@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/executor.js

@@ -1,16 +1,22 @@
-import { randomBytes } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
+import { pinnedTagFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
+import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
+import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
-import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
+import { recordBuiltCommit } from './build-record.js';
+import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { BACKUP_SCOPE_PREFIX, backupScopeKey } from './company-backups.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
+import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
 import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
 import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
@@ -21,13 +27,22 @@ import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScope
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
-import { healthCheckSettings } from './health-check-settings.js';
-import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
+import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
+import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
+import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
+import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
+import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
+import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
+import { LIMITS, limited } from './own-limits.js';
+import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, scopeFromOrg, } from './own-services.js';
+import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
+import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
-import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
-import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -113,14 +128,13 @@ function normalizedLoginBaseUri(uri) {
  * `cms.<domain>` -- the cms studio's own hostname (`cmsSite` below), apart
  * from the public site itself at `org.domain` (used directly there). Called
  * from `cmsSite` and from `zitadelApp` for the fixed `cms` client (#139),
- * both of which only run once `org.site.enabled` is true, so `org.domain`
- * is non-null by the same `validateSite` guarantee
- * {@link tunnelIngressHostnames}'s own doc comment cites.
+ * both of which only run once `org.site.enabled` is true. A company without
+ * a domain has its studio at `<slug>-cms.oikos.host` (`cmsStudioHostnameFor`).
  */
 // #541: exported so `health-targets.ts` reuses this hostname rule rather
 // than restating it; nothing else about this function changes.
 export function cmsHostnameFor(org) {
-    return `cms.${org.domain}`;
+    return cmsStudioHostnameFor(org);
 }
 /**
  * #145's "Decided" (2026-09-27): the calls service's own public hostname.
@@ -158,8 +172,11 @@ export function healthUrls(org) {
             ];
         });
     }
-    if (org.site.enabled && org.domain) {
-        return [`https://${org.domain}/api/health`, `https://${cmsHostnameFor(org)}/api/health`];
+    if (org.site.enabled) {
+        return [
+            `https://${siteHostnameFor(org)}/api/health`,
+            `https://${cmsHostnameFor(org)}/api/health`,
+        ];
     }
     return [];
 }
@@ -186,7 +203,7 @@ function mailOrgFor(org, usesDomain, mode) {
  * https://github.com/wtfalch/foundry/issues/71) names this same constant and
  * value.
  */
-const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
+export const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
 /** The one Access policy foundry puts on a platform Access app (#84). */
 export const ACCESS_POLICY_NAME = 'foundry: allowed emails';
 /**
@@ -300,7 +317,13 @@ const BOULE_PORT = 3000;
  * it from this file, the same way `hostnameFor`'s hostname rule is
  * restated rather than shared across the two files.
  */
-const LOG_DIR = '/app/logs';
+/** Four dotted decimal numbers from 0 to 255, nothing else (the value goes into `ports_mappings`). */
+function isIpv4Address(value) {
+    const parts = value.split('.');
+    return (parts.length === 4 &&
+        parts.every((part) => /^(0|[1-9][0-9]{0,2})$/.test(part) && Number(part) <= 255));
+}
+export const LOG_DIR = '/app/logs';
 /**
  * `cmsSite` provisions two applications from one `cms:site` step, but
  * `execute`'s own return value auto-records only one `resourceId`, under
@@ -318,6 +341,8 @@ const CMS_APP_SCOPE_KEY = 'coolify_cms_app';
 const SITE_APP_SCOPE_KEY = 'coolify_site_app';
 /** #445: the one Coolify server every resource of this org lands on, chosen once and recorded. */
 const COOLIFY_SERVER_SCOPE_KEY = 'coolify_server';
+/** The company's Coolify destination (its Docker network `co-<slug>`), recorded when its first resource is created. */
+export const COOLIFY_DESTINATION_SCOPE_KEY = 'coolify_destination';
 /**
  * #117: the cms app's own Postgres database (`<org.slug>-cms-db`), found or
  * created inside `cmsSite` the same way `coolifyDatabase` does for the org's
@@ -600,8 +625,8 @@ const CHAT_SERVICE_DB_SCOPE_KEY = 'coolify_chat_service_database';
  */
 const CHAT_REKEY_SYNAPSE_SCOPE_KEY = 'coolify_chat_rekey_synapse';
 const CHAT_REKEY_MAS_SCOPE_KEY = 'coolify_chat_rekey_mas';
-const CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY = 'coolify_chat_rekey_synapse_database';
-const CHAT_REKEY_MAS_DB_SCOPE_KEY = 'coolify_chat_rekey_mas_database';
+export const CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY = 'coolify_chat_rekey_synapse_database';
+export const CHAT_REKEY_MAS_DB_SCOPE_KEY = 'coolify_chat_rekey_mas_database';
 /**
  * Set once {@link ChatRekeyPort.copyHomeserver} returns, so a retried or
  * repeated apply never copies the same history twice -- the copy itself is
@@ -633,11 +658,6 @@ const CHAT_SECRET_ENV_KEYS = {
     masRsaKeyPem: 'CHAT_MATRIX_MAS_RSA_KEY_PEM',
     masEcKeyPem: 'CHAT_MATRIX_MAS_EC_KEY_PEM',
 };
-/** `FROM ${MAS_IMAGE}` plus the entry command its published image needs (chat's own `MAS_DOCKERFILE`, same reason: no arguments by default). */
-const CALLS_MAS_DOCKERFILE = [
-    `FROM ${MAS_IMAGE}`,
-    'CMD ["server", "--config", "/config/config.yaml"]',
-].join('\n');
 /**
  * `coolifyCallsService`'s own database (#145) -- no `system:kind:key` slot
  * of its own, the same reason {@link CALLS_SYNAPSE_SCOPE_KEY}'s doc comment
@@ -665,6 +685,12 @@ const CALLS_HEALTH_CHECK_PATH = '/healthz';
  * {@link CALLS_HEALTH_CHECK_PATH} above.
  */
 const CHAT_SERVICE_HEALTH_CHECK_PATH = '/_chat/health';
+/**
+ * Synapse's start period for its Coolify health check. It runs its database
+ * migrations before it listens, which is slower than the default start period
+ * of {@link healthCheckSettings} allows, and the image's own check waits 5 s.
+ */
+const SYNAPSE_HEALTH_CHECK_START_PERIOD_SECONDS = 120;
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
  * `exited:unhealthy` `` -- `@wtfalch/providers`' own doc comment) means it is
@@ -755,8 +781,85 @@ export const databaseStartWait = {
 // ---------------------------------------------------------------------------
 // Executor
 // ---------------------------------------------------------------------------
+/** How long the host's bucket port may take to make or find a bucket. */
+const BUCKET_TIMEOUT_MS = 60_000;
+/** How long the keys worker may take to mint an own files host's credential. */
+const KEYS_MINT_TIMEOUT_MS = 15_000;
+/** How long one call to the R2 key port or the files route that stores the key may take. */
+const R2_KEY_TIMEOUT_MS = 30_000;
+/** Clears a recorded id; a context that cannot forget one records it empty, which reads as unset. */
+function forgetScopeId(context, key) {
+    if (context.forgetId)
+        context.forgetId(key);
+    else
+        context.recordScopeId(key, '');
+}
+async function withTimeout(work, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** How long one Lettermint call of an own company's sign-in mint may take. */
+const LETTERMINT_TIMEOUT_MS = 60_000;
+const OWN_SERVICES_PORT_ABSENT = 'this org runs its own services and the host has no ownServices port for it';
+/** A port that refuses every call, naming the held key the org's service waits for. */
+function blockedPort(service, ref) {
+    return new Proxy({}, {
+        get: () => () => {
+            throw new OwnServicesBlockedError(service, ref);
+        },
+    });
+}
+/** The network a company's resources are made on: the platform's for its owner, `co-<slug>` for the rest. */
+function appliedNetworkOf(org, context) {
+    return onPlatformNetwork(context.ownerCompany) ? PLATFORM_NETWORK : companyNetworkName(org.slug);
+}
+/** The limit profile of the step now running; `limited` reads it on every Coolify call. */
+const limitScope = new AsyncLocalStorage();
+/** The company and run of the step now running; `placedByScope` reads it on every create. */
+const companyScope = new AsyncLocalStorage();
+/**
+ * The limit profile of a step on `this.ports.coolify`. Own-services steps
+ * (`coolify:own-*`) wrap their own ports with their own row of `LIMITS`.
+ */
+function limitProfileOf(action) {
+    if (action.kind.startsWith('own-'))
+        return undefined;
+    switch (`${action.system}:${action.kind}`) {
+        case 'coolify:app':
+        case 'coolify:database':
+            return LIMITS.companyApp;
+        case 'coolify:broker-entry':
+            return LIMITS.brokerEntry;
+        case 'cms:site':
+            return LIMITS.cms;
+        case 'coolify:chat':
+            return LIMITS.chat;
+        case 'coolify:calls':
+        case 'coolify:calls-service':
+        case 'coolify:calls-chat':
+            return LIMITS.calls;
+        case 'coolify:agora':
+            return LIMITS.agora;
+        case 'coolify:boule':
+        case 'coolify:boule-broker-entry':
+            return LIMITS.boule;
+        case 'cloudflare:tunnel':
+            return LIMITS.connector;
+        default:
+            return action.system === 'coolify' ? LIMITS.companyOther : undefined;
+    }
+}
 export class FoundryStepExecutor {
-    ports;
     edgeDns;
     edgeTunnels;
     edgeAccess;
@@ -765,12 +868,132 @@ export class FoundryStepExecutor {
     edgeWriteSlot;
     /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
     handledSecrets = new Set();
+    ports;
+    get rawCoolify() {
+        return this.ports.coolify;
+    }
     constructor(ports) {
-        this.ports = ports;
+        const destinationOf = (coolify, step, serverUuid) => this.companyDestination(coolify, step.org, step.context, serverUuid);
+        // A live view of `ports` whose Coolify port is the limited one; a port set later is seen.
+        const limitedPort = new WeakMap();
+        this.ports = new Proxy(ports, {
+            get(target, prop) {
+                const value = Reflect.get(target, prop, target);
+                if (prop !== 'coolify' || !value)
+                    return value;
+                const coolify = value;
+                let made = limitedPort.get(coolify);
+                if (!made) {
+                    const placedPort = placedByScope(coolify, () => {
+                        const step = companyScope.getStore();
+                        if (!step)
+                            return undefined;
+                        return {
+                            key: step.org.slug,
+                            resolve: (serverUuid) => destinationOf(coolify, step, serverUuid),
+                        };
+                    });
+                    made = limited(placedPort, () => limitScope.getStore());
+                    limitedPort.set(coolify, made);
+                }
+                return made;
+            },
+        });
     }
     secretsHandled() {
         return [...this.handledSecrets];
     }
+    /**
+     * An own org's step runs on a copy of this executor whose ZITADEL, mail,
+     * broker, files, jobs and calls ports are the org's own. A port the org has
+     * not got yet is absent or throws, never the shared one.
+     */
+    async executeScoped(action, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const scoped = await own.portsFor(context.org, context.recordedIds());
+        if (!scoped)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const refs = orgTarget(context.org).refs;
+        const copy = new FoundryStepExecutor({
+            ...this.ports,
+            ownServices: undefined,
+            zitadel: scoped.zitadel ?? blockedPort('zitadel', refs.instanceBearer),
+            mail: scoped.mail ?? blockedPort('mail', refs.mailAdminKey),
+            callsSfu: scoped.callsSfu ?? blockedPort('calls', refs.livekitKeys),
+            broker: scoped.broker,
+            filesOrganisation: scoped.filesOrganisation ??
+                blockedPort('files', refs.filesManagement),
+            jobsScheduler: scoped.jobsScheduler ?? blockedPort('jobs', refs.jobsAdminToken),
+            callsSfuUrls: ownSfuUrls(context.recordedIds()),
+        });
+        try {
+            return await copy.run(action, context);
+        }
+        finally {
+            for (const secret of copy.secretsHandled())
+                this.handledSecrets.add(secret);
+        }
+    }
+    /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
+    ownMailKeyMintable() {
+        return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
+    }
+    /** What the executor's own files dependencies supply, for the planner's blocked lines. */
+    ownFilesDeps() {
+        const files = this.ports.ownServices?.provision.files;
+        if (!files)
+            return { keys: false, bucket: false };
+        return {
+            keys: Boolean(files.keysMint),
+            bucket: Boolean(files.r2Buckets),
+        };
+    }
+    /** Which ports the own files storage key step needs this executor has, for the planner's blocked line. */
+    async ownFilesR2Ports(org, recordedIds) {
+        const r2Keys = Boolean(this.ports.ownServices?.provision.files.r2Keys);
+        // Only an own org whose files host is applied is asked for its scoped ports.
+        if (!ownsServices(org) || !recordedIds[`coolify:own-files:${org.id}`]) {
+            return { r2Keys, storeR2Credentials: false };
+        }
+        try {
+            const scoped = await this.ports.ownServices?.portsFor(org, recordedIds);
+            return {
+                r2Keys,
+                storeR2Credentials: typeof scoped?.filesOrganisation?.storeR2Credentials === 'function',
+            };
+        }
+        catch (e) {
+            if (e instanceof OwnServicesBlockedError)
+                return { r2Keys, storeR2Credentials: false };
+            throw e;
+        }
+    }
+    /** Whether the host's scoped ports for this own org include a files-organisation port. A held key still missing counts as no port. */
+    async ownFilesOrganisationPort(org, recordedIds) {
+        try {
+            const scoped = await this.ports.ownServices?.portsFor(org, recordedIds);
+            return Boolean(scoped?.filesOrganisation);
+        }
+        catch (e) {
+            if (e instanceof OwnServicesBlockedError)
+                return false;
+            throw e;
+        }
+    }
+    /** Whether the host's scoped ports for this own org include a broker port: the company's own broker, which its broker entries are written to. */
+    async ownBrokerPort(org, recordedIds) {
+        try {
+            const scoped = await this.ports.ownServices?.portsFor(org, recordedIds);
+            return Boolean(scoped?.broker);
+        }
+        catch (e) {
+            if (e instanceof OwnServicesBlockedError)
+                return false;
+            throw e;
+        }
+    }
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts() {
         return {
@@ -782,6 +1005,49 @@ export class FoundryStepExecutor {
         };
     }
     async execute(action, context) {
+        const { org } = context;
+        if (ownsServices(org) && !action.kind.startsWith('own-')) {
+            return this.executeScoped(action, context);
+        }
+        return this.run(action, context);
+    }
+    async run(action, context) {
+        let profile = limitProfileOf(action);
+        // An entry that declares `capabilities: 'standard'` is the fallback from tier B to tier A.
+        if (profile === LIMITS.companyApp && action.kind === 'app') {
+            const entry = context.org.hosting.entries.find((e) => appStepKey(context.org, e.key) === action.key);
+            if (entry?.capabilities === 'standard')
+                profile = LIMITS.companyAppStandard;
+        }
+        const dispatch = () => this.dispatch(action, context);
+        return companyScope.run({ org: context.org, context }, () => profile ? limitScope.run(profile, dispatch) : dispatch());
+    }
+    /**
+     * The company's destination on `serverUuid`: its Docker network `co-<slug>`, made when absent and
+     * recorded as {@link COOLIFY_DESTINATION_SCOPE_KEY}. Called before the first create of a step;
+     * a server that already holds too many networks fails here (`DestinationCapacityError`), before
+     * the destination or the resource exists. A crash after the destination is made and before it is
+     * recorded leaves a destination the next run finds by its network name, so a re-run converges.
+     * Each Coolify call has a 60 second timeout (`destinations.ts`).
+     */
+    async companyDestination(coolify, org, context, serverUuid) {
+        // The platform's own company stays on the platform network: Archon reads its database by name.
+        if (onPlatformNetwork(context.ownerCompany)) {
+            return findDestination(coolify, serverUuid, PLATFORM_NETWORK);
+        }
+        const uuid = await ensureDestination(coolify, serverUuid, companyNetworkName(org.slug));
+        if (context.recordedIds()[COOLIFY_DESTINATION_SCOPE_KEY] !== uuid) {
+            context.recordScopeId(COOLIFY_DESTINATION_SCOPE_KEY, uuid);
+        }
+        return uuid;
+    }
+    /** `coolify` for an own-services step: its creates go to the company's destination. */
+    placedForCompany(coolify, org, context) {
+        const own = coolify;
+        const listing = typeof own.raw === 'function' ? own : this.rawCoolify;
+        return placed(coolify, (serverUuid) => this.companyDestination(listing, org, context, serverUuid));
+    }
+    async dispatch(action, context) {
         const { org } = context;
         switch (`${action.system}:${action.kind}`) {
             case 'zitadel:issuer':
@@ -802,10 +1068,14 @@ export class FoundryStepExecutor {
                 return this.zitadelCustomers(org, context);
             case 'coolify:app':
                 return this.coolifyApp(action, org, context);
+            case 'coolify:network':
+                return this.coolifyNetwork(action, org, context);
             case 'coolify:broker-entry':
                 return this.coolifyBrokerEntry(action, org, context);
             case 'coolify:database':
                 return this.coolifyDatabase(action, org, context);
+            case 'coolify:backup':
+                return this.coolifyBackup(action, org, context);
             case 'coolify:calls':
                 return this.coolifyCalls(action, org, context);
             case 'coolify:calls-service':
@@ -860,6 +1130,18 @@ export class FoundryStepExecutor {
                 return this.bouleBrokerEntry(org, context);
             case 'jobs:registration':
                 return this.jobsRegistration(action, org, context);
+            case 'coolify:own-auth':
+                return this.ownAuth(action, org, context);
+            case 'coolify:own-jobs':
+                return this.ownJobs(action, org, context);
+            case 'coolify:own-mail':
+                return this.ownMail(action, org, context);
+            case 'coolify:own-sfu':
+                return this.ownSfu(action, org, context);
+            case 'coolify:own-files':
+                return this.ownFiles(action, org, context);
+            case 'coolify:own-files-r2':
+                return this.ownFilesR2(org, context);
             default:
                 throw new Error(`FoundryStepExecutor has no dispatch for ${action.system}:${action.kind}`);
         }
@@ -1779,10 +2061,9 @@ export class FoundryStepExecutor {
             return { resourceId: created.appId };
         }
         // #139: the fixed `cms` client (`diff.ts`'s `planCmsClient`) signs
-        // people into the cms studio at `cms.<domain>`, not the org's own app
-        // hostname -- `org.site.enabled` guarantees `org.domain` is set
-        // (`org.ts`'s `validateSite`), the same guarantee `cmsHostnameFor`'s own
-        // doc comment relies on. #164: the fixed `agora` client (`diff.ts`'s
+        // people into the cms studio at `cmsHostnameFor(org)` -- `cms.<domain>`,
+        // or `<slug>-cms.oikos.host` for a company without a domain -- not the
+        // org's own app hostname. #164: the fixed `agora` client (`diff.ts`'s
         // `planAgoraClient`) is the same shape, always -- there is no
         // `org.site.enabled`-style guard to check, since Agora is always on.
         // The Agora client stays `appType: 'web'`: providers' `createOidcApp`
@@ -1881,12 +2162,110 @@ export class FoundryStepExecutor {
                 throw new Error(`coolify project ${org.slug} (${found.uuid}) was not created by foundry for this org and may hold other resources: rename or delete it, then apply again`);
             }
         }
-        const projectUuid = found
-            ? found.uuid
-            : (await this.ports.coolify.createProject(org.slug, coolifyProjectMark(org))).uuid;
+        if (!found) {
+            // A project foundry makes now is empty and on the company's own network. Record both, and persist
+            // them, before any resource is made in it: a crash later must never leave a project with
+            // resources and no marker, which the next plan would move (delete) over what was just built.
+            const created = await this.ports.coolify.createProject(org.slug, coolifyProjectMark(org));
+            context.recordScopeId(NETWORK_APPLIED_SCOPE_KEY, appliedNetworkOf(org, context));
+            context.recordScopeId('coolify_project', created.uuid);
+            await context.persistScopeIds();
+            return created.uuid;
+        }
+        const projectUuid = found.uuid;
+        // A project that holds nothing but its environment starts on the company's own network; one that
+        // holds resources was built on the shared network and is moved by `coolify:network`
+        // (`plan/network-move.ts`).
+        const holds = await this.ports.coolify.listResources?.(found.uuid);
+        if (holds?.every((r) => r.kind === 'environment')) {
+            context.recordScopeId(NETWORK_APPLIED_SCOPE_KEY, appliedNetworkOf(org, context));
+        }
         context.recordScopeId('coolify_project', projectUuid);
         return projectUuid;
     }
+    /**
+     * `plan/network-move.ts`'s `planNetworkMove`: a company built on the shared network is moved to its
+     * own. Coolify cannot move a resource in production, so every application and database in the
+     * company's project that foundry did not adopt is deleted, applications first, and the ids recorded
+     * for them are forgotten; the next apply builds them again on `co-<slug>`. Apply has already asked
+     * for the typed company name and checked a fresh backup of every database. A failure part way
+     * leaves what is left recorded and the marker unset, so the same step is planned again and goes on
+     * from there (a 404 counts as deleted). The marker is recorded last. No new timeout: each delete
+     * has the Coolify port's own.
+     */
+    async coolifyNetwork(action, org, context) {
+        const at = `coolify:network for ${org.slug}`;
+        const projectUuid = context.recordedIds().coolify_project;
+        if (!projectUuid)
+            throw new Error(`${at}: no Coolify project is recorded, nothing to move`);
+        const network = companyNetworkName(org.slug);
+        if (action.desired.network !== network) {
+            throw new Error(`${at}: the plan names another network; plan this org again`);
+        }
+        const list = this.ports.coolify.listResources;
+        if (!list) {
+            throw new Error(`${at}: this Coolify port cannot list a project's resources, so the move cannot tell what to delete`);
+        }
+        // Fail closed: an adopted record that cannot be read could name a resource foundry must keep.
+        const unreadable = adoptedKeysUnreadable(context.recordedIds());
+        if (unreadable.length > 0) {
+            throw new Error(`${at}: an adopted record cannot be read, so the move cannot tell what to keep`);
+        }
+        const kept = new Set();
+        for (const [key, raw] of Object.entries(context.recordedIds())) {
+            if (!key.startsWith('adopted.'))
+                continue;
+            const snapshot = parseAdoptSnapshot(raw);
+            if (snapshot)
+                kept.add(snapshot.application.uuid).add(snapshot.database.uuid);
+        }
+        const resources = await list.call(this.ports.coolify, projectUuid);
+        // Delete only what foundry recorded. Anything else in the project (a resource a person made there)
+        // stops the move before the first delete; it is moved by hand.
+        const recorded = new Set(Object.entries(context.recordedIds())
+            .filter(([key]) => !key.startsWith('adopted.'))
+            .map(([, id]) => id));
+        const candidates = resources.filter((r) => (r.kind === 'application' || r.kind === 'database') &&
+            typeof r.key === 'string' &&
+            !kept.has(r.key));
+        const stranger = candidates.find((r) => !recorded.has(r.key));
+        if (stranger) {
+            const name = typeof stranger.config?.name === 'string' ? stranger.config.name : stranger.key;
+            throw new Error(`${at}: the project holds the ${stranger.kind} "${name}", which foundry did not create; move this company by hand (docs/runbooks/network-move.md)`);
+        }
+        const doomed = candidates.sort((a, b) => a.kind === b.kind ? 0 : a.kind === 'application' ? -1 : 1);
+        for (const resource of doomed) {
+            try {
+                if (resource.kind === 'application') {
+                    await this.ports.coolify.deleteApplication(resource.key);
+                }
+                else {
+                    await this.ports.coolify.deleteDatabase(resource.key);
+                }
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+            for (const [key, id] of Object.entries(context.recordedIds())) {
+                if (id === resource.key)
+                    context.forgetId?.(key);
+            }
+            await context.persistScopeIds();
+        }
+        // Every database is gone, so every recorded backup schedule is too. A kept marker would stop
+        // `planCompanyBackups` from scheduling the rebuilt databases, and the upgrade gate would look for
+        // executions of a schedule that no longer exists.
+        for (const key of Object.keys(context.recordedIds())) {
+            if (key.startsWith(BACKUP_SCOPE_PREFIX))
+                context.forgetId?.(key);
+        }
+        // The company's connector is gone, so the tunnel's ingress is written again after the move.
+        context.forgetId?.(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY);
+        context.recordScopeId(NETWORK_APPLIED_SCOPE_KEY, network);
+        await context.persistScopeIds();
+        return {};
+    }
     /**
      * #445: one company lands on one Coolify server. The first call for an
      * org picks a usable, reachable server and records it
@@ -1950,6 +2329,11 @@ export class FoundryStepExecutor {
             throw new Error(`coolify:app for ${org.slug}: entry '${entry.key}' has no repo`);
         }
         const appRepo = entry.repo;
+        // A compose file can set `privileged`, host networking or a Docker socket mount, and its labels
+        // are its own: refused for every company until compose files are checked (`diff.ts` blocks it).
+        if (entry.buildPack === 'dockercompose') {
+            throw new Error(`coolify:app for ${org.slug}: entry '${entry.key}' is compose-built, which is refused`);
+        }
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         // The recorded id first; the name when nothing is recorded, or when the
@@ -1971,10 +2355,12 @@ export class FoundryStepExecutor {
                 environmentIds: [environment.id],
             });
         }
-        // An entry with no names is internal: the other entries reach it as
-        // `<slug>-<key>`, and it gets no domain, route or DNS record.
+        // No entry gets Coolify `domains`: Coolify would add a Traefik router for them. The company's
+        // tunnel routes an entry's names straight to its container (also `<slug>.oikos.host`, through a
+        // record in the platform's oikos.host zone), which every entry reaches as `<slug>-<key>` (its
+        // internal name) on the company network.
         const names = entryHostnames(org, entry);
-        const wantDomains = tunnelDomainList(names);
+        const wantDomains = [];
         const isStatic = entry.buildPack === 'static';
         const settingsKey = appSettingsAppliedScopeKey(entry.key);
         const domainsKey = appDomainsAppliedScopeKey(entry.key);
@@ -2014,8 +2400,7 @@ export class FoundryStepExecutor {
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
                 name: appNameFor(org, entry),
-                domains: names.length > 0 ? coolifyTunnelDomains(names) : undefined,
-                autogenerate_domain: names.length > 0 ? undefined : false,
+                autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
                 is_auto_deploy_enabled: entry.autoDeploy,
@@ -2060,9 +2445,9 @@ export class FoundryStepExecutor {
         // redirect loops behind the tunnel. The internal name is set after
         // create, as the calls stack's apps do.
         if (JSON.stringify(wantDomains) !== JSON.stringify(haveDomains)) {
-            patch.domains = coolifyTunnelDomains(names);
+            patch.domains = '';
         }
-        if (names.length === 0 && (!existing || patch.domains !== undefined)) {
+        if (!existing || patch.domains !== undefined) {
             patch.custom_internal_name = appNameFor(org, entry);
         }
         // A `*` entry's proxy labels: Coolify takes `custom_labels` base64 encoded
@@ -2074,16 +2459,16 @@ export class FoundryStepExecutor {
         // below, after the redeploy, so a failed run repeats this.
         const labelsKey = appLabelsAppliedScopeKey(entry.key);
         const haveLabelsHash = context.recordedIds()[labelsKey];
-        const labelSpec = entryLabelSpec(org, entry, haveLabelsHash !== undefined);
-        const wantLabelsHash = labelSpec ? entryLabelHash(labelSpec) : undefined;
-        const wantLabels = labelSpec ? entryProxyLabels(appId, labelSpec) : undefined;
+        // Every entry container carries `traefik.enable=false` (a run label overrides the image's own), so
+        // Traefik never routes it, whatever its image declares.
+        const wantLabelsHash = entryLabelHash(entryLabelSpec(org, entry));
+        const wantLabels = ENTRY_CONTAINER_LABELS;
         const liveLabels = existing ? live?.custom_labels : undefined;
-        const labelsDiffer = wantLabels !== undefined &&
-            (!existing ||
-                (liveLabels !== undefined
-                    ? !sameLabelSets(Buffer.from(liveLabels ?? '', 'base64').toString('utf8'), wantLabels)
-                    : wantLabelsHash !== haveLabelsHash));
-        if (wantLabels !== undefined && labelsDiffer) {
+        const labelsDiffer = !existing ||
+            (liveLabels !== undefined
+                ? !sameLabelSets(Buffer.from(liveLabels ?? '', 'base64').toString('utf8'), wantLabels)
+                : wantLabelsHash !== haveLabelsHash);
+        if (labelsDiffer) {
             patch.custom_labels = Buffer.from(wantLabels).toString('base64');
         }
         if (Object.keys(patch).length > 0)
@@ -2125,7 +2510,6 @@ export class FoundryStepExecutor {
         // What the plan decided is available (diff.ts `planApps`), so the marker
         // recorded below is the one the plan compares against. Absent: none.
         action.desired.secretSources ?? {
-            platformMailKey: false,
             sharedSecret: false,
         });
         // Rule 4 (#239, #243): a container reads its env only at start, so an app
@@ -2145,9 +2529,15 @@ export class FoundryStepExecutor {
             const [hostname] = names;
             const healthPath = entry.healthPath ?? (isStatic ? '/' : '/api/health');
             const runtime = this.ports.runtime ?? {};
-            await waitForNewDeployment(this.ports.coolify, appId, hostname
+            const built = await waitForNewDeployment(this.ports.coolify, appId, 
+            // The public name answers from the container only once the tunnel step has written the
+            // direct route; before that (a first apply, or the one that moves it) the deployment is the check.
+            hostname &&
+                (context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') ===
+                    entryRoutesMarker(org)
                 ? publicHealthCheck(org, context.recordedIds(), hostname, healthPath)
                 : { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, `coolify:app:${entry.key}`, `${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: entry.key }, (key, value) => context.recordScopeId(key, value));
         }
         else if ((appEnv.changed || dbNeedsRestart) && existing) {
             await this.ports.coolify.restart(appId);
@@ -2158,8 +2548,7 @@ export class FoundryStepExecutor {
         // one and `planApp` reports it instead of planning it.
         context.recordScopeId(settingsKey, JSON.stringify({ ...want, port: want.port ?? have.port }));
         context.recordScopeId(domainsKey, JSON.stringify(wantDomains));
-        if (wantLabelsHash)
-            context.recordScopeId(labelsKey, wantLabelsHash);
+        context.recordScopeId(labelsKey, wantLabelsHash);
         context.recordScopeId(appEnvAppliedScopeKey(entry.key), appEnv.applied);
         if (entry.uses?.auth) {
             context.recordScopeId(entryAuthEnvAppliedScopeKey(entry.key), appEnv.authApplied);
@@ -2223,6 +2612,31 @@ export class FoundryStepExecutor {
             await this.ports.coolify.restart(appId);
         }
     }
+    /**
+     * F6: a nightly dump of one of the company's databases to the platform's
+     * backup bucket. The schedule is found before it is created
+     * (`provisionDatabaseBackup`), so a run that died after the create and
+     * before `backup_<db>` was recorded reuses the schedule on the next apply
+     * instead of adding a second. The error carries the database's name, never
+     * the connection URL or a response body.
+     */
+    async coolifyBackup(action, org, context) {
+        const { databaseId, database, storageUuid } = action.desired;
+        if (typeof databaseId !== 'string' ||
+            typeof database !== 'string' ||
+            typeof storageUuid !== 'string' ||
+            !databaseId ||
+            !storageUuid) {
+            throw new Error(`coolify:backup for ${org.slug}: the plan named no database or no storage`);
+        }
+        const { uuid } = await provisionDatabaseBackup(this.ports.coolify, {
+            databaseUuid: databaseId,
+            label: `${org.slug} ${database}`,
+            storageUuid,
+        });
+        context.recordScopeId(backupScopeKey(database), uuid);
+        return undefined;
+    }
     async coolifyDatabase(action, org, context) {
         if (action.desired.enabled === false) {
             const dbId = context.recordedIds()[`coolify:database:${action.key}`];
@@ -2420,24 +2834,12 @@ export class FoundryStepExecutor {
         // minted here; a source with no value yet (its own step has not run,
         // or has not run for this apply) is simply omitted, the same way every
         // other optional entry above is.
-        // The secret sources (`sharedSecret`, `platformMailKey`) are filled here
+        // The secret source (`sharedSecret`) is filled here
         // only, straight into `envs`: never recorded, returned or logged.
         const heldKeys = this.ports.heldKeys;
-        // Availability is the plan's (`secretSources`). If the plan said a key is
-        // held and this port cannot read it, the host wired the two differently:
-        // fail by ref, never push a marker for an env that was not written.
-        let mailKey = null;
-        if (secretSources.platformMailKey) {
-            try {
-                mailKey = (await heldKeys?.resolve(PLATFORM_AUTH_BROKER_MAIL_KEY_REF)) || null;
-            }
-            catch {
-                // reported below, by ref
-            }
-            if (mailKey === null) {
-                throw new Error(`coolify:app for ${org.slug}: the plan found ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF} held but the executor's heldKeys cannot read it`);
-            }
-        }
+        // Availability is the plan's (`secretSources`). If the plan said secrets
+        // can be held and this port cannot put, the host wired the two differently:
+        // never push a marker for an env that was not written.
         if (secretSources.sharedSecret && typeof heldKeys?.put !== 'function') {
             throw new Error(`coolify:app for ${org.slug}: the plan found held keys that can put but the executor's heldKeys cannot`);
         }
@@ -2448,9 +2850,7 @@ export class FoundryStepExecutor {
         for (const { name, source } of resolved.secrets) {
             envs.push({
                 key: name,
-                value: source === 'platformMailKey'
-                    ? mailKey
-                    : await this.ensureSharedSecret(org, source.name, recorded),
+                value: await this.ensureSharedSecret(org, source.name, recorded),
             });
         }
         await this.ports.coolify.bulkUpsertEnvs(appId, envs);
@@ -2469,6 +2869,40 @@ export class FoundryStepExecutor {
             authApplied,
         };
     }
+    /**
+     * The install's edge label token: read from the held keys, else minted and held first, so a crash
+     * after the `put` hands the same value out on the next apply. Read once more after the `put`, so two
+     * runs that mint at the same moment end on the value that was held last. An error names the ref,
+     * never a value.
+     */
+    async edgeLabelToken() {
+        const heldKeys = this.ports.heldKeys;
+        const held = await heldKeys?.resolve(PROXY_LABEL_TOKEN_REF);
+        if (held)
+            return held;
+        if (typeof heldKeys?.put !== 'function') {
+            throw new Error(`proxy labels: the edge label token (${PROXY_LABEL_TOKEN_REF}) is not held and the executor's heldKeys cannot put one`);
+        }
+        const minted = randomBytes(32).toString('base64url');
+        this.handledSecrets.add(minted);
+        await heldKeys.put(PROXY_LABEL_TOKEN_REF, minted);
+        const final = (await heldKeys.resolve(PROXY_LABEL_TOKEN_REF)) ?? minted;
+        this.handledSecrets.add(final);
+        return final;
+    }
+    /**
+     * The `custom_labels` patch of an app foundry routes through Traefik at `hostname`: the same http
+     * router a `domains` entry gets, plus the edge token. Coolify uses these instead of the labels it
+     * generates from `domains`. The router names use the app's own name, which is unique per company.
+     */
+    async routedLabels(name, hostname, port) {
+        const token = await this.edgeLabelToken();
+        const labels = entryProxyLabels(name, { names: [hostname], wildcardDomain: null, port }, token);
+        if (routesWithoutToken(labels, token)) {
+            throw new Error('proxy labels: a routed app would be sent without the edge token');
+        }
+        return { custom_labels: Buffer.from(labels).toString('base64') };
+    }
     /**
      * The org's shared secret `name`: read from the held keys, else generated
      * and held first, so a crash after the `put` and before the env write
@@ -2925,6 +3359,40 @@ export class FoundryStepExecutor {
             }
         }
     }
+    /**
+     * The company's own sign-in mail token: a Lettermint project `<slug>-auth`
+     * whose token goes to `orgTarget(org).refs.brokerMailKey`, where the broker
+     * and ZITADEL's SMTP settings read it. The platform-wide Lettermint key
+     * stays with the executor and never reaches a company. A held ref is left
+     * alone. Otherwise the mint rule of {@link ensureOrgAppMailToken}: create
+     * the project, restrict the domain, deliver its token, and only then
+     * delete every other `<slug>-auth` project (a token cannot be read back,
+     * so a project without a held token is a leftover). The restriction comes
+     * before the delivery so a failure there leaves no held ref: the next run
+     * starts over instead of skipping it. A failure before the delivery leaves
+     * that project for the next run to delete. Every Lettermint call is
+     * bounded; the token is registered for redaction before anything can throw
+     * with it.
+     */
+    async ensureOwnAuthMailToken(org, mailDomain, deps) {
+        const ref = orgTarget(org).refs.brokerMailKey;
+        if (await deps.heldKeys?.resolve(ref))
+            return;
+        const lettermint = this.ports.lettermint;
+        if (!lettermint || !deps.heldKeys)
+            throw new OwnServicesBlockedError('lettermint', ref);
+        const authName = `${org.slug}-auth`;
+        const projects = await withTimeout(lettermint.listProjects(), LETTERMINT_TIMEOUT_MS);
+        const created = await withTimeout(lettermint.createProject(authName), LETTERMINT_TIMEOUT_MS);
+        deps.runtime?.onSecret?.(created.token);
+        await withTimeout(this.ensureLettermintDomainRestriction(org, mailDomain, [...projects, created.project], null, null), LETTERMINT_TIMEOUT_MS);
+        await deps.deliverSecret(ref, created.token);
+        for (const project of projects) {
+            if (project.name === authName && project.id !== created.project.id) {
+                await withTimeout(lettermint.deleteProject(project.id), LETTERMINT_TIMEOUT_MS);
+            }
+        }
+    }
     /**
      * Deletes a just-minted project from inside a `catch`. A failed delete is
      * dropped so it never replaces the error being rethrown; the orphan is
@@ -2971,6 +3439,7 @@ export class FoundryStepExecutor {
     async ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId) {
         const appName = `${org.slug}-app`;
         const relayName = `${org.slug}-relay`;
+        const authName = `${org.slug}-auth`;
         const isPlatformApexDomain = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
         if (isPlatformApexDomain && platformLettermintProjectId) {
             if (!allProjects.some((p) => p.id === platformLettermintProjectId)) {
@@ -2982,7 +3451,7 @@ export class FoundryStepExecutor {
             ? await this.ports.lettermint.getDomain(existing.id)
             : await this.ports.lettermint.createDomain(mailDomain);
         const scopedProjectIds = allProjects
-            .filter((p) => p.name === appName || p.name === relayName)
+            .filter((p) => p.name === appName || p.name === relayName || p.name === authName)
             .map((p) => p.id);
         if (isPlatformApexDomain &&
             platformLettermintProjectId &&
@@ -3069,14 +3538,8 @@ export class FoundryStepExecutor {
                 await this.ports.coolify.raw('POST', `/applications/${siteAppId}/stop`);
             return { resourceId: cmsAppId ?? siteAppId };
         }
-        // `validateSite` ("site.enabled requires domain") guarantees this
-        // whenever this step runs -- checked anyway, the same way
-        // `cloudflareRateLimit` above guards its own `org.domain` read, since
-        // TypeScript's `string | null` gives no static guarantee of it.
-        if (!org.domain) {
-            throw new Error(`cms:site for ${org.slug}: site.enabled is set but domain is null`);
-        }
-        const domain = org.domain;
+        // The site's address: the org's domain, or `<slug>.oikos.host` without one.
+        const domain = siteHostnameFor(org);
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const site = await this.findOrCreateCmsApp({
@@ -3110,9 +3573,11 @@ export class FoundryStepExecutor {
         // deploys, it does not add a deploy where none exists).
         await this.ports.coolify.updateApplication(site.appId, {
             ...healthCheckSettings('/api/health', CMS_APP_PORT),
+            ...(await this.routedLabels(`${org.slug}-site`, domain, CMS_APP_PORT)),
         });
         await this.ports.coolify.updateApplication(cms.appId, {
             ...healthCheckSettings('/api/health', CMS_APP_PORT),
+            ...(await this.routedLabels(`${org.slug}-cms`, cmsHostnameFor(org), CMS_APP_PORT)),
         });
         // Every app foundry deploys keeps its own logs (#75) -- reused as-is for
         // both of these two, the same unconditional call `coolifyApp` makes for
@@ -3399,24 +3864,27 @@ export class FoundryStepExecutor {
             // yet.
             throw new Error(`coolify:calls for ${org.slug}: a database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
+        const synapseTag = typeof action.desired.synapseTag === 'string' ? action.desired.synapseTag : SYNAPSE_TAG;
         const synapse = await this.findOrCreateCallsApp(names.synapse, environment.id, () => this.ports.coolify.createDockerImageApplication({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             docker_registry_image_name: SYNAPSE_IMAGE,
-            docker_registry_image_tag: SYNAPSE_TAG,
+            docker_registry_image_tag: pinnedTagFor('synapse', synapseTag),
             ports_exposes: '8008',
             name: names.synapse,
-            description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${SYNAPSE_TAG})`,
+            description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${synapseTag})`,
             instant_deploy: false,
         }));
-        if (!synapse.existed) {
-            await this.ports.coolify.updateApplication(synapse.appId, {
-                health_check_enabled: false,
-                custom_internal_name: names.synapse,
-            });
-        }
+        // The check goes on every run, so a Synapse made without one gets it. Synapse
+        // is deployed before MAS here. Its `/health` answers with MAS unreachable
+        // (shown with a throwaway Synapse of the same image, MAS endpoint a name that
+        // does not resolve: 200, healthy), and the start period covers first-boot migrations.
+        await this.ports.coolify.updateApplication(synapse.appId, {
+            ...(synapse.existed ? {} : { custom_internal_name: names.synapse }),
+            ...healthCheckSettings('/health', 8008, SYNAPSE_HEALTH_CHECK_START_PERIOD_SECONDS),
+        });
         context.recordScopeId(CALLS_SYNAPSE_SCOPE_KEY, synapse.appId);
         // #251: only on create -- nothing here patches `docker_registry_image_tag`
         // on an app `findOrCreateCallsApp` found already running, so that is the
@@ -3424,21 +3892,21 @@ export class FoundryStepExecutor {
         // the app id above is, would make `versionNotAppliedLine` compare a
         // bumped `VERSIONS.synapse` against a value never actually applied.
         if (!synapse.existed) {
-            context.recordScopeId(CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, SYNAPSE_TAG);
+            context.recordScopeId(CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, synapseTag);
         }
         const mas = await this.findOrCreateCallsApp(names.mas, environment.id, () => this.ports.coolify.createDockerfileApplication({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            dockerfile: CALLS_MAS_DOCKERFILE,
+            dockerfile: masDockerfile(),
             name: names.mas,
             description: `matrix-authentication-service for ${org.slug}'s calls stack`,
             instant_deploy: false,
         }));
         if (!mas.existed) {
             await this.ports.coolify.updateApplication(mas.appId, {
-                health_check_enabled: false,
+                ...IMAGE_HEALTHCHECK_SETTINGS,
                 custom_internal_name: names.mas,
             });
         }
@@ -3875,7 +4343,7 @@ export class FoundryStepExecutor {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            dockerfile: CALLS_MAS_DOCKERFILE,
+            dockerfile: masDockerfile(),
             name: names.mas,
             description: `matrix-authentication-service for ${org.slug}'s chat`,
             instant_deploy: false,
@@ -3895,21 +4363,26 @@ export class FoundryStepExecutor {
             autogenerate_domain: false,
         }), { startIfStopped: false });
         // Fixed internal names, set on every run: the three apps and Agora
-        // address each other by them. Neither Synapse's nor MAS's health check
-        // can pass before the other is up, so both are off (the calls stack's own
-        // rule).
+        // address each other by them. Both are Dockerfile apps with a HEALTHCHECK
+        // of their own (MAS's has a copied-in busybox, its image has no shell), so
+        // Coolify's check is off and the image's is the live one. MAS is deployed
+        // first and its `/health` needs only its database, so Synapse's check can
+        // pass.
         await this.ports.coolify.updateApplication(synapse.appId, {
             custom_internal_name: names.synapse,
-            ...(synapse.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (curl on /health) is the live check; MAS is deployed first.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         await this.ports.coolify.updateApplication(mas.appId, {
             custom_internal_name: names.mas,
-            ...(mas.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (`masDockerfile`) is the live check.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         await this.ports.coolify.updateApplication(service.appId, {
             custom_internal_name: names.service,
-            // No Coolify health check on the chat service (#543 review): its image
-            // is node:22-alpine with no curl, which Coolify's container check runs.
+            // A command, not Coolify's HTTP check: the image is node:22-alpine with
+            // no curl, and its busybox `wget` tries `localhost` as `::1` first.
+            ...commandHealthCheckSettings(wgetProbe(CHAT_SERVICE_PORT, CHAT_SERVICE_HEALTH_CHECK_PATH)),
         });
         context.recordScopeId(CHAT_SYNAPSE_SCOPE_KEY, synapse.appId);
         context.recordScopeId(CHAT_SERVICE_SCOPE_KEY, service.appId);
@@ -4084,18 +4557,20 @@ export class FoundryStepExecutor {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            dockerfile: CALLS_MAS_DOCKERFILE,
+            dockerfile: masDockerfile(),
             name: names.mas,
             description: `matrix-authentication-service for ${org.slug}'s re-keyed chat (#463)`,
             instant_deploy: false,
         }), { startIfStopped: false });
         await this.ports.coolify.updateApplication(synapse.appId, {
             custom_internal_name: names.synapse,
-            ...(synapse.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (curl on /health) is the live check; MAS is deployed first.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         await this.ports.coolify.updateApplication(mas.appId, {
             custom_internal_name: names.mas,
-            ...(mas.existed ? {} : { health_check_enabled: false }),
+            // Its Dockerfile's HEALTHCHECK (`masDockerfile`) is the live check.
+            ...IMAGE_HEALTHCHECK_SETTINGS,
         });
         context.recordScopeId(CHAT_REKEY_SYNAPSE_SCOPE_KEY, synapse.appId);
         context.recordScopeId(CHAT_REKEY_MAS_SCOPE_KEY, mas.appId);
@@ -4289,14 +4764,16 @@ export class FoundryStepExecutor {
         // step again for a live app whose marker is missing or stale, so an app
         // made before this existed gets its name here. The marker, recorded last,
         // tells `desiredAgoraEnv` that the name and the env are both in place.
-        // No Coolify health check on the calls service (#543 review): its image
-        // is node:24-alpine with no curl, which Coolify's container check runs.
+        // A command, not Coolify's HTTP check: the image is node:24-alpine with no
+        // curl, and its busybox `wget` tries `localhost` as `::1` first.
         // A found app may predate `ports_exposes` on create; patch a differing one.
         const portDiffers = app.existed &&
             (await this.ports.coolify.getApplication(app.appId)).ports_exposes !== CALLS_SERVICE_PORT;
         await this.ports.coolify.updateApplication(app.appId, {
             custom_internal_name: name,
+            ...commandHealthCheckSettings(wgetProbe(CALLS_SERVICE_PORT, CALLS_HEALTH_CHECK_PATH)),
             ...(portDiffers ? { ports_exposes: CALLS_SERVICE_PORT } : {}),
+            ...(await this.routedLabels(name, callsHostnameFor(org), Number(CALLS_SERVICE_PORT))),
         });
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
@@ -4677,6 +5154,7 @@ export class FoundryStepExecutor {
         await this.ports.coolify.updateApplication(app.appId, {
             ...(portDiffers ? { ports_exposes: AGORA_APP_PORTS_EXPOSES } : {}),
             ...healthCheckSettings('/', Number(AGORA_APP_PORTS_EXPOSES)),
+            ...(await this.routedLabels(name, agoraHostnameFor(org), Number(AGORA_APP_PORTS_EXPOSES))),
         });
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
@@ -4703,7 +5181,8 @@ export class FoundryStepExecutor {
             // in the branch below, and this deploy already carries this run's env,
             // pushed above, so the two never both run).
             const runtime = this.ports.runtime ?? {};
-            await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), agoraHostnameFor(org), '/'), runtime, runtime.sleep ?? defaultSleep, 'coolify:agora', `${org.slug}'s Agora stays at its previous deploy`);
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), agoraHostnameFor(org), '/'), runtime, runtime.sleep ?? defaultSleep, 'coolify:agora', `${org.slug}'s Agora stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'agora' }, (key, value) => context.recordScopeId(key, value));
             context.recordScopeId(AGORA_DEPLOYED_SCOPE_KEY, '1');
         }
         else if (app.existed && (envChanged || !alreadyActivated)) {
@@ -4784,6 +5263,7 @@ export class FoundryStepExecutor {
         // `EXPOSE 3000` ({@link BOULE_PORT}'s own doc comment).
         await this.ports.coolify.updateApplication(app.appId, {
             ...healthCheckSettings('/api/health', BOULE_PORT),
+            ...(await this.routedLabels(name, bouleHostnameFor(org), BOULE_PORT)),
         });
         const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
             .filter((e) => !e.is_preview)
@@ -4841,7 +5321,8 @@ export class FoundryStepExecutor {
         if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
             // #543: every deploy waits for health -- Boule's own public hostname.
             const runtime = this.ports.runtime ?? {};
-            await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), bouleHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:boule', `${org.slug}'s Boule stays at its previous deploy`);
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), bouleHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:boule', `${org.slug}'s Boule stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'boule' }, (key, value) => context.recordScopeId(key, value));
             context.recordScopeId(BOULE_DEPLOYED_SCOPE_KEY, '1');
         }
         else if (app.existed &&
@@ -5022,6 +5503,367 @@ export class FoundryStepExecutor {
         }
         return port;
     }
+    /**
+     * `plan/own-diff.ts`'s `planOwnJobs`: the org's own scheduler, in the org's
+     * own project, with the names and the held-key ref of `orgTarget(org)`. The
+     * admin token goes to `jobs:org:<slug>:adminToken` and nowhere else.
+     */
+    async ownJobs(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        return provisionJobsHost(scopeFromOrg(context, {}), {
+            coolify: limited(this.placedForCompany(own.provision.jobs, org, context), LIMITS.ownJobs),
+            deliverSecret: this.ports.deliverSecret,
+            readSecret: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
+            runtime: this.ports.runtime ?? {},
+        }, orgTarget(org), {
+            hostname: null,
+            gitRef: action.desired.gitRef,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+        });
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnFiles`: the org's own files host in the
+     * org's own project, trusting the company's issuer `https://auth.<domain>`.
+     * Its ZITADEL project `<slug>-files` and introspection app are made in the
+     * company's instance (`ownServices.zitadelFor`), never the shared one. The
+     * bucket comes from the host's bucket port under the target's name. The
+     * management key goes to `files:org:<slug>:managementKey` and the
+     * introspection secret to `zitadel:org:<slug>:files:introspection`, both
+     * once, and neither is recorded or returned.
+     */
+    async ownFiles(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const at = `coolify:own-files for ${org.slug}`;
+        const zitadelOrgId = context.recordedIds()[ZITADEL_ORG_SCOPE_KEY];
+        if (!zitadelOrgId)
+            throw new Error(`${at}: the org's ZITADEL organisation is not recorded yet`);
+        const { r2Buckets, r2Keys: _r2Keys, keysMint, readSecret, ...ownFiles } = own.provision.files;
+        const files = {
+            ...ownFiles,
+            coolify: limited(this.placedForCompany(ownFiles.coolify, org, context), LIMITS.ownFiles),
+        };
+        // Never the platform's credential in its place.
+        if (!keysMint)
+            throw new OwnServicesBlockedError('files', 'keysMint');
+        if (!r2Buckets)
+            throw new Error(`${at}: the host supplies no bucket port`);
+        const target = orgTarget(org);
+        let r2;
+        try {
+            r2 = await withTimeout(r2Buckets.ensureBucket(target.names.filesBucket), BUCKET_TIMEOUT_MS);
+        }
+        catch {
+            // The cause is dropped: a host port's message is not ours to repeat.
+            throw new Error(`${at}: the bucket ${target.names.filesBucket} could not be ensured`);
+        }
+        const issuer = ownHostnames(org).issuerUrl;
+        const deps = {
+            ...files,
+            // The platform's keys settings stay out of a company's containers; the minted keyring replaces them.
+            keys: undefined,
+            jobsSigningSecrets: undefined,
+            r2,
+            zitadel: own.zitadelFor({ issuerUrl: issuer, bearerRef: target.refs.instanceBearer }),
+            zitadelForInstance: undefined,
+            deliverSecret: this.ports.deliverSecret,
+            runtime: {
+                ...files.runtime,
+                onSecret: (value) => {
+                    this.handledSecrets.add(value);
+                },
+            },
+        };
+        const invalid = filesDepsInvalid(deps);
+        if (invalid)
+            throw new Error(`${at}: ${invalid}`);
+        const scope = scopeFromOrg(context, {});
+        const mintOwn = async () => {
+            try {
+                return await withTimeout(keysMint.mint(`files-${org.slug}`, randomUUID()), KEYS_MINT_TIMEOUT_MS);
+            }
+            catch (error) {
+                // The cause is dropped: a mint client's message is not ours to repeat.
+                throw new Error(error instanceof Error && error.message === 'timeout'
+                    ? `${at}: the keys mint did not answer within ${KEYS_MINT_TIMEOUT_MS / 1000} seconds`
+                    : `${at}: the keys mint failed`);
+            }
+        };
+        const { keys, guardId } = await resolveOwnFilesKeys(scope, {
+            deliverSecret: deps.deliverSecret,
+            readSecret: readSecret ?? (async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null),
+            runtime: deps.runtime,
+        }, target, mintOwn, keysMint.workerUrl, `own step ${at}`);
+        return provisionFilesHost(scope, { ...deps, keys }, target, {
+            keysGuardId: guardId,
+            hostname: action.desired.hostname,
+            gitRef: action.desired.gitRef,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            issuer,
+            zitadelOrg: { id: zitadelOrgId },
+            zitadelProject: {
+                name: `${org.slug}-files`,
+                scopeKey: ZITADEL_FILES_PROJECT_SCOPE_KEY,
+            },
+            shareDomains: filesShareDomains([org]),
+            bootstrapOperator: action.desired.bootstrapOperator,
+        });
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnFilesR2`: the storage key of the org's own files bucket. A token
+     * recorded as undelivered is deleted first (its secret cannot be read back, so it can never be
+     * finished), then one is minted, registered as a secret, recorded by id as undelivered and
+     * persisted, and only then sent to the files host, the same pair on every retry. The secret is
+     * never recorded and never written to a Coolify env. The id is recorded once the host has it.
+     */
+    async ownFilesR2(org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const at = `coolify:own-files-r2 for ${org.slug}`;
+        const { r2Keys, runtime } = own.provision.files;
+        if (!r2Keys)
+            throw new OwnServicesBlockedError('files', 'r2Keys');
+        const scoped = await own.portsFor(org, context.recordedIds());
+        const organisation = scoped?.filesOrganisation;
+        if (!organisation?.storeR2Credentials) {
+            throw new Error(`${at}: the host gave the company no storeR2Credentials on its files port`);
+        }
+        const store = organisation.storeR2Credentials.bind(organisation);
+        const bucket = orgTarget(org).names.filesBucket;
+        const timeoutText = `did not answer within ${R2_KEY_TIMEOUT_MS / 1000} seconds`;
+        const failure = (what, error) => 
+        // The cause is dropped: a port's message is not ours to repeat, and may hold the secret.
+        new Error(`${at}: ${what} ${error instanceof Error && error.message === 'timeout' ? timeoutText : 'failed'}`);
+        const recorded = context.recordedIds();
+        if (recorded[OWN_FILES_R2_SCOPE_KEY])
+            return { resourceId: recorded[OWN_FILES_R2_SCOPE_KEY] };
+        // A leftover token is deleted before anything is minted: never two live tokens.
+        const leftover = recorded[OWN_FILES_R2_UNDELIVERED_SCOPE_KEY];
+        if (leftover) {
+            try {
+                await withTimeout(r2Keys.deleteBucketKey(leftover), R2_KEY_TIMEOUT_MS);
+            }
+            catch (error) {
+                if (!isNotFoundError(error)) {
+                    throw failure(`deleting the earlier storage key ${leftover}, so no new one was made:`, error);
+                }
+            }
+            forgetScopeId(context, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY);
+            await context.persistScopeIds();
+        }
+        let key;
+        try {
+            key = await withTimeout(r2Keys.mintBucketKey(bucket), R2_KEY_TIMEOUT_MS);
+        }
+        catch (error) {
+            throw failure('the storage key mint', error);
+        }
+        const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 200;
+        if (text(key?.secretAccessKey))
+            this.handledSecrets.add(key.secretAccessKey);
+        // A token id we can read is recorded even when the rest of the answer is unusable, so it is deleted next run.
+        if (text(key?.tokenId)) {
+            context.recordScopeId(OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, key.tokenId);
+            await context.persistScopeIds();
+        }
+        if (!text(key?.accessKeyId) || !text(key?.secretAccessKey) || !text(key?.tokenId)) {
+            throw new Error(`${at}: the storage key mint answered with an unusable key`);
+        }
+        const pair = {
+            accessKeyId: key.accessKeyId,
+            secretAccessKey: key.secretAccessKey,
+            tokenId: key.tokenId,
+        };
+        const attempts = runtime?.deliverAttempts ?? 3;
+        const sleep = runtime?.sleep ?? defaultSleep;
+        for (let attempt = 1;; attempt += 1) {
+            try {
+                await withTimeout(store({ ...pair }), R2_KEY_TIMEOUT_MS);
+                break;
+            }
+            catch (error) {
+                if (attempt >= attempts) {
+                    const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
+                        pair.secretAccessKey,
+                        pair.accessKeyId,
+                    ]);
+                    throw new Error(`${at}: the storage key ${pair.tokenId} could not be delivered after ${attempts} tries; the next run deletes it and makes a new one (last try: ${cause})`);
+                }
+                await sleep(1000 * attempt);
+            }
+        }
+        context.recordScopeId(OWN_FILES_R2_SCOPE_KEY, pair.tokenId);
+        forgetScopeId(context, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY);
+        await context.persistScopeIds();
+        return { resourceId: pair.tokenId };
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnAuth`: the org's own sign-in at
+     * `auth.<domain>`, in the org's own project, through the org's own edge
+     * routed DNS and tunnel ports. The instance owner token goes to
+     * `zitadel:org:<slug>:instanceBearer` and is never recorded. A changed
+     * declared auth ref patches both git apps' branch and redeploys them; the
+     * applied marker comes last, so a run that died halfway is planned again.
+     */
+    async ownAuth(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const hostname = action.desired.hostname;
+        const gitRef = action.desired.gitRef;
+        const hn = ownHostnames(org);
+        const scope = scopeFromOrg(context, {});
+        // The target (host, port, tls, user) is not secret; the platform's SMTP
+        // password is, so the company's own token is the password instead.
+        const { smtp, ...authDeps } = own.provision.auth;
+        const deps = {
+            ...authDeps,
+            ...(smtp
+                ? { smtp: { host: smtp.host, port: smtp.port, tls: smtp.tls, user: smtp.user } }
+                : {}),
+            coolify: limited(this.placedForCompany(own.provision.auth.coolify, org, context), LIMITS.ownAuth),
+            runtime: {
+                ...own.provision.auth.runtime,
+                onSecret: (value) => {
+                    this.handledSecrets.add(value);
+                },
+            },
+        };
+        const before = scope.recordedIds();
+        const refChanged = before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== undefined &&
+            before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+        const gitApps = [
+            before[PLATFORM_AUTH_LOGIN_SCOPE_KEY],
+            before[PLATFORM_AUTH_BROKER_SCOPE_KEY],
+        ].filter((id) => Boolean(id));
+        if (refChanged) {
+            for (const id of gitApps)
+                await deps.coolify.updateApplication(id, { git_branch: gitRef });
+        }
+        await this.ensureOwnAuthMailToken(org, hn.mailDomain, deps);
+        const result = await provisionAuthStack(scope, deps, orgTarget(org), {
+            hostname,
+            apex: hn.zone,
+            gitRef,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:auth`),
+            smtpSender: `noreply@${hn.mailDomain}`,
+            defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
+            ownerCompany: null,
+        });
+        if (refChanged) {
+            const now = scope.recordedIds();
+            const brokerDeployed = Boolean(now[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY]);
+            for (const id of gitApps) {
+                // The broker crash-loops until its inputs exist; it was never deployed, so it is not now.
+                if (id === now[PLATFORM_AUTH_BROKER_SCOPE_KEY] && !brokerDeployed)
+                    continue;
+                await deps.coolify.deploy(id, true);
+            }
+        }
+        scope.recordScopeId(OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+        scope.recordScopeId(OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
+        scope.recordScopeId(OWN_SERVICES_APPLIED_SCOPE_KEY, org.id);
+        await scope.persist();
+        return result;
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own
+     * project, publishing its port 25 on one host port of the server (the shared
+     * relay is on another network and dials the server's address) and a directory
+     * that trusts the org's own sign-in. The admin key goes to
+     * `orgTarget(org).refs.mailAdminKey` and nowhere else. The address the relay
+     * routes to is recorded last, and the step's marker after it.
+     */
+    async ownMail(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const hn = ownHostnames(org);
+        const target = orgTarget(org);
+        const scope = scopeFromOrg(context, {});
+        const issuerUrl = hn.issuerUrl;
+        const smtpPort = action.desired.smtpPort;
+        if (!isOwnMailSmtpPort(smtpPort)) {
+            throw new Error(`coolify:own-mail for ${org.slug}: the plan gives no valid mail port`);
+        }
+        const bind = this.ports.mailBindAddress;
+        if (bind !== undefined && !isIpv4Address(bind)) {
+            throw new Error(`coolify:own-mail for ${org.slug}: the mail bind address is not an IPv4 address`);
+        }
+        const coolify = this.placedForCompany(own.provision.mail.coolify, org, context);
+        const result = await provisionMailServer(scope, {
+            ...own.provision.mail,
+            coolify: limited(coolify, LIMITS.ownMail),
+            deliverSecret: (ref, secret) => {
+                this.handledSecrets.add(secret);
+                return this.ports.deliverSecret(ref, secret);
+            },
+            stalwartForInstance: (input) => {
+                this.handledSecrets.add(input.password);
+                return (own.provision.mail.stalwartForInstance ?? defaultStalwartForInstance)(input);
+            },
+            zitadel: own.zitadelFor({ issuerUrl, bearerRef: target.refs.instanceBearer }),
+            zitadelForInstance: undefined,
+        }, target, {
+            hostname: action.desired.hostname,
+            apex: hn.mailDomain,
+            zone: hn.zone,
+            mailHost: action.desired.mailHost,
+            imageTag: action.desired.gitRef,
+            hostPorts: bind ? `${bind}:${smtpPort}:25` : `${smtpPort}:25`,
+            issuerUrl,
+            mxRecord: null,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:mail`),
+        });
+        // The relay is on the platform's network, so it reaches the company's Stalwart through the server's
+        // address and the port published above. The port is recorded first, then the address the relay is given.
+        const mailServer = (await coolify.listServers()).find((s) => s.uuid === context.recordedIds()[PLATFORM_MAIL_SERVER_SCOPE_KEY]);
+        const wanted = this.ports.mailRelayTarget?.({ serverAddress: mailServer?.ip, port: smtpPort }) ??
+            (bind ? `${bind}:${smtpPort}` : mailServer?.ip ? `${mailServer.ip}:${smtpPort}` : null);
+        const relayTarget = wanted ? normalizeMailTarget(wanted) : null;
+        if (!relayTarget) {
+            throw new Error(`coolify:own-mail for ${org.slug}: the mail server has no address the relay can dial`);
+        }
+        scope.recordScopeId(OWN_MAIL_SMTP_PORT_SCOPE_KEY, String(smtpPort));
+        scope.recordScopeId(OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, relayTarget);
+        await scope.persist();
+        return result;
+    }
+    /**
+     * `plan/own-diff.ts`'s `planOwnSfu`: the org's own LiveKit server in the
+     * org's project, on the ports of its slot. The company's key pair goes to
+     * `livekit:org:<slug>:keys` and the app's env, nowhere else.
+     */
+    async ownSfu(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const scope = scopeFromOrg(context, {});
+        const { sfu } = own.provision;
+        return provisionSfuApp(scope, {
+            coolify: limited(this.placedForCompany(sfu.coolify, org, context), LIMITS.ownSfu),
+            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:sfu`),
+            deliverSecret: sfu.deliverSecret,
+            readSecret: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
+            runtime: this.ports.runtime ?? {},
+            ...(sfu.mintLivekitCredentials
+                ? { mintLivekitCredentials: sfu.mintLivekitCredentials }
+                : {}),
+            onSecret: (value) => this.handledSecrets.add(value),
+        }, orgTarget(org), {
+            slot: action.desired.slot,
+            hostname: action.desired.hostname,
+            apex: ownHostnames(org).zone,
+            version: action.desired.version,
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+        });
+    }
     async jobsRegistration(action, org, context) {
         const scheduler = await this.jobsPort(org);
         const name = action.desired.name;
@@ -5138,15 +5980,19 @@ export class FoundryStepExecutor {
         // login app (the same container the platform auth tunnel routes to), not
         // through Coolify's proxy, which has no route for it.
         const loginHost = action.desired.loginHost ?? null;
+        // A hosting entry's names (and its wildcard) go straight to its container on the company network:
+        // the container carries `traefik.enable=false`, so the proxy has no route for it.
+        const entryOrigins = new Map(entryRoutes(org).map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
                 ? `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`
-                : COOLIFY_PROXY_ORIGIN,
+                : (entryOrigins.get(hostname) ?? COOLIFY_PROXY_ORIGIN),
         }));
         await this.tunnelPort().putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
         });
+        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org));
         // #235: a connector for this org's own tunnel, the same call every
         // platform tunnel step already makes (Decided, William, 2026-10-01:
         // one connector per org tunnel, never a shared tunnel with appended
@@ -5245,8 +6091,77 @@ export class FoundryStepExecutor {
                 context.recordScopeId(CLOUDFLARE_TUNNEL_PREVIOUS_IDS_SCOPE_KEY, '');
             }
         }
+        await this.publishOikosEntryRecords(org, tunnel.id, previousIds, context);
         return { resourceId: tunnel.id };
     }
+    /**
+     * The entry names a company has in the platform's `oikos.host` zone (a company with no domain of its own):
+     * one proxied CNAME each, to this company's tunnel, which routes them straight to the entry container. A
+     * specific record beats the shared `*.oikos.host` wildcard, so the shared ingress stops carrying the name
+     * without being edited. The company writes only its own `<slug>.oikos.host` ({@link ownsOikosName}); an
+     * A or AAAA record, or a CNAME that points anywhere but this tunnel, an earlier id of it or the shared
+     * wildcard's target, blocks the step. A name the company no longer declares has its record deleted when
+     * it still points at this tunnel. The names are recorded only after every record is in place, so a failure
+     * halfway is planned again.
+     */
+    async publishOikosEntryRecords(org, tunnelId, previousIds, context) {
+        const wanted = entryOikosHostnames(org);
+        const recorded = context.recordedIds()[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+        const previous = recorded ? recorded.split(',') : [];
+        if (wanted.length === 0 && previous.length === 0)
+            return;
+        for (const name of wanted) {
+            if (!ownsOikosName(org, name)) {
+                throw new Error(`cloudflare:tunnel for ${org.slug}: ${name} is not a name this company may write in the ${NO_DOMAIN_ZONE} zone`);
+            }
+        }
+        const zone = await this.zonePort().findZoneByApex(NO_DOMAIN_ZONE);
+        if (!zone) {
+            throw new Error(`cloudflare:tunnel for ${org.slug}: no Cloudflare zone found for ${NO_DOMAIN_ZONE} to point its entry names at`);
+        }
+        const dns = this.dnsPort();
+        const dnsTarget = `${tunnelId}.cfargotunnel.com`;
+        const ownTargets = new Set([
+            dnsTarget,
+            ...[...previousIds].map((id) => `${id}.cfargotunnel.com`),
+        ]);
+        const [shared] = await dns.findDnsRecord(zone.name, `*.${NO_DOMAIN_ZONE}`, 'CNAME');
+        const writes = [];
+        const conflicts = [];
+        for (const name of wanted) {
+            const [a] = await dns.findDnsRecord(zone.name, name, 'A');
+            const [aaaa] = await dns.findDnsRecord(zone.name, name, 'AAAA');
+            if (a ?? aaaa) {
+                conflicts.push(`${name} already has an ${(a ?? aaaa)?.type} record`);
+                continue;
+            }
+            const [cname] = await dns.findDnsRecord(zone.name, name, 'CNAME');
+            const record = { type: 'CNAME', name, content: dnsTarget, proxied: true };
+            if (!cname)
+                writes.push(() => dns.createDnsRecord(zone.name, record));
+            else if (cname.content === dnsTarget)
+                continue;
+            else if (ownTargets.has(cname.content) || cname.content === shared?.content) {
+                writes.push(() => dns.updateDnsRecord(zone.name, cname.id, record));
+            }
+            else
+                conflicts.push(`${name} is already a CNAME to ${cname.content}`);
+        }
+        if (conflicts.length > 0) {
+            throw new Error(`cloudflare:tunnel for ${org.slug}: will not point its tunnel at every entry name -- ${conflicts.join('; ')}; remove the conflicting record first`);
+        }
+        for (const write of writes)
+            await write();
+        for (const name of previous.filter((n) => !wanted.includes(n))) {
+            if (!ownsOikosName(org, name))
+                continue;
+            for (const record of await dns.findDnsRecord(zone.name, name, 'CNAME')) {
+                if (ownTargets.has(record.content))
+                    await dns.deleteDnsRecord(zone.name, record.id);
+            }
+        }
+        context.recordScopeId(CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, wanted.join(','));
+    }
     /**
      * #236: when this tunnel's DNS was last published under a domain that
      * differs from the one `org` now declares, deletes every CNAME in the
@@ -5563,7 +6478,7 @@ export class FoundryStepExecutor {
         }
         const mailOrg = mailOrgFor(org, usesDomain, mode);
         const result = await this.ports.mail.applyOrgMail(mailOrg, options);
-        await this.publishMailDnsRecords(org, result);
+        await this.publishMailDnsRecords(org, result, context);
         await this.deleteStaleLettermintDomain(context, result.domain, platformApex);
         context.recordScopeId(MAIL_DOMAIN_SCOPE_KEY, result.domain);
         await this.ensureOwnerMailbox(org, mailOrg, options, context);
@@ -5694,15 +6609,49 @@ export class FoundryStepExecutor {
      * call, since Stalwart mints the key on a background task; the next apply
      * publishes it.
      */
-    async publishMailDnsRecords(org, result) {
+    async publishMailDnsRecords(org, result, context) {
         const zone = await this.zonePort().findZoneByApex(result.domain);
         if (!zone) {
             throw new Error(`coolify:mail for ${org.slug}: no Cloudflare zone found for ${result.domain}`);
         }
+        if (ownsServices(org) && result.domain.toLowerCase() === `${org.slug}.${NO_DOMAIN_ZONE}`) {
+            await this.ensureOwnWebAddressRecord(org, zone.name, context);
+        }
         for (const record of result.records) {
             await this.upsertMailDnsRecord(zone.name, record);
         }
     }
+    /**
+     * A company without a domain keeps its web address at `<slug>.oikos.host`,
+     * which only the shared `*.oikos.host` wildcard answers. A wildcard applies
+     * only to a name that holds no record of its own, so the MX and TXT records
+     * of the company's mail domain on that same name would take the web address
+     * away. This writes the name's own proxied CNAME, to wherever the wildcard
+     * points, before any mail record. Found by name and type, so a rerun after a
+     * half-finished apply never doubles it. Cloudflare lists only A, AAAA and
+     * CNAME as clashing with a CNAME, so MX and TXT sit beside it.
+     * https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/
+     * https://developers.cloudflare.com/dns/manage-dns-records/troubleshooting/records-with-same-name/
+     */
+    async ensureOwnWebAddressRecord(org, zone, context) {
+        const dns = this.dnsPort();
+        const name = `${org.slug}.${NO_DOMAIN_ZONE}`;
+        // The company's own tunnel already carries this name (an entry is served at it): that record is ours.
+        const own = context.recordedIds()[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+        if (own?.split(',').includes(name))
+            return;
+        const [wildcard] = await dns.findDnsRecord(zone, `*.${NO_DOMAIN_ZONE}`, 'CNAME');
+        if (!wildcard) {
+            throw new Error(`coolify:mail for ${org.slug}: the zone ${zone} has no *.${NO_DOMAIN_ZONE} record to copy, so ${name} would stop answering once its mail records exist`);
+        }
+        const record = { type: 'CNAME', name, content: wildcard.content, proxied: true };
+        const [existing] = await dns.findDnsRecord(zone, name, 'CNAME');
+        if (!existing)
+            await dns.createDnsRecord(zone, record);
+        else if (existing.content !== wildcard.content) {
+            await dns.updateDnsRecord(zone, existing.id, record);
+        }
+    }
     /**
      * Creates or updates one mail record (Stalwart's or Lettermint's).
      *
@@ -5759,6 +6708,11 @@ export class FoundryStepExecutor {
      * #491: when `mailDomain` is the platform's own apex, this must never
      * delete the platform's own project (the delete loop skips it by id) or
      * the platform's own domain (returns before the domain lookup/delete).
+     *
+     * An org whose own sign-in is applied keeps its `<slug>-auth` project, and
+     * keeps the Lettermint domain when that is the domain the sign-in sends
+     * from. Every other org deletes `<slug>-auth` too, which only a failed
+     * first sign-in run can have left behind.
      */
     async parkLettermintMail(org, mailOrg, context, platformApex, platformLettermintProjectId) {
         const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
@@ -5768,7 +6722,13 @@ export class FoundryStepExecutor {
         // #345: `mailOrg.domain` is absent for a level-1 org -- the previously
         // recorded mail domain is the one `MailPort.removeOrgRelay` needs.
         await this.ports.mail.removeOrgRelay({ ...mailOrg, domain: mailDomain });
+        // An own org's sign-in sends its mail through `<slug>-auth` and the domain it
+        // applied at; parking the org's mail leaves both, or the sign-in can no
+        // longer send (its held token would still resolve, so nothing re-mints it).
+        const ownSignIn = ownsServices(org) && ownAuthApplied(org, context.recordedIds());
         const names = new Set([`${org.slug}-app`, `${org.slug}-relay`]);
+        if (!ownSignIn)
+            names.add(`${org.slug}-auth`);
         const projects = await this.ports.lettermint.listProjects();
         for (const project of projects) {
             if (names.has(project.name) && project.id !== platformLettermintProjectId) {
@@ -5777,6 +6737,8 @@ export class FoundryStepExecutor {
         }
         if (isPlatformApexOrg)
             return;
+        if (ownSignIn && mailDomain.toLowerCase() === ownHostnames(org).mailDomain.toLowerCase())
+            return;
         const domain = await this.findExactLettermintDomain(mailDomain);
         if (domain)
             await this.ports.lettermint.deleteDomain(domain.id);
@@ -6711,6 +7673,29 @@ export class FoundryStepExecutor {
                                 throw error;
                         }
                     }
+                    // The entry names it has in the platform's oikos.host zone (its own `<slug>.oikos.host` only).
+                    const oikosNames = (recordedIds[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY] ?? '')
+                        .split(',')
+                        .filter((name) => name !== '' && ownsOikosName(org, name));
+                    if (oikosNames.length > 0) {
+                        try {
+                            const zone = await this.zonePort().findZoneByApex(NO_DOMAIN_ZONE);
+                            if (zone) {
+                                const dns = this.dnsPort();
+                                for (const name of oikosNames) {
+                                    for (const record of await dns.findDnsRecord(zone.name, name, 'CNAME')) {
+                                        if (dnsTargets.has(record.content)) {
+                                            await dns.deleteDnsRecord(zone.name, record.id);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        catch (error) {
+                            if (!isNotFoundError(error))
+                                throw error;
+                        }
+                    }
                     await this.tunnelPort().deleteTunnel(target.id);
                     return;
                 }
@@ -6779,6 +7764,23 @@ export class FoundryStepExecutor {
                 case 'coolify:database':
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;
+                case 'coolify:own-files-r2': {
+                    // An own files bucket's storage key; a 404 is caught below as already gone.
+                    const r2Keys = this.ports.ownServices?.provision.files.r2Keys;
+                    if (!r2Keys) {
+                        throw new Error(`coolify:own-files-r2 for ${org.slug}: this host supplies no R2 key port, cannot delete token ${target.id}`);
+                    }
+                    try {
+                        await withTimeout(r2Keys.deleteBucketKey(target.id), R2_KEY_TIMEOUT_MS);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message === 'timeout') {
+                            throw new Error(`coolify:own-files-r2 for ${org.slug}: deleting token ${target.id} did not answer within ${R2_KEY_TIMEOUT_MS / 1000} seconds`);
+                        }
+                        throw error;
+                    }
+                    return;
+                }
                 case 'zitadel:app': {
                     const zitadelOrgId = recordedIds.zitadel_org;
                     const projectId = recordedIds.zitadel_project;