@wtfalch/foundry 0.33.1 → 0.34.0

package/dist/plan/platform-providers.js

@@ -9,16 +9,21 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
-import { healthCheckSettings } from './health-check-settings.js';
+import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
+import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonAuthOrganizationId, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
+import { recordOwnDnsHostname } from './own-dns.js';
+import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonAuthOrganizationId, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
-import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
+import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, waitForSystemApi, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
-function apexZoneKey(apex) {
+export function apexZoneKey(apex) {
     return `cloudflare:zone:${apex}`;
 }
 /** The key `runPlatformSteps` records the jobs scheduler app's id under (`system:kind:key`, #173). */
@@ -29,7 +34,7 @@ const JOBS_APP_KEY = `coolify:jobs:${JOBS_SCHEDULER_KEY}`;
  * those exist. Edge's step runs first and records the address
  * (`planPlatform`), so a missing one means that step has not finished.
  */
-async function platformDns(deps, recorded, step) {
+export async function platformDns(deps, recorded, step) {
     const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
     if (!edgeUrl) {
         throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every DNS record is written through it`);
@@ -37,7 +42,7 @@ async function platformDns(deps, recorded, step) {
     return deps.dns(edgeUrl);
 }
 /** The tunnel port for a platform step; same address and same reason as {@link platformDns}. */
-async function platformTunnels(deps, recorded, step) {
+export async function platformTunnels(deps, recorded, step) {
     const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
     if (!edgeUrl) {
         throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every tunnel is managed through it`);
@@ -69,16 +74,21 @@ const JOBS_DATABASE_SCOPE_KEY = 'coolify_jobs_database';
  * never rotates a token the host already holds.
  */
 const JOBS_ADMIN_TOKEN_SCOPE_KEY = 'jobs_admin_token_set';
-/** How many times `coolifyJobs` tries `deliverSecret` before giving up. */
+/**
+ * An own org's scheduler only: the app's uuid, recorded and persisted before
+ * the admin token leaves and cleared once the token is delivered and written.
+ * Left set, the planner reports the scheduler blocked and never mints again.
+ */
+export const JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY = 'jobs_admin_token_undelivered';
+/** An own org's scheduler only: the git ref its app last deployed, so a changed declared ref plans the step again. */
+export const JOBS_APPLIED_GIT_REF_SCOPE_KEY = 'jobs_applied_git_ref';
+/** How many times `provisionJobsHost` tries `deliverSecret` before giving up. */
 const JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS = 3;
-/** The ref the scheduler's admin token is delivered under: the host's real `JobsSchedulerPort` adapter reads it back. */
-export const JOBS_ADMIN_TOKEN_REF = 'jobs:scheduler:adminToken';
 /** The name of the Coolify project every platform-level service (starting with jobs, #173) lives in. */
 const PLATFORM_COOLIFY_PROJECT_NAME = 'platform';
 /** https://github.com/wtfalch/jobs -- the scheduler's own repo, Dockerfile at its root (its own `Dockerfile`'s doc comment). */
 const JOBS_SCHEDULER_REPO = 'wtfalch/jobs';
-/** The scheduler's fixed `custom_internal_name` and the port it listens on (jobs' `PORT`, default 8080). */
-const JOBS_INTERNAL_NAME = 'platform-jobs';
+/** The port the scheduler listens on (jobs' `PORT`, default 8080). */
 const JOBS_PORT = '8080';
 /**
  * The real {@link PlatformStepExecutor} for the two steps built so far:
@@ -223,6 +233,13 @@ export class FoundryPlatformStepExecutor {
             if (mailBlocked)
                 blocked.mail = mailBlocked;
         }
+        if (platform.mail.relay === true) {
+            const relayBlocked = this.mail
+                ? mailRelayBlockedReason()
+                : MAIL_RELAY_BLOCKED.executorMissing;
+            if (relayBlocked)
+                blocked.relay = relayBlocked;
+        }
         if (platform.integrations.enabled && !this.integrations) {
             blocked.integrations =
                 'the integrations host is blocked, not planned: the host built the platform executor without its integrations dependencies';
@@ -628,6 +645,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformMail(context, this.mail);
         }
+        if (action.system === 'coolify' &&
+            action.kind === 'app' &&
+            action.key === PLATFORM_MAIL_RELAY_KEY) {
+            if (!this.mail) {
+                throw new Error('platform:mail-relay needs FoundryPlatformStepExecutor to be constructed with its mail dependencies');
+            }
+            return provisionPlatformMailRelay(action, context, this.mail);
+        }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_HC_KEY) {
             if (!this.hc) {
                 throw new Error('platform:hc needs FoundryPlatformStepExecutor to be constructed with its hc dependencies (#540)');
@@ -743,104 +768,148 @@ export class FoundryPlatformStepExecutor {
         if (!deliverSecret) {
             throw new Error('platform step coolify:jobs needs a deliverSecret -- construct FoundryPlatformStepExecutor with one, to hand the scheduler admin token to the host (#173)');
         }
-        const hostname = action.desired.hostname;
-        const gitRef = action.desired.gitRef;
-        const recorded = context.recordedIds();
-        let projectUuid = recorded[JOBS_PROJECT_SCOPE_KEY];
-        if (!projectUuid) {
-            const found = await coolify.findProjectByName(PLATFORM_COOLIFY_PROJECT_NAME);
-            projectUuid = found
-                ? found.uuid
-                : (await coolify.createProject(PLATFORM_COOLIFY_PROJECT_NAME)).uuid;
-            context.recordScopeId(JOBS_PROJECT_SCOPE_KEY, projectUuid);
-        }
-        const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
-        let dbId = recorded[JOBS_DATABASE_SCOPE_KEY];
-        if (!dbId) {
-            const dbName = `${JOBS_SCHEDULER_KEY}-scheduler-db`;
-            const found = (await coolify.listDatabases()).find((db) => db.name === dbName && db.environment_id === environment.id);
-            if (found) {
-                dbId = found.uuid;
-            }
-            else {
-                const server = await resolvePlatformServer(coolify);
-                const created = await coolify.createPostgresDatabase({
-                    project_uuid: projectUuid,
-                    server_uuid: server.uuid,
-                    environment_name: environment.name,
-                    environment_uuid: environment.uuid,
-                    name: dbName,
-                    postgres_db: 'jobs',
-                    postgres_user: 'jobs',
-                });
-                dbId = created.uuid;
-            }
-            context.recordScopeId(JOBS_DATABASE_SCOPE_KEY, dbId);
-        }
-        const existingApp = await coolify.findApplicationByName(JOBS_SCHEDULER_KEY, {
-            environmentIds: [environment.id],
+        return provisionJobsHost(scopeFromPlatform(context), { coolify, deliverSecret, runtime: this.runtime }, platformTarget(), {
+            hostname: action.desired.hostname,
+            gitRef: action.desired.gitRef,
+            project: platformJobsProject,
         });
-        let appId;
-        if (existingApp) {
-            appId = existingApp.uuid;
+    }
+}
+/** The platform's jobs scheduler lives in the shared `platform` project. */
+const platformJobsProject = {
+    async ensure(coolify, scope) {
+        const recorded = scope.recordedIds()[JOBS_PROJECT_SCOPE_KEY];
+        if (recorded)
+            return recorded;
+        const found = await coolify.findProjectByName(PLATFORM_COOLIFY_PROJECT_NAME);
+        const projectUuid = found
+            ? found.uuid
+            : (await coolify.createProject(PLATFORM_COOLIFY_PROJECT_NAME)).uuid;
+        scope.recordScopeId(JOBS_PROJECT_SCOPE_KEY, projectUuid);
+        return projectUuid;
+    },
+};
+/**
+ * Provisions one jobs scheduler (database, app, admin token) for `target`:
+ * the platform's, or an own org's. Every name and the held-key ref come from
+ * the target.
+ *
+ * An org target also guards the mint (`CLAUDE.md`, "Platform steps" rules 1
+ * and 3): the token's id is recorded as undelivered and persisted before the
+ * token leaves, the delivered guard is recorded after the env write, and the
+ * applied git ref is recorded so a changed ref plans the step again. The
+ * platform's step keeps its provision-only behaviour.
+ */
+export async function provisionJobsHost(scope, deps, target, input) {
+    const { coolify, deliverSecret, runtime } = deps;
+    const { hostname, gitRef } = input;
+    const own = target.kind === 'org';
+    const label = own ? `own step coolify:own-jobs for ${target.id}` : 'platform step coolify:jobs';
+    const projectUuid = await input.project.ensure(coolify, scope);
+    const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+    let dbId = scope.recordedIds()[JOBS_DATABASE_SCOPE_KEY];
+    if (!dbId) {
+        const dbName = target.names.jobsDb;
+        const found = (await coolify.listDatabases()).find((db) => db.name === dbName && db.environment_id === environment.id);
+        if (found) {
+            dbId = found.uuid;
         }
         else {
             const server = await resolvePlatformServer(coolify);
-            const githubApp = await coolify.requireGithubApp();
-            const created = await coolify.createGithubAppApplication({
+            const created = await coolify.createPostgresDatabase({
                 project_uuid: projectUuid,
                 server_uuid: server.uuid,
                 environment_name: environment.name,
                 environment_uuid: environment.uuid,
-                github_app_uuid: githubApp.uuid,
-                git_repository: JOBS_SCHEDULER_REPO,
-                git_branch: gitRef,
-                build_pack: 'dockerfile',
-                name: JOBS_SCHEDULER_KEY,
-                domains: coolifyDomains([hostname]),
+                name: dbName,
+                postgres_db: 'jobs',
+                postgres_user: 'jobs',
             });
-            appId = created.uuid;
+            dbId = created.uuid;
         }
-        // Set on every run, like `platform:files`' runner: the name another
-        // container reaches the scheduler by. It only takes effect on a deploy.
-        await coolify.updateApplication(appId, {
-            custom_internal_name: JOBS_INTERNAL_NAME,
-            ports_exposes: JOBS_PORT,
+        scope.recordScopeId(JOBS_DATABASE_SCOPE_KEY, dbId);
+    }
+    const existingApp = await coolify.findApplicationByName(target.names.jobsApp, {
+        environmentIds: [environment.id],
+    });
+    let appId;
+    if (existingApp) {
+        appId = existingApp.uuid;
+    }
+    else {
+        const server = await resolvePlatformServer(coolify);
+        const githubApp = await coolify.requireGithubApp();
+        const created = await coolify.createGithubAppApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            github_app_uuid: githubApp.uuid,
+            git_repository: JOBS_SCHEDULER_REPO,
+            git_branch: gitRef,
+            build_pack: 'dockerfile',
+            name: target.names.jobsApp,
+            ...(hostname ? { domains: coolifyDomains([hostname]) } : {}),
         });
-        const db = await getDatabaseStarted(coolify, dbId);
-        if (!db.internal_db_url) {
-            throw new Error(`platform step coolify:jobs: database ${dbId} has no internal_db_url yet; not deploying the scheduler without a database`);
-        }
-        // The scheduler migrates as `DATABASE_URL_OWNER` and creates its own
-        // `jobs_rt` role from `DATABASE_URL` (jobs README, "Deploying"). An app
-        // with no owner URL still holds the owner's URL in `DATABASE_URL`, so
-        // that is never reused: a runtime URL is minted, once, and kept after.
-        const hasOwnerUrl = (await coolify.listEnvs(appId)).some((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview && e.value);
-        const runtimeUrl = await ensureAiRuntimeUrl(coolify, hasOwnerUrl ? [appId] : [], db.internal_db_url, 'platform step coolify:jobs');
-        const envs = [
-            { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
-            { key: 'DATABASE_URL', value: runtimeUrl },
-        ];
-        // Whether the scheduler runs on envs other than the ones written below.
-        // Marked and persisted before the first write, and cleared only after the
-        // deploy, so a run that dies in between leaves the mark and the next run
-        // deploys again (`CLAUDE.md` rule 4).
-        const pending = Boolean(recorded[JOBS_DEPLOY_PENDING_SCOPE_KEY]) || (await envsDiffer(coolify, appId, envs));
-        if (pending) {
-            context.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '1');
-            await context.persist?.();
-        }
-        // SCHEDULER_ADMIN_TOKEN gates the admin API the org registrations use
-        // (jobs README, "The admin API"); unset, every admin route answers 401.
-        // Delivered to the host before it is written to the app, so a failed
-        // delivery leaves nothing set and the rerun simply generates a new one.
-        let tokenJustSet = false;
-        if (!context.recordedIds()[JOBS_ADMIN_TOKEN_SCOPE_KEY]) {
-            const token = randomBytes(32).toString('hex');
+        appId = created.uuid;
+    }
+    // An org's declared ref is applied to the app it already has; the platform's
+    // is a manual redeploy.
+    const refChanged = own && Boolean(existingApp) && scope.recordedIds()[JOBS_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+    // Set on every run, like `platform:files`' runner: the name another
+    // container reaches the scheduler by. It only takes effect on a deploy.
+    await coolify.updateApplication(appId, {
+        custom_internal_name: target.internal.jobs,
+        ports_exposes: JOBS_PORT,
+        // A connect, not a GET: every route but the admin one answers 401, 404 or 405, which a GET check fails.
+        ...commandHealthCheckSettings(tcpProbe(JOBS_PORT)),
+        ...(refChanged ? { git_branch: gitRef } : {}),
+    });
+    const db = await getDatabaseStarted(coolify, dbId);
+    if (!db.internal_db_url) {
+        throw new Error(`${label}: database ${dbId} has no internal_db_url yet; not deploying the scheduler without a database`);
+    }
+    // The scheduler migrates as `DATABASE_URL_OWNER` and creates its own
+    // `jobs_rt` role from `DATABASE_URL` (jobs README, "Deploying"). An app
+    // with no owner URL still holds the owner's URL in `DATABASE_URL`, so
+    // that is never reused: a runtime URL is minted, once, and kept after.
+    const hasOwnerUrl = (await coolify.listEnvs(appId)).some((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview && e.value);
+    const runtimeUrl = await ensureAiRuntimeUrl(coolify, hasOwnerUrl ? [appId] : [], db.internal_db_url, label);
+    const envs = [
+        { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
+        { key: 'DATABASE_URL', value: runtimeUrl },
+    ];
+    // Whether the scheduler runs on envs other than the ones written below.
+    // Marked and persisted before the first write, and cleared only after the
+    // deploy, so a run that dies in between leaves the mark and the next run
+    // deploys again (`CLAUDE.md` rule 4).
+    const pending = Boolean(scope.recordedIds()[JOBS_DEPLOY_PENDING_SCOPE_KEY]) ||
+        refChanged ||
+        (await envsDiffer(coolify, appId, envs));
+    if (pending) {
+        scope.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '1');
+        await scope.persist();
+    }
+    // SCHEDULER_ADMIN_TOKEN gates the admin API the org registrations use
+    // (jobs README, "The admin API"); unset, every admin route answers 401.
+    // Delivered to the host before it is written to the app.
+    let tokenJustSet = false;
+    if (!scope.recordedIds()[JOBS_ADMIN_TOKEN_SCOPE_KEY]) {
+        const lost = own ? scope.recordedIds()[JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY] : undefined;
+        const resumed = lost ? await deps.readSecret?.(target.refs.jobsAdminToken) : null;
+        if (lost && !resumed) {
+            throw new Error(`${label}: a scheduler admin token (${lost}) was minted but never confirmed delivered; remove the recorded key ${JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+        }
+        const token = resumed || randomBytes(32).toString('hex');
+        if (!resumed) {
+            if (own) {
+                scope.recordScopeId(JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, appId);
+                await scope.persist();
+            }
             let delivered = false;
             for (let attempt = 1; attempt <= JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS && !delivered; attempt++) {
                 try {
-                    await deliverSecret(JOBS_ADMIN_TOKEN_REF, token);
+                    await deliverSecret(target.refs.jobsAdminToken, token);
                     delivered = true;
                 }
                 catch {
@@ -848,48 +917,48 @@ export class FoundryPlatformStepExecutor {
                 }
             }
             if (!delivered) {
-                throw new Error(`platform step coolify:jobs: the scheduler admin token could not be delivered after ${JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS} attempts`);
+                throw new Error(`${label}: the scheduler admin token could not be delivered after ${JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS} attempts`);
             }
-            envs.push({ key: 'SCHEDULER_ADMIN_TOKEN', value: token });
-            await coolify.bulkUpsertEnvs(appId, envs);
-            context.recordScopeId(JOBS_ADMIN_TOKEN_SCOPE_KEY, appId);
-            tokenJustSet = true;
         }
-        else {
-            await coolify.bulkUpsertEnvs(appId, envs);
-        }
-        // The app is created with `instant_deploy: false` and an env change needs
-        // a redeploy, so deploy after a create or a new token. Also when it is not
-        // running, so a deploy that failed on an earlier run is retried.
-        const running = (await coolify.getApplication(appId)).status?.startsWith('running') ?? false;
-        // An app applied before its internal address was recorded has no fixed
-        // name yet, so it deploys once to get it; after that it deploys on the
-        // other conditions only.
-        const addressNew = !context.recordedIds()[JOBS_INTERNAL_URL_SCOPE_KEY];
-        // The address is recorded only once the deployment finished: the scheduler
-        // has no route that answers without its admin token (every other path is a
-        // 401, 404 or 405), so the deployment record is the whole check, as for
-        // the AI worker. A deploy that fails or times out throws here, records
-        // nothing and leaves the step planned.
-        if (!existingApp || tokenJustSet || pending || !running || addressNew) {
-            await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, this.runtime, this.runtime.sleep ?? defaultSleep, 'platform step coolify:jobs', 'the scheduler keeps its old address');
-        }
-        if (pending) {
-            context.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '');
-            await context.persist?.();
-        }
-        context.recordScopeId(JOBS_INTERNAL_URL_SCOPE_KEY, `http://${JOBS_INTERNAL_NAME}:${JOBS_PORT}`);
-        return { resourceId: appId };
+        envs.push({ key: 'SCHEDULER_ADMIN_TOKEN', value: token });
+        await coolify.bulkUpsertEnvs(appId, envs);
+        scope.recordScopeId(JOBS_ADMIN_TOKEN_SCOPE_KEY, appId);
+        if (own)
+            scope.recordScopeId(JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, '');
+        tokenJustSet = true;
     }
+    else {
+        await coolify.bulkUpsertEnvs(appId, envs);
+    }
+    // The app is created with `instant_deploy: false` and an env change needs
+    // a redeploy, so deploy after a create or a new token. Also when it is not
+    // running, so a deploy that failed on an earlier run is retried.
+    const running = (await coolify.getApplication(appId)).status?.startsWith('running') ?? false;
+    // An app applied before its internal address was recorded has no fixed
+    // name yet, so it deploys once to get it; after that it deploys on the
+    // other conditions only.
+    const addressNew = !scope.recordedIds()[JOBS_INTERNAL_URL_SCOPE_KEY];
+    // The address is recorded only once the deployment finished: the scheduler
+    // has no route that answers without its admin token (every other path is a
+    // 401, 404 or 405), so the deployment record is the whole check, as for
+    // the AI worker. A deploy that fails or times out throws here, records
+    // nothing and leaves the step planned.
+    if (!existingApp || tokenJustSet || pending || !running || addressNew) {
+        await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, label, 'the scheduler keeps its old address');
+    }
+    if (pending) {
+        scope.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '');
+        await scope.persist();
+    }
+    if (own)
+        scope.recordScopeId(JOBS_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
+    scope.recordScopeId(JOBS_INTERNAL_URL_SCOPE_KEY, `http://${target.internal.jobs}:${JOBS_PORT}`);
+    return { resourceId: appId };
 }
 // ---------------------------------------------------------------------------
 // #168: the platform's own sign-in (ZITADEL)
 // ---------------------------------------------------------------------------
 const PLATFORM_AUTH_PROJECT = 'platform';
-const PLATFORM_AUTH_DB_NAME = 'platform-auth-db';
-const PLATFORM_AUTH_ZITADEL_APP_NAME = 'platform-auth-zitadel';
-const PLATFORM_AUTH_LOGIN_APP_NAME = 'platform-auth-login';
-const PLATFORM_AUTH_BROKER_APP_NAME = 'platform-auth-broker';
 /**
  * Fixed `custom_internal_name`s (`diff.ts`'s `coolifyCalls` sets the same
  * kind of name on Synapse/MAS) so the Cloudflare tunnel below can address
@@ -897,12 +966,7 @@ const PLATFORM_AUTH_BROKER_APP_NAME = 'platform-auth-broker';
  * -- bypassing Coolify's own Traefik, which dispatches purely by `Host`
  * header and so cannot give two different apps the same public hostname.
  */
-const PLATFORM_AUTH_ZITADEL_INTERNAL_NAME = 'platform-auth-zitadel';
 export const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = 'platform-auth-login';
-const PLATFORM_AUTH_BROKER_INTERNAL_NAME = 'platform-auth-broker';
-const PLATFORM_AUTH_TUNNEL_NAME = 'platform-auth-tunnel';
-/** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_AUTH_TUNNEL_NAME}. */
-const PLATFORM_AUTH_CLOUDFLARED_APP_NAME = 'platform-auth-cloudflared';
 /** `wtfalch/auth`'s `docker-compose.yml`: `image: ghcr.io/zitadel/zitadel:${ZITADEL_VERSION:-v4.17.3}`. Pinned in `versions.json` (#247). */
 const AUTH_ZITADEL_IMAGE = 'ghcr.io/zitadel/zitadel';
 const AUTH_ZITADEL_IMAGE_TAG = VERSIONS.zitadel;
@@ -917,6 +981,22 @@ const AUTH_BROKER_DOCKERFILE = '/broker/Dockerfile';
  * own `ZITADEL_PORT: 8080` and the login image's own `EXPOSE`.
  */
 const AUTH_ZITADEL_PORT = '8080';
+/**
+ * The inline Dockerfile of the ZITADEL app. The published image is distroless (no shell, no `curl`) and has no
+ * HEALTHCHECK, and Coolify runs its own check as `sh -c`. So the app is a Dockerfile app: the image's own `ready`
+ * command is its exec-form HEALTHCHECK, which Coolify keeps while its own check is off. `ready` asks the port and
+ * TLS mode from the same `ZITADEL_*` settings the server reads. The start period covers the first run, which sets
+ * up the database and the first instance before it listens. The start command is the one
+ * {@link AUTH_ZITADEL_RUN_OPTIONS} names.
+ */
+export function zitadelDockerfile() {
+    return [
+        `FROM ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG}`,
+        `EXPOSE ${AUTH_ZITADEL_PORT}`,
+        'CMD ["start-from-init", "--masterkeyFromEnv", "--tlsMode", "external"]',
+        'HEALTHCHECK --interval=15s --timeout=5s --start-period=180s --retries=5 CMD ["/app/zitadel", "ready"]',
+    ].join('\n');
+}
 export const AUTH_LOGIN_PORT = '3000';
 /** `broker/Dockerfile`'s own `ENV PORT=3000` / `EXPOSE 3000`. */
 const AUTH_BROKER_PORT = '3000';
@@ -942,8 +1022,8 @@ export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|sy
 const AUTH_BROKER_PATH_PATTERN = '^/api(/|$)';
 const PLATFORM_AUTH_PROJECT_SCOPE_KEY = 'coolify_project_platform_auth';
 const PLATFORM_AUTH_DB_SCOPE_KEY = 'coolify_platform_auth_database';
-const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = 'coolify_platform_auth_zitadel_app';
-const PLATFORM_AUTH_LOGIN_SCOPE_KEY = 'coolify_platform_auth_login_app';
+export const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = 'coolify_platform_auth_zitadel_app';
+export const PLATFORM_AUTH_LOGIN_SCOPE_KEY = 'coolify_platform_auth_login_app';
 const PLATFORM_AUTH_TUNNEL_SCOPE_KEY = 'cloudflare_platform_auth_tunnel';
 /** Recorded once the ZITADEL app has been deployed, so ZITADEL may have written to its database. */
 const PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY = 'zitadel_platform_auth_deployed';
@@ -1072,6 +1152,10 @@ function loginClientRecordValue(userId, patId, token) {
  * miss for a credential-liveness check than for Archon's own Access policy.
  */
 async function authLoginClientDrifted(platform, auth, recordedIds) {
+    return authLoginClientDriftedAt({ hostname: platform.auth.hostname }, auth, recordedIds);
+}
+/** {@link authLoginClientDrifted} for any instance; `bearerRef` is passed to `zitadelForInstance` only when set. */
+async function authLoginClientDriftedAt(instance, auth, recordedIds) {
     const record = parseLoginClientRecord(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]);
     if (!record)
         return false;
@@ -1081,7 +1165,10 @@ async function authLoginClientDrifted(platform, auth, recordedIds) {
     if (!orgId || !loginAppId || !brokerAppId)
         return true;
     try {
-        const zitadel = auth.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? auth.zitadel;
+        const issuer = `https://${instance.hostname}`;
+        const zitadel = (instance.bearerRef && instance.bearerRef !== PLATFORM_AUTH_INSTANCE_BEARER_REF
+            ? auth.zitadelForInstance?.(issuer, instance.bearerRef)
+            : auth.zitadelForInstance?.(issuer)) ?? auth.zitadel;
         const livePats = await zitadel.listLoginClientPats(orgId, record.userId);
         if (livePats.length !== 1 || livePats[0] !== record.patId)
             return true;
@@ -1240,28 +1327,33 @@ async function liveLoginClientTokenHash(coolify, appId) {
  * #197: a `cloudflared` connector for this tunnel is run
  * ({@link ensureCloudflaredConnector}), so `hostname` answers.
  */
-async function provisionPlatformAuth(context, deps, ownerCompany = null) {
-    const { platform } = context;
+export async function provisionAuthStack(scope, deps, target, input) {
+    const { hostname, apex, gitRef, ownerCompany, network } = input;
     const owners = ownerCompany?.owners ?? [];
-    const hostname = platform.auth.hostname;
-    const gitRef = platform.auth.gitRef;
-    const recorded = context.recordedIds();
+    const recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
+    const label = target.kind === 'platform' ? 'platform:auth' : `${target.id}:auth`;
+    const subject = target.kind === 'platform' ? 'the platform' : target.id;
+    const issuer = `https://${hostname}`;
+    const instanceZitadel = () => {
+        const forInstance = target.refs.instanceBearer === PLATFORM_AUTH_INSTANCE_BEARER_REF
+            ? deps.zitadelForInstance?.(issuer)
+            : deps.zitadelForInstance?.(issuer, target.refs.instanceBearer);
+        if (forInstance)
+            return forInstance;
+        if (target.kind === 'org') {
+            throw new Error(`own step coolify:own-auth for ${target.id}: the host supplies no ZITADEL port for the company's own instance`);
+        }
+        return deps.zitadel;
+    };
     // Records an id and writes it out now, so a crash before the step ends
     // cannot lose a resource a provider already created.
     const record = async (key, id) => {
-        context.recordScopeId(key, id);
-        await context.persist?.();
+        scope.recordScopeId(key, id);
+        await scope.persist();
     };
-    let projectUuid = recorded[PLATFORM_AUTH_PROJECT_SCOPE_KEY];
-    if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_AUTH_PROJECT);
-        projectUuid = found
-            ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_AUTH_PROJECT)).uuid;
-        await record(PLATFORM_AUTH_PROJECT_SCOPE_KEY, projectUuid);
-    }
+    const projectUuid = await input.project.ensure(deps.coolify, scope);
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     // ---- database ----------------------------------------------------------
     let dbId = recorded[PLATFORM_AUTH_DB_SCOPE_KEY];
@@ -1277,7 +1369,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            name: PLATFORM_AUTH_DB_NAME,
+            name: target.names.authDb,
             postgres_db: 'zitadel',
             postgres_user: 'zitadel',
         });
@@ -1290,22 +1382,19 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         // `coolifyCalls` follows the same rule for its own databases): Coolify
         // can take a moment to report a freshly created database's
         // `internal_db_url`, so the next apply retries from a clean state.
-        throw new Error('coolify:app for the platform (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
+        throw new Error(`coolify:app for ${subject} (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
     }
     // ---- the ZITADEL app itself ---------------------------------------------
-    const zitadelApp = await findOrCreatePlatformApp(deps.coolify, PLATFORM_AUTH_ZITADEL_APP_NAME, environment, async () => {
+    const zitadelApp = await findOrCreatePlatformApp(deps.coolify, target.names.authZitadel, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
-        return deps.coolify.createDockerImageApplication({
+        return deps.coolify.createDockerfileApplication({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: AUTH_ZITADEL_IMAGE,
-            docker_registry_image_tag: AUTH_ZITADEL_IMAGE_TAG,
-            ports_exposes: AUTH_ZITADEL_PORT,
-            custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
-            name: PLATFORM_AUTH_ZITADEL_APP_NAME,
-            description: `ZITADEL for the platform's own sign-in (#168, ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG})`,
+            dockerfile: zitadelDockerfile(),
+            name: target.names.authZitadel,
+            description: `ZITADEL for ${target.kind === 'platform' ? "the platform's" : `${target.id}'s`} own sign-in (#168, ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG})`,
             instant_deploy: false,
         });
     });
@@ -1315,14 +1404,21 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // create must not leave the app unnamed for good, and the tunnel addresses
     // the app by this name. (The port cannot read the current name back, and
     // setting the same value again is harmless.)
-    // The run options go in the same patch, so an app made before they existed
-    // gets them too.
-    await deps.coolify.updateApplication(zitadelAppId, {
-        custom_internal_name: PLATFORM_AUTH_ZITADEL_INTERNAL_NAME,
-        custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
-    });
     // The container only takes new run options at its next deploy.
     const zitadelRunOptionsNew = recorded[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] !== AUTH_ZITADEL_RUN_OPTIONS;
+    // A new app is a Dockerfile app that starts with `zitadelDockerfile()`'s CMD, so it gets no run options.
+    // An app made before that is an image app, found by name and never replaced: it keeps its run options (sent
+    // here until the deploy that applied them is recorded), has no Docker-level check, and takes none until its
+    // organisation is provisioned again from zero. The Coolify check stays off on both: the Dockerfile's
+    // HEALTHCHECK is the live one, and Coolify's rolling update follows it.
+    await deps.coolify.updateApplication(zitadelAppId, {
+        custom_internal_name: target.internal.authZitadel,
+        ports_exposes: AUTH_ZITADEL_PORT,
+        health_check_enabled: false,
+        ...(zitadelRunOptionsNew && !zitadelApp.justCreated
+            ? { custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS }
+            : {}),
+    });
     // #251: only on create, never unconditionally -- nothing here patches
     // `docker_registry_image_tag` on an app `findOrCreatePlatformApp` found
     // already running, so that is the only moment this tag is actually live.
@@ -1333,7 +1429,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         await record(PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, AUTH_ZITADEL_IMAGE_TAG);
     }
     // ---- the zitadel-login app -----------------------------------------------
-    const loginApp = await findOrCreatePlatformApp(deps.coolify, PLATFORM_AUTH_LOGIN_APP_NAME, environment, async () => {
+    const loginApp = await findOrCreatePlatformApp(deps.coolify, target.names.authLogin, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
@@ -1345,17 +1441,19 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             git_repository: AUTH_REPO,
             git_branch: gitRef,
             build_pack: 'dockerfile',
-            name: PLATFORM_AUTH_LOGIN_APP_NAME,
+            name: target.names.authLogin,
             dockerfile_location: AUTH_LOGIN_DOCKERFILE,
         });
     });
     const loginAppId = loginApp.appId;
     await record(PLATFORM_AUTH_LOGIN_SCOPE_KEY, loginAppId);
+    // The Dockerfile's own HEALTHCHECK is the live check (`IMAGE_HEALTHCHECK_SETTINGS`).
     await deps.coolify.updateApplication(loginAppId, {
-        custom_internal_name: PLATFORM_AUTH_LOGIN_INTERNAL_NAME,
+        custom_internal_name: target.internal.authLogin,
+        ...IMAGE_HEALTHCHECK_SETTINGS,
     });
     // ---- the broker app (#204) -------------------------------------------------
-    const brokerApp = await findOrCreatePlatformApp(deps.coolify, PLATFORM_AUTH_BROKER_APP_NAME, environment, async () => {
+    const brokerApp = await findOrCreatePlatformApp(deps.coolify, target.names.authBroker, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
@@ -1367,21 +1465,24 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             git_repository: AUTH_REPO,
             git_branch: gitRef,
             build_pack: 'dockerfile',
-            name: PLATFORM_AUTH_BROKER_APP_NAME,
+            name: target.names.authBroker,
             dockerfile_location: AUTH_BROKER_DOCKERFILE,
         });
     });
     const brokerAppId = brokerApp.appId;
     await record(PLATFORM_AUTH_BROKER_SCOPE_KEY, brokerAppId);
     await deps.coolify.updateApplication(brokerAppId, {
-        custom_internal_name: PLATFORM_AUTH_BROKER_INTERNAL_NAME,
+        custom_internal_name: target.internal.authBroker,
+        ...IMAGE_HEALTHCHECK_SETTINGS,
     });
     // ---- env -----------------------------------------------------------------
     // Generated once, handed straight to `bulkUpsertEnvs` and nowhere else --
     // never returned, recorded, logged or interpolated into a thrown error, the
     // same rule `executor.ts`'s `ensureAuthCookieSecret` follows for a value
     // this package mints itself rather than receiving from a provider.
-    const masterkey = await ensureMasterkey(deps.coolify, zitadelAppId, databaseInUse);
+    const masterkey = await ensureMasterkey(deps.coolify, zitadelAppId, databaseInUse, label);
+    if (masterkey)
+        runtime.onSecret?.(masterkey);
     // #283: the instance is created once, with the system API, by a platform
     // whose admin machine user is not recorded yet (one that already has it was
     // built from a first instance and keeps it). The keypair is regenerated on
@@ -1391,7 +1492,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     if (lostInstance &&
         !recorded[PLATFORM_AUTH_INSTANCE_SCOPE_KEY] &&
         !recorded[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) {
-        throw new Error(instanceWithoutBearerMessage(hostname, `instance ${lostInstance}`));
+        throw new Error(instanceWithoutBearerMessage(hostname, `instance ${lostInstance}`, label));
     }
     const needsInstance = !recorded[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY] && !recorded[PLATFORM_AUTH_INSTANCE_SCOPE_KEY];
     const systemKeys = needsInstance ? generateSystemApiKeypair() : undefined;
@@ -1421,6 +1522,10 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             value: `https://${hostname}/login?samlRequest=`,
         },
         { key: 'ZITADEL_LOGSTORE_ACCESS_STDOUT_ENABLED', value: 'true' },
+        // ZITADEL 4.17.3 logs every mail's template data at warning level ("missing
+        // translation" for `<Type>.Footer`), which holds the one-time invite code.
+        // Errors (a failed SMTP send among them) are still written.
+        { key: 'ZITADEL_LOG_LEVEL', value: 'error' },
     ];
     if (masterkey)
         zitadelEnvs.push({ key: 'ZITADEL_MASTERKEY', value: masterkey });
@@ -1433,7 +1538,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     const loginEnvs = [
         {
             key: 'ZITADEL_API_URL',
-            value: `http://${PLATFORM_AUTH_ZITADEL_INTERNAL_NAME}:${AUTH_ZITADEL_PORT}`,
+            value: `http://${target.internal.authZitadel}:${AUTH_ZITADEL_PORT}`,
         },
         {
             key: 'CUSTOM_REQUEST_HEADERS',
@@ -1447,8 +1552,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         // invite's own path (set a password, then nowhere to go). Only set once
         // Archon is declared, and only ever to Archon: the platform's one landing
         // app for anyone who reaches the login app outside an app's own sign-in.
-        ...(platform.archon.enabled
-            ? [{ key: 'DEFAULT_REDIRECT_URI', value: `https://${platform.archon.hostname}` }]
+        ...(input.defaultRedirectUri
+            ? [{ key: 'DEFAULT_REDIRECT_URI', value: input.defaultRedirectUri }]
             : []),
     ];
     // #210: read back now, not inside the deploy-decision block below -- this
@@ -1456,7 +1561,9 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // the same way `envsDiffer`/`bulkUpsertEnvs` below already do for every
     // other broker env, so a single apply that finds the key already held can
     // also see `LETTERMINT_API_TOKEN` as met and deploy in that same run.
-    const heldMailKey = await deps.heldKeys?.resolve(PLATFORM_AUTH_BROKER_MAIL_KEY_REF);
+    const heldMailKey = await deps.heldKeys?.resolve(target.refs.brokerMailKey);
+    if (heldMailKey)
+        runtime.onSecret?.(heldMailKey);
     // `AUTH_APPS` and `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` are not pushed here
     // -- this function's own doc comment, "Known gaps". `LETTERMINT_API_TOKEN`
     // is, once held (#210): pushing it costs nothing even while the broker
@@ -1465,7 +1572,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     const brokerEnvs = [
         {
             key: 'ZITADEL_API_URL',
-            value: `http://${PLATFORM_AUTH_ZITADEL_INTERNAL_NAME}:${AUTH_ZITADEL_PORT}`,
+            value: `http://${target.internal.authZitadel}:${AUTH_ZITADEL_PORT}`,
         },
         { key: 'ZITADEL_DOMAIN', value: hostname },
         ...(heldMailKey ? [{ key: 'LETTERMINT_API_TOKEN', value: heldMailKey }] : []),
@@ -1517,25 +1624,25 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, authAppsRaw));
     }
     // ---- tunnel and DNS ------------------------------------------------------
-    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:auth');
-    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_AUTH_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_AUTH_TUNNEL_NAME));
+    const tunnels = await network.tunnels();
+    const existingTunnel = await tunnels.findTunnelByName(target.names.authTunnel);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(target.names.authTunnel));
     await record(PLATFORM_AUTH_TUNNEL_SCOPE_KEY, tunnel.id);
     await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
                 path: AUTH_ZITADEL_PATH_PATTERN,
-                service: `http://${PLATFORM_AUTH_ZITADEL_INTERNAL_NAME}:${AUTH_ZITADEL_PORT}`,
+                service: `http://${target.internal.authZitadel}:${AUTH_ZITADEL_PORT}`,
             },
             {
                 hostname,
                 path: AUTH_BROKER_PATH_PATTERN,
-                service: `http://${PLATFORM_AUTH_BROKER_INTERNAL_NAME}:${AUTH_BROKER_PORT}`,
+                service: `http://${target.internal.authBroker}:${AUTH_BROKER_PORT}`,
             },
             {
                 hostname,
-                service: `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`,
+                service: `http://${target.internal.authLogin}:${AUTH_LOGIN_PORT}`,
             },
             { service: 'http_status:404' },
         ],
@@ -1548,7 +1655,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         coolify: deps.coolify,
         tunnels,
         tunnelId: tunnel.id,
-        appName: PLATFORM_AUTH_CLOUDFLARED_APP_NAME,
+        appName: target.names.authCloudflared,
         projectUuid,
         environment,
         resolveServer: () => resolvePlatformServer(deps.coolify),
@@ -1557,15 +1664,15 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     });
     // The apex zone step records the zone id before this step runs, but it
     // creates no record for the hostname, so it is created here.
-    const zoneId = recorded[apexZoneKey(platform.apex)] ?? (await exactZone(deps.cloudflare, platform.apex))?.id;
+    const zoneId = await network.zoneId(apex);
     if (!zoneId) {
-        throw new Error(`platform:auth: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
+        throw new Error(`${label}: no Cloudflare zone for ${apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const dns = await platformDns(deps, context.recordedIds(), 'platform:auth');
-    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
+    const dns = await network.dns();
+    const [dnsRecord] = await dns.findDnsRecord(apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await dns.createDnsRecord(platform.apex, {
+        await dns.createDnsRecord(apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1573,25 +1680,36 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
+        await dns.updateDnsRecord(apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
             proxied: true,
         });
     }
+    if (target.kind === 'org')
+        await recordOwnDnsHostname(scope, hostname);
     // ---- foundry's own admin machine user, once ------------------------------
     if (!recorded[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) {
         const lost = recorded[PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY];
         if (lost) {
             // The planner reports this and plans nothing; this is the same rule for
             // a caller that reaches the step anyway.
-            throw new Error(`platform:auth: the admin key of ZITADEL machine user ${lost} was minted but never delivered; delete that user and the recorded key ${PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+            throw new Error(`${label}: the admin key of ZITADEL machine user ${lost} was minted but never delivered; delete that user and the recorded key ${PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
         if (systemKeys) {
             // ZITADEL answers /debug/healthz without an instance; the openid
             // document below only exists once the instance does.
-            await waitForInstance(`https://${hostname}/debug/healthz`, runtime, sleep);
+            await waitForInstance(`https://${hostname}/debug/healthz`, runtime, sleep, label);
+            // Healthy is not ready for the system API: its gateway answers 503 for a moment after the server listens.
+            await waitForSystemApi({ customDomain: hostname, privateKey: systemKeys.privateKey, label }, {
+                fetch: runtime.fetch,
+                now: runtime.now ?? Date.now,
+                sleep,
+                timeoutMs: runtime.readyTimeoutMs,
+                intervalMs: runtime.readyIntervalMs,
+                requestTimeoutMs: runtime.readyRequestTimeoutMs,
+            });
             // Sent exactly once. Anything that may have reached ZITADEL leaves a
             // marker first, so the next run refuses instead of creating again.
             let created;
@@ -1601,6 +1719,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                     privateKey: systemKeys.privateKey,
                     instanceName: PLATFORM_AUTH_ORG_NAME,
                     firstOrgName: PLATFORM_AUTH_ORG_NAME,
+                    label,
                     owner: {
                         userName: PLATFORM_AUTH_BEARER_USER_NAME,
                         name: 'Foundry (instance owner)',
@@ -1614,12 +1733,13 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                 throw error;
             }
             const { instanceId, pat } = created;
+            runtime.onSecret?.(pat);
             // Recorded before the PAT leaves this function, like the admin key below.
             await record(PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, instanceId);
             const attempts = runtime.deliverAttempts ?? 3;
             for (let attempt = 1;; attempt += 1) {
                 try {
-                    await deps.deliverSecret(PLATFORM_AUTH_INSTANCE_BEARER_REF, pat);
+                    await deps.deliverSecret(target.refs.instanceBearer, pat);
                     break;
                 }
                 catch (error) {
@@ -1627,7 +1747,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                         const reason = redactSecrets(error instanceof Error ? error.message : String(error), [
                             pat,
                         ]);
-                        throw new Error(`platform:auth: the owner token of ZITADEL instance ${instanceId} was created but could not be delivered after ${attempts} tries (${reason}); ${instanceWithoutBearerMessage(hostname, `instance ${instanceId}`)}`);
+                        throw new Error(`${label}: the owner token of ZITADEL instance ${instanceId} was created but could not be delivered after ${attempts} tries (${reason}); ${instanceWithoutBearerMessage(hostname, `instance ${instanceId}`, label)}`);
                     }
                     await sleep(1000 * attempt);
                 }
@@ -1637,8 +1757,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         }
         // Minting needs a running instance behind the tunnel: the first apply
         // gets here right after the deploy.
-        await waitForInstance(`https://${hostname}/.well-known/openid-configuration`, runtime, sleep);
-        const zitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        await waitForInstance(`https://${hostname}/.well-known/openid-configuration`, runtime, sleep, label);
+        const zitadel = instanceZitadel();
         const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
         // #216 round 5: recorded here too (mirroring `provisionPlatformArchon`),
         // so `authLoginClientDrifted` (below) never needs its own ZITADEL call
@@ -1650,6 +1770,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             userName: PLATFORM_AUTH_ADMIN_USER_NAME,
             name: 'Foundry (platform admin)',
         });
+        runtime.onSecret?.(token);
         // Recorded and persisted before the token leaves this function: if
         // delivery fails for good, the next plan reports the lost key rather than
         // skipping or minting again. Only a delivered key records the guard.
@@ -1661,12 +1782,12 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         const attempts = runtime.deliverAttempts ?? 3;
         for (let attempt = 1;; attempt += 1) {
             try {
-                await deps.deliverSecret('zitadel:platform:admin', token);
+                await deps.deliverSecret(target.refs.authAdmin, token);
                 break;
             }
             catch {
                 if (attempt >= attempts) {
-                    throw new Error(`platform:auth: the admin key of ZITADEL machine user ${userId} was minted but could not be delivered after ${attempts} tries`);
+                    throw new Error(`${label}: the admin key of ZITADEL machine user ${userId} was minted but could not be delivered after ${attempts} tries`);
                 }
                 await sleep(1000 * attempt);
             }
@@ -1731,11 +1852,19 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // make the same call, not just trust that a record exists, or a drifted
     // platform would be planned again forever without ever actually healing.
     const loginClientOtherInputsMissing = brokerMissingInputs.filter((m) => m !== 'ZITADEL_SERVICE_USER_TOKEN');
-    const freshRecordedIds = context.recordedIds();
+    const freshRecordedIds = scope.recordedIds();
     const freshLoginClientRecord = parseLoginClientRecord(freshRecordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]);
-    const loginClientNeedsMint = !freshLoginClientRecord || (await authLoginClientDrifted(platform, deps, freshRecordedIds));
+    const loginClientNeedsMint = !freshLoginClientRecord ||
+        (await authLoginClientDriftedAt({ hostname, bearerRef: target.refs.instanceBearer }, deps, freshRecordedIds));
     if (loginClientNeedsMint && loginClientOtherInputsMissing.length === 0) {
-        const loginClientZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        // An own org never mints a second time on top of a token that may be live:
+        // the platform's re-mint revokes the old one, which would take the org's
+        // sign-in down if the first delivery had in fact landed.
+        const loginClientLost = freshRecordedIds[PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY];
+        if (target.kind === 'org' && loginClientLost && !freshLoginClientRecord) {
+            throw new Error(`${label}: the login-client token of ZITADEL machine user ${loginClientLost} was minted but never confirmed delivered; remove the recorded key ${PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+        }
+        const loginClientZitadel = instanceZitadel();
         const { org: loginClientOrg } = await loginClientZitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
         // #216 round 5: backfills the org id for a platform whose admin block
         // (above) ran before this recording existed and has not run since --
@@ -1747,6 +1876,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             userName: PLATFORM_AUTH_LOGIN_CLIENT_USER_NAME,
             name: 'Foundry (platform login client)',
         });
+        runtime.onSecret?.(loginClientToken);
         // Recorded and persisted before the token leaves this function -- the
         // same "one mint" rule the admin block above follows. Never read back to
         // block planning; `planAuth` (`platform-diff.ts`) reads it only to
@@ -1788,8 +1918,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             // saying "its prior token was already revoked" there would describe a
             // revoke that never happened, so the message only says so when it did.
             throw new Error(revokedPriorPat
-                ? `platform:auth: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so the login app and broker are down until a later apply mints and delivers a fresh one`
-                : `platform:auth: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so the login app and broker still have none until a later apply mints and delivers one`);
+                ? `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so the login app and broker are down until a later apply mints and delivers a fresh one`
+                : `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so the login app and broker still have none until a later apply mints and delivers one`);
         }
         // #216 round 4/5: records what was actually delivered -- the user id,
         // the exact PAT id, and (round 5) a hash of the exact token -- so the
@@ -1802,7 +1932,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // ---- the owner company's own sign-in org ----------------------------------
     // Archon signs people in from this org; the `foundry` org holds none. The
     // company executor finds the same org by name (its slug) and makes no second.
-    const ownerOrgZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+    const ownerOrgZitadel = instanceZitadel();
     let ownerSignInOrgId;
     if (ownerCompany) {
         ({ orgId: ownerSignInOrgId } = await ensureSignInOrg({
@@ -1810,9 +1940,9 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             zitadel: ownerOrgZitadel,
             name: ownerCompany.slug,
             domain: signInOrgDomain(ownerCompany),
-            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            recordScopeId: (key, id) => scope.recordScopeId(key, id),
             persistScopeIds: async () => {
-                await context.persist?.();
+                await scope.persist();
             },
             orgScopeKey: PLATFORM_OWNER_ORG_SCOPE_KEY,
             domainScopeKey: PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY,
@@ -1827,19 +1957,22 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     const mailToken = heldMailKey || (await currentEnvValue(deps.coolify, brokerAppId, 'LETTERMINT_API_TOKEN'));
     const smtpTarget = resolveAuthSmtp(deps.smtp);
     if (mailToken) {
-        const mailZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        const mailZitadel = instanceZitadel();
         let smtpPassword;
         try {
             // Runs every time the step does (idempotent), so a rotated token lands.
             smtpPassword = (await deps.smtp?.password?.()) ?? mailToken;
+            runtime.onSecret?.(smtpPassword);
             const smtp = await mailZitadel.ensureSmtpProvider({
                 host: smtpTarget.host,
                 user: smtpTarget.user,
                 password: smtpPassword,
-                senderAddress: `noreply@${platform.apex}`,
+                senderAddress: input.smtpSender,
                 senderName: PLATFORM_AUTH_MAIL_SENDER_NAME,
                 tls: smtpTarget.tls,
-                description: PLATFORM_AUTH_SMTP_DESCRIPTION,
+                description: target.kind === 'platform'
+                    ? PLATFORM_AUTH_SMTP_DESCRIPTION
+                    : `foundry:org:${target.id}:lettermint`,
             });
             await record(PLATFORM_AUTH_SMTP_SCOPE_KEY, smtp.id);
         }
@@ -1849,10 +1982,10 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                 mailToken,
                 ...(smtpPassword ? [smtpPassword] : []),
             ]);
-            throw new Error(`platform:auth: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
+            throw new Error(`${label}: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
         }
-        const inviteRecorded = context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
-        const inviteOrgRecorded = context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY];
+        const inviteRecorded = scope.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+        const inviteOrgRecorded = scope.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY];
         // An invite recorded for another org (the `foundry` org, before the owner moved) is made again.
         if (!inviteRecorded || (inviteRecorded !== 'none' && inviteOrgRecorded !== ownerSignInOrgId)) {
             const owner = owners[0];
@@ -1870,14 +2003,14 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                             zitadel: mailZitadel,
                             mail: deps.ownerInviteMail,
                             orgId: ownerSignInOrgId,
-                            authIssuer: `https://${hostname}`,
+                            authIssuer: issuer,
                             owner: {
                                 givenName: owner.givenName,
                                 familyName: owner.familyName,
                                 mailboxAddress,
                                 personalEmail: owner.email,
                             },
-                            label: 'platform:auth',
+                            label,
                             ...(inviteRecorded && inviteRecorded !== 'none'
                                 ? { invitedUserId: inviteRecorded }
                                 : {}),
@@ -1892,7 +2025,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                             mailToken,
                             ...(smtpPassword ? [smtpPassword] : []),
                         ]);
-                        throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerSignInOrgId}: ${cause}`);
+                        throw new Error(`${label}: could not invite the platform owner into ZITADEL org ${ownerSignInOrgId}: ${cause}`);
                     }
                     // The user id first: a crash between the two replans the invite, never skips it.
                     await record(PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, invitedUserId);
@@ -1903,6 +2036,34 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     }
     return { resourceId: zitadelAppId };
 }
+/** The platform's sign-in project: the shared `platform` project, its id recorded under the sign-in's own scope key. */
+const platformAuthProject = {
+    async ensure(coolify, scope) {
+        const recorded = scope.recordedIds()[PLATFORM_AUTH_PROJECT_SCOPE_KEY];
+        if (recorded)
+            return recorded;
+        const found = await coolify.findProjectByName(PLATFORM_AUTH_PROJECT);
+        const uuid = found ? found.uuid : (await coolify.createProject(PLATFORM_AUTH_PROJECT)).uuid;
+        scope.recordScopeId(PLATFORM_AUTH_PROJECT_SCOPE_KEY, uuid);
+        await scope.persist();
+        return uuid;
+    },
+};
+/** The platform's sign-in: {@link provisionAuthStack} with {@link platformTarget} and the platform's own inputs. */
+async function provisionPlatformAuth(context, deps, ownerCompany = null) {
+    const { platform } = context;
+    const scope = scopeFromPlatform(context);
+    return provisionAuthStack(scope, deps, platformTarget(), {
+        hostname: platform.auth.hostname,
+        apex: platform.apex,
+        gitRef: platform.auth.gitRef,
+        project: platformAuthProject,
+        network: platformNetwork(deps, scope, 'platform:auth'),
+        smtpSender: `noreply@${platform.apex}`,
+        defaultRedirectUri: platform.archon.enabled ? `https://${platform.archon.hostname}` : null,
+        ownerCompany,
+    });
+}
 /**
  * Reserves the username `admin` and switches self-registration off in the
  * platform's sign-in org (`zitadel:sign-in-policy` keyed {@link PLATFORM_AUTH_KEY}).
@@ -1977,11 +2138,7 @@ const PLATFORM_AUTH_MAIL_SENDER_NAME = 'Company Included';
 // #169: the platform's own mail server (Stalwart)
 // ---------------------------------------------------------------------------
 const PLATFORM_MAIL_PROJECT = 'platform';
-const PLATFORM_MAIL_APP_NAME = 'platform-mail-stalwart';
 const PLATFORM_MAIL_INTERNAL_NAME = 'platform-mail-stalwart';
-const PLATFORM_MAIL_TUNNEL_NAME = 'platform-mail-tunnel';
-/** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_MAIL_TUNNEL_NAME}. */
-const PLATFORM_MAIL_CLOUDFLARED_APP_NAME = 'platform-mail-cloudflared';
 /**
  * `stalw.art/docs/install/docker`: the official image. `platform.mail.gitRef`
  * carries its tag -- `platform.ts`'s `PlatformService.gitRef` doc comment
@@ -2004,7 +2161,6 @@ const STALWART_PORTS_EXPOSES = [STALWART_HTTP_PORT, ...STALWART_SMTP_PORTS].join
  * not here -- it stays behind the tunnel, exactly like `platform:auth`'s
  * ZITADEL/login apps.
  */
-const STALWART_PORTS_MAPPINGS = STALWART_SMTP_PORTS.map((p) => `${p}:${p}`).join(',');
 /**
  * The v0.16 image's two VOLUMEs (its Dockerfile): the data store, and the
  * `config.json` Stalwart writes when bootstrap completes. The pre-0.16 image
@@ -2031,6 +2187,7 @@ const STALWART_READY_PATH = '/healthz/ready';
 const PLATFORM_MAIL_SERVER_SCOPE_KEY = 'coolify_platform_mail_server';
 const PLATFORM_MAIL_PROJECT_SCOPE_KEY = 'coolify_project_platform_mail';
 const PLATFORM_MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+const PLATFORM_MAIL_RELAY_APP_SCOPE_KEY = 'coolify_platform_mail_relay_app';
 const PLATFORM_MAIL_TUNNEL_SCOPE_KEY = 'cloudflare_platform_mail_tunnel';
 /**
  * Recorded once the app has been deployed at least once -- same role as
@@ -2198,24 +2355,20 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  *   (the guard only ever blocks a retry and names an id to revoke by), but
  *   worth tightening if `createApiKey` ever starts returning its own id.
  */
-async function provisionPlatformMail(context, deps) {
-    const { platform } = context;
-    const hostname = platform.mail.hostname;
-    const mailHost = platformMailMxHost(platform.apex);
-    const imageTag = platform.mail.gitRef;
-    const recorded = context.recordedIds();
+export async function provisionMailServer(scope, deps, target, input) {
+    const { hostname, apex, mailHost, imageTag, hostPorts, issuerUrl, mxRecord, network } = input;
+    const label = target.kind === 'org' ? `own step coolify:own-mail for ${target.id}` : 'platform:mail';
+    const keyDescription = target.kind === 'org' ? `foundry:org:${target.id}:admin` : PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION;
+    const recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const record = async (key, id) => {
-        context.recordScopeId(key, id);
-        await context.persist?.();
+        scope.recordScopeId(key, id);
+        await scope.persist();
     };
     let projectUuid = recorded[PLATFORM_MAIL_PROJECT_SCOPE_KEY];
     if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_MAIL_PROJECT);
-        projectUuid = found
-            ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_MAIL_PROJECT)).uuid;
+        projectUuid = await input.project.ensure(deps.coolify, scope);
         await record(PLATFORM_MAIL_PROJECT_SCOPE_KEY, projectUuid);
     }
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
@@ -2226,12 +2379,14 @@ async function provisionPlatformMail(context, deps) {
     // One server for both the app and the MX record: recorded the first time,
     // read back after, so a later run never points `mx.<apex>` somewhere the
     // app is not.
+    const portsChanged = (recorded[PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY] ??
+        (target.kind === 'org' ? '' : PLATFORM_MAIL_HOST_PORTS_DIRECT)) !== hostPorts;
     const server = await resolveMailServer(deps.coolify, recorded[PLATFORM_MAIL_SERVER_SCOPE_KEY]);
     await record(PLATFORM_MAIL_SERVER_SCOPE_KEY, server.uuid);
-    const serverIpBlocked = mailServerIpBlocked(server.ip, platform.serverIpv4);
+    const serverIpBlocked = mxRecord ? mailServerIpBlocked(server.ip, mxRecord.serverIpv4) : null;
     if (serverIpBlocked)
         throw new Error(serverIpBlocked);
-    const app = await findOrCreatePlatformApp(deps.coolify, PLATFORM_MAIL_APP_NAME, environment, async () => {
+    const app = await findOrCreatePlatformApp(deps.coolify, target.names.mailApp, environment, async () => {
         return deps.coolify.createDockerImageApplication({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
@@ -2240,9 +2395,11 @@ async function provisionPlatformMail(context, deps) {
             docker_registry_image_name: STALWART_IMAGE,
             docker_registry_image_tag: imageTag,
             ports_exposes: STALWART_PORTS_EXPOSES,
-            ports_mappings: STALWART_PORTS_MAPPINGS,
-            name: PLATFORM_MAIL_APP_NAME,
-            description: `Stalwart for the platform's own mail (#169, ${STALWART_IMAGE}:${imageTag})`,
+            ...(hostPorts ? { ports_mappings: hostPorts } : {}),
+            name: target.names.mailApp,
+            description: target.kind === 'org'
+                ? `Stalwart for ${target.id}'s own mail (${STALWART_IMAGE}:${imageTag})`
+                : `Stalwart for the platform's own mail (#169, ${STALWART_IMAGE}:${imageTag})`,
             instant_deploy: false,
         });
     });
@@ -2255,14 +2412,16 @@ async function provisionPlatformMail(context, deps) {
     // container before the new one can answer `waitForHealthyVersion`'s own
     // `'ready'` probe below. Stalwart's own readiness route and HTTP port.
     await deps.coolify.updateApplication(appId, {
-        custom_internal_name: PLATFORM_MAIL_INTERNAL_NAME,
+        custom_internal_name: target.internal.mail,
         docker_registry_image_tag: imageTag,
         ...healthCheckSettings(STALWART_READY_PATH, Number(STALWART_HTTP_PORT)),
+        // Only a platform that uses the shared relay, or one that did, changes a published port.
+        ...(portsChanged ? { ports_mappings: hostPorts } : {}),
     });
     // #177: org steps (an org's own `coolify:mail`/`coolify:agora`) read this
     // back instead of a literal, the same way files/ai's own internal
     // addresses are recorded.
-    await record(PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, `http://${PLATFORM_MAIL_INTERNAL_NAME}:${STALWART_HTTP_PORT}`);
+    await record(PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, `http://${target.internal.mail}:${STALWART_HTTP_PORT}`);
     // ---- storage ---------------------------------------------------------------
     const storages = await deps.coolify.listStorages(appId);
     // An app made before this release only has the old `/opt/stalwart` volume.
@@ -2274,7 +2433,7 @@ async function provisionPlatformMail(context, deps) {
             continue;
         }
         await deps.coolify.createPersistentStorage(appId, {
-            name: `${PLATFORM_MAIL_APP_NAME}-${wanted.suffix}`,
+            name: `${target.names.mailApp}-${wanted.suffix}`,
             mount_path: wanted.mount_path,
         });
         storagesAdded = true;
@@ -2295,7 +2454,12 @@ async function provisionPlatformMail(context, deps) {
     const declaredChanged = recorded[PLATFORM_MAIL_DEPLOYED_HOSTNAME_SCOPE_KEY] !== hostname ||
         recorded[PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY] !== imageTag;
     // A new storage binds into the container only at its next start.
-    const mailDeployedNow = app.justCreated || !app.running || envsChanged || declaredChanged || storagesAdded;
+    const mailDeployedNow = app.justCreated ||
+        !app.running ||
+        envsChanged ||
+        declaredChanged ||
+        storagesAdded ||
+        portsChanged;
     if (mailDeployedNow) {
         // A container still up from before would answer the readiness probe with
         // the old deployment's health. Stop it and see it stopped first, so the
@@ -2311,7 +2475,7 @@ async function provisionPlatformMail(context, deps) {
         // instead would just poll a hostname that cannot resolve yet on a first
         // apply. Either way it runs before any applied ref is recorded.
         // The old container was stopped above (or never ran), so nothing stays live.
-        await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:mail', app.justCreated || !app.running
+        await waitForDeploymentFinished(deps.coolify, appId, runtime, label, app.justCreated || !app.running
             ? `mail stays at ${recorded[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`
             : 'mail is stopped until the next apply');
         await record(PLATFORM_MAIL_DEPLOYED_SCOPE_KEY, appId);
@@ -2319,17 +2483,19 @@ async function provisionPlatformMail(context, deps) {
         // settings, mint) does not make the next run stop and redeploy the app.
         await record(PLATFORM_MAIL_DEPLOYED_HOSTNAME_SCOPE_KEY, hostname);
         await record(PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY, imageTag);
+        if (hostPorts)
+            await record(PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, hostPorts);
     }
     // ---- tunnel and DNS: web/JMAP/management ------------------------------------
-    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:mail');
-    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_MAIL_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_MAIL_TUNNEL_NAME));
+    const tunnels = await network.tunnels();
+    const existingTunnel = await tunnels.findTunnelByName(target.names.mailTunnel);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(target.names.mailTunnel));
     await record(PLATFORM_MAIL_TUNNEL_SCOPE_KEY, tunnel.id);
     await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
-                service: `http://${PLATFORM_MAIL_INTERNAL_NAME}:${STALWART_HTTP_PORT}`,
+                service: `http://${target.internal.mail}:${STALWART_HTTP_PORT}`,
             },
             { service: 'http_status:404' },
         ],
@@ -2339,7 +2505,7 @@ async function provisionPlatformMail(context, deps) {
         coolify: deps.coolify,
         tunnels,
         tunnelId: tunnel.id,
-        appName: PLATFORM_MAIL_CLOUDFLARED_APP_NAME,
+        appName: target.names.mailCloudflared,
         projectUuid,
         environment,
         // The Stalwart app's own server, so the connector shares its Docker network.
@@ -2347,15 +2513,15 @@ async function provisionPlatformMail(context, deps) {
         recordedConnectorAppId: recorded[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] ?? null,
         recordAppId: (appId) => record(PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, appId),
     });
-    const zoneId = recorded[apexZoneKey(platform.apex)] ?? (await exactZone(deps.cloudflare, platform.apex))?.id;
+    const zoneId = await network.zoneId(apex);
     if (!zoneId) {
-        throw new Error(`platform:mail: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
+        throw new Error(`${label}: no Cloudflare zone for ${apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const dns = await platformDns(deps, context.recordedIds(), 'platform:mail');
-    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
+    const dns = await network.dns();
+    const [dnsRecord] = await dns.findDnsRecord(apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await dns.createDnsRecord(platform.apex, {
+        await dns.createDnsRecord(apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -2363,31 +2529,35 @@ async function provisionPlatformMail(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
+        await dns.updateDnsRecord(apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
             proxied: true,
         });
     }
+    if (target.kind === 'org')
+        await recordOwnDnsHostname(scope, hostname);
     // ---- the MX hostname: a direct, unproxied A record --------------------------
-    const serverIp = (platform.serverIpv4 ?? server.ip); // checked by mailServerIpBlocked above
-    const [mxRecord] = await dns.findDnsRecord(platform.apex, mailHost, 'A');
-    if (!mxRecord) {
-        await dns.createDnsRecord(platform.apex, {
-            type: 'A',
-            name: mailHost,
-            content: serverIp,
-            proxied: false,
-        });
-    }
-    else if (mxRecord.content !== serverIp) {
-        await dns.updateDnsRecord(platform.apex, mxRecord.id, {
-            type: 'A',
-            name: mailHost,
-            content: serverIp,
-            proxied: false,
-        });
+    if (mxRecord) {
+        const serverIp = (mxRecord.serverIpv4 ?? server.ip); // checked by mailServerIpBlocked above
+        const [existingMx] = await dns.findDnsRecord(apex, mailHost, 'A');
+        if (!existingMx) {
+            await dns.createDnsRecord(apex, {
+                type: 'A',
+                name: mailHost,
+                content: serverIp,
+                proxied: false,
+            });
+        }
+        else if (existingMx.content !== serverIp) {
+            await dns.updateDnsRecord(apex, existingMx.id, {
+                type: 'A',
+                name: mailHost,
+                content: serverIp,
+                proxied: false,
+            });
+        }
     }
     // #252: phase 2, now that the tunnel and DNS above actually route
     // `hostname`. `'ready'`, not `'version'`: Stalwart's `/healthz/ready`
@@ -2404,7 +2574,7 @@ async function provisionPlatformMail(context, deps) {
     const ensureMailReady = async () => {
         if (mailReadyConfirmed)
             return;
-        await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}${STALWART_READY_PATH}` }, runtime, sleep, 'platform:mail', `mail stays at ${recorded[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}${STALWART_READY_PATH}` }, runtime, sleep, label, `mail stays at ${recorded[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
         mailReadyConfirmed = true;
     };
     // Also probe when the applied ref lags the target: the deployed refs are
@@ -2419,7 +2589,7 @@ async function provisionPlatformMail(context, deps) {
     // projects -- its id is the OIDC audience Stalwart's directory checks an
     // access token's `aud` claim against, so no host has to register a
     // resource API for this by hand.
-    const issuer = `https://${platform.auth.hostname}`;
+    const issuer = issuerUrl;
     const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
     const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
     const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_MAIL_ZITADEL_PROJECT_NAME);
@@ -2445,7 +2615,7 @@ async function provisionPlatformMail(context, deps) {
         await ensureMailReady();
         const recoveryEnv = (await deps.coolify.listEnvs(appId)).find((e) => e.key === 'STALWART_RECOVERY_ADMIN' && !e.is_preview);
         if (!recoveryEnv) {
-            throw new Error('platform:mail: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to re-apply the OIDC audience');
+            throw new Error(`${label}: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to re-apply the OIDC audience`);
         }
         const password = recoveryEnv.value.slice(`${STALWART_RECOVERY_USER}:`.length);
         try {
@@ -2453,7 +2623,7 @@ async function provisionPlatformMail(context, deps) {
                 url: `https://${hostname}`,
                 user: STALWART_RECOVERY_USER,
                 password,
-                apex: platform.apex,
+                apex,
             });
             await applyMailSettings(admin, {
                 coolify: deps.coolify,
@@ -2462,8 +2632,8 @@ async function provisionPlatformMail(context, deps) {
                 sleep,
                 hostname,
                 settings: {
-                    mailHost,
-                    apex: platform.apex,
+                    mailHost: hostname,
+                    apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
                 },
             });
@@ -2481,12 +2651,12 @@ async function provisionPlatformMail(context, deps) {
     if (!recorded[PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY]) {
         const lost = recorded[PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY];
         if (lost) {
-            throw new Error(`platform:mail: an admin API key ("${lost}") was minted but never delivered; revoke it in Stalwart and remove the recorded key ${PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+            throw new Error(`${label}: an admin API key ("${lost}") was minted but never delivered; revoke it in Stalwart and remove the recorded key ${PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
         await ensureMailReady();
         const recoveryEnv = (await deps.coolify.listEnvs(appId)).find((e) => e.key === 'STALWART_RECOVERY_ADMIN' && !e.is_preview);
         if (!recoveryEnv) {
-            throw new Error('platform:mail: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to mint the admin key');
+            throw new Error(`${label}: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to mint the admin key`);
         }
         const password = recoveryEnv.value.slice(`${STALWART_RECOVERY_USER}:`.length);
         try {
@@ -2494,7 +2664,7 @@ async function provisionPlatformMail(context, deps) {
                 url: `https://${hostname}`,
                 user: STALWART_RECOVERY_USER,
                 password,
-                apex: platform.apex,
+                apex,
             });
             await applyMailSettings(admin, {
                 coolify: deps.coolify,
@@ -2503,8 +2673,8 @@ async function provisionPlatformMail(context, deps) {
                 sleep,
                 hostname,
                 settings: {
-                    mailHost,
-                    apex: platform.apex,
+                    mailHost: hostname,
+                    apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
                 },
             });
@@ -2512,17 +2682,17 @@ async function provisionPlatformMail(context, deps) {
             // Recorded and persisted before the secret leaves this function: if
             // delivery fails for good, the next plan reports the lost key rather
             // than skipping or minting again.
-            await record(PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION);
-            const secret = await admin.createApiKey(PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, 'inherit');
+            await record(PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, keyDescription);
+            const secret = await admin.createApiKey(keyDescription, 'inherit');
             const attempts = runtime.deliverAttempts ?? 3;
             for (let attempt = 1;; attempt += 1) {
                 try {
-                    await deps.deliverSecret('stalwart:platform:admin', secret);
+                    await deps.deliverSecret(target.refs.mailAdminKey, secret);
                     break;
                 }
                 catch {
                     if (attempt >= attempts) {
-                        throw new Error(`platform:mail: the admin API key ("${PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION}") was minted but could not be delivered after ${attempts} tries`);
+                        throw new Error(`${label}: the admin API key ("${keyDescription}") was minted but could not be delivered after ${attempts} tries`);
                     }
                     await sleep(1000 * attempt);
                 }
@@ -2539,6 +2709,29 @@ async function provisionPlatformMail(context, deps) {
     await record(PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, imageTag);
     return { resourceId: appId };
 }
+/** The platform's mail project: the shared `platform` project, its id recorded by the mail step under its own key. */
+const platformMailProject = {
+    async ensure(coolify) {
+        const found = await coolify.findProjectByName(PLATFORM_MAIL_PROJECT);
+        return found ? found.uuid : (await coolify.createProject(PLATFORM_MAIL_PROJECT)).uuid;
+    },
+};
+/** The platform's mail server: {@link provisionMailServer} with {@link platformTarget} and the platform's own inputs. */
+async function provisionPlatformMail(context, deps) {
+    const { platform } = context;
+    const scope = scopeFromPlatform(context);
+    return provisionMailServer(scope, deps, platformTarget(), {
+        hostname: platform.mail.hostname,
+        apex: platform.apex,
+        mailHost: platformMailMxHost(platform.apex),
+        imageTag: platform.mail.gitRef,
+        hostPorts: platformMailHostPorts(platform),
+        issuerUrl: `https://${platform.auth.hostname}`,
+        mxRecord: { serverIpv4: platform.serverIpv4 },
+        project: platformMailProject,
+        network: platformNetwork(deps, scope, 'platform:mail'),
+    });
+}
 /**
  * Why the Stalwart image tag cannot be used, or `null`. #248: a thin wrapper
  * over the estate-wide {@link floatingTagBlocked} -- the mail step's own
@@ -2604,6 +2797,31 @@ async function mailBlockedReason(platform, mail, recordedIds) {
         return "the platform's mail server is blocked, not planned: no usable Coolify server could be resolved for it";
     }
 }
+/** Why the shared mail relay cannot be built from its pinned base image, or `null`. */
+function mailRelayBlockedReason() {
+    const tagBlocked = floatingTagBlocked('mail relay base', VERSIONS.alpine, '3.22.1');
+    return tagBlocked ? `the platform's mail relay is blocked, not planned: ${tagBlocked}` : null;
+}
+/**
+ * Runs the shared mail relay step against the project and server the platform
+ * mail step recorded, so the relay sits on the Docker network and the server
+ * address of the Stalwart it forwards to.
+ */
+async function provisionPlatformMailRelay(action, context, deps) {
+    const recorded = context.recordedIds();
+    const projectUuid = recorded[PLATFORM_MAIL_PROJECT_SCOPE_KEY];
+    const serverUuid = recorded[PLATFORM_MAIL_SERVER_SCOPE_KEY];
+    if (!projectUuid || !serverUuid) {
+        throw new Error('platform:mail-relay: the platform mail server has not recorded its project and server yet; apply the mail server first');
+    }
+    return provisionMailRelay(action, context, deps, {
+        projectUuid,
+        serverUuid,
+        hostname: platformMailMxHost(context.platform.apex),
+        defaultTarget: `${PLATFORM_MAIL_INTERNAL_NAME}:25`,
+        appScopeKey: PLATFORM_MAIL_RELAY_APP_SCOPE_KEY,
+    });
+}
 /**
  * #211: the broker cannot start without `ZITADEL_SERVICE_USER_TOKEN`/`_FILE`,
  * `LETTERMINT_API_TOKEN` and `AUTH_APPS`. `provisionPlatformAuth` already
@@ -4534,8 +4752,6 @@ function parseAiKeyMintedBody(body) {
         secret: record.secret,
     };
 }
-/** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
-export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
 /**
  * What Archon's management key may do in ai: exactly `ai`'s own
  * `ARCHON_AI_PERMISSIONS` (`apps/host/scripts/authz/bootstrap-archon.ts`) --
@@ -4884,13 +5100,15 @@ async function provisionPlatformAi(context, deps) {
             // Every run, so a changed gitRef reaches an app that already exists.
             git_branch: gitRef,
         };
-        // #543: the health-check quartet too, runner only -- the worker exposes
-        // no port at all (`ports_exposes` is never set on it, just below), so
-        // there is nothing for Coolify's own container probe to reach.
+        // #543: the health-check quartet too, on the runner. The worker exposes no
+        // port (`ports_exposes` is never set on it, just below); its Dockerfile's
+        // HEALTHCHECK checks the age of the heartbeat file it writes, and that is the live one.
         if (spec === PLATFORM_AI_RUNNER) {
             patch.ports_exposes = PLATFORM_AI_PORT;
             Object.assign(patch, healthCheckSettings('/api/health', Number(PLATFORM_AI_PORT)));
         }
+        if (spec === PLATFORM_AI_WORKER)
+            Object.assign(patch, IMAGE_HEALTHCHECK_SETTINGS);
         await coolify.updateApplication(app.appId, patch);
         return app;
     };
@@ -5305,7 +5523,7 @@ async function missingEnvs(coolify, appId, defaults) {
 }
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** Polls `url` until it answers 2xx, or throws once `readyTimeoutMs` has passed. */
-async function waitForInstance(url, runtime, sleep) {
+async function waitForInstance(url, runtime, sleep, label = 'platform:auth') {
     const fetchImpl = runtime.fetch ?? globalThis.fetch;
     const now = runtime.now ?? Date.now;
     const timeout = runtime.readyTimeoutMs ?? 300_000;
@@ -5313,7 +5531,9 @@ async function waitForInstance(url, runtime, sleep) {
     const deadline = now() + timeout;
     for (;;) {
         try {
-            const response = await fetchImpl(url);
+            const response = await fetchImpl(url, {
+                signal: AbortSignal.timeout(runtime.readyRequestTimeoutMs ?? 10_000),
+            });
             if (response.ok)
                 return;
         }
@@ -5321,7 +5541,7 @@ async function waitForInstance(url, runtime, sleep) {
             // Not up yet: DNS, the tunnel or the container.
         }
         if (now() >= deadline) {
-            throw new Error(`platform:auth: the new ZITADEL instance did not answer at ${url} within ${Math.round(timeout / 1000)}s; retry this apply`);
+            throw new Error(`${label}: the new ZITADEL instance did not answer at ${url} within ${Math.round(timeout / 1000)}s; retry this apply`);
         }
         await sleep(interval);
     }
@@ -5547,12 +5767,12 @@ async function currentEnvValue(coolify, appId, key) {
  * deployed app means someone removed it. This throws, and a person sets the key that database was
  * initialised with (or deletes an unused database) and applies again.
  */
-async function ensureMasterkey(coolify, appId, databaseInUse) {
+async function ensureMasterkey(coolify, appId, databaseInUse, label = 'platform:auth') {
     const envs = await coolify.listEnvs(appId);
     if (envs.some((e) => e.key === 'ZITADEL_MASTERKEY' && !e.is_preview))
         return null;
     if (databaseInUse) {
-        throw new Error(`platform:auth: app ${appId} has no ZITADEL_MASTERKEY but its database is already in use; not generating a new one. Set ZITADEL_MASTERKEY on that app to the key the database was initialised with, or delete the database if ZITADEL never ran on it, then apply again`);
+        throw new Error(`${label}: app ${appId} has no ZITADEL_MASTERKEY but its database is already in use; not generating a new one. Set ZITADEL_MASTERKEY on that app to the key the database was initialised with, or delete the database if ZITADEL never ran on it, then apply again`);
     }
     return randomBytes(24).toString('base64');
 }
@@ -5568,23 +5788,21 @@ async function ensureMasterkey(coolify, appId, databaseInUse) {
  */
 export const FILES_MANAGEMENT_ISSUER = 'foundry';
 export const FILES_MANAGEMENT_KEY_ID = 'foundry-1';
-/** The ref the management private key (PKCS#8 PEM) is delivered under. */
-export const FILES_MANAGEMENT_KEY_REF = 'files:platform:managementKey';
 /** The ref the files host's introspection client secret is delivered under. */
 export const FILES_INTROSPECTION_SECRET_REF = 'zitadel:platform:files:introspection';
 /** https://github.com/wtfalch/files -- root Dockerfile with `migration` and `runner` targets. */
 const FILES_REPO = 'wtfalch/files';
 const PLATFORM_FILES_PROJECT = 'platform';
-const PLATFORM_FILES_DB_NAME = 'platform-files-db';
+export const PLATFORM_FILES_DB_NAME = 'platform-files-db';
 /** The two Coolify apps files' `apps/host/README.md` ("Deploying on Coolify") names. */
-const FILES_MIGRATE_APP_NAME = 'files-migrate';
-const FILES_RUNNER_APP_NAME = 'files';
+export const FILES_MIGRATE_APP_NAME = 'files-migrate';
+export const FILES_RUNNER_APP_NAME = 'files';
 /**
  * The runner's fixed `custom_internal_name`: the name another container on
  * the Coolify network reaches it by, and so the host part of
  * {@link PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY}'s recorded address.
  */
-const FILES_RUNNER_INTERNAL_NAME = 'platform-files';
+export const FILES_RUNNER_INTERNAL_NAME = 'platform-files';
 /** The runner's port (`Dockerfile`'s `runner` stage: `PORT=3000`, `EXPOSE 3000`). */
 const FILES_PORT = '3000';
 /** files' own health route, the same one `healthUrls` (`executor.ts`) assumes every hosted app serves. */
@@ -5681,22 +5899,106 @@ async function provisionPlatformFiles(context, deps,
 /** {@link filesShareDomains} of every declared org: each is a runner domain and a public host. */
 shareDomains) {
     const { platform } = context;
-    const gitRef = platform.files.gitRef;
-    const recorded = context.recordedIds();
+    return provisionFilesHost(scopeFromPlatform(context), deps, platformTarget(), {
+        hostname: platform.files.hostname,
+        gitRef: platform.files.gitRef,
+        project: platformFilesProject,
+        issuer: `https://${platform.auth.hostname}`,
+        zitadelOrg: { name: PLATFORM_AUTH_ORG_NAME },
+        zitadelProject: {
+            name: FILES_ZITADEL_PROJECT_NAME,
+            scopeKey: PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY,
+        },
+        shareDomains,
+    });
+}
+/** The platform's files host lives in the shared `platform` project. */
+const platformFilesProject = {
+    async ensure(coolify, scope) {
+        const recorded = scope.recordedIds()[PLATFORM_FILES_PROJECT_SCOPE_KEY];
+        if (recorded)
+            return recorded;
+        const found = await coolify.findProjectByName(PLATFORM_FILES_PROJECT);
+        const projectUuid = found
+            ? found.uuid
+            : (await coolify.createProject(PLATFORM_FILES_PROJECT)).uuid;
+        scope.recordScopeId(PLATFORM_FILES_PROJECT_SCOPE_KEY, projectUuid);
+        await scope.persist();
+        return projectUuid;
+    },
+};
+/** The credential id of the keyring an own files host runs on; recorded once both apps carry it. */
+export const OWN_FILES_KEYS_SCOPE_KEY = 'files_keys_id';
+/** The credential id minted and not yet confirmed delivered. */
+export const OWN_FILES_KEYS_UNDELIVERED_SCOPE_KEY = 'files_keys_undelivered';
+/**
+ * An own files host's keyring, before its env writes. Both refs held: those values, no mint (a rerun
+ * after a failed run resumes here). Nothing held: one mint, which is checked, registered as a
+ * secret, recorded by id as undelivered, then delivered to both refs. A re-mint is harmless: it
+ * yields an equivalent credential. Returns the guard id for {@link FilesHostInput.keysGuardId}.
+ */
+export async function resolveOwnFilesKeys(scope, deps, target, mint, workerUrl, label) {
+    const runtime = deps.runtime ?? {};
+    const recorded = scope.recordedIds();
+    const credential = await deps.readSecret?.(target.refs.keysCredential);
+    const verifyKeys = await deps.readSecret?.(target.refs.keysVerifyKeys);
+    if (credential && verifyKeys) {
+        runtime.onSecret?.(credential);
+        return {
+            keys: { workerUrl, credential, verifyKeys },
+            guardId: recorded[OWN_FILES_KEYS_SCOPE_KEY] ||
+                recorded[OWN_FILES_KEYS_UNDELIVERED_SCOPE_KEY] ||
+                'held',
+        };
+    }
+    const answer = await mint();
+    runtime.onSecret?.(answer.credential);
+    const keys = { workerUrl, credential: answer.credential, verifyKeys: answer.verifyKeys };
+    const invalid = answer.credential
+        ? filesDepsInvalid({ keys })
+        : 'credential';
+    if (invalid)
+        throw new Error(`${label}: the keys worker's answer is not usable (${invalid})`);
+    // Recorded and persisted before the credential leaves this function.
+    scope.recordScopeId(OWN_FILES_KEYS_UNDELIVERED_SCOPE_KEY, answer.credentialId);
+    await scope.persist();
+    const attempts = runtime.deliverAttempts ?? 3;
+    const sleep = runtime.sleep ?? defaultSleep;
+    await deliverWithRetry(deps.deliverSecret, target.refs.keysCredential, answer.credential, attempts, sleep, `the keys credential (${answer.credentialId})`, label);
+    await deliverWithRetry(deps.deliverSecret, target.refs.keysVerifyKeys, answer.verifyKeys, attempts, sleep, `the verify keys of credential ${answer.credentialId}`, label);
+    return { keys, guardId: answer.credentialId };
+}
+/**
+ * The body of {@link provisionPlatformFiles} for any files host: the
+ * platform's, or an own org's. Every name, the internal name and the two
+ * held-key refs come from `target`; the project, sign-in and ZITADEL home
+ * come from `input`. See {@link provisionPlatformFiles} for what the step does.
+ */
+export async function provisionFilesHost(scope, deps, target, input) {
+    const { gitRef, shareDomains } = input;
+    const own = target.kind === 'org';
+    const label = own ? `own step coolify:own-files for ${target.id}` : 'platform:files';
+    const recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const attempts = runtime.deliverAttempts ?? 3;
     const keys = filesKeys(deps);
     if (!keys) {
-        throw new Error('platform:files needs the keys worker URL, credential and verify keys in its files dependencies (KEYS_WORKER_URL, KEYS_CREDENTIAL, KEYS_VERIFY_KEYS); files never becomes healthy without them');
-    }
+        throw new Error(`${label} needs the keys worker URL, credential and verify keys in its files dependencies (KEYS_WORKER_URL, KEYS_CREDENTIAL, KEYS_VERIFY_KEYS); files never becomes healthy without them`);
+    }
+    runtime.onSecret?.(keys.credential);
+    // The platform's audit token and jobs secrets never go to a company's host (SC4).
+    const auditToken = own ? undefined : deps.keys?.auditToken;
+    const jobsSigningSecrets = own ? undefined : deps.jobsSigningSecrets;
+    if (auditToken)
+        runtime.onSecret?.(auditToken);
     // #380: R2_BUCKET/R2_ENDPOINT, the same "block the whole step" treatment
     // as a missing `keys` above -- the runner's `ensureStarted()` requires
     // both, and only this function's caller (`blockedSteps`, `planFiles`) ever
     // has anything useful to report while they are unset.
     const r2 = filesR2(deps);
     if (!r2) {
-        throw new Error('platform:files needs the R2 bucket and endpoint in its files dependencies (R2_BUCKET, R2_ENDPOINT); files never becomes healthy without them');
+        throw new Error(`${label} needs the R2 bucket and endpoint in its files dependencies (R2_BUCKET, R2_ENDPOINT); files never becomes healthy without them`);
     }
     // Never plan-and-throw: the planner reports a lost secret and plans
     // nothing; this is the same rule for a caller that reaches the step anyway.
@@ -5706,28 +6008,21 @@ shareDomains) {
     ]) {
         const lost = recorded[undeliveredKey];
         if (lost && !recorded[guardKey]) {
-            throw new Error(`platform:files: a secret (${lost}) was minted but never delivered; remove the recorded key ${undeliveredKey} to mint a new one`);
+            throw new Error(`${label}: a secret (${lost}) was minted but never delivered; remove the recorded key ${undeliveredKey} to mint a new one`);
         }
     }
     const record = async (key, id) => {
-        context.recordScopeId(key, id);
-        await context.persist?.();
+        scope.recordScopeId(key, id);
+        await scope.persist();
     };
-    let projectUuid = recorded[PLATFORM_FILES_PROJECT_SCOPE_KEY];
-    if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_FILES_PROJECT);
-        projectUuid = found
-            ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_FILES_PROJECT)).uuid;
-        await record(PLATFORM_FILES_PROJECT_SCOPE_KEY, projectUuid);
-    }
+    const projectUuid = await input.project.ensure(deps.coolify, scope);
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     // ---- database ----------------------------------------------------------
     let dbId = recorded[PLATFORM_FILES_DB_SCOPE_KEY];
     if (!dbId) {
         // Found by name first, so a crash between create and record never makes
         // a second one (`coolifyJobs` does the same).
-        const found = (await deps.coolify.listDatabases()).find((db) => db.name === PLATFORM_FILES_DB_NAME && db.environment_id === environment.id);
+        const found = (await deps.coolify.listDatabases()).find((db) => db.name === target.names.filesDb && db.environment_id === environment.id);
         if (found) {
             dbId = found.uuid;
         }
@@ -5738,7 +6033,7 @@ shareDomains) {
                 server_uuid: server.uuid,
                 environment_name: environment.name,
                 environment_uuid: environment.uuid,
-                name: PLATFORM_FILES_DB_NAME,
+                name: target.names.filesDb,
                 postgres_db: FILES_DB,
                 postgres_user: FILES_DB,
             });
@@ -5748,7 +6043,7 @@ shareDomains) {
     }
     const db = await getDatabaseStarted(deps.coolify, dbId);
     if (!db.internal_db_url) {
-        throw new Error('coolify:app for the platform (files): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
+        throw new Error(`${own ? label : 'coolify:app for the platform (files)'}: the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
     }
     // ---- the two apps --------------------------------------------------------
     const createFilesApp = (name) => async () => {
@@ -5766,7 +6061,7 @@ shareDomains) {
             name,
         });
     };
-    const migrateApp = await findOrCreatePlatformApp(deps.coolify, FILES_MIGRATE_APP_NAME, environment, createFilesApp(FILES_MIGRATE_APP_NAME));
+    const migrateApp = await findOrCreatePlatformApp(deps.coolify, target.names.filesMigrate, environment, createFilesApp(target.names.filesMigrate));
     await record(PLATFORM_FILES_MIGRATE_SCOPE_KEY, migrateApp.appId);
     // Set on every run, like `platform:auth`'s `custom_internal_name`: a throw
     // right after a create must not leave the app on the wrong target.
@@ -5775,11 +6070,11 @@ shareDomains) {
         dockerfile_target_build: 'migration',
         git_branch: gitRef,
     });
-    const runnerApp = await findOrCreatePlatformApp(deps.coolify, FILES_RUNNER_APP_NAME, environment, createFilesApp(FILES_RUNNER_APP_NAME));
+    const runnerApp = await findOrCreatePlatformApp(deps.coolify, target.names.filesRunner, environment, createFilesApp(target.names.filesRunner));
     await record(PLATFORM_FILES_RUNNER_SCOPE_KEY, runnerApp.appId);
     await deps.coolify.updateApplication(runnerApp.appId, {
         dockerfile_target_build: 'runner',
-        custom_internal_name: FILES_RUNNER_INTERNAL_NAME,
+        custom_internal_name: target.internal.files,
         git_branch: gitRef,
         // #543: the health-check quartet, same reason Archon's doc comment
         // gives. The migrate app gets none -- it idles rather than serves
@@ -5791,13 +6086,14 @@ shareDomains) {
         // nobody gave a share host keeps no `domains`.
         ...filesShareDomainsPatch(recorded, shareDomains),
     });
-    context.recordScopeId(PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, normalHosts(shareDomains).join(','));
+    scope.recordScopeId(PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, normalHosts(shareDomains).join(','));
     // ---- database env ----------------------------------------------------------
     // The migrate app sets `files_rt`'s password from DATABASE_URL on every
     // boot (files' `scripts/db-runtime-role.sh`), and the runner connects with
     // the same URL, so both apps carry one value, minted once and never
     // rotated: an existing value on either app is reused.
     const runtimeUrl = await ensureFilesRuntimeUrl(deps.coolify, [migrateApp.appId, runnerApp.appId], db.internal_db_url);
+    runtime.onSecret?.(runtimeUrl);
     // The keys worker the migrate app needs to become healthy (files' README:
     // `DATABASE_URL_OWNER`, `DATABASE_URL`, `KEYS_WORKER_URL`, `KEYS_CREDENTIAL`).
     // `files-migrate` never runs `ensureStarted()`, so it needs neither
@@ -5812,11 +6108,13 @@ shareDomains) {
         ...migrateKeysEnvs,
     ]);
     // ---- the files ZITADEL project, in the platform's sign-in ----------------
-    const issuer = `https://${platform.auth.hostname}`;
+    const { issuer } = input;
     const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
-    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
-    const { project } = await zitadel.findOrCreateProject(org.id, FILES_ZITADEL_PROJECT_NAME);
-    await record(PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, project.id);
+    const zitadelOrgId = 'id' in input.zitadelOrg
+        ? input.zitadelOrg.id
+        : (await zitadel.findOrCreateOrg(input.zitadelOrg.name)).org.id;
+    const { project } = await zitadel.findOrCreateProject(zitadelOrgId, input.zitadelProject.name);
+    await record(input.zitadelProject.scopeKey, project.id);
     // #380: the runner's own required settings -- `KEYS_VERIFY_KEYS` and
     // `R2_BUCKET`/`R2_ENDPOINT` -- plus whatever optional ones the host
     // supplies. `files-migrate` needs none of these (see `migrateKeysEnvs`
@@ -5825,10 +6123,10 @@ shareDomains) {
         ...migrateKeysEnvs,
         { key: 'KEYS_VERIFY_KEYS', value: keys.verifyKeys },
     ];
-    if (deps.keys?.auditToken)
+    if (auditToken)
         runnerKeysEnvs.push({
             key: 'KEYS_AUDIT_TOKEN',
-            value: deps.keys.auditToken,
+            value: auditToken,
         });
     const runnerOptionalEnvs = [];
     if (deps.clamd?.host) {
@@ -5843,13 +6141,16 @@ shareDomains) {
             });
     }
     runnerOptionalEnvs.push(...filesPublicHostsEnvs(recorded, deps.publicHosts, shareDomains));
-    if (deps.jobsSigningSecrets)
+    if (jobsSigningSecrets)
         runnerOptionalEnvs.push({
             key: 'JOBS_SIGNING_SECRETS',
-            value: deps.jobsSigningSecrets,
+            value: jobsSigningSecrets,
         });
     // #501: the same person platform:archon names; Files has no sign-in page.
-    const ownerInviteUserId = recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    // An own org's files host gets the platform's owner too, carried in by the planner: its own scope holds none.
+    const ownerInviteUserId = own
+        ? input.bootstrapOperator
+        : recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
     if (ownerInviteUserId && ownerInviteUserId !== 'none') {
         runnerOptionalEnvs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: ownerInviteUserId });
     }
@@ -5857,7 +6158,7 @@ shareDomains) {
         { key: 'DATABASE_URL', value: runtimeUrl },
         // The management verifier's audience, which must be an HTTPS origin. The
         // host has no public address, so this is a name, not a route.
-        { key: 'APP_URL', value: `https://${platform.files.hostname}` },
+        { key: 'APP_URL', value: `https://${input.hostname}` },
         { key: 'AUTH_ISSUER', value: issuer },
         { key: 'AUTH_PERSON_TOKEN_AUDIENCE', value: project.id },
         ...runnerKeysEnvs,
@@ -5872,28 +6173,32 @@ shareDomains) {
     // Base env first, so a secret's own write below cannot be the only one
     // that lands, and a re-run with a changed hostname updates `APP_URL`.
     await deps.coolify.bulkUpsertEnvs(runnerApp.appId, runnerEnvs);
+    // Both apps now carry the company's own keyring: the delivery is confirmed.
+    if (own && input.keysGuardId)
+        await record(OWN_FILES_KEYS_SCOPE_KEY, input.keysGuardId);
     // ---- the introspection client, once --------------------------------------
     if (!recorded[PLATFORM_FILES_INTROSPECTION_SCOPE_KEY]) {
         // An app by this name here has no recorded secret (no undelivered id, or
         // the throw above would have fired): a crash between the create and the
         // record. Nothing was delivered, so it is deleted and made again.
-        const stale = (await zitadel.listApps(org.id, project.id)).apps.filter((app) => app.name === FILES_INTROSPECTION_APP_NAME && app.state !== 'APP_STATE_REMOVED');
+        const stale = (await zitadel.listApps(zitadelOrgId, project.id)).apps.filter((app) => app.name === FILES_INTROSPECTION_APP_NAME && app.state !== 'APP_STATE_REMOVED');
         for (const app of stale) {
             try {
-                await zitadel.deleteApp(org.id, project.id, app.id);
+                await zitadel.deleteApp(zitadelOrgId, project.id, app.id);
             }
             catch (error) {
                 if (!isNotFoundError(error))
                     throw error;
             }
         }
-        const client = await zitadel.createApiApp(org.id, project.id, {
+        const client = await zitadel.createApiApp(zitadelOrgId, project.id, {
             name: FILES_INTROSPECTION_APP_NAME,
         });
+        runtime.onSecret?.(client.clientSecret);
         // Recorded and persisted before the secret leaves this function: a failed
         // delivery or env write is then reported by the planner, not remade.
         await record(PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, client.appId);
-        await deliverWithRetry(deps.deliverSecret, FILES_INTROSPECTION_SECRET_REF, client.clientSecret, attempts, sleep, `the introspection client secret (ZITADEL app ${client.appId})`);
+        await deliverWithRetry(deps.deliverSecret, target.refs.filesIntrospection, client.clientSecret, attempts, sleep, `the introspection client secret (ZITADEL app ${client.appId})`, label);
         await deps.coolify.bulkUpsertEnvs(runnerApp.appId, [
             {
                 key: 'AUTH_PERSON_TOKEN_INTROSPECTION_CLIENT_ID',
@@ -5912,8 +6217,9 @@ shareDomains) {
             publicKeyEncoding: { type: 'spki', format: 'pem' },
             privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
         });
+        runtime.onSecret?.(privateKey);
         await record(PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, FILES_MANAGEMENT_KEY_ID);
-        await deliverWithRetry(deps.deliverSecret, FILES_MANAGEMENT_KEY_REF, privateKey, attempts, sleep, 'the files management key');
+        await deliverWithRetry(deps.deliverSecret, target.refs.filesManagement, privateKey, attempts, sleep, 'the files management key', label);
         await deps.coolify.bulkUpsertEnvs(runnerApp.appId, [
             { key: 'MANAGEMENT_ISSUER', value: FILES_MANAGEMENT_ISSUER },
             {
@@ -5929,12 +6235,12 @@ shareDomains) {
     // container before the new migration has run.
     await stopIfRunning(deps.coolify, migrateApp.appId);
     const migrateDeployed = await deps.coolify.deploy(migrateApp.appId);
-    await waitForMigration(deps.coolify, migrateApp.appId, runtime, sleep);
+    await waitForMigration(deps.coolify, migrateApp.appId, runtime, sleep, label, target.names.filesMigrate);
     // #399: files-migrate idles rather than exits once it has migrated, so it
     // reads healthy well before Coolify's own deployment does; stopping it on
     // that signal alone can find the container already gone and make Coolify
     // mark a deployment that actually migrated as `failed`.
-    await waitForMigrateDeployment(deps.coolify, migrateApp.appId, queuedDeploymentUuid(migrateDeployed) ?? 'untracked', 'platform:files', 'files-migrate', runtime.now ?? Date.now, runtime.migrateTimeoutMs ?? 900_000, runtime.migrateIntervalMs ?? 10_000, sleep);
+    await waitForMigrateDeployment(deps.coolify, migrateApp.appId, queuedDeploymentUuid(migrateDeployed) ?? 'untracked', label, target.names.filesMigrate, runtime.now ?? Date.now, runtime.migrateTimeoutMs ?? 900_000, runtime.migrateIntervalMs ?? 10_000, sleep);
     await deps.coolify.raw('POST', `/applications/${migrateApp.appId}/stop`);
     // #252/#543: no public `domains`, tunnel or DNS record is wired to the
     // runner (its own doc comment: "Nothing public is wired"), but it does
@@ -5945,11 +6251,11 @@ shareDomains) {
     // container); `coolify.deployAndWait` reaching Coolify's own deployment
     // record first is still what rules out the old container staying healthy
     // through a failed deploy.
-    const internalUrl = `http://${FILES_RUNNER_INTERNAL_NAME}:${FILES_PORT}`;
-    await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'ready', url: `${internalUrl}${FILES_HEALTH_CHECK_PATH}` }, runtime, sleep, 'platform:files', `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    const internalUrl = `http://${target.internal.files}:${FILES_PORT}`;
+    await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'ready', url: `${internalUrl}${FILES_HEALTH_CHECK_PATH}` }, runtime, sleep, label, `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
     await record(PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, internalUrl);
     // Last: a run that failed anywhere above is planned again.
-    context.recordScopeId(PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, platform.files.hostname);
+    scope.recordScopeId(PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, input.hostname);
     await record(PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: runnerApp.appId };
 }
@@ -6577,7 +6883,7 @@ function aiKeys(deps) {
     const keys = deps?.keys;
     return keys?.workerUrl && keys.credential && keys.verifyKeys ? keys : null;
 }
-function filesKeys(deps) {
+export function filesKeys(deps) {
     const keys = deps?.keys;
     return keys?.workerUrl && keys.credential && keys.verifyKeys
         ? {
@@ -6600,7 +6906,7 @@ function filesR2(deps) {
  * naming the field instead of deploying a host that never turns healthy.
  * Never echoes the value.
  */
-function filesDepsInvalid(deps) {
+export function filesDepsInvalid(deps) {
     const r2 = filesR2(deps);
     if (r2) {
         let ok = false;
@@ -6727,7 +7033,7 @@ async function ensureFilesRuntimeUrl(coolify, appIds, dbInternalUrl) {
  * stands in for the log line). Throws once `migrateTimeoutMs` has passed; the
  * runner is then never deployed against an unmigrated database.
  */
-async function waitForMigration(coolify, appId, runtime, sleep) {
+async function waitForMigration(coolify, appId, runtime, sleep, label = 'platform:files', appName = 'files-migrate') {
     const now = runtime.now ?? Date.now;
     const timeout = runtime.migrateTimeoutMs ?? 900_000;
     const interval = runtime.migrateIntervalMs ?? 10_000;
@@ -6740,7 +7046,7 @@ async function waitForMigration(coolify, appId, runtime, sleep) {
         if (status !== 'running:healthy')
             left = true;
         if (now() >= deadline) {
-            throw new Error(`platform:files: files-migrate (${appId}) did not report healthy within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'}); the files app was not deployed. Check its logs for "files-migrate: done" and retry this apply`);
+            throw new Error(`${label}: ${appName} (${appId}) did not report healthy within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'}); the files app was not deployed. Check its logs for "files-migrate: done" and retry this apply`);
         }
         await sleep(interval);
     }
@@ -6950,6 +7256,8 @@ async function provisionPlatformIntegrations(action, context, deps) {
     await coolify.updateApplication(runnerApp.appId, {
         dockerfile_target_build: INTEGRATIONS_RUNNER_APP.target,
         ports_exposes: INTEGRATIONS_RUNNER_PORT,
+        // The runner's Dockerfile HEALTHCHECK (curl on /api/health) is the live check.
+        ...IMAGE_HEALTHCHECK_SETTINGS,
         git_branch: gitRef,
         domains: coolifyDomains([hostname]),
     });
@@ -7964,7 +8272,7 @@ export class ProvidersPlatformCoolifyReader {
  * answers with the parent zone. The platform's zone is its apex exactly;
  * any other zone is never adopted or reported as the platform's.
  */
-async function exactZone(client, apex) {
+export async function exactZone(client, apex) {
     const zone = await client.findZoneByApex(apex);
     return zone && zone.name === apex ? zone : undefined;
 }