@wtfalch/foundry 0.33.1 → 0.34.0

package/dist/plan/plan-apply.js

@@ -1,20 +1,25 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { validateHosting } from '../org.js';
+import { sfuSlotPorts } from '../calls-sfu.js';
+import { ownsServices, validateHosting } from '../org.js';
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
 import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
-import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
+import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, isPlatformOwnOrg, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
+import { agoraIssuerHostFor, loginHostServesAgora, readLoginHostDiscovery, } from './login-host.js';
+import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, } from './mail-relay.js';
+import { findNameClashes, nameClashMessage } from './org-names.js';
+import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, dnsBlockedReason, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, NO_DOMAIN_MAIL_APEX, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
@@ -126,6 +131,10 @@ const HOSTNAME_STEPS = new Set([
  * destructive or migrating step without the org's name typed, or one the
  * actor is not authorized to run.
  */
+/** `unmanaged` key of the fixed line for an own org on a host with no `ownServices` port. */
+const OWN_SERVICES_PORT_ABSENT_KEY = 'own-services:port';
+/** `unmanaged` key of the fixed line for an own org whose scoped ports have no files-organisation port. */
+const OWN_FILES_ORGANISATION_PORT_ABSENT_KEY = 'own-services:files-port';
 export class FoundryPlanApply {
     store;
     readers;
@@ -137,6 +146,7 @@ export class FoundryPlanApply {
     agora;
     jobsScheduler;
     loginHostBindings;
+    loginHostDiscovery;
     zitadelIdTokenUserinfo;
     broker;
     edgeWorkers;
@@ -144,6 +154,8 @@ export class FoundryPlanApply {
     hostFiles;
     hostAi;
     hostEdge;
+    hostOwnServices;
+    sfuPortsOpen;
     onlySteps;
     now;
     leaseTtlMs;
@@ -161,6 +173,7 @@ export class FoundryPlanApply {
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
+        this.loginHostDiscovery = options.loginHostDiscovery;
         this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
         this.broker = options.broker ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
@@ -168,6 +181,8 @@ export class FoundryPlanApply {
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
         this.hostEdge = options.edge ?? false;
+        this.hostOwnServices = options.ownServices ?? false;
+        this.sfuPortsOpen = options.sfuPortsOpen;
         this.onlySteps = options.onlySteps;
         this.now = options.now ?? (() => new Date());
         this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
@@ -897,21 +912,45 @@ export class FoundryPlanApply {
         });
         return applied;
     }
+    /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
+    async readSfuPortsOpen(org) {
+        const slot = org.services?.sfuSlot;
+        if (!this.sfuPortsOpen || !ownsServices(org) || !org.calls.enabled || !slot)
+            return false;
+        let ports;
+        try {
+            ports = sfuSlotPorts(slot);
+        }
+        catch {
+            return false;
+        }
+        const timeout = new Promise((resolve) => setTimeout(() => resolve(false), 5_000));
+        return Promise.race([this.sfuPortsOpen(ports).catch(() => false), timeout]);
+    }
     async computeFreshPlan(id) {
         const org = await this.store.get(id);
         if (!org)
             throw new DeclaredOrgNotFoundError(id);
-        const [live, applied, platformReadiness, agoraHost, archonUrl] = await Promise.all([
-            readLiveResources(id, this.readers),
-            this.store.getAppliedState(id),
-            this.orgPlatformReadiness(),
-            this.orgAgoraHost(id),
+        const applied = await this.store.getAppliedState(id);
+        const [live, platformReadiness, agoraHost, archonUrl] = await Promise.all([
+            readLiveResources(id, this.readers, org, applied?.serviceIds ?? {}),
+            this.orgPlatformReadiness(org, applied?.serviceIds ?? {}),
+            this.orgAgoraHost(org, applied?.serviceIds ?? {}),
             this.orgArchonUrl(),
         ]);
         const otherSlugs = (await this.store.list()).filter((o) => o.id !== id).map((o) => o.slug);
         const platformHostnames = await this.platformServiceHostnames();
+        const recorded = applied?.serviceIds ?? {};
+        // Read only for an org Agora may switch and whose login host is applied.
+        const issuerHost = agoraIssuerHostFor(org, isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId)).host;
+        const loginHostServesDiscovery = issuerHost !== null && loginHostServesAgora(issuerHost, org, recorded)
+            ? await readLoginHostDiscovery(this.loginHostDiscovery, issuerHost)
+            : false;
+        const sfuPortsOpen = await this.readSfuPortsOpen(org);
+        const resumable = await this.ownResumableRefs(org);
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
+            loginHostServesDiscovery,
             zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
             broker: this.broker,
             edgeWorkers: this.edgeWorkers,
@@ -920,7 +959,47 @@ export class FoundryPlanApply {
             now: () => this.now().getTime(),
             archonUrl,
             platformHostnames,
+            ownServices: this.hostOwnServices,
+            ownMailKeyHeld: await this.ownMailKeyHeld(org),
+            ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            ownJobsTokenHeld: resumable.jobs,
+            ownSfuKeysHeld: resumable.sfu,
+            ...(ownsServices(org) ? { mailRelayApplied: await this.mailRelayApplied() } : {}),
+            sfuPortsOpen,
+            ownFilesDeps: this.executor.ownFilesDeps?.(),
+            ...(ownsServices(org) && this.executor.ownFilesR2Ports
+                ? { ownFilesR2Ports: await this.executor.ownFilesR2Ports(org, recorded) }
+                : {}),
         });
+        if (ownsServices(org) && !this.hostOwnServices) {
+            detail.unmanaged.push({
+                description: `${org.slug} runs its own services, and this host has no ownServices port`,
+                key: OWN_SERVICES_PORT_ABSENT_KEY,
+            });
+        }
+        if (ownsServices(org) &&
+            this.hostOwnServices &&
+            detail.plannedSteps.some(({ action }) => action.system === 'files' && action.kind === 'organisation') &&
+            (await this.executor.ownFilesOrganisationPort?.(org, recorded)) === false) {
+            detail.plannedSteps = detail.plannedSteps.filter(({ action }) => !(action.system === 'files' && action.kind === 'organisation'));
+            detail.unmanaged.push({
+                description: `${org.slug}'s Files organisation is blocked, not planned: the host gave the company no files-organisation port`,
+                key: OWN_FILES_ORGANISATION_PORT_ABSENT_KEY,
+            });
+        }
+        const clashes = findNameClashes(org, await this.store.list());
+        for (const source of ['own', 'hosting']) {
+            const clash = clashes.find((c) => c.source === source);
+            if (!clash)
+                continue;
+            detail.plannedSteps = detail.plannedSteps.filter(({ action }) => source === 'own'
+                ? !(action.system === 'coolify' && action.kind.startsWith('own-'))
+                : !(action.system === 'coolify' && (action.kind === 'app' || action.kind === 'database')));
+            detail.unmanaged.push({
+                description: `${org.slug}'s ${source === 'own' ? 'own services are' : 'hosting is'} blocked, not planned: ${nameClashMessage(org.slug, clash)}`,
+                key: `names:clash:${source}`,
+            });
+        }
         const invalid = await this.invalidHosting(org);
         if (invalid) {
             // Rule 2: reported in `unmanaged`, not thrown. Steps that read the
@@ -960,7 +1039,40 @@ export class FoundryPlanApply {
      * DEFAULT_ORG_PLATFORM_READINESS} reports every service not ready, so every
      * org step that needs one is blocked.
      */
-    async orgPlatformReadiness() {
+    async orgPlatformReadiness(org, orgRecordedIds) {
+        const base = await this.sharedPlatformReadiness();
+        if (!ownsServices(org))
+            return base;
+        const held = this.platformDeps?.heldKeys;
+        const platform = await this.platformDeps?.store.get();
+        const readiness = orgPlatformReadinessFor(org, base, orgRecordedIds, held ? await heldOwnKeyRefs(held, org) : new Set());
+        return platform ? { ...readiness, serviceGitRefs: serviceGitRefsOf(platform) } : readiness;
+    }
+    /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
+    async ownMailKeyHeld(org) {
+        const held = this.platformDeps?.heldKeys;
+        if (!ownsServices(org) || !held)
+            return false;
+        return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.brokerMailKey);
+    }
+    /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
+    async ownResumableRefs(org) {
+        const held = this.platformDeps?.heldKeys;
+        if (!ownsServices(org) || !held)
+            return { jobs: false, sfu: false };
+        const refs = orgTarget(org).refs;
+        const heldRefs = await heldOwnKeyRefs(held, org);
+        return { jobs: heldRefs.has(refs.jobsAdminToken), sfu: heldRefs.has(refs.livekitKeys) };
+    }
+    /** The relay is declared and has recorded the routes it last applied: port 25 reaches the mail servers. */
+    async mailRelayApplied() {
+        const platform = await this.platformDeps?.store.get();
+        if (!platform?.mail.relay)
+            return false;
+        const recorded = await this.platformDeps?.store.getServiceIds();
+        return Boolean(recorded?.[PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY]);
+    }
+    async sharedPlatformReadiness() {
         if (!this.platformDeps)
             return DEFAULT_ORG_PLATFORM_READINESS;
         const platform = await this.platformDeps.store.get();
@@ -998,11 +1110,14 @@ export class FoundryPlanApply {
      * `platformDeps` {@link orgPlatformReadiness} reads -- but only when the
      * host supplies no `agora` port of its own. An explicit `agora` (#164)
      * always wins, unchanged, so a host that already has its own values
-     * (perhaps not yet wired to this platform) keeps them.
+     * (perhaps not yet wired to this platform) keeps them. An org that owns its
+     * services never takes the host's values: they belong to the shared services.
      */
-    async orgAgoraHost(id) {
+    async orgAgoraHost(org, orgRecordedIds) {
+        if (ownsServices(org))
+            return agoraHostValuesForOwn(org, orgRecordedIds);
         if (this.agora)
-            return readAgoraHost(this.agora, id);
+            return readAgoraHost(this.agora, org.id);
         if (!this.platformDeps)
             return NO_AGORA_HOST_VALUES;
         const platform = await this.platformDeps.store.get();
@@ -1051,16 +1166,73 @@ export class FoundryPlanApply {
         const callsOrgSlugs = (await this.store.list())
             .filter((org) => org.calls.enabled)
             .map((org) => org.slug);
+        const mailRelay = platform.mail.relay === true ? await this.mailRelayInputs(platform) : null;
         const detail = computePlatformPlanDetail(platform, live, {
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
             callsOrgSlugs,
+            ...(mailRelay ?? {}),
             recordedIds: serviceIds,
             blocked: (await executor.blockedSteps?.(platform, serviceIds)) ?? {},
             drifted: (await executor.driftedSteps?.(platform, serviceIds)) ?? {},
         });
         return { platform, plan: toPlatformPlan(detail, platform.ownerOrgId), detail };
     }
+    /**
+     * What the shared mail relay needs from the orgs. A route exists for an org
+     * that owns its services, serves mail on its own domain and has recorded its
+     * mail server's SMTP address (`mail_smtp_internal`, written by the company
+     * mail step). Every other org with mail on its own domain, the platform
+     * apex and the shared no-domain apex are platform domains: the platform's Stalwart receives them. An org
+     * that owns its services but has no mail server yet appears in neither list,
+     * so the relay refuses its mail until the server exists.
+     */
+    async mailRelayInputs(platform) {
+        const candidates = [];
+        const mailPlatformDomains = [platform.apex];
+        for (const org of await this.store.list()) {
+            if (org.mail.mode === 'off')
+                continue;
+            // Mail without the org's own domain is served on the shared no-domain apex.
+            if (!org.domain || !org.mail.usesDomain) {
+                if (!mailPlatformDomains.includes(NO_DOMAIN_MAIL_APEX)) {
+                    mailPlatformDomains.push(NO_DOMAIN_MAIL_APEX);
+                }
+                continue;
+            }
+            if (!ownsServices(org)) {
+                mailPlatformDomains.push(org.domain);
+                continue;
+            }
+            const recorded = (await this.store.getAppliedState(org.id))?.serviceIds ?? {};
+            const target = recorded[OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY];
+            if (recorded.coolify_platform_mail_app && target) {
+                candidates.push({ slug: org.slug, route: { domain: org.domain, target } });
+            }
+        }
+        // A domain the platform serves, or two companies claim, gets no route; the other routes stay.
+        const platformSet = new Set(mailPlatformDomains.map((d) => d.toLowerCase()));
+        const claims = new Map();
+        for (const { route } of candidates) {
+            const domain = route.domain.toLowerCase();
+            claims.set(domain, (claims.get(domain) ?? 0) + 1);
+        }
+        const mailRoutes = [];
+        const mailRoutesBlocked = [];
+        for (const { slug, route } of candidates) {
+            const domain = route.domain.toLowerCase();
+            if (platformSet.has(domain)) {
+                mailRoutesBlocked.push(`${slug}'s mail route for ${route.domain} is blocked, not planned: ${route.domain} is a platform mail domain`);
+            }
+            else if ((claims.get(domain) ?? 0) > 1) {
+                mailRoutesBlocked.push(`${slug}'s mail route for ${route.domain} is blocked, not planned: another company claims ${route.domain}`);
+            }
+            else {
+                mailRoutes.push(route);
+            }
+        }
+        return { mailRoutes, mailPlatformDomains, mailRoutesBlocked };
+    }
     async sfuBlockedReason(platform) {
         if (!platform.sfu.enabled)
             return null;
@@ -1202,6 +1374,8 @@ function destroyTargets(serviceIds, orgId) {
         'cloudflare:worker:',
         'coolify:database:',
         'coolify:app:',
+        // An own files host's storage key: the token id is the step's recorded resource id.
+        'coolify:own-files-r2:',
         'zitadel:customers:',
         // F6a: an entry's ai key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
         'ai:key:',
@@ -1281,6 +1455,16 @@ function destroyTargets(serviceIds, orgId) {
             continue;
         targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
     }
+    // A storage key minted but never delivered has no main id; its token is deleted too.
+    const r2Undelivered = serviceIds[OWN_FILES_R2_UNDELIVERED_SCOPE_KEY];
+    if (r2Undelivered) {
+        targets.push({
+            system: 'coolify',
+            kind: 'own-files-r2',
+            key: 'undelivered',
+            id: r2Undelivered,
+        });
+    }
     for (const [resourceKey, id] of Object.entries(serviceIds)) {
         if (!resourceKey.startsWith('zitadel:app:') || !id)
             continue;
@@ -1337,6 +1521,9 @@ function destroyStepDescriptions(targets) {
 function destroyServiceIdKey(target) {
     if (target.kind === 'project' || target.kind === 'org')
         return target.key;
+    if (target.kind === 'own-files-r2' && target.key === 'undelivered') {
+        return OWN_FILES_R2_UNDELIVERED_SCOPE_KEY;
+    }
     return `${target.system}:${target.kind}:${target.key}`;
 }
 /**
@@ -1352,6 +1539,12 @@ const STEP_FIELDS = {
     'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
+    'coolify:own-auth': 'services.own',
+    'coolify:own-files': 'services.own',
+    'coolify:own-files-r2': 'services.own',
+    'coolify:own-jobs': 'services.own',
+    'coolify:own-mail': 'services.own',
+    'coolify:own-sfu': 'services.own',
     'coolify:calls': 'calls.enabled',
     'coolify:calls-service': 'calls.enabled',
     'coolify:calls-chat': 'calls.enabled',

package/dist/plan/platform-diff.d.ts

@@ -3,6 +3,7 @@ import { type Plan, type PlanNote, type UnmanagedItem, type VersionChangeItem }
 import type { DeclaredPlatform } from '../platform.js';
 import type { PlannedStep } from './diff.js';
 import type { LiveResource } from './live.js';
+import { type MailRoute, PLATFORM_MAIL_RELAY_KEY } from './mail-relay.js';
 /**
  * The platform's own diff result, the {@link DeclaredPlatform} counterpart to
  * `diff.ts`'s `PlanDetail` -- everything the same, minus the `orgId` an org's
@@ -432,6 +433,18 @@ export declare const PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY = "mail_applied_git
  * no key and creates nothing in the sign-in server.
  */
 export declare const PLATFORM_MAIL_ROUTE_SCOPE_KEY = "mail_route_applied";
+/**
+ * The host ports the platform Stalwart publishes, as the mapping string the
+ * last apply set on its app. Without the shared relay it binds SMTP port 25
+ * itself; with `mail.relay` it keeps only submission, because the relay owns
+ * port 25. A missing record means the mapping it was created with, `25:25,...`.
+ */
+export declare const PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY = "mail_host_ports_applied";
+export declare const PLATFORM_MAIL_HOST_PORTS_DIRECT = "25:25,465:465,587:587";
+export declare const PLATFORM_MAIL_HOST_PORTS_RELAY = "465:465,587:587";
+export declare function platformMailHostPorts(platform: DeclaredPlatform): string;
+export { PLATFORM_MAIL_RELAY_KEY };
+export { PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, type MailRoute, } from './mail-relay.js';
 export declare const PLATFORM_MAIL_ROUTE_WANTED = "local-first";
 /**
  * #177: where the mail server answers on the Coolify network
@@ -971,6 +984,19 @@ export interface PlanPlatformOptions {
      * only when the recorded fingerprint differs; absent, it always plans it.
      */
     callsOrgSlugs?: readonly string[];
+    /**
+     * Which company domain goes to which company mail server. Used only when
+     * `platform.mail.relay` is true (default `[]`).
+     */
+    mailRoutes?: readonly MailRoute[];
+    /**
+     * The domains the platform's own Stalwart serves; the relay hands them to
+     * it and refuses any domain in neither list. Used only when
+     * `platform.mail.relay` is true (default `[]`).
+     */
+    mailPlatformDomains?: readonly string[];
+    /** One line per company route left out of `mailRoutes`; each is reported blocked and the relay still plans without it. */
+    mailRoutesBlocked?: readonly string[];
     /** The platform's recorded resource/scope ids (default `{}`). */
     recordedIds?: Readonly<Record<string, string>>;
     /** Per-step block reasons the executor reports (default `{}`). */
@@ -1000,6 +1026,8 @@ export interface PlanPlatformOptions {
         ai?: string;
         archon?: string;
         mail?: string;
+        /** Why the shared mail relay cannot run: the executor lacks the mail dependencies or the base image tag floats. */
+        relay?: string;
         /** #478: why the edge host is blocked, or absent when it is not. */
         edge?: string;
         /** #604: why the Access sign-in provider cannot be made yet (no dependencies, or edge cannot confirm Access is ready), or absent. */

package/dist/plan/platform-diff.js

@@ -5,6 +5,7 @@ import { VERSION_CHANGE_KIND, } from '../plan.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
+import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
@@ -482,6 +483,26 @@ export const PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY = 'mail_applied_git_ref';
  * no key and creates nothing in the sign-in server.
  */
 export const PLATFORM_MAIL_ROUTE_SCOPE_KEY = 'mail_route_applied';
+/**
+ * The host ports the platform Stalwart publishes, as the mapping string the
+ * last apply set on its app. Without the shared relay it binds SMTP port 25
+ * itself; with `mail.relay` it keeps only submission, because the relay owns
+ * port 25. A missing record means the mapping it was created with, `25:25,...`.
+ */
+export const PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY = 'mail_host_ports_applied';
+export const PLATFORM_MAIL_HOST_PORTS_DIRECT = '25:25,465:465,587:587';
+export const PLATFORM_MAIL_HOST_PORTS_RELAY = '465:465,587:587';
+export function platformMailHostPorts(platform) {
+    return platform.mail.relay === true
+        ? PLATFORM_MAIL_HOST_PORTS_RELAY
+        : PLATFORM_MAIL_HOST_PORTS_DIRECT;
+}
+function mailPortsApplied(platform, recordedIds) {
+    return ((recordedIds[PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY] ?? PLATFORM_MAIL_HOST_PORTS_DIRECT) ===
+        platformMailHostPorts(platform));
+}
+export { PLATFORM_MAIL_RELAY_KEY };
+export { PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, } from './mail-relay.js';
 export const PLATFORM_MAIL_ROUTE_WANTED = 'local-first';
 /**
  * #177: where the mail server answers on the Coolify network
@@ -1113,7 +1134,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, recordedIds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailPlatformDomains = [], mailRoutesBlocked = [], recordedIds = {}, blocked = {}, drifted = {}, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1178,6 +1199,18 @@ export function planPlatform(platform, live, options = {}) {
     const mail = planMail(platform, recordedIds, blocked.mail ?? dnsBlocked?.('mail server'), authReady);
     if (mail.step)
         plannedSteps.push(mail.step);
+    // The shared relay owns host port 25 once `mail.relay` is on, so it runs after the
+    // mail step that gives the port up.
+    const relay = planMailRelay(platform, recordedIds, {
+        routes: mailRoutes,
+        platformDomains: mailPlatformDomains,
+        executorBlocked: blocked.relay,
+        mailReady: mail.step !== null ||
+            (Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_MAIL_KEY)]) &&
+                mailPortsApplied(platform, recordedIds)),
+    });
+    if (relay.step)
+        plannedSteps.push(relay.step);
     // #172: a throw halts every step after it, so this one goes late.
     const ai = planAi(platform, recordedIds, blocked.ai);
     if (ai.step)
@@ -1280,6 +1313,13 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: auth.blocked, key: 'auth' });
     if (mail.blocked)
         unmanaged.push({ description: mail.blocked, key: 'mail' });
+    if (relay.blocked)
+        unmanaged.push({ description: relay.blocked, key: 'mail-relay' });
+    if (platform.mail.relay === true) {
+        for (const description of mailRoutesBlocked) {
+            unmanaged.push({ description, key: 'mail-relay:route' });
+        }
+    }
     if (integrations.blocked)
         unmanaged.push({ description: integrations.blocked, key: 'integrations' });
     if (files.blocked)
@@ -1922,7 +1962,8 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
         // #177: a mail step applied before this key existed never recorded it, and
         // org steps read it for Agora's mail upstream. Missing means unapplied.
         recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] &&
-        recordedIds[PLATFORM_MAIL_ROUTE_SCOPE_KEY] === PLATFORM_MAIL_ROUTE_WANTED) {
+        recordedIds[PLATFORM_MAIL_ROUTE_SCOPE_KEY] === PLATFORM_MAIL_ROUTE_WANTED &&
+        mailPortsApplied(platform, recordedIds)) {
         return { step: null, blocked: null };
     }
     // Only the route is missing: say so, the app is not redeployed.
@@ -1930,7 +1971,8 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
         recordedIds[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === platform.mail.hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === platform.mail.gitRef &&
-        recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY];
+        recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] &&
+        mailPortsApplied(platform, recordedIds);
     // Stalwart's `x:ApiKey/set` shows a secret once. An id was minted but never
     // reached the host: report it, plan nothing, the same rule {@link planAuth}
     // follows for ZITADEL's own admin key.

package/dist/plan/platform-org.d.ts

@@ -1,3 +1,4 @@
+import { type DeclaredOrg } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { AgoraHostValues } from './agora.js';
 /**
@@ -151,6 +152,19 @@ export interface OrgPlatformReadiness {
      * A missing key is then reported as "no reader given" instead of "not held".
      */
     noKeyReader?: boolean;
+    /** The platform's declared git ref for each service, which an own org's services deploy. */
+    serviceGitRefs?: {
+        auth: string;
+        mail: string;
+        files: string;
+        jobs: string;
+    };
+    /**
+     * The platform's recorded owner invite (`PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY`): the user id the
+     * platform's files host takes as `AUTHZ_BOOTSTRAP_OPERATOR`, or `'none'` when the platform has no
+     * owner to invite. `null` or absent until recorded. An own org's files host gets the same value.
+     */
+    platformOwnerUserId?: string | null;
 }
 /**
  * What an org's plan reads when no platform is declared: nothing is ready, so
@@ -207,6 +221,26 @@ heldRefs?: ReadonlySet<string>,
 noKeyReader?: boolean, 
 /** #317: true when the host's executor was built with an `EdgePort` ({@link OrgPlatformReadiness.edgeReady}). */
 edgePortPresent?: boolean): OrgPlatformReadiness;
+/** The git refs the platform declares for the services an own org deploys. */
+export declare function serviceGitRefsOf(platform: DeclaredPlatform): {
+    auth: string;
+    mail: string;
+    files: string;
+    jobs: string;
+};
+/** The runner app both the platform's and an own org's files step record. */
+export declare const OWN_FILES_RUNNER_SCOPE_KEY = "coolify_platform_files_runner_app";
+/**
+ * An own org (`services.own`) plans against its own services, so its readiness
+ * reads only its own recorded ids and its own held keys; nothing the shared
+ * services recorded reaches it. AI, edge and Access stay shared and come from
+ * `base`. Any other org gets `base` back unchanged.
+ */
+export declare function orgPlatformReadinessFor(org: DeclaredOrg, base: OrgPlatformReadiness, orgRecordedIds: Readonly<Record<string, string>>, heldRefs: ReadonlySet<string>): OrgPlatformReadiness;
+/** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
+export declare function heldOwnKeyRefs(heldKeys: HeldKeyResolver, org: Pick<DeclaredOrg, 'slug'>): Promise<Set<string>>;
+/** {@link agoraHostValuesFromPlatform}'s counterpart for an own org: every value is the org's own, null until recorded. */
+export declare function agoraHostValuesForOwn(org: DeclaredOrg, orgRecordedIds: Readonly<Record<string, string>>): AgoraHostValues;
 /**
  * #177: {@link AgoraHostValues} derived from the same platform state, rather
  * than requiring a bespoke host-supplied `AgoraHostPort` for values the