@wtfalch/foundry 0.71.0 → 0.72.1

package/dist/plan/broker-registrar-token.js

@@ -0,0 +1,215 @@
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { customersOrgIdOf, registrarWanted } from './boule.js';
+import { withTimeout } from './call-timeout.js';
+import { testCustomersOrgKey } from './workspace-client.js';
+/**
+ * The sign-in broker's ZITADEL credential for registering apps (auth ADR 0003, "Sign-in the broker makes"):
+ * `ZITADEL_REGISTRAR_TOKEN`, a machine user of its own, never the login-client PAT. Without it the broker
+ * logs "app sign-in off" and no Boule of that sign-in can register an app that signs people in.
+ *
+ * The user (`ZitadelPort.ensureRegistrarUser`) lives in the instance's first organisation and holds the
+ * project-creator role in the company's sign-in organisation and its customers organisations. Its token is
+ * minted once (platform-step rule 1), held at the target's `refs.registrarToken`, written to the broker's env
+ * and the broker deployed. A token already on the broker's env that foundry did not make is adopted: it is
+ * recorded as applied and left alone. Never a token in an error, a log or a recorded id.
+ */
+/** The broker env that holds the token. */
+export const REGISTRAR_TOKEN_ENV = 'ZITADEL_REGISTRAR_TOKEN';
+/** The machine user's name, the same for every instance. */
+export const REGISTRAR_TOKEN_USER_NAME = 'foundry-broker-registrar';
+/** The user id of a mint whose token was not yet confirmed delivered (no `:`, so it is a rule 1 guard). Ignored once applied. */
+export const REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY = 'auth_registrar_token_undelivered';
+/** `<user id>:<pat id>` once the token is held and on the broker; `adopted` for a value foundry did not make. Never the token. */
+export const REGISTRAR_TOKEN_SCOPE_KEY = 'auth_registrar_token_applied';
+/** {@link registrarOrgsMarker} of the organisations the user was last granted the role in. */
+export const REGISTRAR_TOKEN_ORGS_SCOPE_KEY = 'auth_registrar_token_orgs';
+/** The adopted marker's value. */
+export const REGISTRAR_TOKEN_ADOPTED = 'adopted';
+/** A stop whose text names ids only, never a cause, so a caller may log it as it is. */
+export class RegistrarTokenError extends Error {
+}
+/** The held key store's read and write, and each ZITADEL call, stop at these: a hung call ends the step with a plain line. */
+const HELD_KEY_TIMEOUT_MS = 15_000;
+const ZITADEL_CALL_TIMEOUT_MS = 30_000;
+const COOLIFY_CALL_TIMEOUT_MS = 60_000;
+/** How many times the hold and the delivery are tried. */
+const DELIVER_ATTEMPTS = 3;
+/** The organisations an own company's registrar user covers besides the instance's first: its sign-in organisation and its customers organisations. */
+export function registrarOrgIdsOf(org, recorded) {
+    const customers = org.customers?.enabled === true ? customersOrgIdOf(org, recorded) : undefined;
+    const test = org.customers?.enabled === true ? recorded[testCustomersOrgKey(org.id)] : undefined;
+    return [recorded[ZITADEL_ORG_SCOPE_KEY], customers, test].filter((id) => Boolean(id));
+}
+/** What the orgs marker holds: the ids, sorted, so a reorder is no change. */
+export const registrarOrgsMarker = (orgIds) => [...new Set(orgIds)].sort().join(',');
+/**
+ * Whether the company's broker still needs this step for its token: the token is wanted (customers or apps),
+ * and it is not applied or the organisations it covers are not the ones recorded now.
+ */
+export function registrarTokenDue(org, recorded) {
+    if (!registrarWanted(org))
+        return false;
+    const applied = recorded[REGISTRAR_TOKEN_SCOPE_KEY];
+    if (!applied)
+        return true;
+    if (applied === REGISTRAR_TOKEN_ADOPTED)
+        return false;
+    return ((recorded[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] ?? '') !==
+        registrarOrgsMarker(registrarOrgIdsOf(org, recorded)));
+}
+/** The same input with a timeout on every held key, ZITADEL and Coolify call. */
+function timed(c) {
+    const { heldKeys, zitadel, coolify } = c;
+    const { ensureRegistrarUser, mintRegistrarToken } = zitadel;
+    return {
+        ...c,
+        coolify: {
+            listEnvs: (...args) => withTimeout('Coolify list env', COOLIFY_CALL_TIMEOUT_MS, () => coolify.listEnvs(...args)),
+            bulkUpsertEnvs: (...args) => withTimeout('Coolify write env', COOLIFY_CALL_TIMEOUT_MS, () => coolify.bulkUpsertEnvs(...args)),
+            deploy: (...args) => withTimeout('Coolify deploy', COOLIFY_CALL_TIMEOUT_MS, () => coolify.deploy(...args)),
+        },
+        heldKeys: heldKeys && {
+            resolve: (ref) => withTimeout('held key read', HELD_KEY_TIMEOUT_MS, () => heldKeys.resolve(ref)),
+            ...(heldKeys.put
+                ? {
+                    put: (ref, value) => withTimeout('held key write', HELD_KEY_TIMEOUT_MS, () => heldKeys.put(ref, value)),
+                }
+                : {}),
+        },
+        zitadel: {
+            ...(ensureRegistrarUser
+                ? {
+                    ensureRegistrarUser: (...args) => withTimeout('ZITADEL ensure registrar user', ZITADEL_CALL_TIMEOUT_MS, () => ensureRegistrarUser(...args)),
+                }
+                : {}),
+            ...(mintRegistrarToken
+                ? {
+                    mintRegistrarToken: (...args) => withTimeout('ZITADEL mint registrar token', ZITADEL_CALL_TIMEOUT_MS, () => mintRegistrarToken(...args)),
+                }
+                : {}),
+        },
+    };
+}
+/** Runs one try at a time, up to {@link DELIVER_ATTEMPTS}; the cause of the last failure is dropped. */
+async function retried(sleep, action) {
+    for (let attempt = 1; attempt <= DELIVER_ATTEMPTS; attempt += 1) {
+        try {
+            await action();
+            return true;
+        }
+        catch {
+            // The cause can hold the token (a Coolify validation error echoes the value), so it is dropped.
+            if (attempt < DELIVER_ATTEMPTS)
+                await sleep(1000 * attempt);
+        }
+    }
+    return false;
+}
+/**
+ * Makes the broker hold a registrar token that covers the company's organisations. Resumable: a token held
+ * but not delivered is delivered, never minted again; a token minted whose hold did not finish stops with
+ * the ids named and nothing minted (a person removes {@link REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make
+ * another). Returns what it did.
+ */
+export async function ensureBrokerRegistrarToken(input) {
+    const c = timed(input);
+    const covered = [c.homeOrgId, ...c.orgIds];
+    const wanted = registrarOrgsMarker(c.orgIds);
+    const envRows = await c.coolify.listEnvs(c.brokerAppId);
+    const live = envRows.find((e) => e.key === REGISTRAR_TOKEN_ENV && !e.is_preview)?.value;
+    if (live)
+        c.secret(live);
+    const before = c.recorded();
+    const applied = before[REGISTRAR_TOKEN_SCOPE_KEY];
+    if (applied) {
+        if (!live) {
+            // The env was lost: the held token is delivered again; with none held, nothing is made over it.
+            const held = await c.heldKeys?.resolve(c.ref);
+            if (!held) {
+                throw new RegistrarTokenError(`${c.label}: the broker has no ${REGISTRAR_TOKEN_ENV} and the registrar token is not held (ref ${c.ref}); remove ${REGISTRAR_TOKEN_SCOPE_KEY} to make a new one`);
+            }
+            c.secret(held);
+            await deliver(c, held);
+            return 'delivered';
+        }
+        if (applied !== REGISTRAR_TOKEN_ADOPTED && before[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] !== wanted) {
+            await grant(c, covered);
+            await c.record(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, wanted);
+            await c.persist();
+            return 'grants';
+        }
+        return 'unchanged';
+    }
+    const undelivered = before[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY];
+    const held = await c.heldKeys?.resolve(c.ref);
+    if (live && !undelivered && held !== live) {
+        // A value somebody set by hand (Candor FX's): kept as it is. Its user is not known, so no grants.
+        c.log(`${c.label}: the broker already has a ${REGISTRAR_TOKEN_ENV} foundry did not make; adopted, not replaced`);
+        await c.record(REGISTRAR_TOKEN_SCOPE_KEY, REGISTRAR_TOKEN_ADOPTED);
+        await c.persist();
+        return 'adopted';
+    }
+    if (undelivered && !held) {
+        throw new RegistrarTokenError(`${c.label}: the registrar token of ZITADEL machine user ${undelivered} was minted but never confirmed held; remove the recorded key ${REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make a new one`);
+    }
+    if (held) {
+        // Made by a run that stopped after holding it: delivered now, nothing minted.
+        c.secret(held);
+        await grant(c, covered);
+        await c.record(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, wanted);
+        await deliver(c, held);
+        await c.record(REGISTRAR_TOKEN_SCOPE_KEY, undelivered ? `${undelivered}:held` : 'held');
+        await c.persist();
+        return 'delivered';
+    }
+    if (typeof c.heldKeys?.put !== 'function') {
+        throw new RegistrarTokenError(`${c.label}: the held keys cannot hold the registrar token (ref ${c.ref})`);
+    }
+    if (!c.zitadel.ensureRegistrarUser || !c.zitadel.mintRegistrarToken) {
+        throw new RegistrarTokenError(`${c.label}: the host's ZITADEL port cannot make a registrar token`);
+    }
+    const { userId } = await c.zitadel.ensureRegistrarUser(covered, {
+        userName: REGISTRAR_TOKEN_USER_NAME,
+        name: 'Foundry (sign-in broker registrar)',
+    });
+    const { token, patId } = await c.zitadel.mintRegistrarToken(c.homeOrgId, userId);
+    c.secret(token);
+    // Recorded and persisted before the token goes anywhere: a crash from here on never mints a second one.
+    await c.record(REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY, userId);
+    await c.persist();
+    const put = c.heldKeys.put.bind(c.heldKeys);
+    if (!(await retried(c.sleep, () => put(c.ref, token)))) {
+        throw new RegistrarTokenError(`${c.label}: the registrar token of ZITADEL machine user ${userId} was minted but could not be held after ${DELIVER_ATTEMPTS} tries (ref ${c.ref})`);
+    }
+    await deliver(c, token, userId);
+    await c.record(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, wanted);
+    // Last: a run that failed above plans the step again.
+    await c.record(REGISTRAR_TOKEN_SCOPE_KEY, `${userId}:${patId}`);
+    await c.persist();
+    return 'minted';
+}
+async function grant(c, covered) {
+    if (!c.zitadel.ensureRegistrarUser) {
+        throw new RegistrarTokenError(`${c.label}: the host's ZITADEL port cannot grant the registrar user`);
+    }
+    try {
+        await c.zitadel.ensureRegistrarUser(covered, {
+            userName: REGISTRAR_TOKEN_USER_NAME,
+            name: 'Foundry (sign-in broker registrar)',
+        });
+    }
+    catch {
+        throw new RegistrarTokenError(`${c.label}: the registrar user could not be granted its organisations; apply again`);
+    }
+}
+/** Writes the token to the broker's env and deploys the broker, each retried; the cause is dropped. */
+async function deliver(c, token, userId) {
+    const who = userId ? ` of ZITADEL machine user ${userId}` : '';
+    const wrote = await retried(c.sleep, () => c.coolify.bulkUpsertEnvs(c.brokerAppId, [{ key: REGISTRAR_TOKEN_ENV, value: token }]));
+    // Forced: an unforced deploy answers "skipped" when one for the same commit is queued, which would let
+    // this record delivery while the running broker never sees the token.
+    const deployed = wrote && (await retried(c.sleep, () => c.coolify.deploy(c.brokerAppId, true)));
+    if (!deployed) {
+        throw new RegistrarTokenError(`${c.label}: the registrar token${who} is held but could not be delivered to the broker after ${DELIVER_ATTEMPTS} tries; the next apply delivers it again`);
+    }
+}

package/dist/plan/broker-registrar.d.ts

@@ -152,6 +152,8 @@ export declare function planBrokerRegistrar(org: DeclaredOrg, recorded: Readonly
     brokerWired: boolean;
     canHoldSecrets: boolean;
     issuerKnown: boolean;
+    /** A company on the shared sign-in whose registrar user the host can grant (`ZitadelPort.ensureRegistrarUser`). */
+    sharedGrants?: boolean;
 }): {
     deliver: boolean;
     /** Customers are off but the record cannot be taken away yet: Boule keeps its registrar env, in step with it. */

package/dist/plan/broker-registrar.js

@@ -1,6 +1,7 @@
 import { randomBytes, randomUUID } from 'node:crypto';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { AUTH_REGISTRAR_KEY_ENV, AUTH_REGISTRAR_URL_ENV, customersOrgIdOf, registrarWanted, } from './boule.js';
+import { REGISTRAR_TOKEN_ORGS_SCOPE_KEY, registrarOrgsMarker } from './broker-registrar-token.js';
 import { loginHostnameFor } from './login-host.js';
 import { brokerDeployRecordValue, missingBrokerInputs } from './platform-providers.js';
 import { testCustomersOrgKey } from './workspace-client.js';
@@ -403,7 +404,10 @@ export function planBrokerRegistrar(org, recorded, plannedSteps, host) {
     else {
         const mint = recorded[REGISTRAR_MINTED_SCOPE_KEY];
         if (mint &&
-            recorded[REGISTRAR_APPLIED_SCOPE_KEY] === registrarAppliedValue(wanted.want, mint)) {
+            recorded[REGISTRAR_APPLIED_SCOPE_KEY] === registrarAppliedValue(wanted.want, mint) &&
+            !(host.sharedGrants &&
+                recorded[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] !==
+                    registrarOrgsMarker([wanted.want.organizationId, ...wanted.want.customers]))) {
             return { deliver, keepBouleEnv: false, step: null, blocked };
         }
     }

package/dist/plan/diff.d.ts

@@ -3,6 +3,7 @@ import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.j
 import { type AgoraHostReading } from './agora.js';
 import { type BlueGreenServer } from './blue-green.js';
 import { type LiveResource } from './live.js';
+import { type OwnAuthHead } from './own-diff.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
 import { type RemoteDatabaseFacts } from './remote-database.js';
 /**
@@ -101,8 +102,12 @@ export interface PlanOrgOptions {
     ownMailKeyHeld?: boolean;
     /** The executor can mint an own org's Lettermint key (`FoundryStepExecutor.ownMailKeyMintable`). */
     ownMailKeyMintable?: boolean;
+    /** The ZITADEL port can set the customers organisation's login policy. Only `false` plans none; unset plans it. */
+    customersLoginPolicy?: boolean;
     /** C3: the executor can mint a customers directory credential (`ZitadelPort.mintOrgDirectoryReader`). */
     customersDirectory?: boolean;
+    /** The ZITADEL port can grant the directory user its customer removal role (`ZitadelPort.ensureOrgDirectoryRoles`). */
+    customersDirectoryRoles?: boolean;
     /** C3: the executor can mint Boule's Archon credential (`FoundryStepExecutorPorts.mintBouleArchonCredential`). */
     bouleArchonCredential?: boolean;
     /** The executor can store a Worker app database's CA and certificate (`FoundryStepExecutor.workerAppDbKeysPuttable`). Absent: true. */
@@ -113,6 +118,14 @@ export interface PlanOrgOptions {
     ownSigninDbKeysPuttable?: boolean;
     /** The executor's company ZITADEL port can write the sign-in mail (`FoundryStepExecutor.ownSigninMailWritable`). Absent: true. */
     ownSigninMailWritable?: boolean;
+    /** #886: the head of the declared auth branch (`FoundryStepExecutor.ownAuthHead`). Absent: not read. */
+    ownAuthHead?: OwnAuthHead;
+    /** The executor's company ZITADEL port can make the broker's registrar token. Absent: not asked for. */
+    ownRegistrarTokenWritable?: boolean;
+    /** The executor can grant the shared sign-in's registrar user its organisations (`ZitadelPort.ensureRegistrarUser`). Absent: false. */
+    registrarGrants?: boolean;
+    /** An own org's registrar token is held. Absent: false. */
+    ownRegistrarTokenHeld?: boolean;
     /** The host supplies the backup bucket the sign-in database dumps into (`FoundryStepExecutor.ownSigninDbBackupConfigured`). Absent: true. */
     ownSigninDbBackupConfigured?: boolean;
     /** The own jobs admin token's held-key ref holds a value. */

package/dist/plan/diff.js

@@ -9,7 +9,7 @@ import { planAppsDbRoute } from './apps-db-route.js';
 import { APPS_DB_BLOCKED_KEY, planAppsDb } from './apps-db.js';
 import { planAppsZones } from './apps-zones.js';
 import { bgKey, planBlueGreen, } from './blue-green.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, customersRoomValue, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_POLICY_SCOPE_KEY, CUSTOMERS_POLICY_VERSION, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, customersRoomValue, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, entryMcpProjectScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { bouleRegistrarDrift, planBrokerRegistrar } from './broker-registrar.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
@@ -265,6 +265,9 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
         signinDbKeysPuttable: options.ownSigninDbKeysPuttable ?? true,
         signinDbBackupConfigured: options.ownSigninDbBackupConfigured ?? true,
         signinMailWritable: options.ownSigninMailWritable ?? true,
+        ...(options.ownAuthHead ? { authHead: options.ownAuthHead } : {}),
+        registrarTokenWritable: options.ownRegistrarTokenWritable,
+        registrarTokenHeld: options.ownRegistrarTokenHeld ?? false,
     });
     if (ownAuth.step)
         plannedSteps.push(ownAuth.step);
@@ -470,7 +473,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     // this array order, one at a time.
     // Customers before the entries that sign them in: `pushAppEnv` and the
     // broker entry read the customers organisation's id.
-    const customers = planCustomers(org, live, claimed, recordedIds, options.zitadelOrgMetadata ?? false);
+    const customers = planCustomers(org, live, claimed, recordedIds, options.zitadelOrgMetadata ?? false, options.customersLoginPolicy !== false);
     if (customers.step)
         plannedSteps.push(customers.step);
     // The workspaces' own customers, before the clients and the workspace steps that read the organisation's id.
@@ -702,6 +705,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     const bouleCredentials = planBouleCredentials(org, recordedIds, {
         archon: options.bouleArchonCredential === true,
         directory: options.customersDirectory === true,
+        directoryRoles: options.customersDirectoryRoles === true,
     }, platformReadiness.canHoldSecrets === true, (options.now ?? Date.now)());
     // F13: Boule's `CUSTOMER_GRANTS`, from the entries that declare `uses.customerGrants`. Every reason it
     // says nothing yet is a plan line, never silence.
@@ -723,6 +727,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
         brokerWired: options.broker ?? false,
         canHoldSecrets: platformReadiness.canHoldSecrets === true,
         issuerKnown: Boolean(authIssuer),
+        sharedGrants: !ownsServices(org) && options.registrarGrants === true,
     });
     const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null, platformReadiness, {
         ...bouleCredentials.wants,
@@ -3361,6 +3366,10 @@ function planBouleCredentials(org, recordedIds, host, canHoldSecrets, nowMs) {
         wants: {
             archonCredential,
             customersDirectory,
+            directoryRolesDue: customersDirectory &&
+                host.directoryRoles === true &&
+                Boolean(recordedIds[CUSTOMERS_DIRECTORY_USER_SCOPE_KEY]) &&
+                recordedIds[CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY] !== CUSTOMERS_DIRECTORY_ROLES_VERSION,
             archonRenewDue: archonCredential && archonCredentialRenewDue(recordedIds, nowMs),
         },
         blocked,
@@ -3479,6 +3488,10 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         !liveEnv[BOULE_CUSTOMERS_CREDENTIAL_ENV]) {
         drift.push(BOULE_CUSTOMERS_CREDENTIAL_ENV);
     }
+    // The directory user that predates the customer removal role: the step grants it once.
+    if (credentials.directoryRolesDue && !drift.includes(BOULE_CUSTOMERS_CREDENTIAL_ENV)) {
+        drift.push(BOULE_CUSTOMERS_CREDENTIAL_ENV);
+    }
     for (const key of staleCustomersEnv(org, liveEnv)) {
         if (!drift.includes(key))
             drift.push(key);
@@ -4721,7 +4734,7 @@ function planBouleBrokerEntry(org, recordedIds, plannedSteps, brokerWired) {
  * recorded, the live project grant to that org is claimed so it is not
  * listed as unmanaged.
  */
-function planCustomers(org, live, claimed, recordedIds, metadataWired) {
+function planCustomers(org, live, claimed, recordedIds, metadataWired, policyAvailable = true) {
     const signUp = org.customers?.signUp === true;
     const wanted = org.customers?.enabled === true ||
         org.hosting.entries.some((entry) => entry.uses?.auth?.users === 'customers');
@@ -4776,8 +4789,14 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
         blocked.push(signInMetadataBlocked(org));
     const writeSignIn = signInDiffers && metadataWired;
     const writeRoom = roomDiffers && metadataWired;
-    if (applied === wantedSignUp && !writeSignIn && !writeRoom)
+    // The login policy needs no metadata write, so it is never blocked: a stack plans it once. A host whose
+    // port cannot write it plans none, and no marker is owed.
+    const writePolicy = wanted &&
+        policyAvailable &&
+        recordedIds[CUSTOMERS_POLICY_SCOPE_KEY] !== CUSTOMERS_POLICY_VERSION;
+    if (applied === wantedSignUp && !writeSignIn && !writeRoom && !writePolicy) {
         return { step: null, blocked };
+    }
     return {
         step: {
             action: {
@@ -4794,7 +4813,9 @@ function planCustomers(org, live, claimed, recordedIds, metadataWired) {
                 description: applied === wantedSignUp
                     ? writeSignIn
                         ? `${wantedSignIn ? 'set' : 'remove'} the emailed-code sign-in metadata of ${org.slug}'s customers`
-                        : `${wantedRoom ? 'set' : 'remove'} the sign-in window text of ${org.slug}'s customers`
+                        : writeRoom
+                            ? `${wantedRoom ? 'set' : 'remove'} the sign-in window text of ${org.slug}'s customers`
+                            : `set the login policy of ${org.slug}'s customers: every sign-in method and second step an app can choose`
                     : `turn self-registration ${wantedSignUp === '1' ? 'on' : 'off'} for ${org.slug}'s customers`,
                 destroys: false,
                 migrates: false,

package/dist/plan/executor.d.ts

@@ -17,6 +17,7 @@ import type { GithubDeployKeysPort } from './github-deploy-keys.js';
 import { type KeysRegistrarPort } from './keys-registrar.js';
 import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
+import { type OwnAuthHead } from './own-diff.js';
 import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
@@ -124,6 +125,8 @@ export interface CoolifyPort {
         /** #788: where Coolify reports previews is not documented, so `previewsOn` reads both places. */
         is_preview_deployments_enabled?: boolean;
         custom_network_aliases?: string | null;
+        /** A fixed container name: while it is set Coolify runs no rolling update (`rollingUpdateSettings` clears it). */
+        custom_internal_name?: string | null;
         health_check_enabled?: boolean;
         ports_exposes?: string;
         /** Coolify's own record of the resource limits (`plan/own-limits.ts`). */
@@ -1029,6 +1032,17 @@ export interface ZitadelPort {
     enforceSecondFactor(orgId: string): Promise<{
         changed: boolean;
     }>;
+    /**
+     * Gives the customers org one fixed, permissive login policy that every customer app can narrow: username
+     * and password allowed, passkeys allowed, no forced second factor, no external IdP, an authenticator app and
+     * a security key as second factors, a user-verified passkey as the multi factor. `allowRegister` is left as
+     * it is (`allowSelfRegistration` and `closeSelfRegistration` own it). An org on the instance default gets
+     * its own policy. Idempotent: a policy already so set is no write. `zitadel-login-policy.ts` is the real
+     * implementation. Optional: a host without it plans no policy (`customersLoginPolicyAvailable`).
+     */
+    setCustomersLoginPolicy?(orgId: string): Promise<{
+        changed: boolean;
+    }>;
     /** Grants another ZITADEL org access to a project (plan gap A9). Idempotent. */
     findOrCreateProjectGrant(orgId: string, projectId: string, grantedOrgId: string): Promise<{
         created: boolean;
@@ -1156,6 +1170,33 @@ export interface ZitadelPort {
         token: string;
         patId: string;
     }>;
+    /**
+     * The sign-in broker's registrar user (`ZITADEL_REGISTRAR_TOKEN`, auth ADR 0003): a machine user of its
+     * own in `orgIds[0]` with the project-creator role in every org of `orgIds`. Idempotent, mints no token,
+     * so it is repeated whenever an org joins. Optional: a host without it gets the registrar token reported
+     * blocked. `zitadel-machine-user.ts` is the real implementation.
+     */
+    ensureRegistrarUser?(orgIds: readonly string[], input: {
+        userName: string;
+        name: string;
+    }): Promise<{
+        userId: string;
+    }>;
+    /**
+     * A fresh token for the registrar user, made in its home org (`orgIds[0]` above); every token it holds is
+     * revoked first. The caller holds the token and writes it to the broker's env; it never reaches an error,
+     * a log or a recorded id.
+     */
+    mintRegistrarToken?(homeOrgId: string, userId: string): Promise<{
+        token: string;
+        patId: string;
+    }>;
+    /**
+     * Grants the directory user the read role and the user-management role in that one organisation, replacing
+     * the roles it holds there; a user that is not a member yet is added. Idempotent. Optional: a host without
+     * it leaves the directory user read-only, and Boule cannot remove a customer.
+     */
+    ensureOrgDirectoryRoles?(orgId: string, userId: string): Promise<void>;
     /** C3: revokes every PAT of the directory reader, so a company that turns customers off leaves no live credential. A PAT already gone is not an error. */
     revokeOrgDirectoryReader?(orgId: string, userId: string): Promise<void>;
     /**
@@ -2092,8 +2133,16 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private executeScoped;
     /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
     ownMailKeyMintable(): boolean;
+    /** Whether the ZITADEL port can grant the shared sign-in's registrar user a company's organisations. */
+    registrarGrantsAvailable(): boolean;
+    /** Whether the host's company ZITADEL port can make the broker's registrar token (`provision.auth.registrarTokenWritable`). */
+    ownRegistrarTokenWritable(): boolean;
+    /** Whether the ZITADEL port can set the customers organisation's login policy. Without it no policy is planned. */
+    customersLoginPolicyAvailable(): boolean;
     /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
     customersDirectoryAvailable(): boolean;
+    /** Whether the ZITADEL port can grant the directory user its customer removal role. */
+    customersDirectoryRolesAvailable(): boolean;
     /** C3: whether the host supplied `mintBouleArchonCredential`. */
     bouleArchonCredentialAvailable(): boolean;
     /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
@@ -2103,6 +2152,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * (`provision.auth.signinMailWritable`). The port is a lazy proxy that answers any name, so it cannot be probed.
      */
     ownSigninMailWritable(): boolean;
+    /**
+     * #886: the head of the declared auth branch, read through the host's `ownServices.readBranchHead` under a
+     * timeout. `undefined` when there is nothing to read: the ref is a tag or a commit (it names one build), or the
+     * host supplies no read. A failed or malformed read is a fixed reason, never the cause (it can echo a credential).
+     */
+    ownAuthHead(gitRef: string): Promise<OwnAuthHead | undefined>;
     /** Whether the held keys can store a Worker app database's CA and certificate. */
     workerAppDbKeysPuttable(): boolean;
     /** Whether the host supplies the backup bucket a Worker app database dumps into (the files host's bucket and key ports). */
@@ -3513,6 +3568,11 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * leaves one live token. `null` while the customers organisation is not recorded yet.
      */
     private ensureCustomersDirectoryCredential;
+    /**
+     * A directory user made before it could remove customers gets that role in the customers organisation
+     * (and in no other), once: the grant is idempotent and the marker is recorded after it.
+     */
+    private ensureDirectoryRoles;
     /** The held keys with a timeout on every call: a hung store stops the step with a plain line. */
     private timedHeldKeys;
     /** T3: the company's registrar key, held at `foundry:registrar:<org id>`; either step may make it. */
@@ -3529,6 +3589,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * last and never holds the key; every error is redacted of it.
      */
     private brokerRegistrar;
+    /**
+     * A company on the shared sign-in: the platform broker's registrar user holds the project-creator role in
+     * the company's sign-in and customers organisations, so the broker can register its apps there. Repeated
+     * whenever the organisations change; no token is made here (the platform's sign-in step makes it).
+     */
+    private grantSharedRegistrar;
     private customerGrantsCredential;
     /**
      * F13, app side: an entry with `uses.customerGrants` gets `CUSTOMER_GRANTS_CREDENTIAL` (made and held first,