@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/plan/plan-apply.js

@@ -1,15 +1,17 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { sfuSlotPorts } from '../calls-sfu.js';
-import { heldEnvRef, ownsServices, validateHosting } from '../org.js';
+import { ORG_SERVICE_SCHEMAS, heldEnvRef, ownsServices, validateHosting } from '../org.js';
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
 import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
+import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
-import { NetworkMoveBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
+import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
 import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, entrySubject, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
+import { LEGACY_BACKUP_NAMES } from './company-backups.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
@@ -20,6 +22,7 @@ import { hostingNames } from './locked-hostnames.js';
 import { agoraIssuerHostFor, loginHostServesAgora, readLoginHostDiscovery, } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_MAX, OWN_MAIL_SMTP_PORT_SCOPE_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, isOwnMailSmtpPort, mailRelayFingerprint, } from './mail-relay.js';
 import { findNameClashes, nameClashMessage } from './org-names.js';
+import { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, invalidMigrationConfirmation, migrateHomeOf, parseMigrationConfirmation, } from './org-postgres-migrate.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
@@ -159,8 +162,11 @@ export class FoundryPlanApply {
     agora;
     jobsScheduler;
     loginHostBindings;
+    loginHostClientOrganizations;
     loginHostDiscovery;
     zitadelIdTokenUserinfo;
+    zitadelPostLogoutUris;
+    zitadelRedirectUris;
     zitadelMcp;
     zitadelOrgMetadata;
     broker;
@@ -194,8 +200,11 @@ export class FoundryPlanApply {
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
+        this.loginHostClientOrganizations = options.loginHostClientOrganizations ?? false;
         this.loginHostDiscovery = options.loginHostDiscovery;
         this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
+        this.zitadelPostLogoutUris = options.zitadelPostLogoutUris ?? false;
+        this.zitadelRedirectUris = options.zitadelRedirectUris ?? false;
         this.zitadelMcp = options.zitadelMcp ?? false;
         this.zitadelOrgMetadata = options.zitadelOrgMetadata ?? false;
         this.broker = options.broker ?? false;
@@ -379,6 +388,55 @@ export class FoundryPlanApply {
             return released;
         }));
     }
+    /**
+     * Records that the staging copy of a live company's data was checked, which is the only thing that lets
+     * the org Postgres migration step run (#444). It is its own call, never part of an apply. Needs the
+     * platform permission. It stores the staging copy id, who confirmed and when, and writes an audit row.
+     * Throws {@link InvalidMigrationConfirmationError} for a confirmation that is not valid.
+     */
+    async confirmOrgPostgresMigration(orgId, confirmation) {
+        const record = (outcome, reason) => this.audit.recordAdoption({
+            actor: this.actor,
+            orgId,
+            action: 'confirm-org-postgres-migration',
+            entryKey: 'org_postgres_migration',
+            outcome,
+            ...(reason === undefined ? {} : { reason }),
+            at: this.now(),
+        });
+        if ((await this.authz.canApplyPlatform?.(this.actor)) !== true) {
+            await record('refused', 'not authorized');
+            throw new NotAuthorizedError(this.actor, orgId);
+        }
+        const invalid = invalidMigrationConfirmation(confirmation);
+        if (invalid) {
+            await record('refused', invalid);
+            throw new InvalidMigrationConfirmationError(invalid);
+        }
+        const value = {
+            stagingCopy: confirmation.stagingCopy,
+            confirmedBy: confirmation.confirmedBy,
+            confirmedAt: confirmation.confirmedAt,
+        };
+        await this.withMutationLease(companyScope(orgId), (reason) => record('refused', reason), (fence) => this.withRunnerSerialization(orgId, (reason) => record('refused', reason), async () => {
+            if (!(await this.store.get(orgId))) {
+                await record('refused', `no declared org ${orgId}`);
+                throw new DeclaredOrgNotFoundError(orgId);
+            }
+            const previous = await this.store.getAppliedState(orgId);
+            await this.store.putAppliedState({
+                orgId,
+                serviceIds: {
+                    ...(previous?.serviceIds ?? {}),
+                    [ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY]: JSON.stringify(value),
+                },
+                checkpoints: previous?.checkpoints ?? [],
+                failedFields: previous?.failedFields ?? [],
+                lastApplied: previous?.lastApplied ?? null,
+            }, fence);
+            await record('recorded');
+        }));
+    }
     async computeAdopt(id, input) {
         const org = await this.store.get(id);
         if (!org)
@@ -485,8 +543,43 @@ export class FoundryPlanApply {
                     throw e;
                 }
             }
+            // A migration to the company's Postgres server needs the recorded staging confirmation and a fresh dump
+            // of the old database. Both are checked before the first port call.
+            const migrations = detail.plannedSteps.filter((s) => s.action.system === 'coolify' && s.action.kind === 'org-postgres-migrate');
+            if (migrations.length > 0) {
+                const ids = (await this.store.getAppliedState(orgId))?.serviceIds ?? {};
+                if (!parseMigrationConfirmation(ids[ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY])) {
+                    await this.refuse(plan, 'org postgres migration without a recorded staging confirmation');
+                    throw new OrgPostgresMigrationNotConfirmedError();
+                }
+                try {
+                    for (const migration of migrations) {
+                        const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === migrateHomeOf(migration.action));
+                        const legacyKey = home?.legacyKey(org);
+                        const backupName = home ? LEGACY_BACKUP_NAMES[home.schema] : undefined;
+                        if (!this.backupGate)
+                            throw new OrgPostgresMigrationBackupMissingError('no-gate');
+                        if (!legacyKey || !backupName) {
+                            throw new OrgPostgresMigrationBackupMissingError('no-backup');
+                        }
+                        await requireFreshBackupForOrgPostgresMigration({
+                            coolify: this.backupGate.coolify,
+                            orgId,
+                            recordedIds: ids,
+                            now: () => this.now().getTime(),
+                        }, legacyKey, backupName);
+                    }
+                }
+                catch (e) {
+                    if (e instanceof OrgPostgresMigrationBackupMissingError) {
+                        await this.refuse(plan, 'org postgres migration without a fresh backup');
+                    }
+                    throw e;
+                }
+            }
             if (planNeedsConfirmation(plan.steps) &&
-                confirmedOrgName.trim() !== org.displayName.trim()) {
+                confirmedOrgName.trim() !== org.displayName.trim() &&
+                !entryConfirms(options.entryConfirmation, detail.plannedSteps, org.id, org.hosting.entries)) {
                 await this.refuse(plan, "destructive or migrating step without the org's name typed correctly");
                 throw new ConfirmationRequiredError(orgId);
             }
@@ -1219,8 +1312,11 @@ export class FoundryPlanApply {
             : undefined;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
+            loginHostClientOrganizations: this.loginHostClientOrganizations,
             loginHostServesDiscovery,
             zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
+            zitadelPostLogoutUris: this.zitadelPostLogoutUris,
+            zitadelRedirectUris: this.zitadelRedirectUris,
             zitadelMcp: this.zitadelMcp,
             zitadelOrgMetadata: this.zitadelOrgMetadata,
             broker: ownsServices(org) && this.hostOwnServices && this.executor.ownBrokerPort
@@ -1356,14 +1452,16 @@ export class FoundryPlanApply {
             ...(await this.sharedPlatformReadiness()),
             heldEnv: await this.heldEnvReadiness(org),
         };
-        if (!ownsServices(org))
-            return base;
-        const held = this.platformDeps?.heldKeys;
         const platform = await this.platformDeps?.store.get();
-        const readiness = orgPlatformReadinessFor(org, base, orgRecordedIds, held ? await heldOwnKeyRefs(held, org) : new Set());
-        return platform
+        // The auth release gates the shared-host organisation check and the cookie domain of every company.
+        const withRefs = (readiness) => platform
             ? { ...readiness, serviceGitRefs: serviceGitRefsOf(platform, org.versionPin) }
             : readiness;
+        if (!ownsServices(org))
+            return withRefs(base);
+        const held = this.platformDeps?.heldKeys;
+        const readiness = orgPlatformReadinessFor(org, base, orgRecordedIds, held ? await heldOwnKeyRefs(held, org) : new Set());
+        return withRefs(readiness);
     }
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
@@ -1763,6 +1861,73 @@ export class FoundryPlanApply {
 export function planNeedsConfirmation(steps) {
     return steps.some((step) => step.destroys || step.migrates);
 }
+/**
+ * The key of the hosting entry a step belongs to, or `null` for a step of the org or the platform.
+ * An entry's own steps are keyed `<orgId>:<entry key>` (its Coolify app, Worker, Worker app, and
+ * ai, edge and files keys); with `orgId` the prefix must be exactly that id. With `entries` (the
+ * declared ones) two more are known: the ZITADEL sign-in client named like an entry that declares
+ * `uses.auth`, and a gate named in an entry's `gates`. The org database, the org-wide files key,
+ * the customers organisation and the issuer belong to no entry. (`apply` lets an entry's
+ * confirmation pass the park of the org database once no declared entry uses a database.)
+ */
+export function stepEntryKey(step, orgId, entries = []) {
+    const { system, kind, key } = step.action;
+    if (system === 'zitadel' && kind === 'app') {
+        return entries.find((e) => e.key === key && e.uses?.auth)?.key ?? null;
+    }
+    const entryOwned = (system === 'coolify' && kind === 'app') ||
+        (system === 'cloudflare' && (kind === 'worker' || kind === 'worker-app' || kind === 'gate')) ||
+        (kind === 'key' && (system === 'ai' || system === 'edge' || system === 'files'));
+    if (!entryOwned)
+        return null;
+    const colon = key.indexOf(':');
+    if (colon < 1)
+        return null;
+    const prefix = key.slice(0, colon);
+    if (orgId === undefined ? prefix === 'platform' : prefix !== orgId)
+        return null;
+    const rest = key.slice(colon + 1);
+    if (rest === '' || rest.includes(':'))
+        return null;
+    if (kind === 'gate')
+        return entries.find((e) => e.gates?.some((g) => g.key === rest))?.key ?? null;
+    return rest;
+}
+/**
+ * The step that parks the org's one database. It belongs to the org, not to an entry, but the
+ * entry that removes the last use of it may confirm it (see `entryConfirms`).
+ */
+function isOrgDatabasePark(step, orgId) {
+    const { system, kind, key } = step.action;
+    return system === 'coolify' && kind === 'database' && key === orgId && step.step.destroys;
+}
+/**
+ * The delete of one of the org's gates that no entry declares any more. The step names only the
+ * gate, so the caller names the removed entry's gates (`entryConfirmation.gates`) and only those pass.
+ */
+function isUndeclaredGateDelete(step, orgId) {
+    const { system, kind, key, desired } = step.action;
+    return (system === 'cloudflare' &&
+        kind === 'gate' &&
+        key.startsWith(`${orgId}:`) &&
+        desired?.mode === 'delete');
+}
+/** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
+export function entryConfirms(confirmation, steps, orgId, entries) {
+    if (!confirmation ||
+        confirmation.entryKey === '' ||
+        confirmation.typed !== confirmation.entryKey) {
+        return false;
+    }
+    return steps
+        .filter(({ step }) => step.destroys || step.migrates)
+        .every((planned) => stepEntryKey(planned, orgId, entries) === confirmation.entryKey ||
+        (isOrgDatabasePark(planned, orgId) && !entries.some(entryHasDatabase)) ||
+        (isUndeclaredGateDelete(planned, orgId) &&
+            !planned.step.migrates &&
+            (confirmation.gates ?? []).includes(planned.action.key.slice(orgId.length + 1)) &&
+            !entries.some((e) => e.key === confirmation.entryKey)));
+}
 /** `AppliedState.serviceIds`' two flat ZITADEL scope keys (`executor.ts`'s `ensureZitadelProject`/`zitadelIssuer`) -- no `:`, unlike a resource key. */
 const ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_project';
 const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
@@ -2022,6 +2187,7 @@ const STEP_FIELDS = {
     'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
     'zitadel:id-token-userinfo': 'hosting.entries.uses.auth',
+    'zitadel:desktop-callback': 'hosting.entries.uses.auth',
     'zitadel:mcp-project': 'hosting.entries.uses.auth.mcp',
     'zitadel:mcp-access': 'hosting.entries.uses.auth.mcp',
     'zitadel:access-token-lifetime': 'hosting.entries.uses.auth.mcp',

package/dist/plan/platform-diff.d.ts

@@ -60,6 +60,12 @@ export declare const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = "auth_z
 export declare const AUTH_ZITADEL_RUN_OPTIONS = "--entrypoint \"/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external\"";
 /** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
 export declare const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = "zitadel_platform_auth_run_options_applied";
+/**
+ * The `gitRef` the platform's login, in-app login and broker apps were last built from (value: the ref). A
+ * different declared ref plans the auth step again: it patches `git_branch` on those three apps and
+ * redeploys them, so a release tag named in the declaration reaches the running login.
+ */
+export declare const PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY = "platform_auth_applied_git_ref";
 /**
  * #251: the Synapse/MAS image tags an org's calls Matrix stack last
  * successful apply actually set live. `coolifyCalls` (`executor.ts`)
@@ -611,6 +617,31 @@ export declare const PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY = "zitadel_platform_a
  * repair while this differs from the recorded client app id.
  */
 export declare const PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY = "archon_id_token_userinfo_applied";
+/**
+ * The marker for Archon's sign-in client once its post-logout addresses were
+ * set: the client's ZITADEL app id and the set it holds
+ * (`postLogoutAppliedValue`). `planArchonPostLogoutUris` plans the update
+ * while this differs from what the declared hostname wants.
+ */
+export declare const PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY = "archon_post_logout_applied";
+/**
+ * #394 (decision D2, release one): the role key on the platform's `mail`
+ * ZITADEL project that every mailbox user holds once the project's role check
+ * is on. This release only makes the role and grants it; the check stays off.
+ */
+export declare const PLATFORM_MAIL_USER_ROLE = "mail:use";
+/** The mail project id once {@link PLATFORM_MAIL_USER_ROLE} exists on it. */
+export declare const PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY = "zitadel_platform_mail_role";
+/** `<mail project id>|<owner user id, or none>` once the owner holds the role. */
+export declare const PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY = "zitadel_platform_mail_role_granted";
+/** The mail project id once its role check and has-project check are on (release two, behind an option). */
+export declare const PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY = "zitadel_platform_mail_role_check";
+/**
+ * The ZITADEL app id of Archon's sign-in client once `/auth/desktop/callback`
+ * was registered on it (#339). `planArchonDesktopCallback` plans the step
+ * while this differs from the recorded client app id.
+ */
+export declare const PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY = "archon_desktop_callback_applied";
 /**
  * The settings `coolifyApp` owns on an entry's app (`folder`, `port`,
  * `autoDeploy`) as the JSON the marker below holds. `coolifyApp` records it
@@ -1225,6 +1256,18 @@ export interface PlanPlatformOptions {
          * repair step is not planned.
          */
         archonIdTokenUserinfo?: boolean;
+        /** The owner company's ZITADEL client has `updateOidcAppPostLogoutRedirectUris`. */
+        archonPostLogoutUris?: boolean;
+        /**
+         * The Archon sign-in client's ZITADEL client has `getOidcAppRedirectUris`
+         * and `updateOidcAppRedirectUris`. Not a block: without them the desktop
+         * callback step is not planned.
+         */
+        archonDesktopCallback?: boolean;
+        /** The mail step's ZITADEL client can make a project role and grant it. Not a block: without it no mail role step is planned. */
+        mailRole?: boolean;
+        /** The host asked for the mail project's role check (release two) and its client has `setProjectRoleChecks`. */
+        mailRoleCheck?: boolean;
         /**
          * The executor has the platform's sign-in dependencies and a ZITADEL
          * client for its instance. Not a block: without it the sign-in policy
@@ -1265,6 +1308,8 @@ export interface PlanPlatformOptions {
     drifted?: {
         archon?: boolean;
         auth?: boolean;
+        /** #643: a recorded sign-in app is missing or not running; plans the step again, minting nothing. */
+        authApps?: boolean;
         edge?: boolean;
         files?: boolean;
         backupStorage?: boolean;

package/dist/plan/platform-diff.js

@@ -12,6 +12,7 @@ import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
+import { postLogoutUpdateOwed, postLogoutUrisFor } from './post-logout-uris.js';
 import { archonInAppHost } from './sign-in-archon.js';
 import { signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
@@ -64,6 +65,12 @@ export const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = 'auth_zitadel_a
 export const AUTH_ZITADEL_RUN_OPTIONS = '--entrypoint "/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external"';
 /** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
 export const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = 'zitadel_platform_auth_run_options_applied';
+/**
+ * The `gitRef` the platform's login, in-app login and broker apps were last built from (value: the ref). A
+ * different declared ref plans the auth step again: it patches `git_branch` on those three apps and
+ * redeploys them, so a release tag named in the declaration reaches the running login.
+ */
+export const PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'platform_auth_applied_git_ref';
 /**
  * #251: the Synapse/MAS image tags an org's calls Matrix stack last
  * successful apply actually set live. `coolifyCalls` (`executor.ts`)
@@ -694,6 +701,31 @@ export const PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY = 'zitadel_platform_access_ap
  * repair while this differs from the recorded client app id.
  */
 export const PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY = 'archon_id_token_userinfo_applied';
+/**
+ * The marker for Archon's sign-in client once its post-logout addresses were
+ * set: the client's ZITADEL app id and the set it holds
+ * (`postLogoutAppliedValue`). `planArchonPostLogoutUris` plans the update
+ * while this differs from what the declared hostname wants.
+ */
+export const PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY = 'archon_post_logout_applied';
+/**
+ * #394 (decision D2, release one): the role key on the platform's `mail`
+ * ZITADEL project that every mailbox user holds once the project's role check
+ * is on. This release only makes the role and grants it; the check stays off.
+ */
+export const PLATFORM_MAIL_USER_ROLE = 'mail:use';
+/** The mail project id once {@link PLATFORM_MAIL_USER_ROLE} exists on it. */
+export const PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY = 'zitadel_platform_mail_role';
+/** `<mail project id>|<owner user id, or none>` once the owner holds the role. */
+export const PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY = 'zitadel_platform_mail_role_granted';
+/** The mail project id once its role check and has-project check are on (release two, behind an option). */
+export const PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY = 'zitadel_platform_mail_role_check';
+/**
+ * The ZITADEL app id of Archon's sign-in client once `/auth/desktop/callback`
+ * was registered on it (#339). `planArchonDesktopCallback` plans the step
+ * while this differs from the recorded client app id.
+ */
+export const PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY = 'archon_desktop_callback_applied';
 export function appSettingsOf(entry) {
     return {
         folder: entry.folder,
@@ -1324,7 +1356,7 @@ export function planPlatform(platform, live, options = {}) {
     // reconcile below can be planned in the *same* round hc first comes up,
     // the same way files/mail/archon are planned in auth's own first round.
     const hcReady = hc.step !== null || Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_HC_KEY)]);
-    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite);
+    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false);
     if (auth.step)
         plannedSteps.push(auth.step);
     // #174: the integrations host. Planned after auth; neither step reads the
@@ -1414,6 +1446,20 @@ export function planPlatform(platform, live, options = {}) {
     const idTokenUserinfo = planArchonIdTokenUserinfo(platform, recordedIds, blocked.archonIdTokenUserinfo ?? false);
     if (idTokenUserinfo)
         plannedSteps.push(idTokenUserinfo);
+    const postLogoutUris = planArchonPostLogoutUris(platform, recordedIds, blocked.archonPostLogoutUris ?? false);
+    if (postLogoutUris)
+        plannedSteps.push(postLogoutUris);
+    // #339: Archon's sign-in client takes the desktop callback too.
+    const desktopCallback = planArchonDesktopCallback(platform, recordedIds, blocked.archonDesktopCallback ?? false);
+    if (desktopCallback)
+        plannedSteps.push(desktopCallback);
+    // #394: the mail role and its grants. After the auth and mail steps, which record what it reads.
+    const mailRole = planMailRole(platform, recordedIds, {
+        role: blocked.mailRole ?? false,
+        check: blocked.mailRoleCheck ?? false,
+    });
+    if (mailRole.step)
+        plannedSteps.push(mailRole.step);
     // #669: after the ID token repair too, which is proven; a policy call that fails every time holds up nothing.
     const signInPolicy = planAuthSignInPolicy(platform, recordedIds, blocked.authSignInPolicy ?? false);
     if (signInPolicy)
@@ -1481,6 +1527,8 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: auth.blocked, key: 'auth' });
     if (mail.blocked)
         unmanaged.push({ description: mail.blocked, key: 'mail' });
+    if (mailRole.blocked)
+        unmanaged.push({ description: mailRole.blocked, key: 'mail-role' });
     if (relay.blocked)
         unmanaged.push({ description: relay.blocked, key: 'mail-relay' });
     if (platform.mail.relay === true) {
@@ -1946,7 +1994,7 @@ function planSfu(platform, callsOrgSlugs, recordedIds) {
  * promising "this apply re-mints" while one of those is still missing would
  * be wrong the moment it is read.
  */
-function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked) {
+function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false) {
     if (!platform.auth.enabled)
         return { step: null, blocked: null };
     // C3/S2: standing notes. The invite and the domain wait on a person; they hold nothing else back.
@@ -1977,7 +2025,14 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
     // comment for why this never holds the step back the way the admin key's
     // own `undelivered` check below does.
     const loginClientUndelivered = recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY];
-    if (recordedIds[key] &&
+    if (
+    // #643: the apps recorded, but one is gone or stopped. The step finds each by name, deploys what is not
+    // running and mints nothing while the records stand.
+    !appsDown &&
+        // #741: a refused owner-org domain (blocked key recorded, domain not) is tried again on the next apply.
+        // While it stays refused the step is planned on every run, each spending about five seconds; known, no code.
+        ownerDomainBlockedText(recordedIds) === null &&
+        recordedIds[key] &&
         connectorApplied &&
         brokerApplied &&
         brokerDeployed &&
@@ -1995,7 +2050,8 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
                 recordedIds[PLATFORM_OWNER_ORG_SCOPE_KEY]) &&
         // The ZITADEL run options reach the container only through the auth
         // step's redeploy, so a platform recorded before them still plans it.
-        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
+        recordedIds[PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY] === platform.auth.gitRef) {
         return { step: null, blocked: standingNote };
     }
     // The admin key was minted but never reached the host. ZITADEL shows a
@@ -2542,6 +2598,97 @@ function planArchonIdTokenUserinfo(platform, recordedIds, wired) {
         },
     };
 }
+/**
+ * #394, decision D2 (release one): one `zitadel:mail-role` step keyed
+ * {@link PLATFORM_MAIL_KEY}. It makes the role {@link PLATFORM_MAIL_USER_ROLE}
+ * on the mail project, grants it to the platform owner, and (only when the host
+ * asks, `wired.check`) turns on the project's role check on a later run than the
+ * grant. It waits until the mail project, the platform's ZITADEL org and the
+ * owner invite are recorded.
+ *
+ * The owner's user lives in the owner company's sign-in org, and the mail project
+ * in the platform's own org. A role grant on a project of another org needs a
+ * project grant with role keys, which the ports do not have; the owner's grant
+ * is reported blocked, not attempted, and the role is still made.
+ */
+function planMailRole(platform, recordedIds, wired) {
+    if (!wired.role || !platform.mail.enabled || !platform.auth.enabled) {
+        return { step: null, blocked: null };
+    }
+    const projectId = recordedIds[PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY];
+    const orgId = recordedIds[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const invite = recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    if (!projectId || !orgId || !invite)
+        return { step: null, blocked: null };
+    const sameOrg = invite === 'none' || recordedIds[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY] === orgId;
+    const blocked = sameOrg
+        ? null
+        : "the platform owner's mail role is blocked, not planned: the owner is in another ZITADEL org than the mail project, and a role grant across orgs needs a project grant with role keys, which is not built";
+    const needsRole = recordedIds[PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY] !== projectId;
+    const granted = recordedIds[PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY] === `${projectId}|${invite}`;
+    // The check is planned only after a grant an earlier apply made, never with the first grant,
+    // and never while the owner holds no role (it would lock the owner out).
+    const needsCheck = wired.check &&
+        sameOrg &&
+        granted &&
+        recordedIds[PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY] !== projectId;
+    if (!needsRole && !(sameOrg && !granted) && !needsCheck)
+        return { step: null, blocked };
+    return {
+        step: {
+            action: { system: 'zitadel', kind: 'mail-role', key: PLATFORM_MAIL_KEY, desired: {} },
+            step: {
+                description: `make the mail role '${PLATFORM_MAIL_USER_ROLE}' on the mail project and grant it to the platform owner`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked,
+    };
+}
+function planArchonDesktopCallback(platform, recordedIds, wired) {
+    if (!wired || !platform.archon.enabled)
+        return null;
+    const appId = recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!appId || recordedIds[PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY] === appId) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'desktop-callback', key: PLATFORM_ARCHON_KEY, desired: {} },
+        step: {
+            description: "register the desktop sign-in callback on Archon's sign-in client",
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
+/**
+ * Archon's sign-in client holds its root and `/auth/signed-out` as post-logout
+ * addresses. One `zitadel:post-logout-uris` step keyed {@link PLATFORM_ARCHON_KEY},
+ * planned while {@link PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY} differs
+ * from the recorded client app id and the declared hostname's set (a client
+ * made again records it at creation). Not planned when the host's ZITADEL
+ * client lacks the method, and not blocked either.
+ */
+function planArchonPostLogoutUris(platform, recordedIds, wired) {
+    if (!wired || !platform.archon.enabled)
+        return null;
+    const appId = recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!appId)
+        return null;
+    const uris = postLogoutUrisFor([platform.archon.hostname]);
+    if (!postLogoutUpdateOwed(recordedIds[PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY], appId, uris)) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'post-logout-uris', key: PLATFORM_ARCHON_KEY, desired: {} },
+        step: {
+            description: "update the post-logout addresses of Archon's sign-in client",
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /**
  * #394, #669: the platform's sign-in org reserves the username `admin` and
  * switches self-registration off. One `zitadel:sign-in-policy` step keyed
@@ -3061,6 +3208,14 @@ function planArchon(platform, recordedIds, executorBlocked, ownerSignIn, ownerFi
     // A deploy the step triggered is still running: planning it again would deploy twice.
     if (deployRunning)
         return { step: null, blocked: deployRunning };
+    // Giving Archon's address up edits the in-app login app's host table: without that app's id the binding
+    // cannot be removed, so nothing is planned (and the address is not recorded as given up).
+    if (ownerSignIn && !ownerSignIn.signInLoginAppId && archonInAppHost(recordedIds) !== '') {
+        return {
+            step: null,
+            blocked: "Archon's own sign-in address cannot be given up: the owner company's in-app login app is not recorded",
+        };
+    }
     const key = resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY);
     const archonOrgId = recordedIds[PLATFORM_ARCHON_ORG_SCOPE_KEY];
     const applied = Boolean(recordedIds[key]) &&

package/dist/plan/platform-org.d.ts

@@ -104,6 +104,8 @@ export interface OrgPlatformReadiness {
     platformZitadelIds?: readonly string[];
     /** The second login app that serves `/sign-in` for companies with `signIn.inApp` is applied. Absent reads as false. */
     signInLoginReady?: boolean;
+    /** `LOGIN_SESSION_BIND_KEY` is live on the in-app login app (`sign_in_bind_key_ready`). Absent reads as false. */
+    signInBindKeyReady?: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
     /**

package/dist/plan/platform-org.js

@@ -1,5 +1,6 @@
 import { ownsServices } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor } from './agora.js';
+import { SIGN_IN_BIND_KEY_SCOPE_KEY } from './cookie-domain.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
@@ -161,6 +162,9 @@ edgePortPresent = false) {
             ? { platformAuthRecordedHost: platform.auth.hostname }
             : {}),
         ...(platformRecordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY] ? { signInLoginReady: true } : {}),
+        ...(platformRecordedIds[SIGN_IN_BIND_KEY_SCOPE_KEY] === '1'
+            ? { signInBindKeyReady: true }
+            : {}),
         authReady,
         authIssuer: authReady ? `https://${platform.auth.hostname}` : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,

package/dist/plan/platform-providers.d.ts

@@ -391,6 +391,10 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
         archonIdTokenUserinfo?: boolean;
+        archonPostLogoutUris?: boolean;
+        archonDesktopCallback?: boolean;
+        mailRole?: boolean;
+        mailRoleCheck?: boolean;
         authSignInPolicy?: boolean;
         archonOrg?: string;
         archonOrgInvite?: string;
@@ -716,7 +720,13 @@ export interface PlatformMailDeps {
      * checks an access token's `aud` claim against -- #346, no host has to
      * register a resource API for this by hand any more.
      */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject'> & Partial<Pick<ZitadelPort, 'ensureProjectRole' | 'grantProjectRoles' | 'setProjectRoleChecks'>>;
+    /**
+     * #394 (decision D2): turn on the mail project's role check and has-project check. Default off:
+     * release one only makes the role and grants it, and the check follows in release two, on a
+     * run after the grant. Needs `setProjectRoleChecks` on the client.
+     */
+    requireMailRole?: boolean;
     /** {@link PlatformArchonDeps.zitadelForInstance}, for Stalwart's OIDC directory. */
     zitadelForInstance?: (issuerUrl: string) => PlatformMailDeps['zitadel'];
     /**
@@ -917,7 +927,7 @@ export interface PlatformArchonDeps {
     access: PlatformAccessFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri'>>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri' | 'updateOidcAppPostLogoutRedirectUris' | 'getOidcAppRedirectUris' | 'updateOidcAppRedirectUris'>>;
     /**
      * {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client:
      * the owner company's own ZITADEL, by its issuer and the held-key reference of