@wtfalch/foundry 0.9.0 → 0.11.0

package/dist/plan/hostnames.d.ts

@@ -0,0 +1,24 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+/**
+ * The full names an entry is served at. With `hosting.usesDomain` off, or no
+ * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * and every other entry is internal. `'*'` names nothing here; the wildcard is
+ * acted on elsewhere.
+ */
+export declare function entryHostnames(org: DeclaredOrg, entry: HostingEntry): string[];
+/**
+ * The one primary name of the org's app: its first, or the name the app was
+ * served at before entries had hostnames. `APP_URL`, the ZITADEL redirect URI
+ * and the jobs registration read it.
+ */
+export declare function appHostname(org: DeclaredOrg): string;
+/** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
+export declare function legacyAppHostname(org: DeclaredOrg): string;
+/**
+ * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
+ * #164): a site's two names, every entry's names, an own-domain calls name and
+ * Agora's. An org that does not host keeps the single name it always had.
+ */
+export declare function tunnelIngressHostnames(org: DeclaredOrg): string[];
+/** The ingress names that get a DNS record: those under the org's own domain. */
+export declare function tunnelDnsHostnames(org: DeclaredOrg, domain: string): string[];

package/dist/plan/hostnames.js

@@ -0,0 +1,56 @@
+import { APP_ENTRY_KEY } from '../org.js';
+import { agoraHostnameFor } from './agora.js';
+/**
+ * The full names an entry is served at. With `hosting.usesDomain` off, or no
+ * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * and every other entry is internal. `'*'` names nothing here; the wildcard is
+ * acted on elsewhere.
+ */
+export function entryHostnames(org, entry) {
+    const { domain } = org;
+    if (!org.hosting.usesDomain || !domain) {
+        return entry.key === APP_ENTRY_KEY ? [`${org.slug}.oikos.host`] : [];
+    }
+    return entry.hostnames.flatMap((name) => name === '*' ? [] : name === '@' ? [domain] : [`${name}.${domain}`]);
+}
+/**
+ * The one primary name of the org's app: its first, or the name the app was
+ * served at before entries had hostnames. `APP_URL`, the ZITADEL redirect URI
+ * and the jobs registration read it.
+ */
+export function appHostname(org) {
+    const entry = org.hosting.entries.find((e) => e.key === APP_ENTRY_KEY);
+    const first = entry ? entryHostnames(org, entry)[0] : undefined;
+    return first ?? legacyAppHostname(org);
+}
+/** What `domains` held on an `app` entry's Coolify app before entries had hostnames. */
+export function legacyAppHostname(org) {
+    return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
+}
+/**
+ * The hostnames `cloudflareTunnel` routes to Coolify's proxy (#115, #145,
+ * #164): a site's two names, every entry's names, an own-domain calls name and
+ * Agora's. An org that does not host keeps the single name it always had.
+ */
+export function tunnelIngressHostnames(org) {
+    const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [];
+    if (org.hosting.enabled) {
+        for (const entry of org.hosting.entries)
+            hostnames.push(...entryHostnames(org, entry));
+    }
+    else if (hostnames.length === 0) {
+        hostnames.push(legacyAppHostname(org));
+    }
+    if (org.calls.enabled && org.calls.usesDomain && org.domain) {
+        hostnames.push(`calls.${org.domain}`);
+    }
+    // #164: Agora always moves onto `agora.<domain>` once `org.domain` is set.
+    if (org.domain) {
+        hostnames.push(agoraHostnameFor(org));
+    }
+    return [...new Set(hostnames)];
+}
+/** The ingress names that get a DNS record: those under the org's own domain. */
+export function tunnelDnsHostnames(org, domain) {
+    return tunnelIngressHostnames(org).filter((hostname) => hostname === domain || hostname.endsWith(`.${domain}`));
+}

package/dist/plan/index.d.ts

@@ -24,6 +24,8 @@ export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCop
 export type { ScopeResolver, RecordedIds } from './providers-readers.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
+export type { BrokerPort } from './broker-entries.js';
+export { PlatformBrokerPort } from './broker-entries.js';
 export type { LoginHostBinding, LoginHostBindingsPort } from './login-host.js';
 export { loginHostnameFor } from './login-host.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './mail-identity.js';

package/dist/plan/index.js

@@ -12,6 +12,7 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { PlatformBrokerPort } from './broker-entries.js';
 export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';

package/dist/plan/locked-hostnames.d.ts

@@ -0,0 +1,8 @@
+import type { DeclaredOrg } from '../org.js';
+/**
+ * The names under the org's domain that foundry owns, so no hosting entry may
+ * take one: Agora, the cms studio when the site is on, calls when it uses the
+ * domain, the sign-in host when the issuer does, and every platform service
+ * hostname that falls under the domain. Empty for an org with no domain.
+ */
+export declare function lockedHostnames(org: DeclaredOrg, platformHostnames: readonly string[]): Set<string>;

package/dist/plan/locked-hostnames.js

@@ -0,0 +1,26 @@
+import { agoraHostnameFor } from './agora.js';
+import { loginHostnameFor } from './login-host.js';
+/**
+ * The names under the org's domain that foundry owns, so no hosting entry may
+ * take one: Agora, the cms studio when the site is on, calls when it uses the
+ * domain, the sign-in host when the issuer does, and every platform service
+ * hostname that falls under the domain. Empty for an org with no domain.
+ */
+export function lockedHostnames(org, platformHostnames) {
+    const { domain } = org;
+    const locked = new Set();
+    if (!domain)
+        return locked;
+    locked.add(agoraHostnameFor(org));
+    if (org.site.enabled)
+        locked.add(`cms.${domain}`);
+    if (org.calls.enabled && org.calls.usesDomain)
+        locked.add(`calls.${domain}`);
+    if (org.issuer.usesDomain)
+        locked.add(loginHostnameFor(org));
+    for (const hostname of platformHostnames) {
+        if (hostname.endsWith(`.${domain}`))
+            locked.add(hostname);
+    }
+    return locked;
+}

package/dist/plan/login-host.d.ts

@@ -66,7 +66,7 @@ export interface LoginHostBindingsPort {
  * on the next run.
  */
 export declare const LOGIN_BINDING_SCOPE_KEY = "login_host_binding";
-/** The org's recorded app client ids (hosted app, cms, agora), sorted. */
+/** The org's recorded app client ids (hosted app, each entry's own, cms, agora), sorted. */
 export declare function loginHostClientIds(recorded: Readonly<Record<string, string>>): string[];
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export declare function loginBindingState(host: string, clientIds: readonly string[]): string;

package/dist/plan/login-host.js

@@ -1,4 +1,4 @@
-import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, } from './agora.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, } from './agora.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -36,12 +36,15 @@ export function loginHostnameFor(org) {
  * on the next run.
  */
 export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
-/** The org's recorded app client ids (hosted app, cms, agora), sorted. */
+/** The org's recorded app client ids (hosted app, each entry's own, cms, agora), sorted. */
 export function loginHostClientIds(recorded) {
     return [
         recorded[APP_CLIENT_ID_SCOPE_KEY],
         recorded[CMS_CLIENT_ID_SCOPE_KEY],
         recorded[AGORA_CLIENT_ID_SCOPE_KEY],
+        ...Object.entries(recorded)
+            .filter(([key]) => key.startsWith(ENTRY_CLIENT_ID_SCOPE_PREFIX))
+            .map(([, id]) => id),
     ]
         .filter((id) => Boolean(id))
         .sort();

package/dist/plan/plan-apply.d.ts

@@ -1,9 +1,10 @@
-import type { PlanApply } from '../apply.js';
+import type { AdoptionRestored, PlanApply } from '../apply.js';
 import type { DeclaredOrg, OrgId } from '../org.js';
-import type { Plan, PlanStep } from '../plan.js';
+import type { Plan, PlanStep, UnmanagedItem } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { AppliedState } from '../state.js';
-import type { DeclaredOrgStore, PlatformStore } from '../store.js';
+import type { Adoption, AdoptionStore, DeclaredOrgStore, PlatformStore } from '../store.js';
+import type { AdoptionVault } from './adoption-vault.js';
 import { type AgoraHostPort } from './agora.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
@@ -147,6 +148,26 @@ export interface StepExecutor {
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
+    /**
+     * #311: what each `coolify:adopt` step will change, keyed by the step's key,
+     * and the adoption items that are blocked. Read from the live app on every
+     * plan. Optional: an executor without it plans the step with no details.
+     */
+    adoptionReport?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<{
+        details: Record<string, string[]>;
+        blocked: UnmanagedItem[];
+        /** Resource keys whose live resource could not be read: their steps are not planned. */
+        withheld: string[];
+    }>;
+    /**
+     * #311: puts the adopted apps back as their snapshots recorded them and
+     * returns the env names it deleted. Refuses before any write when a
+     * snapshot's vault entry is missing. Optional like `adoptionReport`.
+     */
+    restoreAdoption?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, rows: readonly Adoption[]): Promise<{
+        envDeleted: string[];
+        tokenLeft?: string[];
+    }>;
 }
 /**
  * #167: {@link StepExecutionContext}'s platform-scoped counterpart -- what
@@ -202,6 +223,9 @@ export interface PlatformStepExecutor {
     driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<{
         archon?: boolean;
         auth?: boolean;
+        backupStorage?: boolean;
+        /** #257 fix round 4: see `PlanPlatformOptions.drifted.backupStorageBlocked` (`platform-diff.ts`). */
+        backupStorageBlocked?: string;
     }>;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
@@ -247,6 +271,10 @@ export declare class StalePlanError extends Error {
 export declare class ConfirmationRequiredError extends Error {
     constructor(orgId: OrgId);
 }
+/** #311: the first successful apply after the adopting one confirmed the snapshot, so it is no longer offered. */
+export declare class AdoptionConfirmedError extends Error {
+    constructor(orgId: OrgId, resourceKeys: readonly string[]);
+}
 export declare class NotAuthorizedError extends Error {
     constructor(actor: AuditActor, orgId: OrgId);
 }
@@ -295,6 +323,12 @@ export interface FoundryPlanApplyOptions {
      * before zitadel-login's binding can be written.
      */
     loginHostBindings?: boolean;
+    /**
+     * F5: true when the host's executor was built with a `broker` port.
+     * Optional, and false without it: each entry's broker entry is then
+     * reported blocked instead of planned.
+     */
+    broker?: boolean;
     /**
      * #177: true when the host's executor was built with its own `filesOrganisation`
      * / `aiOrganisation` port. Without one, the org step needs the platform's
@@ -302,6 +336,13 @@ export interface FoundryPlanApplyOptions {
      */
     filesOrganisation?: boolean;
     aiOrganisation?: boolean;
+    /**
+     * #311: where an adoption keeps the env values of the app it takes over, and
+     * the rows that hold the rest of the snapshot. Both are needed: with either
+     * absent, each adopted resource is reported blocked and planned for nothing.
+     */
+    adoptionVault?: AdoptionVault;
+    adoptionStore?: AdoptionStore;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /**
@@ -349,13 +390,24 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly agora;
     private readonly jobsScheduler;
     private readonly loginHostBindings;
+    private readonly broker;
     private readonly hostFiles;
     private readonly hostAi;
+    private readonly adoptionVault;
+    private readonly adoptionStore;
     private readonly now;
     private readonly platformDeps;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     apply(plan: Plan, confirmedOrgName: string): Promise<AppliedState>;
+    /**
+     * #311: puts the org's adopted apps back as their snapshots recorded them.
+     * Refused unless `confirmedOrgName` matches the org's `displayName`, and
+     * when every snapshot is `confirmed`; a `confirmed` row beside an `adopted`
+     * one is left as it is. Returns resource keys and env names, never a value
+     * (rule 6).
+     */
+    restore(id: OrgId, confirmedOrgName: string): Promise<AdoptionRestored>;
     /**
      * #167: {@link plan}, for the shared platform (#166) rather than an org --
      * there is no id to pass, since `DeclaredPlatform` is one singleton record.
@@ -388,6 +440,14 @@ export declare class FoundryPlanApply implements PlanApply {
     private refuseDestroy;
     private runSteps;
     private computeFreshPlan;
+    /** #311: the `details` of each `coolify:adopt` step and the adoption items that are blocked. */
+    private addAdoptionReport;
+    /**
+     * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
+     * store checks the names it knows; this adds the platform's own hostnames,
+     * which only the plan can read.
+     */
+    private invalidHosting;
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`

package/dist/plan/plan-apply.js

@@ -1,8 +1,12 @@
 import { createHash } from 'node:crypto';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
+import { validateHosting } from '../org.js';
+import { PLATFORM_SERVICE_KEYS } from '../platform.js';
+import { adoptedConnectorKey, adoptedTunnelKey, declaredAdoptUuids } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
+import { lockedHostnames } from './locked-hostnames.js';
 import { planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export class DeclaredOrgNotFoundError extends Error {
@@ -25,6 +29,13 @@ export class ConfirmationRequiredError extends Error {
         this.name = 'ConfirmationRequiredError';
     }
 }
+/** #311: the first successful apply after the adopting one confirmed the snapshot, so it is no longer offered. */
+export class AdoptionConfirmedError extends Error {
+    constructor(orgId, resourceKeys) {
+        super(`the snapshot of org ${orgId} is confirmed (${resourceKeys.join(', ')}); it can no longer be restored`);
+        this.name = 'AdoptionConfirmedError';
+    }
+}
 export class NotAuthorizedError extends Error {
     constructor(actor, orgId) {
         super(`${actor.display} does not hold the permission to apply org ${orgId} (#9, #19)`);
@@ -63,6 +74,16 @@ export class PlatformConfirmationRequiredError extends Error {
         this.name = 'PlatformConfirmationRequiredError';
     }
 }
+/** The steps that read an entry's hostnames: `computeFreshPlan` drops them for an org whose hosting is invalid. */
+const HOSTNAME_STEPS = new Set([
+    'coolify:adopt',
+    'coolify:app',
+    'coolify:broker-entry',
+    'coolify:database',
+    'cloudflare:tunnel',
+    'cloudflare:access',
+    'jobs:registration',
+]);
 /**
  * The #19 implementation of {@link PlanApply}: computes a plan against live
  * state, and refuses to apply one that has gone stale, one that touches a
@@ -80,8 +101,11 @@ export class FoundryPlanApply {
     agora;
     jobsScheduler;
     loginHostBindings;
+    broker;
     hostFiles;
     hostAi;
+    adoptionVault;
+    adoptionStore;
     now;
     platformDeps;
     constructor(options) {
@@ -95,8 +119,11 @@ export class FoundryPlanApply {
         this.agora = options.agora;
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
+        this.broker = options.broker ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
+        this.adoptionVault = options.adoptionVault;
+        this.adoptionStore = options.adoptionStore;
         this.now = options.now ?? (() => new Date());
         this.platformDeps = options.platform;
     }
@@ -123,6 +150,42 @@ export class FoundryPlanApply {
         }
         return this.runSteps(org, plan, detail);
     }
+    /**
+     * #311: puts the org's adopted apps back as their snapshots recorded them.
+     * Refused unless `confirmedOrgName` matches the org's `displayName`, and
+     * when every snapshot is `confirmed`; a `confirmed` row beside an `adopted`
+     * one is left as it is. Returns resource keys and env names, never a value
+     * (rule 6).
+     */
+    async restore(id, confirmedOrgName) {
+        const authorized = await this.authz.canApply(this.actor, id);
+        if (!authorized)
+            throw new NotAuthorizedError(this.actor, id);
+        const org = await this.store.get(id);
+        if (!org)
+            throw new DeclaredOrgNotFoundError(id);
+        if (confirmedOrgName.trim() !== org.displayName.trim())
+            throw new ConfirmationRequiredError(id);
+        const { adoptionStore, executor } = this;
+        if (!this.adoptionVault || !adoptionStore || !executor.restoreAdoption) {
+            throw new Error(`restore for org ${id}: no adoption vault is wired`);
+        }
+        const rows = await adoptionStore.list(id);
+        const adopted = rows.filter((row) => row.state === 'adopted');
+        const confirmed = rows.filter((row) => row.state === 'confirmed');
+        if (adopted.length === 0 && confirmed.length > 0) {
+            throw new AdoptionConfirmedError(id, confirmed.map((row) => row.resourceKey));
+        }
+        const state = await this.store.getAppliedState(id);
+        const { envDeleted, tokenLeft } = await executor.restoreAdoption(org, state?.serviceIds ?? {}, adopted);
+        for (const row of adopted)
+            await adoptionStore.setState(id, row.resourceKey, 'restored');
+        return {
+            restored: adopted.map((row) => row.resourceKey),
+            envDeleted,
+            ...(tokenLeft?.length ? { tokenLeft } : {}),
+        };
+    }
     /**
      * #167: {@link plan}, for the shared platform (#166) rather than an org --
      * there is no id to pass, since `DeclaredPlatform` is one singleton record.
@@ -203,8 +266,25 @@ export class FoundryPlanApply {
         }
         const state = await this.store.getAppliedState(id);
         const serviceIds = { ...(state?.serviceIds ?? {}) };
-        const targets = destroyTargets(serviceIds);
+        // #311: an adopted resource is released, never deleted. Its rows go to
+        // `released` and its ids leave `serviceIds` before the first delete, so a
+        // retried destroy skips them the same way.
+        const adoptedKeys = new Set((await this.adoptionStore?.list(id))?.map((r) => r.resourceKey));
+        const targets = destroyTargets(serviceIds, adoptedKeys, declaredAdoptUuids(org));
         try {
+            for (const resourceKey of adoptedKeys) {
+                delete serviceIds[resourceKey];
+                await this.adoptionStore?.setState(id, resourceKey, 'released');
+            }
+            if (adoptedKeys.size > 0) {
+                await this.store.putAppliedState({
+                    orgId: id,
+                    serviceIds,
+                    checkpoints: state?.checkpoints ?? [],
+                    failedFields: state?.failedFields ?? [],
+                    lastApplied: state?.lastApplied ?? null,
+                });
+            }
             for (const target of targets) {
                 // A provider 404 counts as deleted -- `StepDestroyer.destroy`'s own
                 // doc comment -- so nothing here needs to special-case "already
@@ -272,6 +352,7 @@ export class FoundryPlanApply {
         const orgId = plan.orgId;
         const previous = await this.store.getAppliedState(orgId);
         const serviceIds = { ...(previous?.serviceIds ?? {}) };
+        const adoptedBefore = (await this.adoptionStore?.list(orgId))?.filter((row) => row.state === 'adopted');
         const checkpoints = [];
         // Backed by the very `serviceIds` map this method persists once, at the
         // end — see `StepExecutionContext`'s doc comment for why.
@@ -335,6 +416,20 @@ export class FoundryPlanApply {
             lastApplied: { at: this.now().toISOString(), declaredOrgVersion: hashOrg(org) },
         };
         await this.store.putAppliedState(applied);
+        // #311: the first successful apply after the adopting one confirms the
+        // snapshot. A row taken after the last successful apply was taken by this
+        // one, or by one that failed, and is not confirmed yet.
+        // Only that same snapshot: one this apply took again is not confirmed by it.
+        for (const row of adoptedBefore ?? []) {
+            if (previous?.lastApplied && row.takenAt <= previous.lastApplied.at) {
+                const now = await this.adoptionStore?.get(orgId, row.resourceKey);
+                if (now?.state === 'adopted' &&
+                    now.takenAt === row.takenAt &&
+                    now.settings.uuid === row.settings.uuid) {
+                    await this.adoptionStore?.setState(orgId, row.resourceKey, 'confirmed');
+                }
+            }
+        }
         await this.audit.recordApply({
             actor: this.actor,
             orgId,
@@ -348,15 +443,74 @@ export class FoundryPlanApply {
         const org = await this.store.get(id);
         if (!org)
             throw new DeclaredOrgNotFoundError(id);
-        const [live, applied, platformReadiness, agoraHost] = await Promise.all([
+        const [live, applied, platformReadiness, agoraHost, adopted] = await Promise.all([
             readLiveResources(id, this.readers),
             this.store.getAppliedState(id),
             this.orgPlatformReadiness(),
             this.orgAgoraHost(id),
+            this.adoptionStore?.list(id) ?? [],
         ]);
-        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, { loginHostBindings: this.loginHostBindings });
+        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
+            loginHostBindings: this.loginHostBindings,
+            broker: this.broker,
+            adoption: {
+                wired: Boolean(this.adoptionVault && this.adoptionStore),
+                adopted,
+            },
+        });
+        await this.addAdoptionReport(org, detail, applied?.serviceIds ?? {});
+        const invalid = await this.invalidHosting(org);
+        if (invalid) {
+            // Rule 2: reported in `unmanaged`, not thrown. Steps that read the
+            // hostnames are dropped, so `apply` does not act on them.
+            detail.plannedSteps = detail.plannedSteps.filter(({ action }) => !HOSTNAME_STEPS.has(`${action.system}:${action.kind}`));
+            detail.unmanaged.push({
+                description: `${org.slug}'s hosting is blocked, not planned: ${invalid}`,
+                key: 'hosting:invalid',
+            });
+        }
         return { org, plan: toPlan(detail), detail };
     }
+    /** #311: the `details` of each `coolify:adopt` step and the adoption items that are blocked. */
+    async addAdoptionReport(org, detail, recordedIds) {
+        if (!this.adoptionVault || !this.adoptionStore || !this.executor.adoptionReport)
+            return;
+        const report = await this.executor.adoptionReport(org, recordedIds);
+        // A resource that cannot be read gets neither its adopt step nor its own (rule 2).
+        const withheld = new Set(report.withheld);
+        // The tunnel step waits for the adoption of the tunnel and of its connector (#312).
+        const tunnelHeld = withheld.has(adoptedTunnelKey(org)) || withheld.has(adoptedConnectorKey(org));
+        detail.plannedSteps = detail.plannedSteps.filter(({ action }) => !(action.system === 'coolify' && action.kind === 'adopt' && withheld.has(action.key)) &&
+            !(action.system === 'coolify' &&
+                (action.kind === 'app' || action.kind === 'database') &&
+                withheld.has(`coolify:${action.kind}:${action.key}`)) &&
+            !(action.system === 'cloudflare' && action.kind === 'tunnel' && tunnelHeld));
+        for (const { action, step } of detail.plannedSteps) {
+            const key = action.system === 'coolify' && action.kind === 'adopt'
+                ? action.key
+                : action.system === 'cloudflare' && action.kind === 'tunnel'
+                    ? adoptedTunnelKey(org)
+                    : undefined;
+            if (key !== undefined && report.details[key])
+                step.details = report.details[key];
+        }
+        detail.unmanaged.push(...report.blocked);
+    }
+    /**
+     * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
+     * store checks the names it knows; this adds the platform's own hostnames,
+     * which only the plan can read.
+     */
+    async invalidHosting(org) {
+        const platform = await this.platformDeps?.store.get();
+        const platformHostnames = platform
+            ? PLATFORM_SERVICE_KEYS.map((k) => platform[k].hostname)
+            : [];
+        return validateHosting(org.hosting, {
+            domain: org.domain,
+            locked: lockedHostnames(org, platformHostnames),
+        });
+    }
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`
@@ -549,7 +703,7 @@ const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
  * belongs to is already left in place -- deleting only the rule and not the
  * zone is a decision left for whoever wires teardown in, not made here.
  */
-function destroyTargets(serviceIds) {
+function destroyTargets(serviceIds, adoptedKeys, adoptedUuids) {
     // Reverse-teardown order: everything under one of these prefixes is
     // collected in this order, then every ZITADEL app (there can be several,
     // #71), then the two scope ids last.
@@ -566,6 +720,9 @@ function destroyTargets(serviceIds) {
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix))
                 continue;
+            // Never delete what was adopted: a row in any state, or a declared uuid (#311).
+            if (adoptedKeys.has(resourceKey) || adoptedUuids.has(id))
+                continue;
             const [system, kind] = prefix.split(':');
             targets.push({ system, kind, key: resourceKey.slice(prefix.length), id });
         }
@@ -604,7 +761,8 @@ function destroyServiceIdKey(target) {
 const STEP_FIELDS = {
     'zitadel:issuer': 'issuer.usesDomain',
     'zitadel:owner': 'owner',
-    'zitadel:customers': 'hosting.issuerApps',
+    'zitadel:customers': 'hosting.entries.uses.auth',
+    'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
     'coolify:calls': 'calls.enabled',