@wtfalch/foundry 0.71.0 → 0.72.0

package/dist/plan/own-diff.d.ts

@@ -52,7 +52,35 @@ export declare const OWN_AUTH_BLOCKED_KEY = "own-auth";
 export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export declare const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = "own_auth_applied_git_ref";
+/** The Git repository the company's login app, in-app login app and broker are built from. */
+export declare const OWN_AUTH_REPOSITORY = "wtfalch/auth";
+/** What the host read of the declared auth branch: its head commit, or why it could not be read (fixed text). */
+export type OwnAuthHead = {
+    commit: string;
+} | {
+    failed: string;
+};
+/**
+ * True for a declared auth ref whose head can move: not a commit and not a release tag (`v1.2.3`, `1.2`).
+ * A tag or a commit already names one build, so it is never read.
+ */
+export declare function isBranchRef(ref: string): boolean;
+/**
+ * The company's auth apps a moved branch head redeploys, with the name their `built_commit_<name>` is recorded
+ * under. The in-app login app is listed once it is recorded; the broker once it was ever deployed (before that it
+ * crash-loops on missing inputs and is not redeployed, so it never records a build).
+ */
+export declare function ownAuthBuildApps(org: Pick<DeclaredOrg, 'slug'>, recordedIds: Readonly<Record<string, string>>): Array<{
+    id: string;
+    name: string;
+}>;
 export interface PlanOwnAuthOptions {
+    /**
+     * #886: the head of the declared auth branch, read by the executor (`FoundryStepExecutor.ownAuthHead`).
+     * Absent: not read (a tag, a commit, or a host without the read), so only the declared ref decides.
+     * A failed read plans nothing from the head and is reported.
+     */
+    authHead?: OwnAuthHead;
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
     readiness: OrgPlatformReadiness;
@@ -76,6 +104,10 @@ export interface PlanOwnAuthOptions {
     signinDbBackupConfigured?: boolean;
     /** The host's ZITADEL port can write the sign-in mail text and look. Default true. False: the marker is not required. */
     signinMailWritable?: boolean;
+    /** The host's ZITADEL port can make the broker's registrar token. True: it is asked for. False: reported blocked. Absent: neither. */
+    registrarTokenWritable?: boolean;
+    /** The registrar token's held-key ref holds a value, so a rerun after a crash delivers it. Default false. */
+    registrarTokenHeld?: boolean;
 }
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app

package/dist/plan/own-diff.js

@@ -3,18 +3,20 @@ import { sfuSlotPorts } from '../calls-sfu.js';
 import { SFU_SLOT_MAX, ownsServices } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { brokerEntryAppliedScopeKey } from './broker-entries.js';
+import { REGISTRAR_TOKEN_SCOPE_KEY, REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY, registrarTokenDue, } from './broker-registrar-token.js';
+import { builtCommitScopeKey } from './build-record.js';
 import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
 import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
-import { ownHostnames } from './own-hostnames.js';
+import { ownHostnames, passkeyRpIdFor } from './own-hostnames.js';
 import { JOBS_PUBLIC_URL_SCOPE_KEY, OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY } from './own-jobs-route.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
-import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
-import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
-import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
+import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn, signInLoginNames } from './sign-in.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, signinDbCertDue } from './signin-db-tls.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db.js';
@@ -126,6 +128,39 @@ export const OWN_AUTH_BLOCKED_KEY = 'own-auth';
 export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'own_auth_applied_git_ref';
+/** The Git repository the company's login app, in-app login app and broker are built from. */
+export const OWN_AUTH_REPOSITORY = 'wtfalch/auth';
+const FULL_SHA = /^[0-9a-f]{40}$/;
+/**
+ * True for a declared auth ref whose head can move: not a commit and not a release tag (`v1.2.3`, `1.2`).
+ * A tag or a commit already names one build, so it is never read.
+ */
+export function isBranchRef(ref) {
+    return !FULL_SHA.test(ref) && !/^v?\d+\.\d+/.test(ref);
+}
+/**
+ * The company's auth apps a moved branch head redeploys, with the name their `built_commit_<name>` is recorded
+ * under. The in-app login app is listed once it is recorded; the broker once it was ever deployed (before that it
+ * crash-loops on missing inputs and is not redeployed, so it never records a build).
+ */
+export function ownAuthBuildApps(org, recordedIds) {
+    const target = orgTarget(org);
+    const apps = [
+        { id: recordedIds[PLATFORM_AUTH_LOGIN_SCOPE_KEY], name: target.names.authLogin },
+        { id: recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY], name: signInLoginNames(target).name },
+        {
+            id: recordedIds[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY]
+                ? recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY]
+                : undefined,
+            name: target.names.authBroker,
+        },
+    ];
+    return apps.filter((app) => Boolean(app.id));
+}
+/** True when the read head differs from the commit any of the company's auth apps was last built from. */
+function authHeadMoved(org, recordedIds, head) {
+    return ownAuthBuildApps(org, recordedIds).some((app) => recordedIds[builtCommitScopeKey(app.name)] !== head);
+}
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
  * and the broker in the org's own Coolify project, at `auth.<domain>`.
@@ -197,7 +232,21 @@ export function planOwnAuth(options) {
             return blocked('the host supplies no backup bucket for the sign-in database');
         }
     }
+    const registrarDue = options.registrarTokenWritable === true && registrarTokenDue(org, recordedIds);
+    // A token minted whose hold did not finish is never minted again: a person removes the marker.
+    if (registrarDue &&
+        recordedIds[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY] &&
+        !recordedIds[REGISTRAR_TOKEN_SCOPE_KEY] &&
+        !options.registrarTokenHeld) {
+        return blocked(`the broker's registrar token of ZITADEL machine user ${recordedIds[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY]} was minted but never confirmed held; remove the recorded key ${REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make a new one`);
+    }
     const hostname = names.auth;
+    // #886: a branch head that moved past what the auth apps were built from plans the step again. A failed read
+    // plans nothing from the head and is reported, so a broken read never loops.
+    const head = options.authHead;
+    const headCommit = head && 'commit' in head ? head.commit : undefined;
+    const headFailed = head && 'failed' in head ? head.failed : undefined;
+    const headMoved = headCommit !== undefined && authHeadMoved(org, recordedIds, headCommit);
     // The broker starts only on a valid `AUTH_APPS`, and the login client is minted only once it does:
     // the first broker entry is what lets this step finish, as the platform's first registration does.
     // Archon's registration is an entry too; the platform records it, not this org, so it comes in
@@ -219,7 +268,7 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY] === AUTH_TUNNEL_ROUTES_VERSION &&
         // The login apps' mail env (`LOGIN_MAIL_FROM`, the Lettermint key); a stack from before it is written again.
         recordedIds[PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY] ===
-            authLoginEnvMarker(`noreply@${names.mailDomain}`) &&
+            authLoginEnvMarker(`noreply@${names.mailDomain}`, passkeyRpIdFor(org)) &&
         // The code mail carries the company's name and design; an older apply, or a renamed company, writes it again.
         (options.signinMailWritable === false ||
             recordedIds[PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY] === signinMailMarker(org.displayName)) &&
@@ -234,15 +283,23 @@ export function planOwnAuth(options) {
         !signinDbCertDue(recordedIds, options.now ?? Date.now()) &&
         !signinDbBackupMissing(recordedIds) &&
         // ZITADEL was started on the TLS database and never seen healthy there: the step starts it again.
-        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY]) {
+        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY] &&
+        !headMoved &&
+        // The broker's registrar token (a company with customers or apps): made, or adopted, and covering the recorded organisations.
+        !registrarDue) {
         // Applied and otherwise done: say why the mail stays ZITADEL's stock text, once.
         const mailMissing = options.signinMailWritable === false &&
             recordedIds[PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY] !== signinMailMarker(org.displayName);
+        const registrarMissing = options.registrarTokenWritable === false && registrarTokenDue(org, recordedIds);
         return {
             step: null,
-            blocked: mailMissing
-                ? `${org.slug}'s sign-in mail keeps ZITADEL's default text: the host cannot write message texts`
-                : null,
+            blocked: headFailed
+                ? `${org.slug}'s auth apps were not checked for a newer auth commit: ${headFailed}`
+                : registrarMissing
+                    ? `${org.slug}'s sign-in broker has no registrar token: the host cannot make it, so its apps cannot register sign-in`
+                    : mailMissing
+                        ? `${org.slug}'s sign-in mail keeps ZITADEL's default text: the host cannot write message texts`
+                        : null,
         };
     }
     return {
@@ -252,7 +309,7 @@ export function planOwnAuth(options) {
                 system: 'coolify',
                 kind: 'own-auth',
                 key: org.id,
-                desired: { hostname, gitRef },
+                desired: { hostname, gitRef, ...(headCommit ? { head: headCommit } : {}) },
             },
             step: {
                 description: `provision ${org.slug}'s own sign-in at ${hostname}`,

package/dist/plan/own-hostnames.d.ts

@@ -27,3 +27,11 @@ export interface OwnHostnames {
  * {@link loginHostnameFor}, so the two cannot disagree.
  */
 export declare function ownHostnames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'issuer' | 'mail'>): OwnHostnames;
+/**
+ * The WebAuthn RP ID for a company's login apps (`LOGIN_PASSKEY_RP_ID`): the company's own domain, which
+ * `auth.<domain>` and the in-app hosts (`agora.<domain>`, `boule.<domain>`) all sit under, so one passkey
+ * works on each. Undefined for a company without its own sign-in domain: its `<slug>-auth.oikos.host` shares
+ * `oikos.host` with every other company, so an RP ID there would span companies. The login app refuses a
+ * host outside the RP ID, so a company's hosts stay under its domain or the variable stays unset.
+ */
+export declare function passkeyRpIdFor(org: Pick<DeclaredOrg, 'domain' | 'issuer'>): string | undefined;

package/dist/plan/own-hostnames.js

@@ -23,3 +23,17 @@ export function ownHostnames(org) {
         mailDomain: mailOnDomain && domain ? domain : `${slug}.${NO_DOMAIN_ZONE}`,
     };
 }
+const BARE_DOMAIN = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/**
+ * The WebAuthn RP ID for a company's login apps (`LOGIN_PASSKEY_RP_ID`): the company's own domain, which
+ * `auth.<domain>` and the in-app hosts (`agora.<domain>`, `boule.<domain>`) all sit under, so one passkey
+ * works on each. Undefined for a company without its own sign-in domain: its `<slug>-auth.oikos.host` shares
+ * `oikos.host` with every other company, so an RP ID there would span companies. The login app refuses a
+ * host outside the RP ID, so a company's hosts stay under its domain or the variable stays unset.
+ */
+export function passkeyRpIdFor(org) {
+    const domain = org.domain?.toLowerCase();
+    if (!domain || !org.issuer.usesDomain || !BARE_DOMAIN.test(domain))
+        return undefined;
+    return domain;
+}

package/dist/plan/own-services.d.ts

@@ -61,6 +61,8 @@ export interface ServiceTarget {
     };
     readonly refs: {
         instanceBearer: string;
+        /** The sign-in broker's ZITADEL registrar token (`ZITADEL_REGISTRAR_TOKEN`), held after its one mint. */
+        registrarToken: string;
         authAdmin: string;
         brokerMailKey: string;
         /** The connection string of the database for the broker's customer workspaces: foundry holds it after making the database, or the operator holds one first. */
@@ -209,4 +211,9 @@ export interface OwnServicesPort {
     /** Builds the ZITADEL port for one company instance. */
     zitadelFor(instance: OwnAuthInstance): ZitadelPort;
     provision: OwnServicesProvision;
+    /**
+     * #886: the head commit (40 hex characters) of `ref` in the Git repository `repository` (`owner/name`).
+     * Absent: a moved auth branch is not noticed. The executor puts a timeout on every call.
+     */
+    readBranchHead?(repository: string, ref: string): Promise<string>;
 }

package/dist/plan/own-services.js

@@ -46,6 +46,7 @@ export function platformTarget() {
         },
         refs: {
             instanceBearer: 'zitadel:platform:instanceBearer',
+            registrarToken: 'zitadel:platform:registrarToken',
             authAdmin: 'zitadel:platform:admin',
             brokerMailKey: 'lettermint:platform:apiToken',
             brokerWorkspacesDatabase: 'auth:platform:workspacesDatabaseUrl',
@@ -103,6 +104,7 @@ export function orgTarget(org) {
         },
         refs: {
             instanceBearer: `zitadel:org:${s}:instanceBearer`,
+            registrarToken: `zitadel:org:${s}:registrarToken`,
             authAdmin: `zitadel:org:${s}:admin`,
             brokerMailKey: `lettermint:org:${s}:apiToken`,
             brokerWorkspacesDatabase: `auth:org:${s}:workspacesDatabaseUrl`,

package/dist/plan/plan-apply.d.ts

@@ -18,6 +18,7 @@ import type { GithubDeployKeysPort } from './github-deploy-keys.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
+import type { OwnAuthHead } from './own-diff.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
@@ -212,8 +213,12 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** Whether the ZITADEL port can set the customers organisation's login policy. Absent: planned, as before. */
+    customersLoginPolicyAvailable?(): boolean;
     /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
     customersDirectoryAvailable?(): boolean;
+    /** Whether the ZITADEL port can grant the directory user its customer removal role. */
+    customersDirectoryRolesAvailable?(): boolean;
     /** C3: whether the host supplied `mintBouleArchonCredential`. */
     bouleArchonCredentialAvailable?(): boolean;
     /** Every Coolify server with whether it is usable and reachable; blue/green plans copies on each. Optional: an executor without it plans no blue/green. */
@@ -264,6 +269,12 @@ export interface StepExecutor {
     ownSigninDbBackupConfigured?(): boolean;
     /** Whether the host's company ZITADEL port can write the sign-in mail text and look. Absent: true. */
     ownSigninMailWritable?(): boolean;
+    /** #886: reads the head of the declared auth branch for an own org; `undefined` when there is nothing to read. */
+    ownAuthHead?(gitRef: string): Promise<OwnAuthHead | undefined>;
+    /** Whether the host's ZITADEL port can grant the shared sign-in's registrar user a company's organisations. Absent: false. */
+    registrarGrantsAvailable?(): boolean;
+    /** Whether the host's company ZITADEL port can make the broker's registrar token. Absent: the planner neither asks for it nor reports it. */
+    ownRegistrarTokenWritable?(): boolean;
     /**
      * Whether the host's scoped ports for this own org include a files-organisation
      * port. The planner plans no `files:organisation` step for an own org while
@@ -1022,8 +1033,12 @@ export declare class FoundryPlanApply implements PlanApply {
      * only the ref.
      */
     private heldEnvReadiness;
+    /** #886: the head of an own org's declared auth branch, or nothing when the org is not own or the executor has no read. */
+    private ownAuthHeadFor;
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
     private ownMailKeyHeld;
+    /** An own org's registrar token is held (a rerun after a crash delivers it instead of blocking). */
+    private ownRegistrarTokenHeld;
     /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
     private ownResumableRefs;
     /**

package/dist/plan/plan-apply.js

@@ -1718,7 +1718,9 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            customersLoginPolicy: this.executor.customersLoginPolicyAvailable?.() ?? true,
             customersDirectory: this.executor.customersDirectoryAvailable?.() ?? false,
+            customersDirectoryRoles: this.executor.customersDirectoryRolesAvailable?.() ?? false,
             bouleArchonCredential: this.executor.bouleArchonCredentialAvailable?.() ?? false,
             ...(blueGreenServers ? { blueGreenServers } : {}),
             ...(stageSinkDown ? { stageSinkDown } : {}),
@@ -1741,6 +1743,10 @@ export class FoundryPlanApply {
             ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
             ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ownSigninMailWritable: this.executor.ownSigninMailWritable?.() ?? true,
+            ...(await this.ownAuthHeadFor(org, platformReadiness)),
+            registrarGrants: this.executor.registrarGrantsAvailable?.() ?? false,
+            ownRegistrarTokenWritable: this.executor.ownRegistrarTokenWritable?.(),
+            ownRegistrarTokenHeld: await this.ownRegistrarTokenHeld(org),
             ...(this.backupGate
                 ? {
                     backupStorageUuid: (await this.platformDeps?.store.getServiceIds())?.[PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY] || null,
@@ -1964,6 +1970,14 @@ export class FoundryPlanApply {
         }
         return { store: Boolean(heldKeys), refs, differs, unreadable, invalid };
     }
+    /** #886: the head of an own org's declared auth branch, or nothing when the org is not own or the executor has no read. */
+    async ownAuthHeadFor(org, readiness) {
+        const gitRef = readiness.serviceGitRefs?.auth;
+        if (!ownsServices(org) || !gitRef || !this.executor.ownAuthHead)
+            return {};
+        const head = await this.executor.ownAuthHead(gitRef);
+        return head ? { ownAuthHead: head } : {};
+    }
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
     async ownMailKeyHeld(org) {
         const held = this.platformDeps?.heldKeys;
@@ -1971,6 +1985,13 @@ export class FoundryPlanApply {
             return false;
         return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.brokerMailKey);
     }
+    /** An own org's registrar token is held (a rerun after a crash delivers it instead of blocking). */
+    async ownRegistrarTokenHeld(org) {
+        const held = this.platformDeps?.heldKeys;
+        if (!ownsServices(org) || !held)
+            return false;
+        return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.registrarToken);
+    }
     /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
     async ownResumableRefs(org) {
         const held = this.platformDeps?.heldKeys;

package/dist/plan/platform-diff.d.ts

@@ -70,16 +70,18 @@ export declare const AUTH_TUNNEL_ROUTES_VERSION = "2";
 export declare const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = "auth_tunnel_routes_applied";
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
+ * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
  */
-export declare const AUTH_LOGIN_ENV_VERSION = "1";
+export declare const AUTH_LOGIN_ENV_VERSION = "2";
 /**
- * What the login apps' env is written for: the version and the sender address (`LOGIN_MAIL_FROM`).
- * The address is no secret; a new mail domain gives a new marker, so the step is planned again.
+ * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
+ * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).
+ * Neither is a secret; a new mail domain or a changed RP ID gives a new marker, so the step is planned again.
  */
-export declare function authLoginEnvMarker(smtpSender: string): string;
+export declare function authLoginEnvMarker(smtpSender: string, passkeyRpId?: string): string;
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export declare const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = "auth_login_env_applied";
 /**
@@ -1327,6 +1329,8 @@ export interface PlanPlatformOptions {
         authMailKeyHeld?: boolean;
         /** C3: why the owner's invite cannot be made (no work address, no mail port). The rest of the step still plans. */
         authOwnerInvite?: string;
+        /** The broker's registrar token was minted and never held: reported, nothing planned for it. */
+        authRegistrar?: string;
         files?: string;
         integrations?: string;
         ai?: string;

package/dist/plan/platform-diff.js

@@ -77,17 +77,19 @@ export const AUTH_TUNNEL_ROUTES_VERSION = '2';
 export const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = 'auth_tunnel_routes_applied';
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
+ * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
  */
-export const AUTH_LOGIN_ENV_VERSION = '1';
+export const AUTH_LOGIN_ENV_VERSION = '2';
 /**
- * What the login apps' env is written for: the version and the sender address (`LOGIN_MAIL_FROM`).
- * The address is no secret; a new mail domain gives a new marker, so the step is planned again.
+ * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
+ * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).
+ * Neither is a secret; a new mail domain or a changed RP ID gives a new marker, so the step is planned again.
  */
-export function authLoginEnvMarker(smtpSender) {
-    return `${AUTH_LOGIN_ENV_VERSION}:${smtpSender}`;
+export function authLoginEnvMarker(smtpSender, passkeyRpId) {
+    return `${AUTH_LOGIN_ENV_VERSION}:${smtpSender}${passkeyRpId ? `:${passkeyRpId}` : ''}`;
 }
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = 'auth_login_env_applied';
@@ -1553,7 +1555,7 @@ export function planPlatform(platform, live, options = {}) {
     // reconcile below can be planned in the *same* round hc first comes up,
     // the same way files/mail/archon are planned in auth's own first round.
     const hcReady = hc.step !== null || Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_HC_KEY)]);
-    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false, blocked.authMailKeyHeld ?? true);
+    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false, blocked.authMailKeyHeld ?? true, blocked.authRegistrar);
     if (auth.step)
         plannedSteps.push(auth.step);
     // #174: the integrations host. Planned after auth; neither step reads the
@@ -2229,11 +2231,15 @@ function planSfu(platform, callsOrgSlugs, recordedIds) {
  * promising "this apply re-mints" while one of those is still missing would
  * be wrong the moment it is read.
  */
-function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false, mailKeyHeld = true) {
+function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false, mailKeyHeld = true, registrarBlocked) {
     if (!platform.auth.enabled)
         return { step: null, blocked: null };
-    // C3/S2: standing notes. The invite and the domain wait on a person; they hold nothing else back.
-    const standing = [ownerInviteBlocked, ownerDomainBlockedText(recordedIds)].filter((t) => Boolean(t));
+    // C3/S2: standing notes. The invite, the registrar token and the domain wait on a person; they hold nothing else back.
+    const standing = [
+        ownerInviteBlocked,
+        registrarBlocked,
+        ownerDomainBlockedText(recordedIds),
+    ].filter((t) => Boolean(t));
     const standingNote = standing.length > 0 ? standing.join('; ') : null;
     const key = resourceKey('coolify', 'app', PLATFORM_AUTH_KEY);
     const connectorApplied = Boolean(recordedIds[PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY]);

package/dist/plan/platform-providers.d.ts

@@ -145,11 +145,16 @@ export interface PlatformAuthDeps {
      * and the planner reports it. The port may be a proxy that answers any method name, so the host says it.
      */
     signinMailWritable?: boolean;
+    /**
+     * The host's ZITADEL port has `ensureRegistrarUser` and `mintRegistrarToken` (the broker's registrar token,
+     * `plan/broker-registrar-token.ts`). Only `true` makes it; otherwise the planner reports it blocked.
+     */
+    registrarTokenWritable?: boolean;
     /** Overrides the Lettermint SMTP relay ZITADEL is given. Absent, Lettermint exactly as before. */
     smtp?: PlatformAuthSmtp;
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'> & 
     /** An own org's sign-in database needs a volume and the CA file mount (#746); the platform's does not. */
-    Partial<Pick<CoolifyPort, 'listStorages' | 'createPersistentStorage' | 'createFileStorage'>>;
+    Partial<Pick<CoolifyPort, 'listStorages' | 'createPersistentStorage' | 'createFileStorage' | 'deleteEnv'>>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -161,7 +166,12 @@ export interface PlatformAuthDeps {
     requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp & Partial<PlatformZitadelMailBranding>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp & Partial<Pick<ZitadelPort, 'ensureRegistrarUser' | 'mintRegistrarToken'>> & Partial<PlatformZitadelMailBranding> & {
+        getOrg?: (id: string) => Promise<{
+            id: string;
+            name: string;
+        }>;
+    };
     /**
      * Mails the owner's first-sign-in link to their personal address (the same
      * port as `FoundryStepExecutorPorts.ownerInviteMail`). The link carries the
@@ -411,6 +421,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         authOtherInputsMissing?: string[];
         authMailKeyHeld?: boolean;
         authOwnerInvite?: string;
+        authRegistrar?: string;
         files?: string;
         integrations?: string;
         ai?: string;
@@ -575,6 +586,7 @@ export declare const AUTH_BROKER_MCP_PATH_PATTERN = "^/(\\.well-known/oauth-auth
 export declare const PLATFORM_AUTH_DB_SCOPE_KEY = "coolify_platform_auth_database";
 export declare const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = "coolify_platform_auth_zitadel_app";
 export declare const PLATFORM_AUTH_LOGIN_SCOPE_KEY = "coolify_platform_auth_login_app";
+export declare const PLATFORM_AUTH_ORG_NAME = "foundry";
 /**
  * #283: the ref the new instance's IAM_OWNER machine token (a PAT) is
  * delivered under, once. A host reads it back to build `zitadelForInstance`
@@ -600,6 +612,11 @@ export interface AuthStackInput {
     network: ServiceNetwork;
     /** The ZITADEL SMTP sender address. */
     smtpSender: string;
+    /**
+     * `LOGIN_PASSKEY_RP_ID` for both login apps: a bare domain every host they serve sits under (the login
+     * refuses any other). Absent: unset, and each passkey belongs to the host it was made on.
+     */
+    passkeyRpId?: string;
     /** Where the login app sends a user with no sign-in request in flight, or null to leave it unset. */
     defaultRedirectUri: string | null;
     /** The company whose owner is invited into its own sign-in org; null for a company's own stack. */
@@ -620,6 +637,11 @@ export interface AuthStackInput {
     mailBranding?: {
         companyName: string;
     };
+    /**
+     * The broker gets a registrar token (`ZITADEL_REGISTRAR_TOKEN`, `plan/broker-registrar-token.ts`) covering the
+     * instance's first organisation and these (the company's sign-in and customers organisations). Absent: none.
+     */
+    registrarOrgIds?: readonly string[];
 }
 /**
  * #168: makes `coolify:app` keyed {@link PLATFORM_AUTH_KEY} true -- a Coolify