@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/plan/executor.js

@@ -1,11 +1,12 @@
-import { randomBytes } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
+import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
+import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
-import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
+import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
@@ -20,13 +21,20 @@ import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScope
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
-import { healthCheckSettings } from './health-check-settings.js';
+import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
 import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
+import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY } from './mail-relay.js';
+import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
+import { limited } from './own-limits.js';
+import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, scopeFromOrg, } from './own-services.js';
+import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
+import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
-import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
@@ -51,7 +59,7 @@ import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerR
  */
 /** #569: the description foundry gives the Coolify project it creates for an org. */
 const COOLIFY_PROJECT_MARK_PREFIX = 'foundry org ';
-function coolifyProjectMark(org) {
+export function coolifyProjectMark(org) {
     return `${COOLIFY_PROJECT_MARK_PREFIX}${org.id}`;
 }
 /**
@@ -631,11 +639,6 @@ const CHAT_SECRET_ENV_KEYS = {
     masRsaKeyPem: 'CHAT_MATRIX_MAS_RSA_KEY_PEM',
     masEcKeyPem: 'CHAT_MATRIX_MAS_EC_KEY_PEM',
 };
-/** `FROM ${MAS_IMAGE}` plus the entry command its published image needs (chat's own `MAS_DOCKERFILE`, same reason: no arguments by default). */
-const CALLS_MAS_DOCKERFILE = [
-    `FROM ${MAS_IMAGE}`,
-    'CMD ["server", "--config", "/config/config.yaml"]',
-].join('\n');
 /**
  * `coolifyCallsService`'s own database (#145) -- no `system:kind:key` slot
  * of its own, the same reason {@link CALLS_SYNAPSE_SCOPE_KEY}'s doc comment
@@ -663,6 +666,12 @@ const CALLS_HEALTH_CHECK_PATH = '/healthz';
  * {@link CALLS_HEALTH_CHECK_PATH} above.
  */
 const CHAT_SERVICE_HEALTH_CHECK_PATH = '/_chat/health';
+/**
+ * Synapse's start period for its Coolify health check. It runs its database
+ * migrations before it listens, which is slower than the default start period
+ * of {@link healthCheckSettings} allows, and the image's own check waits 5 s.
+ */
+const SYNAPSE_HEALTH_CHECK_START_PERIOD_SECONDS = 120;
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
  * `exited:unhealthy` `` -- `@wtfalch/providers`' own doc comment) means it is
@@ -753,6 +762,44 @@ export const databaseStartWait = {
 // ---------------------------------------------------------------------------
 // Executor
 // ---------------------------------------------------------------------------
+/** How long the host's bucket port may take to make or find a bucket. */
+const BUCKET_TIMEOUT_MS = 60_000;
+/** How long the keys worker may take to mint an own files host's credential. */
+const KEYS_MINT_TIMEOUT_MS = 15_000;
+/** How long one call to the R2 key port or the files route that stores the key may take. */
+const R2_KEY_TIMEOUT_MS = 30_000;
+/** Clears a recorded id; a context that cannot forget one records it empty, which reads as unset. */
+function forgetScopeId(context, key) {
+    if (context.forgetId)
+        context.forgetId(key);
+    else
+        context.recordScopeId(key, '');
+}
+async function withTimeout(work, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** How long one Lettermint call of an own company's sign-in mint may take. */
+const LETTERMINT_TIMEOUT_MS = 60_000;
+const OWN_SERVICES_PORT_ABSENT = 'this org runs its own services and the host has no ownServices port for it';
+/** A port that refuses every call, naming the held key the org's service waits for. */
+function blockedPort(service, ref) {
+    return new Proxy({}, {
+        get: () => () => {
+            throw new OwnServicesBlockedError(service, ref);
+        },
+    });
+}
 export class FoundryStepExecutor {
     ports;
     edgeDns;
@@ -761,9 +808,93 @@ export class FoundryStepExecutor {
     edgeRateLimits;
     edgeZones;
     edgeWriteSlot;
+    /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
+    handledSecrets = new Set();
     constructor(ports) {
         this.ports = ports;
     }
+    secretsHandled() {
+        return [...this.handledSecrets];
+    }
+    /**
+     * An own org's step runs on a copy of this executor whose ZITADEL, mail,
+     * broker, files, jobs and calls ports are the org's own. A port the org has
+     * not got yet is absent or throws, never the shared one.
+     */
+    async executeScoped(action, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const scoped = await own.portsFor(context.org, context.recordedIds());
+        if (!scoped)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const refs = orgTarget(context.org).refs;
+        const copy = new FoundryStepExecutor({
+            ...this.ports,
+            ownServices: undefined,
+            zitadel: scoped.zitadel ?? blockedPort('zitadel', refs.instanceBearer),
+            mail: scoped.mail ?? blockedPort('mail', refs.mailAdminKey),
+            callsSfu: scoped.callsSfu ?? blockedPort('calls', refs.livekitKeys),
+            broker: scoped.broker,
+            filesOrganisation: scoped.filesOrganisation ??
+                blockedPort('files', refs.filesManagement),
+            jobsScheduler: scoped.jobsScheduler ?? blockedPort('jobs', refs.jobsAdminToken),
+            callsSfuUrls: ownSfuUrls(context.recordedIds()),
+        });
+        try {
+            return await copy.run(action, context);
+        }
+        finally {
+            for (const secret of copy.secretsHandled())
+                this.handledSecrets.add(secret);
+        }
+    }
+    /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
+    ownMailKeyMintable() {
+        return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
+    }
+    /** What the executor's own files dependencies supply, for the planner's blocked lines. */
+    ownFilesDeps() {
+        const files = this.ports.ownServices?.provision.files;
+        if (!files)
+            return { keys: false, bucket: false };
+        return {
+            keys: Boolean(files.keysMint),
+            bucket: Boolean(files.r2Buckets),
+        };
+    }
+    /** Which ports the own files storage key step needs this executor has, for the planner's blocked line. */
+    async ownFilesR2Ports(org, recordedIds) {
+        const r2Keys = Boolean(this.ports.ownServices?.provision.files.r2Keys);
+        // Only an own org whose files host is applied is asked for its scoped ports.
+        if (!ownsServices(org) || !recordedIds[`coolify:own-files:${org.id}`]) {
+            return { r2Keys, storeR2Credentials: false };
+        }
+        try {
+            const scoped = await this.ports.ownServices?.portsFor(org, recordedIds);
+            return {
+                r2Keys,
+                storeR2Credentials: typeof scoped?.filesOrganisation?.storeR2Credentials === 'function',
+            };
+        }
+        catch (e) {
+            if (e instanceof OwnServicesBlockedError)
+                return { r2Keys, storeR2Credentials: false };
+            throw e;
+        }
+    }
+    /** Whether the host's scoped ports for this own org include a files-organisation port. A held key still missing counts as no port. */
+    async ownFilesOrganisationPort(org, recordedIds) {
+        try {
+            const scoped = await this.ports.ownServices?.portsFor(org, recordedIds);
+            return Boolean(scoped?.filesOrganisation);
+        }
+        catch (e) {
+            if (e instanceof OwnServicesBlockedError)
+                return false;
+            throw e;
+        }
+    }
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts() {
         return {
@@ -775,10 +906,21 @@ export class FoundryStepExecutor {
         };
     }
     async execute(action, context) {
+        const { org } = context;
+        if (ownsServices(org) && !action.kind.startsWith('own-')) {
+            return this.executeScoped(action, context);
+        }
+        return this.run(action, context);
+    }
+    async run(action, context) {
         const { org } = context;
         switch (`${action.system}:${action.kind}`) {
             case 'zitadel:issuer':
                 return this.zitadelIssuer(action, org, context);
+            case 'zitadel:registration-closed':
+                return this.zitadelRegistrationClosed(org, context);
+            case 'zitadel:domain':
+                return this.zitadelDomain(action, org, context);
             case 'zitadel:owner':
                 return this.zitadelOwner(action, org, context);
             case 'zitadel:login-host':
@@ -849,6 +991,18 @@ export class FoundryStepExecutor {
                 return this.bouleBrokerEntry(org, context);
             case 'jobs:registration':
                 return this.jobsRegistration(action, org, context);
+            case 'coolify:own-auth':
+                return this.ownAuth(action, org, context);
+            case 'coolify:own-jobs':
+                return this.ownJobs(action, org, context);
+            case 'coolify:own-mail':
+                return this.ownMail(action, org, context);
+            case 'coolify:own-sfu':
+                return this.ownSfu(action, org, context);
+            case 'coolify:own-files':
+                return this.ownFiles(action, org, context);
+            case 'coolify:own-files-r2':
+                return this.ownFilesR2(org, context);
             default:
                 throw new Error(`FoundryStepExecutor has no dispatch for ${action.system}:${action.kind}`);
         }
@@ -1290,17 +1444,60 @@ export class FoundryStepExecutor {
             // their own design" -- not built in v1).
             throw new NotBuiltError(`zitadel:issuer move for ${org.slug}`, 'moving the issuer onto or off the org\'s own domain is not built in v1; see foundry\'s .claude/decisions-2026-09-24-executor.md, "Executor decisions"');
         }
-        const { org: zOrg } = await this.ports.zitadel.findOrCreateOrg(org.slug);
-        context.recordScopeId('zitadel_org', zOrg.id);
-        return { resourceId: zOrg.id };
+        const { orgId } = await ensureSignInOrg({
+            zitadel: this.ports.zitadel,
+            name: org.slug,
+            domain: signInOrgDomain(org),
+            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            persistScopeIds: () => context.persistScopeIds(),
+            registrationClosedScopeKey: ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY,
+        });
+        return { resourceId: orgId };
+    }
+    /**
+     * `plan/diff.ts`'s `planOrgRegistrationClosed`: closes self-registration on
+     * the recorded ZITADEL org, for an org made before foundry did this or whose
+     * close failed in the issuer step. Recorded only after the close returned.
+     */
+    async zitadelRegistrationClosed(org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:registration-closed for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        await closeSignInOrgRegistration(this.ports.zitadel, zitadelOrgId, (key, id) => context.recordScopeId(key, id));
+        return {};
+    }
+    /**
+     * `plan/diff.ts`'s `planOrgDomain`: registers the org's sign-in domain on
+     * its recorded ZITADEL org and makes it primary, for an org whose ZITADEL
+     * org was made before foundry did this. Records the domain only after both
+     * calls succeeded.
+     */
+    async zitadelDomain(action, org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:domain for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        const domain = action.desired.domain;
+        // A refusal (the sign-in server's domain policy wants proof) is recorded and reported as
+        // blocked by the planner; it does not fail every apply.
+        const registered = await registerSignInDomainOrBlock(this.ports.zitadel, zitadelOrgId, domain, (key, id) => context.recordScopeId(key, id));
+        if (registered)
+            context.recordScopeId(ZITADEL_ORG_DOMAIN_SCOPE_KEY, domain);
+        return {};
     }
     /**
-     * `plan/diff.ts`'s `planOwner`: invites the org's owner into its ZITADEL
-     * org by email. Never logs, returns or throws the email itself -- only the
-     * invited user id, handed back as `resourceId` so `runSteps` records it
-     * under `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
-     * `plan()` call idempotent (`planOwner` plans nothing once that key is
-     * recorded).
+     * `plan/diff.ts`'s `planOwners`: makes the owner's account in the org's
+     * ZITADEL org and mails the first-sign-in link to their personal address.
+     * The account's username is the local part of `mailboxAddress` and its email
+     * is `mailboxAddress`, so the owner signs in as `name@<org domain>`; the
+     * personal address is kept as the `personal_email` metadata. The invite code
+     * ZITADEL returns goes only into that mail. Nothing here logs, returns or
+     * throws the personal address or the code -- only the invited user id, handed
+     * back as `resourceId` so `runSteps` records it under
+     * `zitadel:owner:<orgId>:<email>`, which is exactly what makes the next
+     * `plan()` call idempotent. A failure after the account exists records
+     * nothing: the next apply finds the account by username and mints a new code.
      */
     async zitadelOwner(action, org, context) {
         const zitadelOrgId = context.recordedIds().zitadel_org;
@@ -1313,11 +1510,31 @@ export class FoundryStepExecutor {
         if (!authIssuer) {
             throw new Error(`zitadel:owner for ${org.slug}: no invite template issuer -- refusing to send ZITADEL's default invite link, which 404s on this platform`);
         }
-        const { userId } = await this.ports.zitadel.inviteOrgOwner(zitadelOrgId, {
-            givenName: action.desired.givenName,
-            familyName: action.desired.familyName,
-            email: action.desired.email,
-        }, `${authIssuer}/verify?userId={{.UserID}}&code={{.Code}}&organization={{.OrgID}}&invite=true`);
+        const mailboxAddress = action.desired.mailboxAddress;
+        if (!mailboxAddress) {
+            throw new Error(`zitadel:owner for ${org.slug}: no mailboxAddress -- the planner reports this as blocked, so it should not reach the executor`);
+        }
+        const inviteMail = this.ports.ownerInviteMail;
+        if (!inviteMail) {
+            throw new Error(`zitadel:owner for ${org.slug}: no ownerInviteMail port -- the owner's work mailbox cannot be opened yet, so the invite is not sent there`);
+        }
+        // foundry's own record of this owner's account, so a returning owner is not mistaken for a stranger.
+        const invitedBefore = context.recordedIds()[`zitadel:owner:${action.key}`];
+        const { userId } = await inviteOwnerWithLink({
+            zitadel: this.ports.zitadel,
+            mail: inviteMail,
+            orgId: zitadelOrgId,
+            authIssuer,
+            owner: {
+                givenName: action.desired.givenName,
+                familyName: action.desired.familyName,
+                mailboxAddress,
+                personalEmail: action.desired.email,
+            },
+            label: `zitadel:owner for ${org.slug}`,
+            onSecret: (value) => this.handledSecrets.add(value),
+            ...(invitedBefore ? { invitedUserId: invitedBefore } : {}),
+        });
         // An owner invited after chat was built never reaches `coolifyChat`
         // again, so the role is granted here once the messaging project exists.
         const messagingProjectId = context.recordedIds()[ZITADEL_MESSAGING_PROJECT_SCOPE_KEY];
@@ -2493,6 +2710,23 @@ export class FoundryStepExecutor {
         // Last: a run that failed above plans the step again.
         context.recordScopeId(brokerEntryAppliedScopeKey(entryKey), JSON.stringify(want));
     }
+    /**
+     * `null` once the app already has `AUTHZ_PEER_PASSWORD_OPERATOR`: minted only
+     * the first time and never rotated, like {@link ensureAuthCookieSecret}.
+     */
+    async ensurePeerPassword(appId) {
+        return this.mintIfAbsent(appId, BOULE_PEER_PASSWORD_ENV, 24);
+    }
+    /** Same rule for the secret Archon's invite form sends to Boule. */
+    async ensureBridgeSecret(appId) {
+        return this.mintIfAbsent(appId, BOULE_BRIDGE_SECRET_ENV, 32);
+    }
+    async mintIfAbsent(appId, key, bytes) {
+        const envs = await this.ports.coolify.listEnvs(appId);
+        if (envs.some((e) => e.key === key && !e.is_preview))
+            return null;
+        return randomBytes(bytes).toString('base64url');
+    }
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
      * only the first time (task brief), never regenerated or overwritten, so a
@@ -2834,6 +3068,40 @@ export class FoundryStepExecutor {
             }
         }
     }
+    /**
+     * The company's own sign-in mail token: a Lettermint project `<slug>-auth`
+     * whose token goes to `orgTarget(org).refs.brokerMailKey`, where the broker
+     * and ZITADEL's SMTP settings read it. The platform-wide Lettermint key
+     * stays with the executor and never reaches a company. A held ref is left
+     * alone. Otherwise the mint rule of {@link ensureOrgAppMailToken}: create
+     * the project, restrict the domain, deliver its token, and only then
+     * delete every other `<slug>-auth` project (a token cannot be read back,
+     * so a project without a held token is a leftover). The restriction comes
+     * before the delivery so a failure there leaves no held ref: the next run
+     * starts over instead of skipping it. A failure before the delivery leaves
+     * that project for the next run to delete. Every Lettermint call is
+     * bounded; the token is registered for redaction before anything can throw
+     * with it.
+     */
+    async ensureOwnAuthMailToken(org, mailDomain, deps) {
+        const ref = orgTarget(org).refs.brokerMailKey;
+        if (await deps.heldKeys?.resolve(ref))
+            return;
+        const lettermint = this.ports.lettermint;
+        if (!lettermint || !deps.heldKeys)
+            throw new OwnServicesBlockedError('lettermint', ref);
+        const authName = `${org.slug}-auth`;
+        const projects = await withTimeout(lettermint.listProjects(), LETTERMINT_TIMEOUT_MS);
+        const created = await withTimeout(lettermint.createProject(authName), LETTERMINT_TIMEOUT_MS);
+        deps.runtime?.onSecret?.(created.token);
+        await withTimeout(this.ensureLettermintDomainRestriction(org, mailDomain, [...projects, created.project], null, null), LETTERMINT_TIMEOUT_MS);
+        await deps.deliverSecret(ref, created.token);
+        for (const project of projects) {
+            if (project.name === authName && project.id !== created.project.id) {
+                await withTimeout(lettermint.deleteProject(project.id), LETTERMINT_TIMEOUT_MS);
+            }
+        }
+    }
     /**
      * Deletes a just-minted project from inside a `catch`. A failed delete is
      * dropped so it never replaces the error being rethrown; the orphan is
@@ -2880,6 +3148,7 @@ export class FoundryStepExecutor {
     async ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId) {
         const appName = `${org.slug}-app`;
         const relayName = `${org.slug}-relay`;
+        const authName = `${org.slug}-auth`;
         const isPlatformApexDomain = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
         if (isPlatformApexDomain && platformLettermintProjectId) {
             if (!allProjects.some((p) => p.id === platformLettermintProjectId)) {
@@ -2891,7 +3160,7 @@ export class FoundryStepExecutor {
             ? await this.ports.lettermint.getDomain(existing.id)
             : await this.ports.lettermint.createDomain(mailDomain);
         const scopedProjectIds = allProjects
-            .filter((p) => p.name === appName || p.name === relayName)
+            .filter((p) => p.name === appName || p.name === relayName || p.name === authName)
             .map((p) => p.id);
         if (isPlatformApexDomain &&
             platformLettermintProjectId &&
@@ -3320,12 +3589,14 @@ export class FoundryStepExecutor {
             description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${SYNAPSE_TAG})`,
             instant_deploy: false,
         }));
-        if (!synapse.existed) {
-            await this.ports.coolify.updateApplication(synapse.appId, {
-                health_check_enabled: false,
-                custom_internal_name: names.synapse,
-            });
-        }
+        // The check goes on every run, so a Synapse made without one gets it. Synapse
+        // is deployed before MAS here. Its `/health` answers with MAS unreachable
+        // (shown with a throwaway Synapse of the same image, MAS endpoint a name that
+        // does not resolve: 200, healthy), and the start period covers first-boot migrations.
+        await this.ports.coolify.updateApplication(synapse.appId, {
+            ...(synapse.existed ? {} : { custom_internal_name: names.synapse }),
+            ...healthCheckSettings('/health', 8008, SYNAPSE_HEALTH_CHECK_START_PERIOD_SECONDS),
+        });
         context.recordScopeId(CALLS_SYNAPSE_SCOPE_KEY, synapse.appId);
         // #251: only on create -- nothing here patches `docker_registry_image_tag`
         // on an app `findOrCreateCallsApp` found already running, so that is the
@@ -3340,14 +3611,14 @@ export class FoundryStepExecutor {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            dockerfile: CALLS_MAS_DOCKERFILE,
+            dockerfile: masDockerfile(),
             name: names.mas,
             description: `matrix-authentication-service for ${org.slug}'s calls stack`,
             instant_deploy: false,
         }));
         if (!mas.existed) {
             await this.ports.coolify.updateApplication(mas.appId, {
-                health_check_enabled: false,
+                ...IMAGE_HEALTHCHECK_SETTINGS,
                 custom_internal_name: names.mas,
             });
         }
@@ -3784,7 +4055,7 @@ export class FoundryStepExecutor {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            dockerfile: CALLS_MAS_DOCKERFILE,
+            dockerfile: masDockerfile(),
             name: names.mas,
             description: `matrix-authentication-service for ${org.slug}'s chat`,
             instant_deploy: false,
@@ -3804,21 +4075,26 @@ export class FoundryStepExecutor {
             autogenerate_domain: false,
         }), { startIfStopped: false });
         // Fixed internal names, set on every run: the three apps and Agora
-        // address each other by them. Neither Synapse's nor MAS's health check
-        // can pass before the other is up, so both are off (the calls stack's own
-        // rule).
+        // address each other by them. Both are Dockerfile apps with a HEALTHCHECK
+        // of their own (MAS's has a copied-in busybox, its image has no shell), so
+        // Coolify's check is off and the image's is the live one. MAS is deployed
+        // first and its `/health` needs only its database, so Synapse's check can
+        // pass.
         await this.ports.coolify.updateApplication(synapse.appId, {
             custom_internal_name: names.synapse,
-            ...(synapse.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (curl on /health) is the live check; MAS is deployed first.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         await this.ports.coolify.updateApplication(mas.appId, {
             custom_internal_name: names.mas,
-            ...(mas.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (`masDockerfile`) is the live check.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         await this.ports.coolify.updateApplication(service.appId, {
             custom_internal_name: names.service,
-            // No Coolify health check on the chat service (#543 review): its image
-            // is node:22-alpine with no curl, which Coolify's container check runs.
+            // A command, not Coolify's HTTP check: the image is node:22-alpine with
+            // no curl, and its busybox `wget` tries `localhost` as `::1` first.
+            ...commandHealthCheckSettings(wgetProbe(CHAT_SERVICE_PORT, CHAT_SERVICE_HEALTH_CHECK_PATH)),
         });
         context.recordScopeId(CHAT_SYNAPSE_SCOPE_KEY, synapse.appId);
         context.recordScopeId(CHAT_SERVICE_SCOPE_KEY, service.appId);
@@ -3993,18 +4269,20 @@ export class FoundryStepExecutor {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            dockerfile: CALLS_MAS_DOCKERFILE,
+            dockerfile: masDockerfile(),
             name: names.mas,
             description: `matrix-authentication-service for ${org.slug}'s re-keyed chat (#463)`,
             instant_deploy: false,
         }), { startIfStopped: false });
         await this.ports.coolify.updateApplication(synapse.appId, {
             custom_internal_name: names.synapse,
-            ...(synapse.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (curl on /health) is the live check; MAS is deployed first.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         await this.ports.coolify.updateApplication(mas.appId, {
             custom_internal_name: names.mas,
-            ...(mas.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (`masDockerfile`) is the live check.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         context.recordScopeId(CHAT_REKEY_SYNAPSE_SCOPE_KEY, synapse.appId);
         context.recordScopeId(CHAT_REKEY_MAS_SCOPE_KEY, mas.appId);
@@ -4198,13 +4476,14 @@ export class FoundryStepExecutor {
         // step again for a live app whose marker is missing or stale, so an app
         // made before this existed gets its name here. The marker, recorded last,
         // tells `desiredAgoraEnv` that the name and the env are both in place.
-        // No Coolify health check on the calls service (#543 review): its image
-        // is node:24-alpine with no curl, which Coolify's container check runs.
+        // A command, not Coolify's HTTP check: the image is node:24-alpine with no
+        // curl, and its busybox `wget` tries `localhost` as `::1` first.
         // A found app may predate `ports_exposes` on create; patch a differing one.
         const portDiffers = app.existed &&
             (await this.ports.coolify.getApplication(app.appId)).ports_exposes !== CALLS_SERVICE_PORT;
         await this.ports.coolify.updateApplication(app.appId, {
             custom_internal_name: name,
+            ...commandHealthCheckSettings(wgetProbe(CALLS_SERVICE_PORT, CALLS_HEALTH_CHECK_PATH)),
             ...(portDiffers ? { ports_exposes: CALLS_SERVICE_PORT } : {}),
         });
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
@@ -4707,7 +4986,29 @@ export class FoundryStepExecutor {
         const appKey = await this.ensureAuthAppKey(app.appId);
         if (appKey)
             envs.push({ key: 'AUTH_APP_KEY', value: appKey });
-        await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        // Archon's way into this Boule's people store: only the platform's own
+        // org's Boule gets it, minted once and never rotated (the role Boule's boot
+        // creates from it would otherwise keep the old password).
+        const peerPassword = action.desired.platformOwner === true ? await this.ensurePeerPassword(app.appId) : null;
+        if (peerPassword) {
+            this.handledSecrets.add(peerPassword);
+            envs.push({ key: BOULE_PEER_PASSWORD_ENV, value: peerPassword });
+        }
+        // Archon's invite form calls Boule with this secret; same rule as the password.
+        const bridgeSecret = action.desired.platformOwner === true ? await this.ensureBridgeSecret(app.appId) : null;
+        if (bridgeSecret) {
+            this.handledSecrets.add(bridgeSecret);
+            envs.push({ key: BOULE_BRIDGE_SECRET_ENV, value: bridgeSecret });
+        }
+        try {
+            await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        }
+        catch (error) {
+            const minted = [peerPassword, bridgeSecret].filter((v) => v !== null);
+            if (minted.length === 0)
+                throw error;
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), minted));
+        }
         const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName);
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
@@ -4723,6 +5024,8 @@ export class FoundryStepExecutor {
         // that a previous apply created but crashed before deploying) sat built
         // but never started. Deployed once this executor has confirmed, never
         // again -- a live app is only ever restarted from here on.
+        const secretsNotRestarted = action.desired.platformOwner === true &&
+            !context.recordedIds()[BOULE_SECRETS_RESTARTED_SCOPE_KEY];
         if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
             // #543: every deploy waits for health -- Boule's own public hostname.
             const runtime = this.ports.runtime ?? {};
@@ -4731,10 +5034,21 @@ export class FoundryStepExecutor {
         }
         else if (app.existed &&
             !mail.restarted &&
-            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed || mail.changed)) {
+            (envChanged ||
+                cookieSecret !== null ||
+                appKey !== null ||
+                peerPassword !== null ||
+                bridgeSecret !== null ||
+                secretsNotRestarted ||
+                dbPush.changed ||
+                mail.changed)) {
             // A restart inside the mail rule already came after every env write above.
             await this.ports.coolify.restart(app.appId);
         }
+        // Last, after the restart or deploy: a run that failed before here repeats it, minting nothing.
+        if (action.desired.platformOwner === true) {
+            context.recordScopeId(BOULE_SECRETS_RESTARTED_SCOPE_KEY, '1');
+        }
         return { resourceId: app.appId };
     }
     /**
@@ -4896,6 +5210,349 @@ export class FoundryStepExecutor {
         }
         return port;
     }
+    /**
+     * `plan/own-diff.ts`'s `planOwnJobs`: the org's own scheduler, in the org's
+     * own project, with the names and the held-key ref of `orgTarget(org)`. The
+     * admin token goes to `jobs:org:<slug>:adminToken` and nowhere else.
+     */
+    async ownJobs(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        return provisionJobsHost(scopeFromOrg(context, {}), {
+            coolify: limited(own.provision.jobs),
+            deliverSecret: this.ports.deliverSecret,
+            readSecret: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
+            runtime: this.ports.runtime ?? {},
+        }, orgTarget(org), {
+            hostname: null,
+            gitRef: action.desired.gitRef,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+        });
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnFiles`: the org's own files host in the
+     * org's own project, trusting the company's issuer `https://auth.<domain>`.
+     * Its ZITADEL project `<slug>-files` and introspection app are made in the
+     * company's instance (`ownServices.zitadelFor`), never the shared one. The
+     * bucket comes from the host's bucket port under the target's name. The
+     * management key goes to `files:org:<slug>:managementKey` and the
+     * introspection secret to `zitadel:org:<slug>:files:introspection`, both
+     * once, and neither is recorded or returned.
+     */
+    async ownFiles(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const at = `coolify:own-files for ${org.slug}`;
+        const domain = org.domain;
+        if (!domain)
+            throw new Error(`${at}: the org declares no domain`);
+        const zitadelOrgId = context.recordedIds()[ZITADEL_ORG_SCOPE_KEY];
+        if (!zitadelOrgId)
+            throw new Error(`${at}: the org's ZITADEL organisation is not recorded yet`);
+        const { r2Buckets, r2Keys: _r2Keys, keysMint, readSecret, ...ownFiles } = own.provision.files;
+        const files = { ...ownFiles, coolify: limited(ownFiles.coolify) };
+        // Never the platform's credential in its place.
+        if (!keysMint)
+            throw new OwnServicesBlockedError('files', 'keysMint');
+        if (!r2Buckets)
+            throw new Error(`${at}: the host supplies no bucket port`);
+        const target = orgTarget(org);
+        let r2;
+        try {
+            r2 = await withTimeout(r2Buckets.ensureBucket(target.names.filesBucket), BUCKET_TIMEOUT_MS);
+        }
+        catch {
+            // The cause is dropped: a host port's message is not ours to repeat.
+            throw new Error(`${at}: the bucket ${target.names.filesBucket} could not be ensured`);
+        }
+        const issuer = `https://auth.${domain}`;
+        const deps = {
+            ...files,
+            // The platform's keys settings stay out of a company's containers; the minted keyring replaces them.
+            keys: undefined,
+            jobsSigningSecrets: undefined,
+            r2,
+            zitadel: own.zitadelFor({ issuerUrl: issuer, bearerRef: target.refs.instanceBearer }),
+            zitadelForInstance: undefined,
+            deliverSecret: this.ports.deliverSecret,
+            runtime: {
+                ...files.runtime,
+                onSecret: (value) => {
+                    this.handledSecrets.add(value);
+                },
+            },
+        };
+        const invalid = filesDepsInvalid(deps);
+        if (invalid)
+            throw new Error(`${at}: ${invalid}`);
+        const scope = scopeFromOrg(context, {});
+        const mintOwn = async () => {
+            try {
+                return await withTimeout(keysMint.mint(`files-${org.slug}`, randomUUID()), KEYS_MINT_TIMEOUT_MS);
+            }
+            catch (error) {
+                // The cause is dropped: a mint client's message is not ours to repeat.
+                throw new Error(error instanceof Error && error.message === 'timeout'
+                    ? `${at}: the keys mint did not answer within ${KEYS_MINT_TIMEOUT_MS / 1000} seconds`
+                    : `${at}: the keys mint failed`);
+            }
+        };
+        const { keys, guardId } = await resolveOwnFilesKeys(scope, {
+            deliverSecret: deps.deliverSecret,
+            readSecret: readSecret ?? (async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null),
+            runtime: deps.runtime,
+        }, target, mintOwn, keysMint.workerUrl, `own step ${at}`);
+        return provisionFilesHost(scope, { ...deps, keys }, target, {
+            keysGuardId: guardId,
+            hostname: action.desired.hostname,
+            gitRef: action.desired.gitRef,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            issuer,
+            zitadelOrg: { id: zitadelOrgId },
+            zitadelProject: {
+                name: `${org.slug}-files`,
+                scopeKey: ZITADEL_FILES_PROJECT_SCOPE_KEY,
+            },
+            shareDomains: filesShareDomains([org]),
+            bootstrapOperator: action.desired.bootstrapOperator,
+        });
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnFilesR2`: the storage key of the org's own files bucket. A token
+     * recorded as undelivered is deleted first (its secret cannot be read back, so it can never be
+     * finished), then one is minted, registered as a secret, recorded by id as undelivered and
+     * persisted, and only then sent to the files host, the same pair on every retry. The secret is
+     * never recorded and never written to a Coolify env. The id is recorded once the host has it.
+     */
+    async ownFilesR2(org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const at = `coolify:own-files-r2 for ${org.slug}`;
+        const { r2Keys, runtime } = own.provision.files;
+        if (!r2Keys)
+            throw new OwnServicesBlockedError('files', 'r2Keys');
+        const scoped = await own.portsFor(org, context.recordedIds());
+        const organisation = scoped?.filesOrganisation;
+        if (!organisation?.storeR2Credentials) {
+            throw new Error(`${at}: the host gave the company no storeR2Credentials on its files port`);
+        }
+        const store = organisation.storeR2Credentials.bind(organisation);
+        const bucket = orgTarget(org).names.filesBucket;
+        const timeoutText = `did not answer within ${R2_KEY_TIMEOUT_MS / 1000} seconds`;
+        const failure = (what, error) => 
+        // The cause is dropped: a port's message is not ours to repeat, and may hold the secret.
+        new Error(`${at}: ${what} ${error instanceof Error && error.message === 'timeout' ? timeoutText : 'failed'}`);
+        const recorded = context.recordedIds();
+        if (recorded[OWN_FILES_R2_SCOPE_KEY])
+            return { resourceId: recorded[OWN_FILES_R2_SCOPE_KEY] };
+        // A leftover token is deleted before anything is minted: never two live tokens.
+        const leftover = recorded[OWN_FILES_R2_UNDELIVERED_SCOPE_KEY];
+        if (leftover) {
+            try {
+                await withTimeout(r2Keys.deleteBucketKey(leftover), R2_KEY_TIMEOUT_MS);
+            }
+            catch (error) {
+                if (!isNotFoundError(error)) {
+                    throw failure(`deleting the earlier storage key ${leftover}, so no new one was made:`, error);
+                }
+            }
+            forgetScopeId(context, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY);
+            await context.persistScopeIds();
+        }
+        let key;
+        try {
+            key = await withTimeout(r2Keys.mintBucketKey(bucket), R2_KEY_TIMEOUT_MS);
+        }
+        catch (error) {
+            throw failure('the storage key mint', error);
+        }
+        const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 200;
+        if (text(key?.secretAccessKey))
+            this.handledSecrets.add(key.secretAccessKey);
+        // A token id we can read is recorded even when the rest of the answer is unusable, so it is deleted next run.
+        if (text(key?.tokenId)) {
+            context.recordScopeId(OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, key.tokenId);
+            await context.persistScopeIds();
+        }
+        if (!text(key?.accessKeyId) || !text(key?.secretAccessKey) || !text(key?.tokenId)) {
+            throw new Error(`${at}: the storage key mint answered with an unusable key`);
+        }
+        const pair = {
+            accessKeyId: key.accessKeyId,
+            secretAccessKey: key.secretAccessKey,
+            tokenId: key.tokenId,
+        };
+        const attempts = runtime?.deliverAttempts ?? 3;
+        const sleep = runtime?.sleep ?? defaultSleep;
+        for (let attempt = 1;; attempt += 1) {
+            try {
+                await withTimeout(store({ ...pair }), R2_KEY_TIMEOUT_MS);
+                break;
+            }
+            catch (error) {
+                if (attempt >= attempts) {
+                    const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
+                        pair.secretAccessKey,
+                        pair.accessKeyId,
+                    ]);
+                    throw new Error(`${at}: the storage key ${pair.tokenId} could not be delivered after ${attempts} tries; the next run deletes it and makes a new one (last try: ${cause})`);
+                }
+                await sleep(1000 * attempt);
+            }
+        }
+        context.recordScopeId(OWN_FILES_R2_SCOPE_KEY, pair.tokenId);
+        forgetScopeId(context, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY);
+        await context.persistScopeIds();
+        return { resourceId: pair.tokenId };
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnAuth`: the org's own sign-in at
+     * `auth.<domain>`, in the org's own project, through the org's own edge
+     * routed DNS and tunnel ports. The instance owner token goes to
+     * `zitadel:org:<slug>:instanceBearer` and is never recorded. A changed
+     * declared auth ref patches both git apps' branch and redeploys them; the
+     * applied marker comes last, so a run that died halfway is planned again.
+     */
+    async ownAuth(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const hostname = action.desired.hostname;
+        const gitRef = action.desired.gitRef;
+        const domain = org.domain;
+        if (!domain)
+            throw new Error(`coolify:own-auth for ${org.slug}: the org declares no domain`);
+        const scope = scopeFromOrg(context, {});
+        // The target (host, port, tls, user) is not secret; the platform's SMTP
+        // password is, so the company's own token is the password instead.
+        const { smtp, ...authDeps } = own.provision.auth;
+        const deps = {
+            ...authDeps,
+            ...(smtp
+                ? { smtp: { host: smtp.host, port: smtp.port, tls: smtp.tls, user: smtp.user } }
+                : {}),
+            coolify: limited(own.provision.auth.coolify),
+            runtime: {
+                ...own.provision.auth.runtime,
+                onSecret: (value) => {
+                    this.handledSecrets.add(value);
+                },
+            },
+        };
+        const before = scope.recordedIds();
+        const refChanged = before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== undefined &&
+            before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+        const gitApps = [
+            before[PLATFORM_AUTH_LOGIN_SCOPE_KEY],
+            before[PLATFORM_AUTH_BROKER_SCOPE_KEY],
+        ].filter((id) => Boolean(id));
+        if (refChanged) {
+            for (const id of gitApps)
+                await deps.coolify.updateApplication(id, { git_branch: gitRef });
+        }
+        await this.ensureOwnAuthMailToken(org, domain, deps);
+        const result = await provisionAuthStack(scope, deps, orgTarget(org), {
+            hostname,
+            apex: domain,
+            gitRef,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:auth`),
+            smtpSender: `noreply@${domain}`,
+            defaultRedirectUri: `https://agora.${domain}`,
+            ownerCompany: null,
+        });
+        if (refChanged) {
+            const now = scope.recordedIds();
+            const brokerDeployed = Boolean(now[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY]);
+            for (const id of gitApps) {
+                // The broker crash-loops until its inputs exist; it was never deployed, so it is not now.
+                if (id === now[PLATFORM_AUTH_BROKER_SCOPE_KEY] && !brokerDeployed)
+                    continue;
+                await deps.coolify.deploy(id, true);
+            }
+        }
+        scope.recordScopeId(OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+        scope.recordScopeId(OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
+        scope.recordScopeId(OWN_SERVICES_APPLIED_SCOPE_KEY, org.id);
+        await scope.persist();
+        return result;
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own
+     * project, with no host port (the shared relay reaches it by internal name)
+     * and a directory that trusts the org's own sign-in. The admin key goes to
+     * `orgTarget(org).refs.mailAdminKey` and nowhere else. The address the relay
+     * routes to is recorded last, and the step's marker after it.
+     */
+    async ownMail(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        if (!org.domain)
+            throw new Error(`own step coolify:own-mail for ${org.slug}: the org has no domain`);
+        const target = orgTarget(org);
+        const scope = scopeFromOrg(context, {});
+        const issuerUrl = `https://auth.${org.domain}`;
+        const result = await provisionMailServer(scope, {
+            ...own.provision.mail,
+            coolify: limited(own.provision.mail.coolify),
+            deliverSecret: (ref, secret) => {
+                this.handledSecrets.add(secret);
+                return this.ports.deliverSecret(ref, secret);
+            },
+            stalwartForInstance: (input) => {
+                this.handledSecrets.add(input.password);
+                return (own.provision.mail.stalwartForInstance ?? defaultStalwartForInstance)(input);
+            },
+            zitadel: own.zitadelFor({ issuerUrl, bearerRef: target.refs.instanceBearer }),
+            zitadelForInstance: undefined,
+        }, target, {
+            hostname: action.desired.hostname,
+            apex: org.domain,
+            mailHost: action.desired.mailHost,
+            imageTag: action.desired.gitRef,
+            hostPorts: '',
+            issuerUrl,
+            mxRecord: null,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:mail`),
+        });
+        scope.recordScopeId(OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, `${target.internal.mail}:25`);
+        await scope.persist();
+        return result;
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnSfu`: the org's own LiveKit server in the
+     * org's project, on the ports of its slot. The company's key pair goes to
+     * `livekit:org:<slug>:keys` and the app's env, nowhere else.
+     */
+    async ownSfu(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const scope = scopeFromOrg(context, {});
+        const { sfu } = own.provision;
+        return provisionSfuApp(scope, {
+            coolify: limited(sfu.coolify),
+            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:sfu`),
+            deliverSecret: sfu.deliverSecret,
+            readSecret: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
+            runtime: this.ports.runtime ?? {},
+            ...(sfu.mintLivekitCredentials
+                ? { mintLivekitCredentials: sfu.mintLivekitCredentials }
+                : {}),
+            onSecret: (value) => this.handledSecrets.add(value),
+        }, orgTarget(org), {
+            slot: action.desired.slot,
+            hostname: action.desired.hostname,
+            apex: org.domain,
+            version: action.desired.version,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+        });
+    }
     async jobsRegistration(action, org, context) {
         const scheduler = await this.jobsPort(org);
         const name = action.desired.name;
@@ -5633,6 +6290,11 @@ export class FoundryStepExecutor {
      * #491: when `mailDomain` is the platform's own apex, this must never
      * delete the platform's own project (the delete loop skips it by id) or
      * the platform's own domain (returns before the domain lookup/delete).
+     *
+     * An org whose own sign-in is applied keeps its `<slug>-auth` project, and
+     * keeps the Lettermint domain when that is the domain the sign-in sends
+     * from. Every other org deletes `<slug>-auth` too, which only a failed
+     * first sign-in run can have left behind.
      */
     async parkLettermintMail(org, mailOrg, context, platformApex, platformLettermintProjectId) {
         const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
@@ -5642,7 +6304,13 @@ export class FoundryStepExecutor {
         // #345: `mailOrg.domain` is absent for a level-1 org -- the previously
         // recorded mail domain is the one `MailPort.removeOrgRelay` needs.
         await this.ports.mail.removeOrgRelay({ ...mailOrg, domain: mailDomain });
+        // An own org's sign-in sends its mail through `<slug>-auth` and the domain it
+        // applied at; parking the org's mail leaves both, or the sign-in can no
+        // longer send (its held token would still resolve, so nothing re-mints it).
+        const ownSignIn = ownsServices(org) && Boolean(org.domain) && ownAuthApplied(org, context.recordedIds());
         const names = new Set([`${org.slug}-app`, `${org.slug}-relay`]);
+        if (!ownSignIn)
+            names.add(`${org.slug}-auth`);
         const projects = await this.ports.lettermint.listProjects();
         for (const project of projects) {
             if (names.has(project.name) && project.id !== platformLettermintProjectId) {
@@ -5651,6 +6319,8 @@ export class FoundryStepExecutor {
         }
         if (isPlatformApexOrg)
             return;
+        if (ownSignIn && mailDomain.toLowerCase() === org.domain?.toLowerCase())
+            return;
         const domain = await this.findExactLettermintDomain(mailDomain);
         if (domain)
             await this.ports.lettermint.deleteDomain(domain.id);
@@ -6653,6 +7323,23 @@ export class FoundryStepExecutor {
                 case 'coolify:database':
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;
+                case 'coolify:own-files-r2': {
+                    // An own files bucket's storage key; a 404 is caught below as already gone.
+                    const r2Keys = this.ports.ownServices?.provision.files.r2Keys;
+                    if (!r2Keys) {
+                        throw new Error(`coolify:own-files-r2 for ${org.slug}: this host supplies no R2 key port, cannot delete token ${target.id}`);
+                    }
+                    try {
+                        await withTimeout(r2Keys.deleteBucketKey(target.id), R2_KEY_TIMEOUT_MS);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message === 'timeout') {
+                            throw new Error(`coolify:own-files-r2 for ${org.slug}: deleting token ${target.id} did not answer within ${R2_KEY_TIMEOUT_MS / 1000} seconds`);
+                        }
+                        throw error;
+                    }
+                    return;
+                }
                 case 'zitadel:app': {
                     const zitadelOrgId = recordedIds.zitadel_org;
                     const projectId = recordedIds.zitadel_project;