@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/plan/executor.js

@@ -4,21 +4,25 @@ import { URL } from 'node:url';
 import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, filesCollectionEnvName, heldEnvRef, isMainEntry, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
 import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
-import { BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
+import { BACKUP_POSTGRES_DATABASES_SCOPE_KEY, BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
+import { LOGIN_COOKIE_DOMAIN_SCOPE_KEY } from './cookie-domain.js';
 import { previewsOn } from './coolify-previews.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
-import { waitForNewDeployment, } from './deploy-health.js';
+import { waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
+import { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_DOCKERFILE, DESKTOP_AUTH_HOME, DESKTOP_AUTH_ORIGIN_SCOPE_KEY, DESKTOP_AUTH_READY_PATH, DESKTOP_AUTH_READY_SCOPE_KEY, DESKTOP_AUTH_REDIRECT_SCOPE_KEY, DESKTOP_AUTH_REVISION_SCOPE_KEY, desktopAuthCallbackUri, desktopAuthEnv, desktopAuthInputs, desktopAuthRedirectUnsupported, desktopAuthRevision, } from './desktop-auth.js';
+import { desktopCallbackUri, unionRedirectUris, zitadelAppDesktopCallbackAppliedScopeKey, } from './desktop-callback.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
 import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
@@ -33,11 +37,13 @@ import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate }
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
 import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
 import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
 import { applyAccessTokenLifetime, applyMcpAccess, applyMcpProject } from './mcp.js';
 import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
+import { ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, migrateHomeOf, migrateOrgPostgresHome, parseMigrationConfirmation, } from './org-postgres-migrate.js';
+import { orgPostgresSecretRef, provisionOrgPostgresDatabases, provisionOrgPostgresServer, serviceEndpoint, serviceOnServer, serviceUrls, } from './org-postgres.js';
 import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
 import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
 import { LIMITS, limited } from './own-limits.js';
@@ -46,6 +52,7 @@ import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
 import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
+import { companyAppPostLogoutUris, postLogoutAppliedValue, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { createReleaseHost } from './release-host.js';
 import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
@@ -86,8 +93,8 @@ export function coolifyProjectMark(org) {
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
  * -- into {@link ZitadelPort.listApps}'s own shape, so a host wiring that
  * real client in satisfies this port without reaching into `executor.ts`
- * itself to build the wrapper by hand. `complete: true` on every call:
- * since providers 0.7.4 the real client pages `_search` to the end. A host
+ * itself to build the wrapper by hand. `complete` is true only when the client
+ * has `getApp` (#557; providers 0.12.0, which pages `_search` to the end). A host
  * that supplies its own `listApps` keeps whatever `complete` it reports.
  * Each app's `clientId` (providers 0.7.5) passes through. `loginBaseUri` comes back `undefined`
  * for every app for the identical reason -- the real client does not read
@@ -99,9 +106,10 @@ export function coolifyProjectMark(org) {
 export function adaptZitadelListApps(client) {
     return async (orgId, projectId) => ({
         apps: await client.listApps(orgId, projectId),
-        // Sound because package.json requires providers >=0.7.4 as a peer: from
-        // there `listApps` pages `_search` to the end, so this read every app.
-        complete: true,
+        // #557: `getApp` arrived with providers 0.12.0, after `listApps` paged to
+        // the end (0.7.4), so a client that has it read every app. An older one
+        // may have returned a first page only; the peer range alone cannot tell.
+        complete: typeof client.getApp === 'function',
     });
 }
 /** An outside call for Boule's credentials that has not answered in this long fails the step; the next apply repairs it. */
@@ -203,7 +211,7 @@ export function callsHostnameFor(org) {
  */
 export function healthUrls(org) {
     // One URL per entry that has a public name; an internal entry has none.
-    if (org.hosting.enabled && appEntry(org.hosting)) {
+    if (org.hosting.enabled && org.hosting.entries.length > 0) {
         return org.hosting.entries.flatMap((entry) => {
             const [hostname] = entryHostnames(org, entry);
             if (!hostname)
@@ -890,6 +898,7 @@ function limitProfileOf(action) {
         case 'coolify:calls-chat':
             return LIMITS.calls;
         case 'coolify:agora':
+        case 'coolify:desktop-auth':
             return LIMITS.agora;
         case 'coolify:boule':
         case 'coolify:boule-broker-entry':
@@ -904,6 +913,10 @@ function limitProfileOf(action) {
             return action.system === 'coolify' ? LIMITS.companyOther : undefined;
     }
 }
+/** The cookie domain a login-host action carries: a bare lower-case domain of two or more labels, else none. */
+function inAppCookieDomain(value) {
+    return typeof value === 'string' && /^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(value) ? value : undefined;
+}
 export class FoundryStepExecutor {
     edgeDns;
     edgeTunnels;
@@ -1127,6 +1140,10 @@ export class FoundryStepExecutor {
                 return this.zitadelApp(action, org, context);
             case 'zitadel:id-token-userinfo':
                 return this.zitadelIdTokenUserinfo(action, org, context);
+            case 'zitadel:post-logout-uris':
+                return this.zitadelPostLogoutUris(action, org, context);
+            case 'zitadel:desktop-callback':
+                return this.zitadelDesktopCallback(action, org, context);
             case 'zitadel:customers':
                 return this.zitadelCustomers(action, org, context);
             case 'zitadel:mcp-project':
@@ -1147,6 +1164,12 @@ export class FoundryStepExecutor {
                 return this.coolifyBrokerEntry(action, org, context);
             case 'coolify:database':
                 return this.coolifyDatabase(action, org, context);
+            case 'coolify:org-postgres':
+                return this.orgPostgresServer(org, context);
+            case 'coolify:org-postgres-databases':
+                return this.orgPostgresDatabases(action, org, context);
+            case 'coolify:org-postgres-migrate':
+                return this.orgPostgresMigrate(action, org, context);
             case 'coolify:backup':
                 return this.coolifyBackup(action, org, context);
             case 'coolify:calls':
@@ -1204,8 +1227,12 @@ export class FoundryStepExecutor {
                 return this.cmsSite(action, org, context);
             case 'coolify:agora':
                 return this.coolifyAgora(action, org, context);
+            case 'coolify:desktop-auth':
+                return this.coolifyDesktopAuth(action, org, context);
             case 'coolify:boule':
                 return this.coolifyBoule(action, org, context);
+            case 'coolify:boule-owners':
+                return this.bouleOwners(org, context);
             case 'coolify:boule-broker-entry':
                 return this.bouleBrokerEntry(org, context);
             case 'jobs:registration':
@@ -1407,6 +1434,7 @@ export class FoundryStepExecutor {
                 throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
             }
             // The other variant of foundry's own rule holds the zone's one slot: remove it, then make this one.
+            // Known gap: between the delete and the create the zone has no rate limit (the Free plan has one slot).
             const stale = rules.find((r) => ours.includes(r.description ?? ''));
             if (stale) {
                 if (!rateLimits.deleteRateLimitRule) {
@@ -1874,6 +1902,96 @@ export class FoundryStepExecutor {
         }
         return {};
     }
+    /**
+     * Replaces the post-logout redirect URIs of each live app the planner named.
+     * An app's marker (its id and the set it holds) is recorded and persisted
+     * only after its call returned, so a call that throws leaves none and the
+     * next plan names the app again. The error names ids only, never the cause.
+     */
+    async zitadelPostLogoutUris(action, org, context) {
+        const update = this.ports.zitadel.updateOidcAppPostLogoutRedirectUris?.bind(this.ports.zitadel);
+        // The planner plans nothing without the method; a stale plan does nothing.
+        if (!update)
+            return {};
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded.zitadel_org;
+        const projectId = recorded.zitadel_project;
+        if (!zitadelOrgId || !projectId) {
+            throw new Error(`zitadel:post-logout-uris for ${org.slug}: no ZITADEL org and project recorded yet -- the issuer must be provisioned first`);
+        }
+        for (const appKey of action.desired.apps) {
+            const appId = recorded[`zitadel:app:${appKey}`];
+            if (!appId)
+                continue;
+            // From the declared org, never from the plan, so a stale plan writes the current set.
+            const uris = companyAppPostLogoutUris(org, appKey);
+            if (uris.length === 0)
+                continue;
+            try {
+                await update(zitadelOrgId, projectId, appId, uris);
+            }
+            catch {
+                throw new Error(`zitadel:post-logout-uris for ${org.slug}: updating the post-logout addresses failed for app '${appKey}' (${appId})`);
+            }
+            context.recordScopeId(zitadelAppPostLogoutAppliedScopeKey(appKey), postLogoutAppliedValue(appId, uris));
+            await context.persistScopeIds();
+        }
+        return {};
+    }
+    /**
+     * #339: registers `/auth/desktop/callback` on each live web sign-in app the
+     * planner named, keeping every redirect URI the app already holds (the
+     * union of the current list and the wanted one; a write only when the
+     * union is larger). An app's marker (its ZITADEL app id) is recorded and
+     * persisted only after its read and write resolved, so a failure leaves no
+     * marker and the next plan names the app again. The error names ids only,
+     * never the cause.
+     */
+    async zitadelDesktopCallback(action, org, context) {
+        const read = this.ports.zitadel.getOidcAppRedirectUris?.bind(this.ports.zitadel);
+        const write = this.ports.zitadel.updateOidcAppRedirectUris?.bind(this.ports.zitadel);
+        // The planner plans nothing without the methods; a stale plan does nothing.
+        if (!read || !write)
+            return {};
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded.zitadel_org;
+        const projectId = recorded.zitadel_project;
+        if (!zitadelOrgId || !projectId) {
+            throw new Error(`zitadel:desktop-callback for ${org.slug}: no ZITADEL org and project recorded yet -- the issuer must be provisioned first`);
+        }
+        for (const appKey of action.desired.apps) {
+            const appId = recorded[`zitadel:app:${appKey}`];
+            if (!appId)
+                continue;
+            const wanted = this.signInHostnames(org, appKey).map(desktopCallbackUri);
+            try {
+                const current = await read(zitadelOrgId, projectId, appId);
+                const union = unionRedirectUris(current, wanted);
+                if (union.length > current.length)
+                    await write(zitadelOrgId, projectId, appId, union);
+            }
+            catch {
+                throw new Error(`zitadel:desktop-callback for ${org.slug}: registering the desktop callback failed for app '${appKey}' (${appId})`);
+            }
+            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(appKey), appId);
+            await context.persistScopeIds();
+        }
+        return {};
+    }
+    /**
+     * The hostnames a company web app signs in at: the same rule `zitadelApp`
+     * uses for the redirect URIs it creates the app with.
+     */
+    signInHostnames(org, appKey) {
+        const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
+        if (appKey === 'cms' && org.site.enabled)
+            return [cmsHostnameFor(org)];
+        if (appKey === 'boule')
+            return [bouleHostnameFor(org)];
+        if (authEntry)
+            return entryHostnames(org, authEntry);
+        return [appHostname(org)];
+    }
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted
@@ -1883,10 +2001,12 @@ export class FoundryStepExecutor {
      *
      * In-app sign-in (`signIn.inApp`, `plan/sign-in.ts` has the order): an app host is trusted first. It is
      * bound, and its app pointed at `/sign-in/`, only once its app runs `SIGNIN_UPSTREAM` (the app step
-     * records that). The bind moves the app's client id off the company's binding in the same write (the
-     * login refuses a client id in two bindings); a company binding left with no client is removed.
-     * Switched off, the client id goes back and the base URI returns to the login host, and a trusted
-     * domain is given up only after the app dropped the env.
+     * records that). From auth 0.28.0 the move is three writes (the login then allows one client in two
+     * bindings of one company): the app host's binding with the id kept on the company's, the base URI, then
+     * the company's binding without the id. Before it, one write moves the id (the login refuses a client in
+     * two bindings) and a short gap follows. A company binding left with no client is removed.
+     * Switched off, the id goes back to the company binding, then the base URI returns to the login host, then
+     * the app binding goes; a trusted domain is given up only after the app dropped the env.
      *
      * #274: when the org's host has moved (`recorded[key]`, the *previous*
      * run's resourceId, differs from this run's `host`), also removes every
@@ -1985,6 +2105,55 @@ export class FoundryStepExecutor {
         const envLive = signInEnvLiveHosts(recorded);
         // The login refuses a client id held by two bindings: an active app host's client id is in its own binding only.
         const clientIds = loginHostClientIds(org, recorded, activePairs.map((pair) => pair.clientId));
+        let deferredUnbound = [];
+        // From the login release that lets one client sit in two bindings of one company, an app host's client id
+        // moves in three writes: the app host's binding with the id kept on the company's, then the base URI, then
+        // the company's binding without it. Sign-in works at every point. Before that release: one write, and a
+        // short gap between it and the base URI.
+        const authReleased = action.desired.authReleased === true;
+        const companyIdsBefore = new Set((recorded[LOGIN_BINDING_SCOPE_KEY]?.startsWith(`${host} `)
+            ? recorded[LOGIN_BINDING_SCOPE_KEY].slice(host.length + 1)
+            : '')
+            .split(',')
+            .filter((id) => id.length > 0));
+        const movedIds = new Set(!own && authReleased
+            ? activePairs.map((pair) => pair.clientId).filter((id) => companyIdsBefore.has(id))
+            : []);
+        const threeStep = movedIds.size > 0;
+        const firstWriteIds = threeStep
+            ? loginHostClientIds(org, recorded, activePairs.map((pair) => pair.clientId).filter((id) => !movedIds.has(id)))
+            : clientIds;
+        const cookieDomain = inAppCookieDomain(action.desired.cookieDomain);
+        const writeCompanyBinding = async (ids) => {
+            if (ids.length > 0 || activePairs.length === 0) {
+                await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds: ids });
+            }
+            else {
+                // Every client of the company signs in on its app's own address: the login refuses a binding
+                // with no client ids, so the company's own binding goes (nothing signs in on this host).
+                try {
+                    await bindings.deleteBinding(host);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
+        };
+        // The customers clients and the organisation each signs in to, for the shared login host to check.
+        const wantedOrgs = customersClientOrganizations(org, recorded);
+        const staleOrgIds = clientOrganizationIds(recorded[LOGIN_CLIENT_ORGS_SCOPE_KEY]).filter((id) => !(id in wantedOrgs));
+        const orgsWritable = (Object.keys(wantedOrgs).length === 0 || Boolean(bindings.upsertClientOrganizations)) &&
+            (staleOrgIds.length === 0 || Boolean(bindings.deleteClientOrganizations));
+        const writeClientOrgs = async () => {
+            if (!orgsWritable)
+                return;
+            if (Object.keys(wantedOrgs).length > 0) {
+                await bindings.upsertClientOrganizations?.(wantedOrgs);
+            }
+            if (staleOrgIds.length > 0)
+                await bindings.deleteClientOrganizations?.(staleOrgIds);
+        };
         if (!shared) {
             // The company's own login host is its instance's external domain: trusted and routed already.
             if (!own)
@@ -1994,10 +2163,12 @@ export class FoundryStepExecutor {
                 await this.ports.zitadel.ensureTrustedDomain(app.host);
             // An app host bound before and not active now gives its client id back to the company's binding:
             // its own binding goes first, so no write leaves the id in two bindings.
+            // From the release that allows it the company's binding takes the id back first and the app host's
+            // binding goes after the base URI (below), so no write leaves a client without a binding.
+            const unboundHosts = inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY]).filter((old) => !activeHosts.has(old));
+            deferredUnbound = authReleased && !own ? unboundHosts : [];
             let unbound = false;
-            for (const old of inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY])) {
-                if (activeHosts.has(old))
-                    continue;
+            for (const old of authReleased && !own ? [] : unboundHosts) {
                 try {
                     await bindings.deleteBinding(old);
                 }
@@ -2011,27 +2182,20 @@ export class FoundryStepExecutor {
                 await bindings.flush?.();
             // zitadel-login's own routing table, written before any app is repointed
             // so no app ever points at a host with no binding.
-            if (!own) {
-                if (clientIds.length > 0 || activePairs.length === 0) {
-                    await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
-                }
-                else {
-                    // Every client of the company signs in on its app's own address: the login refuses a binding
-                    // with no client ids, so the company's own binding goes (nothing signs in on this host).
-                    try {
-                        await bindings.deleteBinding(host);
-                    }
-                    catch (error) {
-                        if (!isNotFoundError(error))
-                            throw error;
-                    }
-                }
-            }
+            if (!own)
+                await writeCompanyBinding(firstWriteIds);
             for (const app of inApp) {
                 if (!activeHosts.has(app.host))
                     continue;
-                await bindings.upsertBinding({ ...inAppBindingFor(app), organizationId: zitadelOrgId });
+                await bindings.upsertBinding({
+                    ...inAppBindingFor(app),
+                    organizationId: zitadelOrgId,
+                    ...(cookieDomain && (app.host === cookieDomain || app.host.endsWith(`.${cookieDomain}`))
+                        ? { cookieDomain }
+                        : {}),
+                });
             }
+            await writeClientOrgs();
             // One write for every upsert above (one redeploy of the login), before any app is repointed.
             await bindings.flush?.();
             if (own && activeHosts.size > 0) {
@@ -2070,11 +2234,28 @@ export class FoundryStepExecutor {
         // on), and nothing to repoint either.
         let liveApps = [];
         let listingComplete = true;
+        // #580: a customers entry's app signs in on the shared host, wherever its base URI points now.
+        // A company's own instance has no shared host to move to.
+        const customersAppIds = new Set();
+        const sharedBaseUri = own
+            ? null
+            : await this.ports.platformOrg?.authHostname?.().then((h) => (h ? `https://${h}/` : null));
+        if (sharedBaseUri) {
+            for (const key of customersKeys) {
+                const appId = recorded[`zitadel:app:${key}`];
+                if (appId)
+                    customersAppIds.add(appId);
+            }
+        }
         if (projectId) {
             const listed = await this.ports.zitadel.listApps(zitadelOrgId, projectId);
             listingComplete = listed.complete;
             liveApps = listed.apps.filter((app) => app.state !== 'APP_STATE_REMOVED');
             for (const app of liveApps) {
+                if (sharedBaseUri && customersAppIds.has(app.id)) {
+                    await setOidcAppLoginBaseUri(this.ports.zitadel, zitadelOrgId, projectId, app.id, sharedBaseUri);
+                    continue;
+                }
                 if (!boundAppIds.has(app.id))
                     continue;
                 // A company's own instance has the login host as its default; only the in-app apps move.
@@ -2083,6 +2264,27 @@ export class FoundryStepExecutor {
                 await setOidcAppLoginBaseUri(this.ports.zitadel, zitadelOrgId, projectId, app.id, baseUriOf(app.id));
             }
         }
+        // The base URIs are set: the company's binding gives up the ids that moved to the app hosts, and an app
+        // host given up goes last.
+        if (!shared) {
+            if (threeStep)
+                await writeCompanyBinding(clientIds);
+            for (const old of deferredUnbound) {
+                try {
+                    await bindings.deleteBinding(old);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
+            if (threeStep || deferredUnbound.length > 0)
+                await bindings.flush?.();
+        }
+        else if (orgsWritable) {
+            await writeClientOrgs();
+            await bindings.flush?.();
+        }
         // Fix round 3 point 5: a bound app's current base URI is `host` for
         // certain, just set above, whatever `listApps` read before that --
         // never its stale pre-repoint snapshot. Every other live app's is
@@ -2092,7 +2294,11 @@ export class FoundryStepExecutor {
         // compare against, same as an app this loop never visits at all.
         const currentLoginBaseUris = new Set();
         for (const app of liveApps) {
-            const uri = boundAppIds.has(app.id) ? baseUriOf(app.id) : app.loginBaseUri;
+            const uri = customersAppIds.has(app.id) && sharedBaseUri
+                ? sharedBaseUri
+                : boundAppIds.has(app.id)
+                    ? baseUriOf(app.id)
+                    : app.loginBaseUri;
             if (typeof uri === 'string')
                 currentLoginBaseUris.add(normalizedLoginBaseUri(uri));
         }
@@ -2177,9 +2383,15 @@ export class FoundryStepExecutor {
         else {
             if (!own)
                 context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+            if (!own) {
+                context.recordScopeId(LOGIN_COOKIE_DOMAIN_SCOPE_KEY, activePairs.length > 0 && cookieDomain ? cookieDomain : '');
+            }
             context.recordScopeId(SIGN_IN_TRUSTED_SCOPE_KEY, targets.trusted);
             context.recordScopeId(SIGN_IN_IN_APP_SCOPE_KEY, targets.active);
         }
+        if (orgsWritable) {
+            context.recordScopeId(LOGIN_CLIENT_ORGS_SCOPE_KEY, clientOrganizationsState(wantedOrgs));
+        }
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
@@ -2195,6 +2407,8 @@ export class FoundryStepExecutor {
         }
         const upsert = [];
         const remove = [];
+        let orgsUpsert = {};
+        const orgsRemove = [];
         return {
             upsertBinding: async (binding) => {
                 upsert.push(binding);
@@ -2202,12 +2416,29 @@ export class FoundryStepExecutor {
             deleteBinding: async (host) => {
                 remove.push(host);
             },
+            upsertClientOrganizations: async (entries) => {
+                Object.assign(orgsUpsert, entries);
+            },
+            deleteClientOrganizations: async (clientIds) => {
+                orgsRemove.push(...clientIds);
+            },
             flush: async () => {
-                if (upsert.length === 0 && remove.length === 0)
+                const orgsEmpty = Object.keys(orgsUpsert).length === 0 && orgsRemove.length === 0;
+                if (upsert.length === 0 && remove.length === 0 && orgsEmpty)
                     return;
-                const edits = { appId, instanceHost, upsert: [...upsert], remove: [...remove] };
+                const edits = {
+                    appId,
+                    instanceHost,
+                    upsert: [...upsert],
+                    remove: [...remove],
+                    ...(orgsEmpty
+                        ? {}
+                        : { clientOrganizations: { upsert: { ...orgsUpsert }, remove: [...orgsRemove] } }),
+                };
                 upsert.length = 0;
                 remove.length = 0;
+                orgsUpsert = {};
+                orgsRemove.length = 0;
                 await editSignInBindings(this.ports.coolify, edits);
             },
         };
@@ -2420,6 +2651,9 @@ export class FoundryStepExecutor {
         // An entry with `uses.auth` signs in at its own exact hostnames, one pair
         // of addresses each; a `*` adds none (`entryHostnames`).
         const hosts = authEntry ? entryHostnames(org, authEntry) : null;
+        const postLogoutUris = appType === 'native' ? [] : companyAppPostLogoutUris(org, action.key);
+        // #339: every `@wtfalch/auth` web client also takes the desktop callback (Agora's own client does not).
+        const desktopCallbacks = appType === 'web' && !isAgoraClient ? (hosts ?? [hostname]).map(desktopCallbackUri) : [];
         const created = await this.ports.zitadel.createOidcApp(zitadelOrgId, projectId, {
             name: action.key,
             appType,
@@ -2428,14 +2662,11 @@ export class FoundryStepExecutor {
                 : hosts
                     ? [
                         ...hosts.map((host) => `https://${host}/auth/callback`),
+                        ...desktopCallbacks,
                         ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : []),
                     ]
-                    : [redirectUri],
-            postLogoutRedirectUris: appType === 'native'
-                ? []
-                : hosts
-                    ? hosts.map((host) => `https://${host}/`)
-                    : [`https://${hostname}/`],
+                    : [redirectUri, ...desktopCallbacks],
+            postLogoutRedirectUris: postLogoutUris,
             ...(authEntry?.uses?.auth?.mcp ? { accessTokenType: 'jwt' } : {}),
         });
         if (appType === 'web') {
@@ -2451,6 +2682,12 @@ export class FoundryStepExecutor {
         }
         // Made with the setting on (providers 0.9.0): nothing to repair on this id.
         context.recordScopeId(zitadelAppIdTokenUserinfoAppliedScopeKey(action.key), created.appId);
+        if (appType === 'web') {
+            context.recordScopeId(zitadelAppPostLogoutAppliedScopeKey(action.key), postLogoutAppliedValue(created.appId, postLogoutUris));
+        }
+        if (desktopCallbacks.length > 0) {
+            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(action.key), created.appId);
+        }
         return { resourceId: created.appId };
     }
     /**
@@ -2979,7 +3216,11 @@ export class FoundryStepExecutor {
         let dbPush = { pushed: false, changed: false };
         if (entry.database) {
             const dbId = context.recordedIds()[`coolify:database:${org.id}`];
-            if (dbId) {
+            if (this.homeOnServer(org, context, 'app')) {
+                const onServer = await this.serverHome(org, context, 'app');
+                dbPush = await this.pushDatabaseUrl(appId, '', org.slug.replace(/-/g, '_'), onServer);
+            }
+            else if (dbId) {
                 dbPush = await this.pushDatabaseUrl(appId, dbId, org.slug.replace(/-/g, '_'));
             }
         }
@@ -3057,7 +3298,7 @@ export class FoundryStepExecutor {
         // actually resolved a mail domain for this org.
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
-        if (entry.key === APP_ENTRY_KEY) {
+        if (isMainEntry(entry)) {
             await this.ensureAppLettermintMail(appId, org, context, 
             // Deployed or started above on every path, a created app included
             // (#566), so it has read its env before the mail env is written.
@@ -3141,7 +3382,7 @@ export class FoundryStepExecutor {
      * the connection URL or a response body.
      */
     async coolifyBackup(action, org, context) {
-        const { databaseId, database, storageUuid } = action.desired;
+        const { databaseId, database, storageUuid, databaseNames } = action.desired;
         if (typeof databaseId !== 'string' ||
             typeof database !== 'string' ||
             typeof storageUuid !== 'string' ||
@@ -3153,11 +3394,115 @@ export class FoundryStepExecutor {
             databaseUuid: databaseId,
             label: `${org.slug} ${database}`,
             storageUuid,
-            databaseName: COMPANY_BACKUP_DATABASE_NAMES[database],
+            databaseName: typeof databaseNames === 'string' && databaseNames
+                ? databaseNames
+                : COMPANY_BACKUP_DATABASE_NAMES[database],
         });
         context.recordScopeId(backupScopeKey(database), uuid);
+        if (typeof databaseNames === 'string' && databaseNames) {
+            context.recordScopeId(BACKUP_POSTGRES_DATABASES_SCOPE_KEY, databaseNames);
+        }
         return undefined;
     }
+    orgPostgresDeps(org, context) {
+        return {
+            coolify: this.ports.coolify,
+            ensureProject: () => this.ensureCoolifyProject(org, context),
+            serverUuid: async () => (await this.resolveServer(org, context)).uuid,
+            startDatabase: (uuid) => getDatabaseStarted(this.ports.coolify, uuid),
+            deliverSecret: (ref, secret) => this.ports.deliverSecret(ref, secret),
+            onSecret: (value) => void this.handledSecrets.add(value),
+            runtime: {
+                ...(this.ports.runtime?.sleep ? { sleep: this.ports.runtime.sleep } : {}),
+                ...(this.ports.runtime?.now ? { now: this.ports.runtime.now } : {}),
+            },
+        };
+    }
+    /** `coolify:org-postgres` (#444): the company's one Postgres server. */
+    async orgPostgresServer(org, context) {
+        return provisionOrgPostgresServer(scopeFromOrg(context, {}), this.orgPostgresDeps(org, context), org);
+    }
+    /** `coolify:org-postgres-databases` (#444): a database and its roles for each home that has none. */
+    async orgPostgresDatabases(action, org, context) {
+        const homes = action.desired.homes;
+        if (!Array.isArray(homes) || !homes.every((home) => typeof home === 'string')) {
+            throw new Error(`coolify:org-postgres-databases for ${org.slug}: the plan named no homes`);
+        }
+        await provisionOrgPostgresDatabases(scopeFromOrg(context, {}), this.orgPostgresDeps(org, context), org, homes);
+        return {};
+    }
+    /**
+     * `coolify:org-postgres-migrate` (#444): one home's data from its old Coolify database to the
+     * company's server. Refuses before any port call unless the staging confirmation is recorded.
+     */
+    async orgPostgresMigrate(action, org, context) {
+        const scope = scopeFromOrg(context, {});
+        if (!parseMigrationConfirmation(scope.recordedIds()[ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY])) {
+            throw new OrgPostgresMigrationNotConfirmedError();
+        }
+        const home = migrateHomeOf(action);
+        await migrateOrgPostgresHome(scope, {
+            coolify: this.ports.coolify,
+            ensureProject: () => this.ensureCoolifyProject(org, context),
+            serverUuid: async () => (await this.resolveServer(org, context)).uuid,
+            startServer: (uuid) => getDatabaseStarted(this.ports.coolify, uuid),
+            readLegacyDatabase: (uuid) => this.ports.coolify.getDatabase(uuid),
+            resolveSecret: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? undefined,
+            consumers: (schema) => this.migrationConsumers(org, context, schema.schema),
+            onSecret: (value) => void this.handledSecrets.add(value),
+            runtime: {
+                ...(this.ports.runtime?.sleep ? { sleep: this.ports.runtime.sleep } : {}),
+                ...(this.ports.runtime?.now ? { now: this.ports.runtime.now } : {}),
+            },
+        }, org, home);
+        return {};
+    }
+    /** The apps that use a home's database, found the way each service finds its own app. */
+    async migrationConsumers(org, context, schema) {
+        const recorded = context.recordedIds();
+        const byName = async (...names) => {
+            const projectUuid = await this.ensureCoolifyProject(org, context);
+            const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+            const ids = [];
+            for (const name of names) {
+                const found = await this.ports.coolify.findApplicationByName(name, {
+                    environmentIds: [environment.id],
+                });
+                if (found)
+                    ids.push(found.uuid);
+            }
+            return ids;
+        };
+        const chat = chatInternalNames(org.slug);
+        switch (schema) {
+            case 'app': {
+                const entry = org.hosting.entries.find((e) => e.database);
+                const id = entry && recorded[`coolify:app:${appStepKey(org, entry.key)}`];
+                return { appIds: id ? [id] : [], template: true };
+            }
+            case 'cms': {
+                const id = recorded[CMS_APP_SCOPE_KEY];
+                return { appIds: id ? [id] : [], template: true };
+            }
+            case 'boule':
+                return { appIds: await byName(`${org.slug}-boule`), template: true };
+            case 'chat_service':
+                return { appIds: await byName(chat.service), template: true };
+            case 'calls_service':
+                return { appIds: await byName(callsServiceInternalName(org)), template: true };
+            case 'chat_synapse':
+            case 'chat_mas':
+                return { appIds: await byName(chat.synapse, chat.mas), template: false };
+            case 'calls_synapse':
+            case 'calls_mas':
+                return {
+                    appIds: await byName(`${org.slug}-calls-synapse`, `${org.slug}-calls-mas`),
+                    template: false,
+                };
+            default:
+                throw new Error(`${org.slug}: ${schema} has no apps to stop`);
+        }
+    }
     async coolifyDatabase(action, org, context) {
         if (action.desired.enabled === false) {
             const dbId = context.recordedIds()[`coolify:database:${action.key}`];
@@ -3169,6 +3514,10 @@ export class FoundryStepExecutor {
         }
         const existing = context.recordedIds()[`coolify:database:${action.key}`];
         let dbId;
+        if (this.homeOnServer(org, context, 'app')) {
+            // #444: the app's database is on the company's server; this step makes none.
+            return {};
+        }
         if (existing) {
             dbId = existing;
         }
@@ -3229,22 +3578,91 @@ export class FoundryStepExecutor {
      * recorded in `serviceIds` (hence never in the store or an audit record),
      * never logged, never interpolated into a thrown error.
      */
-    async pushDatabaseUrl(appId, dbId, dbName) {
-        const db = await getDatabaseStarted(this.ports.coolify, dbId);
+    async pushDatabaseUrl(appId, dbId, dbName, onServer) {
+        // On the company's server (#444) the owner URL is already built from the
+        // held password; `dbId` is then unused.
+        const ownerUrl = onServer
+            ? onServer.ownerUrl
+            : (await getDatabaseStarted(this.ports.coolify, dbId)).internal_db_url;
         // Nothing to push; `planApp` reports this as blocked from the live reader.
-        if (!db.internal_db_url)
+        if (!ownerUrl)
             return { pushed: false, changed: false };
         const envs = [
-            { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
+            { key: 'DATABASE_URL_OWNER', value: ownerUrl },
         ];
-        const runtimeUrl = await this.ensureAppRuntimeUrl(appId, db.internal_db_url, dbName);
+        const runtimeUrl = await this.ensureAppRuntimeUrl(appId, ownerUrl, onServer?.runtimeUser ?? `${dbName}_rt`);
         if (runtimeUrl)
             envs.push({ key: 'DATABASE_URL', value: runtimeUrl });
         // True when a value actually changed, so the caller restarts the app only
         // then (the owner URL is upserted on every apply).
         const ownerBefore = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview)?.value;
         await this.ports.coolify.bulkUpsertEnvs(appId, envs);
-        return { pushed: true, changed: runtimeUrl !== null || ownerBefore !== db.internal_db_url };
+        return { pushed: true, changed: runtimeUrl !== null || ownerBefore !== ownerUrl };
+    }
+    /**
+     * #444: the home's owner URL on the company's Postgres server, built from
+     * the server's live host and the owner password the host holds
+     * (`deliverSecret` under `org-postgres:<slug>:<home>:owner`). Only for a
+     * home {@link homeLocation} puts on the server. The password is registered
+     * for redaction and goes only into the returned URL.
+     */
+    async serverHome(org, context, schema, options = {}) {
+        const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === schema);
+        const serverId = context.recordedIds()[ORG_POSTGRES_SERVER_SCOPE_KEY];
+        if (!home || !serverId) {
+            throw new Error(`${org.slug}: the Postgres server for ${schema} is not recorded yet`);
+        }
+        const server = await getDatabaseStarted(this.ports.coolify, serverId);
+        const endpoint = server.internal_db_url
+            ? serviceEndpoint(org, home, server.internal_db_url)
+            : null;
+        if (!endpoint) {
+            throw new Error(`${org.slug}: the Postgres server has no internal URL yet -- retry this apply once Coolify reports one`);
+        }
+        const password = await this.ports.heldKeys?.resolve(orgPostgresSecretRef(org, schema, 'owner'));
+        if (!password) {
+            throw new Error(`${org.slug}: the owner password for ${schema} is not held yet`);
+        }
+        this.handledSecrets.add(password);
+        const runtimePassword = options.runtime
+            ? await this.ports.heldKeys?.resolve(orgPostgresSecretRef(org, schema, 'runtime'))
+            : null;
+        if (options.runtime && !runtimePassword) {
+            throw new Error(`${org.slug}: the runtime password for ${schema} is not held yet`);
+        }
+        if (runtimePassword)
+            this.handledSecrets.add(runtimePassword);
+        const { owner, runtime } = serviceUrls(endpoint, password, runtimePassword ?? null);
+        this.handledSecrets.add(owner);
+        if (runtime)
+            this.handledSecrets.add(runtime);
+        return { ownerUrl: owner, runtimeUser: endpoint.runtimeUser, runtimeUrl: runtime };
+    }
+    /** #444: whether `schema`'s database is on the company's server (recorded, and not waiting for its migration). */
+    homeOnServer(org, context, schema) {
+        const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === schema);
+        return home !== undefined && serviceOnServer(org, home, context.recordedIds());
+    }
+    /**
+     * #444: a home's database. On the company's server nothing is made or
+     * recorded (the legacy id stays unset, or the home would read as unmigrated)
+     * and `ensureLegacy` is never called, so no `POSTGRES_INITDB_ARGS` is set:
+     * the provisioning job creates the database with its collation. Otherwise
+     * today's calls, unchanged.
+     */
+    async ensureHomeDatabase(org, context, schema, scopeKey, ensureLegacy) {
+        if (this.homeOnServer(org, context, schema)) {
+            return { id: '', server: await this.serverHome(org, context, schema) };
+        }
+        const id = await ensureLegacy();
+        context.recordScopeId(scopeKey, id);
+        return { id, server: null };
+    }
+    /** The owner URL of a home from {@link ensureHomeDatabase}; the legacy one is read live and started. */
+    async homeOwnerUrl(home) {
+        return home.server
+            ? home.server.ownerUrl
+            : (await getDatabaseStarted(this.ports.coolify, home.id)).internal_db_url;
     }
     /**
      * `null` once the app already has a `DATABASE_URL` -- never rotated, the
@@ -3256,7 +3674,7 @@ export class FoundryStepExecutor {
      * hands the app next. See `ensureCmsRuntimeUrl`'s own doc comment for the
      * parsing and encoding choices this mirrors exactly.
      */
-    async ensureAppRuntimeUrl(appId, dbInternalUrl, dbName) {
+    async ensureAppRuntimeUrl(appId, dbInternalUrl, runtimeUser) {
         const envs = await this.ports.coolify.listEnvs(appId);
         // An existing `DATABASE_URL` that is still the superuser string is what an
         // app got before the split (#239): treat it as absent so the runtime role
@@ -3274,7 +3692,7 @@ export class FoundryStepExecutor {
             return null;
         }
         const password = randomBytes(24).toString('base64url');
-        return `postgres://${dbName}_rt:${password}@${host}${pathname}${search}`;
+        return `postgres://${runtimeUser}:${password}@${host}${pathname}${search}`;
     }
     /**
      * Pushes what the org's app needs to sign a user in through ZITADEL (gap
@@ -3300,10 +3718,8 @@ export class FoundryStepExecutor {
     async pushAppEnv(appId, org, entry, context, authIssuer, secretSources) {
         const recorded = context.recordedIds();
         const envs = [
-            // Only the `app` entry has a public name; the others are internal.
-            ...(entry.key === APP_ENTRY_KEY
-                ? [{ key: 'APP_URL', value: `https://${appHostname(org)}` }]
-                : []),
+            // Only the main entry has a public name; the others are internal.
+            ...(isMainEntry(entry) ? [{ key: 'APP_URL', value: `https://${appHostname(org)}` }] : []),
             // #75: read back by the package-side pino sink (not this repo's job,
             // #75 "What belongs where") once `ensureLogVolume` has mounted the
             // matching volume.
@@ -3525,6 +3941,51 @@ export class FoundryStepExecutor {
      * hosting entry's is: with the `AUTH_APP_KEY` `coolifyBoule` put in the
      * Boule app's env.
      */
+    async bouleOwners(org, context) {
+        const at = `coolify:boule-owners for ${org.slug}`;
+        const recorded = context.recordedIds();
+        const appId = recorded[`coolify:boule:${org.id}`];
+        const organisationId = recorded[ZITADEL_ORG_SCOPE_KEY];
+        if (!appId || !organisationId) {
+            throw new Error(`${at}: the Boule app or its sign-in organisation is not recorded yet`);
+        }
+        const secret = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === BOULE_OWNER_SEED_SECRET_ENV && !e.is_preview)?.value;
+        if (!secret)
+            throw new Error(`${at}: the app has no ${BOULE_OWNER_SEED_SECRET_ENV} yet`);
+        this.handledSecrets.add(secret);
+        const owners = bouleOwnerSeeds(org, recorded);
+        if (owners.length === 0)
+            return {};
+        let results;
+        try {
+            results = (await (this.ports.bouleOwners ?? httpBouleOwners()).seed({
+                hostname: bouleHostnameFor(org),
+                organisationId,
+                secret,
+                owners,
+            })).results;
+        }
+        catch (error) {
+            const status = error instanceof BouleOwnersError ? error.status : 0;
+            throw new Error(status === 404
+                ? `Boule for ${org.slug} has no owner-seeding door yet: its deploy is older than the foundry release; retry once Boule has deployed main`
+                : `${at}: ${status === 0 ? 'Boule did not answer' : `Boule answered ${status}`}`);
+        }
+        // One at a time, only after Boule answered for that owner.
+        owners.forEach((owner, index) => {
+            const result = results.find((r) => r.subject === owner.subject);
+            if (!result)
+                throw new Error(`${at}: Boule gave no result for owner ${index + 1}`);
+            context.recordScopeId(result.outcome === 'refused'
+                ? bouleOwnerRefusedScopeKey(owner.email)
+                : bouleOwnerSeededScopeKey(owner.email), result.outcome === 'refused'
+                ? result.code === 'platform_frozen' || result.code === 'holds_other_role'
+                    ? result.code
+                    : 'refused'
+                : '1');
+        });
+        return {};
+    }
     async bouleBrokerEntry(org, context) {
         const broker = this.ports.broker;
         if (!broker) {
@@ -3740,7 +4201,9 @@ export class FoundryStepExecutor {
         const { org, context, mailDomain, self, mailFrom } = args;
         const appName = `${org.slug}-app`;
         const recorded = context.recordedIds();
-        const appId = self.role === 'app' ? self.id : recorded[`coolify:app:${appStepKey(org)}`];
+        const appId = self.role === 'app'
+            ? self.id
+            : recorded[`coolify:app:${appStepKey(org, mainEntry(org.hosting)?.key)}`];
         const bouleId = self.role === 'boule' ? self.id : recorded[`coolify:boule:${org.id}`];
         const peerListEnvs = (id) => !id || id === self.id
             ? Promise.resolve(null)
@@ -4193,8 +4656,15 @@ export class FoundryStepExecutor {
         // and retried on the next one, rather than silently skipped -- the two
         // `bulkUpsertEnvs` calls above have already landed by the time either
         // could throw.
-        const dbId = await this.ensureCmsDatabase(org, context, projectUuid, environment);
-        context.recordScopeId(CMS_DATABASE_SCOPE_KEY, dbId);
+        // #444: on the company's server there is no Coolify database to make, and the
+        // legacy id stays unset (recording it would mark the home as unmigrated).
+        const cmsOnServer = this.homeOnServer(org, context, 'cms');
+        const cmsServer = cmsOnServer ? await this.serverHome(org, context, 'cms') : null;
+        const dbId = cmsOnServer
+            ? ''
+            : await this.ensureCmsDatabase(org, context, projectUuid, environment);
+        if (!cmsOnServer)
+            context.recordScopeId(CMS_DATABASE_SCOPE_KEY, dbId);
         // Read back from Coolify's own record (`pushDatabaseUrl`'s own doc
         // comment on why: live state, not `createPostgresDatabase`'s return
         // value, since this run may have just found the database rather than
@@ -4203,12 +4673,14 @@ export class FoundryStepExecutor {
         // recorded, logged, or interpolated into a thrown error. Its own call,
         // separate from the two app-env calls above, since it has nothing to
         // push once `internal_db_url` is absent.
-        const db = await getDatabaseStarted(this.ports.coolify, dbId);
-        if (db.internal_db_url) {
+        const ownerUrl = cmsServer
+            ? cmsServer.ownerUrl
+            : (await getDatabaseStarted(this.ports.coolify, dbId)).internal_db_url;
+        if (ownerUrl) {
             const dbEnvs = [
-                { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
+                { key: 'DATABASE_URL_OWNER', value: ownerUrl },
             ];
-            const runtimeUrl = await this.ensureCmsRuntimeUrl(cms.appId, db.internal_db_url);
+            const runtimeUrl = await this.ensureCmsRuntimeUrl(cms.appId, ownerUrl);
             if (runtimeUrl)
                 dbEnvs.push({ key: 'DATABASE_URL', value: runtimeUrl });
             await this.ports.coolify.bulkUpsertEnvs(cms.appId, dbEnvs);
@@ -4400,18 +4872,14 @@ export class FoundryStepExecutor {
             synapseDb: `${org.slug}-calls-synapse-db`,
             masDb: `${org.slug}-calls-mas-db`,
         };
-        const synapseDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.synapseDb, 'synapse', CALLS_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS);
-        context.recordScopeId(CALLS_SYNAPSE_DB_SCOPE_KEY, synapseDbId);
-        const masDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.masDb, 'mas', CALLS_MAS_DB_SCOPE_KEY);
-        context.recordScopeId(CALLS_MAS_DB_SCOPE_KEY, masDbId);
-        const [synapseDbRow, masDbRow] = await Promise.all([
-            getDatabaseStarted(this.ports.coolify, synapseDbId),
-            getDatabaseStarted(this.ports.coolify, masDbId),
+        const synapseHome = await this.ensureHomeDatabase(org, context, 'calls_synapse', CALLS_SYNAPSE_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, names.synapseDb, 'synapse', CALLS_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS));
+        const masHome = await this.ensureHomeDatabase(org, context, 'calls_mas', CALLS_MAS_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, names.masDb, 'mas', CALLS_MAS_DB_SCOPE_KEY));
+        const [synapseDbUrl, masDbUrl] = await Promise.all([
+            this.homeOwnerUrl(synapseHome),
+            this.homeOwnerUrl(masHome),
         ]);
-        const synapseDb = synapseDbRow.internal_db_url
-            ? parseCallsDbUrl(synapseDbRow.internal_db_url)
-            : null;
-        const masDb = masDbRow.internal_db_url ? parseCallsDbUrl(masDbRow.internal_db_url) : null;
+        const synapseDb = synapseDbUrl ? parseCallsDbUrl(synapseDbUrl) : null;
+        const masDb = masDbUrl ? parseCallsDbUrl(masDbUrl) : null;
         if (!synapseDb || !masDb) {
             // Static config check before the two apps below are ever touched
             // (issue #128's "static config checks run before the first Coolify
@@ -4790,10 +5258,11 @@ export class FoundryStepExecutor {
             if (action.desired.refreshDatabaseSplit === true) {
                 const serviceAppId = recorded[CHAT_SERVICE_SCOPE_KEY];
                 const serviceDbId = recorded[CHAT_SERVICE_DB_SCOPE_KEY];
-                if (!serviceAppId || !serviceDbId) {
+                const serviceOnServer = this.homeOnServer(org, context, 'chat_service');
+                if (!serviceAppId || (!serviceDbId && !serviceOnServer)) {
                     throw new Error(`coolify:chat database split for ${org.slug}: the chat service app or its database is not recorded yet`);
                 }
-                const push = await this.pushDatabaseUrl(serviceAppId, serviceDbId, 'chat');
+                const push = await this.pushDatabaseUrl(serviceAppId, serviceDbId ?? '', 'chat', serviceOnServer ? await this.serverHome(org, context, 'chat_service') : undefined);
                 const markerKey = serviceDbEnvAppliedScopeKey('chat');
                 if (!push.pushed) {
                     // Unlike a fresh provision, this chat was already fully up and
@@ -4860,22 +5329,17 @@ export class FoundryStepExecutor {
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const server = await this.resolveServer(org, context);
         const names = chatInternalNames(org.slug);
-        const synapseDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.synapseDb, 'synapse', CHAT_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS);
-        context.recordScopeId(CHAT_SYNAPSE_DB_SCOPE_KEY, synapseDbId);
-        const masDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.masDb, 'mas', CHAT_MAS_DB_SCOPE_KEY);
-        context.recordScopeId(CHAT_MAS_DB_SCOPE_KEY, masDbId);
-        const serviceDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.serviceDb, 'chat', CHAT_SERVICE_DB_SCOPE_KEY);
-        context.recordScopeId(CHAT_SERVICE_DB_SCOPE_KEY, serviceDbId);
-        const [synapseDbRow, masDbRow, serviceDbRow] = await Promise.all([
-            getDatabaseStarted(this.ports.coolify, synapseDbId),
-            getDatabaseStarted(this.ports.coolify, masDbId),
-            getDatabaseStarted(this.ports.coolify, serviceDbId),
+        const synapseHome = await this.ensureHomeDatabase(org, context, 'chat_synapse', CHAT_SYNAPSE_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, names.synapseDb, 'synapse', CHAT_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS));
+        const masHome = await this.ensureHomeDatabase(org, context, 'chat_mas', CHAT_MAS_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, names.masDb, 'mas', CHAT_MAS_DB_SCOPE_KEY));
+        const serviceHome = await this.ensureHomeDatabase(org, context, 'chat_service', CHAT_SERVICE_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, names.serviceDb, 'chat', CHAT_SERVICE_DB_SCOPE_KEY));
+        const [synapseDbUrl, masDbUrl, serviceDbUrl] = await Promise.all([
+            this.homeOwnerUrl(synapseHome),
+            this.homeOwnerUrl(masHome),
+            this.homeOwnerUrl(serviceHome),
         ]);
-        const synapseDb = synapseDbRow.internal_db_url
-            ? parseCallsDbUrl(synapseDbRow.internal_db_url)
-            : null;
-        const masDb = masDbRow.internal_db_url ? parseCallsDbUrl(masDbRow.internal_db_url) : null;
-        if (!synapseDb || !masDb || !serviceDbRow.internal_db_url) {
+        const synapseDb = synapseDbUrl ? parseCallsDbUrl(synapseDbUrl) : null;
+        const masDb = masDbUrl ? parseCallsDbUrl(masDbUrl) : null;
+        if (!synapseDb || !masDb || !serviceDbUrl) {
             // Before any app is touched: Coolify can take a moment to report a new
             // database's url, and the next apply retries from a clean state.
             throw new Error(`coolify:chat for ${org.slug}: a database has no internal_db_url yet -- retry this apply once Coolify reports one`);
@@ -5004,7 +5468,7 @@ export class FoundryStepExecutor {
         // `DATABASE_URL` is a minted `chat_rt` role -- `chat` is the literal
         // `postgres_db`/`postgres_user` `ensureCallsDatabase` created the service
         // database with above, not the Coolify resource name `names.serviceDb`.
-        const serviceDbPush = await this.pushDatabaseUrl(service.appId, serviceDbId, 'chat');
+        const serviceDbPush = await this.pushDatabaseUrl(service.appId, serviceHome.id, 'chat', serviceHome.server ?? undefined);
         // A file-storage write alone never reaches a running container. Deploy an
         // app that is new, whose config was freshly minted, or that is not
         // running now. The last test reads the live status, not what this run
@@ -5306,10 +5770,8 @@ export class FoundryStepExecutor {
         const synapseHost = `${org.slug}-calls-synapse`;
         const masHost = `${org.slug}-calls-mas`;
         const dbName = `${name}-db`;
-        const dbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY);
-        context.recordScopeId(CALLS_SERVICE_DB_SCOPE_KEY, dbId);
-        const db = await getDatabaseStarted(this.ports.coolify, dbId);
-        if (!db.internal_db_url) {
+        const serviceHome = await this.ensureHomeDatabase(org, context, 'calls_service', CALLS_SERVICE_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY));
+        if (!(await this.homeOwnerUrl(serviceHome))) {
             throw new Error(`coolify:calls-service for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
         const server = await this.resolveServer(org, context);
@@ -5393,7 +5855,7 @@ export class FoundryStepExecutor {
         // `DATABASE_URL` is a minted `<dbName>_rt` role -- the real Postgres
         // database name `ensureCallsDatabase` created this database with, not
         // the Coolify resource name.
-        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName.replace(/-/g, '_'));
+        const dbPush = await this.pushDatabaseUrl(app.appId, serviceHome.id, dbName.replace(/-/g, '_'), serviceHome.server ?? undefined);
         // #456: a crash between the push above and the deploy/marker below
         // leaves the env right and no marker, so this replans and deploys once
         // more -- the same rule `coolifyApp`'s own `dbEnvAppliedScopeKey` marker
@@ -5766,6 +6228,155 @@ export class FoundryStepExecutor {
         context.recordScopeId(AGORA_ACTIVATED_ENV_SCOPE_KEY, revision);
         return { resourceId: app.appId };
     }
+    // ---- desktop-auth (#440) -------------------------------------------------
+    /**
+     * `plan/desktop-auth.ts`'s `planDesktopAuth`: Agora's desktop sign-in backend, built from the agora repo's
+     * `apps/desktop-auth`, internal only (Agora proxies `/auth/desktop/*` to `<slug>-desktop-auth:8080`).
+     *
+     * Env: the non-secret values from `desktopAuthEnv`, the owner and runtime URLs of the company server's
+     * `desktop_auth` home (rebuilt from the held passwords on every run; the owner URL is for the migrate that
+     * runs first in the image, which drops it before the server starts), and two secrets generated once. A secret
+     * is minted only when the app's env lacks it, and both go into the one write with the rest, so a reapply or a
+     * crash before the write never leaves two. Neither is delivered anywhere else.
+     *
+     * Deployed once after creation, again when the app is not running, and restarted when only the env changed
+     * (decided from the live app, not from this run). The readiness probe goes through Agora once Agora carries
+     * the upstream; the first apply has none to probe, and the next plan turns the upstream on. The callback URI is
+     * added to Agora's client last, as the union of what the client holds and the callback (never removing one).
+     */
+    async coolifyDesktopAuth(action, org, context) {
+        const host = action.desired.host;
+        if (!host) {
+            throw new Error(`desktop sign-in for ${org.slug} cannot be configured: the step carries no host values`);
+        }
+        const { inputs, missing } = desktopAuthInputs(org, context.recordedIds(), host);
+        if (!inputs) {
+            throw new Error(`desktop sign-in for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
+        }
+        const home = await this.serverHome(org, context, DESKTOP_AUTH_HOME, { runtime: true });
+        if (!home.runtimeUrl) {
+            throw new Error(`desktop sign-in for ${org.slug}: the runtime URL could not be built`);
+        }
+        const env = desktopAuthEnv(inputs, home.runtimeUser);
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const name = desktopAuthInternalName(org);
+        const recordedApp = context.recordedIds()[DESKTOP_AUTH_APP_SCOPE_KEY];
+        let app;
+        if (recordedApp) {
+            app = { appId: recordedApp, existed: true };
+        }
+        else {
+            const server = await this.resolveServer(org, context);
+            const githubApp = await this.ports.coolify.requireGithubApp();
+            app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+                is_preview_deployments_enabled: false,
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                github_app_uuid: githubApp.uuid,
+                git_repository: AGORA_REPO,
+                git_branch: 'main',
+                build_pack: 'dockerfile',
+                name,
+                dockerfile_location: DESKTOP_AUTH_DOCKERFILE,
+                ports_exposes: DESKTOP_AUTH_PORT,
+                autogenerate_domain: false,
+            }), { startIfStopped: false });
+        }
+        context.recordScopeId(DESKTOP_AUTH_APP_SCOPE_KEY, app.appId);
+        const live = app.existed ? await this.ports.coolify.getApplication(app.appId) : null;
+        const portDiffers = live !== null && live.ports_exposes !== DESKTOP_AUTH_PORT;
+        // The image carries its own HEALTHCHECK; Coolify's generated one would replace it.
+        await this.ports.coolify.updateApplication(app.appId, {
+            custom_internal_name: name,
+            health_check_enabled: false,
+            ...(portDiffers ? { ports_exposes: DESKTOP_AUTH_PORT } : {}),
+        });
+        const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
+        const liveEnv = new Map(liveRows.map((e) => [e.key, e.value]));
+        const secrets = [];
+        if (!liveEnv.has('AUTH_COOKIE_SECRET')) {
+            secrets.push({ key: 'AUTH_COOKIE_SECRET', value: randomBytes(32).toString('base64url') });
+        }
+        if (!liveEnv.has('MESSAGING_HANDOFF_KEY')) {
+            secrets.push({ key: 'MESSAGING_HANDOFF_KEY', value: randomBytes(32).toString('hex') });
+        }
+        for (const secret of secrets)
+            this.handledSecrets.add(secret.value);
+        const desired = {
+            ...env,
+            MESSAGING_DATABASE_URL_OWNER: home.ownerUrl,
+            MESSAGING_DATABASE_URL: home.runtimeUrl,
+        };
+        const envChanged = Object.entries(desired).some(([key, value]) => liveEnv.get(key) !== value);
+        await this.ports.coolify.bulkUpsertEnvs(app.appId, [
+            ...Object.entries(desired).map(([key, value]) => ({ key, value })),
+            ...secrets,
+        ]);
+        const recorded = context.recordedIds();
+        const upstreamLive = await this.agoraUpstreamLive(org, recorded);
+        const health = upstreamLive
+            ? publicHealthCheck(org, recorded, agoraHostnameFor(org), DESKTOP_AUTH_READY_PATH, {
+                viaAgora: true,
+            })
+            : { kind: 'deployment-only' };
+        const runtime = this.ports.runtime ?? {};
+        const sleep = runtime.sleep ?? defaultSleep;
+        const running = live !== null && isRunningOrStarting(live.status);
+        const label = 'coolify:desktop-auth';
+        const previous = `${org.slug}'s desktop sign-in service stays at its previous deploy`;
+        if (!app.existed || !recorded[DESKTOP_AUTH_DEPLOYED_SCOPE_KEY] || !running || portDiffers) {
+            await waitForNewDeployment(this.ports.coolify, app.appId, health, runtime, sleep, label, previous);
+            context.recordScopeId(DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else {
+            if (envChanged)
+                await this.ports.coolify.restart(app.appId);
+            await waitForHealthyVersion(app.appId, health, runtime, sleep, label, previous);
+        }
+        if (upstreamLive)
+            context.recordScopeId(DESKTOP_AUTH_READY_SCOPE_KEY, '1');
+        await this.addDesktopAuthCallback(org, context, desktopAuthCallbackUri(inputs.origin));
+        context.recordScopeId(DESKTOP_AUTH_ORIGIN_SCOPE_KEY, inputs.origin);
+        context.recordScopeId(DESKTOP_AUTH_REVISION_SCOPE_KEY, desktopAuthRevision(env));
+        return { resourceId: app.appId };
+    }
+    /** Whether the org's running Agora carries `AGORA_DESKTOP_AUTH_UPSTREAM`, read from its live env. */
+    async agoraUpstreamLive(org, recorded) {
+        const agoraId = recorded[`coolify:agora:${org.id}`];
+        if (!agoraId)
+            return false;
+        const rows = await this.ports.coolify.listEnvs(agoraId);
+        return rows.some((e) => e.key === 'AGORA_DESKTOP_AUTH_UPSTREAM' && !e.is_preview && e.value);
+    }
+    /**
+     * Adds `callback` to the Agora client's redirect URIs, keeping the ones it has. A providers client older
+     * than 0.12.0 cannot do it: the step records that and the planner reports it blocked, rather than failing.
+     */
+    async addDesktopAuthCallback(org, context, callback) {
+        const zitadel = this.ports.zitadel;
+        const read = zitadel.getOidcAppRedirectUris?.bind(zitadel);
+        const write = zitadel.updateOidcAppRedirectUris?.bind(zitadel);
+        if (!read || !write) {
+            context.recordScopeId(DESKTOP_AUTH_REDIRECT_SCOPE_KEY, desktopAuthRedirectUnsupported(callback));
+            return;
+        }
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+        const clientAppId = recorded['zitadel:app:agora'];
+        if (!zitadelOrgId || !clientAppId) {
+            throw new Error(`desktop sign-in for ${org.slug}: the Agora ZITADEL client is not recorded yet -- nothing was changed on it`);
+        }
+        const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
+        const at = `desktop sign-in for ${org.slug}`;
+        const current = await withCallTimeout(WORKER_APP_CALL_TIMEOUT_MS, `${at}: read redirect URIs`, () => read(zitadelOrgId, projectId, clientAppId));
+        if (!current.includes(callback)) {
+            await withCallTimeout(WORKER_APP_CALL_TIMEOUT_MS, `${at}: add redirect URI`, () => write(zitadelOrgId, projectId, clientAppId, [...current, callback]));
+        }
+        context.recordScopeId(DESKTOP_AUTH_REDIRECT_SCOPE_KEY, callback);
+    }
     /**
      * Records whether an app's running env holds `SIGNIN_UPSTREAM` (the app's host while it does, `''` once it
      * does not), so the login-host step knows when to point the base URI at the app and when it may give the
@@ -5850,8 +6461,16 @@ export class FoundryStepExecutor {
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const name = `${org.slug}-boule`;
         const dbName = `${org.slug}-boule-db`.replace(/-/g, '_');
-        const dbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, `${org.slug}-boule-db`, dbName, BOULE_DATABASE_SCOPE_KEY);
-        context.recordScopeId(BOULE_DATABASE_SCOPE_KEY, dbId);
+        // #444: on the company's server there is no Coolify database to make, and the
+        // legacy id stays unset (recording it would mark the home as unmigrated).
+        const bouleServer = this.homeOnServer(org, context, 'boule')
+            ? await this.serverHome(org, context, 'boule')
+            : null;
+        const dbId = bouleServer
+            ? ''
+            : await this.ensureCallsDatabase(org, context, projectUuid, environment, `${org.slug}-boule-db`, dbName, BOULE_DATABASE_SCOPE_KEY);
+        if (!bouleServer)
+            context.recordScopeId(BOULE_DATABASE_SCOPE_KEY, dbId);
         const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
@@ -5907,6 +6526,12 @@ export class FoundryStepExecutor {
             this.handledSecrets.add(bridgeSecret);
             envs.push({ key: BOULE_BRIDGE_SECRET_ENV, value: bridgeSecret });
         }
+        // The owner-seeding door's secret, for every org's Boule: minted once, read back from this env when seeding.
+        const ownerSeedSecret = await this.mintIfAbsent(app.appId, BOULE_OWNER_SEED_SECRET_ENV, 32);
+        if (ownerSeedSecret) {
+            this.handledSecrets.add(ownerSeedSecret);
+            envs.push({ key: BOULE_OWNER_SEED_SECRET_ENV, value: ownerSeedSecret });
+        }
         // Held, minted once (C3). Compared with the live value so a changed one restarts the app.
         const credentialEnvs = [];
         let archonPushedAt = null;
@@ -5938,13 +6563,14 @@ export class FoundryStepExecutor {
             const minted = [
                 peerPassword,
                 bridgeSecret,
+                ownerSeedSecret,
                 ...credentialEnvs.map((credential) => credential.value),
             ].filter((v) => v !== null);
             if (minted.length === 0)
                 throw error;
             throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), minted));
         }
-        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName);
+        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName, bouleServer ?? undefined);
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
@@ -5975,6 +6601,7 @@ export class FoundryStepExecutor {
                 appKey !== null ||
                 peerPassword !== null ||
                 bridgeSecret !== null ||
+                ownerSeedSecret !== null ||
                 secretsNotRestarted ||
                 dbPush.changed ||
                 mail.changed)) {