@wtfalch/foundry 0.31.0 → 0.33.1

package/dist/plan/platform-providers.js

@@ -3,13 +3,17 @@ import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
+import { ownerMailboxes } from '../org.js';
+import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
-import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { ACCESS_POLICY_NAME, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonAuthOrganizationId, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
+export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
@@ -207,6 +211,12 @@ export class FoundryPlatformStepExecutor {
             // #216 round 5: see `PlanPlatformOptions.blocked.authOtherInputsMissing`.
             if (otherInputsMissing.length > 0)
                 blocked.authOtherInputsMissing = otherInputsMissing;
+            // C3: the owner's invite needs a work address and the host's mail port. Without them it is
+            // a blocked item, never a throw on every apply.
+            const ownerCompany = await this.declaredOrgStore.get(platform.ownerOrgId);
+            const inviteBlocked = ownerInviteBlockedReason(ownerCompany, Boolean(this.auth.ownerInviteMail));
+            if (inviteBlocked)
+                blocked.authOwnerInvite = inviteBlocked;
         }
         if (platform.mail.enabled) {
             const mailBlocked = await mailBlockedReason(platform, this.mail, recordedIds);
@@ -365,6 +375,16 @@ export class FoundryPlatformStepExecutor {
                 console.error(`platform:archon: could not reach the platform's ZITADEL client to plan the ID token repair: ${e instanceof Error ? e.message : String(e)}`);
             }
         }
+        // Not a block: without the auth dependencies and a ZITADEL client for the instance the sign-in policy step is not planned.
+        if (this.auth && platform.auth.enabled && recordedIds[PLATFORM_ZITADEL_ORG_SCOPE_KEY]) {
+            try {
+                this.auth.zitadelForInstance?.(`https://${platform.auth.hostname}`);
+                blocked.authSignInPolicy = true;
+            }
+            catch (e) {
+                console.error(`platform:auth: could not reach the platform's ZITADEL client to plan the sign-in policy: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
         // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
         if (this.archon?.runsInsideApp) {
             blocked.archonRunsInsideApp = true;
@@ -458,9 +478,18 @@ export class FoundryPlatformStepExecutor {
                 ? recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
                 : undefined);
             const brokerDrifted = !accessDrifted && (await archonBrokerRegistrationDrifted(this.archon.coolify, recordedIds));
-            const bootstrapOperatorDrifted = !accessDrifted &&
+            const authOrgDrifted = !accessDrifted &&
+                !brokerDrifted &&
+                (await archonAuthOrgDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], recordedIds));
+            const authzDrifted = !accessDrifted &&
                 !brokerDrifted &&
-                (await archonBootstrapOperatorDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], recordedIds));
+                !authOrgDrifted &&
+                (await archonAuthzDatabaseDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], await this.declaredOrgStore.get(platform.ownerOrgId)));
+            const bridgeDrifted = !accessDrifted &&
+                !brokerDrifted &&
+                !authOrgDrifted &&
+                !authzDrifted &&
+                (await archonBridgeDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], await this.declaredOrgStore.get(platform.ownerOrgId)));
             // #480: re-reads the live app's rolling-update/health-check settings
             // even once `PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY` is
             // recorded -- that marker only ever proves one past apply patched them,
@@ -469,7 +498,9 @@ export class FoundryPlatformStepExecutor {
             // back off.
             const rollingUpdateDrifted = !accessDrifted &&
                 !brokerDrifted &&
-                !bootstrapOperatorDrifted &&
+                !authOrgDrifted &&
+                !authzDrifted &&
+                !bridgeDrifted &&
                 (await archonRollingUpdateDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]));
             // The deployment the step triggered failed or Coolify does not know it:
             // plan the step again, which deploys again. A finished one is confirmed
@@ -480,7 +511,9 @@ export class FoundryPlatformStepExecutor {
                 (await archonDeploymentState(this.archon.coolify, deployment)) === 'failed';
             if (accessDrifted ||
                 brokerDrifted ||
-                bootstrapOperatorDrifted ||
+                authOrgDrifted ||
+                authzDrifted ||
+                bridgeDrifted ||
                 rollingUpdateDrifted ||
                 redeployFailed)
                 result.archon = true;
@@ -552,7 +585,7 @@ export class FoundryPlatformStepExecutor {
                 throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
             }
             const company = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformAuth(context, this.auth, company?.owners ?? []);
+            return provisionPlatformAuth(context, this.auth, company);
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_FILES_KEY) {
             if (!this.files) {
@@ -586,7 +619,8 @@ export class FoundryPlatformStepExecutor {
             if (!this.archon) {
                 throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
             }
-            return provisionPlatformArchon(context, this.archon);
+            const ownerCompany = await this.declaredOrgStore.get(context.platform.ownerOrgId);
+            return provisionPlatformArchon(context, this.archon, ownerCompany);
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_MAIL_KEY) {
             if (!this.mail) {
@@ -608,6 +642,14 @@ export class FoundryPlatformStepExecutor {
             }
             return switchOnArchonIdTokenUserinfo(context, this.archon);
         }
+        if (action.system === 'zitadel' &&
+            action.kind === 'sign-in-policy' &&
+            action.key === PLATFORM_AUTH_KEY) {
+            if (!this.auth) {
+                throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
+            }
+            return applyPlatformSignInPolicy(context, this.auth);
+        }
         if (action.system === 'cloudflare' && action.kind === 'access-provider') {
             if (!this.accessProvider) {
                 throw new Error('cloudflare:access-provider needs FoundryPlatformStepExecutor to be constructed with its Access provider dependencies (#604)');
@@ -1198,8 +1240,9 @@ async function liveLoginClientTokenHash(coolify, appId) {
  * #197: a `cloudflared` connector for this tunnel is run
  * ({@link ensureCloudflaredConnector}), so `hostname` answers.
  */
-async function provisionPlatformAuth(context, deps, owners = []) {
+async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     const { platform } = context;
+    const owners = ownerCompany?.owners ?? [];
     const hostname = platform.auth.hostname;
     const gitRef = platform.auth.gitRef;
     const recorded = context.recordedIds();
@@ -1756,6 +1799,28 @@ async function provisionPlatformAuth(context, deps, owners = []) {
         // own doc comment, and `authLoginClientDrifted`'s, for why.
         await record(PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, loginClientRecordValue(loginClientUserId, loginClientPatId, loginClientToken));
     }
+    // ---- the owner company's own sign-in org ----------------------------------
+    // Archon signs people in from this org; the `foundry` org holds none. The
+    // company executor finds the same org by name (its slug) and makes no second.
+    const ownerOrgZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+    let ownerSignInOrgId;
+    if (ownerCompany) {
+        ({ orgId: ownerSignInOrgId } = await ensureSignInOrg({
+            domainBlockedScopeKey: PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY,
+            zitadel: ownerOrgZitadel,
+            name: ownerCompany.slug,
+            domain: signInOrgDomain(ownerCompany),
+            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            persistScopeIds: async () => {
+                await context.persist?.();
+            },
+            orgScopeKey: PLATFORM_OWNER_ORG_SCOPE_KEY,
+            domainScopeKey: PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY,
+        }));
+    }
+    else {
+        await record(PLATFORM_OWNER_ORG_SCOPE_KEY, 'none');
+    }
     // ---- ZITADEL mail and the owner's invite ----------------------------------
     // The token is the held key, else the broker's live env. Absent, nothing
     // here can run; `authBrokerBlockedReason` already reports it by name.
@@ -1786,63 +1851,97 @@ async function provisionPlatformAuth(context, deps, owners = []) {
             ]);
             throw new Error(`platform:auth: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
         }
-        if (!context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY]) {
+        const inviteRecorded = context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+        const inviteOrgRecorded = context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY];
+        // An invite recorded for another org (the `foundry` org, before the owner moved) is made again.
+        if (!inviteRecorded || (inviteRecorded !== 'none' && inviteOrgRecorded !== ownerSignInOrgId)) {
             const owner = owners[0];
-            if (!owner) {
+            if (!owner || !ownerCompany || !ownerSignInOrgId) {
                 // No owner declared: nothing to invite. Recorded so the step is not replanned for it.
                 await record(PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, 'none');
             }
             else {
-                const ownerOrgId = context.recordedIds()[PLATFORM_ZITADEL_ORG_SCOPE_KEY] ??
-                    (await mailZitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME)).org.id;
-                await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, ownerOrgId);
-                let invitedUserId;
-                try {
-                    // ZITADEL's default invite link is `/ui/v2/login/verify`, which 404s on the login app;
-                    // it serves `/verify` at the root.
-                    ({ userId: invitedUserId } = await mailZitadel.inviteOrgOwner(ownerOrgId, {
-                        givenName: owner.givenName,
-                        familyName: owner.familyName,
-                        email: owner.email,
-                    }, `https://${hostname}/verify?userId={{.UserID}}&code={{.Code}}&organization={{.OrgID}}&invite=true`));
-                }
-                catch (error) {
-                    // The cause, with the owner's email and the Lettermint key redacted, so a failure says why.
-                    const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
-                        owner.email,
-                        owner.email.toLowerCase(),
-                        mailToken,
-                        ...(smtpPassword ? [smtpPassword] : []),
-                    ]);
-                    throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerOrgId}: ${cause}`);
+                const mailboxAddress = ownerMailboxes(ownerCompany)[0]?.address;
+                // C3: `ownerInviteBlockedReason` reports these two as blocked; the step goes on without the invite.
+                if (mailboxAddress && deps.ownerInviteMail) {
+                    let invitedUserId;
+                    try {
+                        ({ userId: invitedUserId } = await inviteOwnerWithLink({
+                            zitadel: mailZitadel,
+                            mail: deps.ownerInviteMail,
+                            orgId: ownerSignInOrgId,
+                            authIssuer: `https://${hostname}`,
+                            owner: {
+                                givenName: owner.givenName,
+                                familyName: owner.familyName,
+                                mailboxAddress,
+                                personalEmail: owner.email,
+                            },
+                            label: 'platform:auth',
+                            ...(inviteRecorded && inviteRecorded !== 'none'
+                                ? { invitedUserId: inviteRecorded }
+                                : {}),
+                        }));
+                    }
+                    catch (error) {
+                        // The cause, with both addresses and the Lettermint key redacted, so a failure says why.
+                        const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
+                            owner.email,
+                            owner.email.toLowerCase(),
+                            mailboxAddress,
+                            mailToken,
+                            ...(smtpPassword ? [smtpPassword] : []),
+                        ]);
+                        throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerSignInOrgId}: ${cause}`);
+                    }
+                    // The user id first: a crash between the two replans the invite, never skips it.
+                    await record(PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, invitedUserId);
+                    await record(PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, ownerSignInOrgId);
                 }
-                await record(PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, invitedUserId);
             }
         }
     }
-    // ---- reserved username and closed registration, once each (#394) ----------
-    // Outside the blocks above so a platform applied before this existed gets
-    // it on its next apply; `planAuth` plans the step until both keys exist.
-    // Last, so a failure here holds up neither the SMTP provider nor the invite.
-    const policyRecorded = context.recordedIds();
-    if (!policyRecorded[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY] ||
-        !policyRecorded[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY]) {
-        const policyZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
-        let policyOrgId = policyRecorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
-        if (!policyOrgId) {
-            policyOrgId = (await policyZitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME)).org.id;
-            await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, policyOrgId);
+    return { resourceId: zitadelAppId };
+}
+/**
+ * Reserves the username `admin` and switches self-registration off in the
+ * platform's sign-in org (`zitadel:sign-in-policy` keyed {@link PLATFORM_AUTH_KEY}).
+ * Each call records its own key right after it succeeds, so a failure in the
+ * second leaves the first recorded and throws; the next plan names the step
+ * again. The error names the org only, never the cause.
+ */
+async function applyPlatformSignInPolicy(context, deps) {
+    const { platform } = context;
+    const recorded = context.recordedIds();
+    const orgId = recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    if (!orgId) {
+        throw new Error("platform:auth: the sign-in's ZITADEL org is not recorded yet -- cannot reserve the admin username or close registration");
+    }
+    const zitadel = deps.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? deps.zitadel;
+    const record = async (key, value) => {
+        context.recordScopeId(key, value);
+        await context.persist?.();
+    };
+    if (!recorded[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY]) {
+        let userId;
+        try {
+            ({ userId } = await zitadel.reserveUserName(orgId, PLATFORM_AUTH_RESERVED_USERNAME));
         }
-        if (!policyRecorded[PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY]) {
-            const { userId } = await policyZitadel.reserveUserName(policyOrgId, PLATFORM_AUTH_RESERVED_USERNAME);
-            await record(PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, userId);
+        catch {
+            throw new Error(`platform:auth: reserving the username '${PLATFORM_AUTH_RESERVED_USERNAME}' failed in ZITADEL org ${orgId}`);
         }
-        if (!policyRecorded[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY]) {
-            await policyZitadel.closeSelfRegistration(policyOrgId);
-            await record(PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, 'closed');
+        await record(PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, userId);
+    }
+    if (!recorded[PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY]) {
+        try {
+            await zitadel.closeSelfRegistration(orgId);
         }
+        catch {
+            throw new Error(`platform:auth: closing self-registration failed in ZITADEL org ${orgId}`);
+        }
+        await record(PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, 'closed');
     }
-    return { resourceId: zitadelAppId };
+    return {};
 }
 /** Lettermint's SMTP relay, as ZITADEL's SMTP provider wants it: `host:port`, STARTTLS. */
 const PLATFORM_AUTH_SMTP_HOST = 'smtp.lettermint.co:587';
@@ -2542,6 +2641,18 @@ async function mailBlockedReason(platform, mail, recordedIds) {
  * push it (see that function's own `heldMailKey` read) and clears the gap
  * for good.
  */
+/** Why the platform owner cannot be invited yet, or `null`. Fixed text: names no address. */
+export function ownerInviteBlockedReason(ownerCompany, hasInviteMail) {
+    if (!ownerCompany || ownerCompany.owners.length === 0)
+        return null;
+    if (!ownerMailboxes(ownerCompany)[0]?.address) {
+        return "the platform owner's invite is blocked, not planned: the owner has no work address (mailboxAddress), and the owner signs in as name@<the org's domain>";
+    }
+    if (!hasInviteMail) {
+        return "the platform owner's invite is blocked, not planned: the host built the platform's auth dependencies without ownerInviteMail, so the first-sign-in link cannot be sent";
+    }
+    return null;
+}
 async function authBrokerBlockedReason(auth, recordedIds) {
     const brokerAppId = recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY];
     if (!brokerAppId)
@@ -2723,8 +2834,6 @@ const PLATFORM_ARCHON_PROJECT_SCOPE_KEY = 'coolify_project_platform_archon';
 const PLATFORM_ARCHON_DB_SCOPE_KEY = 'coolify_platform_archon_database';
 const PLATFORM_ARCHON_TUNNEL_SCOPE_KEY = 'cloudflare_platform_archon_tunnel';
 const PLATFORM_ARCHON_ACCESS_SCOPE_KEY = 'cloudflare_platform_archon_access_app';
-/** The platform's own ZITADEL org (`foundry`, the one `provisionPlatformAuth` mints its admin user in). */
-export const PLATFORM_ZITADEL_ORG_SCOPE_KEY = 'zitadel_platform_org';
 const PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_platform_archon_project';
 /** The hostname the sign-in client's redirect URIs were made for; a change makes a new client. */
 const PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY = 'zitadel_platform_archon_client_hostname';
@@ -2865,7 +2974,7 @@ async function switchOnArchonIdTokenUserinfo(context, deps) {
  *   and `platform:integrations` are left for a further follow-up, since
  *   #543 did not establish a reachable url for either.
  */
-async function provisionPlatformArchon(context, deps) {
+async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const { platform } = context;
     const hostname = platform.archon.hostname;
     const gitRef = platform.archon.gitRef;
@@ -3046,10 +3155,13 @@ async function provisionPlatformArchon(context, deps) {
         clientId = created.clientId;
     }
     // ---- env ------------------------------------------------------------------
+    // People sign in from the owner company's sign-in org. The project, client
+    // and Access app above stay in the `foundry` org, which holds no people.
+    const authOrgId = archonAuthOrganizationId(context.recordedIds()) ?? org.id;
     const envs = [
         { key: 'APP_URL', value: `https://${hostname}` },
         { key: 'AUTH_ISSUER', value: issuer },
-        { key: 'AUTH_ORGANIZATION_ID', value: org.id },
+        { key: 'AUTH_ORGANIZATION_ID', value: authOrgId },
         { key: 'AUTH_CLIENT_ID', value: clientId },
     ];
     // #265: an owner URL or reporting site already on the app is kept as it is.
@@ -3073,6 +3185,24 @@ async function provisionPlatformArchon(context, deps) {
     const runtimeUrl = await ensureArchonRuntimeUrl(deps.coolify, appId, db.internal_db_url);
     if (runtimeUrl)
         envs.push({ key: 'DATABASE_URL', value: runtimeUrl });
+    // Archon's way into the owner company's people store. Not there until that
+    // company's Boule holds the peer password; `driftedSteps` then plans this
+    // step again. Its host is the company's database, not Archon's, so
+    // `assertSameDatabaseHost` is not applied to this key.
+    const authzDatabaseUrl = ownerCompany
+        ? await ownerAuthzDatabaseUrl(deps.coolify, ownerCompany, 'platform:archon')
+        : null;
+    if (authzDatabaseUrl)
+        envs.push({ key: ARCHON_AUTHZ_DATABASE_URL_ENV, value: authzDatabaseUrl });
+    // The invite form's secret and Boule's address, written together and only
+    // once Boule holds the secret: the secret is Boule's, copied here.
+    const bridge = ownerCompany
+        ? await ownerBridge(deps.coolify, ownerCompany, 'platform:archon')
+        : null;
+    if (bridge) {
+        envs.push({ key: BOULE_BRIDGE_SECRET_ENV, value: bridge.secret });
+        envs.push({ key: ARCHON_BOULE_URL_ENV, value: bridge.url });
+    }
     // #467: `envs` above only ever carries these four keys on the run that
     // generates or adopts them -- a later run that keeps them as they are
     // pushes none of it, so `envs` itself shrinks from one run to the next
@@ -3110,24 +3240,6 @@ async function provisionPlatformArchon(context, deps) {
         throw new Error(`platform:archon: app ${appId} lost its AUTH_APP_KEY between two reads`);
     }
     envs.push({ key: 'AUTH_APP_KEY', value: appKey });
-    // The owner `platform:auth` invited is Archon's first operator.
-    const bootstrapOperator = archonBootstrapOperator(recorded);
-    if (bootstrapOperator)
-        envs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: bootstrapOperator });
-    // #406: the invited platform owner's ZITADEL subject id, once
-    // `platform:auth` has recorded one -- the guard at the top of this
-    // function already requires `platform:auth` to have been applied before
-    // this step is reached, and `provisionPlatformAuth` records the owner
-    // invite (or, with no owner declared, the literal string 'none') as part
-    // of that same step, so by the time this runs the value here is whatever
-    // is actually true. `bootstrapOperator` (archon's `src/lib/authz/
-    // bootstrap.ts`) compares this verbatim against a signed-in user's
-    // subject id, so 'none' is skipped rather than written -- it would simply
-    // never match, but it is not a real id and should not look like one.
-    const ownerInviteUserId = recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
-    if (ownerInviteUserId && ownerInviteUserId !== 'none') {
-        envs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: ownerInviteUserId });
-    }
     // #501: a FILES_URL or FILES_AUDIENCE already on the app is kept (the #265
     // rule above), and hashed as the live value so it never reads as a changed
     // env.
@@ -3176,7 +3288,20 @@ async function provisionPlatformArchon(context, deps) {
     // deploy between this run's write and its confirmation).
     const envsHash = hashArchonEnvs(envs, archonEnvHashOverrides);
     const envsHashChanged = recorded[PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY] !== envsHash;
-    await deps.coolify.bulkUpsertEnvs(appId, envs);
+    try {
+        await deps.coolify.bulkUpsertEnvs(appId, envs);
+    }
+    catch (error) {
+        // Every value this write carries that came from the owner company's Boule.
+        const carried = [
+            bridge?.secret,
+            authzDatabaseUrl,
+            authzDatabaseUrl ? passwordOf(authzDatabaseUrl) : undefined,
+        ].filter((v) => Boolean(v));
+        if (carried.length === 0)
+            throw error;
+        throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), carried));
+    }
     // #436 round 2: `bulkUpsertEnvs` only adds or updates, so the
     // `FILES_MANAGEMENT_KEY` this step used to write before the fix above
     // would otherwise survive on an Archon already deployed with it --
@@ -3198,7 +3323,9 @@ async function provisionPlatformArchon(context, deps) {
     for (const stale of await deps.coolify.listEnvs(appId)) {
         // foundry#542: a disabled Worker's token leaves Archon's env too.
         const staleUptime = !platform.uptime.enabled && stale.key === 'UPTIME_TOKEN';
-        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime) && stale.uuid) {
+        // People now come from the owner company's store, so a first operator set by an older apply goes.
+        const staleOperator = stale.key === 'AUTHZ_BOOTSTRAP_OPERATOR';
+        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime || staleOperator) && stale.uuid) {
             await deps.coolify.deleteEnv(appId, stale.uuid);
             staleKeyDeleted = true;
         }
@@ -3229,13 +3356,16 @@ async function provisionPlatformArchon(context, deps) {
     // one. The first is kept (and updated below); the rest are dropped, so no
     // duplicate carries a stale key a broker client could still present.
     const archonMatchIndices = brokerApps
-        .map((a, i) => (a.organizationId === org.id && a.name === PLATFORM_ARCHON_ZITADEL_APP ? i : -1))
+        .map((a, i) => (a.organizationId === authOrgId || a.organizationId === org.id) &&
+        a.name === PLATFORM_ARCHON_ZITADEL_APP
+        ? i
+        : -1)
         .filter((i) => i >= 0);
     const archonEntryIndex = archonMatchIndices[0] ?? -1;
     const duplicateIndices = new Set(archonMatchIndices.slice(1));
     const archonEntry = {
         ...(archonEntryIndex >= 0 ? brokerApps[archonEntryIndex] : {}),
-        organizationId: org.id,
+        organizationId: authOrgId,
         key: appKey,
         name: PLATFORM_ARCHON_ZITADEL_APP,
         clientIds: [clientId],
@@ -3466,7 +3596,7 @@ async function provisionPlatformArchon(context, deps) {
     // (whose AUTH_APPS never carried this registration) from one still holding
     // it.
     await record(PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, brokerAppId);
-    await record(PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, bootstrapOperator ?? 'none');
+    await record(PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, authOrgId);
     // The host runs inside this app: every marker is recorded above, so the
     // deploy goes last and is not waited for -- the old container stops during
     // it, and the response, the lease and the audit row must be done first.
@@ -3908,7 +4038,7 @@ async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId
  */
 async function archonBrokerRegistrationDrifted(coolify, recordedIds) {
     const brokerAppId = recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY];
-    const orgId = recordedIds[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const orgId = archonAuthOrganizationId(recordedIds);
     if (!brokerAppId || !orgId)
         return false;
     try {
@@ -3919,34 +4049,156 @@ async function archonBrokerRegistrationDrifted(coolify, recordedIds) {
         return false;
     }
 }
+/** The decoded password of a connection URL, or `undefined` when it has none or cannot be parsed. */
+function passwordOf(url) {
+    try {
+        const password = new URL(url).password;
+        return password ? decodeURIComponent(password) : undefined;
+    }
+    catch (_error) {
+        // Not a parseable URL: there is no password to mask beyond the whole string.
+        return undefined;
+    }
+}
 /**
- * #406: whether the platform owner invite recorded under
- * {@link PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY} is a real user id (not
- * absent, not the literal `'none'` {@link provisionPlatformAuth} records
- * when no owner is declared) that Archon's live env does not yet carry as
- * `AUTHZ_BOOTSTRAP_OPERATOR`. `provisionPlatformAuth`'s own invite can
- * record after Archon's `coolify:app` id already has -- the owner invite
- * happens inside `platform:auth` only once its Lettermint token is held,
- * which Archon's own apply does not wait on -- so without this, an owner
- * invited after Archon's first deploy would need a redeploy by hand, the
- * way companyincluded.com's did. A failed read is not drift, the same rule
- * {@link archonAccessDrifted} and {@link archonBrokerRegistrationDrifted}
- * follow: the next plan reads again.
+ * The owner company's own Boule: the app named `<slug>-boule` in the
+ * `production` environment of the Coolify project foundry made for that org
+ * (marked with the org id). Never the first app of that name across Coolify,
+ * which another org's hosting entry can also produce. `null` when the project
+ * is missing or not foundry's for this org, or holds no such app.
  */
-async function archonBootstrapOperatorDrifted(coolify, appId, recordedIds) {
-    const invitedUserId = recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
-    if (!appId || !invitedUserId || invitedUserId === 'none')
+async function findOwnerBoule(coolify, owner) {
+    const project = await coolify.findProjectByName(owner.slug);
+    if (!project || project.description !== coolifyProjectMark(owner))
+        return null;
+    const environment = (await coolify.listEnvironments(project.uuid)).find((e) => e.name === 'production');
+    if (!environment)
+        return null;
+    return coolify.findApplicationByName(`${owner.slug}-boule`, { environmentIds: [environment.id] });
+}
+/** Archon's connection to the owner company's people store (role {@link BOULE_PEER_ROLE}). */
+const ARCHON_AUTHZ_DATABASE_URL_ENV = 'AUTHZ_DATABASE_URL';
+/**
+ * Archon's `AUTHZ_DATABASE_URL`: the owner company's Boule database, as the
+ * peer role with the password Boule's env holds. The host and database come
+ * from that Boule's own `DATABASE_URL` (built from the database's internal
+ * URL); only they are read from it, never its credentials. `null` while the
+ * company's Boule, its password or its database URL does not exist yet. A
+ * failed read throws a fixed message with the error's name, never its text,
+ * which can carry Coolify's response.
+ */
+async function ownerAuthzDatabaseUrl(coolify, owner, label) {
+    let password;
+    let databaseUrl;
+    try {
+        const boule = await findOwnerBoule(coolify, owner);
+        if (!boule)
+            return null;
+        password = await currentEnvValue(coolify, boule.uuid, BOULE_PEER_PASSWORD_ENV);
+        databaseUrl = await currentEnvValue(coolify, boule.uuid, 'DATABASE_URL');
+    }
+    catch (error) {
+        throw new Error(`${label}: could not read the owner company's Boule env (${error instanceof Error ? error.name : 'error'})`);
+    }
+    if (!password || !databaseUrl)
+        return null;
+    let host;
+    let pathname;
+    let search;
+    try {
+        ({ host, pathname, search } = new URL(databaseUrl));
+    }
+    catch (error) {
+        // Node's `ERR_INVALID_URL` carries the whole input, credential included.
+        throw new Error(`${label}: the owner company's Boule DATABASE_URL could not be parsed (${error instanceof Error ? error.name : 'error'})`);
+    }
+    return `postgres://${BOULE_PEER_ROLE}:${encodeURIComponent(password)}@${host}${pathname}${search}`;
+}
+/** Where Archon's invite form calls Boule. */
+const ARCHON_BOULE_URL_ENV = 'BOULE_URL';
+/**
+ * The invite form's secret (read from the owner company's Boule env, never
+ * minted here) and the origin Archon calls Boule on. The origin is Boule's
+ * public one, `https://<bouleHostnameFor>`: it is the `APP_URL` foundry already
+ * writes to that Boule, derived from the declared org alone. Boule's internal
+ * address would need its Coolify uuid and port, which foundry does not record,
+ * and goes stale when the app is recreated. `null` while the company's Boule
+ * does not hold the secret. A failed read throws a fixed message with the
+ * error's name only.
+ */
+async function ownerBridge(coolify, owner, label) {
+    let secret;
+    try {
+        const boule = await findOwnerBoule(coolify, owner);
+        if (!boule)
+            return null;
+        secret = await currentEnvValue(coolify, boule.uuid, BOULE_BRIDGE_SECRET_ENV);
+    }
+    catch (error) {
+        throw new Error(`${label}: could not read the owner company's Boule env (${error instanceof Error ? error.name : 'error'})`);
+    }
+    if (!secret)
+        return null;
+    return { secret, url: `https://${bouleHostnameFor(owner)}` };
+}
+/**
+ * Whether Archon's live `ARCHON_BRIDGE_SECRET` or `BOULE_URL` is not what the
+ * owner company's Boule now implies. Nothing to compare while that Boule holds
+ * no secret. A failed read is not drift: the next plan reads again.
+ */
+async function archonBridgeDrifted(coolify, appId, owner) {
+    if (!appId || !owner)
         return false;
     try {
-        const live = await currentEnvValue(coolify, appId, 'AUTHZ_BOOTSTRAP_OPERATOR');
-        return live !== invitedUserId;
+        const wanted = await ownerBridge(coolify, owner, 'platform:archon');
+        if (!wanted)
+            return false;
+        return ((await currentEnvValue(coolify, appId, BOULE_BRIDGE_SECRET_ENV)) !== wanted.secret ||
+            (await currentEnvValue(coolify, appId, ARCHON_BOULE_URL_ENV)) !== wanted.url);
+    }
+    catch (_error) {
+        // Nothing logged: the error can carry Coolify's response, and the values read are credentials.
+        return false;
+    }
+}
+/**
+ * Whether Archon's live `AUTHZ_DATABASE_URL` is not the one the owner
+ * company's Boule now allows. Nothing to compare while that Boule holds no
+ * password. A failed read is not drift: the next plan reads again.
+ */
+async function archonAuthzDatabaseDrifted(coolify, appId, owner) {
+    if (!appId || !owner)
+        return false;
+    try {
+        const wanted = await ownerAuthzDatabaseUrl(coolify, owner, 'platform:archon');
+        if (!wanted)
+            return false;
+        return (await currentEnvValue(coolify, appId, ARCHON_AUTHZ_DATABASE_URL_ENV)) !== wanted;
+    }
+    catch (_error) {
+        // Nothing logged: the error can carry Coolify's response, and the values read are credentials.
+        return false;
+    }
+}
+/**
+ * Whether Archon's live `AUTH_ORGANIZATION_ID` is not the sign-in org it
+ * should accept ({@link archonAuthOrganizationId}). Without this nothing
+ * replans Archon when the owner company's org changes, since the step plans
+ * only on hostname, `gitRef` and the Access list. A failed read is not drift.
+ */
+async function archonAuthOrgDrifted(coolify, appId, recordedIds) {
+    const expected = archonAuthOrganizationId(recordedIds);
+    if (!appId || !expected)
+        return false;
+    try {
+        return (await currentEnvValue(coolify, appId, 'AUTH_ORGANIZATION_ID')) !== expected;
     }
     catch {
         return false;
     }
 }
 /**
- * #501: {@link archonBootstrapOperatorDrifted} for the files runner. The owner
+ * #501: The files runner's check that it carries the owner's `AUTHZ_BOOTSTRAP_OPERATOR`. The owner
  * invite can record after the files step's app id does, so an owner invited
  * later still gets `AUTHZ_BOOTSTRAP_OPERATOR`. A failed read is not drift.
  */