@wtfalch/foundry 0.70.1 → 0.72.0

package/dist/plan/health-check-settings.d.ts

@@ -27,6 +27,19 @@
  * no live measurement to pin it to instead"). A caller whose app is known to
  * be slower or faster to boot passes its own.
  */
+/**
+ * #1054: the two fields that let Coolify run a rolling update for an app other containers reach by a fixed name.
+ * Coolify starts the new container beside the old one, waits for its check, then stops the old one, only when the
+ * app has no fixed container name (`custom_internal_name`) and the consistent-name flag is off. A network alias
+ * answers on the Docker network under the same name throughout the swap, so callers send this instead of
+ * `custom_internal_name`. The app also needs a health check to wait on (`healthCheckSettings` or
+ * {@link IMAGE_HEALTHCHECK_SETTINGS}).
+ */
+export declare function rollingUpdateSettings(alias: string): {
+    custom_network_aliases: string;
+    is_consistent_container_name_enabled: false;
+    custom_internal_name: null;
+};
 /** The four Coolify `updateApplication` fields {@link healthCheckSettings} returns. */
 export interface HealthCheckPatch {
     health_check_enabled: true;

package/dist/plan/health-check-settings.js

@@ -27,6 +27,23 @@
  * no live measurement to pin it to instead"). A caller whose app is known to
  * be slower or faster to boot passes its own.
  */
+/**
+ * #1054: the two fields that let Coolify run a rolling update for an app other containers reach by a fixed name.
+ * Coolify starts the new container beside the old one, waits for its check, then stops the old one, only when the
+ * app has no fixed container name (`custom_internal_name`) and the consistent-name flag is off. A network alias
+ * answers on the Docker network under the same name throughout the swap, so callers send this instead of
+ * `custom_internal_name`. The app also needs a health check to wait on (`healthCheckSettings` or
+ * {@link IMAGE_HEALTHCHECK_SETTINGS}).
+ */
+export function rollingUpdateSettings(alias) {
+    // `custom_internal_name: null` clears the fixed name an app made by an earlier foundry still has: with it set
+    // Coolify refuses the rolling update whatever else is patched.
+    return {
+        custom_network_aliases: alias,
+        is_consistent_container_name_enabled: false,
+        custom_internal_name: null,
+    };
+}
 /** Archon's own number (see this module's doc comment) -- the default every other caller inherits unless it knows better. */
 export const DEFAULT_HEALTH_CHECK_START_PERIOD_SECONDS = 30;
 /**

package/dist/plan/own-diff.d.ts

@@ -52,7 +52,35 @@ export declare const OWN_AUTH_BLOCKED_KEY = "own-auth";
 export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export declare const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = "own_auth_applied_git_ref";
+/** The Git repository the company's login app, in-app login app and broker are built from. */
+export declare const OWN_AUTH_REPOSITORY = "wtfalch/auth";
+/** What the host read of the declared auth branch: its head commit, or why it could not be read (fixed text). */
+export type OwnAuthHead = {
+    commit: string;
+} | {
+    failed: string;
+};
+/**
+ * True for a declared auth ref whose head can move: not a commit and not a release tag (`v1.2.3`, `1.2`).
+ * A tag or a commit already names one build, so it is never read.
+ */
+export declare function isBranchRef(ref: string): boolean;
+/**
+ * The company's auth apps a moved branch head redeploys, with the name their `built_commit_<name>` is recorded
+ * under. The in-app login app is listed once it is recorded; the broker once it was ever deployed (before that it
+ * crash-loops on missing inputs and is not redeployed, so it never records a build).
+ */
+export declare function ownAuthBuildApps(org: Pick<DeclaredOrg, 'slug'>, recordedIds: Readonly<Record<string, string>>): Array<{
+    id: string;
+    name: string;
+}>;
 export interface PlanOwnAuthOptions {
+    /**
+     * #886: the head of the declared auth branch, read by the executor (`FoundryStepExecutor.ownAuthHead`).
+     * Absent: not read (a tag, a commit, or a host without the read), so only the declared ref decides.
+     * A failed read plans nothing from the head and is reported.
+     */
+    authHead?: OwnAuthHead;
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
     readiness: OrgPlatformReadiness;
@@ -76,6 +104,10 @@ export interface PlanOwnAuthOptions {
     signinDbBackupConfigured?: boolean;
     /** The host's ZITADEL port can write the sign-in mail text and look. Default true. False: the marker is not required. */
     signinMailWritable?: boolean;
+    /** The host's ZITADEL port can make the broker's registrar token. True: it is asked for. False: reported blocked. Absent: neither. */
+    registrarTokenWritable?: boolean;
+    /** The registrar token's held-key ref holds a value, so a rerun after a crash delivers it. Default false. */
+    registrarTokenHeld?: boolean;
 }
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app

package/dist/plan/own-diff.js

@@ -3,18 +3,20 @@ import { sfuSlotPorts } from '../calls-sfu.js';
 import { SFU_SLOT_MAX, ownsServices } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { brokerEntryAppliedScopeKey } from './broker-entries.js';
+import { REGISTRAR_TOKEN_SCOPE_KEY, REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY, registrarTokenDue, } from './broker-registrar-token.js';
+import { builtCommitScopeKey } from './build-record.js';
 import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
 import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
-import { ownHostnames } from './own-hostnames.js';
+import { ownHostnames, passkeyRpIdFor } from './own-hostnames.js';
 import { JOBS_PUBLIC_URL_SCOPE_KEY, OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY } from './own-jobs-route.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
-import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
-import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
-import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
+import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn, signInLoginNames } from './sign-in.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, signinDbCertDue } from './signin-db-tls.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db.js';
@@ -126,6 +128,39 @@ export const OWN_AUTH_BLOCKED_KEY = 'own-auth';
 export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'own_auth_applied_git_ref';
+/** The Git repository the company's login app, in-app login app and broker are built from. */
+export const OWN_AUTH_REPOSITORY = 'wtfalch/auth';
+const FULL_SHA = /^[0-9a-f]{40}$/;
+/**
+ * True for a declared auth ref whose head can move: not a commit and not a release tag (`v1.2.3`, `1.2`).
+ * A tag or a commit already names one build, so it is never read.
+ */
+export function isBranchRef(ref) {
+    return !FULL_SHA.test(ref) && !/^v?\d+\.\d+/.test(ref);
+}
+/**
+ * The company's auth apps a moved branch head redeploys, with the name their `built_commit_<name>` is recorded
+ * under. The in-app login app is listed once it is recorded; the broker once it was ever deployed (before that it
+ * crash-loops on missing inputs and is not redeployed, so it never records a build).
+ */
+export function ownAuthBuildApps(org, recordedIds) {
+    const target = orgTarget(org);
+    const apps = [
+        { id: recordedIds[PLATFORM_AUTH_LOGIN_SCOPE_KEY], name: target.names.authLogin },
+        { id: recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY], name: signInLoginNames(target).name },
+        {
+            id: recordedIds[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY]
+                ? recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY]
+                : undefined,
+            name: target.names.authBroker,
+        },
+    ];
+    return apps.filter((app) => Boolean(app.id));
+}
+/** True when the read head differs from the commit any of the company's auth apps was last built from. */
+function authHeadMoved(org, recordedIds, head) {
+    return ownAuthBuildApps(org, recordedIds).some((app) => recordedIds[builtCommitScopeKey(app.name)] !== head);
+}
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
  * and the broker in the org's own Coolify project, at `auth.<domain>`.
@@ -197,7 +232,21 @@ export function planOwnAuth(options) {
             return blocked('the host supplies no backup bucket for the sign-in database');
         }
     }
+    const registrarDue = options.registrarTokenWritable === true && registrarTokenDue(org, recordedIds);
+    // A token minted whose hold did not finish is never minted again: a person removes the marker.
+    if (registrarDue &&
+        recordedIds[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY] &&
+        !recordedIds[REGISTRAR_TOKEN_SCOPE_KEY] &&
+        !options.registrarTokenHeld) {
+        return blocked(`the broker's registrar token of ZITADEL machine user ${recordedIds[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY]} was minted but never confirmed held; remove the recorded key ${REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make a new one`);
+    }
     const hostname = names.auth;
+    // #886: a branch head that moved past what the auth apps were built from plans the step again. A failed read
+    // plans nothing from the head and is reported, so a broken read never loops.
+    const head = options.authHead;
+    const headCommit = head && 'commit' in head ? head.commit : undefined;
+    const headFailed = head && 'failed' in head ? head.failed : undefined;
+    const headMoved = headCommit !== undefined && authHeadMoved(org, recordedIds, headCommit);
     // The broker starts only on a valid `AUTH_APPS`, and the login client is minted only once it does:
     // the first broker entry is what lets this step finish, as the platform's first registration does.
     // Archon's registration is an entry too; the platform records it, not this org, so it comes in
@@ -219,7 +268,7 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY] === AUTH_TUNNEL_ROUTES_VERSION &&
         // The login apps' mail env (`LOGIN_MAIL_FROM`, the Lettermint key); a stack from before it is written again.
         recordedIds[PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY] ===
-            authLoginEnvMarker(`noreply@${names.mailDomain}`) &&
+            authLoginEnvMarker(`noreply@${names.mailDomain}`, passkeyRpIdFor(org)) &&
         // The code mail carries the company's name and design; an older apply, or a renamed company, writes it again.
         (options.signinMailWritable === false ||
             recordedIds[PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY] === signinMailMarker(org.displayName)) &&
@@ -234,15 +283,23 @@ export function planOwnAuth(options) {
         !signinDbCertDue(recordedIds, options.now ?? Date.now()) &&
         !signinDbBackupMissing(recordedIds) &&
         // ZITADEL was started on the TLS database and never seen healthy there: the step starts it again.
-        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY]) {
+        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY] &&
+        !headMoved &&
+        // The broker's registrar token (a company with customers or apps): made, or adopted, and covering the recorded organisations.
+        !registrarDue) {
         // Applied and otherwise done: say why the mail stays ZITADEL's stock text, once.
         const mailMissing = options.signinMailWritable === false &&
             recordedIds[PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY] !== signinMailMarker(org.displayName);
+        const registrarMissing = options.registrarTokenWritable === false && registrarTokenDue(org, recordedIds);
         return {
             step: null,
-            blocked: mailMissing
-                ? `${org.slug}'s sign-in mail keeps ZITADEL's default text: the host cannot write message texts`
-                : null,
+            blocked: headFailed
+                ? `${org.slug}'s auth apps were not checked for a newer auth commit: ${headFailed}`
+                : registrarMissing
+                    ? `${org.slug}'s sign-in broker has no registrar token: the host cannot make it, so its apps cannot register sign-in`
+                    : mailMissing
+                        ? `${org.slug}'s sign-in mail keeps ZITADEL's default text: the host cannot write message texts`
+                        : null,
         };
     }
     return {
@@ -252,7 +309,7 @@ export function planOwnAuth(options) {
                 system: 'coolify',
                 kind: 'own-auth',
                 key: org.id,
-                desired: { hostname, gitRef },
+                desired: { hostname, gitRef, ...(headCommit ? { head: headCommit } : {}) },
             },
             step: {
                 description: `provision ${org.slug}'s own sign-in at ${hostname}`,

package/dist/plan/own-hostnames.d.ts

@@ -27,3 +27,11 @@ export interface OwnHostnames {
  * {@link loginHostnameFor}, so the two cannot disagree.
  */
 export declare function ownHostnames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'issuer' | 'mail'>): OwnHostnames;
+/**
+ * The WebAuthn RP ID for a company's login apps (`LOGIN_PASSKEY_RP_ID`): the company's own domain, which
+ * `auth.<domain>` and the in-app hosts (`agora.<domain>`, `boule.<domain>`) all sit under, so one passkey
+ * works on each. Undefined for a company without its own sign-in domain: its `<slug>-auth.oikos.host` shares
+ * `oikos.host` with every other company, so an RP ID there would span companies. The login app refuses a
+ * host outside the RP ID, so a company's hosts stay under its domain or the variable stays unset.
+ */
+export declare function passkeyRpIdFor(org: Pick<DeclaredOrg, 'domain' | 'issuer'>): string | undefined;

package/dist/plan/own-hostnames.js

@@ -23,3 +23,17 @@ export function ownHostnames(org) {
         mailDomain: mailOnDomain && domain ? domain : `${slug}.${NO_DOMAIN_ZONE}`,
     };
 }
+const BARE_DOMAIN = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/**
+ * The WebAuthn RP ID for a company's login apps (`LOGIN_PASSKEY_RP_ID`): the company's own domain, which
+ * `auth.<domain>` and the in-app hosts (`agora.<domain>`, `boule.<domain>`) all sit under, so one passkey
+ * works on each. Undefined for a company without its own sign-in domain: its `<slug>-auth.oikos.host` shares
+ * `oikos.host` with every other company, so an RP ID there would span companies. The login app refuses a
+ * host outside the RP ID, so a company's hosts stay under its domain or the variable stays unset.
+ */
+export function passkeyRpIdFor(org) {
+    const domain = org.domain?.toLowerCase();
+    if (!domain || !org.issuer.usesDomain || !BARE_DOMAIN.test(domain))
+        return undefined;
+    return domain;
+}

package/dist/plan/own-services.d.ts

@@ -61,6 +61,8 @@ export interface ServiceTarget {
     };
     readonly refs: {
         instanceBearer: string;
+        /** The sign-in broker's ZITADEL registrar token (`ZITADEL_REGISTRAR_TOKEN`), held after its one mint. */
+        registrarToken: string;
         authAdmin: string;
         brokerMailKey: string;
         /** The connection string of the database for the broker's customer workspaces: foundry holds it after making the database, or the operator holds one first. */
@@ -209,4 +211,9 @@ export interface OwnServicesPort {
     /** Builds the ZITADEL port for one company instance. */
     zitadelFor(instance: OwnAuthInstance): ZitadelPort;
     provision: OwnServicesProvision;
+    /**
+     * #886: the head commit (40 hex characters) of `ref` in the Git repository `repository` (`owner/name`).
+     * Absent: a moved auth branch is not noticed. The executor puts a timeout on every call.
+     */
+    readBranchHead?(repository: string, ref: string): Promise<string>;
 }

package/dist/plan/own-services.js

@@ -46,6 +46,7 @@ export function platformTarget() {
         },
         refs: {
             instanceBearer: 'zitadel:platform:instanceBearer',
+            registrarToken: 'zitadel:platform:registrarToken',
             authAdmin: 'zitadel:platform:admin',
             brokerMailKey: 'lettermint:platform:apiToken',
             brokerWorkspacesDatabase: 'auth:platform:workspacesDatabaseUrl',
@@ -103,6 +104,7 @@ export function orgTarget(org) {
         },
         refs: {
             instanceBearer: `zitadel:org:${s}:instanceBearer`,
+            registrarToken: `zitadel:org:${s}:registrarToken`,
             authAdmin: `zitadel:org:${s}:admin`,
             brokerMailKey: `lettermint:org:${s}:apiToken`,
             brokerWorkspacesDatabase: `auth:org:${s}:workspacesDatabaseUrl`,

package/dist/plan/plan-apply.d.ts

@@ -18,6 +18,7 @@ import type { GithubDeployKeysPort } from './github-deploy-keys.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
+import type { OwnAuthHead } from './own-diff.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
@@ -212,8 +213,12 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** Whether the ZITADEL port can set the customers organisation's login policy. Absent: planned, as before. */
+    customersLoginPolicyAvailable?(): boolean;
     /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
     customersDirectoryAvailable?(): boolean;
+    /** Whether the ZITADEL port can grant the directory user its customer removal role. */
+    customersDirectoryRolesAvailable?(): boolean;
     /** C3: whether the host supplied `mintBouleArchonCredential`. */
     bouleArchonCredentialAvailable?(): boolean;
     /** Every Coolify server with whether it is usable and reachable; blue/green plans copies on each. Optional: an executor without it plans no blue/green. */
@@ -234,6 +239,21 @@ export interface StepExecutor {
      * copy is not recorded. Optional: an executor without it runs no release.
      */
     releaseHost?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /**
+     * The built-in fan-out's in-place deploy of one org's Boule or Agora at `sha` (`release/fanout.ts`). Optional:
+     * an executor without it runs no fan-out.
+     */
+    deployBuiltinAt?(input: {
+        app: 'boule' | 'agora';
+        org: DeclaredOrg;
+        recordedIds: Readonly<Record<string, string>>;
+        sha: string;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
     /**
      * One release tick for one subject: the recorded stage gate's list follows the people holding `releases:preview`,
      * owners staying. Never throws. Optional: an executor without it leaves every gate as it is.
@@ -249,6 +269,12 @@ export interface StepExecutor {
     ownSigninDbBackupConfigured?(): boolean;
     /** Whether the host's company ZITADEL port can write the sign-in mail text and look. Absent: true. */
     ownSigninMailWritable?(): boolean;
+    /** #886: reads the head of the declared auth branch for an own org; `undefined` when there is nothing to read. */
+    ownAuthHead?(gitRef: string): Promise<OwnAuthHead | undefined>;
+    /** Whether the host's ZITADEL port can grant the shared sign-in's registrar user a company's organisations. Absent: false. */
+    registrarGrantsAvailable?(): boolean;
+    /** Whether the host's company ZITADEL port can make the broker's registrar token. Absent: the planner neither asks for it nor reports it. */
+    ownRegistrarTokenWritable?(): boolean;
     /**
      * Whether the host's scoped ports for this own org include a files-organisation
      * port. The planner plans no `files:organisation` step for an own org while
@@ -935,6 +961,12 @@ export declare class FoundryPlanApply implements PlanApply {
         target: string;
         error?: string;
     }>>;
+    /**
+     * One fan-out pass for the owner org's built-in `app` (`release/fanout.ts`): the other orgs' copies are put on
+     * the commit the owner's copy runs, one after the other, in place, stopping at the first failure. Each state
+     * write takes the owner's lease on its own; no lease is held while a deploy waits.
+     */
+    private runBuiltinFanOut;
     /**
      * Phase 2 for one org: takes the copy lock of each stage copy request under the org's lease, then runs the
      * copies after the lease is released. While a copy runs, every other tick and apply for the org goes on, a
@@ -1001,8 +1033,12 @@ export declare class FoundryPlanApply implements PlanApply {
      * only the ref.
      */
     private heldEnvReadiness;
+    /** #886: the head of an own org's declared auth branch, or nothing when the org is not own or the executor has no read. */
+    private ownAuthHeadFor;
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
     private ownMailKeyHeld;
+    /** An own org's registrar token is held (a rerun after a crash delivers it instead of blocking). */
+    private ownRegistrarTokenHeld;
     /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
     private ownResumableRefs;
     /**

package/dist/plan/plan-apply.js

@@ -4,6 +4,7 @@ import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { sfuSlotPorts } from '../calls-sfu.js';
 import { ORG_SERVICE_SCHEMAS, heldEnvRef, ownsServices, validateHosting } from '../org.js';
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
+import { runBuiltinFanOut } from '../release/fanout.js';
 import { recordedFrom, releaseKeys } from '../release/state.js';
 import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
@@ -1338,6 +1339,16 @@ export class FoundryPlanApply {
                 settle('platform', e);
             }
         }
+        // Between the phases: once the owner's Boule or Agora is fully live, copy it to every other org. Its errors
+        // are reported by app, never as an org.
+        for (const app of ['boule', 'agora']) {
+            try {
+                await this.runBuiltinFanOut(app);
+            }
+            catch (e) {
+                settle(`fanout:${app}`, e);
+            }
+        }
         // Phase 2: the copies, one subject at a time. A copy takes its lock under the org's lease and runs without it.
         for (const { target, run } of copying) {
             try {
@@ -1350,6 +1361,65 @@ export class FoundryPlanApply {
         }
         return results;
     }
+    /**
+     * One fan-out pass for the owner org's built-in `app` (`release/fanout.ts`): the other orgs' copies are put on
+     * the commit the owner's copy runs, one after the other, in place, stopping at the first failure. Each state
+     * write takes the owner's lease on its own; no lease is held while a deploy waits.
+     */
+    async runBuiltinFanOut(app) {
+        const store = this.releaseStore;
+        const platform = await this.platformDeps?.store.get();
+        if (!store || !platform || !this.executor.deployBuiltinAt)
+            return;
+        const ownerOrgId = platform.ownerOrgId;
+        const owner = await this.store.get(ownerOrgId);
+        if (!owner)
+            return;
+        const empty = { orgId: ownerOrgId, steps: [], unmanaged: [] };
+        if ((await this.authz.canApplyPlatform?.(this.actor)) !== true) {
+            await this.refusePlatform(empty, ownerOrgId, 'not authorized to run the release tick');
+            throw new NotAuthorizedError(this.actor, ownerOrgId);
+        }
+        const deploy = this.executor.deployBuiltinAt.bind(this.executor);
+        await runBuiltinFanOut({
+            ownerOrgId,
+            app,
+            ownerDeclares: owner[app]?.blueGreen !== undefined,
+            store,
+            readIds: async () => ({
+                ...((await this.store.getAppliedState(ownerOrgId))?.serviceIds ?? {}),
+            }),
+            write: (writes) => this.withMutationLease(companyScope(ownerOrgId), (reason) => this.refuse(empty, reason), async (fence) => {
+                const previous = await this.store.getAppliedState(ownerOrgId);
+                if (!previous)
+                    throw new Error('the owner org has no applied state');
+                const serviceIds = { ...previous.serviceIds };
+                for (const [key, value] of Object.entries(writes)) {
+                    if (value === null)
+                        delete serviceIds[key];
+                    else
+                        serviceIds[key] = value;
+                }
+                await this.store.putAppliedState({ ...previous, serviceIds }, fence);
+            }),
+            targets: async () => {
+                const others = (await this.store.list()).filter((o) => o.id !== ownerOrgId && o[app] !== undefined);
+                return others.map((o) => ({ orgId: o.id, slug: o.slug }));
+            },
+            // Re-reads the org fresh right before its own deploy, never from a list taken when the pass
+            // started: a deploy can wait many minutes with no lease held on the target org (CLAUDE.md,
+            // "Built-in fan-out"), so an ordinary `apply()` to a later-in-order org can turn its own
+            // blue/green on in that window, and `deployBuiltinAt`'s guard must see that, not a stale copy.
+            deploy: async (target, sha) => {
+                const org = await this.store.get(target.orgId);
+                if (!org || org[app] === undefined)
+                    return { ok: false, reason: 'org not found' };
+                const recordedIds = (await this.store.getAppliedState(org.id))?.serviceIds ?? {};
+                return deploy({ app, org, recordedIds, sha });
+            },
+            now: this.now,
+        });
+    }
     /**
      * Phase 2 for one org: takes the copy lock of each stage copy request under the org's lease, then runs the
      * copies after the lease is released. While a copy runs, every other tick and apply for the org goes on, a
@@ -1648,7 +1718,9 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            customersLoginPolicy: this.executor.customersLoginPolicyAvailable?.() ?? true,
             customersDirectory: this.executor.customersDirectoryAvailable?.() ?? false,
+            customersDirectoryRoles: this.executor.customersDirectoryRolesAvailable?.() ?? false,
             bouleArchonCredential: this.executor.bouleArchonCredentialAvailable?.() ?? false,
             ...(blueGreenServers ? { blueGreenServers } : {}),
             ...(stageSinkDown ? { stageSinkDown } : {}),
@@ -1671,6 +1743,10 @@ export class FoundryPlanApply {
             ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
             ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ownSigninMailWritable: this.executor.ownSigninMailWritable?.() ?? true,
+            ...(await this.ownAuthHeadFor(org, platformReadiness)),
+            registrarGrants: this.executor.registrarGrantsAvailable?.() ?? false,
+            ownRegistrarTokenWritable: this.executor.ownRegistrarTokenWritable?.(),
+            ownRegistrarTokenHeld: await this.ownRegistrarTokenHeld(org),
             ...(this.backupGate
                 ? {
                     backupStorageUuid: (await this.platformDeps?.store.getServiceIds())?.[PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY] || null,
@@ -1894,6 +1970,14 @@ export class FoundryPlanApply {
         }
         return { store: Boolean(heldKeys), refs, differs, unreadable, invalid };
     }
+    /** #886: the head of an own org's declared auth branch, or nothing when the org is not own or the executor has no read. */
+    async ownAuthHeadFor(org, readiness) {
+        const gitRef = readiness.serviceGitRefs?.auth;
+        if (!ownsServices(org) || !gitRef || !this.executor.ownAuthHead)
+            return {};
+        const head = await this.executor.ownAuthHead(gitRef);
+        return head ? { ownAuthHead: head } : {};
+    }
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
     async ownMailKeyHeld(org) {
         const held = this.platformDeps?.heldKeys;
@@ -1901,6 +1985,13 @@ export class FoundryPlanApply {
             return false;
         return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.brokerMailKey);
     }
+    /** An own org's registrar token is held (a rerun after a crash delivers it instead of blocking). */
+    async ownRegistrarTokenHeld(org) {
+        const held = this.platformDeps?.heldKeys;
+        if (!ownsServices(org) || !held)
+            return false;
+        return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.registrarToken);
+    }
     /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
     async ownResumableRefs(org) {
         const held = this.platformDeps?.heldKeys;

package/dist/plan/platform-diff.d.ts

@@ -70,16 +70,18 @@ export declare const AUTH_TUNNEL_ROUTES_VERSION = "2";
 export declare const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = "auth_tunnel_routes_applied";
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
+ * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
  */
-export declare const AUTH_LOGIN_ENV_VERSION = "1";
+export declare const AUTH_LOGIN_ENV_VERSION = "2";
 /**
- * What the login apps' env is written for: the version and the sender address (`LOGIN_MAIL_FROM`).
- * The address is no secret; a new mail domain gives a new marker, so the step is planned again.
+ * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
+ * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).
+ * Neither is a secret; a new mail domain or a changed RP ID gives a new marker, so the step is planned again.
  */
-export declare function authLoginEnvMarker(smtpSender: string): string;
+export declare function authLoginEnvMarker(smtpSender: string, passkeyRpId?: string): string;
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export declare const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = "auth_login_env_applied";
 /**
@@ -1327,6 +1329,8 @@ export interface PlanPlatformOptions {
         authMailKeyHeld?: boolean;
         /** C3: why the owner's invite cannot be made (no work address, no mail port). The rest of the step still plans. */
         authOwnerInvite?: string;
+        /** The broker's registrar token was minted and never held: reported, nothing planned for it. */
+        authRegistrar?: string;
         files?: string;
         integrations?: string;
         ai?: string;

package/dist/plan/platform-diff.js

@@ -77,17 +77,19 @@ export const AUTH_TUNNEL_ROUTES_VERSION = '2';
 export const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = 'auth_tunnel_routes_applied';
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
+ * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
  */
-export const AUTH_LOGIN_ENV_VERSION = '1';
+export const AUTH_LOGIN_ENV_VERSION = '2';
 /**
- * What the login apps' env is written for: the version and the sender address (`LOGIN_MAIL_FROM`).
- * The address is no secret; a new mail domain gives a new marker, so the step is planned again.
+ * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
+ * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).
+ * Neither is a secret; a new mail domain or a changed RP ID gives a new marker, so the step is planned again.
  */
-export function authLoginEnvMarker(smtpSender) {
-    return `${AUTH_LOGIN_ENV_VERSION}:${smtpSender}`;
+export function authLoginEnvMarker(smtpSender, passkeyRpId) {
+    return `${AUTH_LOGIN_ENV_VERSION}:${smtpSender}${passkeyRpId ? `:${passkeyRpId}` : ''}`;
 }
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = 'auth_login_env_applied';
@@ -1553,7 +1555,7 @@ export function planPlatform(platform, live, options = {}) {
     // reconcile below can be planned in the *same* round hc first comes up,
     // the same way files/mail/archon are planned in auth's own first round.
     const hcReady = hc.step !== null || Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_HC_KEY)]);
-    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false, blocked.authMailKeyHeld ?? true);
+    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false, blocked.authMailKeyHeld ?? true, blocked.authRegistrar);
     if (auth.step)
         plannedSteps.push(auth.step);
     // #174: the integrations host. Planned after auth; neither step reads the
@@ -2229,11 +2231,15 @@ function planSfu(platform, callsOrgSlugs, recordedIds) {
  * promising "this apply re-mints" while one of those is still missing would
  * be wrong the moment it is read.
  */
-function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false, mailKeyHeld = true) {
+function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false, mailKeyHeld = true, registrarBlocked) {
     if (!platform.auth.enabled)
         return { step: null, blocked: null };
-    // C3/S2: standing notes. The invite and the domain wait on a person; they hold nothing else back.
-    const standing = [ownerInviteBlocked, ownerDomainBlockedText(recordedIds)].filter((t) => Boolean(t));
+    // C3/S2: standing notes. The invite, the registrar token and the domain wait on a person; they hold nothing else back.
+    const standing = [
+        ownerInviteBlocked,
+        registrarBlocked,
+        ownerDomainBlockedText(recordedIds),
+    ].filter((t) => Boolean(t));
     const standingNote = standing.length > 0 ? standing.join('; ') : null;
     const key = resourceKey('coolify', 'app', PLATFORM_AUTH_KEY);
     const connectorApplied = Boolean(recordedIds[PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY]);