@wtfalch/foundry 0.33.1 → 0.34.0

package/dist/plan/diff.js

@@ -1,5 +1,5 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, ownsServices, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
@@ -10,9 +10,11 @@ import { planFilesKeys } from './entry-files-key.js';
 import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, orgLoginHost, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
+import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
+import { ownDnsHostnames } from './own-dns.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
@@ -56,6 +58,10 @@ function resourceKey(system, kind, key) {
 function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     if (PROVIDER_KINDS[r.system]?.includes(r.kind) && recordedValues.has(r.key))
         return true;
+    // The reader maps an applied own step's app onto its marker (`coolify:own-<service>:<org.id>`); only this org's id is its own.
+    if (r.system === 'coolify' && OWN_MARKER_KINDS.has(r.kind) && r.key === org.id) {
+        return Boolean(recordedIds[`coolify:${r.kind}:${org.id}`]);
+    }
     if (r.system === 'coolify') {
         if (r.kind === 'environment')
             return true;
@@ -78,6 +84,11 @@ function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     if (type === 'CNAME' && content.endsWith('.cfargotunnel.com') && tunnelHostnames.includes(name)) {
         return true;
     }
+    if (type === 'CNAME' &&
+        content.endsWith('.cfargotunnel.com') &&
+        ownDnsHostnames(recordedIds).includes(name)) {
+        return true;
+    }
     const mailDomain = recordedIds[MAIL_DOMAIN_SCOPE_KEY]?.toLowerCase();
     if (!mailDomain)
         return false;
@@ -86,6 +97,14 @@ function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     }
     return name === `_dmarc.${mailDomain}` || name.endsWith(`._domainkey.${mailDomain}`);
 }
+const OWN_MARKER_KINDS = new Set([
+    'own-auth',
+    'own-mail',
+    'own-files',
+    'own-files-r2',
+    'own-jobs',
+    'own-sfu',
+]);
 /** The kinds a provider lists a resource under before a recorded `system:kind:key` maps it to foundry's own. */
 const PROVIDER_KINDS = {
     coolify: ['application', 'database'],
@@ -167,6 +186,21 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #491 reads for mail). It signs in on the shared instance's own host, so
     // `issuer.usesDomain` never moves it.
     const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId);
+    // An own org's sign-in comes before every step that signs in through it.
+    const ownAuth = planOwnAuth({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        zone: org.domain ? zoneReadiness(org.domain, byKey) : null,
+        mailKeyHeld: options.ownMailKeyHeld ?? false,
+        mailKeyMintable: options.ownMailKeyMintable ?? false,
+    });
+    if (ownAuth.step)
+        plannedSteps.push(ownAuth.step);
+    // An own org's ZITADEL is the company's own instance: nothing that needs it plans before it exists.
+    const ownSignInPending = ownsServices(org) && !isPlatformOrg && !ownAuthApplied(org, recordedIds);
     const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady, isPlatformOrg);
     if (issuer.step)
         plannedSteps.push(issuer.step);
@@ -213,6 +247,17 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     else if (zone.step) {
         plannedSteps.push(zone.step);
     }
+    const ownMail = planOwnMail({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        mailRelayApplied: options.mailRelayApplied ?? false,
+        zoneActive: zone.step === null && !zoneWaiting,
+    });
+    if (ownMail.step)
+        plannedSteps.push(ownMail.step);
     const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId);
     // #238: own-domain mail publishes DNS records into the zone, so it waits for
     // an active zone -- blocked, not planned (rule 2).
@@ -238,6 +283,19 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady);
     if (calls.step)
         plannedSteps.push(calls.step);
+    // An own org's media server, before the calls service that reads its addresses.
+    const ownSfu = planOwnSfu({
+        org,
+        recordedIds,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        zoneActive: zone.step === null && !zoneWaiting,
+        readiness: platformReadiness,
+        sfuPortsOpen: options.sfuPortsOpen ?? false,
+        keysHeld: options.ownSfuKeysHeld ?? false,
+    });
+    if (ownSfu.step)
+        plannedSteps.push(ownSfu.step);
     // Right after the Matrix stack (#145): its own executor
     // (`executor.ts`'s `coolifyCallsService`) reads the Synapse/MAS addresses
     // and MAS client credentials `coolifyCalls` just recorded, the same
@@ -269,7 +327,30 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         if (masChange)
             versionChanges.push(masChange);
     }
-    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader);
+    // An own org's files host, before its organisation on it.
+    const ownFiles = planOwnFiles({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        filesDeps: options.ownFilesDeps ?? { keys: false, bucket: false },
+    });
+    if (ownFiles.step)
+        plannedSteps.push(ownFiles.step);
+    // After the host is applied: its storage key is delivered to the running host.
+    const ownFilesR2 = options.ownFilesR2Ports
+        ? planOwnFilesR2({
+            org,
+            recordedIds,
+            isPlatformOrg,
+            ownServices: options.ownServices ?? false,
+            ports: options.ownFilesR2Ports,
+        })
+        : { step: null, blocked: null };
+    if (ownFilesR2.step)
+        plannedSteps.push(ownFilesR2.step);
+    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader, ownsServices(org) && !isPlatformOrg && !recordedIds[`coolify:own-files:${org.id}`]);
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
     const aiOrganisation = planAiOrganisation(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader);
@@ -411,7 +492,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const agoraGuarded = guardApp(agoraClient);
     if (agoraGuarded)
         plannedSteps.push(agoraGuarded);
-    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost);
+    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost, isPlatformOrg, {
+        servesDiscovery: options.loginHostServesDiscovery ?? false,
+    });
     if (agora.step)
         plannedSteps.push(agora.step);
     // #161 (Boule part): every org's own Boule -- always on, no toggle, the same
@@ -433,10 +516,23 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleBroker = planBouleBrokerEntry(org, recordedIds, plannedSteps, options.broker ?? false);
     if (bouleBroker.step)
         plannedSteps.push(bouleBroker.step);
+    // An own org's scheduler, before its registration below.
+    const ownJobs = planOwnJobs({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        isPlatformOrg,
+        ownServices: options.ownServices ?? false,
+        tokenHeld: options.ownJobsTokenHeld ?? false,
+    });
+    if (ownJobs.step)
+        plannedSteps.push(ownJobs.step);
     // #173: register the org's own app with the platform's jobs scheduler.
     // After Agora, so a failing registration can never stop Agora from
     // provisioning (`runSteps` stops at the first failing step).
-    const jobsRegistration = planJobsRegistration(org, recordedIds, jobsAvailable || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
+    const jobsRegistration = planJobsRegistration(org, recordedIds, 
+    // An own org never registers with the shared scheduler the host supplies.
+    (jobsAvailable && !ownsServices(org)) || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
     if (jobsRegistration.step)
         plannedSteps.push(jobsRegistration.step);
     // F8 (#318), after Agora and Boule, not right after the zone: a route
@@ -489,6 +585,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // item list, so it rides along with the unmanaged items.
     if (agora.blocked)
         unmanaged.push({ description: agora.blocked, key: 'coolify:agora' });
+    if (agora.issuerNote)
+        unmanaged.push({ description: agora.issuerNote, key: 'coolify:agora' });
     if (boule.blocked)
         unmanaged.push({ description: boule.blocked, key: 'coolify:boule' });
     if (boule.mailBlocked) {
@@ -503,6 +601,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...edgeWorkers.blocked);
     unmanaged.push(...entryEdgeKeys.blocked);
     unmanaged.push(...edgeReservedLabels.blocked);
+    if (ownAuth.blocked)
+        unmanaged.push({ description: ownAuth.blocked, key: OWN_AUTH_BLOCKED_KEY });
+    if (ownJobs.blocked)
+        unmanaged.push({ description: ownJobs.blocked, key: OWN_JOBS_BLOCKED_KEY });
+    if (ownMail.blocked)
+        unmanaged.push({ description: ownMail.blocked, key: OWN_MAIL_BLOCKED_KEY });
+    if (ownSfu.blocked)
+        unmanaged.push({ description: ownSfu.blocked, key: OWN_SFU_BLOCKED_KEY });
+    if (ownSfu.firewall)
+        unmanaged.push({ description: ownSfu.firewall, key: OWN_SFU_FIREWALL_KEY });
+    if (ownFiles.blocked) {
+        unmanaged.push({ description: ownFiles.blocked, key: OWN_FILES_BLOCKED_KEY });
+    }
+    if (ownFilesR2.blocked) {
+        unmanaged.push({ description: ownFilesR2.blocked, key: OWN_FILES_R2_BLOCKED_KEY });
+    }
     // Same for a jobs registration that cannot run (no scheduler wired) or must
     // not run again (minted, never delivered).
     if (jobsRegistration.blocked) {
@@ -513,9 +627,20 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // `platformReadiness` instead of a host-supplied port. Each is reported at
     // most once even though a dependent step (owner, calls-service, storage,
     // budget, key) would otherwise also have nothing to act on.
-    if (issuer.blocked)
-        unmanaged.push({ description: issuer.blocked, key: 'zitadel:issuer' });
-    unmanaged.push(...owners.blocked);
+    if (ownSignInPending) {
+        // The sign-in step's own reason, when it has one, already says why the rest waits.
+        if (!ownAuth.blocked) {
+            unmanaged.push({
+                description: `${org.slug}'s ZITADEL steps are blocked, not planned: its own sign-in service is not applied yet`,
+                key: 'coolify:own-auth',
+            });
+        }
+    }
+    else {
+        if (issuer.blocked)
+            unmanaged.push({ description: issuer.blocked, key: 'zitadel:issuer' });
+        unmanaged.push(...owners.blocked);
+    }
     const domainBlocked = orgDomainBlocked(org, recordedIds);
     if (domainBlocked)
         unmanaged.push(domainBlocked);
@@ -568,12 +693,31 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...bouleBroker.blocked);
     return {
         orgId: org.id,
-        plannedSteps: plannedSteps.map(withStepSystem),
+        plannedSteps: (ownSignInPending
+            ? plannedSteps.filter((s) => !NEEDS_OWN_ZITADEL.has(`${s.action.system}:${s.action.kind}`))
+            : plannedSteps).map(withStepSystem),
         unmanaged,
         versionChanges,
         orgPostgres,
     };
 }
+/** Steps that run against the org's own ZITADEL instance (its projects, apps and broker entries). */
+const NEEDS_OWN_ZITADEL = new Set([
+    'zitadel:issuer',
+    'zitadel:registration-closed',
+    'zitadel:domain',
+    'zitadel:owner',
+    'zitadel:app',
+    'zitadel:customers',
+    'zitadel:id-token-userinfo',
+    'zitadel:login-host',
+    'coolify:chat',
+    'coolify:calls-service',
+    'coolify:calls-chat',
+    'coolify:broker-entry',
+    'coolify:boule-broker-entry',
+    'files:organisation',
+]);
 /**
  * #553: a plain ZITADEL app provision (not a `recreate`) is planned only when
  * the live listing lacks the app by name. If an app id is recorded for it,
@@ -926,6 +1070,9 @@ function platformAuthHostnameFrom(issuer) {
  */
 function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, platformAuthHostname, isPlatformOrg) {
     const none = { step: null, blocked: null };
+    // An own org's instance has no shared login host to bind: its issuer is the sign-in service's own.
+    if (ownsServices(org) && !isPlatformOrg)
+        return none;
     const key = resourceKey('zitadel', 'login-host', org.id);
     // The platform's own org signs in on the shared instance's host whatever
     // `issuer.usesDomain` says (turning it on would move the issuer).
@@ -938,7 +1085,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
         };
     }
     const sharedInstanceHost = isPlatformOrg && platformAuthHostname !== null;
-    const host = sharedInstanceHost ? platformAuthHostname : loginHostnameFor(org);
+    const host = orgLoginHost(org, sharedInstanceHost ? platformAuthHostname : null);
     // #488: the guard in `loginHostnameFor` fired -- the org's own domain host
     // would have been the platform's shared ZITADEL instance host.
     if (sharedInstanceHost) {
@@ -1495,7 +1642,9 @@ function planCalls(org, byKey, claimed, callsReady) {
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return {
             step: null,
-            blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
+            blocked: ownsServices(org)
+                ? `${org.slug}'s calls Matrix stack is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`
+                : `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
         };
     }
     // #248: the two images this stack's own apply would run, checked the same
@@ -1544,6 +1693,13 @@ function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlo
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return { step: null, blocked: null };
     }
+    // An own org's service names its own media server, so it waits for it even when already provisioned.
+    if (org.calls.enabled && ownsServices(org) && !callsReady) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls service is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`,
+        };
+    }
     // The introspection secret is shown once. One minted but never written to
     // the app is lost, so this reports it and mints no second (platform rule 1).
     const undelivered = recordedIds[CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
@@ -1771,13 +1927,21 @@ function notReadyReason(service, keyName, missingKeyRef, noKeyReader) {
  * Files organisation already exists -- the old origin is left allowed
  * rather than silently dropped.
  */
-function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false) {
+function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false, 
+/** An own org whose files host (`coolify:own-files:<org.id>`) is not recorded yet. */
+ownFilesPending = false) {
     const key = resourceKey('files', 'organisation', org.id);
     const live = byKey.get(key);
     if (live) {
         claimed.add(key);
         return { step: null, blocked: null };
     }
+    if (ownFilesPending) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Files organisation is blocked, not planned: its own files host is not applied yet`,
+        };
+    }
     if (!filesReady) {
         return {
             step: null,
@@ -2150,14 +2314,32 @@ function planAgoraClient(org, byKey, claimed) {
  * message naming each missing value, which `computePlanDetail` lists with the
  * plan's non-step items, so every other step still applies.
  */
-function planAgora(org, byKey, claimed, recordedIds, reading) {
+function planAgora(org, byKey, claimed, recordedIds, reading, isPlatformOrg, issuerSwitch) {
     const key = resourceKey('coolify', 'agora', org.id);
     const live = byKey.get(key);
     if (live)
         claimed.add(key);
+    const ownSignIn = ownsServices(org) && !isPlatformOrg;
+    if (ownSignIn && !ownAuthApplied(org, recordedIds)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Agora is blocked, not planned: its own sign-in service is not applied yet`,
+            issuerNote: null,
+        };
+    }
+    // The files host records its internal URL only while it applies, and Agora's
+    // env takes its files upstream from it: planned in the same pass, the first
+    // deploy would start without one. The company's files host exists only with a domain.
+    if (ownSignIn && org.domain && !recordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY]) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Agora is blocked, not planned: its own files host is not applied yet`,
+            issuerNote: null,
+        };
+    }
     const error = 'error' in reading ? reading.error : null;
-    const host = withRecordedMessagingProject('error' in reading ? NO_AGORA_HOST_VALUES : reading, recordedIds);
-    const missing = agoraHostMissing(host);
+    const platformHost = withRecordedMessagingProject('error' in reading ? NO_AGORA_HOST_VALUES : reading, recordedIds);
+    const missing = agoraHostMissing(platformHost);
     if (missing.length > 0) {
         // A fixed text, never the port's own message: this line is part of the
         // stale-plan comparison, and an error that varies per call would refuse
@@ -2166,8 +2348,41 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
         return {
             step: null,
             blocked: `${org.slug}'s Agora is blocked, not planned: the host supplies no ${missing.join(', ')}${why}`,
+            issuerNote: null,
         };
     }
+    // Agora signs in at the company's own login host, and refuses any issuer off
+    // its own address's domain. Only this value changes: the calls token env,
+    // chat and Boule keep reading the platform issuer from `reading`, and Agora
+    // always plans. The company host is written only once the login host is
+    // applied with Agora's client AND a live read said it serves discovery as
+    // that issuer. An Agora already on the company host keeps it while the host
+    // stays applied: a later failing read never flips it back (no oscillation).
+    let host = platformHost;
+    let issuerNote = null;
+    const choice = agoraIssuerHostFor(org, isPlatformOrg);
+    if (choice.mismatch) {
+        issuerNote = `${org.slug}'s Agora cannot sign in: its login host ${loginHostnameFor(org)} is not on its Agora address ${agoraHostnameFor(org)}; the login host must be on the org's domain`;
+    }
+    else if (choice.host) {
+        const loginHost = choice.host;
+        const target = `https://${loginHost}`;
+        const applied = loginHostServesAgora(loginHost, org, recordedIds);
+        if (applied && (liveAgoraIssuer(live) === target || issuerSwitch.servesDiscovery)) {
+            host = { ...platformHost, issuer: target };
+        }
+        else if (ownSignIn) {
+            // No platform issuer to fall back on: Agora waits for the company's own.
+            return {
+                step: null,
+                blocked: `${org.slug}'s Agora is blocked, not planned: ${target} does not answer OIDC discovery yet`,
+                issuerNote: null,
+            };
+        }
+        else {
+            issuerNote = `${org.slug}'s Agora keeps the platform issuer; the switch to ${target} is blocked, not planned, until ${loginHost} is applied with Agora's client and answers OIDC discovery`;
+        }
+    }
     // The executor writes exactly these host values, so what the plan showed
     // is what gets applied; the ids only the apply itself records are read at
     // run time.
@@ -2188,6 +2403,7 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
                 },
             },
             blocked: null,
+            issuerNote,
         };
     }
     const liveEnv = (live.config.env ?? {});
@@ -2215,8 +2431,9 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
     // actually serving this exact `env`; while it disagrees, the step stays
     // planned no matter what Coolify's env store already shows.
     const activated = recordedIds[AGORA_ACTIVATED_ENV_SCOPE_KEY] === agoraEnvRevision(env);
-    if (drift.length === 0 && activated && !portDrift)
-        return { step: null, blocked: null };
+    if (drift.length === 0 && activated && !portDrift) {
+        return { step: null, blocked: null, issuerNote };
+    }
     const reasons = [
         ...(drift.length > 0 ? [`${drift.join(', ')} missing or different`] : []),
         ...(portDrift ? ["ports_exposes wrong -- Traefik can't reach it"] : []),
@@ -2233,8 +2450,22 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
             },
         },
         blocked: null,
+        issuerNote,
     };
 }
+/** The issuer a live Agora's `AGORA_CONFIG` names, or null when it has none or is not JSON. */
+function liveAgoraIssuer(live) {
+    const raw = (live?.config.env ?? {}).AGORA_CONFIG;
+    if (raw === undefined)
+        return null;
+    try {
+        const issuer = JSON.parse(raw)?.issuer;
+        return typeof issuer === 'string' ? issuer : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * #161 (Boule part): every org gets one fixed ZITADEL web client named
  * `boule`, so its Boule (https://github.com/wtfalch/boule) can sign anyone in.
@@ -2871,6 +3102,16 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
     // The host says whether its executor has a scheduler to register with. A
     // fixed text: it is part of the stale-plan comparison.
     if (!jobsAvailable) {
+        if (ownsServices(org)) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s jobs registration is blocked, not planned: ${addressMissing
+                    ? `${org.slug}'s own jobs scheduler has not recorded its internal address yet; apply its own jobs step first`
+                    : missingKeyRef
+                        ? `${org.slug}'s own jobs admin token ${missingKeyRef} is not held yet`
+                        : `${org.slug}'s own jobs scheduler is not applied yet`}`,
+            };
+        }
         return {
             step: null,
             blocked: addressMissing

package/dist/plan/executor.d.ts

@@ -12,6 +12,7 @@ import { type EdgePlatformTunnels, type TunnelPort } from './edge-tunnels.js';
 import { type EdgePlatformZones, type ZonePort } from './edge-zones.js';
 import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
+import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
@@ -107,6 +108,9 @@ export interface CoolifyPort {
         custom_network_aliases?: string | null;
         health_check_enabled?: boolean;
         ports_exposes?: string;
+        /** Coolify's own record of the resource limits (`plan/own-limits.ts`). */
+        limits_memory?: string;
+        limits_cpus?: string;
     }>;
     createGithubAppApplication(input: {
         project_uuid: string;
@@ -162,6 +166,8 @@ export interface CoolifyPort {
         uuid: string;
         internal_db_url?: string;
         status?: string;
+        limits_memory?: string;
+        limits_cpus?: string;
     }>;
     /**
      * Every database Coolify holds. `coolifyDatabase` finds its own by name and
@@ -1144,6 +1150,16 @@ export interface ZitadelListAppsRawApp {
  * an operator's `MANAGEMENT_PUBLIC_KEYS`/`MANAGEMENT_ISSUER` pins.
  */
 export interface FilesOrganisationPort {
+    /**
+     * An own files host's R2 storage key, sent to that host once (the files route
+     * `PUT /v1/manage/r2-credentials`). Absent on a port that cannot: the own R2 key step is then
+     * blocked by name. The same pair may be sent again after a failed send.
+     */
+    storeR2Credentials?(input: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        tokenId: string;
+    }): Promise<void>;
     provisionOrganisation(input: {
         organisationId: string;
         ceilingBytes: string | null;
@@ -1447,6 +1463,12 @@ export interface PlatformOrgPortSource {
 }
 export interface FoundryStepExecutorPorts {
     coolify: CoolifyPort;
+    /**
+     * Ports for the instances an own org (`services.own`) runs itself. Without
+     * it, a step for an own org is refused rather than run against the shared
+     * services, and the planner reports the org's own services blocked.
+     */
+    ownServices?: OwnServicesPort;
     zitadel: ZitadelPort;
     mail: MailPort;
     lettermint: LettermintPort;
@@ -1694,11 +1716,32 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private readonly handledSecrets;
     constructor(ports: FoundryStepExecutorPorts);
     secretsHandled(): readonly string[];
+    /**
+     * An own org's step runs on a copy of this executor whose ZITADEL, mail,
+     * broker, files, jobs and calls ports are the org's own. A port the org has
+     * not got yet is absent or throws, never the shared one.
+     */
+    private executeScoped;
+    /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
+    ownMailKeyMintable(): boolean;
+    /** What the executor's own files dependencies supply, for the planner's blocked lines. */
+    ownFilesDeps(): {
+        keys: boolean;
+        bucket: boolean;
+    };
+    /** Which ports the own files storage key step needs this executor has, for the planner's blocked line. */
+    ownFilesR2Ports(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<{
+        r2Keys: boolean;
+        storeR2Credentials: boolean;
+    }>;
+    /** Whether the host's scoped ports for this own org include a files-organisation port. A held key still missing counts as no port. */
+    ownFilesOrganisationPort(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts(): Partial<Record<EdgePortName, boolean>>;
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
+    private run;
     /**
      * `plan/diff.ts`'s `planAccess` (#246): puts a `hosting.access` rule's
      * hostname behind a Cloudflare Access app named
@@ -2189,6 +2232,22 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * (which must never delete the platform's own project) change.
      */
     private ensureOrgLettermintRelay;
+    /**
+     * The company's own sign-in mail token: a Lettermint project `<slug>-auth`
+     * whose token goes to `orgTarget(org).refs.brokerMailKey`, where the broker
+     * and ZITADEL's SMTP settings read it. The platform-wide Lettermint key
+     * stays with the executor and never reaches a company. A held ref is left
+     * alone. Otherwise the mint rule of {@link ensureOrgAppMailToken}: create
+     * the project, restrict the domain, deliver its token, and only then
+     * delete every other `<slug>-auth` project (a token cannot be read back,
+     * so a project without a held token is a leftover). The restriction comes
+     * before the delivery so a failure there leaves no held ref: the next run
+     * starts over instead of skipping it. A failure before the delivery leaves
+     * that project for the next run to delete. Every Lettermint call is
+     * bounded; the token is registered for redaction before anything can throw
+     * with it.
+     */
+    private ensureOwnAuthMailToken;
     /**
      * Deletes a just-minted project from inside a `catch`. A failed delete is
      * dropped so it never replaces the error being rethrown; the orphan is
@@ -2684,6 +2743,54 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private zonePort;
     private jobsPort;
+    /**
+     * `plan/own-diff.ts`'s `planOwnJobs`: the org's own scheduler, in the org's
+     * own project, with the names and the held-key ref of `orgTarget(org)`. The
+     * admin token goes to `jobs:org:<slug>:adminToken` and nowhere else.
+     */
+    private ownJobs;
+    /**
+     * `plan/own-diff.ts`'s `planOwnFiles`: the org's own files host in the
+     * org's own project, trusting the company's issuer `https://auth.<domain>`.
+     * Its ZITADEL project `<slug>-files` and introspection app are made in the
+     * company's instance (`ownServices.zitadelFor`), never the shared one. The
+     * bucket comes from the host's bucket port under the target's name. The
+     * management key goes to `files:org:<slug>:managementKey` and the
+     * introspection secret to `zitadel:org:<slug>:files:introspection`, both
+     * once, and neither is recorded or returned.
+     */
+    private ownFiles;
+    /**
+     * `plan/own-diff.ts`'s `planOwnFilesR2`: the storage key of the org's own files bucket. A token
+     * recorded as undelivered is deleted first (its secret cannot be read back, so it can never be
+     * finished), then one is minted, registered as a secret, recorded by id as undelivered and
+     * persisted, and only then sent to the files host, the same pair on every retry. The secret is
+     * never recorded and never written to a Coolify env. The id is recorded once the host has it.
+     */
+    private ownFilesR2;
+    /**
+     * `plan/own-diff.ts`'s `planOwnAuth`: the org's own sign-in at
+     * `auth.<domain>`, in the org's own project, through the org's own edge
+     * routed DNS and tunnel ports. The instance owner token goes to
+     * `zitadel:org:<slug>:instanceBearer` and is never recorded. A changed
+     * declared auth ref patches both git apps' branch and redeploys them; the
+     * applied marker comes last, so a run that died halfway is planned again.
+     */
+    private ownAuth;
+    /**
+     * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own
+     * project, with no host port (the shared relay reaches it by internal name)
+     * and a directory that trusts the org's own sign-in. The admin key goes to
+     * `orgTarget(org).refs.mailAdminKey` and nowhere else. The address the relay
+     * routes to is recorded last, and the step's marker after it.
+     */
+    private ownMail;
+    /**
+     * `plan/own-diff.ts`'s `planOwnSfu`: the org's own LiveKit server in the
+     * org's project, on the ports of its slot. The company's key pair goes to
+     * `livekit:org:<slug>:keys` and the app's env, nowhere else.
+     */
+    private ownSfu;
     private jobsRegistration;
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     private deliverWithRetry;
@@ -2937,6 +3044,11 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * #491: when `mailDomain` is the platform's own apex, this must never
      * delete the platform's own project (the delete loop skips it by id) or
      * the platform's own domain (returns before the domain lookup/delete).
+     *
+     * An org whose own sign-in is applied keeps its `<slug>-auth` project, and
+     * keeps the Lettermint domain when that is the domain the sign-in sends
+     * from. Every other org deletes `<slug>-auth` too, which only a failed
+     * first sign-in run can have left behind.
      */
     private parkLettermintMail;
     /**