@wtfalch/foundry 0.71.0 → 0.72.1

package/dist/plan/plan-apply.js

@@ -1718,7 +1718,9 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            customersLoginPolicy: this.executor.customersLoginPolicyAvailable?.() ?? true,
             customersDirectory: this.executor.customersDirectoryAvailable?.() ?? false,
+            customersDirectoryRoles: this.executor.customersDirectoryRolesAvailable?.() ?? false,
             bouleArchonCredential: this.executor.bouleArchonCredentialAvailable?.() ?? false,
             ...(blueGreenServers ? { blueGreenServers } : {}),
             ...(stageSinkDown ? { stageSinkDown } : {}),
@@ -1741,6 +1743,10 @@ export class FoundryPlanApply {
             ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
             ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ownSigninMailWritable: this.executor.ownSigninMailWritable?.() ?? true,
+            ...(await this.ownAuthHeadFor(org, platformReadiness)),
+            registrarGrants: this.executor.registrarGrantsAvailable?.() ?? false,
+            ownRegistrarTokenWritable: this.executor.ownRegistrarTokenWritable?.(),
+            ownRegistrarTokenHeld: await this.ownRegistrarTokenHeld(org),
             ...(this.backupGate
                 ? {
                     backupStorageUuid: (await this.platformDeps?.store.getServiceIds())?.[PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY] || null,
@@ -1964,6 +1970,14 @@ export class FoundryPlanApply {
         }
         return { store: Boolean(heldKeys), refs, differs, unreadable, invalid };
     }
+    /** #886: the head of an own org's declared auth branch, or nothing when the org is not own or the executor has no read. */
+    async ownAuthHeadFor(org, readiness) {
+        const gitRef = readiness.serviceGitRefs?.auth;
+        if (!ownsServices(org) || !gitRef || !this.executor.ownAuthHead)
+            return {};
+        const head = await this.executor.ownAuthHead(gitRef);
+        return head ? { ownAuthHead: head } : {};
+    }
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
     async ownMailKeyHeld(org) {
         const held = this.platformDeps?.heldKeys;
@@ -1971,6 +1985,13 @@ export class FoundryPlanApply {
             return false;
         return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.brokerMailKey);
     }
+    /** An own org's registrar token is held (a rerun after a crash delivers it instead of blocking). */
+    async ownRegistrarTokenHeld(org) {
+        const held = this.platformDeps?.heldKeys;
+        if (!ownsServices(org) || !held)
+            return false;
+        return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.registrarToken);
+    }
     /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
     async ownResumableRefs(org) {
         const held = this.platformDeps?.heldKeys;

package/dist/plan/platform-diff.d.ts

@@ -70,16 +70,18 @@ export declare const AUTH_TUNNEL_ROUTES_VERSION = "2";
 export declare const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = "auth_tunnel_routes_applied";
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
+ * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
  */
-export declare const AUTH_LOGIN_ENV_VERSION = "1";
+export declare const AUTH_LOGIN_ENV_VERSION = "2";
 /**
- * What the login apps' env is written for: the version and the sender address (`LOGIN_MAIL_FROM`).
- * The address is no secret; a new mail domain gives a new marker, so the step is planned again.
+ * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
+ * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).
+ * Neither is a secret; a new mail domain or a changed RP ID gives a new marker, so the step is planned again.
  */
-export declare function authLoginEnvMarker(smtpSender: string): string;
+export declare function authLoginEnvMarker(smtpSender: string, passkeyRpId?: string): string;
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export declare const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = "auth_login_env_applied";
 /**
@@ -1327,6 +1329,8 @@ export interface PlanPlatformOptions {
         authMailKeyHeld?: boolean;
         /** C3: why the owner's invite cannot be made (no work address, no mail port). The rest of the step still plans. */
         authOwnerInvite?: string;
+        /** The broker's registrar token was minted and never held: reported, nothing planned for it. */
+        authRegistrar?: string;
         files?: string;
         integrations?: string;
         ai?: string;

package/dist/plan/platform-diff.js

@@ -77,17 +77,19 @@ export const AUTH_TUNNEL_ROUTES_VERSION = '2';
 export const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = 'auth_tunnel_routes_applied';
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
+ * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
  */
-export const AUTH_LOGIN_ENV_VERSION = '1';
+export const AUTH_LOGIN_ENV_VERSION = '2';
 /**
- * What the login apps' env is written for: the version and the sender address (`LOGIN_MAIL_FROM`).
- * The address is no secret; a new mail domain gives a new marker, so the step is planned again.
+ * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
+ * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).
+ * Neither is a secret; a new mail domain or a changed RP ID gives a new marker, so the step is planned again.
  */
-export function authLoginEnvMarker(smtpSender) {
-    return `${AUTH_LOGIN_ENV_VERSION}:${smtpSender}`;
+export function authLoginEnvMarker(smtpSender, passkeyRpId) {
+    return `${AUTH_LOGIN_ENV_VERSION}:${smtpSender}${passkeyRpId ? `:${passkeyRpId}` : ''}`;
 }
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = 'auth_login_env_applied';
@@ -1553,7 +1555,7 @@ export function planPlatform(platform, live, options = {}) {
     // reconcile below can be planned in the *same* round hc first comes up,
     // the same way files/mail/archon are planned in auth's own first round.
     const hcReady = hc.step !== null || Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_HC_KEY)]);
-    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false, blocked.authMailKeyHeld ?? true);
+    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false, blocked.authMailKeyHeld ?? true, blocked.authRegistrar);
     if (auth.step)
         plannedSteps.push(auth.step);
     // #174: the integrations host. Planned after auth; neither step reads the
@@ -2229,11 +2231,15 @@ function planSfu(platform, callsOrgSlugs, recordedIds) {
  * promising "this apply re-mints" while one of those is still missing would
  * be wrong the moment it is read.
  */
-function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false, mailKeyHeld = true) {
+function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false, mailKeyHeld = true, registrarBlocked) {
     if (!platform.auth.enabled)
         return { step: null, blocked: null };
-    // C3/S2: standing notes. The invite and the domain wait on a person; they hold nothing else back.
-    const standing = [ownerInviteBlocked, ownerDomainBlockedText(recordedIds)].filter((t) => Boolean(t));
+    // C3/S2: standing notes. The invite, the registrar token and the domain wait on a person; they hold nothing else back.
+    const standing = [
+        ownerInviteBlocked,
+        registrarBlocked,
+        ownerDomainBlockedText(recordedIds),
+    ].filter((t) => Boolean(t));
     const standingNote = standing.length > 0 ? standing.join('; ') : null;
     const key = resourceKey('coolify', 'app', PLATFORM_AUTH_KEY);
     const connectorApplied = Boolean(recordedIds[PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY]);

package/dist/plan/platform-providers.d.ts

@@ -145,11 +145,16 @@ export interface PlatformAuthDeps {
      * and the planner reports it. The port may be a proxy that answers any method name, so the host says it.
      */
     signinMailWritable?: boolean;
+    /**
+     * The host's ZITADEL port has `ensureRegistrarUser` and `mintRegistrarToken` (the broker's registrar token,
+     * `plan/broker-registrar-token.ts`). Only `true` makes it; otherwise the planner reports it blocked.
+     */
+    registrarTokenWritable?: boolean;
     /** Overrides the Lettermint SMTP relay ZITADEL is given. Absent, Lettermint exactly as before. */
     smtp?: PlatformAuthSmtp;
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'> & 
     /** An own org's sign-in database needs a volume and the CA file mount (#746); the platform's does not. */
-    Partial<Pick<CoolifyPort, 'listStorages' | 'createPersistentStorage' | 'createFileStorage'>>;
+    Partial<Pick<CoolifyPort, 'listStorages' | 'createPersistentStorage' | 'createFileStorage' | 'deleteEnv'>>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -161,7 +166,12 @@ export interface PlatformAuthDeps {
     requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp & Partial<PlatformZitadelMailBranding>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp & Partial<Pick<ZitadelPort, 'ensureRegistrarUser' | 'mintRegistrarToken'>> & Partial<PlatformZitadelMailBranding> & {
+        getOrg?: (id: string) => Promise<{
+            id: string;
+            name: string;
+        }>;
+    };
     /**
      * Mails the owner's first-sign-in link to their personal address (the same
      * port as `FoundryStepExecutorPorts.ownerInviteMail`). The link carries the
@@ -411,6 +421,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         authOtherInputsMissing?: string[];
         authMailKeyHeld?: boolean;
         authOwnerInvite?: string;
+        authRegistrar?: string;
         files?: string;
         integrations?: string;
         ai?: string;
@@ -575,6 +586,7 @@ export declare const AUTH_BROKER_MCP_PATH_PATTERN = "^/(\\.well-known/oauth-auth
 export declare const PLATFORM_AUTH_DB_SCOPE_KEY = "coolify_platform_auth_database";
 export declare const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = "coolify_platform_auth_zitadel_app";
 export declare const PLATFORM_AUTH_LOGIN_SCOPE_KEY = "coolify_platform_auth_login_app";
+export declare const PLATFORM_AUTH_ORG_NAME = "foundry";
 /**
  * #283: the ref the new instance's IAM_OWNER machine token (a PAT) is
  * delivered under, once. A host reads it back to build `zitadelForInstance`
@@ -600,6 +612,11 @@ export interface AuthStackInput {
     network: ServiceNetwork;
     /** The ZITADEL SMTP sender address. */
     smtpSender: string;
+    /**
+     * `LOGIN_PASSKEY_RP_ID` for both login apps: a bare domain every host they serve sits under (the login
+     * refuses any other). Absent: unset, and each passkey belongs to the host it was made on.
+     */
+    passkeyRpId?: string;
     /** Where the login app sends a user with no sign-in request in flight, or null to leave it unset. */
     defaultRedirectUri: string | null;
     /** The company whose owner is invited into its own sign-in org; null for a company's own stack. */
@@ -620,6 +637,11 @@ export interface AuthStackInput {
     mailBranding?: {
         companyName: string;
     };
+    /**
+     * The broker gets a registrar token (`ZITADEL_REGISTRAR_TOKEN`, `plan/broker-registrar-token.ts`) covering the
+     * instance's first organisation and these (the company's sign-in and customers organisations). Absent: none.
+     */
+    registrarOrgIds?: readonly string[];
 }
 /**
  * #168: makes `coolify:app` keyed {@link PLATFORM_AUTH_KEY} true -- a Coolify

package/dist/plan/platform-providers.js

@@ -15,7 +15,7 @@ import { desktopCallbackUri, unionRedirectUris } from './desktop-callback.js';
 import { placedOnPlatform } from './destinations.js';
 import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, setOidcAppLoginBaseUri, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
-import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
+import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, rollingUpdateSettings, tcpProbe, } from './health-check-settings.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { LIMITS, limited } from './own-limits.js';
 import { postLogoutAppliedValue, postLogoutUrisFor } from './post-logout-uris.js';
@@ -24,6 +24,7 @@ import { buildStageCopyHostPorts } from './stage-copy-host.js';
 import { stageGateKey, stageHostname, syncStageGateMembers, } from './stage-guards.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { BROKER_DB_NAME, BROKER_DB_USER, ensureBrokerMcpEnv } from './broker-mcp.js';
+import { REGISTRAR_TOKEN_SCOPE_KEY, REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY, RegistrarTokenError, ensureBrokerRegistrarToken, } from './broker-registrar-token.js';
 import { withTimeout } from './call-timeout.js';
 import { SIGN_IN_BIND_KEY_ENV, SIGN_IN_BIND_KEY_MIN_LENGTH, SIGN_IN_BIND_KEY_SCOPE_KEY, } from './cookie-domain.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
@@ -436,6 +437,9 @@ export class FoundryPlatformStepExecutor {
             const inviteBlocked = ownerInviteBlockedReason(ownerCompany, Boolean(this.auth.ownerInviteMail));
             if (inviteBlocked)
                 blocked.authOwnerInvite = inviteBlocked;
+            const registrarBlocked = await registrarTokenBlockedReason(this.auth, recordedIds);
+            if (registrarBlocked)
+                blocked.authRegistrar = registrarBlocked;
         }
         if (platform.mail.enabled) {
             const mailBlocked = await mailBlockedReason(platform, this.mail, recordedIds);
@@ -911,13 +915,22 @@ export class FoundryPlatformStepExecutor {
             const loginClientDrifted = await authLoginClientDrifted(platform, this.auth, recordedIds);
             // The broker lacks the MCP database and secret a shared org's entry needs (auth ADR 0002).
             const mcpDrifted = recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] !== '1' && (await this.mcpWanted());
+            // The broker has no registrar token yet (`ZITADEL_REGISTRAR_TOKEN`).
+            // A token minted and never held is blocked (`blockedSteps`), not drift: no apply could change it.
+            const registrarDrifted = this.auth.registrarTokenWritable === true &&
+                !recordedIds[REGISTRAR_TOKEN_SCOPE_KEY] &&
+                !(await registrarTokenBlockedReason(this.auth, recordedIds));
             if (loginClientDrifted ||
                 mcpDrifted ||
+                registrarDrifted ||
                 (await this.signInLoginDrifted(this.auth, recordedIds))) {
                 result.auth = true;
             }
             if (await authAppsNotRunning(this.auth.coolify, recordedIds))
                 result.authApps = true;
+            // An app made before the rolling update still has its fixed container name: the step clears it.
+            if (await authAppsKeepInternalName(this.auth.coolify, recordedIds))
+                result.auth = true;
         }
         // #380: once the runner app is recorded, re-check its live env against
         // every setting `ensureStarted()` requires -- the gap that left the
@@ -1561,7 +1574,25 @@ const PLATFORM_AUTH_ADMIN_USER_NAME = 'foundry-admin';
 const PLATFORM_AUTH_RESERVED_USERNAME = 'admin';
 /** #216 (building on #209/#215): the narrower `IAM_LOGIN_CLIENT` machine user for the login app and the broker. */
 const PLATFORM_AUTH_LOGIN_CLIENT_USER_NAME = 'foundry-login-client';
-const PLATFORM_AUTH_ORG_NAME = 'foundry';
+export const PLATFORM_AUTH_ORG_NAME = 'foundry';
+/**
+ * The instance's first organisation (the default one, whose name the login shows as its wordmark).
+ * A company's own instance passes the recorded id (the platform passes none and keeps the name `foundry`);
+ * found by that id when there is one, because a company's own instance has it renamed to the
+ * company's name (`applySigninMail`), and a lookup by name would then make a second `foundry` org. The
+ * name is the way in only before the id is recorded. A recorded id ZITADEL no longer has is a failure,
+ * never a reason to make another org.
+ */
+async function platformAuthFirstOrg(zitadel, recordedId) {
+    if (recordedId) {
+        // The name is no way back in once the id is recorded: the org was renamed, and a lookup by name would make another.
+        if (typeof zitadel.getOrg !== 'function') {
+            throw new Error("the instance's first organisation is recorded, but the host's ZITADEL port cannot read it by id; it is not looked up by name");
+        }
+        return await zitadel.getOrg(recordedId);
+    }
+    return (await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME)).org;
+}
 /**
  * #283: the ref the new instance's IAM_OWNER machine token (a PAT) is
  * delivered under, once. A host reads it back to build `zitadelForInstance`
@@ -1628,6 +1659,27 @@ function loginClientRecordValue(userId, patId, token) {
     };
     return JSON.stringify(record);
 }
+/**
+ * The broker's registrar token was minted and never held: nothing can deliver it and a second mint is refused
+ * (platform-step rule 1), so the plan reports it and plans nothing for it. Undefined when not in that state.
+ */
+async function registrarTokenBlockedReason(auth, recordedIds) {
+    const userId = recordedIds[REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY];
+    if (auth.registrarTokenWritable !== true || !userId || recordedIds[REGISTRAR_TOKEN_SCOPE_KEY]) {
+        return undefined;
+    }
+    let held;
+    try {
+        held = await auth.heldKeys?.resolve(platformTarget().refs.registrarToken);
+    }
+    catch {
+        // Not read: nothing is claimed, and the step itself reports the state.
+        return undefined;
+    }
+    if (held)
+        return undefined;
+    return `the broker's registrar token of ZITADEL machine user ${userId} was minted but never confirmed held; remove the recorded key ${REGISTRAR_TOKEN_UNDELIVERED_SCOPE_KEY} to make a new one`;
+}
 /**
  * #216 round 4: whether the login-client PAT recorded for this platform
  * (under {@link PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY}) is still, right
@@ -2037,7 +2089,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
     const gitBranchPatchFor = (app) => authRefChanged && !app.justCreated ? { git_branch: gitRef } : {};
     // The Dockerfile's own HEALTHCHECK is the live check (`IMAGE_HEALTHCHECK_SETTINGS`).
     await deps.coolify.updateApplication(loginAppId, {
-        custom_internal_name: target.internal.authLogin,
+        ...rollingUpdateSettings(target.internal.authLogin),
         ...IMAGE_HEALTHCHECK_SETTINGS,
         ...gitBranchPatchFor(loginApp),
     });
@@ -2071,7 +2123,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         : null;
     if (signInApp && signInNames) {
         await deps.coolify.updateApplication(signInApp.appId, {
-            custom_internal_name: signInNames.internal,
+            ...rollingUpdateSettings(signInNames.internal),
             ...IMAGE_HEALTHCHECK_SETTINGS,
             ...gitBranchPatchFor(signInApp),
         });
@@ -2097,7 +2149,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
     const brokerAppId = brokerApp.appId;
     await record(PLATFORM_AUTH_BROKER_SCOPE_KEY, brokerAppId);
     await deps.coolify.updateApplication(brokerAppId, {
-        custom_internal_name: target.internal.authBroker,
+        ...rollingUpdateSettings(target.internal.authBroker),
         ...IMAGE_HEALTHCHECK_SETTINGS,
         ...gitBranchPatchFor(brokerApp),
     });
@@ -2201,6 +2253,8 @@ export async function provisionAuthStack(scope, deps, target, input) {
         loginEnvs.push({ key: 'LETTERMINT_API_TOKEN', value: heldMailKey });
     if (input.smtpSender)
         loginEnvs.push({ key: 'LOGIN_MAIL_FROM', value: input.smtpSender });
+    if (input.passkeyRpId)
+        loginEnvs.push({ key: LOGIN_PASSKEY_RP_ID_ENV, value: input.passkeyRpId });
     // `AUTH_APPS` and `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` are not pushed here
     // -- this function's own doc comment, "Known gaps". `LETTERMINT_API_TOKEN`
     // is, once held (#210): pushing it costs nothing even while the broker
@@ -2242,6 +2296,12 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await deps.coolify.bulkUpsertEnvs(zitadelAppId, zitadelEnvs);
     await deps.coolify.bulkUpsertEnvs(loginAppId, loginEnvs);
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
+    // A domain removed (or `usesDomain` off) leaves no RP ID to set: a value from an earlier apply is removed,
+    // and the apps deploy again, so a passkey is never bound to a domain the company no longer has.
+    const staleRpIdLogin = input.passkeyRpId
+        ? false
+        : await removeLoginEnv(deps.coolify, loginAppId, LOGIN_PASSKEY_RP_ID_ENV);
+    let staleRpIdSignIn = false;
     // The in-app login: the login's env, the base path as a build argument, and the host table.
     let signInEnvsChanged = false;
     // The session bind key is minted once, on the in-app login app only: a key already live (32 characters or
@@ -2265,6 +2325,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
         ];
         signInEnvsChanged = await envsDiffer(deps.coolify, signInApp.appId, signInEnvs);
         await deps.coolify.bulkUpsertEnvs(signInApp.appId, signInEnvs);
+        staleRpIdSignIn = input.passkeyRpId
+            ? false
+            : await removeLoginEnv(deps.coolify, signInApp.appId, LOGIN_PASSKEY_RP_ID_ENV);
     }
     // Deploy an app that was just created, is not running (a throw after the
     // create left it never deployed, or it stopped), or whose envs changed.
@@ -2290,10 +2353,12 @@ export async function provisionAuthStack(scope, deps, target, input) {
     // died between the write and the deploy leaves the marker unset, and the next run sees no env diff.
     const loginEnvUnconfirmed = Boolean(heldMailKey &&
         input.smtpSender &&
-        recorded[PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY] !== authLoginEnvMarker(input.smtpSender));
+        recorded[PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY] !==
+            authLoginEnvMarker(input.smtpSender, input.passkeyRpId));
     if (loginApp.justCreated ||
         !loginApp.running ||
         loginEnvsChanged ||
+        staleRpIdLogin ||
         loginEnvUnconfirmed ||
         authRefChanged) {
         await deps.coolify.deploy(loginAppId);
@@ -2305,6 +2370,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         (signInApp.justCreated ||
             !signInApp.running ||
             signInEnvsChanged ||
+            staleRpIdSignIn ||
             bindKeyWritten ||
             bindKeyUnconfirmed ||
             loginEnvUnconfirmed ||
@@ -2316,7 +2382,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
     // The mail env is live on the login apps: written above and deployed with them. Without the held
     // key the marker stays unset, so the step is planned again once the key is held.
     if (heldMailKey && input.smtpSender) {
-        await record(PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, authLoginEnvMarker(input.smtpSender));
+        await record(PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, authLoginEnvMarker(input.smtpSender, input.passkeyRpId));
     }
     // #211: the broker's own `server.ts` refuses to start without
     // `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` and `LETTERMINT_API_TOKEN` --
@@ -2501,7 +2567,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         // gets here right after the deploy.
         await waitForInstance(`https://${hostname}/.well-known/openid-configuration`, runtime, sleep, label);
         const zitadel = instanceZitadel();
-        const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
+        const org = await platformAuthFirstOrg(zitadel, target.kind === 'org' ? recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY] : undefined);
         // #216 round 5: recorded here too (mirroring `provisionPlatformArchon`),
         // so `authLoginClientDrifted` (below) never needs its own ZITADEL call
         // to resolve the org -- see that function's own doc comment.
@@ -2642,7 +2708,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
             throw new Error(`${label}: the login-client token of ZITADEL machine user ${loginClientLost} was minted but never confirmed delivered; remove the recorded key ${PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
         const loginClientZitadel = instanceZitadel();
-        const { org: loginClientOrg } = await loginClientZitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
+        const loginClientOrg = await platformAuthFirstOrg(loginClientZitadel, target.kind === 'org' ? freshRecordedIds[PLATFORM_ZITADEL_ORG_SCOPE_KEY] : undefined);
         // #216 round 5: backfills the org id for a platform whose admin block
         // (above) ran before this recording existed and has not run since --
         // see `authLoginClientDrifted`'s own doc comment.
@@ -2788,12 +2854,17 @@ export async function provisionAuthStack(scope, deps, target, input) {
             (deps.signinMailWritable !== true ||
                 typeof mailZitadel.ensureEmailOtpMessageText !== 'function' ||
                 typeof mailZitadel.ensureLabelPolicy !== 'function' ||
+                typeof mailZitadel.ensureOrgName !== 'function' ||
                 typeof mailZitadel.ensureEmailOtpGenerator !== 'function')) {
             console.info(`${label}: the host cannot write message texts, so the sign-in mail keeps ZITADEL's default text`);
         }
         else if (input.mailBranding) {
+            const firstOrgId = scope.recordedIds()[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+            if (!firstOrgId) {
+                throw new Error(`${label}: the instance's first organisation is not recorded`);
+            }
             try {
-                await applySigninMail(mailZitadel, input.mailBranding.companyName);
+                await applySigninMail(mailZitadel, input.mailBranding.companyName, firstOrgId);
             }
             catch (error) {
                 const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
@@ -2854,6 +2925,41 @@ export async function provisionAuthStack(scope, deps, target, input) {
             }
         }
     }
+    // The broker's registrar token: made once, held, written to the broker's env, adopted when set by hand.
+    // Last, so a stop here never holds up the login env, the mail or the invite above. It is reported, not
+    // thrown: the plan names the step again while the token is due, or blocked while it was minted and not held.
+    if (input.registrarOrgIds) {
+        try {
+            const firstOrgId = scope.recordedIds()[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+            if (!firstOrgId) {
+                throw new RegistrarTokenError(`${label}: the instance's first organisation is not recorded`);
+            }
+            await ensureBrokerRegistrarToken({
+                label,
+                zitadel: instanceZitadel(),
+                coolify: deps.coolify,
+                brokerAppId,
+                homeOrgId: firstOrgId,
+                orgIds: input.registrarOrgIds,
+                heldKeys: deps.heldKeys,
+                ref: target.refs.registrarToken,
+                recorded: () => scope.recordedIds(),
+                record,
+                persist: async () => {
+                    await scope.persist();
+                },
+                secret: (value) => runtime.onSecret?.(value),
+                sleep,
+                log: (line) => console.info(line),
+            });
+        }
+        catch (error) {
+            // Only our own text, which names ids; any other cause can carry a token.
+            console.warn(error instanceof RegistrarTokenError
+                ? error.message
+                : `${label}: the broker's registrar token is not in place yet; the next apply tries again`);
+        }
+    }
     return { resourceId: zitadelAppId };
 }
 /** The platform's sign-in project: the shared `platform` project, its id recorded under the sign-in's own scope key. */
@@ -2886,6 +2992,8 @@ async function provisionPlatformAuth(context, deps, options = {}) {
         // In-app sign-in: the second login app copies the login's host table (the host's port writes that).
         ...(signInLogin ? { signInLogin: { bindings: null } } : {}),
         mcp,
+        // The shared companies' organisations are granted by each company's registrar step.
+        ...(deps.registrarTokenWritable === true ? { registrarOrgIds: [] } : {}),
     });
 }
 /**
@@ -6161,6 +6269,30 @@ async function authAppsNotRunning(coolify, recordedIds) {
     }
     return false;
 }
+/**
+ * Whether the login app, the in-app login app or the broker still has a fixed container name
+ * (`custom_internal_name`), which stops Coolify's rolling update. `rollingUpdateSettings` clears it on every
+ * run of the step, so this plans the step again for an app made before. A Coolify read error counts as not drifted.
+ */
+async function authAppsKeepInternalName(coolify, recordedIds) {
+    for (const scopeKey of [
+        PLATFORM_AUTH_LOGIN_SCOPE_KEY,
+        SIGN_IN_LOGIN_APP_SCOPE_KEY,
+        PLATFORM_AUTH_BROKER_SCOPE_KEY,
+    ]) {
+        const appId = recordedIds[scopeKey];
+        if (!appId)
+            continue;
+        try {
+            if ((await coolify.getApplication(appId)).custom_internal_name)
+                return true;
+        }
+        catch {
+            // Nothing logged: the error can carry Coolify's response.
+        }
+    }
+    return false;
+}
 /**
  * Archon's live release webhook secret is missing, or is not the one its last deploy recorded
  * (`PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY`): the release hook step wrote it after Archon's
@@ -7516,6 +7648,17 @@ export function brokerDeployRecordValue(brokerAppId, authAppsRaw) {
     };
     return JSON.stringify(record);
 }
+const LOGIN_PASSKEY_RP_ID_ENV = 'LOGIN_PASSKEY_RP_ID';
+/** Removes one env from an app when it is live. True when it was removed; false with nothing live or no delete on the port. */
+async function removeLoginEnv(coolify, appId, key) {
+    if (typeof coolify.deleteEnv !== 'function')
+        return false;
+    const row = (await coolify.listEnvs(appId)).find((e) => e.key === key && !e.is_preview);
+    if (!row?.uuid)
+        return false;
+    await coolify.deleteEnv(appId, row.uuid);
+    return true;
+}
 /** Whether any desired env is missing from the app, or set to another value. */
 export async function envsDiffer(coolify, appId, desired) {
     const live = new Map((await coolify.listEnvs(appId)).filter((e) => !e.is_preview).map((e) => [e.key, e.value]));
@@ -8069,7 +8212,7 @@ const EDGE_REPO = 'wtfalch/edge';
 const PLATFORM_EDGE_PROJECT = 'platform';
 const PLATFORM_EDGE_DB_NAME = 'platform-edge-db';
 const EDGE_APP_NAME = 'edge';
-/** The app's fixed `custom_internal_name`, the way `platform:files`' runner names itself. */
+/** The app's network alias (#1054: not a `custom_internal_name`, which turns off rolling updates). */
 const EDGE_RUNNER_INTERNAL_NAME = 'platform-edge';
 /** The runner's port (its Dockerfile: `PORT=3000`, `EXPOSE 3000`). */
 const EDGE_PORT = '3000';
@@ -8274,7 +8417,7 @@ async function provisionPlatformEdge(context, deps) {
     // port the `waitForNewDeployment` call below already probes internally.
     await deps.coolify.updateApplication(appId, {
         dockerfile_target_build: 'runner',
-        custom_internal_name: EDGE_RUNNER_INTERNAL_NAME,
+        ...rollingUpdateSettings(EDGE_RUNNER_INTERNAL_NAME),
         git_branch: gitRef,
         ...healthCheckSettings('/api/health', Number(EDGE_PORT)),
     });

package/dist/plan/signin-mail.d.ts

@@ -2,7 +2,7 @@
  * The sign-in code mail of a company that runs its own sign-in: the company's name in the sender and
  * the text, the platform's design tokens for the look. ZITADEL's email-code message is built from the
  * instance's custom text and label policy; both are written through `PlatformZitadelMailBranding`
- * (`@wtfalch/providers` 0.14.0), each only when it differs. The code itself (six digits, five minutes)
+ * (`@wtfalch/providers`), each only when it differs. The code itself (six digits, five minutes)
  * is the instance's email-OTP generator.
  *
  * The look: no company declares a design foundry can read (an `OrgTheme` lives in cms and reaches
@@ -10,7 +10,7 @@
  * (`SIGNIN_MAIL_LABEL_POLICY`). No logo: ZITADEL takes it as a multipart upload the client does not make.
  */
 /** Raise it when the text or the look changes, so an applied company plans its sign-in step again. */
-export declare const AUTH_SIGNIN_MAIL_VERSION = "2";
+export declare const AUTH_SIGNIN_MAIL_VERSION = "3";
 /** `signinMailMarker` of the company name and version last written, recorded after both writes. */
 export declare const PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY = "auth_signin_mail_applied";
 /** The code the mail carries: six digits, valid five minutes (`123-456` in the mail, see `signinMailText`). */
@@ -18,8 +18,16 @@ export declare const SIGNIN_MAIL_CODE: {
     readonly length: 6;
     readonly expirySeconds: 300;
 };
-/** The three ZITADEL calls the sign-in mail needs. `@wtfalch/providers` 0.14.0's `ZitadelClient` has all. */
+/** The four ZITADEL calls the sign-in mail needs. */
 export interface PlatformZitadelMailBranding {
+    /**
+     * Renames an organisation, only when its name differs (`PUT /management/v1/orgs/me` as that
+     * organisation). The login shows the instance's default organisation's name as its wordmark when the
+     * host is bound to no company, so a company's own instance names it after the company.
+     */
+    ensureOrgName(orgId: string, name: string): Promise<{
+        changed: boolean;
+    }>;
     ensureEmailOtpMessageText(language: string, text: {
         title: string;
         preHeader: string;
@@ -65,6 +73,11 @@ export declare const SIGNIN_MAIL_LANGUAGE = "en";
  * holds the code, split in the middle with Go's `slice` (`123-456`), because ZITADEL renders the
  * greeting as the large heading, so the code is the first thing the reader sees. No greeting by
  * name: the login fills names from the email address, so it would read "Wtfalch Wtfalch".
+ *
+ * Paragraphs: ZITADEL v4.17.3 puts `{{.Text}}` in one `<div>` of its built-in mail, where a line
+ * break collapses to a space. It escapes the field (`html/template`), then un-escapes the whole mail
+ * before sending it over SMTP (`internal/notification/types/user_email.go:43`,
+ * `html.UnescapeString`), so `<p>` tags in the text arrive as tags. There is no mail template API.
  */
 export declare function signinMailText(companyName: string): {
     title: string;
@@ -91,7 +104,7 @@ export declare const SIGNIN_MAIL_LABEL_POLICY: {
     readonly warnColorDark: "#FF9C8C";
     readonly disableWatermark: true;
 };
-/** Writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. */
-export declare function applySigninMail(zitadel: PlatformZitadelMailBranding, companyName: string): Promise<{
+/** Names the default organisation after the company, then writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. */
+export declare function applySigninMail(zitadel: PlatformZitadelMailBranding, companyName: string, defaultOrgId: string): Promise<{
     changed: boolean;
 }>;