@wtfalch/foundry 0.70.1 → 0.72.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingGithub, BlueGreenConfig, OrgBuiltinApp, BouleApp, KosmosApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, EntryWorkspace, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingGithub, BlueGreenConfig, OrgBuiltinApp, BouleApp, KosmosApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, SecondFactorMode, SignInMethod, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, EntryWorkspace, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
 export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
@@ -25,6 +25,8 @@ export { createPostgresAuditLog } from './store/audit.js';
 export type { Color, ReleaseAction, ReleaseEvent, ReleaseEventKind, ReleaseSeries, ReleaseSeriesColor, ReleaseSignal, ReleaseState, WindowState, } from './release/types.js';
 export type { ReleaseStore } from './release/state.js';
 export { readReleaseHistory, readReleaseState, requestReleaseAction } from './release/state.js';
+export type { BuiltinFanOut, FanOutApp, FanOutOrgState } from './release/fanout.js';
+export { readBuiltinFanOut } from './release/fanout.js';
 export type { ReleaseSeriesHost, ReleaseSeriesQuery } from './release/series.js';
 export { readReleaseSeries } from './release/series.js';
 export type { EntrySeriesDeps } from './plan/release-series-reader.js';

package/dist/index.js

@@ -15,6 +15,7 @@ export { StaleLeaseError } from './store.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
 export { readReleaseHistory, readReleaseState, requestReleaseAction } from './release/state.js';
+export { readBuiltinFanOut } from './release/fanout.js';
 export { readReleaseSeries } from './release/series.js';
 export { readEntryReleaseSeries } from './plan/release-series-reader.js';
 export { checkMigrationCompatibility } from './release/migration-compatibility.js';

package/dist/modules/sign-in.js

@@ -69,15 +69,53 @@ export const signIn = {
                 ],
             },
             {
-                key: 'method',
+                key: 'methods',
                 label: 'How people sign in',
+                help: 'Pick one or more; people choose among them. With none picked, people sign in with a password.',
+                kind: 'list',
+                max: 3,
+                choices: [
+                    { value: 'email-code', label: 'A code sent by email', help: 'No password to remember.' },
+                    { value: 'password', label: 'A password' },
+                    {
+                        value: 'passkey',
+                        label: 'A passkey',
+                        help: 'Sign in with a fingerprint, face or device lock. Pair it with a code or a password, so people can set it up and get back in.',
+                    },
+                ],
+            },
+            {
+                key: 'secondFactor',
+                label: 'A second step after sign-in',
+                help: 'An authenticator app or a security key. A passkey that checks the person already counts.',
                 kind: 'choice',
                 required: true,
-                default: 'password',
+                default: 'off',
+                showWhen: forCustomers,
                 choices: [
-                    { value: 'email-code', label: 'A code sent by email', help: 'No password to remember.' },
+                    { value: 'off', label: 'No second step', help: 'People sign in with the methods above.' },
+                    {
+                        value: 'allowed',
+                        label: 'Offer it',
+                        help: 'People who set up a second step are asked for it.',
+                    },
+                    {
+                        value: 'required',
+                        label: 'Everyone',
+                        help: 'We help each person set one up the first time they sign in.',
+                    },
+                ],
+            },
+            {
+                key: 'method',
+                label: 'How people sign in (older setting)',
+                help: 'Replaced by "How people sign in". Kept so manifests written before it still work.',
+                kind: 'choice',
+                hidden: true,
+                choices: [
+                    { value: 'email-code', label: 'A code sent by email' },
                     { value: 'password', label: 'A password' },
-                    { value: 'passkey', label: 'A passkey', soon: true },
+                    { value: 'passkey', label: 'A passkey' },
                 ],
             },
             roomField('roomName', 'Name on the sign-in page', 'The name of your app or company, as people know it.'),
@@ -107,8 +145,23 @@ export const signIn = {
         if (!customers && values.registration === 'open') {
             return problem('registration', 'Only customers can make their own account. For your team, choose "Only people you invite".');
         }
-        if (!customers && values.method === 'email-code') {
-            return problem('method', 'A code by email is for customers. Your team signs in with a password.');
+        if (Array.isArray(values.methods) && values.methods.length === 0) {
+            return problem('methods', 'Pick at least one way for people to sign in.');
+        }
+        const methods = methodsOf(values);
+        if (values.method !== undefined && values.methods !== undefined && !sameMethods(values)) {
+            return problem('methods', 'Sign-in is set twice with different answers. Use only "How people sign in".');
+        }
+        if (!customers && (methods.length !== 1 || methods[0] !== 'password')) {
+            return problem('methods', methods.includes('email-code')
+                ? 'A code by email is for customers. Your team signs in with a password.'
+                : 'Your team signs in with a password.');
+        }
+        if (!customers && values.secondFactor !== undefined && values.secondFactor !== 'off') {
+            return problem('secondFactor', 'The second step for your team is set for the whole company, not per app.');
+        }
+        if (methods.length === 1 && methods[0] === 'passkey') {
+            return problem('methods', 'A passkey works together with another way in. Add a code by email or a password, so people can set up the passkey and get back in.');
         }
         const roomSet = [...Object.keys(ROOM_TEXT_KEYS), 'roomSteps'].some((key) => values[key] !== undefined && values[key] !== '');
         if (!roomSet)
@@ -141,14 +194,21 @@ export const signIn = {
             return withWorkerApp(next, (app) => omit(app, 'authEnv'));
         }
         // The parts other modules own (mcp, workspaces) and the operator's replacesBrokerEntry stay.
-        const kept = omit(entry.uses?.auth ?? {}, 'signIn', 'room');
+        const kept = omit(entry.uses?.auth ?? {}, 'signIn', 'signIns', 'secondFactor', 'room');
         const auth = {
             ...kept,
             users: values.users,
             registration: values.registration,
         };
-        if (values.method === 'email-code')
+        const methods = methodsOf(values);
+        if (methods.includes('email-code'))
             auth.signIn = 'email-code';
+        // One method is already what `signIn` says (or password by default), so only a mix is written.
+        if (methods.length > 1 || methods[0] === 'passkey')
+            auth.signIns = methods;
+        const secondFactor = values.secondFactor;
+        if (secondFactor !== undefined && secondFactor !== 'off')
+            auth.secondFactor = secondFactor;
         const room = roomOf(values);
         if (room)
             auth.room = room;
@@ -162,7 +222,8 @@ export const signIn = {
         const values = {
             users: auth.users,
             registration: auth.registration,
-            method: auth.signIn ?? 'password',
+            methods: auth.signIns ?? [auth.signIn ?? 'password'],
+            secondFactor: auth.secondFactor ?? 'off',
         };
         const room = auth.room;
         if (room) {
@@ -178,6 +239,17 @@ export const signIn = {
         return values;
     },
 };
+/** The methods the values name: `methods`, else the older single `method`, else password. */
+function methodsOf(values) {
+    if (Array.isArray(values.methods) && values.methods.length > 0) {
+        return values.methods;
+    }
+    return [values.method ?? 'password'];
+}
+const sameMethods = (values) => {
+    const methods = values.methods;
+    return methods.length === 1 && methods[0] === values.method;
+};
 function roomOf(values) {
     const name = text(values, 'roomName');
     const headline = text(values, 'roomHeadline');

package/dist/modules/types.d.ts

@@ -21,6 +21,8 @@ export interface ModuleField {
     /** For `choice`: the one value picked. For `list`: every item must be one of them. */
     choices?: ModuleChoice[];
     default?: string | number | boolean | string[];
+    /** Accepted but not shown: a setting an older manifest may still carry. */
+    hidden?: boolean;
     /** Shown under "Advanced". */
     advanced?: boolean;
     /**

package/dist/org.d.ts

@@ -301,7 +301,7 @@ export type AccessRule = {
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /** Why a validator refused. `code` is stable and never reworded; `message` is for people. */
-export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'issuer_app_name_reserved_kosmos' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'entry_image_invalid' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'hosting_repo_invalid' | 'hosting_github_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'hosted_name_invalid' | 'hosted_name_not_unique' | 'hosted_name_worker_app' | 'entry_workspace_invalid' | 'entry_workspace_unsupported' | 'entry_live_needs_workspace' | 'entry_live_commit_invalid' | 'gate_key_taken_by_workspace' | 'gate_key_taken_by_private_page' | 'private_page_invalid' | 'private_page_path_invalid' | 'private_page_duplicate' | 'private_page_limit' | 'private_page_needs_hosting' | 'private_page_roles_invalid' | 'private_page_people_invalid' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'blue_green_advance_invalid' | 'blue_green_min_requests_invalid' | 'blue_green_error_margin_invalid' | 'blue_green_staff_first_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'mcp_events_path_invalid' | 'mcp_manage_path_invalid' | 'auth_sign_in_invalid' | 'email_code_needs_customers' | 'auth_room_invalid' | 'auth_room_needs_customers' | 'auth_room_not_unique' | 'client_name_taken' | 'workspaces_needs_customers' | 'workspaces_needs_server' | 'workspaces_roles_invalid' | 'workspaces_role_reserved' | 'workspaces_invite_path_invalid' | 'workspaces_env_clash' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_needs_own_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'mail_not_true' | 'mail_needs_hosting' | 'mail_env_clash' | 'jobs_not_true' | 'jobs_needs_hosting' | 'jobs_env_clash' | 'analytics_not_true' | 'analytics_needs_hosting' | 'analytics_env_clash' | 'customer_grants_not_true' | 'customer_grants_needs_customers' | 'customer_grants_env_clash' | 'repo_use_invalid' | 'repo_use_needs_repo' | 'repo_use_env_clash' | 'audit_not_true' | 'audit_needs_hosting' | 'audit_needs_worker_database' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
+export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'issuer_app_name_reserved_kosmos' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'entry_image_invalid' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'hosting_repo_invalid' | 'hosting_github_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'hosted_name_invalid' | 'hosted_name_not_unique' | 'hosted_name_worker_app' | 'entry_workspace_invalid' | 'entry_workspace_unsupported' | 'entry_live_needs_workspace' | 'entry_live_commit_invalid' | 'gate_key_taken_by_workspace' | 'gate_key_taken_by_private_page' | 'private_page_invalid' | 'private_page_path_invalid' | 'private_page_duplicate' | 'private_page_limit' | 'private_page_needs_hosting' | 'private_page_roles_invalid' | 'private_page_people_invalid' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'blue_green_advance_invalid' | 'blue_green_min_requests_invalid' | 'blue_green_error_margin_invalid' | 'blue_green_staff_first_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'mcp_events_path_invalid' | 'mcp_manage_path_invalid' | 'auth_sign_in_invalid' | 'auth_sign_ins_invalid' | 'auth_second_factor_invalid' | 'sign_in_staff_password_only' | 'passkey_needs_another_method' | 'email_code_needs_customers' | 'email_code_needs_sign_in' | 'auth_room_invalid' | 'auth_room_needs_customers' | 'auth_room_not_unique' | 'client_name_taken' | 'workspaces_needs_customers' | 'workspaces_needs_server' | 'workspaces_roles_invalid' | 'workspaces_role_reserved' | 'workspaces_invite_path_invalid' | 'workspaces_env_clash' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_needs_own_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'mail_not_true' | 'mail_needs_hosting' | 'mail_env_clash' | 'jobs_not_true' | 'jobs_needs_hosting' | 'jobs_env_clash' | 'analytics_not_true' | 'analytics_needs_hosting' | 'analytics_env_clash' | 'customer_grants_not_true' | 'customer_grants_needs_customers' | 'customer_grants_env_clash' | 'repo_use_invalid' | 'repo_use_needs_repo' | 'repo_use_env_clash' | 'audit_not_true' | 'audit_needs_hosting' | 'audit_needs_worker_database' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
 /**
  * One refusal: a stable `code`, the dotted `path` into {@link DeclaredOrg} it is about
  * (`hosting.entries.terminal.uses.auth.registration`) and the sentence for people.
@@ -641,6 +641,19 @@ export interface EntryAuth {
      * `users: 'customers'`.
      */
     signIn?: 'password' | 'email-code';
+    /**
+     * The ways this app lets people sign in: one to three of `email-code`, `password` and `passkey`, no
+     * repeats. Absent means `signIn`, or `password`. `passkey` needs another method beside it, because a
+     * first passkey and its recovery both go through an emailed code or a password. A staff entry
+     * (`users: 'staff'`) may only have `['password']`. When both are set, `signIn` must be one of them.
+     */
+    signIns?: SignInMethod[];
+    /**
+     * Whether the app asks for a second step (an authenticator app or a security key): `off` (the default),
+     * `allowed` (asked of people who set one up) or `required`. A user-verified passkey counts as the second
+     * step. Staff entries may only have `off`: staff 2FA belongs to the company login policy.
+     */
+    secondFactor?: SecondFactorMode;
     /**
      * The entry's own customers get workspaces in the broker: they make one, invite people by email and give
      * each member one of `roles`. The first role is the owner role. `invitePath` is the page on the entry's
@@ -659,6 +672,10 @@ export interface EntryAuth {
      */
     room?: EntryAuthRoom;
 }
+export type SignInMethod = 'email-code' | 'password' | 'passkey';
+export declare const SIGN_IN_METHODS: readonly SignInMethod[];
+export type SecondFactorMode = 'off' | 'allowed' | 'required';
+export declare const SECOND_FACTOR_MODES: readonly SecondFactorMode[];
 /** The env names `uses.auth.workspaces` writes; `env` may not name them. */
 export declare const WORKSPACES_ENTRY_ENV_NAMES: readonly ["WORKSPACES_URL", "WORKSPACES_API_KEY"];
 export interface EntryAuthRoom {

package/dist/org.js

@@ -55,6 +55,8 @@ export function withNewOrgAppsDefault(org) {
 export const kosmosOn = (org) => org.kosmos?.enabled === true;
 /** The most volumes one entry may declare. */
 export const MAX_ENTRY_VOLUMES = 8;
+export const SIGN_IN_METHODS = ['email-code', 'password', 'passkey'];
+export const SECOND_FACTOR_MODES = ['off', 'allowed', 'required'];
 /** The env names `uses.auth.workspaces` writes; `env` may not name them. */
 export const WORKSPACES_ENTRY_ENV_NAMES = ['WORKSPACES_URL', 'WORKSPACES_API_KEY'];
 /** The env names `uses.ai` writes; `env` may not name them. */
@@ -971,6 +973,44 @@ function validateEntryAuth(entry, hosting, domain) {
     if (signIn !== undefined && signIn !== 'password' && signIn !== 'email-code') {
         return refusal('auth_sign_in_invalid', `hosting.entries.${entry.key}.uses.auth.signIn`, `${at} signIn must be 'password' or 'email-code'`);
     }
+    const signIns = auth.signIns;
+    const signInsAt = `hosting.entries.${entry.key}.uses.auth.signIns`;
+    if (signIns !== undefined) {
+        if (!Array.isArray(signIns) ||
+            signIns.length < 1 ||
+            signIns.length > SIGN_IN_METHODS.length ||
+            !signIns.every((m) => SIGN_IN_METHODS.includes(m)) ||
+            new Set(signIns).size !== signIns.length) {
+            return refusal('auth_sign_ins_invalid', signInsAt, `${at} signIns must list one to three different methods of 'email-code', 'password' and 'passkey'`);
+        }
+        const methods = signIns;
+        if (signIn !== undefined && !methods.includes(signIn)) {
+            return refusal('auth_sign_ins_invalid', signInsAt, `${at} signIns must include signIn '${String(signIn)}'`);
+        }
+        if (auth.users !== 'customers' && (methods.length !== 1 || methods[0] !== 'password')) {
+            return refusal('sign_in_staff_password_only', signInsAt, `${at} signIns for users 'staff' must be ['password']: your team signs in with a password`);
+        }
+        if (methods.length === 1 && methods[0] === 'passkey') {
+            return refusal('passkey_needs_another_method', signInsAt, `${at} signIns 'passkey' needs 'email-code' or 'password' beside it: a first passkey and its recovery both use one of them`);
+        }
+        if (methods.includes('email-code') && auth.users !== 'customers') {
+            return refusal('email_code_needs_customers', signInsAt, `${at} signIns 'email-code' needs users 'customers': only customers sign in with an emailed code`);
+        }
+        // Every reader of the emailed code (the sign-in metadata, the broker entry, the workspace sign-in) reads
+        // `signIn`, so a list that offers the code without it would plan none of them.
+        if (methods.includes('email-code') && signIn !== 'email-code') {
+            return refusal('email_code_needs_sign_in', signInsAt, `${at} signIns 'email-code' needs signIn 'email-code' too: the emailed code is set up from signIn`);
+        }
+    }
+    const secondFactor = auth.secondFactor;
+    if (secondFactor !== undefined) {
+        if (!SECOND_FACTOR_MODES.includes(secondFactor)) {
+            return refusal('auth_second_factor_invalid', `hosting.entries.${entry.key}.uses.auth.secondFactor`, `${at} secondFactor must be 'off', 'allowed' or 'required'`);
+        }
+        if (secondFactor !== 'off' && auth.users !== 'customers') {
+            return refusal('sign_in_staff_password_only', `hosting.entries.${entry.key}.uses.auth.secondFactor`, `${at} secondFactor for users 'staff' must be 'off': staff two-step sign-in is set for the whole company`);
+        }
+    }
     if (signIn === 'email-code' && auth.users !== 'customers') {
         return refusal('email_code_needs_customers', `hosting.entries.${entry.key}.uses.auth.signIn`, `${at} signIn 'email-code' needs users 'customers': only customers sign in with an emailed code`);
     }

package/dist/plan/boule.d.ts

@@ -108,10 +108,23 @@ export declare const ARCHON_CREDENTIAL_RENEW_AFTER_MS: number;
 export declare function archonCredentialRenewDue(recorded: Readonly<Record<string, string>>, nowMs: number): boolean;
 /** The ZITADEL machine user that reads the customers organisation. No secret. */
 export declare const CUSTOMERS_DIRECTORY_USER_SCOPE_KEY = "customers_directory_user";
+/**
+ * The roles the customers directory user holds in the customers organisation, recorded once they are granted.
+ * The value is the version: raise it and every stack plans the grant again. `1` is read plus user management
+ * (Boule removes a customer with this credential, boule#495).
+ */
+export declare const CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY = "customers_directory_roles";
+export declare const CUSTOMERS_DIRECTORY_ROLES_VERSION = "1";
 /** The ZITADEL org metadata key that tells the sign-in page how the customers organisation signs in. */
 export declare const CUSTOMERS_SIGN_IN_METADATA_KEY = "wtfalch.signIn";
 /** `email-code` or `password`: the sign-in metadata last written to the customers organisation. Absent: never written. */
 export declare const CUSTOMERS_SIGN_IN_SCOPE_KEY = "zitadel_customers_signin";
+/**
+ * The customers organisation's login policy (every customer app's superset), recorded once it is written.
+ * The value is the policy's version: raise it and every stack plans the write again.
+ */
+export declare const CUSTOMERS_POLICY_SCOPE_KEY = "zitadel_customers_policy";
+export declare const CUSTOMERS_POLICY_VERSION = "1";
 /** The ZITADEL org metadata key that holds the left-half text of the customers' sign-in window. */
 export declare const CUSTOMERS_ROOM_METADATA_KEY = "wtfalch.room";
 /** The metadata value last written to the customers organisation, or empty after a removal. Absent: never written. */
@@ -134,6 +147,8 @@ export declare const customersOrgIdOf: (org: Pick<DeclaredOrg, "id">, recorded:
 export interface BouleCredentialWants {
     archonCredential?: boolean;
     customersDirectory?: boolean;
+    /** The directory user was made before it could remove customers: the step grants it that role in the customers organisation once. */
+    directoryRolesDue?: boolean;
     /** The recorded Archon credential is missing or 335 days old: the step mints it again. */
     archonRenewDue?: boolean;
     /** F13: Boule is given `CUSTOMER_GRANTS` (an entry declares `uses.customerGrants`; needs `customersDirectory`). */

package/dist/plan/boule.js

@@ -124,10 +124,23 @@ export function archonCredentialRenewDue(recorded, nowMs) {
 }
 /** The ZITADEL machine user that reads the customers organisation. No secret. */
 export const CUSTOMERS_DIRECTORY_USER_SCOPE_KEY = 'customers_directory_user';
+/**
+ * The roles the customers directory user holds in the customers organisation, recorded once they are granted.
+ * The value is the version: raise it and every stack plans the grant again. `1` is read plus user management
+ * (Boule removes a customer with this credential, boule#495).
+ */
+export const CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY = 'customers_directory_roles';
+export const CUSTOMERS_DIRECTORY_ROLES_VERSION = '1';
 /** The ZITADEL org metadata key that tells the sign-in page how the customers organisation signs in. */
 export const CUSTOMERS_SIGN_IN_METADATA_KEY = 'wtfalch.signIn';
 /** `email-code` or `password`: the sign-in metadata last written to the customers organisation. Absent: never written. */
 export const CUSTOMERS_SIGN_IN_SCOPE_KEY = 'zitadel_customers_signin';
+/**
+ * The customers organisation's login policy (every customer app's superset), recorded once it is written.
+ * The value is the policy's version: raise it and every stack plans the write again.
+ */
+export const CUSTOMERS_POLICY_SCOPE_KEY = 'zitadel_customers_policy';
+export const CUSTOMERS_POLICY_VERSION = '1';
 /** The ZITADEL org metadata key that holds the left-half text of the customers' sign-in window. */
 export const CUSTOMERS_ROOM_METADATA_KEY = 'wtfalch.room';
 /** The metadata value last written to the customers organisation, or empty after a removal. Absent: never written. */

package/dist/plan/broker-registrar-token.d.ts

@@ -0,0 +1,69 @@
+import type { DeclaredOrg } from '../org.js';
+import type { CoolifyPort, ZitadelPort } from './executor.js';
+/**
+ * The sign-in broker's ZITADEL credential for registering apps (auth ADR 0003, "Sign-in the broker makes"):
+ * `ZITADEL_REGISTRAR_TOKEN`, a machine user of its own, never the login-client PAT. Without it the broker
+ * logs "app sign-in off" and no Boule of that sign-in can register an app that signs people in.
+ *
+ * The user (`ZitadelPort.ensureRegistrarUser`) lives in the instance's first organisation and holds the
+ * project-creator role in the company's sign-in organisation and its customers organisations. Its token is
+ * minted once (platform-step rule 1), held at the target's `refs.registrarToken`, written to the broker's env
+ * and the broker deployed. A token already on the broker's env that foundry did not make is adopted: it is
+ * recorded as applied and left alone. Never a token in an error, a log or a recorded id.
+ */
+/** The broker env that holds the token. */
+export declare const REGISTRAR_TOKEN_ENV = "ZITADEL_REGISTRAR_TOKEN";
+/** The machine user's name, the same for every instance. */
+export declare const REGISTRAR_TOKEN_USER_NAME = "foundry-broker-registrar";
+/** The user id of a mint whose token was not yet confirmed delivered (no `:`, so it is a rule 1 guard). Ignored once applied. */
+export declare const REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY = "auth_registrar_token_undelivered";
+/** `<user id>:<pat id>` once the token is held and on the broker; `adopted` for a value foundry did not make. Never the token. */
+export declare const REGISTRAR_TOKEN_SCOPE_KEY = "auth_registrar_token_applied";
+/** {@link registrarOrgsMarker} of the organisations the user was last granted the role in. */
+export declare const REGISTRAR_TOKEN_ORGS_SCOPE_KEY = "auth_registrar_token_orgs";
+/** The adopted marker's value. */
+export declare const REGISTRAR_TOKEN_ADOPTED = "adopted";
+/** A stop whose text names ids only, never a cause, so a caller may log it as it is. */
+export declare class RegistrarTokenError extends Error {
+}
+/** The organisations an own company's registrar user covers besides the instance's first: its sign-in organisation and its customers organisations. */
+export declare function registrarOrgIdsOf(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string[];
+/** What the orgs marker holds: the ids, sorted, so a reorder is no change. */
+export declare const registrarOrgsMarker: (orgIds: readonly string[]) => string;
+/**
+ * Whether the company's broker still needs this step for its token: the token is wanted (customers or apps),
+ * and it is not applied or the organisations it covers are not the ones recorded now.
+ */
+export declare function registrarTokenDue(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): boolean;
+interface TokenHeldKeys {
+    resolve(ref: string): Promise<string | null | undefined>;
+    put?(ref: string, value: string): Promise<void>;
+}
+export interface EnsureRegistrarTokenInput {
+    /** Names the instance in an error, e.g. `candorfx:auth`. */
+    label: string;
+    zitadel: Partial<Pick<ZitadelPort, 'ensureRegistrarUser' | 'mintRegistrarToken'>>;
+    coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs' | 'deploy'>;
+    brokerAppId: string;
+    /** The instance's first organisation: where the user lives. */
+    homeOrgId: string;
+    /** The company's organisations the user covers besides the home one. */
+    orgIds: readonly string[];
+    heldKeys: TokenHeldKeys | undefined;
+    ref: string;
+    recorded: () => Readonly<Record<string, string>>;
+    record: (key: string, value: string) => Promise<void>;
+    persist: () => Promise<void>;
+    /** Told every secret this function handles, so the caller can redact it. */
+    secret: (value: string) => void;
+    sleep: (ms: number) => Promise<void>;
+    log: (line: string) => void;
+}
+/**
+ * Makes the broker hold a registrar token that covers the company's organisations. Resumable: a token held
+ * but not delivered is delivered, never minted again; a token minted whose hold did not finish stops with
+ * the ids named and nothing minted (a person removes {@link REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make
+ * another). Returns what it did.
+ */
+export declare function ensureBrokerRegistrarToken(input: EnsureRegistrarTokenInput): Promise<'adopted' | 'delivered' | 'minted' | 'grants' | 'unchanged'>;
+export {};

package/dist/plan/broker-registrar-token.js

@@ -0,0 +1,215 @@
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { customersOrgIdOf, registrarWanted } from './boule.js';
+import { withTimeout } from './call-timeout.js';
+import { testCustomersOrgKey } from './workspace-client.js';
+/**
+ * The sign-in broker's ZITADEL credential for registering apps (auth ADR 0003, "Sign-in the broker makes"):
+ * `ZITADEL_REGISTRAR_TOKEN`, a machine user of its own, never the login-client PAT. Without it the broker
+ * logs "app sign-in off" and no Boule of that sign-in can register an app that signs people in.
+ *
+ * The user (`ZitadelPort.ensureRegistrarUser`) lives in the instance's first organisation and holds the
+ * project-creator role in the company's sign-in organisation and its customers organisations. Its token is
+ * minted once (platform-step rule 1), held at the target's `refs.registrarToken`, written to the broker's env
+ * and the broker deployed. A token already on the broker's env that foundry did not make is adopted: it is
+ * recorded as applied and left alone. Never a token in an error, a log or a recorded id.
+ */
+/** The broker env that holds the token. */
+export const REGISTRAR_TOKEN_ENV = 'ZITADEL_REGISTRAR_TOKEN';
+/** The machine user's name, the same for every instance. */
+export const REGISTRAR_TOKEN_USER_NAME = 'foundry-broker-registrar';
+/** The user id of a mint whose token was not yet confirmed delivered (no `:`, so it is a rule 1 guard). Ignored once applied. */
+export const REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY = 'auth_registrar_token_undelivered';
+/** `<user id>:<pat id>` once the token is held and on the broker; `adopted` for a value foundry did not make. Never the token. */
+export const REGISTRAR_TOKEN_SCOPE_KEY = 'auth_registrar_token_applied';
+/** {@link registrarOrgsMarker} of the organisations the user was last granted the role in. */
+export const REGISTRAR_TOKEN_ORGS_SCOPE_KEY = 'auth_registrar_token_orgs';
+/** The adopted marker's value. */
+export const REGISTRAR_TOKEN_ADOPTED = 'adopted';
+/** A stop whose text names ids only, never a cause, so a caller may log it as it is. */
+export class RegistrarTokenError extends Error {
+}
+/** The held key store's read and write, and each ZITADEL call, stop at these: a hung call ends the step with a plain line. */
+const HELD_KEY_TIMEOUT_MS = 15_000;
+const ZITADEL_CALL_TIMEOUT_MS = 30_000;
+const COOLIFY_CALL_TIMEOUT_MS = 60_000;
+/** How many times the hold and the delivery are tried. */
+const DELIVER_ATTEMPTS = 3;
+/** The organisations an own company's registrar user covers besides the instance's first: its sign-in organisation and its customers organisations. */
+export function registrarOrgIdsOf(org, recorded) {
+    const customers = org.customers?.enabled === true ? customersOrgIdOf(org, recorded) : undefined;
+    const test = org.customers?.enabled === true ? recorded[testCustomersOrgKey(org.id)] : undefined;
+    return [recorded[ZITADEL_ORG_SCOPE_KEY], customers, test].filter((id) => Boolean(id));
+}
+/** What the orgs marker holds: the ids, sorted, so a reorder is no change. */
+export const registrarOrgsMarker = (orgIds) => [...new Set(orgIds)].sort().join(',');
+/**
+ * Whether the company's broker still needs this step for its token: the token is wanted (customers or apps),
+ * and it is not applied or the organisations it covers are not the ones recorded now.
+ */
+export function registrarTokenDue(org, recorded) {
+    if (!registrarWanted(org))
+        return false;
+    const applied = recorded[REGISTRAR_TOKEN_SCOPE_KEY];
+    if (!applied)
+        return true;
+    if (applied === REGISTRAR_TOKEN_ADOPTED)
+        return false;
+    return ((recorded[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] ?? '') !==
+        registrarOrgsMarker(registrarOrgIdsOf(org, recorded)));
+}
+/** The same input with a timeout on every held key, ZITADEL and Coolify call. */
+function timed(c) {
+    const { heldKeys, zitadel, coolify } = c;
+    const { ensureRegistrarUser, mintRegistrarToken } = zitadel;
+    return {
+        ...c,
+        coolify: {
+            listEnvs: (...args) => withTimeout('Coolify list env', COOLIFY_CALL_TIMEOUT_MS, () => coolify.listEnvs(...args)),
+            bulkUpsertEnvs: (...args) => withTimeout('Coolify write env', COOLIFY_CALL_TIMEOUT_MS, () => coolify.bulkUpsertEnvs(...args)),
+            deploy: (...args) => withTimeout('Coolify deploy', COOLIFY_CALL_TIMEOUT_MS, () => coolify.deploy(...args)),
+        },
+        heldKeys: heldKeys && {
+            resolve: (ref) => withTimeout('held key read', HELD_KEY_TIMEOUT_MS, () => heldKeys.resolve(ref)),
+            ...(heldKeys.put
+                ? {
+                    put: (ref, value) => withTimeout('held key write', HELD_KEY_TIMEOUT_MS, () => heldKeys.put(ref, value)),
+                }
+                : {}),
+        },
+        zitadel: {
+            ...(ensureRegistrarUser
+                ? {
+                    ensureRegistrarUser: (...args) => withTimeout('ZITADEL ensure registrar user', ZITADEL_CALL_TIMEOUT_MS, () => ensureRegistrarUser(...args)),
+                }
+                : {}),
+            ...(mintRegistrarToken
+                ? {
+                    mintRegistrarToken: (...args) => withTimeout('ZITADEL mint registrar token', ZITADEL_CALL_TIMEOUT_MS, () => mintRegistrarToken(...args)),
+                }
+                : {}),
+        },
+    };
+}
+/** Runs one try at a time, up to {@link DELIVER_ATTEMPTS}; the cause of the last failure is dropped. */
+async function retried(sleep, action) {
+    for (let attempt = 1; attempt <= DELIVER_ATTEMPTS; attempt += 1) {
+        try {
+            await action();
+            return true;
+        }
+        catch {
+            // The cause can hold the token (a Coolify validation error echoes the value), so it is dropped.
+            if (attempt < DELIVER_ATTEMPTS)
+                await sleep(1000 * attempt);
+        }
+    }
+    return false;
+}
+/**
+ * Makes the broker hold a registrar token that covers the company's organisations. Resumable: a token held
+ * but not delivered is delivered, never minted again; a token minted whose hold did not finish stops with
+ * the ids named and nothing minted (a person removes {@link REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make
+ * another). Returns what it did.
+ */
+export async function ensureBrokerRegistrarToken(input) {
+    const c = timed(input);
+    const covered = [c.homeOrgId, ...c.orgIds];
+    const wanted = registrarOrgsMarker(c.orgIds);
+    const envRows = await c.coolify.listEnvs(c.brokerAppId);
+    const live = envRows.find((e) => e.key === REGISTRAR_TOKEN_ENV && !e.is_preview)?.value;
+    if (live)
+        c.secret(live);
+    const before = c.recorded();
+    const applied = before[REGISTRAR_TOKEN_SCOPE_KEY];
+    if (applied) {
+        if (!live) {
+            // The env was lost: the held token is delivered again; with none held, nothing is made over it.
+            const held = await c.heldKeys?.resolve(c.ref);
+            if (!held) {
+                throw new RegistrarTokenError(`${c.label}: the broker has no ${REGISTRAR_TOKEN_ENV} and the registrar token is not held (ref ${c.ref}); remove ${REGISTRAR_TOKEN_SCOPE_KEY} to make a new one`);
+            }
+            c.secret(held);
+            await deliver(c, held);
+            return 'delivered';
+        }
+        if (applied !== REGISTRAR_TOKEN_ADOPTED && before[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] !== wanted) {
+            await grant(c, covered);
+            await c.record(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, wanted);
+            await c.persist();
+            return 'grants';
+        }
+        return 'unchanged';
+    }
+    const undelivered = before[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY];
+    const held = await c.heldKeys?.resolve(c.ref);
+    if (live && !undelivered && held !== live) {
+        // A value somebody set by hand (Candor FX's): kept as it is. Its user is not known, so no grants.
+        c.log(`${c.label}: the broker already has a ${REGISTRAR_TOKEN_ENV} foundry did not make; adopted, not replaced`);
+        await c.record(REGISTRAR_TOKEN_SCOPE_KEY, REGISTRAR_TOKEN_ADOPTED);
+        await c.persist();
+        return 'adopted';
+    }
+    if (undelivered && !held) {
+        throw new RegistrarTokenError(`${c.label}: the registrar token of ZITADEL machine user ${undelivered} was minted but never confirmed held; remove the recorded key ${REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make a new one`);
+    }
+    if (held) {
+        // Made by a run that stopped after holding it: delivered now, nothing minted.
+        c.secret(held);
+        await grant(c, covered);
+        await c.record(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, wanted);
+        await deliver(c, held);
+        await c.record(REGISTRAR_TOKEN_SCOPE_KEY, undelivered ? `${undelivered}:held` : 'held');
+        await c.persist();
+        return 'delivered';
+    }
+    if (typeof c.heldKeys?.put !== 'function') {
+        throw new RegistrarTokenError(`${c.label}: the held keys cannot hold the registrar token (ref ${c.ref})`);
+    }
+    if (!c.zitadel.ensureRegistrarUser || !c.zitadel.mintRegistrarToken) {
+        throw new RegistrarTokenError(`${c.label}: the host's ZITADEL port cannot make a registrar token`);
+    }
+    const { userId } = await c.zitadel.ensureRegistrarUser(covered, {
+        userName: REGISTRAR_TOKEN_USER_NAME,
+        name: 'Foundry (sign-in broker registrar)',
+    });
+    const { token, patId } = await c.zitadel.mintRegistrarToken(c.homeOrgId, userId);
+    c.secret(token);
+    // Recorded and persisted before the token goes anywhere: a crash from here on never mints a second one.
+    await c.record(REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY, userId);
+    await c.persist();
+    const put = c.heldKeys.put.bind(c.heldKeys);
+    if (!(await retried(c.sleep, () => put(c.ref, token)))) {
+        throw new RegistrarTokenError(`${c.label}: the registrar token of ZITADEL machine user ${userId} was minted but could not be held after ${DELIVER_ATTEMPTS} tries (ref ${c.ref})`);
+    }
+    await deliver(c, token, userId);
+    await c.record(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, wanted);
+    // Last: a run that failed above plans the step again.
+    await c.record(REGISTRAR_TOKEN_SCOPE_KEY, `${userId}:${patId}`);
+    await c.persist();
+    return 'minted';
+}
+async function grant(c, covered) {
+    if (!c.zitadel.ensureRegistrarUser) {
+        throw new RegistrarTokenError(`${c.label}: the host's ZITADEL port cannot grant the registrar user`);
+    }
+    try {
+        await c.zitadel.ensureRegistrarUser(covered, {
+            userName: REGISTRAR_TOKEN_USER_NAME,
+            name: 'Foundry (sign-in broker registrar)',
+        });
+    }
+    catch {
+        throw new RegistrarTokenError(`${c.label}: the registrar user could not be granted its organisations; apply again`);
+    }
+}
+/** Writes the token to the broker's env and deploys the broker, each retried; the cause is dropped. */
+async function deliver(c, token, userId) {
+    const who = userId ? ` of ZITADEL machine user ${userId}` : '';
+    const wrote = await retried(c.sleep, () => c.coolify.bulkUpsertEnvs(c.brokerAppId, [{ key: REGISTRAR_TOKEN_ENV, value: token }]));
+    // Forced: an unforced deploy answers "skipped" when one for the same commit is queued, which would let
+    // this record delivery while the running broker never sees the token.
+    const deployed = wrote && (await retried(c.sleep, () => c.coolify.deploy(c.brokerAppId, true)));
+    if (!deployed) {
+        throw new RegistrarTokenError(`${c.label}: the registrar token${who} is held but could not be delivered to the broker after ${DELIVER_ATTEMPTS} tries; the next apply delivers it again`);
+    }
+}