@wtfalch/foundry 0.71.0 → 0.72.0

package/dist/plan/broker-registrar.js

@@ -1,6 +1,7 @@
 import { randomBytes, randomUUID } from 'node:crypto';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { AUTH_REGISTRAR_KEY_ENV, AUTH_REGISTRAR_URL_ENV, customersOrgIdOf, registrarWanted, } from './boule.js';
+import { REGISTRAR_TOKEN_ORGS_SCOPE_KEY, registrarOrgsMarker } from './broker-registrar-token.js';
 import { loginHostnameFor } from './login-host.js';
 import { brokerDeployRecordValue, missingBrokerInputs } from './platform-providers.js';
 import { testCustomersOrgKey } from './workspace-client.js';
@@ -403,7 +404,10 @@ export function planBrokerRegistrar(org, recorded, plannedSteps, host) {
     else {
         const mint = recorded[REGISTRAR_MINTED_SCOPE_KEY];
         if (mint &&
-            recorded[REGISTRAR_APPLIED_SCOPE_KEY] === registrarAppliedValue(wanted.want, mint)) {
+            recorded[REGISTRAR_APPLIED_SCOPE_KEY] === registrarAppliedValue(wanted.want, mint) &&
+            !(host.sharedGrants &&
+                recorded[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] !==
+                    registrarOrgsMarker([wanted.want.organizationId, ...wanted.want.customers]))) {
             return { deliver, keepBouleEnv: false, step: null, blocked };
         }
     }

package/dist/plan/diff.d.ts

@@ -3,6 +3,7 @@ import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.j
 import { type AgoraHostReading } from './agora.js';
 import { type BlueGreenServer } from './blue-green.js';
 import { type LiveResource } from './live.js';
+import { type OwnAuthHead } from './own-diff.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
 import { type RemoteDatabaseFacts } from './remote-database.js';
 /**
@@ -101,8 +102,12 @@ export interface PlanOrgOptions {
     ownMailKeyHeld?: boolean;
     /** The executor can mint an own org's Lettermint key (`FoundryStepExecutor.ownMailKeyMintable`). */
     ownMailKeyMintable?: boolean;
+    /** The ZITADEL port can set the customers organisation's login policy. Only `false` plans none; unset plans it. */
+    customersLoginPolicy?: boolean;
     /** C3: the executor can mint a customers directory credential (`ZitadelPort.mintOrgDirectoryReader`). */
     customersDirectory?: boolean;
+    /** The ZITADEL port can grant the directory user its customer removal role (`ZitadelPort.ensureOrgDirectoryRoles`). */
+    customersDirectoryRoles?: boolean;
     /** C3: the executor can mint Boule's Archon credential (`FoundryStepExecutorPorts.mintBouleArchonCredential`). */
     bouleArchonCredential?: boolean;
     /** The executor can store a Worker app database's CA and certificate (`FoundryStepExecutor.workerAppDbKeysPuttable`). Absent: true. */
@@ -113,6 +118,14 @@ export interface PlanOrgOptions {
     ownSigninDbKeysPuttable?: boolean;
     /** The executor's company ZITADEL port can write the sign-in mail (`FoundryStepExecutor.ownSigninMailWritable`). Absent: true. */
     ownSigninMailWritable?: boolean;
+    /** #886: the head of the declared auth branch (`FoundryStepExecutor.ownAuthHead`). Absent: not read. */
+    ownAuthHead?: OwnAuthHead;
+    /** The executor's company ZITADEL port can make the broker's registrar token. Absent: not asked for. */
+    ownRegistrarTokenWritable?: boolean;
+    /** The executor can grant the shared sign-in's registrar user its organisations (`ZitadelPort.ensureRegistrarUser`). Absent: false. */
+    registrarGrants?: boolean;
+    /** An own org's registrar token is held. Absent: false. */
+    ownRegistrarTokenHeld?: boolean;
     /** The host supplies the backup bucket the sign-in database dumps into (`FoundryStepExecutor.ownSigninDbBackupConfigured`). Absent: true. */
     ownSigninDbBackupConfigured?: boolean;
     /** The own jobs admin token's held-key ref holds a value. */

package/dist/plan/diff.js

@@ -9,7 +9,7 @@ import { planAppsDbRoute } from './apps-db-route.js';
 import { APPS_DB_BLOCKED_KEY, planAppsDb } from './apps-db.js';
 import { planAppsZones } from './apps-zones.js';
 import { bgKey, planBlueGreen, } from './blue-green.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, customersRoomValue, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_POLICY_SCOPE_KEY, CUSTOMERS_POLICY_VERSION, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, customersRoomValue, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, entryMcpProjectScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { bouleRegistrarDrift, planBrokerRegistrar } from './broker-registrar.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
@@ -265,6 +265,9 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
         signinDbKeysPuttable: options.ownSigninDbKeysPuttable ?? true,
         signinDbBackupConfigured: options.ownSigninDbBackupConfigured ?? true,
         signinMailWritable: options.ownSigninMailWritable ?? true,
+        ...(options.ownAuthHead ? { authHead: options.ownAuthHead } : {}),
+        registrarTokenWritable: options.ownRegistrarTokenWritable,
+        registrarTokenHeld: options.ownRegistrarTokenHeld ?? false,
     });
     if (ownAuth.step)
         plannedSteps.push(ownAuth.step);
@@ -470,7 +473,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     // this array order, one at a time.
     // Customers before the entries that sign them in: `pushAppEnv` and the
     // broker entry read the customers organisation's id.
-    const customers = planCustomers(org, live, claimed, recordedIds, options.zitadelOrgMetadata ?? false);
+    const customers = planCustomers(org, live, claimed, recordedIds, options.zitadelOrgMetadata ?? false, options.customersLoginPolicy !== false);
     if (customers.step)
         plannedSteps.push(customers.step);
     // The workspaces' own customers, before the clients and the workspace steps that read the organisation's id.
@@ -702,6 +705,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     const bouleCredentials = planBouleCredentials(org, recordedIds, {
         archon: options.bouleArchonCredential === true,
         directory: options.customersDirectory === true,
+        directoryRoles: options.customersDirectoryRoles === true,
     }, platformReadiness.canHoldSecrets === true, (options.now ?? Date.now)());
     // F13: Boule's `CUSTOMER_GRANTS`, from the entries that declare `uses.customerGrants`. Every reason it
     // says nothing yet is a plan line, never silence.
@@ -723,6 +727,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
         brokerWired: options.broker ?? false,
         canHoldSecrets: platformReadiness.canHoldSecrets === true,
         issuerKnown: Boolean(authIssuer),
+        sharedGrants: !ownsServices(org) && options.registrarGrants === true,
     });
     const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null, platformReadiness, {
         ...bouleCredentials.wants,
@@ -3361,6 +3366,10 @@ function planBouleCredentials(org, recordedIds, host, canHoldSecrets, nowMs) {
         wants: {
             archonCredential,
             customersDirectory,
+            directoryRolesDue: customersDirectory &&
+                host.directoryRoles === true &&
+                Boolean(recordedIds[CUSTOMERS_DIRECTORY_USER_SCOPE_KEY]) &&
+                recordedIds[CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY] !== CUSTOMERS_DIRECTORY_ROLES_VERSION,
             archonRenewDue: archonCredential && archonCredentialRenewDue(recordedIds, nowMs),
         },
         blocked,
@@ -3479,6 +3488,10 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         !liveEnv[BOULE_CUSTOMERS_CREDENTIAL_ENV]) {
         drift.push(BOULE_CUSTOMERS_CREDENTIAL_ENV);
     }
+    // The directory user that predates the customer removal role: the step grants it once.
+    if (credentials.directoryRolesDue && !drift.includes(BOULE_CUSTOMERS_CREDENTIAL_ENV)) {
+        drift.push(BOULE_CUSTOMERS_CREDENTIAL_ENV);
+    }
     for (const key of staleCustomersEnv(org, liveEnv)) {
         if (!drift.includes(key))
             drift.push(key);
@@ -4721,7 +4734,7 @@ function planBouleBrokerEntry(org, recordedIds, plannedSteps, brokerWired) {
  * recorded, the live project grant to that org is claimed so it is not
  * listed as unmanaged.
  */
-function planCustomers(org, live, claimed, recordedIds, metadataWired) {
+function planCustomers(org, live, claimed, recordedIds, metadataWired, policyAvailable = true) {
     const signUp = org.customers?.signUp === true;
     const wanted = org.customers?.enabled === true ||
         org.hosting.entries.some((entry) => entry.uses?.auth?.users === 'customers');
@@ -4776,8 +4789,14 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
         blocked.push(signInMetadataBlocked(org));
     const writeSignIn = signInDiffers && metadataWired;
     const writeRoom = roomDiffers && metadataWired;
-    if (applied === wantedSignUp && !writeSignIn && !writeRoom)
+    // The login policy needs no metadata write, so it is never blocked: a stack plans it once. A host whose
+    // port cannot write it plans none, and no marker is owed.
+    const writePolicy = wanted &&
+        policyAvailable &&
+        recordedIds[CUSTOMERS_POLICY_SCOPE_KEY] !== CUSTOMERS_POLICY_VERSION;
+    if (applied === wantedSignUp && !writeSignIn && !writeRoom && !writePolicy) {
         return { step: null, blocked };
+    }
     return {
         step: {
             action: {
@@ -4794,7 +4813,9 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
                 description: applied === wantedSignUp
                     ? writeSignIn
                         ? `${wantedSignIn ? 'set' : 'remove'} the emailed-code sign-in metadata of ${org.slug}'s customers`
-                        : `${wantedRoom ? 'set' : 'remove'} the sign-in window text of ${org.slug}'s customers`
+                        : writeRoom
+                            ? `${wantedRoom ? 'set' : 'remove'} the sign-in window text of ${org.slug}'s customers`
+                            : `set the login policy of ${org.slug}'s customers: every sign-in method and second step an app can choose`
                     : `turn self-registration ${wantedSignUp === '1' ? 'on' : 'off'} for ${org.slug}'s customers`,
                 destroys: false,
                 migrates: false,

package/dist/plan/executor.d.ts

@@ -17,6 +17,7 @@ import type { GithubDeployKeysPort } from './github-deploy-keys.js';
 import { type KeysRegistrarPort } from './keys-registrar.js';
 import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
+import { type OwnAuthHead } from './own-diff.js';
 import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
@@ -124,6 +125,8 @@ export interface CoolifyPort {
         /** #788: where Coolify reports previews is not documented, so `previewsOn` reads both places. */
         is_preview_deployments_enabled?: boolean;
         custom_network_aliases?: string | null;
+        /** A fixed container name: while it is set Coolify runs no rolling update (`rollingUpdateSettings` clears it). */
+        custom_internal_name?: string | null;
         health_check_enabled?: boolean;
         ports_exposes?: string;
         /** Coolify's own record of the resource limits (`plan/own-limits.ts`). */
@@ -1029,6 +1032,17 @@ export interface ZitadelPort {
     enforceSecondFactor(orgId: string): Promise<{
         changed: boolean;
     }>;
+    /**
+     * Gives the customers org one fixed, permissive login policy that every customer app can narrow: username
+     * and password allowed, passkeys allowed, no forced second factor, no external IdP, an authenticator app and
+     * a security key as second factors, a user-verified passkey as the multi factor. `allowRegister` is left as
+     * it is (`allowSelfRegistration` and `closeSelfRegistration` own it). An org on the instance default gets
+     * its own policy. Idempotent: a policy already so set is no write. `zitadel-login-policy.ts` is the real
+     * implementation. Optional: a host without it plans no policy (`customersLoginPolicyAvailable`).
+     */
+    setCustomersLoginPolicy?(orgId: string): Promise<{
+        changed: boolean;
+    }>;
     /** Grants another ZITADEL org access to a project (plan gap A9). Idempotent. */
     findOrCreateProjectGrant(orgId: string, projectId: string, grantedOrgId: string): Promise<{
         created: boolean;
@@ -1156,6 +1170,33 @@ export interface ZitadelPort {
         token: string;
         patId: string;
     }>;
+    /**
+     * The sign-in broker's registrar user (`ZITADEL_REGISTRAR_TOKEN`, auth ADR 0003): a machine user of its
+     * own in `orgIds[0]` with the project-creator role in every org of `orgIds`. Idempotent, mints no token,
+     * so it is repeated whenever an org joins. Optional: a host without it gets the registrar token reported
+     * blocked. `zitadel-machine-user.ts` is the real implementation.
+     */
+    ensureRegistrarUser?(orgIds: readonly string[], input: {
+        userName: string;
+        name: string;
+    }): Promise<{
+        userId: string;
+    }>;
+    /**
+     * A fresh token for the registrar user, made in its home org (`orgIds[0]` above); every token it holds is
+     * revoked first. The caller holds the token and writes it to the broker's env; it never reaches an error,
+     * a log or a recorded id.
+     */
+    mintRegistrarToken?(homeOrgId: string, userId: string): Promise<{
+        token: string;
+        patId: string;
+    }>;
+    /**
+     * Grants the directory user the read role and the user-management role in that one organisation, replacing
+     * the roles it holds there; a user that is not a member yet is added. Idempotent. Optional: a host without
+     * it leaves the directory user read-only, and Boule cannot remove a customer.
+     */
+    ensureOrgDirectoryRoles?(orgId: string, userId: string): Promise<void>;
     /** C3: revokes every PAT of the directory reader, so a company that turns customers off leaves no live credential. A PAT already gone is not an error. */
     revokeOrgDirectoryReader?(orgId: string, userId: string): Promise<void>;
     /**
@@ -2092,8 +2133,16 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private executeScoped;
     /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
     ownMailKeyMintable(): boolean;
+    /** Whether the ZITADEL port can grant the shared sign-in's registrar user a company's organisations. */
+    registrarGrantsAvailable(): boolean;
+    /** Whether the host's company ZITADEL port can make the broker's registrar token (`provision.auth.registrarTokenWritable`). */
+    ownRegistrarTokenWritable(): boolean;
+    /** Whether the ZITADEL port can set the customers organisation's login policy. Without it no policy is planned. */
+    customersLoginPolicyAvailable(): boolean;
     /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
     customersDirectoryAvailable(): boolean;
+    /** Whether the ZITADEL port can grant the directory user its customer removal role. */
+    customersDirectoryRolesAvailable(): boolean;
     /** C3: whether the host supplied `mintBouleArchonCredential`. */
     bouleArchonCredentialAvailable(): boolean;
     /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
@@ -2103,6 +2152,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * (`provision.auth.signinMailWritable`). The port is a lazy proxy that answers any name, so it cannot be probed.
      */
     ownSigninMailWritable(): boolean;
+    /**
+     * #886: the head of the declared auth branch, read through the host's `ownServices.readBranchHead` under a
+     * timeout. `undefined` when there is nothing to read: the ref is a tag or a commit (it names one build), or the
+     * host supplies no read. A failed or malformed read is a fixed reason, never the cause (it can echo a credential).
+     */
+    ownAuthHead(gitRef: string): Promise<OwnAuthHead | undefined>;
     /** Whether the held keys can store a Worker app database's CA and certificate. */
     workerAppDbKeysPuttable(): boolean;
     /** Whether the host supplies the backup bucket a Worker app database dumps into (the files host's bucket and key ports). */
@@ -3513,6 +3568,11 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * leaves one live token. `null` while the customers organisation is not recorded yet.
      */
     private ensureCustomersDirectoryCredential;
+    /**
+     * A directory user made before it could remove customers gets that role in the customers organisation
+     * (and in no other), once: the grant is idempotent and the marker is recorded after it.
+     */
+    private ensureDirectoryRoles;
     /** The held keys with a timeout on every call: a hung store stops the step with a plain line. */
     private timedHeldKeys;
     /** T3: the company's registrar key, held at `foundry:registrar:<org id>`; either step may make it. */
@@ -3529,6 +3589,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * last and never holds the key; every error is redacted of it.
      */
     private brokerRegistrar;
+    /**
+     * A company on the shared sign-in: the platform broker's registrar user holds the project-creator role in
+     * the company's sign-in and customers organisations, so the broker can register its apps there. Repeated
+     * whenever the organisations change; no token is made here (the platform's sign-in step makes it).
+     */
+    private grantSharedRegistrar;
     private customerGrantsCredential;
     /**
      * F13, app side: an entry with `uses.customerGrants` gets `CUSTOMER_GRANTS_CREDENTIAL` (made and held first,

package/dist/plan/executor.js

@@ -17,11 +17,12 @@ import { APPS_ZONES_APPLIED_SCOPE_KEY, applyAppsZones, retireAppsZones } from '.
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, applyWorkspaceServer, } from './blue-green-apply.js';
 import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, mintPinKey, parseGuards, pinKeyName, splitServers, } from './blue-green.js';
 import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, BOULE_TEST_CUSTOMERS_ORG_ENV, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_ROOM_METADATA_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, BOULE_TEST_CUSTOMERS_ORG_ENV, CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_POLICY_SCOPE_KEY, CUSTOMERS_POLICY_VERSION, CUSTOMERS_ROOM_METADATA_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, entryMcp, entryMcpProjectScopeKey, mcpCallbackUri, removeBrokerEntry, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
+import { REGISTRAR_TOKEN_ORGS_SCOPE_KEY, REGISTRAR_TOKEN_USER_NAME, registrarOrgIdsOf, registrarOrgsMarker, } from './broker-registrar-token.js';
 import { AUTH_REGISTRAR_KEY_ENV, AUTH_REGISTRAR_URL_ENV, REGISTRAR_APPLIED_SCOPE_KEY, REGISTRAR_DELIVERED_SCOPE_KEY, REGISTRAR_DEPLOY_WAITS_SCOPE_KEY, REGISTRAR_MINTED_SCOPE_KEY, REGISTRAR_REMOVAL_HELD_SCOPE_KEY, appliedRegistrarOrganization, ensureRegistrarKey, registrarAppliedValue, registrarRef, registrarWanted, wantedRegistrar, writeRegistrar, } from './broker-registrar.js';
 import { BROKER_WORKSPACES_DATABASE_SCOPE_KEY, canHoldWorkspacesDatabase, ensureBrokerWorkspacesDatabase, } from './broker-workspaces-database.js';
-import { recordBuiltCommit } from './build-record.js';
+import { builtCommitScopeKey, recordBuiltCommit } from './build-record.js';
 import { CallError, withTimeout as withLabelledTimeout } from './call-timeout.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -66,15 +67,15 @@ import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
 import { provisionOrgAppsAdmin, retireOrgAppsAdmin, } from './org-apps-admin.js';
 import { ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, migrateHomeOf, migrateOrgPostgresHome, parseMigrationConfirmation, } from './org-postgres-migrate.js';
 import { orgPostgresSecretRef, provisionOrgPostgresDatabases, provisionOrgPostgresServer, serviceEndpoint, serviceOnServer, serviceUrls, } from './org-postgres.js';
-import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
-import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
+import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_REPOSITORY, isBranchRef, ownAuthBuildApps, } from './own-diff.js';
+import { NO_DOMAIN_ZONE, ownHostnames, passkeyRpIdFor } from './own-hostnames.js';
 import { provisionJobsRoute } from './own-jobs-route.js';
 import { LIMITS, limited } from './own-limits.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformTarget, scopeFromOrg, } from './own-services.js';
 import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appImageAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, entryImageFields, entryImageRef, orgDeclaresMcp, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
-import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_PROJECT, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_ORG_NAME, PLATFORM_AUTH_PROJECT, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutAppliedValue, postLogoutUrisFor, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
 import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryAppsHostnames, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsAppsZoneName, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { STAGE_DEPLOY_ATTEMPTS, STAGE_DEPLOY_INTERVAL_MS, createReleaseHost, } from './release-host.js';
@@ -146,6 +147,8 @@ const BOULE_CREDENTIAL_TIMEOUT_MS = 60_000;
 /** One read of the broker's env. */
 const BROKER_ENV_READ_TIMEOUT_MS = 15_000;
 const HELD_KEY_READ_TIMEOUT_MS = 15_000;
+/** One ZITADEL call that grants the shared registrar user its organisations. */
+const REGISTRAR_CALL_TIMEOUT_MS = 30_000;
 const BOULE_CREDENTIAL_ATTEMPTS = 3;
 /** The ZITADEL machine user that reads one company's customers organisation. */
 const CUSTOMERS_DIRECTORY_USER_NAME = 'foundry-customers-directory';
@@ -922,6 +925,8 @@ async function withTimeout(work, ms) {
         clearTimeout(timer);
     }
 }
+/** How long the host may take to read the head of the auth branch (#886). */
+const AUTH_HEAD_READ_TIMEOUT_MS = 15_000;
 /** How long one call to the jobs scheduler or the held keys, made for an entry's project, may take. */
 const JOBS_PROJECT_CALL_TIMEOUT_MS = 30_000;
 /** How many times an entry's project credentials are tried against the held keys. */
@@ -1081,11 +1086,27 @@ export class FoundryStepExecutor {
     ownMailKeyMintable() {
         return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
     }
+    /** Whether the ZITADEL port can grant the shared sign-in's registrar user a company's organisations. */
+    registrarGrantsAvailable() {
+        return typeof this.ports.zitadel.ensureRegistrarUser === 'function';
+    }
+    /** Whether the host's company ZITADEL port can make the broker's registrar token (`provision.auth.registrarTokenWritable`). */
+    ownRegistrarTokenWritable() {
+        return this.ports.ownServices?.provision.auth.registrarTokenWritable === true;
+    }
+    /** Whether the ZITADEL port can set the customers organisation's login policy. Without it no policy is planned. */
+    customersLoginPolicyAvailable() {
+        return typeof this.ports.zitadel.setCustomersLoginPolicy === 'function';
+    }
     /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
     customersDirectoryAvailable() {
         return (typeof this.ports.zitadel.mintOrgDirectoryReader === 'function' &&
             typeof this.ports.zitadel.revokeOrgDirectoryReader === 'function');
     }
+    /** Whether the ZITADEL port can grant the directory user its customer removal role. */
+    customersDirectoryRolesAvailable() {
+        return typeof this.ports.zitadel.ensureOrgDirectoryRoles === 'function';
+    }
     /** C3: whether the host supplied `mintBouleArchonCredential`. */
     bouleArchonCredentialAvailable() {
         return typeof this.ports.mintBouleArchonCredential === 'function';
@@ -1101,6 +1122,30 @@ export class FoundryStepExecutor {
     ownSigninMailWritable() {
         return this.ports.ownServices?.provision.auth.signinMailWritable === true;
     }
+    /**
+     * #886: the head of the declared auth branch, read through the host's `ownServices.readBranchHead` under a
+     * timeout. `undefined` when there is nothing to read: the ref is a tag or a commit (it names one build), or the
+     * host supplies no read. A failed or malformed read is a fixed reason, never the cause (it can echo a credential).
+     */
+    async ownAuthHead(gitRef) {
+        const read = this.ports.ownServices?.readBranchHead?.bind(this.ports.ownServices);
+        if (!read || !isBranchRef(gitRef))
+            return undefined;
+        let commit;
+        try {
+            commit = await withLabelledTimeout('auth branch head', AUTH_HEAD_READ_TIMEOUT_MS, () => read(OWN_AUTH_REPOSITORY, gitRef));
+        }
+        catch (error) {
+            return {
+                failed: error instanceof CallError && error.message.includes('no answer')
+                    ? 'the auth branch head read timed out'
+                    : 'the auth branch head read failed',
+            };
+        }
+        return /^[0-9a-f]{40}$/.test(commit)
+            ? { commit }
+            : { failed: 'the auth branch head was not a commit' };
+    }
     /** Whether the held keys can store a Worker app database's CA and certificate. */
     workerAppDbKeysPuttable() {
         return typeof this.ports.heldKeys?.put === 'function';
@@ -2756,6 +2801,11 @@ export class FoundryStepExecutor {
             await this.ports.zitadel.allowSelfRegistration(customers.id);
         else
             await this.ports.zitadel.closeSelfRegistration(customers.id);
+        // The live customers org only: the workspaces' test customers keep the instance policy. Read after the
+        // sign-up call, so the policy keeps `allowRegister` as that call left it.
+        const policyWritten = variant === LIVE_CUSTOMERS && this.customersLoginPolicyAvailable()
+            ? await this.ports.zitadel.setCustomersLoginPolicy?.(customers.id)
+            : undefined;
         await this.ports.zitadel.findOrCreateProjectGrant(zitadelOrgId, projectId, customers.id);
         // The sign-in and room metadata come before every marker: a failed write leaves both markers behind, so the next plan repeats the step.
         const signIn = await this.writeCustomersSignInMetadata(org, customers.id, action, context, variant);
@@ -2768,6 +2818,9 @@ export class FoundryStepExecutor {
             context.recordScopeId(variant.signInKey, signIn);
         if (room !== null)
             context.recordScopeId(CUSTOMERS_ROOM_SCOPE_KEY, room);
+        if (policyWritten) {
+            context.recordScopeId(CUSTOMERS_POLICY_SCOPE_KEY, CUSTOMERS_POLICY_VERSION);
+        }
         return { resourceId: customers.id };
     }
     /**
@@ -8397,20 +8450,51 @@ export class FoundryStepExecutor {
         const put = heldKeys.put;
         const ref = customersDirectoryRef(org.id);
         const held = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: read the held directory credential`, () => heldKeys.resolve(ref));
-        if (held)
+        if (held) {
+            await this.ensureDirectoryRoles(org, customersOrgId, context);
             return held;
+        }
         const minted = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: mint the directory credential`, () => zitadel.mintOrgDirectoryReader(customersOrgId, {
             userName: CUSTOMERS_DIRECTORY_USER_NAME,
-            name: 'Foundry customers directory (read-only)',
+            name: 'Foundry customers directory',
         }));
         this.handledSecrets.add(minted.token);
         context.recordScopeId(CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, minted.userId);
+        // The mint grants the same roles, so a fresh user needs no second grant.
+        if (zitadel.ensureOrgDirectoryRoles) {
+            context.recordScopeId(CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION);
+        }
         await context.persistScopeIds();
         if (!(await this.holdWithRetry(ref, minted.token, put, `${at}: hold the directory credential`))) {
             throw new Error(`${at}: the directory credential of ZITADEL user ${minted.userId} could not be held after ${BOULE_CREDENTIAL_ATTEMPTS} attempts; the next apply mints it again and revokes this one`);
         }
         return minted.token;
     }
+    /**
+     * A directory user made before it could remove customers gets that role in the customers organisation
+     * (and in no other), once: the grant is idempotent and the marker is recorded after it.
+     */
+    async ensureDirectoryRoles(org, customersOrgId, context) {
+        const recorded = context.recordedIds();
+        const userId = recorded[CUSTOMERS_DIRECTORY_USER_SCOPE_KEY];
+        const grant = this.ports.zitadel.ensureOrgDirectoryRoles;
+        if (!userId ||
+            !grant ||
+            recorded[CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY] === CUSTOMERS_DIRECTORY_ROLES_VERSION) {
+            return;
+        }
+        const at = `coolify:boule for ${org.slug}`;
+        try {
+            await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: grant the directory user`, () => grant.call(this.ports.zitadel, customersOrgId, userId));
+        }
+        catch (error) {
+            // The HTTP status says why (403 is a missing right); the body is dropped.
+            const status = error?.status;
+            throw new Error(`${at}: ZITADEL user ${userId} could not be granted its customer removal role${typeof status === 'number' ? ` (HTTP ${status})` : ''}; apply again`);
+        }
+        context.recordScopeId(CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION);
+        await context.persistScopeIds();
+    }
     /** The held keys with a timeout on every call: a hung store stops the step with a plain line. */
     timedHeldKeys() {
         const held = this.ports.heldKeys;
@@ -8559,11 +8643,39 @@ export class FoundryStepExecutor {
         catch (error) {
             throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), keys));
         }
+        await this.grantSharedRegistrar(org, wanted.want, context);
         context.recordScopeId(REGISTRAR_DEPLOY_WAITS_SCOPE_KEY, result.waits.join(', '));
         // Last: a run that failed above plans the step again.
         context.recordScopeId(REGISTRAR_APPLIED_SCOPE_KEY, registrarAppliedValue(wanted.want, mint));
         return {};
     }
+    /**
+     * A company on the shared sign-in: the platform broker's registrar user holds the project-creator role in
+     * the company's sign-in and customers organisations, so the broker can register its apps there. Repeated
+     * whenever the organisations change; no token is made here (the platform's sign-in step makes it).
+     */
+    async grantSharedRegistrar(org, want, context) {
+        const zitadel = this.ports.zitadel;
+        if (ownsServices(org) || typeof zitadel.ensureRegistrarUser !== 'function')
+            return;
+        const covered = [want.organizationId, ...want.customers];
+        const marker = registrarOrgsMarker(covered);
+        if (context.recordedIds()[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] === marker)
+            return;
+        const at = `coolify:broker-registrar for ${org.slug}`;
+        try {
+            const home = (await withCallTimeout(REGISTRAR_CALL_TIMEOUT_MS, `${at}: find the first organisation`, () => zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME))).org.id;
+            await withCallTimeout(REGISTRAR_CALL_TIMEOUT_MS, `${at}: grant the registrar user`, () => zitadel.ensureRegistrarUser([home, ...covered], {
+                userName: REGISTRAR_TOKEN_USER_NAME,
+                name: 'Foundry (sign-in broker registrar)',
+            }));
+        }
+        catch {
+            // The cause is dropped: nothing here is a secret, but ZITADEL's error can echo a request.
+            throw new Error(`coolify:broker-registrar for ${org.slug}: the registrar user could not be granted the company's organisations; apply again`);
+        }
+        context.recordScopeId(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, marker);
+    }
     customerGrantsCredential(org, entryKey, context) {
         return ensureCustomerGrantsCredential({
             orgId: org.id,
@@ -9204,8 +9316,15 @@ export class FoundryStepExecutor {
         const before = scope.recordedIds();
         const refChanged = before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== undefined &&
             before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+        // #886: the branch head the plan read. Validated here: it decides which build is recorded.
+        const head = typeof action.desired.head === 'string' && /^[0-9a-f]{40}$/.test(action.desired.head)
+            ? action.desired.head
+            : undefined;
+        const headMoved = head !== undefined &&
+            ownAuthBuildApps(org, before).some((app) => before[builtCommitScopeKey(app.name)] !== head);
         const gitApps = [
             before[PLATFORM_AUTH_LOGIN_SCOPE_KEY],
+            before[SIGN_IN_LOGIN_APP_SCOPE_KEY],
             before[PLATFORM_AUTH_BROKER_SCOPE_KEY],
         ].filter((id) => Boolean(id));
         if (refChanged) {
@@ -9225,6 +9344,7 @@ export class FoundryStepExecutor {
                 zones: this.zonePort(),
             }, scope, `${org.slug}:auth`),
             smtpSender: `noreply@${hn.mailDomain}`,
+            ...(passkeyRpIdFor(org) ? { passkeyRpId: passkeyRpIdFor(org) } : {}),
             defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,
             // In-app sign-in: the company's own stack gets the second login app. Its host table starts
@@ -9232,15 +9352,23 @@ export class FoundryStepExecutor {
             ...(inAppSignIn(org) ? { signInLogin: { bindings: null } } : {}),
             mcp: orgDeclaresMcp(org),
             mailBranding: { companyName: org.displayName },
+            ...(registrarWanted(org) && this.ownRegistrarTokenWritable()
+                ? { registrarOrgIds: registrarOrgIdsOf(org, scope.recordedIds()) }
+                : {}),
         });
-        if (refChanged) {
+        if (refChanged || headMoved) {
             const now = scope.recordedIds();
             const brokerDeployed = Boolean(now[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY]);
+            const names = new Map(ownAuthBuildApps(org, now).map((app) => [app.id, app.name]));
             for (const id of gitApps) {
                 // The broker crash-loops until its inputs exist; it was never deployed, so it is not now.
                 if (id === now[PLATFORM_AUTH_BROKER_SCOPE_KEY] && !brokerDeployed)
                     continue;
                 await deps.coolify.deploy(id, true);
+                // Recorded after the deploy was queued: a failed one leaves the old build, so the next plan repeats it.
+                const name = names.get(id);
+                if (head && name)
+                    scope.recordScopeId(builtCommitScopeKey(name), head);
             }
         }
         scope.recordScopeId(OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, hostname);

package/dist/plan/health-check-settings.d.ts

@@ -27,6 +27,19 @@
  * no live measurement to pin it to instead"). A caller whose app is known to
  * be slower or faster to boot passes its own.
  */
+/**
+ * #1054: the two fields that let Coolify run a rolling update for an app other containers reach by a fixed name.
+ * Coolify starts the new container beside the old one, waits for its check, then stops the old one, only when the
+ * app has no fixed container name (`custom_internal_name`) and the consistent-name flag is off. A network alias
+ * answers on the Docker network under the same name throughout the swap, so callers send this instead of
+ * `custom_internal_name`. The app also needs a health check to wait on (`healthCheckSettings` or
+ * {@link IMAGE_HEALTHCHECK_SETTINGS}).
+ */
+export declare function rollingUpdateSettings(alias: string): {
+    custom_network_aliases: string;
+    is_consistent_container_name_enabled: false;
+    custom_internal_name: null;
+};
 /** The four Coolify `updateApplication` fields {@link healthCheckSettings} returns. */
 export interface HealthCheckPatch {
     health_check_enabled: true;

package/dist/plan/health-check-settings.js

@@ -27,6 +27,23 @@
  * no live measurement to pin it to instead"). A caller whose app is known to
  * be slower or faster to boot passes its own.
  */
+/**
+ * #1054: the two fields that let Coolify run a rolling update for an app other containers reach by a fixed name.
+ * Coolify starts the new container beside the old one, waits for its check, then stops the old one, only when the
+ * app has no fixed container name (`custom_internal_name`) and the consistent-name flag is off. A network alias
+ * answers on the Docker network under the same name throughout the swap, so callers send this instead of
+ * `custom_internal_name`. The app also needs a health check to wait on (`healthCheckSettings` or
+ * {@link IMAGE_HEALTHCHECK_SETTINGS}).
+ */
+export function rollingUpdateSettings(alias) {
+    // `custom_internal_name: null` clears the fixed name an app made by an earlier foundry still has: with it set
+    // Coolify refuses the rolling update whatever else is patched.
+    return {
+        custom_network_aliases: alias,
+        is_consistent_container_name_enabled: false,
+        custom_internal_name: null,
+    };
+}
 /** Archon's own number (see this module's doc comment) -- the default every other caller inherits unless it knows better. */
 export const DEFAULT_HEALTH_CHECK_START_PERIOD_SECONDS = 30;
 /**