@wtfalch/foundry 0.71.0 → 0.72.1

package/dist/plan/executor.js

@@ -17,11 +17,12 @@ import { APPS_ZONES_APPLIED_SCOPE_KEY, applyAppsZones, retireAppsZones } from '.
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, applyWorkspaceServer, } from './blue-green-apply.js';
 import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, mintPinKey, parseGuards, pinKeyName, splitServers, } from './blue-green.js';
 import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, BOULE_TEST_CUSTOMERS_ORG_ENV, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_ROOM_METADATA_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, BOULE_TEST_CUSTOMERS_ORG_ENV, CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_POLICY_SCOPE_KEY, CUSTOMERS_POLICY_VERSION, CUSTOMERS_ROOM_METADATA_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, entryMcp, entryMcpProjectScopeKey, mcpCallbackUri, removeBrokerEntry, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
+import { REGISTRAR_TOKEN_ORGS_SCOPE_KEY, REGISTRAR_TOKEN_USER_NAME, registrarOrgIdsOf, registrarOrgsMarker, } from './broker-registrar-token.js';
 import { AUTH_REGISTRAR_KEY_ENV, AUTH_REGISTRAR_URL_ENV, REGISTRAR_APPLIED_SCOPE_KEY, REGISTRAR_DELIVERED_SCOPE_KEY, REGISTRAR_DEPLOY_WAITS_SCOPE_KEY, REGISTRAR_MINTED_SCOPE_KEY, REGISTRAR_REMOVAL_HELD_SCOPE_KEY, appliedRegistrarOrganization, ensureRegistrarKey, registrarAppliedValue, registrarRef, registrarWanted, wantedRegistrar, writeRegistrar, } from './broker-registrar.js';
 import { BROKER_WORKSPACES_DATABASE_SCOPE_KEY, canHoldWorkspacesDatabase, ensureBrokerWorkspacesDatabase, } from './broker-workspaces-database.js';
-import { recordBuiltCommit } from './build-record.js';
+import { builtCommitScopeKey, recordBuiltCommit } from './build-record.js';
 import { CallError, withTimeout as withLabelledTimeout } from './call-timeout.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -66,15 +67,15 @@ import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
 import { provisionOrgAppsAdmin, retireOrgAppsAdmin, } from './org-apps-admin.js';
 import { ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, migrateHomeOf, migrateOrgPostgresHome, parseMigrationConfirmation, } from './org-postgres-migrate.js';
 import { orgPostgresSecretRef, provisionOrgPostgresDatabases, provisionOrgPostgresServer, serviceEndpoint, serviceOnServer, serviceUrls, } from './org-postgres.js';
-import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
-import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
+import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_REPOSITORY, isBranchRef, ownAuthBuildApps, } from './own-diff.js';
+import { NO_DOMAIN_ZONE, ownHostnames, passkeyRpIdFor } from './own-hostnames.js';
 import { provisionJobsRoute } from './own-jobs-route.js';
 import { LIMITS, limited } from './own-limits.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformTarget, scopeFromOrg, } from './own-services.js';
 import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appImageAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, entryImageFields, entryImageRef, orgDeclaresMcp, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
-import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_PROJECT, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_ORG_NAME, PLATFORM_AUTH_PROJECT, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutAppliedValue, postLogoutUrisFor, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
 import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryAppsHostnames, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsAppsZoneName, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { STAGE_DEPLOY_ATTEMPTS, STAGE_DEPLOY_INTERVAL_MS, createReleaseHost, } from './release-host.js';
@@ -146,6 +147,8 @@ const BOULE_CREDENTIAL_TIMEOUT_MS = 60_000;
 /** One read of the broker's env. */
 const BROKER_ENV_READ_TIMEOUT_MS = 15_000;
 const HELD_KEY_READ_TIMEOUT_MS = 15_000;
+/** One ZITADEL call that grants the shared registrar user its organisations. */
+const REGISTRAR_CALL_TIMEOUT_MS = 30_000;
 const BOULE_CREDENTIAL_ATTEMPTS = 3;
 /** The ZITADEL machine user that reads one company's customers organisation. */
 const CUSTOMERS_DIRECTORY_USER_NAME = 'foundry-customers-directory';
@@ -922,6 +925,8 @@ async function withTimeout(work, ms) {
         clearTimeout(timer);
     }
 }
+/** How long the host may take to read the head of the auth branch (#886). */
+const AUTH_HEAD_READ_TIMEOUT_MS = 15_000;
 /** How long one call to the jobs scheduler or the held keys, made for an entry's project, may take. */
 const JOBS_PROJECT_CALL_TIMEOUT_MS = 30_000;
 /** How many times an entry's project credentials are tried against the held keys. */
@@ -1081,11 +1086,27 @@ export class FoundryStepExecutor {
     ownMailKeyMintable() {
         return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
     }
+    /** Whether the ZITADEL port can grant the shared sign-in's registrar user a company's organisations. */
+    registrarGrantsAvailable() {
+        return typeof this.ports.zitadel.ensureRegistrarUser === 'function';
+    }
+    /** Whether the host's company ZITADEL port can make the broker's registrar token (`provision.auth.registrarTokenWritable`). */
+    ownRegistrarTokenWritable() {
+        return this.ports.ownServices?.provision.auth.registrarTokenWritable === true;
+    }
+    /** Whether the ZITADEL port can set the customers organisation's login policy. Without it no policy is planned. */
+    customersLoginPolicyAvailable() {
+        return typeof this.ports.zitadel.setCustomersLoginPolicy === 'function';
+    }
     /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
     customersDirectoryAvailable() {
         return (typeof this.ports.zitadel.mintOrgDirectoryReader === 'function' &&
             typeof this.ports.zitadel.revokeOrgDirectoryReader === 'function');
     }
+    /** Whether the ZITADEL port can grant the directory user its customer removal role. */
+    customersDirectoryRolesAvailable() {
+        return typeof this.ports.zitadel.ensureOrgDirectoryRoles === 'function';
+    }
     /** C3: whether the host supplied `mintBouleArchonCredential`. */
     bouleArchonCredentialAvailable() {
         return typeof this.ports.mintBouleArchonCredential === 'function';
@@ -1101,6 +1122,30 @@ export class FoundryStepExecutor {
     ownSigninMailWritable() {
         return this.ports.ownServices?.provision.auth.signinMailWritable === true;
     }
+    /**
+     * #886: the head of the declared auth branch, read through the host's `ownServices.readBranchHead` under a
+     * timeout. `undefined` when there is nothing to read: the ref is a tag or a commit (it names one build), or the
+     * host supplies no read. A failed or malformed read is a fixed reason, never the cause (it can echo a credential).
+     */
+    async ownAuthHead(gitRef) {
+        const read = this.ports.ownServices?.readBranchHead?.bind(this.ports.ownServices);
+        if (!read || !isBranchRef(gitRef))
+            return undefined;
+        let commit;
+        try {
+            commit = await withLabelledTimeout('auth branch head', AUTH_HEAD_READ_TIMEOUT_MS, () => read(OWN_AUTH_REPOSITORY, gitRef));
+        }
+        catch (error) {
+            return {
+                failed: error instanceof CallError && error.message.includes('no answer')
+                    ? 'the auth branch head read timed out'
+                    : 'the auth branch head read failed',
+            };
+        }
+        return /^[0-9a-f]{40}$/.test(commit)
+            ? { commit }
+            : { failed: 'the auth branch head was not a commit' };
+    }
     /** Whether the held keys can store a Worker app database's CA and certificate. */
     workerAppDbKeysPuttable() {
         return typeof this.ports.heldKeys?.put === 'function';
@@ -2756,6 +2801,11 @@ export class FoundryStepExecutor {
             await this.ports.zitadel.allowSelfRegistration(customers.id);
         else
             await this.ports.zitadel.closeSelfRegistration(customers.id);
+        // The live customers org only: the workspaces' test customers keep the instance policy. Read after the
+        // sign-up call, so the policy keeps `allowRegister` as that call left it.
+        const policyWritten = variant === LIVE_CUSTOMERS && this.customersLoginPolicyAvailable()
+            ? await this.ports.zitadel.setCustomersLoginPolicy?.(customers.id)
+            : undefined;
         await this.ports.zitadel.findOrCreateProjectGrant(zitadelOrgId, projectId, customers.id);
         // The sign-in and room metadata come before every marker: a failed write leaves both markers behind, so the next plan repeats the step.
         const signIn = await this.writeCustomersSignInMetadata(org, customers.id, action, context, variant);
@@ -2768,6 +2818,9 @@ export class FoundryStepExecutor {
             context.recordScopeId(variant.signInKey, signIn);
         if (room !== null)
             context.recordScopeId(CUSTOMERS_ROOM_SCOPE_KEY, room);
+        if (policyWritten) {
+            context.recordScopeId(CUSTOMERS_POLICY_SCOPE_KEY, CUSTOMERS_POLICY_VERSION);
+        }
         return { resourceId: customers.id };
     }
     /**
@@ -8397,20 +8450,51 @@ export class FoundryStepExecutor {
         const put = heldKeys.put;
         const ref = customersDirectoryRef(org.id);
         const held = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: read the held directory credential`, () => heldKeys.resolve(ref));
-        if (held)
+        if (held) {
+            await this.ensureDirectoryRoles(org, customersOrgId, context);
             return held;
+        }
         const minted = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: mint the directory credential`, () => zitadel.mintOrgDirectoryReader(customersOrgId, {
             userName: CUSTOMERS_DIRECTORY_USER_NAME,
-            name: 'Foundry customers directory (read-only)',
+            name: 'Foundry customers directory',
         }));
         this.handledSecrets.add(minted.token);
         context.recordScopeId(CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, minted.userId);
+        // The mint grants the same roles, so a fresh user needs no second grant.
+        if (zitadel.ensureOrgDirectoryRoles) {
+            context.recordScopeId(CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION);
+        }
         await context.persistScopeIds();
         if (!(await this.holdWithRetry(ref, minted.token, put, `${at}: hold the directory credential`))) {
             throw new Error(`${at}: the directory credential of ZITADEL user ${minted.userId} could not be held after ${BOULE_CREDENTIAL_ATTEMPTS} attempts; the next apply mints it again and revokes this one`);
         }
         return minted.token;
     }
+    /**
+     * A directory user made before it could remove customers gets that role in the customers organisation
+     * (and in no other), once: the grant is idempotent and the marker is recorded after it.
+     */
+    async ensureDirectoryRoles(org, customersOrgId, context) {
+        const recorded = context.recordedIds();
+        const userId = recorded[CUSTOMERS_DIRECTORY_USER_SCOPE_KEY];
+        const grant = this.ports.zitadel.ensureOrgDirectoryRoles;
+        if (!userId ||
+            !grant ||
+            recorded[CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY] === CUSTOMERS_DIRECTORY_ROLES_VERSION) {
+            return;
+        }
+        const at = `coolify:boule for ${org.slug}`;
+        try {
+            await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: grant the directory user`, () => grant.call(this.ports.zitadel, customersOrgId, userId));
+        }
+        catch (error) {
+            // The HTTP status says why (403 is a missing right); the body is dropped.
+            const status = error?.status;
+            throw new Error(`${at}: ZITADEL user ${userId} could not be granted its customer removal role${typeof status === 'number' ? ` (HTTP ${status})` : ''}; apply again`);
+        }
+        context.recordScopeId(CUSTOMERS_DIRECTORY_ROLES_SCOPE_KEY, CUSTOMERS_DIRECTORY_ROLES_VERSION);
+        await context.persistScopeIds();
+    }
     /** The held keys with a timeout on every call: a hung store stops the step with a plain line. */
     timedHeldKeys() {
         const held = this.ports.heldKeys;
@@ -8559,11 +8643,39 @@ export class FoundryStepExecutor {
         catch (error) {
             throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), keys));
         }
+        await this.grantSharedRegistrar(org, wanted.want, context);
         context.recordScopeId(REGISTRAR_DEPLOY_WAITS_SCOPE_KEY, result.waits.join(', '));
         // Last: a run that failed above plans the step again.
         context.recordScopeId(REGISTRAR_APPLIED_SCOPE_KEY, registrarAppliedValue(wanted.want, mint));
         return {};
     }
+    /**
+     * A company on the shared sign-in: the platform broker's registrar user holds the project-creator role in
+     * the company's sign-in and customers organisations, so the broker can register its apps there. Repeated
+     * whenever the organisations change; no token is made here (the platform's sign-in step makes it).
+     */
+    async grantSharedRegistrar(org, want, context) {
+        const zitadel = this.ports.zitadel;
+        if (ownsServices(org) || typeof zitadel.ensureRegistrarUser !== 'function')
+            return;
+        const covered = [want.organizationId, ...want.customers];
+        const marker = registrarOrgsMarker(covered);
+        if (context.recordedIds()[REGISTRAR_TOKEN_ORGS_SCOPE_KEY] === marker)
+            return;
+        const at = `coolify:broker-registrar for ${org.slug}`;
+        try {
+            const home = (await withCallTimeout(REGISTRAR_CALL_TIMEOUT_MS, `${at}: find the first organisation`, () => zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME))).org.id;
+            await withCallTimeout(REGISTRAR_CALL_TIMEOUT_MS, `${at}: grant the registrar user`, () => zitadel.ensureRegistrarUser([home, ...covered], {
+                userName: REGISTRAR_TOKEN_USER_NAME,
+                name: 'Foundry (sign-in broker registrar)',
+            }));
+        }
+        catch {
+            // The cause is dropped: nothing here is a secret, but ZITADEL's error can echo a request.
+            throw new Error(`coolify:broker-registrar for ${org.slug}: the registrar user could not be granted the company's organisations; apply again`);
+        }
+        context.recordScopeId(REGISTRAR_TOKEN_ORGS_SCOPE_KEY, marker);
+    }
     customerGrantsCredential(org, entryKey, context) {
         return ensureCustomerGrantsCredential({
             orgId: org.id,
@@ -9204,8 +9316,15 @@ export class FoundryStepExecutor {
         const before = scope.recordedIds();
         const refChanged = before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== undefined &&
             before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+        // #886: the branch head the plan read. Validated here: it decides which build is recorded.
+        const head = typeof action.desired.head === 'string' && /^[0-9a-f]{40}$/.test(action.desired.head)
+            ? action.desired.head
+            : undefined;
+        const headMoved = head !== undefined &&
+            ownAuthBuildApps(org, before).some((app) => before[builtCommitScopeKey(app.name)] !== head);
         const gitApps = [
             before[PLATFORM_AUTH_LOGIN_SCOPE_KEY],
+            before[SIGN_IN_LOGIN_APP_SCOPE_KEY],
             before[PLATFORM_AUTH_BROKER_SCOPE_KEY],
         ].filter((id) => Boolean(id));
         if (refChanged) {
@@ -9225,6 +9344,7 @@ export class FoundryStepExecutor {
                 zones: this.zonePort(),
             }, scope, `${org.slug}:auth`),
             smtpSender: `noreply@${hn.mailDomain}`,
+            ...(passkeyRpIdFor(org) ? { passkeyRpId: passkeyRpIdFor(org) } : {}),
             defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,
             // In-app sign-in: the company's own stack gets the second login app. Its host table starts
@@ -9232,15 +9352,23 @@ export class FoundryStepExecutor {
             ...(inAppSignIn(org) ? { signInLogin: { bindings: null } } : {}),
             mcp: orgDeclaresMcp(org),
             mailBranding: { companyName: org.displayName },
+            ...(registrarWanted(org) && this.ownRegistrarTokenWritable()
+                ? { registrarOrgIds: registrarOrgIdsOf(org, scope.recordedIds()) }
+                : {}),
         });
-        if (refChanged) {
+        if (refChanged || headMoved) {
             const now = scope.recordedIds();
             const brokerDeployed = Boolean(now[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY]);
+            const names = new Map(ownAuthBuildApps(org, now).map((app) => [app.id, app.name]));
             for (const id of gitApps) {
                 // The broker crash-loops until its inputs exist; it was never deployed, so it is not now.
                 if (id === now[PLATFORM_AUTH_BROKER_SCOPE_KEY] && !brokerDeployed)
                     continue;
                 await deps.coolify.deploy(id, true);
+                // Recorded after the deploy was queued: a failed one leaves the old build, so the next plan repeats it.
+                const name = names.get(id);
+                if (head && name)
+                    scope.recordScopeId(builtCommitScopeKey(name), head);
             }
         }
         scope.recordScopeId(OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, hostname);

package/dist/plan/health-check-settings.d.ts

@@ -27,6 +27,19 @@
  * no live measurement to pin it to instead"). A caller whose app is known to
  * be slower or faster to boot passes its own.
  */
+/**
+ * #1054: the two fields that let Coolify run a rolling update for an app other containers reach by a fixed name.
+ * Coolify starts the new container beside the old one, waits for its check, then stops the old one, only when the
+ * app has no fixed container name (`custom_internal_name`) and the consistent-name flag is off. A network alias
+ * answers on the Docker network under the same name throughout the swap, so callers send this instead of
+ * `custom_internal_name`. The app also needs a health check to wait on (`healthCheckSettings` or
+ * {@link IMAGE_HEALTHCHECK_SETTINGS}).
+ */
+export declare function rollingUpdateSettings(alias: string): {
+    custom_network_aliases: string;
+    is_consistent_container_name_enabled: false;
+    custom_internal_name: null;
+};
 /** The four Coolify `updateApplication` fields {@link healthCheckSettings} returns. */
 export interface HealthCheckPatch {
     health_check_enabled: true;

package/dist/plan/health-check-settings.js

@@ -27,6 +27,23 @@
  * no live measurement to pin it to instead"). A caller whose app is known to
  * be slower or faster to boot passes its own.
  */
+/**
+ * #1054: the two fields that let Coolify run a rolling update for an app other containers reach by a fixed name.
+ * Coolify starts the new container beside the old one, waits for its check, then stops the old one, only when the
+ * app has no fixed container name (`custom_internal_name`) and the consistent-name flag is off. A network alias
+ * answers on the Docker network under the same name throughout the swap, so callers send this instead of
+ * `custom_internal_name`. The app also needs a health check to wait on (`healthCheckSettings` or
+ * {@link IMAGE_HEALTHCHECK_SETTINGS}).
+ */
+export function rollingUpdateSettings(alias) {
+    // `custom_internal_name: null` clears the fixed name an app made by an earlier foundry still has: with it set
+    // Coolify refuses the rolling update whatever else is patched.
+    return {
+        custom_network_aliases: alias,
+        is_consistent_container_name_enabled: false,
+        custom_internal_name: null,
+    };
+}
 /** Archon's own number (see this module's doc comment) -- the default every other caller inherits unless it knows better. */
 export const DEFAULT_HEALTH_CHECK_START_PERIOD_SECONDS = 30;
 /**

package/dist/plan/own-diff.d.ts

@@ -52,7 +52,35 @@ export declare const OWN_AUTH_BLOCKED_KEY = "own-auth";
 export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export declare const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = "own_auth_applied_git_ref";
+/** The Git repository the company's login app, in-app login app and broker are built from. */
+export declare const OWN_AUTH_REPOSITORY = "wtfalch/auth";
+/** What the host read of the declared auth branch: its head commit, or why it could not be read (fixed text). */
+export type OwnAuthHead = {
+    commit: string;
+} | {
+    failed: string;
+};
+/**
+ * True for a declared auth ref whose head can move: not a commit and not a release tag (`v1.2.3`, `1.2`).
+ * A tag or a commit already names one build, so it is never read.
+ */
+export declare function isBranchRef(ref: string): boolean;
+/**
+ * The company's auth apps a moved branch head redeploys, with the name their `built_commit_<name>` is recorded
+ * under. The in-app login app is listed once it is recorded; the broker once it was ever deployed (before that it
+ * crash-loops on missing inputs and is not redeployed, so it never records a build).
+ */
+export declare function ownAuthBuildApps(org: Pick<DeclaredOrg, 'slug'>, recordedIds: Readonly<Record<string, string>>): Array<{
+    id: string;
+    name: string;
+}>;
 export interface PlanOwnAuthOptions {
+    /**
+     * #886: the head of the declared auth branch, read by the executor (`FoundryStepExecutor.ownAuthHead`).
+     * Absent: not read (a tag, a commit, or a host without the read), so only the declared ref decides.
+     * A failed read plans nothing from the head and is reported.
+     */
+    authHead?: OwnAuthHead;
     org: DeclaredOrg;
     recordedIds: Readonly<Record<string, string>>;
     readiness: OrgPlatformReadiness;
@@ -76,6 +104,10 @@ export interface PlanOwnAuthOptions {
     signinDbBackupConfigured?: boolean;
     /** The host's ZITADEL port can write the sign-in mail text and look. Default true. False: the marker is not required. */
     signinMailWritable?: boolean;
+    /** The host's ZITADEL port can make the broker's registrar token. True: it is asked for. False: reported blocked. Absent: neither. */
+    registrarTokenWritable?: boolean;
+    /** The registrar token's held-key ref holds a value, so a rerun after a crash delivers it. Default false. */
+    registrarTokenHeld?: boolean;
 }
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app

package/dist/plan/own-diff.js

@@ -3,18 +3,20 @@ import { sfuSlotPorts } from '../calls-sfu.js';
 import { SFU_SLOT_MAX, ownsServices } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { brokerEntryAppliedScopeKey } from './broker-entries.js';
+import { REGISTRAR_TOKEN_SCOPE_KEY, REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY, registrarTokenDue, } from './broker-registrar-token.js';
+import { builtCommitScopeKey } from './build-record.js';
 import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
 import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
-import { ownHostnames } from './own-hostnames.js';
+import { ownHostnames, passkeyRpIdFor } from './own-hostnames.js';
 import { JOBS_PUBLIC_URL_SCOPE_KEY, OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY } from './own-jobs-route.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
-import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
-import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
-import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
+import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn, signInLoginNames } from './sign-in.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, signinDbCertDue } from './signin-db-tls.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db.js';
@@ -126,6 +128,39 @@ export const OWN_AUTH_BLOCKED_KEY = 'own-auth';
 export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'own_auth_applied_git_ref';
+/** The Git repository the company's login app, in-app login app and broker are built from. */
+export const OWN_AUTH_REPOSITORY = 'wtfalch/auth';
+const FULL_SHA = /^[0-9a-f]{40}$/;
+/**
+ * True for a declared auth ref whose head can move: not a commit and not a release tag (`v1.2.3`, `1.2`).
+ * A tag or a commit already names one build, so it is never read.
+ */
+export function isBranchRef(ref) {
+    return !FULL_SHA.test(ref) && !/^v?\d+\.\d+/.test(ref);
+}
+/**
+ * The company's auth apps a moved branch head redeploys, with the name their `built_commit_<name>` is recorded
+ * under. The in-app login app is listed once it is recorded; the broker once it was ever deployed (before that it
+ * crash-loops on missing inputs and is not redeployed, so it never records a build).
+ */
+export function ownAuthBuildApps(org, recordedIds) {
+    const target = orgTarget(org);
+    const apps = [
+        { id: recordedIds[PLATFORM_AUTH_LOGIN_SCOPE_KEY], name: target.names.authLogin },
+        { id: recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY], name: signInLoginNames(target).name },
+        {
+            id: recordedIds[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY]
+                ? recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY]
+                : undefined,
+            name: target.names.authBroker,
+        },
+    ];
+    return apps.filter((app) => Boolean(app.id));
+}
+/** True when the read head differs from the commit any of the company's auth apps was last built from. */
+function authHeadMoved(org, recordedIds, head) {
+    return ownAuthBuildApps(org, recordedIds).some((app) => recordedIds[builtCommitScopeKey(app.name)] !== head);
+}
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
  * and the broker in the org's own Coolify project, at `auth.<domain>`.
@@ -197,7 +232,21 @@ export function planOwnAuth(options) {
             return blocked('the host supplies no backup bucket for the sign-in database');
         }
     }
+    const registrarDue = options.registrarTokenWritable === true && registrarTokenDue(org, recordedIds);
+    // A token minted whose hold did not finish is never minted again: a person removes the marker.
+    if (registrarDue &&
+        recordedIds[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY] &&
+        !recordedIds[REGISTRAR_TOKEN_SCOPE_KEY] &&
+        !options.registrarTokenHeld) {
+        return blocked(`the broker's registrar token of ZITADEL machine user ${recordedIds[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY]} was minted but never confirmed held; remove the recorded key ${REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make a new one`);
+    }
     const hostname = names.auth;
+    // #886: a branch head that moved past what the auth apps were built from plans the step again. A failed read
+    // plans nothing from the head and is reported, so a broken read never loops.
+    const head = options.authHead;
+    const headCommit = head && 'commit' in head ? head.commit : undefined;
+    const headFailed = head && 'failed' in head ? head.failed : undefined;
+    const headMoved = headCommit !== undefined && authHeadMoved(org, recordedIds, headCommit);
     // The broker starts only on a valid `AUTH_APPS`, and the login client is minted only once it does:
     // the first broker entry is what lets this step finish, as the platform's first registration does.
     // Archon's registration is an entry too; the platform records it, not this org, so it comes in
@@ -219,7 +268,7 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY] === AUTH_TUNNEL_ROUTES_VERSION &&
         // The login apps' mail env (`LOGIN_MAIL_FROM`, the Lettermint key); a stack from before it is written again.
         recordedIds[PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY] ===
-            authLoginEnvMarker(`noreply@${names.mailDomain}`) &&
+            authLoginEnvMarker(`noreply@${names.mailDomain}`, passkeyRpIdFor(org)) &&
         // The code mail carries the company's name and design; an older apply, or a renamed company, writes it again.
         (options.signinMailWritable === false ||
             recordedIds[PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY] === signinMailMarker(org.displayName)) &&
@@ -234,15 +283,23 @@ export function planOwnAuth(options) {
         !signinDbCertDue(recordedIds, options.now ?? Date.now()) &&
         !signinDbBackupMissing(recordedIds) &&
         // ZITADEL was started on the TLS database and never seen healthy there: the step starts it again.
-        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY]) {
+        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY] &&
+        !headMoved &&
+        // The broker's registrar token (a company with customers or apps): made, or adopted, and covering the recorded organisations.
+        !registrarDue) {
         // Applied and otherwise done: say why the mail stays ZITADEL's stock text, once.
         const mailMissing = options.signinMailWritable === false &&
             recordedIds[PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY] !== signinMailMarker(org.displayName);
+        const registrarMissing = options.registrarTokenWritable === false && registrarTokenDue(org, recordedIds);
         return {
             step: null,
-            blocked: mailMissing
-                ? `${org.slug}'s sign-in mail keeps ZITADEL's default text: the host cannot write message texts`
-                : null,
+            blocked: headFailed
+                ? `${org.slug}'s auth apps were not checked for a newer auth commit: ${headFailed}`
+                : registrarMissing
+                    ? `${org.slug}'s sign-in broker has no registrar token: the host cannot make it, so its apps cannot register sign-in`
+                    : mailMissing
+                        ? `${org.slug}'s sign-in mail keeps ZITADEL's default text: the host cannot write message texts`
+                        : null,
         };
     }
     return {
@@ -252,7 +309,7 @@ export function planOwnAuth(options) {
                 system: 'coolify',
                 kind: 'own-auth',
                 key: org.id,
-                desired: { hostname, gitRef },
+                desired: { hostname, gitRef, ...(headCommit ? { head: headCommit } : {}) },
             },
             step: {
                 description: `provision ${org.slug}'s own sign-in at ${hostname}`,

package/dist/plan/own-hostnames.d.ts

@@ -27,3 +27,11 @@ export interface OwnHostnames {
  * {@link loginHostnameFor}, so the two cannot disagree.
  */
 export declare function ownHostnames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'issuer' | 'mail'>): OwnHostnames;
+/**
+ * The WebAuthn RP ID for a company's login apps (`LOGIN_PASSKEY_RP_ID`): the company's own domain, which
+ * `auth.<domain>` and the in-app hosts (`agora.<domain>`, `boule.<domain>`) all sit under, so one passkey
+ * works on each. Undefined for a company without its own sign-in domain: its `<slug>-auth.oikos.host` shares
+ * `oikos.host` with every other company, so an RP ID there would span companies. The login app refuses a
+ * host outside the RP ID, so a company's hosts stay under its domain or the variable stays unset.
+ */
+export declare function passkeyRpIdFor(org: Pick<DeclaredOrg, 'domain' | 'issuer'>): string | undefined;

package/dist/plan/own-hostnames.js

@@ -23,3 +23,17 @@ export function ownHostnames(org) {
         mailDomain: mailOnDomain && domain ? domain : `${slug}.${NO_DOMAIN_ZONE}`,
     };
 }
+const BARE_DOMAIN = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/**
+ * The WebAuthn RP ID for a company's login apps (`LOGIN_PASSKEY_RP_ID`): the company's own domain, which
+ * `auth.<domain>` and the in-app hosts (`agora.<domain>`, `boule.<domain>`) all sit under, so one passkey
+ * works on each. Undefined for a company without its own sign-in domain: its `<slug>-auth.oikos.host` shares
+ * `oikos.host` with every other company, so an RP ID there would span companies. The login app refuses a
+ * host outside the RP ID, so a company's hosts stay under its domain or the variable stays unset.
+ */
+export function passkeyRpIdFor(org) {
+    const domain = org.domain?.toLowerCase();
+    if (!domain || !org.issuer.usesDomain || !BARE_DOMAIN.test(domain))
+        return undefined;
+    return domain;
+}

package/dist/plan/own-services.d.ts

@@ -61,6 +61,8 @@ export interface ServiceTarget {
     };
     readonly refs: {
         instanceBearer: string;
+        /** The sign-in broker's ZITADEL registrar token (`ZITADEL_REGISTRAR_TOKEN`), held after its one mint. */
+        registrarToken: string;
         authAdmin: string;
         brokerMailKey: string;
         /** The connection string of the database for the broker's customer workspaces: foundry holds it after making the database, or the operator holds one first. */
@@ -209,4 +211,9 @@ export interface OwnServicesPort {
     /** Builds the ZITADEL port for one company instance. */
     zitadelFor(instance: OwnAuthInstance): ZitadelPort;
     provision: OwnServicesProvision;
+    /**
+     * #886: the head commit (40 hex characters) of `ref` in the Git repository `repository` (`owner/name`).
+     * Absent: a moved auth branch is not noticed. The executor puts a timeout on every call.
+     */
+    readBranchHead?(repository: string, ref: string): Promise<string>;
 }

package/dist/plan/own-services.js

@@ -46,6 +46,7 @@ export function platformTarget() {
         },
         refs: {
             instanceBearer: 'zitadel:platform:instanceBearer',
+            registrarToken: 'zitadel:platform:registrarToken',
             authAdmin: 'zitadel:platform:admin',
             brokerMailKey: 'lettermint:platform:apiToken',
             brokerWorkspacesDatabase: 'auth:platform:workspacesDatabaseUrl',
@@ -103,6 +104,7 @@ export function orgTarget(org) {
         },
         refs: {
             instanceBearer: `zitadel:org:${s}:instanceBearer`,
+            registrarToken: `zitadel:org:${s}:registrarToken`,
             authAdmin: `zitadel:org:${s}:admin`,
             brokerMailKey: `lettermint:org:${s}:apiToken`,
             brokerWorkspacesDatabase: `auth:org:${s}:workspacesDatabaseUrl`,

package/dist/plan/plan-apply.d.ts

@@ -18,6 +18,7 @@ import type { GithubDeployKeysPort } from './github-deploy-keys.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
+import type { OwnAuthHead } from './own-diff.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
@@ -212,8 +213,12 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** Whether the ZITADEL port can set the customers organisation's login policy. Absent: planned, as before. */
+    customersLoginPolicyAvailable?(): boolean;
     /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
     customersDirectoryAvailable?(): boolean;
+    /** Whether the ZITADEL port can grant the directory user its customer removal role. */
+    customersDirectoryRolesAvailable?(): boolean;
     /** C3: whether the host supplied `mintBouleArchonCredential`. */
     bouleArchonCredentialAvailable?(): boolean;
     /** Every Coolify server with whether it is usable and reachable; blue/green plans copies on each. Optional: an executor without it plans no blue/green. */
@@ -264,6 +269,12 @@ export interface StepExecutor {
     ownSigninDbBackupConfigured?(): boolean;
     /** Whether the host's company ZITADEL port can write the sign-in mail text and look. Absent: true. */
     ownSigninMailWritable?(): boolean;
+    /** #886: reads the head of the declared auth branch for an own org; `undefined` when there is nothing to read. */
+    ownAuthHead?(gitRef: string): Promise<OwnAuthHead | undefined>;
+    /** Whether the host's ZITADEL port can grant the shared sign-in's registrar user a company's organisations. Absent: false. */
+    registrarGrantsAvailable?(): boolean;
+    /** Whether the host's company ZITADEL port can make the broker's registrar token. Absent: the planner neither asks for it nor reports it. */
+    ownRegistrarTokenWritable?(): boolean;
     /**
      * Whether the host's scoped ports for this own org include a files-organisation
      * port. The planner plans no `files:organisation` step for an own org while
@@ -1022,8 +1033,12 @@ export declare class FoundryPlanApply implements PlanApply {
      * only the ref.
      */
     private heldEnvReadiness;
+    /** #886: the head of an own org's declared auth branch, or nothing when the org is not own or the executor has no read. */
+    private ownAuthHeadFor;
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
     private ownMailKeyHeld;
+    /** An own org's registrar token is held (a rerun after a crash delivers it instead of blocking). */
+    private ownRegistrarTokenHeld;
     /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
     private ownResumableRefs;
     /**