@wtfalch/foundry 0.32.0 → 0.34.0

package/dist/plan/diff.js

@@ -1,7 +1,7 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, ownsServices, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
@@ -10,12 +10,15 @@ import { planFilesKeys } from './entry-files-key.js';
 import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, orgLoginHost, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
+import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
+import { ownDnsHostnames } from './own-dns.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
+import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
@@ -55,6 +58,10 @@ function resourceKey(system, kind, key) {
 function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     if (PROVIDER_KINDS[r.system]?.includes(r.kind) && recordedValues.has(r.key))
         return true;
+    // The reader maps an applied own step's app onto its marker (`coolify:own-<service>:<org.id>`); only this org's id is its own.
+    if (r.system === 'coolify' && OWN_MARKER_KINDS.has(r.kind) && r.key === org.id) {
+        return Boolean(recordedIds[`coolify:${r.kind}:${org.id}`]);
+    }
     if (r.system === 'coolify') {
         if (r.kind === 'environment')
             return true;
@@ -77,6 +84,11 @@ function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     if (type === 'CNAME' && content.endsWith('.cfargotunnel.com') && tunnelHostnames.includes(name)) {
         return true;
     }
+    if (type === 'CNAME' &&
+        content.endsWith('.cfargotunnel.com') &&
+        ownDnsHostnames(recordedIds).includes(name)) {
+        return true;
+    }
     const mailDomain = recordedIds[MAIL_DOMAIN_SCOPE_KEY]?.toLowerCase();
     if (!mailDomain)
         return false;
@@ -85,6 +97,14 @@ function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     }
     return name === `_dmarc.${mailDomain}` || name.endsWith(`._domainkey.${mailDomain}`);
 }
+const OWN_MARKER_KINDS = new Set([
+    'own-auth',
+    'own-mail',
+    'own-files',
+    'own-files-r2',
+    'own-jobs',
+    'own-sfu',
+]);
 /** The kinds a provider lists a resource under before a recorded `system:kind:key` maps it to foundry's own. */
 const PROVIDER_KINDS = {
     coolify: ['application', 'database'],
@@ -165,11 +185,34 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // The platform's own org: its domain is the platform apex (the same fact
     // #491 reads for mail). It signs in on the shared instance's own host, so
     // `issuer.usesDomain` never moves it.
-    const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformApex);
+    const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId);
+    // An own org's sign-in comes before every step that signs in through it.
+    const ownAuth = planOwnAuth({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        zone: org.domain ? zoneReadiness(org.domain, byKey) : null,
+        mailKeyHeld: options.ownMailKeyHeld ?? false,
+        mailKeyMintable: options.ownMailKeyMintable ?? false,
+    });
+    if (ownAuth.step)
+        plannedSteps.push(ownAuth.step);
+    // An own org's ZITADEL is the company's own instance: nothing that needs it plans before it exists.
+    const ownSignInPending = ownsServices(org) && !isPlatformOrg && !ownAuthApplied(org, recordedIds);
     const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady, isPlatformOrg);
     if (issuer.step)
         plannedSteps.push(issuer.step);
-    plannedSteps.push(...planOwners(org, recordedIds, platformReadiness.authReady, platformReadiness.authIssuer));
+    // Before the domain and the owners: no invite runs on an org still open to registration.
+    const registrationClosed = planOrgRegistrationClosed(org, recordedIds, platformReadiness.authReady, issuer.step);
+    if (registrationClosed)
+        plannedSteps.push(registrationClosed);
+    const orgDomain = planOrgDomain(org, recordedIds, platformReadiness.authReady, issuer.step);
+    if (orgDomain)
+        plannedSteps.push(orgDomain);
+    const owners = planOwners(org, recordedIds, platformReadiness.authReady, platformReadiness.authIssuer, options.ownerInviteMail ?? false, registrationClosed !== null);
+    plannedSteps.push(...owners.steps);
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
@@ -204,6 +247,17 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     else if (zone.step) {
         plannedSteps.push(zone.step);
     }
+    const ownMail = planOwnMail({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        mailRelayApplied: options.mailRelayApplied ?? false,
+        zoneActive: zone.step === null && !zoneWaiting,
+    });
+    if (ownMail.step)
+        plannedSteps.push(ownMail.step);
     const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId);
     // #238: own-domain mail publishes DNS records into the zone, so it waits for
     // an active zone -- blocked, not planned (rule 2).
@@ -229,6 +283,19 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady);
     if (calls.step)
         plannedSteps.push(calls.step);
+    // An own org's media server, before the calls service that reads its addresses.
+    const ownSfu = planOwnSfu({
+        org,
+        recordedIds,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        zoneActive: zone.step === null && !zoneWaiting,
+        readiness: platformReadiness,
+        sfuPortsOpen: options.sfuPortsOpen ?? false,
+        keysHeld: options.ownSfuKeysHeld ?? false,
+    });
+    if (ownSfu.step)
+        plannedSteps.push(ownSfu.step);
     // Right after the Matrix stack (#145): its own executor
     // (`executor.ts`'s `coolifyCallsService`) reads the Synapse/MAS addresses
     // and MAS client credentials `coolifyCalls` just recorded, the same
@@ -260,7 +327,30 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         if (masChange)
             versionChanges.push(masChange);
     }
-    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader);
+    // An own org's files host, before its organisation on it.
+    const ownFiles = planOwnFiles({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        filesDeps: options.ownFilesDeps ?? { keys: false, bucket: false },
+    });
+    if (ownFiles.step)
+        plannedSteps.push(ownFiles.step);
+    // After the host is applied: its storage key is delivered to the running host.
+    const ownFilesR2 = options.ownFilesR2Ports
+        ? planOwnFilesR2({
+            org,
+            recordedIds,
+            isPlatformOrg,
+            ownServices: options.ownServices ?? false,
+            ports: options.ownFilesR2Ports,
+        })
+        : { step: null, blocked: null };
+    if (ownFilesR2.step)
+        plannedSteps.push(ownFilesR2.step);
+    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader, ownsServices(org) && !isPlatformOrg && !recordedIds[`coolify:own-files:${org.id}`]);
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
     const aiOrganisation = planAiOrganisation(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader);
@@ -402,7 +492,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const agoraGuarded = guardApp(agoraClient);
     if (agoraGuarded)
         plannedSteps.push(agoraGuarded);
-    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost);
+    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost, isPlatformOrg, {
+        servesDiscovery: options.loginHostServesDiscovery ?? false,
+    });
     if (agora.step)
         plannedSteps.push(agora.step);
     // #161 (Boule part): every org's own Boule -- always on, no toggle, the same
@@ -424,10 +516,23 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleBroker = planBouleBrokerEntry(org, recordedIds, plannedSteps, options.broker ?? false);
     if (bouleBroker.step)
         plannedSteps.push(bouleBroker.step);
+    // An own org's scheduler, before its registration below.
+    const ownJobs = planOwnJobs({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        tokenHeld: options.ownJobsTokenHeld ?? false,
+    });
+    if (ownJobs.step)
+        plannedSteps.push(ownJobs.step);
     // #173: register the org's own app with the platform's jobs scheduler.
     // After Agora, so a failing registration can never stop Agora from
     // provisioning (`runSteps` stops at the first failing step).
-    const jobsRegistration = planJobsRegistration(org, recordedIds, jobsAvailable || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
+    const jobsRegistration = planJobsRegistration(org, recordedIds, 
+    // An own org never registers with the shared scheduler the host supplies.
+    (jobsAvailable && !ownsServices(org)) || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
     if (jobsRegistration.step)
         plannedSteps.push(jobsRegistration.step);
     // F8 (#318), after Agora and Boule, not right after the zone: a route
@@ -480,6 +585,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // item list, so it rides along with the unmanaged items.
     if (agora.blocked)
         unmanaged.push({ description: agora.blocked, key: 'coolify:agora' });
+    if (agora.issuerNote)
+        unmanaged.push({ description: agora.issuerNote, key: 'coolify:agora' });
     if (boule.blocked)
         unmanaged.push({ description: boule.blocked, key: 'coolify:boule' });
     if (boule.mailBlocked) {
@@ -494,6 +601,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...edgeWorkers.blocked);
     unmanaged.push(...entryEdgeKeys.blocked);
     unmanaged.push(...edgeReservedLabels.blocked);
+    if (ownAuth.blocked)
+        unmanaged.push({ description: ownAuth.blocked, key: OWN_AUTH_BLOCKED_KEY });
+    if (ownJobs.blocked)
+        unmanaged.push({ description: ownJobs.blocked, key: OWN_JOBS_BLOCKED_KEY });
+    if (ownMail.blocked)
+        unmanaged.push({ description: ownMail.blocked, key: OWN_MAIL_BLOCKED_KEY });
+    if (ownSfu.blocked)
+        unmanaged.push({ description: ownSfu.blocked, key: OWN_SFU_BLOCKED_KEY });
+    if (ownSfu.firewall)
+        unmanaged.push({ description: ownSfu.firewall, key: OWN_SFU_FIREWALL_KEY });
+    if (ownFiles.blocked) {
+        unmanaged.push({ description: ownFiles.blocked, key: OWN_FILES_BLOCKED_KEY });
+    }
+    if (ownFilesR2.blocked) {
+        unmanaged.push({ description: ownFilesR2.blocked, key: OWN_FILES_R2_BLOCKED_KEY });
+    }
     // Same for a jobs registration that cannot run (no scheduler wired) or must
     // not run again (minted, never delivered).
     if (jobsRegistration.blocked) {
@@ -504,8 +627,23 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // `platformReadiness` instead of a host-supplied port. Each is reported at
     // most once even though a dependent step (owner, calls-service, storage,
     // budget, key) would otherwise also have nothing to act on.
-    if (issuer.blocked)
-        unmanaged.push({ description: issuer.blocked, key: 'zitadel:issuer' });
+    if (ownSignInPending) {
+        // The sign-in step's own reason, when it has one, already says why the rest waits.
+        if (!ownAuth.blocked) {
+            unmanaged.push({
+                description: `${org.slug}'s ZITADEL steps are blocked, not planned: its own sign-in service is not applied yet`,
+                key: 'coolify:own-auth',
+            });
+        }
+    }
+    else {
+        if (issuer.blocked)
+            unmanaged.push({ description: issuer.blocked, key: 'zitadel:issuer' });
+        unmanaged.push(...owners.blocked);
+    }
+    const domainBlocked = orgDomainBlocked(org, recordedIds);
+    if (domainBlocked)
+        unmanaged.push(domainBlocked);
     // #267 (rule 2): a login host with no ZITADEL org to trust it in is blocked, not planned to throw.
     if (loginHost.blocked) {
         unmanaged.push({ description: loginHost.blocked, key: 'zitadel:login-host' });
@@ -555,12 +693,31 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...bouleBroker.blocked);
     return {
         orgId: org.id,
-        plannedSteps: plannedSteps.map(withStepSystem),
+        plannedSteps: (ownSignInPending
+            ? plannedSteps.filter((s) => !NEEDS_OWN_ZITADEL.has(`${s.action.system}:${s.action.kind}`))
+            : plannedSteps).map(withStepSystem),
         unmanaged,
         versionChanges,
         orgPostgres,
     };
 }
+/** Steps that run against the org's own ZITADEL instance (its projects, apps and broker entries). */
+const NEEDS_OWN_ZITADEL = new Set([
+    'zitadel:issuer',
+    'zitadel:registration-closed',
+    'zitadel:domain',
+    'zitadel:owner',
+    'zitadel:app',
+    'zitadel:customers',
+    'zitadel:id-token-userinfo',
+    'zitadel:login-host',
+    'coolify:chat',
+    'coolify:calls-service',
+    'coolify:calls-chat',
+    'coolify:broker-entry',
+    'coolify:boule-broker-entry',
+    'files:organisation',
+]);
 /**
  * #553: a plain ZITADEL app provision (not a `recreate`) is planned only when
  * the live listing lacks the app by name. If an app id is recorded for it,
@@ -698,6 +855,70 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
         blocked: null,
     };
 }
+/**
+ * Closes self-registration on a ZITADEL org that already exists and has no
+ * recorded close: one made before foundry closed it, or one whose close failed
+ * inside the issuer step. A fresh org is closed inside the issuer step, so
+ * nothing is planned beside that step. While this step is planned no owner is
+ * invited ({@link planOwners}).
+ */
+function planOrgRegistrationClosed(org, recordedIds, authReady, issuerStep) {
+    if (!authReady)
+        return null;
+    if (issuerStep?.action.desired.provision === true)
+        return null;
+    if (!recordedIds.zitadel_org)
+        return null;
+    if (recordedIds[ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY] === recordedIds.zitadel_org) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'registration-closed', key: org.id, desired: {} },
+        step: {
+            description: `switch self-registration off on ${org.slug}'s sign-in org`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
+/** The blocked item for an org sign-in domain the sign-in server refused to make primary. */
+function orgDomainBlocked(org, recordedIds) {
+    const domain = signInOrgDomain(org);
+    if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() !== domain)
+        return null;
+    if (recordedIds[ZITADEL_ORG_DOMAIN_SCOPE_KEY]?.toLowerCase() === domain)
+        return null;
+    return { description: signInDomainBlockedText(org.slug, domain), key: 'zitadel:domain' };
+}
+/**
+ * Registers the org's sign-in domain (its own, or `<slug>.oikos.host`) on its ZITADEL org
+ * and makes it primary, so an owner signs in as `name@<domain>`. Idempotent on the
+ * *recorded* `zitadel_org_domain`: a changed declared domain plans it again. A fresh
+ * org gets its domain inside the issuer step, so nothing is planned beside that step.
+ * Nothing is planned until the ZITADEL org exists.
+ */
+function planOrgDomain(org, recordedIds, authReady, issuerStep) {
+    if (!authReady)
+        return null;
+    if (issuerStep?.action.desired.provision === true)
+        return null;
+    if (!recordedIds.zitadel_org)
+        return null;
+    const domain = signInOrgDomain(org);
+    if (recordedIds[ZITADEL_ORG_DOMAIN_SCOPE_KEY]?.toLowerCase() === domain)
+        return null;
+    // Refused once: reported as blocked (see `orgDomainBlocked`), not planned again.
+    if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() === domain)
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'domain', key: org.id, desired: { domain } },
+        step: {
+            description: `register ${domain} as ${org.slug}'s sign-in domain`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /**
  * The org's owners, one step each, each invited by ZITADEL email once the org's ZITADEL org
  * exists (goal line: "the org's owner is invited by ZITADEL email and sets a
@@ -718,6 +939,11 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
  * issuer step immediately before it in the same run: `plan-apply.ts`'s
  * `runSteps` awaits each planned step in array order, one at a time.
  *
+ * An owner signs in as `name@<org domain>`, so each unrecorded owner needs a work
+ * address (`mailboxAddress`, or `mail.ownerMailboxAddress` for the first owner) and the
+ * host needs an `ownerInviteMail` port to send the first-sign-in link to the personal
+ * address. Without either, that owner is a blocked item named by position (rule 2).
+ *
  * `desired` carries the owner's email so the executor can pass it to
  * `ZitadelClient.inviteOrgOwner` — but the step's own `description` never
  * does. `Plan` (the public contract `AuditLog.recordPlan`/`recordApply`
@@ -726,19 +952,40 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
  * nothing here puts it anywhere beyond what audit already records for the
  * org.
  */
-function planOwners(org, recordedIds, authReady, authIssuer) {
+function planOwners(org, recordedIds, authReady, authIssuer, ownerInviteMail, registrationOpen = false) {
+    const steps = [];
+    const blocked = [];
+    // The close step is planned in this plan; the invites come with the next one, after it succeeded.
+    if (registrationOpen)
+        return { steps, blocked };
     // #177: nothing to invite into yet -- `planIssuer` already reports the
     // platform's sign-in as blocked, so these steps stay silent rather than
     // repeating it.
     if (!authReady)
-        return [];
-    const steps = [];
+        return { steps, blocked };
+    const mailboxes = ownerMailboxes(org);
     org.owners.forEach((owner, index) => {
         // Every owner is keyed by its lowercased email (as `validateOwners` compares
         // it), so reordering the list never moves a key onto another person.
         const key = `${org.id}:${owner.email.toLowerCase()}`;
         if (recordedIds[resourceKey('zitadel', 'owner', key)])
             return; // already invited.
+        const position = index + 1;
+        const mailboxAddress = mailboxes[index]?.address;
+        if (!mailboxAddress) {
+            blocked.push({
+                description: `${org.slug}'s owner ${position} is blocked, not planned: no mailboxAddress is declared, and the owner signs in as name@<the org's domain>`,
+                key: `zitadel:owner:${position}`,
+            });
+            return;
+        }
+        if (!ownerInviteMail) {
+            blocked.push({
+                description: `${org.slug}'s owner ${position} is blocked, not planned: the host has no ownerInviteMail port, and the owner cannot open their work mailbox yet`,
+                key: `zitadel:owner:${position}`,
+            });
+            return;
+        }
         steps.push({
             action: {
                 system: 'zitadel',
@@ -746,6 +993,7 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
                 key,
                 desired: {
                     email: owner.email,
+                    mailboxAddress,
                     givenName: owner.givenName,
                     familyName: owner.familyName,
                     // The platform's login app, where the invite link must land (it serves `/verify`).
@@ -761,7 +1009,7 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
             },
         });
     });
-    return steps;
+    return { steps, blocked };
 }
 /**
  * #488: the bare hostname out of an issuer URL (`https://<hostname>`, the
@@ -771,8 +1019,8 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
-export function isPlatformOwnOrg(org, platformApex) {
-    return Boolean(org.domain && platformApex && org.domain.toLowerCase() === platformApex.toLowerCase());
+export function isPlatformOwnOrg(org, platformOwnerOrgId) {
+    return Boolean(platformOwnerOrgId && org.id === platformOwnerOrgId);
 }
 function platformAuthHostnameFrom(issuer) {
     if (!issuer)
@@ -822,6 +1070,9 @@ function platformAuthHostnameFrom(issuer) {
  */
 function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, platformAuthHostname, isPlatformOrg) {
     const none = { step: null, blocked: null };
+    // An own org's instance has no shared login host to bind: its issuer is the sign-in service's own.
+    if (ownsServices(org) && !isPlatformOrg)
+        return none;
     const key = resourceKey('zitadel', 'login-host', org.id);
     // The platform's own org signs in on the shared instance's host whatever
     // `issuer.usesDomain` says (turning it on would move the issuer).
@@ -834,7 +1085,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
         };
     }
     const sharedInstanceHost = isPlatformOrg && platformAuthHostname !== null;
-    const host = sharedInstanceHost ? platformAuthHostname : loginHostnameFor(org);
+    const host = orgLoginHost(org, sharedInstanceHost ? platformAuthHostname : null);
     // #488: the guard in `loginHostnameFor` fired -- the org's own domain host
     // would have been the platform's shared ZITADEL instance host.
     if (sharedInstanceHost) {
@@ -1391,7 +1642,9 @@ function planCalls(org, byKey, claimed, callsReady) {
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return {
             step: null,
-            blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
+            blocked: ownsServices(org)
+                ? `${org.slug}'s calls Matrix stack is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`
+                : `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
         };
     }
     // #248: the two images this stack's own apply would run, checked the same
@@ -1440,6 +1693,13 @@ function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlo
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return { step: null, blocked: null };
     }
+    // An own org's service names its own media server, so it waits for it even when already provisioned.
+    if (org.calls.enabled && ownsServices(org) && !callsReady) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls service is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`,
+        };
+    }
     // The introspection secret is shown once. One minted but never written to
     // the app is lost, so this reports it and mints no second (platform rule 1).
     const undelivered = recordedIds[CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
@@ -1667,13 +1927,21 @@ function notReadyReason(service, keyName, missingKeyRef, noKeyReader) {
  * Files organisation already exists -- the old origin is left allowed
  * rather than silently dropped.
  */
-function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false) {
+function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false, 
+/** An own org whose files host (`coolify:own-files:<org.id>`) is not recorded yet. */
+ownFilesPending = false) {
     const key = resourceKey('files', 'organisation', org.id);
     const live = byKey.get(key);
     if (live) {
         claimed.add(key);
         return { step: null, blocked: null };
     }
+    if (ownFilesPending) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Files organisation is blocked, not planned: its own files host is not applied yet`,
+        };
+    }
     if (!filesReady) {
         return {
             step: null,
@@ -2046,14 +2314,32 @@ function planAgoraClient(org, byKey, claimed) {
  * message naming each missing value, which `computePlanDetail` lists with the
  * plan's non-step items, so every other step still applies.
  */
-function planAgora(org, byKey, claimed, recordedIds, reading) {
+function planAgora(org, byKey, claimed, recordedIds, reading, isPlatformOrg, issuerSwitch) {
     const key = resourceKey('coolify', 'agora', org.id);
     const live = byKey.get(key);
     if (live)
         claimed.add(key);
+    const ownSignIn = ownsServices(org) && !isPlatformOrg;
+    if (ownSignIn && !ownAuthApplied(org, recordedIds)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Agora is blocked, not planned: its own sign-in service is not applied yet`,
+            issuerNote: null,
+        };
+    }
+    // The files host records its internal URL only while it applies, and Agora's
+    // env takes its files upstream from it: planned in the same pass, the first
+    // deploy would start without one. The company's files host exists only with a domain.
+    if (ownSignIn && org.domain && !recordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY]) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Agora is blocked, not planned: its own files host is not applied yet`,
+            issuerNote: null,
+        };
+    }
     const error = 'error' in reading ? reading.error : null;
-    const host = withRecordedMessagingProject('error' in reading ? NO_AGORA_HOST_VALUES : reading, recordedIds);
-    const missing = agoraHostMissing(host);
+    const platformHost = withRecordedMessagingProject('error' in reading ? NO_AGORA_HOST_VALUES : reading, recordedIds);
+    const missing = agoraHostMissing(platformHost);
     if (missing.length > 0) {
         // A fixed text, never the port's own message: this line is part of the
         // stale-plan comparison, and an error that varies per call would refuse
@@ -2062,8 +2348,41 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
         return {
             step: null,
             blocked: `${org.slug}'s Agora is blocked, not planned: the host supplies no ${missing.join(', ')}${why}`,
+            issuerNote: null,
         };
     }
+    // Agora signs in at the company's own login host, and refuses any issuer off
+    // its own address's domain. Only this value changes: the calls token env,
+    // chat and Boule keep reading the platform issuer from `reading`, and Agora
+    // always plans. The company host is written only once the login host is
+    // applied with Agora's client AND a live read said it serves discovery as
+    // that issuer. An Agora already on the company host keeps it while the host
+    // stays applied: a later failing read never flips it back (no oscillation).
+    let host = platformHost;
+    let issuerNote = null;
+    const choice = agoraIssuerHostFor(org, isPlatformOrg);
+    if (choice.mismatch) {
+        issuerNote = `${org.slug}'s Agora cannot sign in: its login host ${loginHostnameFor(org)} is not on its Agora address ${agoraHostnameFor(org)}; the login host must be on the org's domain`;
+    }
+    else if (choice.host) {
+        const loginHost = choice.host;
+        const target = `https://${loginHost}`;
+        const applied = loginHostServesAgora(loginHost, org, recordedIds);
+        if (applied && (liveAgoraIssuer(live) === target || issuerSwitch.servesDiscovery)) {
+            host = { ...platformHost, issuer: target };
+        }
+        else if (ownSignIn) {
+            // No platform issuer to fall back on: Agora waits for the company's own.
+            return {
+                step: null,
+                blocked: `${org.slug}'s Agora is blocked, not planned: ${target} does not answer OIDC discovery yet`,
+                issuerNote: null,
+            };
+        }
+        else {
+            issuerNote = `${org.slug}'s Agora keeps the platform issuer; the switch to ${target} is blocked, not planned, until ${loginHost} is applied with Agora's client and answers OIDC discovery`;
+        }
+    }
     // The executor writes exactly these host values, so what the plan showed
     // is what gets applied; the ids only the apply itself records are read at
     // run time.
@@ -2084,6 +2403,7 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
                 },
             },
             blocked: null,
+            issuerNote,
         };
     }
     const liveEnv = (live.config.env ?? {});
@@ -2111,8 +2431,9 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
     // actually serving this exact `env`; while it disagrees, the step stays
     // planned no matter what Coolify's env store already shows.
     const activated = recordedIds[AGORA_ACTIVATED_ENV_SCOPE_KEY] === agoraEnvRevision(env);
-    if (drift.length === 0 && activated && !portDrift)
-        return { step: null, blocked: null };
+    if (drift.length === 0 && activated && !portDrift) {
+        return { step: null, blocked: null, issuerNote };
+    }
     const reasons = [
         ...(drift.length > 0 ? [`${drift.join(', ')} missing or different`] : []),
         ...(portDrift ? ["ports_exposes wrong -- Traefik can't reach it"] : []),
@@ -2129,8 +2450,22 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
             },
         },
         blocked: null,
+        issuerNote,
     };
 }
+/** The issuer a live Agora's `AGORA_CONFIG` names, or null when it has none or is not JSON. */
+function liveAgoraIssuer(live) {
+    const raw = (live?.config.env ?? {}).AGORA_CONFIG;
+    if (raw === undefined)
+        return null;
+    try {
+        const issuer = JSON.parse(raw)?.issuer;
+        return typeof issuer === 'string' ? issuer : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * #161 (Boule part): every org gets one fixed ZITADEL web client named
  * `boule`, so its Boule (https://github.com/wtfalch/boule) can sign anyone in.
@@ -2237,6 +2572,7 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         ? `${org.slug}'s Boule mail is blocked, not planned: ${mailBlockedReason}`
         : null;
     const mailOn = mailWanted && !mailBlocked;
+    const platformOwner = isPlatformOwnOrg(org, readiness.platformOwnerOrgId);
     const action = {
         system: 'coolify',
         kind: 'boule',
@@ -2249,6 +2585,8 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
             platformApex: readiness.platformApex,
             platformLettermintProjectId: readiness.platformLettermintProjectId,
             mailBlocked: mailBlocked !== null,
+            // Only the platform's own org's Boule gets the peer password for Archon.
+            platformOwner,
         },
     };
     if (!live) {
@@ -2269,6 +2607,15 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         bouleMailTokenDrift(liveEnv[BOULE_MAIL_TOKEN_ENV], live.config.appMailToken)) {
         drift.push(BOULE_MAIL_TOKEN_ENV);
     }
+    // The peer password is secret, so only its absence is compared.
+    if (platformOwner && !liveEnv[BOULE_PEER_PASSWORD_ENV])
+        drift.push(BOULE_PEER_PASSWORD_ENV);
+    if (platformOwner && !liveEnv[BOULE_BRIDGE_SECRET_ENV])
+        drift.push(BOULE_BRIDGE_SECRET_ENV);
+    // Secrets written but Boule not restarted since: plan the step so it restarts, minting nothing.
+    if (platformOwner && !recordedIds[BOULE_SECRETS_RESTARTED_SCOPE_KEY]) {
+        drift.push('restart after the peer password and bridge secret');
+    }
     if (drift.length === 0)
         return { step: null, blocked: null, mailBlocked };
     return {
@@ -2755,6 +3102,16 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
     // The host says whether its executor has a scheduler to register with. A
     // fixed text: it is part of the stale-plan comparison.
     if (!jobsAvailable) {
+        if (ownsServices(org)) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s jobs registration is blocked, not planned: ${addressMissing
+                    ? `${org.slug}'s own jobs scheduler has not recorded its internal address yet; apply its own jobs step first`
+                    : missingKeyRef
+                        ? `${org.slug}'s own jobs admin token ${missingKeyRef} is not held yet`
+                        : `${org.slug}'s own jobs scheduler is not applied yet`}`,
+            };
+        }
         return {
             step: null,
             blocked: addressMissing