@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/plan-apply.js

@@ -1,11 +1,14 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { validateHosting } from '../org.js';
+import { sfuSlotPorts } from '../calls-sfu.js';
+import { ownsServices, validateHosting } from '../org.js';
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
 import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
+import { NetworkMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
+import { readLiveBuilds } from './build-record.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
@@ -13,9 +16,15 @@ import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredSco
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { PLATFORM_ARCHON_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, dnsBlockedReason, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
-import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
+import { agoraIssuerHostFor, loginHostServesAgora, readLoginHostDiscovery, } from './login-host.js';
+import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_MAX, OWN_MAIL_SMTP_PORT_SCOPE_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, isOwnMailSmtpPort, mailRelayFingerprint, } from './mail-relay.js';
+import { findNameClashes, nameClashMessage } from './org-names.js';
+import { ownHostnames } from './own-hostnames.js';
+import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
+import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
+import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
@@ -126,6 +135,10 @@ const HOSTNAME_STEPS = new Set([
  * destructive or migrating step without the org's name typed, or one the
  * actor is not authorized to run.
  */
+/** `unmanaged` key of the fixed line for an own org on a host with no `ownServices` port. */
+const OWN_SERVICES_PORT_ABSENT_KEY = 'own-services:port';
+/** `unmanaged` key of the fixed line for an own org whose scoped ports have no files-organisation port. */
+const OWN_FILES_ORGANISATION_PORT_ABSENT_KEY = 'own-services:files-port';
 export class FoundryPlanApply {
     store;
     readers;
@@ -137,6 +150,7 @@ export class FoundryPlanApply {
     agora;
     jobsScheduler;
     loginHostBindings;
+    loginHostDiscovery;
     zitadelIdTokenUserinfo;
     broker;
     edgeWorkers;
@@ -144,10 +158,13 @@ export class FoundryPlanApply {
     hostFiles;
     hostAi;
     hostEdge;
+    hostOwnServices;
+    sfuPortsOpen;
     onlySteps;
     now;
     leaseTtlMs;
     appliedVersions;
+    backupGate;
     platformDeps;
     runner;
     constructor(options) {
@@ -161,6 +178,7 @@ export class FoundryPlanApply {
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
+        this.loginHostDiscovery = options.loginHostDiscovery;
         this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
         this.broker = options.broker ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
@@ -168,10 +186,13 @@ export class FoundryPlanApply {
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
         this.hostEdge = options.edge ?? false;
+        this.hostOwnServices = options.ownServices ?? false;
+        this.sfuPortsOpen = options.sfuPortsOpen;
         this.onlySteps = options.onlySteps;
         this.now = options.now ?? (() => new Date());
         this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
         this.appliedVersions = options.appliedVersions;
+        this.backupGate = options.backupGate;
         this.platformDeps = options.platform;
         this.runner = options.runner;
     }
@@ -345,6 +366,7 @@ export class FoundryPlanApply {
         const reader = this.readers.coolify;
         const live = project && reader.listProject ? await reader.listProject(project) : null;
         const claimedElsewhere = [];
+        const platformRecorded = new Set(Object.values((await this.platformDeps?.store.getServiceIds()) ?? {}));
         for (const [what, uuid] of [
             ['application', input.applicationUuid],
             ['database', input.databaseUuid],
@@ -352,6 +374,10 @@ export class FoundryPlanApply {
         ]) {
             if (!uuid)
                 continue;
+            if (platformRecorded.has(uuid)) {
+                claimedElsewhere.push(`${what} ${uuid} is recorded by the platform`);
+                continue;
+            }
             const owner = await this.store.findOtherOrgRecordingCoolifyId(uuid, id);
             if (owner)
                 claimedElsewhere.push(`${what} ${uuid} is already recorded by org ${owner}`);
@@ -379,12 +405,50 @@ export class FoundryPlanApply {
                 await this.refuse(plan, `version change without confirmUpgrade naming: ${unconfirmed.map((u) => u.service).join(', ')}`);
                 throw new UpgradeConfirmationRequiredError(unconfirmed);
             }
+            // F6: before step one. No override.
+            let backupId = null;
+            if (this.backupGate) {
+                try {
+                    ({ backupId } = await requireFreshBackupsForUpgrades(freshPlan, options.confirmUpgrade, {
+                        coolify: this.backupGate.coolify,
+                        orgId,
+                        recordedIds: (await this.store.getAppliedState(orgId))?.serviceIds ?? {},
+                        now: () => this.now().getTime(),
+                    }));
+                }
+                catch (e) {
+                    if (e instanceof UpgradeBackupMissingError) {
+                        await this.refuse(plan, `upgrade of ${e.service} without a fresh backup`);
+                    }
+                    throw e;
+                }
+            }
+            // A move to the company's own network deletes its databases: a fresh dump of each first.
+            if (detail.plannedSteps.some((s) => s.action.system === 'coolify' && s.action.kind === 'network')) {
+                try {
+                    if (!this.backupGate)
+                        throw new NetworkMoveBackupMissingError('no-gate');
+                    await requireFreshBackupsForMove({
+                        coolify: this.backupGate.coolify,
+                        projectUuid: (await this.store.getAppliedState(orgId))?.serviceIds
+                            ?.coolify_project,
+                        ownsMail: ownsServices(org) && org.mail.mode !== 'off',
+                        now: () => this.now().getTime(),
+                    });
+                }
+                catch (e) {
+                    if (e instanceof NetworkMoveBackupMissingError) {
+                        await this.refuse(plan, 'network move without a fresh backup');
+                    }
+                    throw e;
+                }
+            }
             if (planNeedsConfirmation(plan.steps) &&
                 confirmedOrgName.trim() !== org.displayName.trim()) {
                 await this.refuse(plan, "destructive or migrating step without the org's name typed correctly");
                 throw new ConfirmationRequiredError(orgId);
             }
-            const applied = await this.runSteps(org, plan, detail, fence);
+            const applied = await this.runSteps(org, plan, detail, fence, backupId);
             await this.refreshPlatformFilesShare();
             return applied;
         }));
@@ -479,6 +543,27 @@ export class FoundryPlanApply {
                 await this.refusePlatform(plan, platform.ownerOrgId, `version change without confirmUpgrade naming: ${unconfirmed.map((u) => u.service).join(', ')}`);
                 throw new UpgradeConfirmationRequiredError(unconfirmed);
             }
+            // F6: before step one. No override. The platform records no applied versions, so no backup id is kept.
+            if (this.backupGate) {
+                try {
+                    await requireFreshBackupsForUpgrades(freshPlan, options.confirmUpgrade, {
+                        coolify: this.backupGate.coolify,
+                        orgId: platform.ownerOrgId,
+                        recordedIds: await this.requirePlatformDeps().store.getServiceIds(),
+                        now: () => this.now().getTime(),
+                        scope: {
+                            keys: PLATFORM_BACKUP_DATABASE_SCOPE_KEYS,
+                            forService: platformDatabasesForService,
+                        },
+                    });
+                }
+                catch (e) {
+                    if (e instanceof UpgradeBackupMissingError) {
+                        await this.refusePlatform(plan, platform.ownerOrgId, `upgrade of ${e.service} without a fresh backup`);
+                    }
+                    throw e;
+                }
+            }
             if (planNeedsConfirmation(plan.steps) && confirmedName.trim() !== 'platform') {
                 await this.refusePlatform(plan, platform.ownerOrgId, "destructive or migrating step without 'platform' typed correctly");
                 throw new PlatformConfirmationRequiredError();
@@ -572,6 +657,11 @@ export class FoundryPlanApply {
                         // gone" itself.
                         await this.destroyer.destroy(target, { org, recordedIds: { ...serviceIds } });
                         delete serviceIds[destroyServiceIdKey(target)];
+                        if (target.system === 'cloudflare' && target.kind === 'tunnel') {
+                            // The tunnel is gone, so what was written into it is too.
+                            delete serviceIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY];
+                            delete serviceIds[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+                        }
                         if (target.system === 'cloudflare' && target.kind === 'worker') {
                             // #318: its partial-deploy traces too, or a retry after a later
                             // step fails would read this Worker as live again.
@@ -792,15 +882,17 @@ export class FoundryPlanApply {
             at: this.now(),
         });
     }
-    async runSteps(org, plan, detail, fence) {
+    async runSteps(org, plan, detail, fence, backupId = null) {
         const orgId = plan.orgId;
         const previous = await this.store.getAppliedState(orgId);
         const serviceIds = { ...(previous?.serviceIds ?? {}) };
         const checkpoints = [];
         // Backed by the very `serviceIds` map this method persists once, at the
         // end — see `StepExecutionContext`'s doc comment for why.
+        const ownerCompany = (await this.platformDeps?.store.get())?.ownerOrgId === orgId;
         const context = {
             org,
+            ownerCompany,
             recordedIds: () => ({ ...serviceIds }),
             now: () => this.now().getTime(),
             recordScopeId: (key, id) => {
@@ -887,6 +979,7 @@ export class FoundryPlanApply {
             service: orgId,
             ref: lastApplied.declaredOrgVersion,
             appliedAt: lastApplied.at,
+            backupId,
         });
         await this.audit.recordApply({
             actor: this.actor,
@@ -897,30 +990,118 @@ export class FoundryPlanApply {
         });
         return applied;
     }
+    /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
+    async readSfuPortsOpen(org) {
+        const slot = org.services?.sfuSlot;
+        if (!this.sfuPortsOpen || !ownsServices(org) || !org.calls.enabled || !slot)
+            return false;
+        let ports;
+        try {
+            ports = sfuSlotPorts(slot);
+        }
+        catch {
+            return false;
+        }
+        const timeout = new Promise((resolve) => setTimeout(() => resolve(false), 5_000));
+        return Promise.race([this.sfuPortsOpen(ports).catch(() => false), timeout]);
+    }
     async computeFreshPlan(id) {
         const org = await this.store.get(id);
         if (!org)
             throw new DeclaredOrgNotFoundError(id);
-        const [live, applied, platformReadiness, agoraHost, archonUrl] = await Promise.all([
-            readLiveResources(id, this.readers),
-            this.store.getAppliedState(id),
-            this.orgPlatformReadiness(),
-            this.orgAgoraHost(id),
+        const applied = await this.store.getAppliedState(id);
+        const [live, platformReadiness, agoraHost, archonUrl] = await Promise.all([
+            readLiveResources(id, this.readers, org, applied?.serviceIds ?? {}),
+            this.orgPlatformReadiness(org, applied?.serviceIds ?? {}),
+            this.orgAgoraHost(org, applied?.serviceIds ?? {}),
             this.orgArchonUrl(),
         ]);
         const otherSlugs = (await this.store.list()).filter((o) => o.id !== id).map((o) => o.slug);
         const platformHostnames = await this.platformServiceHostnames();
+        const recorded = applied?.serviceIds ?? {};
+        // Read only for an org Agora may switch and whose login host is applied.
+        const issuerHost = agoraIssuerHostFor(org).host;
+        const loginHostServesDiscovery = issuerHost !== null && loginHostServesAgora(issuerHost, org, recorded)
+            ? await readLoginHostDiscovery(this.loginHostDiscovery, issuerHost)
+            : false;
+        const sfuPortsOpen = await this.readSfuPortsOpen(org);
+        const resumable = await this.ownResumableRefs(org);
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
+            loginHostServesDiscovery,
             zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
-            broker: this.broker,
+            broker: ownsServices(org) && this.hostOwnServices && this.executor.ownBrokerPort
+                ? await this.executor.ownBrokerPort(org, recorded)
+                : this.broker,
             edgeWorkers: this.edgeWorkers,
             ownerInviteMail: this.ownerInviteMail,
             otherSlugs,
             now: () => this.now().getTime(),
             archonUrl,
             platformHostnames,
+            ownServices: this.hostOwnServices,
+            // The `oikos.host` zone, its wildcard and its tunnel are the platform's `platform:oikos-ingress` step.
+            oikosZoneReady: platformReadiness.oikosIngressApplied === true,
+            ownMailKeyHeld: await this.ownMailKeyHeld(org),
+            ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            ...(this.backupGate
+                ? {
+                    backupStorageUuid: (await this.platformDeps?.store.getServiceIds())?.[PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY] || null,
+                }
+                : {}),
+            ownJobsTokenHeld: resumable.jobs,
+            ownSfuKeysHeld: resumable.sfu,
+            ...(ownsServices(org)
+                ? {
+                    mailRelayApplied: await this.mailRelayApplied(),
+                    ownMailSmtpPort: await this.ownMailSmtpPort(org),
+                    mailRelayRoute: await this.mailRelayHoldsRoute(org),
+                }
+                : {}),
+            sfuPortsOpen,
+            ownFilesDeps: this.executor.ownFilesDeps?.(),
+            ...(ownsServices(org) && this.executor.ownFilesR2Ports
+                ? { ownFilesR2Ports: await this.executor.ownFilesR2Ports(org, recorded) }
+                : {}),
         });
+        if (!ownsServices(org)) {
+            // No company runs the shared services; each runs its own.
+            detail.plannedSteps = [];
+            detail.versionChanges = [];
+            detail.unmanaged.push({
+                description: `${org.slug} has no services.own: the shared services are removed, so a company runs its own. Set services.own.`,
+                key: 'services:shared-removed',
+            });
+        }
+        if (ownsServices(org) && !this.hostOwnServices) {
+            detail.unmanaged.push({
+                description: `${org.slug} runs its own services, and this host has no ownServices port`,
+                key: OWN_SERVICES_PORT_ABSENT_KEY,
+            });
+        }
+        if (ownsServices(org) &&
+            this.hostOwnServices &&
+            detail.plannedSteps.some(({ action }) => action.system === 'files' && action.kind === 'organisation') &&
+            (await this.executor.ownFilesOrganisationPort?.(org, recorded)) === false) {
+            detail.plannedSteps = detail.plannedSteps.filter(({ action }) => !(action.system === 'files' && action.kind === 'organisation'));
+            detail.unmanaged.push({
+                description: `${org.slug}'s Files organisation is blocked, not planned: the host gave the company no files-organisation port`,
+                key: OWN_FILES_ORGANISATION_PORT_ABSENT_KEY,
+            });
+        }
+        const clashes = findNameClashes(org, await this.store.list());
+        for (const source of ['own', 'hosting']) {
+            const clash = clashes.find((c) => c.source === source);
+            if (!clash)
+                continue;
+            detail.plannedSteps = detail.plannedSteps.filter(({ action }) => source === 'own'
+                ? !(action.system === 'coolify' && action.kind.startsWith('own-'))
+                : !(action.system === 'coolify' && (action.kind === 'app' || action.kind === 'database')));
+            detail.unmanaged.push({
+                description: `${org.slug}'s ${source === 'own' ? 'own services are' : 'hosting is'} blocked, not planned: ${nameClashMessage(org.slug, clash)}`,
+                key: `names:clash:${source}`,
+            });
+        }
         const invalid = await this.invalidHosting(org);
         if (invalid) {
             // Rule 2: reported in `unmanaged`, not thrown. Steps that read the
@@ -960,7 +1141,78 @@ export class FoundryPlanApply {
      * DEFAULT_ORG_PLATFORM_READINESS} reports every service not ready, so every
      * org step that needs one is blocked.
      */
-    async orgPlatformReadiness() {
+    async orgPlatformReadiness(org, orgRecordedIds) {
+        const base = await this.sharedPlatformReadiness();
+        if (!ownsServices(org))
+            return base;
+        const held = this.platformDeps?.heldKeys;
+        const platform = await this.platformDeps?.store.get();
+        const readiness = orgPlatformReadinessFor(org, base, orgRecordedIds, held ? await heldOwnKeyRefs(held, org) : new Set());
+        return platform
+            ? { ...readiness, serviceGitRefs: serviceGitRefsOf(platform, org.versionPin) }
+            : readiness;
+    }
+    /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
+    async ownMailKeyHeld(org) {
+        const held = this.platformDeps?.heldKeys;
+        if (!ownsServices(org) || !held)
+            return false;
+        return (await heldOwnKeyRefs(held, org)).has(orgTarget(org).refs.brokerMailKey);
+    }
+    /** Which of an own org's undelivered-secret refs hold a value now, so a rerun resumes instead of blocking. */
+    async ownResumableRefs(org) {
+        const held = this.platformDeps?.heldKeys;
+        if (!ownsServices(org) || !held)
+            return { jobs: false, sfu: false };
+        const refs = orgTarget(org).refs;
+        const heldRefs = await heldOwnKeyRefs(held, org);
+        return { jobs: heldRefs.has(refs.jobsAdminToken), sfu: heldRefs.has(refs.livekitKeys) };
+    }
+    /**
+     * The host port an own org's Stalwart publishes for the relay: the one it already has recorded, else
+     * the lowest port in the range no other org has recorded. Two plans made at the same moment could pick
+     * the same port; the second Stalwart then fails to bind it and the step fails, with nothing recorded.
+     */
+    async ownMailSmtpPort(org) {
+        const own = (await this.store.getAppliedState(org.id))?.serviceIds?.[OWN_MAIL_SMTP_PORT_SCOPE_KEY];
+        if (own && isOwnMailSmtpPort(Number(own)))
+            return Number(own);
+        const taken = new Set();
+        for (const other of await this.store.list()) {
+            const port = (await this.store.getAppliedState(other.id))?.serviceIds?.[OWN_MAIL_SMTP_PORT_SCOPE_KEY];
+            if (port)
+                taken.add(Number(port));
+        }
+        for (let port = OWN_MAIL_SMTP_PORT_BASE; port <= OWN_MAIL_SMTP_PORT_MAX; port += 1) {
+            if (!taken.has(port))
+                return port;
+        }
+        return OWN_MAIL_SMTP_PORT_MAX + 1;
+    }
+    /** The relay is declared and has recorded the routes it last applied: port 25 reaches the mail servers. */
+    async mailRelayApplied() {
+        const platform = await this.platformDeps?.store.get();
+        if (!platform?.mail.relay)
+            return false;
+        const recorded = await this.platformDeps?.store.getServiceIds();
+        return Boolean(recorded?.[PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY]);
+    }
+    /**
+     * The relay's last applied routes (a fingerprint, recorded when it deploys) are the routes the
+     * orgs' recorded SMTP addresses give now, and one of them is this org's mail domain.
+     */
+    async mailRelayHoldsRoute(org) {
+        const platform = await this.platformDeps?.store.get();
+        if (!platform?.mail.relay)
+            return false;
+        const { mailRoutes } = await this.mailRelayInputs();
+        const domain = ownHostnames(org).mailDomain.toLowerCase();
+        if (!mailRoutes.some((r) => r.domain.toLowerCase() === domain))
+            return false;
+        const recorded = await this.platformDeps?.store.getServiceIds();
+        return recorded?.[PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY] === mailRelayFingerprint(mailRoutes);
+    }
+    async sharedPlatformReadiness() {
         if (!this.platformDeps)
             return DEFAULT_ORG_PLATFORM_READINESS;
         const platform = await this.platformDeps.store.get();
@@ -985,8 +1237,13 @@ export class FoundryPlanApply {
         catch {
             // not held
         }
+        const ownerOrg = await this.store.get(platform.ownerOrgId);
+        const ownerRecorded = ownerOrg
+            ? (await this.store.getAppliedState(ownerOrg.id))?.serviceIds
+            : {};
         return {
             ...readiness,
+            platformOwnerUserId: platformOwnerUserIdFrom(ownerOrg, ownerRecorded ?? {}),
             mailKeyHeld,
             canHoldSecrets: typeof heldKeys?.put === 'function',
             dnsBlocked: dnsBlockedReason(platform, recorded),
@@ -998,11 +1255,14 @@ export class FoundryPlanApply {
      * `platformDeps` {@link orgPlatformReadiness} reads -- but only when the
      * host supplies no `agora` port of its own. An explicit `agora` (#164)
      * always wins, unchanged, so a host that already has its own values
-     * (perhaps not yet wired to this platform) keeps them.
+     * (perhaps not yet wired to this platform) keeps them. An org that owns its
+     * services never takes the host's values: they belong to the shared services.
      */
-    async orgAgoraHost(id) {
+    async orgAgoraHost(org, orgRecordedIds) {
+        if (ownsServices(org))
+            return agoraHostValuesForOwn(org, orgRecordedIds);
         if (this.agora)
-            return readAgoraHost(this.agora, id);
+            return readAgoraHost(this.agora, org.id);
         if (!this.platformDeps)
             return NO_AGORA_HOST_VALUES;
         const platform = await this.platformDeps.store.get();
@@ -1051,16 +1311,73 @@ export class FoundryPlanApply {
         const callsOrgSlugs = (await this.store.list())
             .filter((org) => org.calls.enabled)
             .map((org) => org.slug);
+        const mailRelay = platform.mail.relay === true ? await this.mailRelayInputs() : null;
+        const owner = await this.platformOwnerInput(platform);
         const detail = computePlatformPlanDetail(platform, live, {
+            owner,
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
             callsOrgSlugs,
+            ...(mailRelay ?? {}),
             recordedIds: serviceIds,
-            blocked: (await executor.blockedSteps?.(platform, serviceIds)) ?? {},
-            drifted: (await executor.driftedSteps?.(platform, serviceIds)) ?? {},
+            liveBuilds: await readLiveBuilds(readers.coolify, serviceIds),
+            blocked: (await executor.blockedSteps?.(platform, serviceIds, owner)) ?? {},
+            drifted: (await executor.driftedSteps?.(platform, serviceIds, owner)) ?? {},
         });
         return { platform, plan: toPlatformPlan(detail, platform.ownerOrgId), detail };
     }
+    /** The owner company's own sign-in and files host, read from its applied ids; `null` members until applied. */
+    async platformOwnerInput(platform) {
+        const owner = await this.store.get(platform.ownerOrgId);
+        if (!owner)
+            return { signIn: null, files: null };
+        const recorded = (await this.store.getAppliedState(owner.id))?.serviceIds ?? {};
+        return { signIn: ownerSignInFrom(owner, recorded), files: ownerFilesFrom(owner, recorded) };
+    }
+    /**
+     * What the shared mail relay needs from the orgs. A route exists for an org
+     * that owns its services, serves mail on its own domain and has recorded its
+     * mail server's SMTP address (`mail_smtp_internal`, written by the company
+     * mail step), on its mail domain: its own domain, or `<slug>.oikos.host`.
+     * There is no platform mail server: a domain with no route is refused. An org
+     * that owns its services but has no mail server yet has no route, so the
+     * relay refuses its mail until the server exists.
+     */
+    async mailRelayInputs() {
+        const candidates = [];
+        for (const org of await this.store.list()) {
+            if (org.mail.mode === 'off')
+                continue;
+            if (!ownsServices(org))
+                continue;
+            const recorded = (await this.store.getAppliedState(org.id))?.serviceIds ?? {};
+            const target = recorded[OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY];
+            if (recorded.coolify_platform_mail_app && target) {
+                candidates.push({
+                    slug: org.slug,
+                    route: { domain: ownHostnames(org).mailDomain, target },
+                });
+            }
+        }
+        // A domain two companies claim gets no route; the other routes stay.
+        const claims = new Map();
+        for (const { route } of candidates) {
+            const domain = route.domain.toLowerCase();
+            claims.set(domain, (claims.get(domain) ?? 0) + 1);
+        }
+        const mailRoutes = [];
+        const mailRoutesBlocked = [];
+        for (const { slug, route } of candidates) {
+            const domain = route.domain.toLowerCase();
+            if ((claims.get(domain) ?? 0) > 1) {
+                mailRoutesBlocked.push(`${slug}'s mail route for ${route.domain} is blocked, not planned: another company claims ${route.domain}`);
+            }
+            else {
+                mailRoutes.push(route);
+            }
+        }
+        return { mailRoutes, mailRoutesBlocked };
+    }
     async sfuBlockedReason(platform) {
         if (!platform.sfu.enabled)
             return null;
@@ -1100,6 +1417,7 @@ export class FoundryPlanApply {
         const serviceIds = { ...(await store.getServiceIds()) };
         const context = {
             platform,
+            owner: await this.platformOwnerInput(platform),
             recordedIds: () => ({ ...serviceIds }),
             recordScopeId: (key, id) => {
                 serviceIds[key] = id;
@@ -1202,6 +1520,8 @@ function destroyTargets(serviceIds, orgId) {
         'cloudflare:worker:',
         'coolify:database:',
         'coolify:app:',
+        // An own files host's storage key: the token id is the step's recorded resource id.
+        'coolify:own-files-r2:',
         'zitadel:customers:',
         // F6a: an entry's ai key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
         'ai:key:',
@@ -1281,6 +1601,16 @@ function destroyTargets(serviceIds, orgId) {
             continue;
         targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
     }
+    // A storage key minted but never delivered has no main id; its token is deleted too.
+    const r2Undelivered = serviceIds[OWN_FILES_R2_UNDELIVERED_SCOPE_KEY];
+    if (r2Undelivered) {
+        targets.push({
+            system: 'coolify',
+            kind: 'own-files-r2',
+            key: 'undelivered',
+            id: r2Undelivered,
+        });
+    }
     for (const [resourceKey, id] of Object.entries(serviceIds)) {
         if (!resourceKey.startsWith('zitadel:app:') || !id)
             continue;
@@ -1337,6 +1667,9 @@ function destroyStepDescriptions(targets) {
 function destroyServiceIdKey(target) {
     if (target.kind === 'project' || target.kind === 'org')
         return target.key;
+    if (target.kind === 'own-files-r2' && target.key === 'undelivered') {
+        return OWN_FILES_R2_UNDELIVERED_SCOPE_KEY;
+    }
     return `${target.system}:${target.kind}:${target.key}`;
 }
 /**
@@ -1352,6 +1685,12 @@ const STEP_FIELDS = {
     'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
+    'coolify:own-auth': 'services.own',
+    'coolify:own-files': 'services.own',
+    'coolify:own-files-r2': 'services.own',
+    'coolify:own-jobs': 'services.own',
+    'coolify:own-mail': 'services.own',
+    'coolify:own-sfu': 'services.own',
     'coolify:calls': 'calls.enabled',
     'coolify:calls-service': 'calls.enabled',
     'coolify:calls-chat': 'calls.enabled',