@wtfalch/foundry 0.3.0 → 0.4.0

package/dist/plan/executor.js

@@ -1,5 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
+import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
+import { MAS_IMAGE, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 // ---------------------------------------------------------------------------
 // Errors
 // ---------------------------------------------------------------------------
@@ -32,14 +34,30 @@ function hostnameFor(org) {
 }
 /**
  * `cms.<domain>` -- the cms studio's own hostname (`cmsSite` below), apart
- * from the public site itself at `org.domain` (used directly there). Only
- * ever called from `cmsSite`, which only ever runs once `org.site.enabled`
- * is true, so `org.domain` is non-null by the same `validateSite` guarantee
+ * from the public site itself at `org.domain` (used directly there). Called
+ * from `cmsSite` and from `zitadelApp` for the fixed `cms` client (#139),
+ * both of which only run once `org.site.enabled` is true, so `org.domain`
+ * is non-null by the same `validateSite` guarantee
  * {@link tunnelIngressHostnames}'s own doc comment cites.
  */
 function cmsHostnameFor(org) {
     return `cms.${org.domain}`;
 }
+/**
+ * #145's "Decided" (2026-09-27): the calls service's own public hostname.
+ * `calls.usesDomain: false` (or no `domain`) is served flat, like
+ * `<slug>-stage.oikos.host` and `<slug>-pr-<n>.oikos.host` (`../slug.ts`) --
+ * the shared tunnel's wildcard `*.oikos.host` DNS record already reaches it,
+ * so nothing changes in `scripts/shared-ingress.mjs`. `calls.usesDomain: true`
+ * gets `calls.<domain>` instead, on its own per-org tunnel
+ * ({@link tunnelIngressHostnames}), the same subdomain-of-the-org's-own-domain
+ * shape {@link cmsHostnameFor} uses for `cms.<domain>`.
+ */
+function callsHostnameFor(org) {
+    return org.calls.usesDomain && org.domain
+        ? `calls.${org.domain}`
+        : `${org.slug}-calls.oikos.host`;
+}
 /**
  * The hostnames `cloudflareTunnel` routes to `COOLIFY_PROXY_ORIGIN`
  * (https://github.com/wtfalch/foundry/issues/115). A site-enabled org
@@ -51,11 +69,17 @@ function cmsHostnameFor(org) {
  * concretely a hosting org, whose one app hostname this served before #115
  * ever existed -- keeps exactly the prior single-hostname behavior
  * ({@link hostnameFor}), unchanged.
+ *
+ * #145: an own-domain calls service adds `calls.<domain>` on top of whichever
+ * of those a site/hosting org already gets, since calls can run alongside
+ * either (or neither).
  */
 function tunnelIngressHostnames(org) {
-    if (org.site.enabled && org.domain)
-        return [org.domain, `cms.${org.domain}`];
-    return [hostnameFor(org)];
+    const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [hostnameFor(org)];
+    if (org.calls.enabled && org.calls.usesDomain && org.domain) {
+        hostnames.push(`calls.${org.domain}`);
+    }
+    return hostnames;
 }
 /**
  * The health URLs an outside prober should call for this org (#43): one per
@@ -141,8 +165,15 @@ const RATE_LIMIT_REQUESTS_PER_PERIOD = 10;
  * org declares none of its own — the repo may not exist yet at decision
  * time, and Coolify's own GitHub App create call is what will fail loudly
  * against it, the same as any other repo name that does not exist.
+ *
+ * Hestia moved into this repo's own `apps/hestia` (estate DECISIONS.md,
+ * 2026-09-28; the hestia repo archives once this move lands), so the
+ * standard app now builds from foundry's own repo, told apart from
+ * `packages/foundry` by `dockerfile_location` — the same one-repo,
+ * multiple-apps shape `cmsSite`/`CMS_APP_DOCKERFILE` already use below.
  */
-const DEFAULT_APP_REPO = 'wtfalch/hestia';
+const DEFAULT_APP_REPO = 'wtfalch/foundry';
+const DEFAULT_APP_DOCKERFILE = 'apps/hestia/Dockerfile';
 /**
  * The one repo `cmsSite` builds both of its apps from
  * (https://github.com/wtfalch/cms) -- the 2026-09-25 decision this campaign
@@ -185,6 +216,16 @@ const MAIL_HOST = 'mail.wtfalch.dev';
  * report).
  */
 const APP_CLIENT_ID_SCOPE_KEY = 'zitadel_app_client_id';
+/**
+ * #139: the `cms` app's own ZITADEL web client's `clientId`, recorded
+ * separately from {@link APP_CLIENT_ID_SCOPE_KEY} -- that key belongs to the
+ * org's own hosted app (`diff.ts`'s `planIssuerApps`), a different
+ * `zitadel:app` step from the fixed `cms` client `diff.ts`'s `planCmsClient`
+ * plans. `cmsSite` reads this key to push `AUTH_CLIENT_ID` onto the cms app,
+ * the same way `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` for the hosted
+ * app.
+ */
+const CMS_CLIENT_ID_SCOPE_KEY = 'cms_client_id';
 /**
  * `cmsSite` provisions two applications from one `cms:site` step, but
  * `execute`'s own return value auto-records only one `resourceId`, under
@@ -210,6 +251,86 @@ const SITE_APP_SCOPE_KEY = 'coolify_site_app';
  * never collide with that form.
  */
 const CMS_DATABASE_SCOPE_KEY = 'coolify_cms_database';
+/**
+ * #138: the Resend domain's own id (`createDomain`/`findDomain`'s result,
+ * never a key or token) for this org's mail domain -- recorded so the app
+ * step (#140 rework) can scope its `<slug>-app@<domainId>` key to this domain without
+ * calling Resend a second time to look it up. No `system:kind:key` slot of
+ * its own for the same reason {@link CMS_DATABASE_SCOPE_KEY} has none:
+ * `coolify:mail`'s one step already auto-records `result.domain` as its
+ * `resourceId`.
+ */
+const RESEND_DOMAIN_ID_SCOPE_KEY = 'resend_domain_id';
+/**
+ * #138/#140: the mail domain `registerResendDomain` verified with Resend --
+ * `org.domain` when the org uses its own domain, else `<slug>.<apex>` for a
+ * domainless org (2026-09-28: domainless orgs get their own Resend domain
+ * too). Recorded so the app step can derive `MAIL_FROM` without recomputing
+ * `mailOrgFor`'s own domain choice, the same way {@link APP_CLIENT_ID_SCOPE_KEY}
+ * carries a public value out.
+ */
+const RESEND_MAIL_DOMAIN_SCOPE_KEY = 'resend_mail_domain';
+/**
+ * `coolifyCalls` provisions four resources from one `coolify:calls` step
+ * (#128) — the same one-step, several-resource shape `cmsSite` already solves
+ * with flat scope ids (`CMS_APP_SCOPE_KEY`/`SITE_APP_SCOPE_KEY`/
+ * `CMS_DATABASE_SCOPE_KEY`, that constant's own doc comment). This step's own
+ * auto-recorded `resourceId` (under `coolify:calls:<orgId>`) is the MAS app's
+ * id, the one every secret this stack mints lives on
+ * ({@link CALLS_SECRET_ENV_KEYS}); the other three get their own flat scope
+ * id here for the same reason CMS's site app and database do.
+ */
+const CALLS_SYNAPSE_SCOPE_KEY = 'coolify_calls_synapse';
+const CALLS_MAS_SCOPE_KEY = 'coolify_calls_mas';
+const CALLS_SYNAPSE_DB_SCOPE_KEY = 'coolify_calls_synapse_database';
+const CALLS_MAS_DB_SCOPE_KEY = 'coolify_calls_mas_database';
+/**
+ * Synapse refuses to start against a database whose `LC_COLLATE`/`LC_CTYPE`
+ * is not `C` (https://element-hq.github.io/synapse/latest/postgres.html);
+ * Coolify's official postgres image otherwise creates one with `en_US.utf8`.
+ * `postgres_initdb_args` is the only point this can be set -- it cannot be
+ * migrated onto an existing database. MAS has no such requirement, so this
+ * is passed for the Synapse database only. Not using Synapse's own
+ * `allow_unsafe_locale` escape hatch: that trades a loud startup refusal for
+ * silent index corruption after a future glibc upgrade.
+ */
+const CALLS_SYNAPSE_DB_INITDB_ARGS = '--locale=C --encoding=UTF8';
+/**
+ * `CallsMatrixSecrets`' six fields, held nowhere else once minted
+ * (`calls-matrix.ts`'s own doc comment: no `ctx.outputs` state file exists
+ * here) — pushed onto the MAS app's own envs purely as memory for the next
+ * apply, never read by MAS itself (MAS reads only its `config.yaml` file
+ * storage). `multiline: true` on the two PEM keys, the same flag
+ * `CoolifyPort.bulkUpsertEnvs` already carries for exactly this shape of
+ * value.
+ */
+const CALLS_SECRET_ENV_KEYS = {
+    masSynapseSharedSecret: 'CALLS_MATRIX_MAS_SYNAPSE_SHARED_SECRET',
+    masClientId: 'CALLS_MATRIX_MAS_CLIENT_ID',
+    masClientSecret: 'CALLS_MATRIX_MAS_CLIENT_SECRET',
+    masEncryptionKey: 'CALLS_MATRIX_MAS_ENCRYPTION_KEY',
+    masRsaKeyPem: 'CALLS_MATRIX_MAS_RSA_KEY_PEM',
+    masEcKeyPem: 'CALLS_MATRIX_MAS_EC_KEY_PEM',
+};
+/** `FROM ${MAS_IMAGE}` plus the entry command its published image needs (chat's own `MAS_DOCKERFILE`, same reason: no arguments by default). */
+const CALLS_MAS_DOCKERFILE = [
+    `FROM ${MAS_IMAGE}`,
+    'CMD ["server", "--config", "/config/config.yaml"]',
+].join('\n');
+/**
+ * `coolifyCallsService`'s own database (#145) -- no `system:kind:key` slot
+ * of its own, the same reason {@link CALLS_SYNAPSE_SCOPE_KEY}'s doc comment
+ * gives for the Matrix stack's two: this step's one auto-recorded
+ * `resourceId` (under `coolify:calls-service:<orgId>`) is the calls service
+ * app itself, not its database.
+ */
+const CALLS_SERVICE_DB_SCOPE_KEY = 'coolify_calls_service_database';
+/** `wtfalch/calls`'s own repo -- `coolifyCallsService` deploys its `packages/service` (#145, part 2 of #128). */
+const CALLS_SERVICE_REPO = 'wtfalch/calls';
+/** `packages/service/Dockerfile`, built from the repo root (that Dockerfile's own top comment). */
+const CALLS_SERVICE_DOCKERFILE = 'packages/service/Dockerfile';
+/** The port `calls/packages/service/Dockerfile` documents (`EXPOSE 8080`) -- `config.mjs`'s own `PORT` has no default, so this must be pushed explicitly. */
+const CALLS_SERVICE_PORT = '8080';
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
  * `exited:unhealthy` `` -- `@wtfalch/providers`' own doc comment) means it is
@@ -249,10 +370,14 @@ export class FoundryStepExecutor {
                 return this.coolifyApp(action, org, context);
             case 'coolify:database':
                 return this.coolifyDatabase(action, org, context);
+            case 'coolify:calls':
+                return this.coolifyCalls(action, org, context);
+            case 'coolify:calls-service':
+                return this.coolifyCallsService(action, org, context);
             case 'cloudflare:tunnel':
                 return this.cloudflareTunnel(action, org, context);
             case 'cloudflare:zone':
-                return this.cloudflareZone(action);
+                return this.cloudflareZone(action, org);
             case 'cloudflare:access':
                 return this.cloudflareAccess(org);
             case 'cloudflare:ratelimit':
@@ -266,7 +391,7 @@ export class FoundryStepExecutor {
             case 'ai:budget':
                 return this.aiBudget(action, org);
             case 'coolify:mail':
-                return this.coolifyMail(action, org);
+                return this.coolifyMail(action, org, context);
             case 'coolify:chat':
                 throw new NotBuiltError(`coolify:chat for ${org.slug}`, "chat's per-org Synapse+MAS has no admin API yet; tracked at https://github.com/wtfalch/chat/issues/40");
             case 'cms:site':
@@ -427,10 +552,39 @@ export class FoundryStepExecutor {
         const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
         // A kind change deletes the recorded app then recreates it (task
         // brief); the first-ever create for this key has nothing recorded, so
-        // this is a no-op then.
+        // this is a no-op then. A 404 here (already gone) is tolerated the same
+        // way `destroy` tolerates one -- a retry after the delete half already
+        // succeeded but the recreate half failed must find an already-deleted
+        // app a no-op, not a new error that wedges the apply forever.
         const priorAppId = recorded[`zitadel:app:${action.key}`];
         if (priorAppId) {
-            await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, priorAppId);
+            try {
+                await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, priorAppId);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+            // The recreate half is retried on its own failure (the delete above
+            // already tolerates the resulting 404), so a retry can also land here
+            // after an earlier attempt's create call actually succeeded against
+            // ZITADEL but whose response this executor never saw (a dropped
+            // connection, a killed process). That app is deleted, not reused: the
+            // lost response also lost its clientSecret and clientId, which
+            // `listApps` cannot return, so reusing it would leave the secret
+            // undelivered and the clientId unrecorded forever. The create below
+            // then runs every side effect. A first-ever create (no `priorAppId`)
+            // has nothing to find here and never pays this read.
+            const orphan = await this.findRecreatedApp(zitadelOrgId, projectId, action.key, appType);
+            if (orphan) {
+                try {
+                    await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, orphan.id);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
         }
         if (appType === 'api') {
             const created = await this.ports.zitadel.createApiApp(zitadelOrgId, projectId, {
@@ -442,7 +596,13 @@ export class FoundryStepExecutor {
             await this.ports.deliverSecret(`zitadel:app:${org.slug}:${action.key}`, created.clientSecret);
             return { resourceId: created.appId };
         }
-        const hostname = hostnameFor(org);
+        // #139: the fixed `cms` client (`diff.ts`'s `planCmsClient`) signs
+        // people into the cms studio at `cms.<domain>`, not the org's own app
+        // hostname -- `org.site.enabled` guarantees `org.domain` is set
+        // (`org.ts`'s `validateSite`), the same guarantee `cmsHostnameFor`'s own
+        // doc comment relies on.
+        const isCmsClient = action.key === 'cms' && org.site.enabled;
+        const hostname = isCmsClient ? cmsHostnameFor(org) : hostnameFor(org);
         // Native apps sign in via device code, with no redirect of their own
         // (auth/scripts/provision.mjs:475-497, prior art cited in the decisions
         // file) -- empty arrays rather than a web app's callback/logout URLs.
@@ -453,15 +613,30 @@ export class FoundryStepExecutor {
             postLogoutRedirectUris: appType === 'native' ? [] : [`https://${hostname}/`],
         });
         if (appType === 'web') {
-            // `coolifyApp`'s own `pushAppEnv` reads this to push AUTH_CLIENT_ID
-            // (level-1 app-env campaign, gap P2) -- public, not a secret, so a
-            // plain scope id, not `deliverSecret`. A native app signs in via
-            // device code with no cookie session of its own, so its clientId is
-            // never something the app's env needs.
-            context.recordScopeId(APP_CLIENT_ID_SCOPE_KEY, created.clientId);
+            // `coolifyApp`'s own `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` to
+            // push AUTH_CLIENT_ID (level-1 app-env campaign, gap P2); `cmsSite`
+            // reads `CMS_CLIENT_ID_SCOPE_KEY` for the same env on the cms app
+            // (#139) -- public, not a secret, so a plain scope id, not
+            // `deliverSecret`. A native app signs in via device code with no
+            // cookie session of its own, so its clientId is never something an
+            // app's env needs.
+            context.recordScopeId(isCmsClient ? CMS_CLIENT_ID_SCOPE_KEY : APP_CLIENT_ID_SCOPE_KEY, created.clientId);
         }
         return { resourceId: created.appId };
     }
+    /**
+     * The app an earlier attempt's recreate already made under the same
+     * name, whose response this executor never saw -- deleted before the
+     * create so no duplicate is left behind. Matches on name and the
+     * desired kind, and skips a removed app -- ZITADEL's
+     * search can return one that has since been deleted (`isNotFoundError`'s
+     * own doc comment covers why a delete can be retried into a 404), and
+     * that is not the survivor this is looking for.
+     */
+    async findRecreatedApp(zitadelOrgId, projectId, name, appType) {
+        const apps = await this.ports.zitadel.listApps(zitadelOrgId, projectId);
+        return apps.find((app) => app.name === name && app.appType === appType && app.state !== 'APP_STATE_REMOVED');
+    }
     async ensureZitadelProject(org, zitadelOrgId, context) {
         const recorded = context.recordedIds();
         const existing = recorded.zitadel_project;
@@ -537,6 +712,9 @@ export class FoundryStepExecutor {
                 build_pack: org.hosting.buildPack,
                 name: org.slug,
                 domains: hostnameFor(org),
+                // Only the shared standard app builds from this repo; a bespoke
+                // app's Dockerfile is at its own repo's root.
+                dockerfile_location: org.bespokeAppRepo ? undefined : DEFAULT_APP_DOCKERFILE,
             });
             appId = created.uuid;
         }
@@ -562,6 +740,11 @@ export class FoundryStepExecutor {
         // unlike the database push above: every app has a hostname, and an
         // upsert of the same value on a later apply is a no-op, not a change.
         await this.pushAppEnv(appId, org, context);
+        // #140 rework: the hosted app's own Resend sending key and `MAIL_FROM`
+        // (only the app started by this same step, per the design's "only apps
+        // that send mail get it" -- cms and calls do not). A no-op until
+        // `coolify:mail` has actually registered a Resend domain for this org.
+        await this.ensureAppResendKey(appId, org, context, Boolean(existing));
         return { resourceId: appId };
     }
     /**
@@ -735,6 +918,83 @@ export class FoundryStepExecutor {
             return null;
         return randomBytes(32).toString('base64');
     }
+    /**
+     * #140 rework: the hosted app's own Resend sending key, pushed as
+     * `RESEND_API_KEY` straight into the app's env, the one place its token
+     * ever lives (Resend shows a key's token once, at creation). A no-op until
+     * `coolify:mail` has recorded a {@link RESEND_DOMAIN_ID_SCOPE_KEY} for this
+     * org; the next apply fills it in once `coolify:mail` runs first
+     * (`diff.ts`'s `computePlanDetail` order).
+     *
+     * The key is named `<slug>-app@<resendDomainId>`, so a key limited to a
+     * mail domain the org no longer uses (a `usesDomain` flip moves it between
+     * `org.domain` and `<slug>.<apex>`) never passes for the current one.
+     * `RESEND_API_KEY_ID` sits beside the token in the env -- an id, not a
+     * secret -- so the env can say which key its token belongs to.
+     *
+     * The mint rule (`.plans/2026-09-27-org-mail-resend-design.md` "One rule
+     * for minting"): healthy when the env holds a token and its
+     * `RESEND_API_KEY_ID` is the one key Resend lists under the current name.
+     * Otherwise one fresh key is minted and written to the env first, and only
+     * then is every other `<slug>-app@` key deleted -- a lost mint response, a
+     * duplicate, a hand-made key, and a previous domain's key all end the same
+     * way. An app that was already running is restarted before that delete,
+     * since a container reads its env only at start (`running`, the same
+     * reason {@link ensureLogVolume} restarts one). The restart is not
+     * awaited to completion, so the old container can briefly outlive its key.
+     *
+     * `MAIL_FROM` is upserted every time: it depends only on the mail domain
+     * `coolify:mail` resolved (`RESEND_MAIL_DOMAIN_SCOPE_KEY`).
+     *
+     * The token goes straight to `bulkUpsertEnvs` and nowhere else: never
+     * returned, never recorded in `serviceIds` (`recordScopeId`'s own doc
+     * comment), never logged, never interpolated into a thrown error -- the
+     * same discipline `pushDatabaseUrl`'s doc comment states for a database's
+     * own connection string.
+     */
+    async ensureAppResendKey(appId, org, context, running) {
+        const recorded = context.recordedIds();
+        const domainId = recorded[RESEND_DOMAIN_ID_SCOPE_KEY];
+        if (!domainId)
+            return;
+        const prefix = `${org.slug}-app@`;
+        const keyName = `${prefix}${domainId}`;
+        const [ours, envs] = await Promise.all([
+            this.ports.resend.listApiKeys().then((keys) => keys.filter((k) => k.name.startsWith(prefix))),
+            this.ports.coolify.listEnvs(appId),
+        ]);
+        const envValue = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+        const current = ours.filter((k) => k.name === keyName);
+        const held = current.length === 1 ? current[0] : undefined;
+        const healthy = held !== undefined &&
+            Boolean(envValue('RESEND_API_KEY')) &&
+            envValue('RESEND_API_KEY_ID') === held.id;
+        const envUpdates = [];
+        let keep = healthy ? held?.id : undefined;
+        if (!healthy) {
+            const created = await this.ports.resend.createApiKey({
+                name: keyName,
+                permission: 'sending_access',
+                domainId,
+            });
+            keep = created.id;
+            envUpdates.push({ key: 'RESEND_API_KEY', value: created.token }, { key: 'RESEND_API_KEY_ID', value: created.id });
+        }
+        const mailDomain = recorded[RESEND_MAIL_DOMAIN_SCOPE_KEY];
+        if (mailDomain)
+            envUpdates.push({ key: 'MAIL_FROM', value: `no-reply@${mailDomain}` });
+        if (envUpdates.length > 0)
+            await this.ports.coolify.bulkUpsertEnvs(appId, envUpdates);
+        // A running container read its env at start and still holds the old
+        // token, so a fresh key only reaches it through a restart -- before the
+        // old key is deleted below. A just-created app starts with the new env.
+        if (!healthy && running)
+            await this.ports.coolify.restart(appId);
+        for (const key of ours) {
+            if (key.id !== keep)
+                await this.ports.resend.deleteApiKey(key.id);
+        }
+    }
     /**
      * `plan/diff.ts`'s `planSite` (#116, slicing #99's "provision the cms app,
      * database and site app per org"): the 2026-09-25 decision
@@ -832,11 +1092,32 @@ export class FoundryStepExecutor {
         // (see that section's own comment) instead of caught, so a database
         // failure must not also cost the app these two calls already have
         // everything they need for.
-        await this.ports.coolify.bulkUpsertEnvs(cms.appId, [
+        //
+        // #139: `@wtfalch/cms`'s `AUTH_*` contract
+        // (https://github.com/wtfalch/cms/blob/main/apps/host/.env.example),
+        // pushed in this same call. `AUTH_ORGANIZATION_ID` and `AUTH_CLIENT_ID`
+        // are pushed only once their own source step has recorded them --
+        // `zitadel:issuer` and this org's `cms` `zitadel:app` step
+        // (`diff.ts`'s `planCmsClient`), both ordered before `cms:site` for
+        // exactly this reason, the same rule `pushAppEnv` follows for the
+        // hosted app. `AUTH_COOKIE_SECRET` is generated once and never rotated
+        // (`ensureAuthCookieSecret`'s own doc comment).
+        const recorded = context.recordedIds();
+        const cmsEnvs = [
             { key: 'APP_URL', value: `https://${cmsHostnameFor(org)}` },
             { key: 'CMS_ORGANISATION_ID', value: org.id },
             { key: 'CMS_SITE_URL', value: `https://${domain}` },
-        ]);
+        ];
+        if (recorded.zitadel_org) {
+            cmsEnvs.push({ key: 'AUTH_ORGANIZATION_ID', value: recorded.zitadel_org });
+        }
+        const cmsClientId = recorded[CMS_CLIENT_ID_SCOPE_KEY];
+        if (cmsClientId)
+            cmsEnvs.push({ key: 'AUTH_CLIENT_ID', value: cmsClientId });
+        const cookieSecret = await this.ensureAuthCookieSecret(cms.appId);
+        if (cookieSecret)
+            cmsEnvs.push({ key: 'AUTH_COOKIE_SECRET', value: cookieSecret });
+        await this.ports.coolify.bulkUpsertEnvs(cms.appId, cmsEnvs);
         await this.ports.coolify.bulkUpsertEnvs(site.appId, [
             { key: 'CMS_URL', value: `https://${cmsHostnameFor(org)}` },
         ]);
@@ -1015,6 +1296,371 @@ export class FoundryStepExecutor {
         });
         return { appId: created.uuid, existed: false };
     }
+    // ---- calls (#128) ------------------------------------------------------
+    /**
+     * `plan/diff.ts`'s `planCalls`: the org's own calls Matrix stack, entirely
+     * separate from chat's (`calls-matrix.ts`'s own top doc comment) -- two
+     * Coolify-managed Postgres databases, a Synapse app and an MAS app, no
+     * public hostname of its own (neither app is reachable from outside
+     * Coolify's own Docker network) -- `coolifyCallsService` below (#145, part 2
+     * of #128) is the one that gets a public hostname, since it is the one a
+     * browser actually talks to. Park stops Synapse and MAS only, the same
+     * park-not-delete rule `coolifyApp`/`cmsSite` already follow (#7
+     * corrections 1) -- their databases are never touched from that branch, the
+     * same way `cmsSite`'s own database never is.
+     */
+    async coolifyCalls(action, org, context) {
+        if (action.desired.enabled === false) {
+            const recorded = context.recordedIds();
+            const synapseId = recorded[CALLS_SYNAPSE_SCOPE_KEY];
+            const masId = recorded[CALLS_MAS_SCOPE_KEY];
+            if (!synapseId && !masId) {
+                throw new Error(`coolify:calls for ${org.slug}: no live calls stack recorded, nothing to park`);
+            }
+            if (synapseId)
+                await this.ports.coolify.raw('POST', `/applications/${synapseId}/stop`);
+            if (masId)
+                await this.ports.coolify.raw('POST', `/applications/${masId}/stop`);
+            return { resourceId: masId ?? synapseId };
+        }
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const server = await this.resolveServer();
+        const names = {
+            synapse: `${org.slug}-calls-synapse`,
+            mas: `${org.slug}-calls-mas`,
+            synapseDb: `${org.slug}-calls-synapse-db`,
+            masDb: `${org.slug}-calls-mas-db`,
+        };
+        const synapseDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.synapseDb, 'synapse', CALLS_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS);
+        context.recordScopeId(CALLS_SYNAPSE_DB_SCOPE_KEY, synapseDbId);
+        const masDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.masDb, 'mas', CALLS_MAS_DB_SCOPE_KEY);
+        context.recordScopeId(CALLS_MAS_DB_SCOPE_KEY, masDbId);
+        const [synapseDbRow, masDbRow] = await Promise.all([
+            this.ports.coolify.getDatabase(synapseDbId),
+            this.ports.coolify.getDatabase(masDbId),
+        ]);
+        const synapseDb = synapseDbRow.internal_db_url
+            ? parseCallsDbUrl(synapseDbRow.internal_db_url)
+            : null;
+        const masDb = masDbRow.internal_db_url ? parseCallsDbUrl(masDbRow.internal_db_url) : null;
+        if (!synapseDb || !masDb) {
+            // Static config check before the two apps below are ever touched
+            // (issue #128's "static config checks run before the first Coolify
+            // call", carried from PR 344's review) -- Coolify can take a moment to
+            // report a freshly created database's `internal_db_url`; the next
+            // apply retries this from a clean, unstarted state rather than half
+            // deploying Synapse or MAS against a connection string it does not have
+            // yet.
+            throw new Error(`coolify:calls for ${org.slug}: a database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        const synapse = await this.findOrCreateCallsApp(names.synapse, environment.id, () => this.ports.coolify.createDockerImageApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            docker_registry_image_name: SYNAPSE_IMAGE,
+            docker_registry_image_tag: SYNAPSE_TAG,
+            ports_exposes: '8008',
+            name: names.synapse,
+            description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${SYNAPSE_TAG})`,
+            instant_deploy: false,
+        }));
+        if (!synapse.existed) {
+            await this.ports.coolify.updateApplication(synapse.appId, {
+                health_check_enabled: false,
+                custom_internal_name: names.synapse,
+            });
+        }
+        context.recordScopeId(CALLS_SYNAPSE_SCOPE_KEY, synapse.appId);
+        const mas = await this.findOrCreateCallsApp(names.mas, environment.id, () => this.ports.coolify.createDockerfileApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            dockerfile: CALLS_MAS_DOCKERFILE,
+            name: names.mas,
+            description: `matrix-authentication-service for ${org.slug}'s calls stack`,
+            instant_deploy: false,
+        }));
+        if (!mas.existed) {
+            await this.ports.coolify.updateApplication(mas.appId, {
+                health_check_enabled: false,
+                custom_internal_name: names.mas,
+            });
+        }
+        context.recordScopeId(CALLS_MAS_SCOPE_KEY, mas.appId);
+        // Synapse's own signing key, media store and pid file (#75's own
+        // durable-volume convention, reused here for a different reason: this
+        // volume is Synapse's own state, not a log).
+        const synapseStorages = await this.ports.coolify.listStorages(synapse.appId);
+        if (!(synapseStorages.persistent_storages ?? []).some((s) => s.mount_path === '/data')) {
+            await this.ports.coolify.createPersistentStorage(synapse.appId, {
+                name: `${names.synapse}-data`,
+                mount_path: '/data',
+            });
+        }
+        const secrets = await this.ensureCallsMatrixSecrets(mas.appId);
+        await this.ensureCallsFileStorage(synapse.appId, '/data/homeserver.yaml', callsSynapseHomeserverYaml({
+            orgSlug: org.slug,
+            db: synapseDb,
+            masHost: names.mas,
+            masSharedSecret: secrets.value.masSynapseSharedSecret,
+        }));
+        // Synapse's official image reads `/data/homeserver.yaml` by default, but
+        // it also needs write access to the mounted volume it does not own by
+        // default (`calls/proof/provider/scripts/guest-stack.mjs`'s own working
+        // config carries the same three envs).
+        await this.ports.coolify.bulkUpsertEnvs(synapse.appId, [
+            { key: 'SYNAPSE_CONFIG_PATH', value: '/data/homeserver.yaml' },
+            { key: 'UID', value: '0' },
+            { key: 'GID', value: '0' },
+        ]);
+        await this.ensureCallsFileStorage(mas.appId, '/config/config.yaml', callsMasConfigYaml({
+            orgSlug: org.slug,
+            db: masDb,
+            synapseHost: names.synapse,
+            sharedSecret: secrets.value.masSynapseSharedSecret,
+            clientId: secrets.value.masClientId,
+            clientSecret: secrets.value.masClientSecret,
+            encryptionKey: secrets.value.masEncryptionKey,
+            rsaKeyPem: secrets.value.masRsaKeyPem,
+            ecKeyPem: secrets.value.masEcKeyPem,
+        }));
+        // Issue #128's "a running app is redeployed when its config changed"
+        // (PR 344's review fix): a file-storage write alone never reaches a
+        // running container until its next deploy, but redeploying an unchanged,
+        // already-running app on every apply would mean this step never
+        // converges. A brand new app or a freshly minted secret set are the only
+        // two reasons the file just written could differ from what the container
+        // already has -- reusing existing secrets means byte-identical content.
+        if (!synapse.existed || secrets.changed)
+            await this.ports.coolify.deploy(synapse.appId);
+        if (!mas.existed || secrets.changed)
+            await this.ports.coolify.deploy(mas.appId);
+        return { resourceId: mas.appId };
+    }
+    /**
+     * `coolifyCalls`'s own find-or-create for Synapse/MAS, restarting a
+     * found-but-stopped app (#116 review round 3, Finding 1's same fix). Reused
+     * by `coolifyCallsService` (#145) for the calls service app itself -- the
+     * same find-by-name-then-start-or-create shape applies unchanged.
+     */
+    async findOrCreateCallsApp(name, environmentId, create) {
+        const existing = await this.ports.coolify.findApplicationByName(name, {
+            environmentIds: [environmentId],
+        });
+        if (existing) {
+            const live = await this.ports.coolify.getApplication(existing.uuid);
+            if (!isRunningOrStarting(live.status)) {
+                await this.ports.coolify.raw('POST', `/applications/${existing.uuid}/start`);
+            }
+            return { appId: existing.uuid, existed: true };
+        }
+        const created = await create();
+        return { appId: created.uuid, existed: false };
+    }
+    /**
+     * `coolifyCalls`'s own database find-or-create, modeled on
+     * `ensureCmsDatabase`: `context.recordedIds()` is checked first since
+     * neither database has a `system:kind:key` slot of its own (this step's one
+     * auto-recorded `resourceId` is the MAS app, not either database --
+     * {@link CALLS_SYNAPSE_SCOPE_KEY}'s own doc comment), then `listDatabases`
+     * finds one already created by name before `createPostgresDatabase` makes
+     * one. Reused by `coolifyCallsService` (#145) for the calls service's own
+     * database, whose {@link CALLS_SERVICE_DB_SCOPE_KEY} has no
+     * `system:kind:key` slot of its own for the same reason.
+     */
+    async ensureCallsDatabase(context, projectUuid, environment, name, postgresDb, scopeKey, postgresInitdbArgs) {
+        const existing = context.recordedIds()[scopeKey];
+        if (existing)
+            return existing;
+        const found = (await this.ports.coolify.listDatabases()).find((d) => d.name === name && d.environment_id === environment.id);
+        if (found)
+            return found.uuid;
+        const server = await this.resolveServer();
+        const created = await this.ports.coolify.createPostgresDatabase({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            name,
+            postgres_db: postgresDb,
+            postgres_user: postgresDb,
+            ...(postgresInitdbArgs ? { postgres_initdb_args: postgresInitdbArgs } : {}),
+        });
+        return created.uuid;
+    }
+    /**
+     * Reads back {@link CALLS_SECRET_ENV_KEYS} from the MAS app's own envs
+     * before minting fresh ones -- this stack's only memory across a re-run
+     * (`calls-matrix.ts`'s `CallsMatrixSecrets` doc comment). `changed: true`
+     * only when nothing usable was found: a partial set (a crash mid-mint) is
+     * still treated as "mint fresh", since MAS's shared secret and Synapse's
+     * copy of it must always agree.
+     */
+    async ensureCallsMatrixSecrets(masAppId) {
+        const envs = await this.ports.coolify.listEnvs(masAppId);
+        const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+        const fields = Object.entries(CALLS_SECRET_ENV_KEYS);
+        const existing = {};
+        for (const [field, envKey] of fields) {
+            const value = read(envKey);
+            if (value !== undefined)
+                existing[field] = value;
+        }
+        const hasAll = fields.every(([field]) => existing[field] !== undefined);
+        if (hasAll)
+            return { value: existing, changed: false };
+        const minted = mintCallsMatrixSecrets();
+        await this.ports.coolify.bulkUpsertEnvs(masAppId, fields.map(([field, envKey]) => ({
+            key: envKey,
+            value: minted[field],
+            multiline: field === 'masRsaKeyPem' || field === 'masEcKeyPem',
+        })));
+        return { value: minted, changed: true };
+    }
+    /**
+     * Upserts a file storage's content, creating it if the application has none
+     * at that mount path yet -- there is no way to read a file storage's
+     * current content back from Coolify to diff it, the same limit
+     * `archon/bootstrap/steps/chat-instance.ts`'s own `ensureFileStorage` notes,
+     * so an existing one is always re-written.
+     */
+    async ensureCallsFileStorage(applicationUuid, mountPath, content) {
+        const storages = await this.ports.coolify.listStorages(applicationUuid);
+        const found = storages.file_storages?.find((s) => s.mount_path === mountPath);
+        if (found) {
+            await this.ports.coolify.updateFileStorage(applicationUuid, found.uuid, content);
+        }
+        else {
+            await this.ports.coolify.createFileStorage(applicationUuid, {
+                mount_path: mountPath,
+                content,
+            });
+        }
+    }
+    // ---- calls service (#145, part 2 of #128) -------------------------------
+    /**
+     * `plan/diff.ts`'s `planCallsService`: the org's own calls service --
+     * `wtfalch/calls`'s `packages/service`, wired to the calls Matrix stack
+     * {@link coolifyCalls} provisions and the shared LiveKit SFU (#122/#127).
+     * Static config checks run first, before any Coolify call (#128's own
+     * carried-over PR 344 review fix, restated in #145's own issue body): the
+     * calls Matrix stack must already be recorded, its MAS app must already
+     * carry its client id/secret, and the shared SFU's LiveKit credentials must
+     * already be resolvable -- none of the three is minted or guessed here.
+     * Park stops the app only, the same park-not-delete rule
+     * {@link coolifyCalls}/{@link coolifyApp} already follow (#7 corrections
+     * 1); its own database is never touched from that branch.
+     */
+    async coolifyCallsService(action, org, context) {
+        if (action.desired.enabled === false) {
+            const appId = context.recordedIds()[`coolify:calls-service:${action.key}`];
+            if (!appId) {
+                throw new Error(`coolify:calls-service for ${org.slug}: no live app recorded, nothing to park`);
+            }
+            await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
+            return { resourceId: appId };
+        }
+        const recorded = context.recordedIds();
+        const synapseId = recorded[CALLS_SYNAPSE_SCOPE_KEY];
+        const masId = recorded[CALLS_MAS_SCOPE_KEY];
+        if (!synapseId || !masId) {
+            throw new Error(`coolify:calls-service for ${org.slug}: the calls Matrix stack has not been provisioned yet -- coolify:calls must run first`);
+        }
+        const masCredentials = await this.readCallsMasClientCredentials(masId);
+        if (!masCredentials) {
+            throw new Error(`coolify:calls-service for ${org.slug}: the calls Matrix stack's MAS client credentials are not on the MAS app yet -- retry this apply once coolify:calls has minted them`);
+        }
+        const sfu = await this.ports.callsSfu.resolveCredentials();
+        if (!sfu) {
+            throw new Error(`coolify:calls-service for ${org.slug}: the shared calls SFU has no LiveKit credentials configured yet -- see https://github.com/wtfalch/foundry/issues/122`);
+        }
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const name = `${org.slug}-calls`;
+        const synapseHost = `${org.slug}-calls-synapse`;
+        const masHost = `${org.slug}-calls-mas`;
+        const dbName = `${name}-db`;
+        const dbId = await this.ensureCallsDatabase(context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY);
+        context.recordScopeId(CALLS_SERVICE_DB_SCOPE_KEY, dbId);
+        const db = await this.ports.coolify.getDatabase(dbId);
+        if (!db.internal_db_url) {
+            throw new Error(`coolify:calls-service for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        const server = await this.resolveServer();
+        const githubApp = await this.ports.coolify.requireGithubApp();
+        const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            github_app_uuid: githubApp.uuid,
+            git_repository: CALLS_SERVICE_REPO,
+            git_branch: 'main',
+            build_pack: 'dockerfile',
+            name,
+            domains: callsHostnameFor(org),
+            dockerfile_location: CALLS_SERVICE_DOCKERFILE,
+        }));
+        // Every app foundry deploys keeps its own logs (#75), reused as-is here.
+        await this.ensureLogVolume(app.appId, org, app.existed);
+        const bindingSecret = await this.ensureCallsBindingSecret(app.appId);
+        const envs = [
+            { key: 'DATABASE_URL', value: db.internal_db_url },
+            { key: 'LIVEKIT_URL', value: CALLS_SFU_PRIVATE_URL },
+            { key: 'LIVEKIT_PUBLIC_URL', value: CALLS_SFU_PUBLIC_URL },
+            { key: 'LIVEKIT_API_KEY', value: sfu.apiKey },
+            { key: 'LIVEKIT_API_SECRET', value: sfu.apiSecret },
+            { key: 'MAS_URL', value: `http://${masHost}:8080/` },
+            { key: 'MAS_HOMESERVER', value: callsServerName(org.slug) },
+            { key: 'MAS_CLIENT_ID', value: masCredentials.clientId },
+            { key: 'MAS_CLIENT_SECRET', value: masCredentials.clientSecret },
+            { key: 'SYNAPSE_URL', value: `http://${synapseHost}:8008` },
+            { key: 'CALLS_ORIGIN', value: `https://${callsHostnameFor(org)}` },
+            { key: 'CALLS_HOST_ADAPTER', value: 'production' },
+            { key: 'CALLS_TRUSTED_IP_HEADER', value: 'cf-connecting-ip' },
+            { key: 'PORT', value: CALLS_SERVICE_PORT },
+        ];
+        if (bindingSecret)
+            envs.push({ key: 'CALLS_BINDING_SECRET', value: bindingSecret });
+        await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        return { resourceId: app.appId };
+    }
+    /**
+     * Reads back the calls Matrix stack's MAS client id/secret from the MAS
+     * app's own envs ({@link CALLS_SECRET_ENV_KEYS}) -- never mints: minting
+     * either is {@link ensureCallsMatrixSecrets}'s own job, and a missing value
+     * here means that stack has not finished provisioning yet, not something
+     * this step can fix on its own.
+     */
+    async readCallsMasClientCredentials(masAppId) {
+        const envs = await this.ports.coolify.listEnvs(masAppId);
+        const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+        const clientId = read(CALLS_SECRET_ENV_KEYS.masClientId);
+        const clientSecret = read(CALLS_SECRET_ENV_KEYS.masClientSecret);
+        if (!clientId || !clientSecret)
+            return null;
+        return { clientId, clientSecret };
+    }
+    /**
+     * `null` once the calls service app already has a `CALLS_BINDING_SECRET` --
+     * never rotated, the same rule {@link ensureAuthCookieSecret} follows for
+     * `AUTH_COOKIE_SECRET`: it wraps the provider-token ciphertext already
+     * stored under any binding minted so far
+     * (`calls/packages/service/src/config.mjs`'s own doc comment on
+     * `CALLS_BINDING_SECRET`), so overwriting it would strand every binding
+     * minted under the old value. 32 raw bytes, hex-encoded -- the exact shape
+     * `config.mjs`'s own regex requires.
+     */
+    async ensureCallsBindingSecret(appId) {
+        const envs = await this.ports.coolify.listEnvs(appId);
+        const already = envs.some((e) => e.key === 'CALLS_BINDING_SECRET' && !e.is_preview);
+        if (already)
+            return null;
+        return randomBytes(32).toString('hex');
+    }
     // ---- cloudflare --------------------------------------------------------
     async cloudflareTunnel(action, org, context) {
         if (action.desired.enabled === false) {
@@ -1058,12 +1704,34 @@ export class FoundryStepExecutor {
         });
         return { resourceId: tunnel.id };
     }
-    async cloudflareZone(action) {
+    /**
+     * `plan/diff.ts`'s `planZone`: finds or creates the Cloudflare zone for the
+     * org's own domain. Refuses to adopt a zone the store already records
+     * under a *different* org's applied state (#131), the same
+     * do-not-adopt-a-foreign-resource rule `cloudflareAccess` above enforces --
+     * but where that method tells "foundry's own" from "foreign" by reading
+     * Cloudflare's own Access-app name live, a Cloudflare zone carries no
+     * org-identifying field of its own, so this asks the store instead. That
+     * matters because two different, DB-unique `domain` values (`org.ts`'s
+     * `validateDomain` plus its unique index) can still resolve to the same
+     * Cloudflare zone -- a zone is keyed by apex, and one org's domain can be a
+     * subdomain of another org's -- which is exactly the shared-zone,
+     * shared-hostname collision this ticket exists to refuse. An org re-running
+     * its own already-recorded zone is unaffected: the store then names this
+     * same org as the owner.
+     */
+    async cloudflareZone(action, org) {
         const domain = action.key;
-        const existing = await this.ports.cloudflare.findZoneByApex(domain);
-        if (existing)
+        const cf = this.ports.cloudflare;
+        const existing = await cf.findZoneByApex(domain);
+        if (existing) {
+            const owner = await this.ports.declaredOrgStore.findOrgIdForZone(existing.id);
+            if (owner !== null && owner !== org.id) {
+                throw new Error(`cloudflare:zone for ${org.slug}: zone ${existing.id} (${domain}) is already recorded under org ${owner}; foundry does not adopt it`);
+            }
             return { resourceId: existing.id };
-        const created = await this.ports.cloudflare.createZone(domain);
+        }
+        const created = await cf.createZone(domain);
         return { resourceId: created.id };
     }
     // ---- mail -----------------------------------------------------------
@@ -1071,9 +1739,16 @@ export class FoundryStepExecutor {
      * `plan/diff.ts`'s `planMail`: gives an org mail, moves it between modes,
      * or parks it on the one shared Stalwart instance (`this.ports.mail`,
      * `@wtfalch/email/postmaster`'s `applyOrgMail`/`parkOrgMail` bound), then
-     * publishes whatever DNS records the call returns.
+     * publishes whatever DNS records the call returns, then registers the same
+     * mail domain with Resend (#138) -- the shared Stalwart relays every
+     * outbound message through Resend, and Resend refuses mail from a domain
+     * it has not verified. No step here ever deletes the app's Resend key:
+     * `diff.ts`'s `planMail` plans nothing for mode `'off'`, so turning mail
+     * off leaves the key live, like every other resource foundry stops
+     * managing (#10). Switching the mail domain replaces the key instead
+     * (`ensureAppResendKey`).
      */
-    async coolifyMail(action, org) {
+    async coolifyMail(action, org, context) {
         const mode = action.desired.mode;
         const usesDomain = action.desired.usesDomain;
         const options = { apex: MAIL_APEX, mailHost: MAIL_HOST };
@@ -1082,7 +1757,8 @@ export class FoundryStepExecutor {
             return undefined;
         }
         const result = await this.ports.mail.applyOrgMail(mailOrgFor(org, usesDomain, mode), options);
-        await this.publishMailDnsRecords(org, result);
+        const zoneId = await this.publishMailDnsRecords(org, result);
+        await this.registerResendDomain(result.domain, zoneId, context);
         return { resourceId: result.domain };
     }
     /**
@@ -1090,7 +1766,9 @@ export class FoundryStepExecutor {
      * by an exact name+type match (`CloudflarePort.findDnsRecord`'s own doc
      * comment) so update never mistakes a stale record of a different type for
      * a match. A `DKIM` record can be absent on the first call, since Stalwart
-     * mints the key on a background task; the next apply publishes it.
+     * mints the key on a background task; the next apply publishes it. Returns
+     * the zone id so `registerResendDomain` publishes Resend's own records on
+     * the same zone without a second lookup.
      */
     async publishMailDnsRecords(org, result) {
         const cf = this.ports.cloudflare;
@@ -1108,6 +1786,99 @@ export class FoundryStepExecutor {
                 await cf.createDnsRecord(zone.id, rec);
             }
         }
+        return zone.id;
+    }
+    /**
+     * #138: registers `domain` with Resend -- the custom domain, or
+     * `<slug>.<apex>` for a level-1 org, exactly what `publishMailDnsRecords`
+     * just published the Stalwart records for. Idempotent by name, the same way
+     * `applyOrgMail` itself is: found by `findDomain` rather than any id this
+     * class recorded, so a crash between here and the next apply just repeats
+     * the same find-or-create. Never blocks on DNS propagation (task brief):
+     * `verifyDomain` asks Resend to re-check once, and its returned status is
+     * neither polled nor awaited -- an unverified domain here is exactly what
+     * the next apply corrects.
+     *
+     * #140 rework: mints no key of its own any more. It records the domain's
+     * own id and the resolved mail domain as scope ids so `ensureAppResendKey`
+     * (`coolifyApp`) can mint the app's own `<slug>-app@<domainId>` key once the app
+     * exists, without this step or the app step calling Resend to look the
+     * domain back up.
+     */
+    async registerResendDomain(domain, zoneId, context) {
+        const existing = await this.ports.resend.findDomain(domain);
+        const resendDomain = existing
+            ? await this.ports.resend.getDomain(existing.id)
+            : await this.ports.resend.createDomain(domain);
+        await this.publishResendDnsRecords(zoneId, resendDomain.records ?? []);
+        await this.ports.resend.verifyDomain(resendDomain.id);
+        context.recordScopeId(RESEND_DOMAIN_ID_SCOPE_KEY, resendDomain.id);
+        context.recordScopeId(RESEND_MAIL_DOMAIN_SCOPE_KEY, domain);
+    }
+    /**
+     * Upserts each DNS record Resend's domain names, the same find-then-upsert
+     * `publishMailDnsRecords` above uses for Stalwart's own records -- except
+     * SPF is merged into whatever record that call just published rather than
+     * created a second time (RFC 7208 treats two `v=spf1` TXT records on one
+     * name as a permerror and silently breaks SPF for every sender on the
+     * domain), and an existing `_dmarc` record is never overwritten. Prior art:
+     * `wtfalch/app-template`'s `bootstrap/steps/resend-email.ts`.
+     */
+    async publishResendDnsRecords(zoneId, records) {
+        const cf = this.ports.cloudflare;
+        for (const record of records) {
+            if (record.type === 'TXT' && record.value.toLowerCase().startsWith('v=spf1')) {
+                await this.mergeResendSpfRecord(cf, zoneId, record);
+                continue;
+            }
+            if (record.type === 'TXT' && record.value.toLowerCase().startsWith('v=dmarc1')) {
+                await this.ensureResendDmarcRecord(cf, zoneId, record);
+                continue;
+            }
+            const [existing] = await cf.findDnsRecord(zoneId, record.name, record.type);
+            const rec = { type: record.type, name: record.name, content: record.value };
+            if (existing) {
+                await cf.updateDnsRecord(zoneId, existing.id, rec);
+            }
+            else {
+                await cf.createDnsRecord(zoneId, rec);
+            }
+        }
+    }
+    /**
+     * Inserts Resend's `include:` token into whatever SPF record
+     * `publishMailDnsRecords` already published for this name, instead of
+     * creating a second `v=spf1` TXT record -- the classic foot-gun that makes
+     * every receiver treat SPF as a permerror and skip it entirely.
+     */
+    async mergeResendSpfRecord(cf, zoneId, record) {
+        const includeToken = record.value.match(/include:\S+/i)?.[0] ?? 'include:_spf.resend.com';
+        const existingSpf = (await cf.findDnsRecord(zoneId, record.name, 'TXT')).find((r) => r.content.toLowerCase().startsWith('v=spf1'));
+        if (!existingSpf) {
+            await cf.createDnsRecord(zoneId, { type: 'TXT', name: record.name, content: record.value });
+            return;
+        }
+        if (existingSpf.content.toLowerCase().includes(includeToken.toLowerCase()))
+            return;
+        const merged = /\s+[~\-?+]all\s*$/.test(existingSpf.content)
+            ? existingSpf.content.replace(/\s+([~\-?+])all\s*$/, ` ${includeToken} $1all`)
+            : `${existingSpf.content.trim()} ${includeToken}`;
+        await cf.updateDnsRecord(zoneId, existingSpf.id, {
+            type: 'TXT',
+            name: record.name,
+            content: merged,
+        });
+    }
+    /**
+     * Never overwrites an existing `_dmarc` record -- a stricter policy an org
+     * already set (`p=quarantine`/`p=reject`) should not be relaxed back to
+     * Resend's own `p=none` default.
+     */
+    async ensureResendDmarcRecord(cf, zoneId, record) {
+        const hasDmarc = (await cf.findDnsRecord(zoneId, record.name, 'TXT')).some((r) => r.content.toLowerCase().startsWith('v=dmarc1'));
+        if (hasDmarc)
+            return;
+        await cf.createDnsRecord(zoneId, { type: 'TXT', name: record.name, content: record.value });
     }
     // ---- files / ai --------------------------------------------------------
     /**