@wtfalch/foundry 0.52.1 → 0.54.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, BlueGreenConfig, OrgBuiltinApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, BlueGreenConfig, OrgBuiltinApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
 export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';

package/dist/org.d.ts

@@ -289,7 +289,7 @@ export type AccessRule = {
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /** Why a validator refused. `code` is stable and never reworded; `message` is for people. */
-export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'hosting_repo_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'auth_sign_in_invalid' | 'email_code_needs_customers' | 'client_name_taken' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
+export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'hosting_repo_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'auth_sign_in_invalid' | 'email_code_needs_customers' | 'auth_room_invalid' | 'auth_room_needs_customers' | 'auth_room_not_unique' | 'client_name_taken' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
 /**
  * One refusal: a stable `code`, the dotted `path` into {@link DeclaredOrg} it is about
  * (`hosting.entries.terminal.uses.auth.registration`) and the sentence for people.
@@ -498,7 +498,32 @@ export interface EntryAuth {
      * `users: 'customers'`.
      */
     signIn?: 'password' | 'email-code';
+    /**
+     * The left-half text of the customers' sign-in window. Written on the
+     * customers organisation as metadata `wtfalch.room` (JSON, keys in the
+     * order below). Needs `users: 'customers'`; at most one entry per org
+     * declares it.
+     */
+    room?: EntryAuthRoom;
 }
+export interface EntryAuthRoom {
+    name: string;
+    headline: string;
+    line: string;
+    title?: string;
+    description?: string;
+    steps?: number;
+}
+/** Longest value of each `uses.auth.room` text field. */
+export declare const ROOM_TEXT_MAX: {
+    readonly name: 40;
+    readonly headline: 120;
+    readonly line: 200;
+    readonly title: 60;
+    readonly description: 200;
+};
+export declare const ROOM_STEPS_MIN = 2;
+export declare const ROOM_STEPS_MAX = 9;
 /** `uses.auth.mcp.onboardingPath`: absolute, no query, no fragment, no dot segments. */
 export declare const ONBOARDING_PATH_MAX_LENGTH = 200;
 /** The MCP endpoint path: absolute, plain characters, no dot segments, no query. */

package/dist/org.js

@@ -15,6 +15,16 @@ function refusal(code, path, message) {
 }
 /** The most volumes one entry may declare. */
 export const MAX_ENTRY_VOLUMES = 8;
+/** Longest value of each `uses.auth.room` text field. */
+export const ROOM_TEXT_MAX = {
+    name: 40,
+    headline: 120,
+    line: 200,
+    title: 60,
+    description: 200,
+};
+export const ROOM_STEPS_MIN = 2;
+export const ROOM_STEPS_MAX = 9;
 /** `uses.auth.mcp.onboardingPath`: absolute, no query, no fragment, no dot segments. */
 export const ONBOARDING_PATH_MAX_LENGTH = 200;
 /** The MCP endpoint path: absolute, plain characters, no dot segments, no query. */
@@ -216,6 +226,10 @@ export function refuseHosting(hosting, names) {
     if (mains.length > 1) {
         return refusal('hosting_main_count', 'hosting.entries', `at most one hosting entry may be the main app: ${mains.map((entry) => `'${entry.key}'`).join(' and ')} are`);
     }
+    const roomEntries = hosting.entries.filter((entry) => entry.uses?.auth?.room !== undefined);
+    if (roomEntries.length > 1) {
+        return refusal('auth_room_not_unique', 'hosting.entries', `at most one hosting entry may set uses.auth.room: ${roomEntries.map((entry) => `'${entry.key}'`).join(' and ')} do`);
+    }
     if (hosting.entries.filter((entry) => entry.uses?.ai?.webhookPath !== undefined).length > 1) {
         return refusal('ai_webhook_path_not_unique', 'hosting.entries', 'at most one hosting entry may set uses.ai webhookPath: ai keeps one webhook per organisation');
     }
@@ -649,6 +663,15 @@ function validateEntryAuth(entry, hosting, domain) {
     if (signIn === 'email-code' && auth.users !== 'customers') {
         return refusal('email_code_needs_customers', `hosting.entries.${entry.key}.uses.auth.signIn`, `${at} signIn 'email-code' needs users 'customers': only customers sign in with an emailed code`);
     }
+    if (auth.room !== undefined) {
+        if (auth.users !== 'customers') {
+            return refusal('auth_room_needs_customers', `hosting.entries.${entry.key}.uses.auth.room`, `${at} room needs users 'customers': only the customers' sign-in window shows it`);
+        }
+        const problem = roomProblem(auth.room);
+        if (problem) {
+            return refusal('auth_room_invalid', `hosting.entries.${entry.key}.uses.auth.room`, `${at} room ${problem}`);
+        }
+    }
     if (entry.key === 'agora' ||
         entry.key === 'boule' ||
         entry.key === 'cms' ||
@@ -657,6 +680,39 @@ function validateEntryAuth(entry, hosting, domain) {
     }
     return null;
 }
+const ROOM_KEYS = [...Object.keys(ROOM_TEXT_MAX), 'steps'];
+// biome-ignore lint/suspicious/noControlCharactersInRegex: the point is to refuse them
+const ROOM_UNSAFE_TEXT = /[\u0000-\u001f\u007f<>]/;
+/** A fixed sentence when `uses.auth.room` is not usable, `null` when it is. The value is never in it. */
+function roomProblem(room) {
+    if (typeof room !== 'object' || room === null || Array.isArray(room)) {
+        return 'must be an object with name, headline and line';
+    }
+    const fields = room;
+    const unknown = Object.keys(fields).find((key) => !ROOM_KEYS.includes(key));
+    if (unknown !== undefined)
+        return `has an unknown key '${unknown}'`;
+    for (const [key, max] of Object.entries(ROOM_TEXT_MAX)) {
+        const value = fields[key];
+        if (value === undefined && (key === 'title' || key === 'description'))
+            continue;
+        if (typeof value !== 'string' ||
+            value.trim() === '' ||
+            value.length > max ||
+            ROOM_UNSAFE_TEXT.test(value)) {
+            return `${key} must be 1 to ${max} characters of plain text with no control character, '<' or '>'`;
+        }
+    }
+    const steps = fields.steps;
+    if (steps !== undefined &&
+        (typeof steps !== 'number' ||
+            !Number.isInteger(steps) ||
+            steps < ROOM_STEPS_MIN ||
+            steps > ROOM_STEPS_MAX)) {
+        return `steps must be a whole number from ${ROOM_STEPS_MIN} to ${ROOM_STEPS_MAX}`;
+    }
+    return null;
+}
 /** With no domain the hostnames are not read (`entryHostnames`). */
 function hasExactHostname(entry, hosting, domain) {
     if (entry.workerApp)

package/dist/plan/boule.d.ts

@@ -1,4 +1,4 @@
-import { type DeclaredOrg, type OwnerIdentity } from '../org.js';
+import { type DeclaredOrg, type EntryAuthRoom, type OwnerIdentity } from '../org.js';
 import type { BrokerEntryInput, BrokerEntryWant } from './broker-entries.js';
 /**
  * #161 (Boule part): what both the planner (`diff.ts`) and the executor
@@ -106,6 +106,12 @@ export declare const CUSTOMERS_DIRECTORY_USER_SCOPE_KEY = "customers_directory_u
 export declare const CUSTOMERS_SIGN_IN_METADATA_KEY = "wtfalch.signIn";
 /** `email-code` or `password`: the sign-in metadata last written to the customers organisation. Absent: never written. */
 export declare const CUSTOMERS_SIGN_IN_SCOPE_KEY = "zitadel_customers_signin";
+/** The ZITADEL org metadata key that holds the left-half text of the customers' sign-in window. */
+export declare const CUSTOMERS_ROOM_METADATA_KEY = "wtfalch.room";
+/** The metadata value last written to the customers organisation, or empty after a removal. Absent: never written. */
+export declare const CUSTOMERS_ROOM_SCOPE_KEY = "zitadel_customers_room";
+/** The `wtfalch.room` value: JSON, keys in the order name, headline, line, title, description, steps. */
+export declare function customersRoomValue(room: EntryAuthRoom): string;
 /** `1` or `0`: the sign-up switch last written to the customers organisation's login policy. */
 export declare const CUSTOMERS_SIGN_UP_SCOPE_KEY = "zitadel_customers_signup";
 /** Where the held-key store keeps the Archon credential of an org's Boule. */

package/dist/plan/boule.js

@@ -120,6 +120,22 @@ export const CUSTOMERS_DIRECTORY_USER_SCOPE_KEY = 'customers_directory_user';
 export const CUSTOMERS_SIGN_IN_METADATA_KEY = 'wtfalch.signIn';
 /** `email-code` or `password`: the sign-in metadata last written to the customers organisation. Absent: never written. */
 export const CUSTOMERS_SIGN_IN_SCOPE_KEY = 'zitadel_customers_signin';
+/** The ZITADEL org metadata key that holds the left-half text of the customers' sign-in window. */
+export const CUSTOMERS_ROOM_METADATA_KEY = 'wtfalch.room';
+/** The metadata value last written to the customers organisation, or empty after a removal. Absent: never written. */
+export const CUSTOMERS_ROOM_SCOPE_KEY = 'zitadel_customers_room';
+/** The `wtfalch.room` value: JSON, keys in the order name, headline, line, title, description, steps. */
+export function customersRoomValue(room) {
+    const { name, headline, line, title, description, steps } = room;
+    return JSON.stringify({
+        name,
+        headline,
+        line,
+        ...(title !== undefined ? { title } : {}),
+        ...(description !== undefined ? { description } : {}),
+        ...(steps !== undefined ? { steps } : {}),
+    });
+}
 /** `1` or `0`: the sign-up switch last written to the customers organisation's login policy. */
 export const CUSTOMERS_SIGN_UP_SCOPE_KEY = 'zitadel_customers_signup';
 /** Where the held-key store keeps the Archon credential of an org's Boule. */

package/dist/plan/broker-entries.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { isFoundryOwnedBrokerEntryName, } from '../org.js';
 import { entryClientIdScopeKey } from './agora.js';
+import { MCP_DATABASE_URL_ENV, MCP_OAUTH_SECRET_ENV } from './broker-mcp.js';
 import { entryHostnames } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
 import { PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, parseBrokerDeployRecord, } from './platform-diff.js';
@@ -185,7 +186,8 @@ export async function writeBrokerEntry(broker, input) {
     if (archonOrgConflicts([want], archonOrgId).length > 0) {
         throw new Error(`${label} would sign in Archon's own organisation, which no other entry may`);
     }
-    const env = (await broker.listEnvs()).find((e) => e.key === 'AUTH_APPS' && !e.is_preview);
+    const brokerEnvs = await broker.listEnvs();
+    const env = brokerEnvs.find((e) => e.key === 'AUTH_APPS' && !e.is_preview);
     // A value that reads back empty is not an empty list: writing over it
     // would drop every hand-written entry.
     if (env && !env.value) {
@@ -275,8 +277,15 @@ export async function writeBrokerEntry(broker, input) {
     place();
     const nextRaw = JSON.stringify(next);
     const changed = JSON.stringify(current) !== nextRaw;
-    if (changed)
+    if (changed) {
+        // Auth ADR 0002: a broker given an `mcp` entry without its database and secret exits at boot. The
+        // sign-in step sets both first; until it has, nothing is written and the next apply tries again.
+        const held = (key) => brokerEnvs.some((e) => e.key === key && !e.is_preview && e.value != null && e.value !== '');
+        if (want.mcp && !(held(MCP_DATABASE_URL_ENV) && held(MCP_OAUTH_SECRET_ENV))) {
+            throw new Error(`${label}: the broker has no ${MCP_DATABASE_URL_ENV} and ${MCP_OAUTH_SECRET_ENV} yet (the sign-in step sets them), so nothing was written; apply again`);
+        }
         await broker.setAuthApps(nextRaw);
+    }
     // The platform's own check of the broker's inputs also refuses a broker
     // whose AUTH_APPS holds an invalid entry; the broker itself only drops it,
     // so that one does not hold back the deploy.

package/dist/plan/broker-mcp.d.ts

@@ -0,0 +1,63 @@
+import type { CoolifyPort } from './executor.js';
+import { type JobRuntime } from './job-app.js';
+/**
+ * Auth ADR 0002, sections 2 and 5: a broker whose `AUTH_APPS` holds an entry with `mcp` exits at boot
+ * without `MCP_DATABASE_URL` (a `broker` database on the sign-in Postgres) and `MCP_OAUTH_SECRET`
+ * (`deriveKeys` in `wtfalch/auth` broker/src/mcp-crypto.ts wants at least 32 characters). This file
+ * gives the broker both, from `provisionAuthStack`, before an entry with `mcp` can reach it.
+ */
+export declare const MCP_DATABASE_URL_ENV = "MCP_DATABASE_URL";
+export declare const MCP_OAUTH_SECRET_ENV = "MCP_OAUTH_SECRET";
+/** The broker's own role and database on the sign-in Postgres. */
+export declare const BROKER_DB_NAME = "broker";
+export declare const BROKER_DB_USER = "broker";
+/** 32 random bytes as 64 hex characters: twice the 32 characters `deriveKeys` asks for. */
+export declare const MCP_OAUTH_SECRET_MIN_LENGTH = 32;
+type Coolify = Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs' | 'findApplicationByName' | 'createDockerfileApplication' | 'updateApplication' | 'deploy' | 'getApplication' | 'listServers' | 'raw'>;
+/**
+ * The job's script. Idempotent: a role or database that exists is kept, and the role's password is set
+ * to the one given. The password reaches SQL through `\getenv` and `format('%L')`, never through the
+ * shell, and psql's output is discarded so no line carries a URL or a password. `ADMIN_DATABASE_URL`
+ * is the sign-in database's own DSN; for the TLS database the CA is written to the path its
+ * `sslrootcert` names.
+ */
+export declare function brokerDbJobScript(): string[];
+/** The job: the sign-in database's pinned image, so `psql` matches the server's major version. */
+export declare function brokerDbJobDockerfile(): string;
+export interface BrokerMcpInput {
+    coolify: Coolify;
+    brokerAppId: string;
+    /** The job app's Coolify name. */
+    jobName: string;
+    project: {
+        uuid: string;
+        environment: {
+            id: number;
+            name: string;
+            uuid: string;
+        };
+    };
+    /** The sign-in database's own (superuser) DSN. A secret. */
+    adminUrl: string;
+    /** The CA PEM when the database is the TLS image; public. */
+    caPem: string | undefined;
+    /** The broker role's connection string for `password`. A secret. */
+    brokerUrl(password: string): string;
+    runtime: JobRuntime & {
+        onSecret?: (value: string) => void;
+    };
+    label: string;
+}
+/**
+ * The two env entries a broker with `mcp` entries needs, for the caller to write with the rest of the
+ * broker's env. A live value of either is kept (a hand-set one too), so a rerun makes nothing and the
+ * `broker` database job runs only while `MCP_DATABASE_URL` is unset. The secret is minted with
+ * `ensureGeneratedEnv`. The role's password is minted only when the URL is unset; a run that fails after
+ * the job and before the URL is written mints another and the job sets it, since nothing else uses the
+ * old one. Secrets go only to the job's and the broker's env and to `runtime.onSecret`.
+ */
+export declare function ensureBrokerMcpEnv(input: BrokerMcpInput): Promise<Array<{
+    key: string;
+    value: string;
+}>>;
+export {};

package/dist/plan/broker-mcp.js

@@ -0,0 +1,158 @@
+import { randomBytes } from 'node:crypto';
+import { pinnedRef } from '../bootstrap/versions.js';
+import { JobFailure, waitForJob } from './job-app.js';
+import { currentEnvValue, ensureGeneratedEnv, resolvePlatformServer, } from './platform-providers.js';
+import { SIGNIN_DB_CA_MOUNT, boundedCall } from './signin-db.js';
+/**
+ * Auth ADR 0002, sections 2 and 5: a broker whose `AUTH_APPS` holds an entry with `mcp` exits at boot
+ * without `MCP_DATABASE_URL` (a `broker` database on the sign-in Postgres) and `MCP_OAUTH_SECRET`
+ * (`deriveKeys` in `wtfalch/auth` broker/src/mcp-crypto.ts wants at least 32 characters). This file
+ * gives the broker both, from `provisionAuthStack`, before an entry with `mcp` can reach it.
+ */
+export const MCP_DATABASE_URL_ENV = 'MCP_DATABASE_URL';
+export const MCP_OAUTH_SECRET_ENV = 'MCP_OAUTH_SECRET';
+/** The broker's own role and database on the sign-in Postgres. */
+export const BROKER_DB_NAME = 'broker';
+export const BROKER_DB_USER = 'broker';
+/** 32 random bytes as 64 hex characters: twice the 32 characters `deriveKeys` asks for. */
+export const MCP_OAUTH_SECRET_MIN_LENGTH = 32;
+const JOB_ADMIN_ENV = 'ADMIN_DATABASE_URL';
+const JOB_PASSWORD_ENV = 'BROKER_DB_PASSWORD';
+const JOB_CA_ENV = 'SIGNIN_DB_CA_B64';
+const JOB_DONE_FILE = '/tmp/done';
+const JOB_FAILED_FILE = '/tmp/failed';
+/**
+ * The job's script. Idempotent: a role or database that exists is kept, and the role's password is set
+ * to the one given. The password reaches SQL through `\getenv` and `format('%L')`, never through the
+ * shell, and psql's output is discarded so no line carries a URL or a password. `ADMIN_DATABASE_URL`
+ * is the sign-in database's own DSN; for the TLS database the CA is written to the path its
+ * `sslrootcert` names.
+ */
+export function brokerDbJobScript() {
+    return [
+        '#!/bin/sh',
+        'set -eu',
+        `trap '[ -f ${JOB_DONE_FILE} ] || touch ${JOB_FAILED_FILE}' EXIT`,
+        "trap 'exit 1' HUP INT TERM",
+        `[ ! -f ${JOB_FAILED_FILE} ] || exit 1`,
+        `rm -f ${JOB_DONE_FILE}`,
+        'fail() { echo "broker-db: failed"; exit 1; }',
+        `[ -n "\${${JOB_PASSWORD_ENV}:-}" ] || fail`,
+        `if [ -n "\${${JOB_CA_ENV}:-}" ]; then mkdir -p "$(dirname ${SIGNIN_DB_CA_MOUNT})"; printf %s "$${JOB_CA_ENV}" | base64 -d > ${SIGNIN_DB_CA_MOUNT}; fi`,
+        `psql "$${JOB_ADMIN_ENV}" -X -q -v ON_ERROR_STOP=1 > /dev/null 2>&1 <<'SQL' || fail`,
+        `\\getenv pw ${JOB_PASSWORD_ENV}`,
+        `SELECT 'CREATE ROLE ${BROKER_DB_USER} LOGIN' WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${BROKER_DB_USER}') \\gexec`,
+        `SELECT format('ALTER ROLE ${BROKER_DB_USER} PASSWORD %L', :'pw') \\gexec`,
+        `SELECT 'CREATE DATABASE ${BROKER_DB_NAME} OWNER ${BROKER_DB_USER} TEMPLATE template0 ENCODING ''UTF8''' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${BROKER_DB_NAME}') \\gexec`,
+        'SQL',
+        'echo "broker-db: ready"',
+        `touch ${JOB_DONE_FILE}`,
+        'exec sleep infinity',
+    ];
+}
+/** The job: the sign-in database's pinned image, so `psql` matches the server's major version. */
+export function brokerDbJobDockerfile() {
+    const encoded = Buffer.from(`${brokerDbJobScript().join('\n')}\n`, 'utf8').toString('base64');
+    return [
+        `FROM postgres:${pinnedRef('postgres')}`,
+        `RUN echo '${encoded}' | base64 -d > /usr/local/bin/broker-db && chmod 0755 /usr/local/bin/broker-db`,
+        'ENTRYPOINT ["/usr/local/bin/broker-db"]',
+        `HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=1 CMD ["test", "-f", "${JOB_DONE_FILE}"]`,
+    ].join('\n');
+}
+/**
+ * The two env entries a broker with `mcp` entries needs, for the caller to write with the rest of the
+ * broker's env. A live value of either is kept (a hand-set one too), so a rerun makes nothing and the
+ * `broker` database job runs only while `MCP_DATABASE_URL` is unset. The secret is minted with
+ * `ensureGeneratedEnv`. The role's password is minted only when the URL is unset; a run that fails after
+ * the job and before the URL is written mints another and the job sets it, since nothing else uses the
+ * old one. Secrets go only to the job's and the broker's env and to `runtime.onSecret`.
+ */
+export async function ensureBrokerMcpEnv(input) {
+    const { coolify, brokerAppId, runtime } = input;
+    let url = await currentEnvValue(coolify, brokerAppId, MCP_DATABASE_URL_ENV);
+    if (!url) {
+        const password = randomBytes(24).toString('base64url');
+        runtime.onSecret?.(password);
+        await runBrokerDbJob(input, password);
+        url = input.brokerUrl(password);
+    }
+    runtime.onSecret?.(url);
+    const minted = await ensureGeneratedEnv(coolify, brokerAppId, MCP_OAUTH_SECRET_ENV, () => randomBytes(32).toString('hex'), MCP_OAUTH_SECRET_MIN_LENGTH);
+    const secret = minted ?? (await currentEnvValue(coolify, brokerAppId, MCP_OAUTH_SECRET_ENV));
+    if (!secret) {
+        throw new Error(`${input.label}: the broker lost its ${MCP_OAUTH_SECRET_ENV} between two reads`);
+    }
+    runtime.onSecret?.(secret);
+    return [
+        { key: MCP_DATABASE_URL_ENV, value: url },
+        { key: MCP_OAUTH_SECRET_ENV, value: secret },
+    ];
+}
+/** Runs the job once, waits for it, deletes it. Every error is fixed text with the app id, never a cause. */
+async function runBrokerDbJob(input, password) {
+    const { label, runtime } = input;
+    const coolify = input.coolify;
+    const { uuid: projectUuid, environment } = input.project;
+    let jobAppId;
+    try {
+        // A job left by an earlier run holds an old script and password: it is replaced, never reused.
+        const leftover = await boundedCall(coolify.findApplicationByName(input.jobName, { environmentIds: [environment.id] }), 'Coolify findApplicationByName');
+        if (leftover) {
+            await boundedCall(coolify.raw('DELETE', `/applications/${leftover.uuid}`), 'delete the job');
+        }
+        const server = await resolvePlatformServer(coolify);
+        const created = await boundedCall(coolify.createDockerfileApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            dockerfile: brokerDbJobDockerfile(),
+            name: input.jobName,
+            description: `makes the broker's MCP database (auth ADR 0002)`,
+            instant_deploy: false,
+            autogenerate_domain: false,
+        }), 'Coolify createDockerfileApplication');
+        jobAppId = created.uuid;
+        await coolify.updateApplication(jobAppId, { health_check_enabled: false });
+        await coolify.bulkUpsertEnvs(jobAppId, [
+            { key: JOB_ADMIN_ENV, value: input.adminUrl },
+            { key: JOB_PASSWORD_ENV, value: password },
+            ...(input.caPem
+                ? [{ key: JOB_CA_ENV, value: Buffer.from(input.caPem, 'utf8').toString('base64') }]
+                : []),
+        ]);
+        await coolify.deploy(jobAppId, true);
+        await waitForJob(coolify, jobAppId, runtime, {
+            job: "the broker's database job",
+            stopped: "the broker's database job stopped before it finished",
+        });
+    }
+    catch (error) {
+        const why = error instanceof JobFailure ? error.message : 'a Coolify call failed or timed out';
+        let cleaned = '';
+        if (jobAppId) {
+            const id = jobAppId;
+            try {
+                await boundedCall(coolify.raw('POST', `/applications/${id}/stop`), 'stop the job');
+            }
+            catch {
+                cleaned += '; the job app could not be stopped, stop it in Coolify';
+            }
+            try {
+                await boundedCall(coolify.bulkUpsertEnvs(id, [JOB_ADMIN_ENV, JOB_PASSWORD_ENV, JOB_CA_ENV].map((key) => ({ key, value: '' }))), 'clear the job env');
+            }
+            catch {
+                cleaned +=
+                    '; its env could not be cleared, delete the app in Coolify (it holds the admin URL)';
+            }
+        }
+        throw new Error(`${label}: ${why}${jobAppId ? `; the job app ${jobAppId} is left stopped without secrets and the next apply replaces it${cleaned}` : ''}; apply again`);
+    }
+    try {
+        await boundedCall(coolify.raw('DELETE', `/applications/${jobAppId}`), 'delete the job');
+    }
+    catch {
+        throw new Error(`${label}: the broker's database job ran, but its app ${jobAppId} could not be deleted; delete it in Coolify (it holds the admin URL), then apply again`);
+    }
+}

package/dist/plan/diff.d.ts

@@ -270,3 +270,15 @@ export declare const JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY = "jobs_registratio
  * {@link effectiveAiLimitMicros} is the one place that substitutes it.
  */
 export declare const DEFAULT_AI_LIMIT_MICROS = "112250000";
+/**
+ * F5: one broker `AUTH_APPS` entry per entry with `uses.auth`. Idempotent on
+ * the recorded marker of what the last write said (ids, names, origins; never
+ * the key), so a rerun plans nothing. The values it needs come from steps
+ * that run earlier; one that nothing records and no step in this plan will
+ * record blocks it (rule 2). A foreign broker entry the last write found
+ * invalid is listed as a warning: the broker drops it, foundry keeps it.
+ */
+export declare function planBrokerEntries(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], brokerWired: boolean): {
+    steps: DraftStep[];
+    blocked: UnmanagedItem[];
+};

package/dist/plan/diff.js

@@ -3,7 +3,7 @@ import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, held
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { planBlueGreen } from './blue-green.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, customersRoomValue, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
 import { planCompanyBackups } from './company-backups.js';
@@ -28,7 +28,7 @@ import { legacyUnmigrated, orgPostgresUndeliveredScopeKey, planOrgPostgresSteps,
 import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, OWN_SIGNIN_DB_MOVE_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, planSigninDbMove, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
 import { ownHostnames } from './own-hostnames.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSecretAvailability, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSecretAvailability, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutUpdateOwed, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
@@ -3955,7 +3955,7 @@ function planEntryClients(org, byKey, claimed) {
  * record blocks it (rule 2). A foreign broker entry the last write found
  * invalid is listed as a warning: the broker drops it, foundry keeps it.
  */
-function planBrokerEntries(org, recordedIds, plannedSteps, brokerWired) {
+export function planBrokerEntries(org, recordedIds, plannedSteps, brokerWired) {
     const steps = [];
     const blocked = [];
     for (const entry of org.hosting.entries) {
@@ -3978,6 +3978,16 @@ function planBrokerEntries(org, recordedIds, plannedSteps, brokerWired) {
             });
             continue;
         }
+        // Auth ADR 0002: a broker given an `mcp` entry before it holds its database and secret exits at boot.
+        // A company's own sign-in step sets them and records it; a shared org's broker is the platform's, whose
+        // marker this plan cannot see, so `writeBrokerEntry` refuses there until the platform step has run.
+        if (auth.mcp && ownsServices(org) && recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] !== '1') {
+            blocked.push({
+                description: `${at} is blocked, not planned: the broker's MCP database and secret are not set yet (the sign-in step sets them)`,
+                key,
+            });
+            continue;
+        }
         // A Worker app has no Coolify app to hold the broker key: its generated AUTH_APP_KEY
         // is delivered to the Worker first and read back from the held-key store.
         if (entry.workerApp && !brokerKeyDelivered(recordedIds, entry.key)) {
@@ -4102,13 +4112,16 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
     const wantedSignIn = wanted && org.hosting.entries.some((entry) => entry.uses?.auth?.signIn === 'email-code')
         ? 'email-code'
         : '';
+    const room = org.hosting.entries.find((entry) => entry.uses?.auth?.room)?.uses?.auth?.room;
+    const wantedRoom = room ? customersRoomValue(room) : '';
     const blocked = [];
     const customersOrgId = recordedIds[resourceKey('zitadel', 'customers', org.id)];
     if (!customersOrgId) {
         if (!wanted)
             return { step: null, blocked };
         const signIn = wantedSignIn === 'email-code' && metadataWired ? { signIn: wantedSignIn } : {};
-        if (wantedSignIn === 'email-code' && !metadataWired) {
+        const roomDesired = wantedRoom && metadataWired ? { room: wantedRoom } : {};
+        if ((wantedSignIn === 'email-code' || wantedRoom) && !metadataWired) {
             blocked.push(signInMetadataBlocked(org));
         }
         return {
@@ -4117,7 +4130,7 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
                     system: 'zitadel',
                     kind: 'customers',
                     key: org.id,
-                    desired: { signUp, ...signIn },
+                    desired: { signUp, ...signIn, ...roomDesired },
                 },
                 step: {
                     description: `provision a ZITADEL org for ${org.slug}'s customers, with self-registration ${signUp ? 'on' : 'off'}${signIn.signIn ? ' and sign-in by emailed code' : ''}`,
@@ -4141,10 +4154,12 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
     const wantedSignUp = wanted && signUp ? '1' : '0';
     const appliedSignIn = recordedIds[CUSTOMERS_SIGN_IN_SCOPE_KEY] === 'email-code' ? 'email-code' : '';
     const signInDiffers = appliedSignIn !== wantedSignIn;
-    if (signInDiffers && !metadataWired)
+    const roomDiffers = (recordedIds[CUSTOMERS_ROOM_SCOPE_KEY] ?? '') !== wantedRoom;
+    if ((signInDiffers || roomDiffers) && !metadataWired)
         blocked.push(signInMetadataBlocked(org));
     const writeSignIn = signInDiffers && metadataWired;
-    if (applied === wantedSignUp && !writeSignIn)
+    const writeRoom = roomDiffers && metadataWired;
+    if (applied === wantedSignUp && !writeSignIn && !writeRoom)
         return { step: null, blocked };
     return {
         step: {
@@ -4155,11 +4170,14 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
                 desired: {
                     signUp: wantedSignUp === '1',
                     ...(writeSignIn ? { signIn: wantedSignIn } : {}),
+                    ...(writeRoom ? { room: wantedRoom } : {}),
                 },
             },
             step: {
                 description: applied === wantedSignUp
-                    ? `${wantedSignIn ? 'set' : 'remove'} the emailed-code sign-in metadata of ${org.slug}'s customers`
+                    ? writeSignIn
+                        ? `${wantedSignIn ? 'set' : 'remove'} the emailed-code sign-in metadata of ${org.slug}'s customers`
+                        : `${wantedRoom ? 'set' : 'remove'} the sign-in window text of ${org.slug}'s customers`
                     : `turn self-registration ${wantedSignUp === '1' ? 'on' : 'off'} for ${org.slug}'s customers`,
                 destroys: false,
                 migrates: false,

package/dist/plan/executor.d.ts

@@ -2313,6 +2313,13 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * a re-run after a crash finishes the job.
      */
     private zitadelCustomers;
+    /**
+     * `wtfalch.room` on the customers organisation: the planner's value (JSON)
+     * while an entry declares a room, removed when none does. The planner puts
+     * `room` in the step only when the recorded value differs. Returns the value
+     * to record (empty after a removal), or null for no change.
+     */
+    private writeCustomersRoomMetadata;
     /**
      * `wtfalch.signIn = email-code` on the customers organisation while an entry
      * declares it, removed when none does. The planner puts `signIn` in the step

package/dist/plan/executor.js

@@ -10,7 +10,7 @@ import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
 import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, splitServers, } from './blue-green.js';
 import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_ROOM_METADATA_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
@@ -50,7 +50,7 @@ import { LIMITS, limited } from './own-limits.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, scopeFromOrg, } from './own-services.js';
 import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
 import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, orgDeclaresMcp, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutAppliedValue, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
@@ -2487,13 +2487,47 @@ export class FoundryStepExecutor {
         else
             await this.ports.zitadel.closeSelfRegistration(customers.id);
         await this.ports.zitadel.findOrCreateProjectGrant(zitadelOrgId, projectId, customers.id);
-        // The sign-in metadata comes before either marker: a failed write leaves both markers behind, so the next plan repeats the step.
+        // The sign-in and room metadata come before every marker: a failed write leaves both markers behind, so the next plan repeats the step.
         const signIn = await this.writeCustomersSignInMetadata(org, customers.id, action, context);
+        const room = await this.writeCustomersRoomMetadata(org, customers.id, action, context);
         context.recordScopeId(CUSTOMERS_SIGN_UP_SCOPE_KEY, signUp ? '1' : '0');
         if (signIn)
             context.recordScopeId(CUSTOMERS_SIGN_IN_SCOPE_KEY, signIn);
+        if (room !== null)
+            context.recordScopeId(CUSTOMERS_ROOM_SCOPE_KEY, room);
         return { resourceId: customers.id };
     }
+    /**
+     * `wtfalch.room` on the customers organisation: the planner's value (JSON)
+     * while an entry declares a room, removed when none does. The planner puts
+     * `room` in the step only when the recorded value differs. Returns the value
+     * to record (empty after a removal), or null for no change.
+     */
+    async writeCustomersRoomMetadata(org, customersOrgId, action, context) {
+        const want = action.desired.room;
+        if (want === undefined)
+            return null;
+        if (typeof want !== 'string') {
+            throw new Error(`zitadel:customers for ${org.slug}: the planned sign-in window text is invalid`);
+        }
+        const { setOrgMetadata, removeOrgMetadata } = this.ports.zitadel;
+        if (!setOrgMetadata || !removeOrgMetadata) {
+            throw new Error(`zitadel:customers for ${org.slug}: the ZITADEL client cannot set organisation metadata`);
+        }
+        try {
+            if (want !== '') {
+                await setOrgMetadata.call(this.ports.zitadel, customersOrgId, CUSTOMERS_ROOM_METADATA_KEY, want);
+                return want;
+            }
+            if (!context.recordedIds()[CUSTOMERS_ROOM_SCOPE_KEY])
+                return null;
+            await removeOrgMetadata.call(this.ports.zitadel, customersOrgId, CUSTOMERS_ROOM_METADATA_KEY);
+            return '';
+        }
+        catch {
+            throw new Error(`zitadel:customers for ${org.slug}: writing the sign-in window text of organisation ${customersOrgId} failed`);
+        }
+    }
     /**
      * `wtfalch.signIn = email-code` on the customers organisation while an entry
      * declares it, removed when none does. The planner puts `signIn` in the step
@@ -7285,6 +7319,7 @@ export class FoundryStepExecutor {
             // In-app sign-in: the company's own stack gets the second login app. Its host table starts
             // empty; the login-host step writes it once the apps' clients exist.
             ...(inAppSignIn(org) ? { signInLogin: { bindings: null } } : {}),
+            mcp: orgDeclaresMcp(org),
         });
         if (refChanged) {
             const now = scope.recordedIds();

package/dist/plan/own-diff.js

@@ -10,7 +10,7 @@ import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
 import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
 import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
@@ -162,6 +162,9 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_SMTP_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
+        recordedIds[PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY] === AUTH_TUNNEL_ROUTES_VERSION &&
+        // An entry with `mcp` needs the broker's database and secret (auth ADR 0002).
+        (!orgDeclaresMcp(org) || recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] === '1') &&
         (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry) &&
         // In-app sign-in: the second login app is recorded once it is deployed and holds the token, which
         // needs the login client; until the broker holds an entry that cannot be, so the step waits.

package/dist/plan/platform-diff.d.ts

@@ -60,6 +60,22 @@ export declare const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = "auth_z
 export declare const AUTH_ZITADEL_RUN_OPTIONS = "--entrypoint \"/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external\"";
 /** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
 export declare const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = "zitadel_platform_auth_run_options_applied";
+/**
+ * The version of the sign-in tunnel's path rules (`provisionAuthStack`). Raise it when a rule
+ * changes, so an applied sign-in plans its step once more and the tunnel is written again.
+ * 2: the broker's MCP authorization paths (auth ADR 0002).
+ */
+export declare const AUTH_TUNNEL_ROUTES_VERSION = "2";
+/** The {@link AUTH_TUNNEL_ROUTES_VERSION} the sign-in tunnel was last written with. */
+export declare const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = "auth_tunnel_routes_applied";
+/**
+ * `'1'` once the broker holds `MCP_DATABASE_URL` and `MCP_OAUTH_SECRET` (auth ADR 0002), recorded by the
+ * sign-in step when an entry of that broker declares `uses.auth.mcp`. A broker entry with `mcp` is not
+ * written before it, and an applied sign-in that wants it and lacks it plans its step again.
+ */
+export declare const PLATFORM_AUTH_MCP_SCOPE_KEY = "auth_mcp_env_applied";
+/** True when a hosting entry of the org declares `uses.auth.mcp`: its broker needs the MCP database and secret. */
+export declare function orgDeclaresMcp(org: Pick<DeclaredOrg, 'hosting'>): boolean;
 /**
  * The `gitRef` the platform's login, in-app login and broker apps were last built from (value: the ref). A
  * different declared ref plans the auth step again: it patches `git_branch` on those three apps and

package/dist/plan/platform-diff.js

@@ -65,6 +65,24 @@ export const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = 'auth_zitadel_a
 export const AUTH_ZITADEL_RUN_OPTIONS = '--entrypoint "/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external"';
 /** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
 export const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = 'zitadel_platform_auth_run_options_applied';
+/**
+ * The version of the sign-in tunnel's path rules (`provisionAuthStack`). Raise it when a rule
+ * changes, so an applied sign-in plans its step once more and the tunnel is written again.
+ * 2: the broker's MCP authorization paths (auth ADR 0002).
+ */
+export const AUTH_TUNNEL_ROUTES_VERSION = '2';
+/** The {@link AUTH_TUNNEL_ROUTES_VERSION} the sign-in tunnel was last written with. */
+export const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = 'auth_tunnel_routes_applied';
+/**
+ * `'1'` once the broker holds `MCP_DATABASE_URL` and `MCP_OAUTH_SECRET` (auth ADR 0002), recorded by the
+ * sign-in step when an entry of that broker declares `uses.auth.mcp`. A broker entry with `mcp` is not
+ * written before it, and an applied sign-in that wants it and lacks it plans its step again.
+ */
+export const PLATFORM_AUTH_MCP_SCOPE_KEY = 'auth_mcp_env_applied';
+/** True when a hosting entry of the org declares `uses.auth.mcp`: its broker needs the MCP database and secret. */
+export function orgDeclaresMcp(org) {
+    return org.hosting.enabled && org.hosting.entries.some((e) => Boolean(e.uses?.auth?.mcp));
+}
 /**
  * The `gitRef` the platform's login, in-app login and broker apps were last built from (value: the ref). A
  * different declared ref plans the auth step again: it patches `git_branch` on those three apps and
@@ -2127,6 +2145,7 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
         // The ZITADEL run options reach the container only through the auth
         // step's redeploy, so a platform recorded before them still plans it.
         recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
+        recordedIds[PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY] === AUTH_TUNNEL_ROUTES_VERSION &&
         recordedIds[PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY] === platform.auth.gitRef) {
         return { step: null, blocked: standingNote };
     }

package/dist/plan/platform-providers.d.ts

@@ -432,6 +432,11 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
      * (or the runner was never applied).
      */
     refreshFilesShare(_platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<Record<string, string> | null>;
+    /**
+     * True while a shared org declares `uses.auth.mcp`: its entry goes to the platform's broker, which then
+     * needs the MCP database and secret (auth ADR 0002). An own org's entry goes to its own broker.
+     */
+    private mcpWanted;
     /** True while a company signs in on its apps' own addresses through the platform's login. */
     private signInLoginWanted;
     /**
@@ -510,6 +515,11 @@ export declare const AUTH_LOGIN_PORT = "3000";
  * everything else, including the root).
  */
 export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
+/**
+ * The broker's MCP authorization server (auth ADR 0002): its metadata and `/mcp-oauth/*`.
+ * Checked before {@link AUTH_ZITADEL_PATH_PATTERN}, which takes every other `/.well-known` path.
+ */
+export declare const AUTH_BROKER_MCP_PATH_PATTERN = "^/(\\.well-known/oauth-authorization-server|mcp-oauth/.+)$";
 export declare const PLATFORM_AUTH_DB_SCOPE_KEY = "coolify_platform_auth_database";
 export declare const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = "coolify_platform_auth_zitadel_app";
 export declare const PLATFORM_AUTH_LOGIN_SCOPE_KEY = "coolify_platform_auth_login_app";
@@ -549,6 +559,11 @@ export interface AuthStackInput {
     signInLogin?: {
         bindings: string | null;
     };
+    /**
+     * An entry of this stack's broker declares `uses.auth.mcp` (auth ADR 0002): the broker needs a `broker`
+     * database on the sign-in Postgres and `MCP_OAUTH_SECRET` before that entry reaches it. Absent: neither.
+     */
+    mcp?: boolean;
 }
 /**
  * #168: makes `coolify:app` keyed {@link PLATFORM_AUTH_KEY} true -- a Coolify
@@ -1312,6 +1327,33 @@ export declare function envsDiffer(coolify: Pick<CoolifyPort, 'listEnvs'>, appId
     key: string;
     value: string;
 }>): Promise<boolean>;
+/**
+ * `null` once the app already has this key set -- generated only the first
+ * time, never regenerated or overwritten, mirroring `executor.ts`'s
+ * `ensureAuthCookieSecret` exactly. #211 round 4: `''`, `null` and
+ * `undefined` all count as not set, the same "missing" a live Coolify
+ * response can carry despite its declared `string` type
+ * (`CoolifyPort.listEnvs`'s own doc comment) -- an entry present with one of
+ * those values used to read as "already has this key set" and return `null`,
+ * so a caller reading the value back afterwards (`provisionPlatformArchon`'s
+ * own `AUTH_APP_KEY`) threw "lost its ... between two reads" on every single
+ * apply instead of regenerating it.
+ *
+ * #211 round 5: `minLength`, when given, also counts a *present, non-empty*
+ * value shorter than it as not set -- the broker's own `parseApps`
+ * (`wtfalch/auth/broker/src/apps.ts`) refuses a `key` under 32 characters,
+ * and this package minted a 32-character `AUTH_APP_KEY` from the start
+ * (`provisionPlatformArchon`'s own comment on `randomBytes(32)`), so this
+ * only ever changes behaviour for a key that reached the app some other way
+ * -- a hand-set value, or one carried over from before that guarantee held.
+ * Optional, and unused by every other call site (`ensureMasterkey`,
+ * `ZITADEL_ADMIN_PASSWORD`, `AUTH_COOKIE_SECRET`, this file's recovery admin
+ * password): none of those have a broker-enforced minimum, so widening this
+ * check to them would reject a value that has always been fine.
+ */
+export declare function ensureGeneratedEnv(coolify: Pick<CoolifyPort, 'listEnvs'>, appId: string, key: string, generate: () => string, minLength?: number): Promise<string | null>;
+/** The live value of `key` on `appId`, or `undefined` when unset -- `ensureGeneratedEnv`'s read half, for a caller that needs the value it already found. */
+export declare function currentEnvValue(coolify: Pick<CoolifyPort, 'listEnvs'>, appId: string, key: string): Promise<string | undefined>;
 /**
  * #171: everything {@link provisionPlatformFiles} needs beyond
  * {@link PlatformStepExecutionContext}, bundled for the same reason as

package/dist/plan/platform-providers.js

@@ -3,7 +3,7 @@ import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
 import { VERSIONS, coolifyImageFor, floatingTagBlocked, pinnedRef } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
-import { ownerMailboxes, sharedSecretRef, } from '../org.js';
+import { ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { applyArchonBlueGreen } from './archon-blue-green.js';
 import { ARCHON_REPO, archonSubject, healthTokenName, tunnelOriginFor, } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
@@ -21,6 +21,7 @@ import { LIMITS, limited } from './own-limits.js';
 import { postLogoutAppliedValue, postLogoutUrisFor } from './post-logout-uris.js';
 import { createReleaseHost } from './release-host.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+import { BROKER_DB_NAME, BROKER_DB_USER, ensureBrokerMcpEnv } from './broker-mcp.js';
 import { SIGN_IN_BIND_KEY_ENV, SIGN_IN_BIND_KEY_MIN_LENGTH, SIGN_IN_BIND_KEY_SCOPE_KEY, } from './cookie-domain.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
@@ -28,13 +29,13 @@ import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAI
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, orgDeclaresMcp, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
 import { LOGIN_HOST_BINDINGS_ENV } from './sign-in-bindings.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_BUILD_ARG_ENV, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppOnSharedLogin, signInLoginNames, signInUpstream, } from './sign-in.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
-import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
+import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, signinDbDsn, waitHealthy, withCallTimeout, } from './signin-db.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { githubReleaseHookPlanInputs, provisionGithubReleaseHook, } from './github-release-hook.js';
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
@@ -723,7 +724,11 @@ export class FoundryPlatformStepExecutor {
         }
         if (platform.auth.enabled && this.auth) {
             const loginClientDrifted = await authLoginClientDrifted(platform, this.auth, recordedIds);
-            if (loginClientDrifted || (await this.signInLoginDrifted(this.auth, recordedIds))) {
+            // The broker lacks the MCP database and secret a shared org's entry needs (auth ADR 0002).
+            const mcpDrifted = recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] !== '1' && (await this.mcpWanted());
+            if (loginClientDrifted ||
+                mcpDrifted ||
+                (await this.signInLoginDrifted(this.auth, recordedIds))) {
                 result.auth = true;
             }
             if (await authAppsNotRunning(this.auth.coolify, recordedIds))
@@ -785,6 +790,13 @@ export class FoundryPlatformStepExecutor {
         await coolify.deploy(runnerAppId);
         return { [PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY]: normalHosts(wanted).join(',') };
     }
+    /**
+     * True while a shared org declares `uses.auth.mcp`: its entry goes to the platform's broker, which then
+     * needs the MCP database and secret (auth ADR 0002). An own org's entry goes to its own broker.
+     */
+    async mcpWanted() {
+        return (await this.declaredOrgStore.list()).some((org) => !ownsServices(org) && orgDeclaresMcp(org));
+    }
     /** True while a company signs in on its apps' own addresses through the platform's login. */
     async signInLoginWanted() {
         return (await this.declaredOrgStore.list()).some(inAppOnSharedLogin);
@@ -826,7 +838,11 @@ export class FoundryPlatformStepExecutor {
                 throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
             }
             const company = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), { ownerCompany: company, signInLogin: await this.signInLoginWanted() });
+            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), {
+                ownerCompany: company,
+                signInLogin: await this.signInLoginWanted(),
+                mcp: await this.mcpWanted(),
+            });
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_FILES_KEY) {
             if (!this.files) {
@@ -1317,6 +1333,11 @@ export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|sy
  * than folded into it.
  */
 const AUTH_BROKER_PATH_PATTERN = '^/api(/|$)';
+/**
+ * The broker's MCP authorization server (auth ADR 0002): its metadata and `/mcp-oauth/*`.
+ * Checked before {@link AUTH_ZITADEL_PATH_PATTERN}, which takes every other `/.well-known` path.
+ */
+export const AUTH_BROKER_MCP_PATH_PATTERN = '^/(\\.well-known/oauth-authorization-server|mcp-oauth/.+)$';
 const PLATFORM_AUTH_PROJECT_SCOPE_KEY = 'coolify_project_platform_auth';
 export const PLATFORM_AUTH_DB_SCOPE_KEY = 'coolify_platform_auth_database';
 export const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = 'coolify_platform_auth_zitadel_app';
@@ -1666,6 +1687,8 @@ export async function provisionAuthStack(scope, deps, target, input) {
         recorded[PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY]);
     let databaseUrl;
     let signinDbCa;
+    /** The broker role's connection string on the sign-in Postgres, for a password (auth ADR 0002). */
+    let brokerMcpUrl;
     if (tlsDatabase) {
         const provisioned = await provisionSigninDb({
             coolify: deps.coolify,
@@ -1691,6 +1714,10 @@ export async function provisionAuthStack(scope, deps, target, input) {
         });
         databaseUrl = provisioned.dsn;
         signinDbCa = provisioned.ca;
+        brokerMcpUrl = (password) => signinDbDsn(target.internal.signinDb, password, {
+            user: BROKER_DB_USER,
+            database: BROKER_DB_NAME,
+        });
         await record(SIGNIN_DB_TLS_SCOPE_KEY, provisioned.appId);
     }
     else {
@@ -1717,6 +1744,14 @@ export async function provisionAuthStack(scope, deps, target, input) {
             throw new Error(`coolify:app for ${subject} (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
         databaseUrl = db.internal_db_url;
+        const legacyUrl = db.internal_db_url;
+        brokerMcpUrl = (password) => {
+            const url = new URL(legacyUrl);
+            url.username = BROKER_DB_USER;
+            url.password = password;
+            url.pathname = `/${BROKER_DB_NAME}`;
+            return url.toString();
+        };
     }
     // ---- the ZITADEL app itself ---------------------------------------------
     const zitadelApp = await findOrCreatePlatformApp(deps.coolify, target.names.authZitadel, environment, async () => {
@@ -1953,7 +1988,26 @@ export async function provisionAuthStack(scope, deps, target, input) {
     // is, once held (#210): pushing it costs nothing even while the broker
     // still cannot start on the other two, and the deploy decision below stays
     // gated on `missingBrokerInputs` regardless.
+    // Auth ADR 0002: a broker with an `mcp` entry exits without a `broker` database and `MCP_OAUTH_SECRET`, so
+    // both are set here, before such an entry is written (`writeBrokerEntry` refuses until they are live).
+    let mcpEnvs = [];
+    if (input.mcp) {
+        mcpEnvs = await ensureBrokerMcpEnv({
+            coolify: deps.coolify,
+            brokerAppId,
+            jobName: `${target.names.authBroker}-mcp-db-job`,
+            project: { uuid: projectUuid, environment },
+            adminUrl: databaseUrl,
+            caPem: signinDbCa,
+            brokerUrl: brokerMcpUrl,
+            runtime,
+            label,
+        });
+        if (signinDbCa)
+            await ensureSigninDbCaFile(deps.coolify, brokerAppId, signinDbCa, label);
+    }
     const brokerEnvs = [
+        ...mcpEnvs,
         {
             key: 'ZITADEL_API_URL',
             value: `http://${target.internal.authZitadel}:${AUTH_ZITADEL_PORT}`,
@@ -2057,6 +2111,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
         await deps.coolify.deploy(brokerAppId);
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, authAppsRaw));
     }
+    // The env is live on the broker (and deployed when it changed): the entry write may now carry `mcp`.
+    if (input.mcp)
+        await record(PLATFORM_AUTH_MCP_SCOPE_KEY, '1');
     // ---- tunnel and DNS ------------------------------------------------------
     const tunnels = await network.tunnels();
     const existingTunnel = await tunnels.findTunnelByName(target.names.authTunnel);
@@ -2064,6 +2121,11 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await record(PLATFORM_AUTH_TUNNEL_SCOPE_KEY, tunnel.id);
     await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
+            {
+                hostname,
+                path: AUTH_BROKER_MCP_PATH_PATTERN,
+                service: `http://${target.internal.authBroker}:${AUTH_BROKER_PORT}`,
+            },
             {
                 hostname,
                 path: AUTH_ZITADEL_PATH_PATTERN,
@@ -2081,6 +2143,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
             { service: 'http_status:404' },
         ],
     });
+    await record(PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, AUTH_TUNNEL_ROUTES_VERSION);
     // ---- cloudflared connector for the tunnel above (#197) --------------------
     // Without this, `hostname` resolves to a tunnel nothing is dialed into and
     // answers with a Cloudflare error -- the known gap #197 closes for this
@@ -2551,7 +2614,7 @@ const platformAuthProject = {
 };
 /** The platform's sign-in: {@link provisionAuthStack} with {@link platformTarget} and the platform's own inputs. */
 async function provisionPlatformAuth(context, deps, options = {}) {
-    const { ownerCompany = null, signInLogin = false } = options;
+    const { ownerCompany = null, signInLogin = false, mcp = false } = options;
     const { platform } = context;
     const scope = scopeFromPlatform(context);
     return provisionAuthStack(scope, deps, platformTarget(), {
@@ -2565,6 +2628,7 @@ async function provisionPlatformAuth(context, deps, options = {}) {
         ownerCompany,
         // In-app sign-in: the second login app copies the login's host table (the host's port writes that).
         ...(signInLogin ? { signInLogin: { bindings: null } } : {}),
+        mcp,
     });
 }
 /**
@@ -7177,7 +7241,7 @@ export async function envsDiffer(coolify, appId, desired) {
  * password): none of those have a broker-enforced minimum, so widening this
  * check to them would reject a value that has always been fine.
  */
-async function ensureGeneratedEnv(coolify, appId, key, generate, minLength) {
+export async function ensureGeneratedEnv(coolify, appId, key, generate, minLength) {
     const envs = await coolify.listEnvs(appId);
     const entry = envs.find((e) => e.key === key && !e.is_preview);
     const already = entry !== undefined &&
@@ -7189,7 +7253,7 @@ async function ensureGeneratedEnv(coolify, appId, key, generate, minLength) {
     return generate();
 }
 /** The live value of `key` on `appId`, or `undefined` when unset -- `ensureGeneratedEnv`'s read half, for a caller that needs the value it already found. */
-async function currentEnvValue(coolify, appId, key) {
+export async function currentEnvValue(coolify, appId, key) {
     const envs = await coolify.listEnvs(appId);
     return envs.find((e) => e.key === key && !e.is_preview)?.value;
 }

package/dist/plan/worker-app.d.ts

@@ -105,6 +105,8 @@ export interface WorkerAppUpload {
     bindings: WorkerAppBinding[];
     /** Only the migrations not yet applied; absent when there are none. */
     migrations?: WorkerAppMigrations;
+    /** Durable Object classes the upload marks container-enabled; absent when the entry declares no container. */
+    containers?: string[];
 }
 export interface WorkerAppContainer {
     className: string;
@@ -299,7 +301,7 @@ export interface WorkerAppDeps {
 export declare const WORKER_APP_CALL_TIMEOUT_MS = 120000;
 export declare const WORKER_APP_KEYS_DELIVERY_ATTEMPTS = 3;
 /**
- * Races `task` against a timer. An error names the call, never the cause.
+ * Races `task` against a timer. An error names the call and edge's error code, never the cause.
  */
 export declare function withCallTimeout<T>(ms: number, label: string, task: () => Promise<T>): Promise<T>;
 /**

package/dist/plan/worker-app.js

@@ -400,7 +400,7 @@ export function planWorkerApps(org, recordedIds, input) {
 export const WORKER_APP_CALL_TIMEOUT_MS = 120_000;
 export const WORKER_APP_KEYS_DELIVERY_ATTEMPTS = 3;
 /**
- * Races `task` against a timer. An error names the call, never the cause.
+ * Races `task` against a timer. An error names the call and edge's error code, never the cause.
  */
 export function withCallTimeout(ms, label, task) {
     return new Promise((resolve, reject) => {
@@ -411,11 +411,15 @@ export function withCallTimeout(ms, label, task) {
         }, (error) => {
             clearTimeout(timer);
             // The cause is dropped: a provider error can echo a request body. The
-            // HTTP status stays, because callers tell "already gone" by it.
-            const failure = new Error(`${label} failed`);
-            const status = error?.status;
+            // HTTP status stays, because callers tell "already gone" by it. So does
+            // edge's error code (a fixed lower-case enum, never a secret), to say why.
+            const { status, code } = (error ?? {});
+            const known = typeof code === 'string' && /^[a-z_]{1,40}$/.test(code) ? code : undefined;
+            const failure = new Error(known ? `${label} failed (${known})` : `${label} failed`);
             if (typeof status === 'number')
                 failure.status = status;
+            if (known)
+                failure.code = known;
             reject(failure);
         });
     });
@@ -523,6 +527,9 @@ export async function applyWorkerApp(deps, org, action, context) {
                 : []),
         ],
         ...(migrations ? { migrations } : {}),
+        ...(want.containers.length > 0
+            ? { containers: want.containers.map((c) => c.className) }
+            : {}),
     }));
     context.recordScopeId(workerAppTagsScopeKey(entryKey), JSON.stringify(declaredTags));
     await context.persistScopeIds();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.52.1",
+  "version": "0.54.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",