire never looks a zone up; a deploy needs the org's zone, or the shared oikos.host zone.
+        const hasDatabase = Boolean(org.hosting.entries.find((e) => e.key === stepEntry)?.workerApp?.database);
+        const reason = !apply
+            ? null
+            : hasDatabase
+                ? edgeNeeded(platformReadiness, ['zones', 'dns', 'access', 'tunnels'])
+                : ownZone
+                    ? edgeNeeded(platformReadiness, ['zones', 'dns'])
+                    : edgeNeeded(platformReadiness, ['zones']);
+        if (reason) {
+            dnsBlocked.push(edgeBlockedItem(org, `${stepEntry} Worker app`, step.action.key, reason));
+        }
+        else if (apply && ownZone && zoneWaiting) {
+            zoneBlocked.push({
+                description: `${org.slug}'s ${stepEntry} Worker app is blocked, not planned: the zone for ${org.domain} is not active yet`,
+                key: step.action.key,
+            });
+        }
+        else if (apply && !ownZone && !(options.oikosZoneReady ?? false)) {
+            zoneBlocked.push({
+                description: `${org.slug}'s ${stepEntry} Worker app is blocked, not planned: the shared oikos.host zone is not ready yet`,
+                key: step.action.key,
+            });
+        }
+        else {
+            plannedSteps.push(step);
+        }
+    }
     // Last: a repair that fails must not stop any step after it (`runSteps` stops at the first failure).
     const idTokenUserinfo = planIdTokenUserinfo(org, live, recordedIds, plannedSteps, platformReadiness.authReady, options.zitadelIdTokenUserinfo ?? false);
     if (idTokenUserinfo)
@@ -608,6 +691,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         unmanaged.push({ description: agora.issuerNote, key: 'coolify:agora' });
     if (boule.blocked)
         unmanaged.push({ description: boule.blocked, key: 'coolify:boule' });
+    for (const description of bouleCredentials.blocked) {
+        unmanaged.push({ description, key: 'coolify:boule:credentials' });
+    }
     if (boule.mailBlocked) {
         unmanaged.push({ description: boule.mailBlocked, key: 'coolify:boule:mail' });
     }
@@ -615,9 +701,12 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // orphan a second live key.
     if (aiKey.blocked)
         unmanaged.push({ description: aiKey.blocked, key: 'ai:key' });
+    unmanaged.push(...blueGreen.unmanaged);
     unmanaged.push(...filesKeys.blocked);
     unmanaged.push(...entryAiKeys.blocked);
     unmanaged.push(...edgeWorkers.blocked);
+    unmanaged.push(...workerApps.blocked);
+    unmanaged.push(...mcp.blocked);
     unmanaged.push(...entryEdgeKeys.blocked);
     unmanaged.push(...edgeReservedLabels.blocked);
     if (ownAuth.blocked)
@@ -644,6 +733,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     if (jobsRegistration.blocked) {
         unmanaged.push({ description: jobsRegistration.blocked, key: 'jobs:registration' });
     }
+    if (remoteDatabase.blocked)
+        unmanaged.push(remoteDatabase.blocked);
     // #177: an org step whose own shared platform service is off or not yet
     // applied is blocked here, not planned -- the same rule, now driven by
     // `platformReadiness` instead of a host-supplied port. Each is reported at
@@ -740,6 +831,13 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         orgPostgres,
     };
 }
+/** A blue/green plan step as the draft step `computePlanDetail` collects. */
+function blueGreenDraft() {
+    return (step) => ({
+        action: { system: 'coolify', kind: step.kind, key: step.key, desired: step.desired },
+        step: { description: step.description, destroys: false, migrates: false },
+    });
+}
 /** Steps that run against the org's own ZITADEL instance (its projects, apps and broker entries). */
 const NEEDS_OWN_ZITADEL = new Set([
     'zitadel:issuer',
@@ -1274,7 +1372,7 @@ function orgServiceSchemaEnabled(org, schema) {
     if (schema.schema.startsWith('calls_'))
         return org.calls.enabled;
     if (schema.schema === 'app')
-        return org.hosting.entries.some((entry) => entry.database);
+        return org.hosting.entries.some(entryHasDatabase);
     return true;
 }
 /**
@@ -2567,6 +2665,45 @@ function planBouleClient(org, byKey, claimed) {
         },
     };
 }
+/**
+ * C3: which credentials the org's Boule is given, and why one is not. Archon's credential goes to every
+ * Boule the host can mint it for; the customers directory credential only while `customers.enabled`. Each
+ * needs a held-key store that can put. A credential minted and never held (platform rule 1) is never minted
+ * again: it is reported blocked.
+ */
+function planBouleCredentials(org, recordedIds, host, canHoldSecrets, nowMs) {
+    const blocked = [];
+    const at = `${org.slug}'s Boule`;
+    let archonCredential = false;
+    if (host.archon) {
+        if (!canHoldSecrets) {
+            blocked.push(`${at} Archon credential is blocked, not planned: it needs a held-key store that can put, and the host has none`);
+        }
+        else {
+            archonCredential = true;
+        }
+    }
+    let customersDirectory = false;
+    if (org.customers?.enabled) {
+        if (!host.directory) {
+            blocked.push(`${at} customers directory credential is blocked, not planned: the host supplies no ZitadelPort.mintOrgDirectoryReader`);
+        }
+        else if (!canHoldSecrets) {
+            blocked.push(`${at} customers directory credential is blocked, not planned: it needs a held-key store that can put, and the host has none`);
+        }
+        else {
+            customersDirectory = true;
+        }
+    }
+    return {
+        wants: {
+            archonCredential,
+            customersDirectory,
+            archonRenewDue: archonCredential && archonCredentialRenewDue(recordedIds, nowMs),
+        },
+        blocked,
+    };
+}
 /**
  * #161 (Boule part): the org's own Boule, a per-org singleton keyed by the org
  * id under its own `boule` kind, a separate Coolify application from the org's
@@ -2580,7 +2717,7 @@ function planBouleClient(org, byKey, claimed) {
  * address (the one Agora signs in at); without it the Boule is blocked, not
  * planned, so every other step still applies.
  */
-function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonUrl, readiness) {
+function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonUrl, readiness, credentials) {
     const key = resourceKey('coolify', 'boule', org.id);
     const live = byKey.get(key);
     if (live)
@@ -2650,6 +2787,8 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
             mailBlocked: mailBlocked !== null,
             // Only the platform's own org's Boule gets the peer password for Archon.
             platformOwner,
+            archonCredential: credentials.archonCredential === true,
+            customersDirectory: credentials.customersDirectory === true,
         },
     };
     if (!live) {
@@ -2663,8 +2802,22 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         };
     }
     const liveEnv = (live.config.env ?? {});
-    const { env } = desiredBouleEnv(org, recordedIds, issuer, archonUrl, mailOn);
+    const { env } = desiredBouleEnv(org, recordedIds, issuer, archonUrl, mailOn, credentials);
     const drift = bouleEnvDrift(env, liveEnv);
+    // Secrets are compared by presence only. A switched-off customers org takes its env away.
+    if (credentials.archonCredential &&
+        (!liveEnv[BOULE_ARCHON_CREDENTIAL_ENV] || credentials.archonRenewDue)) {
+        drift.push(BOULE_ARCHON_CREDENTIAL_ENV);
+    }
+    if (credentials.customersDirectory &&
+        customersOrgIdOf(org, recordedIds) &&
+        !liveEnv[BOULE_CUSTOMERS_CREDENTIAL_ENV]) {
+        drift.push(BOULE_CUSTOMERS_CREDENTIAL_ENV);
+    }
+    for (const key of staleCustomersEnv(org, liveEnv)) {
+        if (!drift.includes(key))
+            drift.push(key);
+    }
     // The token is compared, never planned with its value.
     if (mailOn &&
         bouleMailTokenDrift(liveEnv[BOULE_MAIL_TOKEN_ENV], live.config.appMailToken)) {
@@ -3155,6 +3308,9 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
             if (!resource || (typeof status === 'string' && /^(exited|stopped)/.test(status)))
                 continue;
         }
+        // A Worker app has no Coolify app: `planWorkerApps` plans it.
+        if (org.hosting.entries.some((e) => e.key === key && e.workerApp))
+            continue;
         const app = planApp(org, key, byKey, claimed, recordedIds, plannedSteps, authIssuer, readiness);
         // The executor pushes the issuer the plan read, the way Agora gets its host values.
         // The same availability the plan's marker used: the executor records its
@@ -3294,7 +3450,7 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
  * {@link planApp}.
  */
 function planDatabase(org, byKey, claimed) {
-    return planHostingToggle('coolify', 'database', org.hosting.entries.some((entry) => entry.database), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
+    return planHostingToggle('coolify', 'database', org.hosting.entries.some(entryHasDatabase), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
 }
 function sortedNames(names) {
     return names.filter(Boolean).sort().join(',');
@@ -3336,7 +3492,7 @@ function planTunnel(org, byKey, claimed, recordedIds, platformApex) {
         (org.calls.enabled && org.calls.usesDomain && Boolean(org.domain)) ||
         Boolean(org.domain) ||
         // A company without a domain still gets a tunnel of its own for an entry at `<slug>.oikos.host`.
-        entryRoutes(org).length > 0;
+        entryRoutes(org, recordedIds).length > 0;
     const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`, org.id, 
     // Cloudflare's status, read against what is declared: a park cannot change
     // it, so judging on/off by status alone would never let the plan empty.
@@ -3393,7 +3549,8 @@ function planTunnel(org, byKey, claimed, recordedIds, platformApex) {
     // An entry's hostname goes straight to its container, so a changed port, key or name, or an ingress
     // written before entries were routed that way, needs the ingress written again. Nothing recorded
     // equals no routes.
-    const routesStale = (recordedIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') !== entryRoutesMarker(org);
+    const routesStale = (recordedIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') !==
+        entryRoutesMarker(org, recordedIds);
     if (!connectorMissing && !dnsStale && !routesStale)
         return null;
     return {
@@ -3606,6 +3763,15 @@ function planBrokerEntries(org, recordedIds, plannedSteps, brokerWired) {
             });
             continue;
         }
+        // A Worker app has no Coolify app to hold the broker key: its generated AUTH_APP_KEY
+        // is delivered to the Worker first and read back from the held-key store.
+        if (entry.workerApp && !brokerKeyDelivered(recordedIds, entry.key)) {
+            blocked.push({
+                description: `${at} is blocked, not planned: the Worker app's AUTH_APP_KEY is not delivered yet`,
+                key,
+            });
+            continue;
+        }
         const wanted = wantedBrokerEntry(org, entry, recordedIds);
         if ('want' in wanted) {
             if (recordedIds[brokerEntryAppliedScopeKey(entry.key)] === JSON.stringify(wanted.want)) {
@@ -3714,23 +3880,44 @@ function planBouleBrokerEntry(org, recordedIds, plannedSteps, brokerWired) {
  * listed as unmanaged.
  */
 function planCustomers(org, live, claimed, recordedIds) {
-    if (!org.hosting.entries.some((entry) => entry.uses?.auth?.users === 'customers'))
-        return null;
+    const signUp = org.customers?.signUp === true;
+    const wanted = org.customers?.enabled === true ||
+        org.hosting.entries.some((entry) => entry.uses?.auth?.users === 'customers');
     const customersOrgId = recordedIds[resourceKey('zitadel', 'customers', org.id)];
-    if (customersOrgId) {
-        for (const r of live) {
-            if (r.system === 'zitadel' &&
-                r.kind === 'project_grant' &&
-                r.config.grantedOrgId === customersOrgId) {
-                claimed.add(resourceKey(r.system, r.kind, r.key));
-            }
+    if (!customersOrgId) {
+        if (!wanted)
+            return null;
+        return {
+            action: { system: 'zitadel', kind: 'customers', key: org.id, desired: { signUp } },
+            step: {
+                description: `provision a ZITADEL org for ${org.slug}'s customers, with self-registration ${signUp ? 'on' : 'off'}`,
+                destroys: false,
+                migrates: false,
+            },
+        };
+    }
+    for (const r of live) {
+        if (r.system === 'zitadel' &&
+            r.kind === 'project_grant' &&
+            r.config.grantedOrgId === customersOrgId) {
+            claimed.add(resourceKey(r.system, r.kind, r.key));
         }
-        return null;
     }
+    // Before the sign-up switch existed foundry forced self-registration on, so a customers org with no
+    // marker is on. Switching customers off closes it: the declaration says no one signs themselves up.
+    const applied = recordedIds[CUSTOMERS_SIGN_UP_SCOPE_KEY] || '1';
+    const wantedSignUp = wanted && signUp ? '1' : '0';
+    if (applied === wantedSignUp)
+        return null;
     return {
-        action: { system: 'zitadel', kind: 'customers', key: org.id, desired: {} },
+        action: {
+            system: 'zitadel',
+            kind: 'customers',
+            key: org.id,
+            desired: { signUp: wantedSignUp === '1' },
+        },
         step: {
-            description: `provision a self-registration ZITADEL org for ${org.slug}'s customers`,
+            description: `turn self-registration ${wantedSignUp === '1' ? 'on' : 'off'} for ${org.slug}'s customers`,
             destroys: false,
             migrates: false,
         },