@wtfalch/foundry 0.43.0 → 0.44.0

package/dist/plan/executor.js

@@ -9,8 +9,8 @@ import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
 import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
-import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
-import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -36,6 +36,7 @@ import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
+import { applyAccessTokenLifetime, applyMcpAccess, applyMcpProject } from './mcp.js';
 import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
 import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
 import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
@@ -52,6 +53,7 @@ import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
+import { WORKER_APP_CALL_TIMEOUT_MS, applyWorkerApp, heldBrokerKey, teardownWorkerApp, withCallTimeout, } from './worker-app.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
@@ -102,6 +104,11 @@ export function adaptZitadelListApps(client) {
         complete: true,
     });
 }
+/** An outside call for Boule's credentials that has not answered in this long fails the step; the next apply repairs it. */
+const BOULE_CREDENTIAL_TIMEOUT_MS = 60_000;
+const BOULE_CREDENTIAL_ATTEMPTS = 3;
+/** The ZITADEL machine user that reads one company's customers organisation. */
+const CUSTOMERS_DIRECTORY_USER_NAME = 'foundry-customers-directory';
 // ---------------------------------------------------------------------------
 // Errors
 // ---------------------------------------------------------------------------
@@ -978,6 +985,15 @@ export class FoundryStepExecutor {
     ownMailKeyMintable() {
         return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
     }
+    /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
+    customersDirectoryAvailable() {
+        return (typeof this.ports.zitadel.mintOrgDirectoryReader === 'function' &&
+            typeof this.ports.zitadel.revokeOrgDirectoryReader === 'function');
+    }
+    /** C3: whether the host supplied `mintBouleArchonCredential`. */
+    bouleArchonCredentialAvailable() {
+        return typeof this.ports.mintBouleArchonCredential === 'function';
+    }
     /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
     ownSigninDbKeysPuttable() {
         return Boolean(this.ports.ownServices?.provision.auth.heldKeys?.put);
@@ -1112,7 +1128,13 @@ export class FoundryStepExecutor {
             case 'zitadel:id-token-userinfo':
                 return this.zitadelIdTokenUserinfo(action, org, context);
             case 'zitadel:customers':
-                return this.zitadelCustomers(org, context);
+                return this.zitadelCustomers(action, org, context);
+            case 'zitadel:mcp-project':
+                return this.zitadelMcpProject(action, org, context);
+            case 'zitadel:mcp-access':
+                return this.zitadelMcpAccess(action, org, context);
+            case 'zitadel:access-token-lifetime':
+                return this.zitadelAccessTokenLifetime(context);
             case 'coolify:app':
                 return this.coolifyApp(action, org, context);
             case 'coolify:network':
@@ -1145,6 +1167,13 @@ export class FoundryStepExecutor {
                 return this.cloudflareRateLimit(org, context);
             case 'cloudflare:worker':
                 return this.cloudflareWorker(action, org, context);
+            case 'cloudflare:worker-app': {
+                const workers = this.ports.workerApps;
+                if (!workers) {
+                    throw new Error(`cloudflare:worker-app for ${org.slug}: this executor was built without a WorkerAppPort`);
+                }
+                return applyWorkerApp(this.workerAppDeps(workers), org, action, context);
+            }
             case 'files:organisation':
                 return this.filesOrganisation(action, org, context);
             case 'files:key':
@@ -1429,6 +1458,35 @@ export class FoundryStepExecutor {
      * "Declared changes apply" nothing is marked done until the
      * live state actually matches it.
      */
+    workerAppDeps(workers) {
+        return {
+            workers,
+            ...(this.ports.workerAppKeys ? { keys: this.ports.workerAppKeys } : {}),
+            ...(this.ports.workerAppDatabase
+                ? {
+                    database: {
+                        port: this.ports.workerAppDatabase,
+                        tunnels: this.tunnelPort(),
+                        access: this.accessPort(),
+                        dns: this.dnsPort(),
+                        zones: this.zonePort(),
+                        ownerUrl: async (databaseId) => {
+                            const db = await getDatabaseStarted(this.ports.coolify, databaseId);
+                            if (!db.internal_db_url) {
+                                throw new Error('the database reports no internal connection URL yet');
+                            }
+                            this.handledSecrets.add(db.internal_db_url);
+                            return db.internal_db_url;
+                        },
+                        secret: (value) => void this.handledSecrets.add(value),
+                    },
+                }
+                : {}),
+            zones: this.zonePort(),
+            dns: this.dnsPort(),
+            ...(this.ports.heldKeys ? { heldKeys: this.ports.heldKeys } : {}),
+        };
+    }
     async cloudflareWorker(action, org, context) {
         const entryKey = action.key.slice(org.id.length + 1);
         const at = `cloudflare:worker for ${org.slug} entry '${entryKey}'`;
@@ -1766,6 +1824,18 @@ export class FoundryStepExecutor {
         }
         return { resourceId: userId };
     }
+    /** `plan/mcp.ts`: the entry's MCP audience project. */
+    zitadelMcpProject(action, org, context) {
+        return applyMcpProject(this.ports.zitadel, org, action, context);
+    }
+    /** `plan/mcp.ts`: JWT access tokens and the broker's callback on the entry's app. */
+    zitadelMcpAccess(action, org, context) {
+        return applyMcpAccess(this.ports.zitadel, org, action, context);
+    }
+    /** `plan/mcp.ts`: the instance access-token lifetime. */
+    zitadelAccessTokenLifetime(context) {
+        return applyAccessTokenLifetime(this.ports.zitadel, context);
+    }
     /**
      * Switches on "user info inside the ID token" for each live sign-in app
      * the planner named. An app's marker (its ZITADEL app id) is recorded and
@@ -2145,20 +2215,27 @@ export class FoundryStepExecutor {
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
-     * self-registration on and a grant to the org's app project. Staff stay in
+     * self-registration as `customers.signUp` says (off by default) and a grant to the org's app project. Staff stay in
      * the org's own invite-only ZITADEL org. The space keeps the name apart from
      * every issuer org, which is named by a slug and a slug has no spaces. Every call here is idempotent, so
      * a re-run after a crash finishes the job.
      */
-    async zitadelCustomers(org, context) {
+    async zitadelCustomers(action, org, context) {
         const zitadelOrgId = context.recordedIds().zitadel_org;
         if (!zitadelOrgId) {
             throw new Error(`zitadel:customers for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
         }
         const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
         const { org: customers } = await this.ports.zitadel.findOrCreateOrg(`${org.slug} customers`);
-        await this.ports.zitadel.allowSelfRegistration(customers.id);
+        // Self-registration follows `customers.signUp` (off by default). The marker is written last, so a
+        // run that failed before here is planned again.
+        const signUp = action.desired.signUp === true;
+        if (signUp)
+            await this.ports.zitadel.allowSelfRegistration(customers.id);
+        else
+            await this.ports.zitadel.closeSelfRegistration(customers.id);
         await this.ports.zitadel.findOrCreateProjectGrant(zitadelOrgId, projectId, customers.id);
+        context.recordScopeId(CUSTOMERS_SIGN_UP_SCOPE_KEY, signUp ? '1' : '0');
         return { resourceId: customers.id };
     }
     async zitadelApp(action, org, context) {
@@ -2316,13 +2393,17 @@ export class FoundryStepExecutor {
             redirectUris: appType === 'native'
                 ? []
                 : hosts
-                    ? hosts.map((host) => `https://${host}/auth/callback`)
+                    ? [
+                        ...hosts.map((host) => `https://${host}/auth/callback`),
+                        ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : []),
+                    ]
                     : [redirectUri],
             postLogoutRedirectUris: appType === 'native'
                 ? []
                 : hosts
                     ? hosts.map((host) => `https://${host}/`)
                     : [`https://${hostname}/`],
+            ...(authEntry?.uses?.auth?.mcp ? { accessTokenType: 'jwt' } : {}),
         });
         if (appType === 'web') {
             // `coolifyApp`'s own `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` to
@@ -3389,11 +3470,21 @@ export class FoundryStepExecutor {
         if ('missing' in wanted) {
             throw new Error(`coolify:broker-entry for ${org.slug}: ${wanted.missing.map((m) => m.what).join(', ')} not recorded yet`);
         }
+        if (entry.workerApp) {
+            // No Coolify app: the key is the held AUTH_APP_KEY the Worker app was given.
+            const heldKey = await heldBrokerKey(this.ports.heldKeys, org, entry.key);
+            await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, heldKey, context);
+            return {};
+        }
         const appId = recorded[`coolify:app:${action.key}`];
         if (!appId) {
             throw new Error(`coolify:broker-entry for ${org.slug}: app ${action.key} is not recorded yet`);
         }
-        await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, appId, context);
+        const appKey = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === 'AUTH_APP_KEY' && !e.is_preview)?.value;
+        if (!appKey || appKey.length < 32) {
+            throw new Error(`coolify:broker-entry for ${org.slug}: app ${appId} has no AUTH_APP_KEY yet`);
+        }
+        await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, appKey, context);
         return {};
     }
     /**
@@ -3415,15 +3506,15 @@ export class FoundryStepExecutor {
         if (!appId) {
             throw new Error(`coolify:boule-broker-entry for ${org.slug}: the Boule app is not recorded yet`);
         }
-        await this.writeAppBrokerEntry(org, broker, BOULE_BROKER_ENTRY_KEY, wanted.want, appId, context);
-        return {};
-    }
-    /** The shared tail of both broker-entry steps: read the app's key, write the entry, record what was written. */
-    async writeAppBrokerEntry(org, broker, entryKey, want, appId, context) {
         const appKey = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === 'AUTH_APP_KEY' && !e.is_preview)?.value;
         if (!appKey || appKey.length < 32) {
             throw new Error(`coolify:broker-entry for ${org.slug}: app ${appId} has no AUTH_APP_KEY yet`);
         }
+        await this.writeAppBrokerEntry(org, broker, BOULE_BROKER_ENTRY_KEY, wanted.want, appKey, context);
+        return {};
+    }
+    /** The shared tail of both broker-entry steps: read the app's key, write the entry, record what was written. */
+    async writeAppBrokerEntry(_org, broker, entryKey, want, appKey, context) {
         const previousRaw = context.recordedIds()[brokerEntryAppliedScopeKey(entryKey)];
         const result = await writeBrokerEntry(broker, {
             want,
@@ -5713,7 +5804,12 @@ export class FoundryStepExecutor {
         if (mailWanted && !('platformApex' in action.desired)) {
             throw new Error(`coolify:boule for ${org.slug}: this step's plan carries no platformApex; plan this org's Boule again`);
         }
-        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl, mailWanted);
+        // What the plan decided Boule is given beyond its sign-in env (C3).
+        const credentialWants = {
+            archonCredential: action.desired.archonCredential === true,
+            customersDirectory: action.desired.customersDirectory === true,
+        };
+        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl, mailWanted, credentialWants);
         if (missing.length > 0) {
             throw new Error(`Boule for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
         }
@@ -5750,8 +5846,11 @@ export class FoundryStepExecutor {
         });
         const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
         const liveEnv = new Map(liveRows.map((e) => [e.key, e.value]));
-        const envChanged = bouleEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
+        let envChanged = bouleEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
         await this.dropStaleSignInUpstream(app.appId, env, liveRows);
+        // Customers switched off: revoke the directory credential and take the env away (C3).
+        if (await this.dropCustomersCredential(app.appId, org, context, liveRows))
+            envChanged = true;
         const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
         const cookieSecret = await this.ensureAuthCookieSecret(app.appId);
         if (cookieSecret)
@@ -5775,11 +5874,39 @@ export class FoundryStepExecutor {
             this.handledSecrets.add(bridgeSecret);
             envs.push({ key: BOULE_BRIDGE_SECRET_ENV, value: bridgeSecret });
         }
+        // Held, minted once (C3). Compared with the live value so a changed one restarts the app.
+        const credentialEnvs = [];
+        let archonPushedAt = null;
+        if (credentialWants.archonCredential) {
+            const archon = await this.ensureBouleArchonCredential(org, context);
+            archonPushedAt = archon.pushedAt;
+            credentialEnvs.push({ key: BOULE_ARCHON_CREDENTIAL_ENV, value: archon.value });
+        }
+        if (credentialWants.customersDirectory) {
+            const directory = await this.ensureCustomersDirectoryCredential(org, context);
+            if (directory)
+                credentialEnvs.push({ key: BOULE_CUSTOMERS_CREDENTIAL_ENV, value: directory });
+        }
+        for (const credential of credentialEnvs) {
+            this.handledSecrets.add(credential.value);
+            envs.push(credential);
+            if (liveEnv.get(credential.key) !== credential.value)
+                envChanged = true;
+        }
         try {
             await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+            // Only a push that reached Boule's env counts: a failed one is minted and pushed again next apply.
+            if (archonPushedAt) {
+                context.recordScopeId(BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, archonPushedAt);
+                await context.persistScopeIds();
+            }
         }
         catch (error) {
-            const minted = [peerPassword, bridgeSecret].filter((v) => v !== null);
+            const minted = [
+                peerPassword,
+                bridgeSecret,
+                ...credentialEnvs.map((credential) => credential.value),
+            ].filter((v) => v !== null);
             if (minted.length === 0)
                 throw error;
             throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), minted));
@@ -5829,6 +5956,125 @@ export class FoundryStepExecutor {
         this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
+    /**
+     * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
+     * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is
+     * written again unchanged. The secret is held first; the caller records `pushedAt` only after the env write
+     * succeeded, so a failed hold or a failed push is mended by the next apply minting again. Errors name no secret.
+     */
+    async ensureBouleArchonCredential(org, context) {
+        const at = `coolify:boule for ${org.slug}`;
+        const mint = this.ports.mintBouleArchonCredential;
+        const heldKeys = this.ports.heldKeys;
+        if (!mint)
+            throw new Error(`${at}: this executor was built without mintBouleArchonCredential`);
+        if (!heldKeys?.put) {
+            throw new Error(`${at}: the Archon credential needs a held-key store that can put`);
+        }
+        const put = heldKeys.put;
+        const ref = bouleArchonCredentialRef(org.id);
+        const held = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: read the held Archon credential`, () => heldKeys.resolve(ref));
+        const nowMs = context.now?.() ?? Date.now();
+        if (held && !archonCredentialRenewDue(context.recordedIds(), nowMs)) {
+            return { value: held, pushedAt: null };
+        }
+        const secret = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: mint the Archon credential`, () => mint(org.id));
+        this.handledSecrets.add(secret);
+        if (!(await this.holdWithRetry(ref, secret, put, `${at}: hold the Archon credential`))) {
+            throw new Error(`${at}: the Archon credential could not be held after ${BOULE_CREDENTIAL_ATTEMPTS} attempts; the next apply mints it again`);
+        }
+        return { value: secret, pushedAt: new Date(nowMs).toISOString() };
+    }
+    /**
+     * C3: the read-only credential for the company's customers organisation. Held first. Minting revokes every
+     * earlier token of the machine user, so a hold that failed is repaired by the next apply minting again and
+     * leaves one live token. `null` while the customers organisation is not recorded yet.
+     */
+    async ensureCustomersDirectoryCredential(org, context) {
+        const at = `coolify:boule for ${org.slug}`;
+        const customersOrgId = customersOrgIdOf(org, context.recordedIds());
+        if (!customersOrgId)
+            return null;
+        const zitadel = this.ports.zitadel;
+        const heldKeys = this.ports.heldKeys;
+        if (!zitadel.mintOrgDirectoryReader) {
+            throw new Error(`${at}: this executor's ZITADEL port cannot mint a customers directory credential`);
+        }
+        if (!heldKeys?.put) {
+            throw new Error(`${at}: the customers directory credential needs a held-key store that can put`);
+        }
+        const put = heldKeys.put;
+        const ref = customersDirectoryRef(org.id);
+        const held = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: read the held directory credential`, () => heldKeys.resolve(ref));
+        if (held)
+            return held;
+        const minted = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: mint the directory credential`, () => zitadel.mintOrgDirectoryReader(customersOrgId, {
+            userName: CUSTOMERS_DIRECTORY_USER_NAME,
+            name: 'Foundry customers directory (read-only)',
+        }));
+        this.handledSecrets.add(minted.token);
+        context.recordScopeId(CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, minted.userId);
+        await context.persistScopeIds();
+        if (!(await this.holdWithRetry(ref, minted.token, put, `${at}: hold the directory credential`))) {
+            throw new Error(`${at}: the directory credential of ZITADEL user ${minted.userId} could not be held after ${BOULE_CREDENTIAL_ATTEMPTS} attempts; the next apply mints it again and revokes this one`);
+        }
+        return minted.token;
+    }
+    /** `put`, tried up to {@link BOULE_CREDENTIAL_ATTEMPTS} times; true once one attempt succeeds. The cause is dropped. */
+    async holdWithRetry(ref, value, put, label) {
+        for (let attempt = 1; attempt <= BOULE_CREDENTIAL_ATTEMPTS; attempt++) {
+            try {
+                await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, label, () => put(ref, value));
+                return true;
+            }
+            catch {
+                // Retried; the cause may echo the value.
+            }
+        }
+        return false;
+    }
+    /**
+     * C3: customers switched off. Revokes the directory credential's tokens first, then removes the customers
+     * env from Boule, then forgets the held value and the user id. Each step is repeated safely, so a run that
+     * died halfway is finished by the next. Returns true when Boule's env changed.
+     */
+    async dropCustomersCredential(appId, org, context, liveRows) {
+        if (org.customers?.enabled)
+            return false;
+        const at = `coolify:boule for ${org.slug}`;
+        const recorded = context.recordedIds();
+        const userId = recorded[CUSTOMERS_DIRECTORY_USER_SCOPE_KEY];
+        const customersOrgId = customersOrgIdOf(org, recorded);
+        const zitadel = this.ports.zitadel;
+        if (userId && customersOrgId && zitadel.revokeOrgDirectoryReader) {
+            await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: revoke the directory credential`, () => zitadel.revokeOrgDirectoryReader(customersOrgId, userId));
+        }
+        let changed = false;
+        for (const row of liveRows) {
+            if (row.key !== BOULE_CUSTOMERS_ORG_ENV && row.key !== BOULE_CUSTOMERS_CREDENTIAL_ENV)
+                continue;
+            if (!row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+                changed = true;
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        if (userId && (!customersOrgId || zitadel.revokeOrgDirectoryReader)) {
+            const heldKeys = this.ports.heldKeys;
+            if (heldKeys?.put) {
+                const put = heldKeys.put;
+                const ref = customersDirectoryRef(org.id);
+                await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: forget the directory credential`, () => put(ref, ''));
+            }
+            context.recordScopeId(CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, '');
+        }
+        return changed;
+    }
     /**
      * Gives Boule `LETTERMINT_API_TOKEN`: the platform's held key for an org on
      * the platform's own apex, else the org's `<slug>-app` token through the
@@ -8302,6 +8548,17 @@ export class FoundryStepExecutor {
                     await this.teardownWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
                     return;
                 }
+                case 'cloudflare:worker-app': {
+                    // ADR 0002: route, record, containers and script of a Worker app.
+                    const workers = this.ports.workerApps;
+                    if (!workers) {
+                        throw new Error(`cloudflare:worker-app '${target.key}' for ${org.slug}: this executor was built without a WorkerAppPort; cannot delete it`);
+                    }
+                    const entryKey = target.key.slice(org.id.length + 1);
+                    const at = `cloudflare:worker-app '${target.key}' for ${org.slug}`;
+                    await teardownWorkerApp(this.workerAppDeps(workers), entryKey, target.id || undefined, recordedIds, (label, task) => withCallTimeout(WORKER_APP_CALL_TIMEOUT_MS, `${at}: ${label}`, task), org.id);
+                    return;
+                }
                 case 'edge:key': {
                     // F7 (#317): an entry's key (`<orgId>:<entry>`); edge has no org-root key.
                     // No port means no way to revoke it -- thrown, not silently

package/dist/plan/hostnames.d.ts

@@ -6,6 +6,13 @@ import type { DeclaredOrg, HostingEntry } from '../org.js';
  * acted on elsewhere.
  */
 export declare function entryHostnames(org: DeclaredOrg, entry: HostingEntry): string[];
+/**
+ * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
+ * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
+ * under `oikos.host`, so the free Universal certificate covers it), and
+ * `<slug>.oikos.host` for the entry keyed `app`.
+ */
+export declare function workerAppHostname(org: DeclaredOrg, entry: HostingEntry): string;
 /**
  * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
  * Like `entryHostnames`, it is read only while hosting is on, `usesDomain` is

package/dist/plan/hostnames.js

@@ -1,4 +1,5 @@
 import { APP_ENTRY_KEY } from '../org.js';
+import { workerAppHostnameOf } from '../worker-app-config.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 /**
@@ -9,11 +10,22 @@ import { bouleHostnameFor } from './boule.js';
  */
 export function entryHostnames(org, entry) {
     const { domain } = org;
+    if (entry.workerApp)
+        return [workerAppHostname(org, entry)];
     if (!org.hosting.usesDomain || !domain) {
         return entry.key === APP_ENTRY_KEY ? [`${org.slug}.oikos.host`] : [];
     }
     return entry.hostnames.flatMap((name) => name === '*' ? [] : name === '@' ? [domain] : [`${name}.${domain}`]);
 }
+/**
+ * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
+ * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
+ * under `oikos.host`, so the free Universal certificate covers it), and
+ * `<slug>.oikos.host` for the entry keyed `app`.
+ */
+export function workerAppHostname(org, entry) {
+    return workerAppHostnameOf({ slug: org.slug, domain: org.domain, usesDomain: org.hosting.usesDomain }, entry.key, entry.workerApp?.host ?? '@');
+}
 /**
  * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
  * Like `entryHostnames`, it is read only while hosting is on, `usesDomain` is
@@ -98,8 +110,11 @@ export function filesShareHostname(org) {
 export function tunnelIngressHostnames(org, loginHost = null) {
     const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [];
     if (org.hosting.enabled) {
-        for (const entry of org.hosting.entries)
-            hostnames.push(...entryHostnames(org, entry));
+        // A Worker app is reached through its own Worker route, never the tunnel.
+        for (const entry of org.hosting.entries) {
+            if (!entry.workerApp)
+                hostnames.push(...entryHostnames(org, entry));
+        }
     }
     else if (hostnames.length === 0) {
         hostnames.push(legacyAppHostname(org));

package/dist/plan/locked-hostnames.d.ts

@@ -10,3 +10,14 @@ export declare const OWN_SERVICE_LABELS: readonly ["auth", "mail", "files", "sfu
  * oikos.host service names; any other org with no domain holds none.
  */
 export declare function lockedHostnames(org: DeclaredOrg, platformHostnames: readonly string[]): Set<string>;
+/**
+ * What `validateHosting` knows of the org's names: its domain, the names
+ * foundry owns, its slug (for the domain-less `<slug>-<key>.oikos.host`) and
+ * whether its site is served at the apex.
+ */
+export declare function hostingNames(org: DeclaredOrg, platformHostnames: readonly string[]): {
+    domain: string | null;
+    locked: Set<string>;
+    slug: string;
+    siteOwnsApex: boolean;
+};

package/dist/plan/locked-hostnames.js

@@ -47,3 +47,16 @@ export function lockedHostnames(org, platformHostnames) {
     }
     return locked;
 }
+/**
+ * What `validateHosting` knows of the org's names: its domain, the names
+ * foundry owns, its slug (for the domain-less `<slug>-<key>.oikos.host`) and
+ * whether its site is served at the apex.
+ */
+export function hostingNames(org, platformHostnames) {
+    return {
+        domain: org.domain,
+        locked: lockedHostnames(org, platformHostnames),
+        slug: org.slug,
+        siteOwnsApex: org.site.enabled && org.site.usesDomain && org.domain !== null,
+    };
+}

package/dist/plan/mcp.d.ts

@@ -0,0 +1,57 @@
+import type { DeclaredOrg } from '../org.js';
+import type { DraftStep, StepAction } from './diff.js';
+import type { ZitadelPort } from './executor.js';
+import type { StepExecutionContext } from './plan-apply.js';
+/**
+ * Auth ADR 0002, "What foundry declares and applies": the ZITADEL side of
+ * `uses.auth.mcp`. Three steps, all absent for an org that declares no `mcp`:
+ *
+ * - `zitadel:mcp-project` (per entry): an empty project in the customers
+ *   organisation. It holds no app; it exists so its id can be the token's
+ *   audience. The id is recorded once, and `entryMcp` (`broker-entries.ts`) is
+ *   the single reader: the broker entry and the app's `MCP_AUDIENCE` both take
+ *   it from there.
+ * - `zitadel:mcp-access` (per entry): the entry's existing sign-in app issues
+ *   JWT access tokens and accepts `https://<login host>/mcp-oauth/callback`.
+ * - `zitadel:access-token-lifetime` (per org): the instance-wide lifetime goes
+ *   from 12 hours to one. No app of ours keeps an access token, so no other
+ *   app is affected (auth ADR 0002, 4). It is set once any org declares `mcp`
+ *   and is not set back.
+ *
+ * Blocked, not failing (`CLAUDE.md` rule 2), while the executor's ZITADEL
+ * client lacks the calls, or an input is neither recorded nor made by a step in
+ * this plan.
+ */
+type Blocked = Array<{
+    description: string;
+    key: string;
+}>;
+/** A ZITADEL call of the MCP steps that has not answered in this long fails the step; the next apply repeats it. */
+export declare const MCP_CALL_TIMEOUT_MS = 60000;
+/** The want of the access step, recorded when it is done. */
+export declare const mcpAccessWant: (org: DeclaredOrg) => string;
+export declare function planMcp(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], zitadelMcp: boolean): {
+    steps: DraftStep[];
+    blocked: Blocked;
+};
+/**
+ * The empty project in the customers organisation that is an entry's MCP token
+ * audience. Found by name first, so a create whose answer was lost is not made
+ * twice. Its id is recorded under {@link entryMcpProjectScopeKey}, the one
+ * source `entryMcp` reads.
+ */
+export declare function applyMcpProject(zitadel: Pick<ZitadelPort, 'findOrCreateProject'>, org: DeclaredOrg, action: StepAction, context: StepExecutionContext): Promise<{
+    resourceId?: string;
+}>;
+/**
+ * The entry's sign-in app issues JWT access tokens and holds the broker's
+ * callback. Records the want last, so a failed call is planned again.
+ */
+export declare function applyMcpAccess(zitadel: Pick<ZitadelPort, 'ensureOidcAppMcpAccess'>, org: DeclaredOrg, action: StepAction, context: StepExecutionContext): Promise<{
+    resourceId?: string;
+}>;
+/** The instance access-token lifetime, set to one hour. */
+export declare function applyAccessTokenLifetime(zitadel: Pick<ZitadelPort, 'ensureAccessTokenLifetime'>, context: StepExecutionContext): Promise<{
+    resourceId?: string;
+}>;
+export {};