.env.example

@@ -63,142 +63,23 @@ REVERB_SERVER_PORT=8080
 # browser-side (baked into built assets): the address a browser can reach
 VITE_REVERB_APP_KEY=change-me-app-key
 VITE_REVERB_HOST=localhost
-VITE_REVERB_PORT=443
-VITE_REVERB_SCHEME=https
+VITE_REVERB_PORT=8080
+VITE_REVERB_SCHEME=http
 VITE_APP_NAME=CluPilot
 
 # Vite HMR host the browser connects to (dev). Set to the reachable VM address
 # when developing against a remote host; localhost for local-only.
 VITE_HMR_HOST=localhost
 
-# ── Mail ─────────────────────────────────────────────────────────────────
-# DEV: `log` writes mails to storage/logs (nothing is sent).
-# PROD: switch to smtp and fill in the credentials below.
+# ── Mail (dev → log) ─────────────────────────────────────────────────────
 MAIL_MAILER=log
 MAIL_FROM_ADDRESS=hello@clupilot.local
 MAIL_FROM_NAME=CluPilot
-# MAIL_MAILER=smtp
-# MAIL_HOST=smtp.your-provider.tld
-# MAIL_PORT=587
-# MAIL_USERNAME=
-# MAIL_PASSWORD=
-# MAIL_SCHEME=tls           # tls | smtps (465)
-
-# ═════════════════════════════════════════════════════════════════════════
-#  CluPilot operations — fill these in to run real provisioning.
-#  Everything below is OPTIONAL for local dev: left blank, the services are
-#  no-ops/fakes and the app + test suite still run. Only real infrastructure
-#  work (host onboarding, customer provisioning) needs them.
-# ═════════════════════════════════════════════════════════════════════════
-
-# ── Stripe (payments) ────────────────────────────────────────────────────
-# WEBHOOK_SECRET is READ BY CODE today (signature check on /webhooks/stripe).
-# Outside local/testing a missing secret makes the webhook fail closed.
-STRIPE_WEBHOOK_SECRET=
-# Not read yet — needed once the Checkout flow is built (currently the portal
-# only records a purchase intent):
-STRIPE_KEY=
-STRIPE_SECRET=
-
-# ── DNS (Hetzner DNS API) ────────────────────────────────────────────────
-# Creates <subdomain>.<zone> A-records for each customer instance.
-HETZNER_DNS_TOKEN=
-CLUPILOT_DNS_ZONE=clupilot.com
-
-# ── Traefik (reverse proxy + TLS) ────────────────────────────────────────
-# Directory ON THE PROXMOX HOST where CluPilot writes dynamic route files.
-TRAEFIK_DYNAMIC_PATH=/etc/traefik/dynamic
-
-# ── WireGuard hub (this CluPilot VM) ─────────────────────────────────────
-# Hosts join this hub during onboarding; CluPilot reaches them over the tunnel.
-CLUPILOT_WG_SUBNET=10.66.0.0/24
-CLUPILOT_WG_HUB_IP=10.66.0.1
-CLUPILOT_WG_ENDPOINT=              # public host:port peers dial, e.g. vpn.clupilot.com:51820
-CLUPILOT_WG_HUB_PUBKEY=            # `wg pubkey < /etc/wireguard/privatekey`
-CLUPILOT_WG_CONFIG_PATH=/etc/wireguard/wg0.conf
-
-# ── SSH identity for host onboarding ─────────────────────────────────────
-# Deployed to each fresh server after the one-time root password login.
-# PREFERRED: point at files (a multi-line PEM cannot live in .env).
-#   ssh-keygen -t ed25519 -N '' -C clupilot -f storage/app/ssh/clupilot
-CLUPILOT_SSH_PUBLIC_KEY_PATH=
-CLUPILOT_SSH_PRIVATE_KEY_PATH=
-# Alternative (single-line values only):
-CLUPILOT_SSH_PUBLIC_KEY=
-CLUPILOT_SSH_PRIVATE_KEY=
-CLUPILOT_SSH_COMMAND_TIMEOUT=2000
-
-# ── Monitoring ───────────────────────────────────────────────────────────
-# The built-in client speaks a GENERIC REST API:
-#   GET/POST /monitors, GET/DELETE /monitors/{id}
-# For Uptime Kuma use the bundled bridge below (Kuma's own REST API is
-# read-only — monitor CRUD goes through Socket.IO):
-#   MONITORING_API_URL=http://kuma-bridge:8080
-# Leave blank to disable monitoring entirely: provisioning records a stable
-# breadcrumb and its own health checks (occ status, TLS, admin user) still
-# gate acceptance.
-MONITORING_API_URL=
-MONITORING_API_TOKEN=
-
-# ── Uptime Kuma (über die mitgelieferte Bridge) ───────────────────────────
-# Kuma kann Monitore nur über Socket.IO anlegen, daher die Bridge:
-#   docker compose --profile monitoring up -d --build kuma-bridge
-# Danach hier MONITORING_API_URL auf die Bridge zeigen lassen:
-#   MONITORING_API_URL=http://kuma-bridge:8080
-# MONITORING_API_TOKEN ist gleichzeitig das Bridge-Token (frei wählbar, lang).
-KUMA_URL=
-KUMA_USERNAME=
-KUMA_PASSWORD=
-KUMA_TOTP=
-
-# Monitoring-Verhalten bei Ausfall:
-#   MONITORING_REQUIRED=false -> Bereitstellung läuft weiter (Warn-Event), Standard
-#   MONITORING_REQUIRED=true  -> Lauf schlägt fehl, wenn Monitoring nicht erreichbar
-MONITORING_REQUIRED=false
-MONITORING_ATTEMPTS=2
-
-# ── Admin-Konsole: erlaubte Hostnamen ────────────────────────────────────
-# Die Proxmox-Hosts UND das Admin-Dashboard dürfen nie öffentlich erreichbar
-# sein. Primär regelt das dein Reverse Proxy (nur www/app/ws/api öffentlich);
-# dies ist die zweite Verteidigungslinie IN der App: auf jedem anderen Host
-# antwortet /admin mit 404 (nicht 403 — verrät nicht, dass es die Konsole gibt).
-# Komma-getrennt. LEER = keine Einschränkung (aktueller Dev-Stand).
-# Beispiel: # Schluessel fuer gespeicherte VPN-Konfigurationen (32 Byte, base64).
-# Bewusst getrennt von APP_KEY. Leer = Speichern deaktiviert.
-# Erzeugen: head -c 32 /dev/urandom | base64
-VPN_CONFIG_KEY=
-
-# Netze, die als "wir" gelten, solange die Website versteckt ist
-# (WireGuard-Subnetz). Alles andere sieht die Platzhalterseite.
-TRUSTED_RANGES=10.66.0.0/24,127.0.0.1
-
-# Umsatzsteuersatz des Verkäufers in Prozent. Preise in der Konfiguration
-# sind NETTO; die Oberfläche weist beides aus.
-CLUPILOT_TAX_PERCENT=20
-
-ADMIN_HOSTS=admin.dev.clupilot.com,10.10.90.185,localhost,127.0.0.1
-
-# ── Nextcloud blueprint template ─────────────────────────────────────────
-# NOT an env var: set the Proxmox template VMID per plan in
-# config/provisioning.php → plans.*.template_vmid (default 9000).
 
 # ── docker-compose knobs (host-side) ─────────────────────────────────────
 HOST_UID=1000
 HOST_GID=1000
 APP_PORT=80
-# Vite dev server (HMR). Off by default: over the HTTPS domains the
-# browser cannot load assets from http://<ip>:5173. Set true only when
-# working over http://10.10.90.185, then run: docker compose up -d app
-VITE_AUTOSTART=false
 VITE_PORT=5173
 REVERB_HOST_PORT=8080
 DB_HOST_PORT=3306
-
-# ── CI (Gitea Actions) ──────────────────────────────────────────────────────
-# Registrierungs-Token aus Gitea: Repo → Settings → Actions → Runners →
-# "Create new runner". Danach:  docker compose --profile ci up -d runner
-GITEA_INSTANCE_URL=https://git.bave.dev
-GITEA_RUNNER_TOKEN=
-GITEA_RUNNER_NAME=clupilot-local
-# Passend zur Server-Version halten (1.20 verträgt keinen aktuellen Runner).
-GITEA_RUNNER_VERSION=0.2.6

.gitea/workflows/tests.yml

@@ -1,118 +0,0 @@
-# CluPilot CI — runs on Gitea Actions (GitHub-Actions syntax, own runner).
-#
-# Deliberately not mirrored to GitHub: this repository describes how our
-# infrastructure is provisioned, and the same workflow runs at home. If we ever
-# move, this file goes along unchanged.
-name: tests
-
-on:
-  push:
-    branches: [main, 'feat/**']
-  pull_request:
-
-jobs:
-  pest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.2.2
-
-      - name: Set up PHP
-        # Pinned: the floating v2 tag now requires node24, which the runner
-        # matching Gitea 1.20 cannot execute. 2.34.1 is the newest that still
-        # declares node20.
-        uses: shivammathur/setup-php@2.34.1
-        with:
-          php-version: '8.4'
-          extensions: mbstring, pdo_sqlite, sodium, redis, bcmath, gd, zip
-          coverage: none
-
-      - name: Install PHP dependencies
-        # Source clones, not dist archives: dist downloads go through GitHub's
-        # API, which throttles anonymous callers and left a half-installed
-        # vendor/ behind — the tests then failed with 500s that had nothing to
-        # do with the code. Cloning is slower and does not need anyone's quota.
-        # Swap back to --prefer-dist once a GitHub token is configured.
-        run: composer install --no-interaction --prefer-source --no-progress
-
-      - name: Prepare environment
-        run: |
-          cp .env.example .env
-          php artisan key:generate
-
-      - name: Tests
-        # phpunit.xml pins its own sqlite/array drivers, so no services needed.
-        run: ./vendor/bin/pest --colors=always
-
-  assets:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.2.2
-
-      - uses: actions/setup-node@v4.1.0
-        with:
-          node-version: '22'
-
-      - name: Install JS dependencies
-        run: npm ci --no-fund --no-audit
-
-      # A build failure here is what used to surface as "the design is broken"
-      # only after deploying — catch it before it ships.
-      - name: Build assets
-        run: npm run build
-
-  release:
-    # Only a green run produces the tag the console offers as an update.
-    needs: [pest, assets]
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Tag this commit as tested
-        run: |
-          tag="tested-$(date -u +%Y%m%d-%H%M)-$(git rev-parse --short HEAD)"
-          git tag "$tag"
-          git push origin "$tag"
-
-      # A release is cut by editing VERSION and merging it — nothing else. The
-      # tag is created here, only after the suite is green, and only if it does
-      # not already exist. Never moved: servers are pinned to these, and a tag
-      # that changes underneath them means two machines claiming one version.
-      - name: Tag the release when VERSION changed
-        run: |
-          version="$(tr -d ' \n\r' < VERSION)"
-          # Anchored, because a `case` glob does not anchor: `[0-9]*.[0-9]*`
-          # happily accepts 1x.2y.3garbage and would tag it.
-          printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
-            || { echo "VERSION is not MAJOR.MINOR.PATCH: '$version'" >&2; exit 1; }
-
-          # Only the commit that RAISED the version is the release. Without
-          # this, any later green push finds the tag missing and claims it —
-          # and the tag would then name code the bump never described. Runs
-          # overlap and finish out of order; that is enough for it to happen.
-          previous="$(git show 'HEAD^:VERSION' 2>/dev/null | tr -d ' \n\r' || true)"
-          if [ "$previous" = "$version" ]; then
-            echo "::notice::VERSION is unchanged ($version) — nothing to release."
-            exit 0
-          fi
-
-          tag="v${version}"
-          git fetch --tags --force origin
-
-          if existing="$(git rev-parse -q --verify "refs/tags/${tag}^{commit}")"; then
-            # Already released. The invariant is that the tag points at the
-            # commit VERSION was raised in — if a later commit still carries
-            # that number, that is fine, but the tag must not be re-pointed.
-            if [ "$existing" != "$(git rev-parse HEAD)" ]; then
-              echo "::notice::${tag} already exists at ${existing}; leaving it alone."
-            fi
-            exit 0
-          fi
-
-          git config user.name  "CluPilot CI"
-          git config user.email "ci@clupilot.local"
-          git tag -a "$tag" -m "CluPilot ${version}"
-          git push origin "$tag"
-          echo "::notice::Released ${tag}"

.gitignore

@@ -28,4 +28,3 @@ Thumbs.db
 
 # Gitea push token (parent home dir; never track)
 .env.gitea
-clupilot.env

VERSION

@@ -1 +0,0 @@
-1.0.0

app/Actions/ApplyStripeBillingEvent.php

@@ -1,459 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\StripePendingEvent;
-use App\Models\Subscription;
-use App\Models\SubscriptionRecord;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-
-/**
- * What Stripe tells us about the billing cycle, applied to the contract.
- *
- * The division of labour: Stripe owns the money — retries, dunning, off-session
- * SCA, invoice numbering — and we own capability, because Stripe does not know
- * how big the VM should be. So these handlers move period boundaries and status,
- * and write the register. They never re-derive an amount: the invoice is the
- * authority for what was charged, and recomputing it here from our own
- * catalogue would produce a second, disagreeing answer.
- *
- * Every handler is idempotent. Stripe retries a webhook until it gets a 2xx,
- * and it also sends the same event to several endpoints — so "already applied"
- * is the normal case, not the exception.
- */
-class ApplyStripeBillingEvent
-{
-    /**
-     * Precedence when two events share a second — highest wins.
-     *
-     * Ordered by how much the event settles: a payment that went through is the
-     * last word, a snapshot of the subscription is a running picture, and a
-     * failed attempt is the least final of the three, since a retry may already
-     * have succeeded.
-     */
-    private const RANK_PAID = 3;
-
-    private const RANK_UPDATED = 2;
-
-    private const RANK_FAILED = 1;
-
-    public function __construct(private RecordCommercialEvent $record) {}
-
-    /**
-     * A renewal was paid. Move the period on and enter it in the register.
-     *
-     * @param  array<string, mixed>  $invoice
-     */
-    public function invoicePaid(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
-    {
-        $subscription = $this->resolve($invoice['subscription'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        $reason = (string) ($invoice['billing_reason'] ?? '');
-
-        // The checkout's own invoice is not a renewal — it is the purchase, and
-        // OpenSubscription has already entered it. Recording it again here
-        // would double every customer's first payment in the register.
-        if ($reason === 'subscription_create') {
-            return null;
-        }
-
-        // Only a cycle renewal moves the term on. Stripe also sends paid
-        // invoices for prorations and for charges raised by hand, and those are
-        // money received without being the start of a new month — calling them
-        // renewals would push the period forward on a top-up.
-        $isRenewal = $reason === 'subscription_cycle';
-        $invoiceId = (string) ($invoice['id'] ?? '');
-
-        [$start, $end] = $this->period($invoice);
-
-        // A contract that has ended stays ended (mutateInOrder refuses one), so
-        // a final invoice arriving after the deletion cannot hand a departed
-        // customer their service back. The payment is still entered in the
-        // register below; it did happen.
-        if ($isRenewal && $start !== null && $end !== null) {
-            $this->mutateInOrder($subscription, $eventAt, self::RANK_PAID, fn (Subscription $fresh) => $end
-                // Never backwards: a renewal delayed behind the next one would
-                // otherwise shorten the term the customer has already paid for.
-                ->greaterThanOrEqualTo($fresh->current_period_end)
-                    // Period boundaries are not part of the frozen snapshot:
-                    // what the customer is owed does not change, only which
-                    // month it is.
-                    ? [
-                        'current_period_start' => $start,
-                        'current_period_end' => $end,
-                        'status' => 'active',
-                        'stripe_status' => 'active',
-                    ]
-                    : null);
-        }
-
-        // One invoice, one entry — enforced by the unique index rather than by
-        // a check, because Stripe can deliver the same invoice twice at once
-        // and both deliveries would pass a check.
-        $event = $isRenewal ? SubscriptionRecord::EVENT_RENEWAL : SubscriptionRecord::EVENT_INVOICE_PAID;
-
-        return $this->recordOnce(
-            fn () => ($this->record)(
-                event: $event,
-                subscription: $subscription->refresh(),
-                netCents: $isRenewal ? $subscription->price_cents : 0,
-                stripe: [
-                    'invoice' => $invoiceId ?: null,
-                    'subscription' => $subscription->stripe_subscription_id,
-                ],
-                // The exact kind, kept so a proration or a manual charge stays
-                // distinguishable from an ordinary renewal.
-                extra: ['billing_reason' => $reason ?: null],
-                // Stripe's total is what was actually taken, tax and all. Ours
-                // is what was agreed; the register states both.
-                chargedGrossCents: isset($invoice['amount_paid']) ? (int) $invoice['amount_paid'] : null,
-                eventKey: $invoiceId !== '' ? "{$event}:{$invoiceId}" : null,
-            )
-        );
-    }
-
-    /**
-     * A renewal failed. Recorded, and nothing else: Stripe runs the dunning
-     * schedule, and cutting a customer off on the first failed attempt would
-     * punish an expired card as though it were a refusal to pay.
-     *
-     * @param  array<string, mixed>  $invoice
-     */
-    public function invoicePaymentFailed(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
-    {
-        $subscription = $this->resolve($invoice['subscription'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        $invoiceId = (string) ($invoice['id'] ?? '');
-
-        // Only if this is the newest word we have. A failed attempt delayed
-        // behind the successful retry would otherwise flip a customer who has
-        // since paid back to past_due.
-        $this->mutateInOrder($subscription, $eventAt, self::RANK_FAILED, fn () => ['stripe_status' => 'past_due']);
-
-        return $this->recordOnce(
-            fn () => ($this->record)(
-                event: SubscriptionRecord::EVENT_PAYMENT_FAILED,
-                subscription: $subscription->refresh(),
-                netCents: 0,
-                stripe: [
-                    'invoice' => $invoiceId ?: null,
-                    'subscription' => $subscription->stripe_subscription_id,
-                ],
-                extra: ['attempt' => $invoice['attempt_count'] ?? null],
-                chargedGrossCents: 0,
-                // Per attempt, not per invoice: Stripe retries a failing
-                // payment on a schedule, and each attempt is its own event.
-                eventKey: $invoiceId !== ''
-                    ? 'payment_failed:'.$invoiceId.':'.($invoice['attempt_count'] ?? 0)
-                    : null,
-            )
-        );
-    }
-
-    /**
-     * Stripe's own status changed. Theirs is the authority on whether the money
-     * is arriving; we copy it, and leave what the customer may USE to our own
-     * status, which only a cancellation or an operator changes.
-     *
-     * @param  array<string, mixed>  $object
-     */
-    public function subscriptionUpdated(array $object, ?Carbon $eventAt = null): ?Subscription
-    {
-        $subscription = $this->resolve($object['id'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        [$start, $end] = $this->period($object);
-
-        // Ended is ended, whatever order events arrive in — and an older
-        // snapshot must never overwrite a newer one it was delivered behind.
-        $this->mutateInOrder($subscription, $eventAt, self::RANK_UPDATED, fn () => array_filter([
-            'stripe_status' => $object['status'] ?? null,
-            'current_period_start' => $start,
-            'current_period_end' => $end,
-        ], fn ($value) => $value !== null));
-
-        return $subscription;
-    }
-
-    /**
-     * The subscription has ended at Stripe. That is the end of the contract,
-     * so it goes in the register — a cancellation nobody recorded is exactly
-     * the kind of gap the register exists to prevent.
-     *
-     * @param  array<string, mixed>  $object
-     */
-    public function subscriptionDeleted(array $object, ?Carbon $eventAt = null): ?SubscriptionRecord
-    {
-        $subscription = $this->resolve($object['id'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        $endedAt = isset($object['ended_at'])
-            ? Carbon::createFromTimestamp((int) $object['ended_at'])
-            : now();
-
-        // The ending and its entry in the register commit together. Marking the
-        // contract cancelled first and failing before the record would leave a
-        // retry seeing "already cancelled" and returning — and the end of a
-        // contract would never be entered at all.
-        return $this->recordOnce(fn () => DB::transaction(function () use ($subscription, $object, $endedAt, $eventAt) {
-            // Held while we decide, so a renewal arriving at the same moment
-            // cannot reactivate the contract between this and the write.
-            $subscription = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->firstOrFail();
-
-            // No ordering guard: an ending is final, so a late delivery of it
-            // is still correct. Only the running picture can go stale.
-            $subscription->update([
-                'status' => 'cancelled',
-                'stripe_status' => $object['status'] ?? 'canceled',
-                'cancelled_at' => $endedAt,
-                'stripe_event_at' => $eventAt,
-            ]);
-
-            return ($this->record)(
-                event: SubscriptionRecord::EVENT_CANCELLATION,
-                subscription: $subscription->refresh(),
-                netCents: 0,
-                at: $endedAt,
-                stripe: ['subscription' => $subscription->stripe_subscription_id],
-                chargedGrossCents: 0,
-                // A contract ends once. Two deliveries arriving together would
-                // both pass a status check; only one can take this key.
-                eventKey: 'cancellation:'.$subscription->id,
-            );
-        }));
-    }
-
-    /**
-     * Whether this event is the newest word we have about the contract.
-     *
-     * Stripe does not guarantee delivery order, and the state here is a
-     * running picture rather than a log: applying a stale snapshot on top of a
-     * fresher one is how a paid-up customer ends up looking overdue. The
-     * register is unaffected — each entry is keyed by what it is about, so a
-     * late arrival still lands once, in its proper place.
-     */
-    /**
-     * Decide and write in one step, with the contract's row held.
-     *
-     * The ordering guard is only worth as much as its atomicity: two
-     * deliveries for the same contract can both read a stale copy, both pass
-     * the check, and the loser then overwrites the winner — a renewal
-     * reactivating a contract a deletion had just ended, or an old failure
-     * burying a payment that went through. So the row is re-read under a lock
-     * and re-judged inside the transaction that writes it.
-     *
-     * `$changes` returns the columns to set, or null to decline.
-     *
-     * @param  callable(Subscription): ?array<string, mixed>  $changes
-     */
-    private function mutateInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank, callable $changes): void
-    {
-        DB::transaction(function () use ($subscription, $eventAt, $rank, $changes) {
-            $fresh = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->first();
-
-            if ($fresh === null
-                || $fresh->status === 'cancelled'
-                || ! $this->appliesInOrder($fresh, $eventAt, $rank)) {
-                return;
-            }
-
-            $values = $changes($fresh);
-
-            if ($values === null) {
-                return;
-            }
-
-            if ($eventAt !== null) {
-                $values['stripe_event_at'] = $eventAt;
-                $values['stripe_event_rank'] = $rank;
-            }
-
-            $fresh->update($values);
-        });
-
-        $subscription->refresh();
-    }
-
-    private function appliesInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank): bool
-    {
-        if ($eventAt === null || $subscription->stripe_event_at === null) {
-            return true;   // nothing to compare against
-        }
-
-        if ($eventAt->greaterThan($subscription->stripe_event_at)) {
-            return true;
-        }
-
-        if ($eventAt->lessThan($subscription->stripe_event_at)) {
-            return false;
-        }
-
-        // Same second, which Stripe's one-second timestamps make common enough
-        // to matter: a failed attempt and the retry that succeeded can share
-        // one. Decide by what the event says about the money.
-        return $rank >= (int) ($subscription->stripe_event_rank ?? 0);
-    }
-
-    /**
-     * Write a register entry, unless one already exists for this invoice and
-     * event.
-     *
-     * The uniqueness lives in the database, on (stripe_invoice_id, event).
-     * Checking first and inserting afterwards leaves a window that Stripe
-     * delivering the same invoice twice at once walks straight through — and a
-     * register that counts a payment twice is worse than one that is late.
-     *
-     * @param  callable(): SubscriptionRecord  $write
-     */
-    private function recordOnce(callable $write): ?SubscriptionRecord
-    {
-        try {
-            return $write();
-        } catch (UniqueConstraintViolationException) {
-            return null; // already recorded by a concurrent delivery
-        }
-    }
-
-    /**
-     * Hold an event whose contract does not exist yet, so it is not lost.
-     *
-     * @param  array<string, mixed>  $event
-     */
-    public function hold(array $event): void
-    {
-        $subscriptionId = $event['data']['object']['subscription']
-            ?? $event['data']['object']['id']
-            ?? null;
-
-        if (! is_string($subscriptionId) || ! is_string($event['id'] ?? null)) {
-            return;
-        }
-
-        // Only what we could not match. A handler returns null for several
-        // reasons — already recorded, or deliberately skipped, like every
-        // checkout's own invoice — and holding those would fill the table with
-        // rows that replayHeldFor() can never revisit, because their contract
-        // is right there. Nothing to wait for means nothing to hold.
-        if (Subscription::query()->where('stripe_subscription_id', $subscriptionId)->exists()) {
-            // Unless it appeared just now: the contract can be created between
-            // the handler missing it and this check, and the replay that would
-            // have collected it has then already been and gone. Apply it here
-            // instead of dropping it. Safe to repeat — the handlers are
-            // idempotent, so an event that was a no-op stays one.
-            $this->dispatch($event);
-
-            return;
-        }
-
-        StripePendingEvent::query()->updateOrCreate(
-            ['stripe_event_id' => $event['id']],
-            [
-                'stripe_subscription_id' => $subscriptionId,
-                'type' => (string) ($event['type'] ?? ''),
-                'raised_at' => isset($event['created']) && is_numeric($event['created'])
-                    ? Carbon::createFromTimestamp((int) $event['created'])
-                    : null,
-                'payload' => $event,
-            ],
-        );
-    }
-
-    /**
-     * Replay everything held for a contract that has just appeared.
-     *
-     * In their original order, so the ordering guard sees them as Stripe raised
-     * them rather than as they happened to be stored.
-     */
-    public function replayHeldFor(Subscription $subscription): int
-    {
-        if ($subscription->stripe_subscription_id === null) {
-            return 0;
-        }
-
-        $held = StripePendingEvent::query()
-            ->where('stripe_subscription_id', $subscription->stripe_subscription_id)
-            ->orderBy('raised_at')
-            ->orderBy('id')
-            ->get();
-
-        foreach ($held as $pending) {
-            $this->dispatch($pending->payload ?? []);
-            $pending->delete();
-        }
-
-        return $held->count();
-    }
-
-    /**
-     * Route one event to its handler. Returns false for a type we do not
-     * handle, so the caller can tell "not ours" from "nothing to do".
-     *
-     * @param  array<string, mixed>  $event
-     */
-    public function dispatch(array $event): mixed
-    {
-        $object = $event['data']['object'] ?? [];
-        $raisedAt = isset($event['created']) && is_numeric($event['created'])
-            ? Carbon::createFromTimestamp((int) $event['created'])
-            : null;
-
-        return match ($event['type'] ?? '') {
-            'invoice.paid' => $this->invoicePaid($object, $raisedAt),
-            'invoice.payment_failed' => $this->invoicePaymentFailed($object, $raisedAt),
-            'customer.subscription.updated' => $this->subscriptionUpdated($object, $raisedAt),
-            'customer.subscription.deleted' => $this->subscriptionDeleted($object, $raisedAt),
-            default => false,
-        };
-    }
-
-    /**
-     * Find the contract a Stripe event is about.
-     *
-     * An unknown id is logged and dropped rather than raised: Stripe delivers
-     * events for objects created by hand in the dashboard, and by other
-     * environments pointed at the same endpoint. Failing the webhook for those
-     * would have Stripe retry something that can never succeed.
-     */
-    private function resolve(mixed $stripeSubscriptionId): ?Subscription
-    {
-        $id = is_string($stripeSubscriptionId) ? $stripeSubscriptionId : null;
-
-        if ($id === null) {
-            return null;
-        }
-
-        return Subscription::query()->where('stripe_subscription_id', $id)->first();
-    }
-
-    /**
-     * @param  array<string, mixed>  $object
-     * @return array{0: ?Carbon, 1: ?Carbon}
-     */
-    private function period(array $object): array
-    {
-        $start = $object['period_start'] ?? $object['current_period_start'] ?? null;
-        $end = $object['period_end'] ?? $object['current_period_end'] ?? null;
-
-        return [
-            is_numeric($start) ? Carbon::createFromTimestamp((int) $start) : null,
-            is_numeric($end) ? Carbon::createFromTimestamp((int) $end) : null,
-        ];
-    }
-}

app/Actions/BookAddon.php

@@ -1,132 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Models\SubscriptionAddon;
-use App\Models\SubscriptionRecord;
-use App\Services\Billing\AddonCatalogue;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\DB;
-use RuntimeException;
-
-/**
- * Books a module onto a contract at today's price, and freezes it there.
- *
- * Booking is the moment the module's price stops moving for this customer, for
- * exactly the reason the plan's price does: they agreed to a figure. What they
- * have NOT booked stays on the live catalogue — that is a sale still to be
- * made, at whatever it costs now.
- */
-class BookAddon
-{
-    public function __construct(private RecordCommercialEvent $record) {}
-
-    public function __invoke(Subscription $subscription, string $addonKey, int $quantity = 1, ?Order $order = null): SubscriptionAddon
-    {
-        $price = app(AddonCatalogue::class)->priceCents($addonKey);
-
-        if ($price === null) {
-            throw new RuntimeException("Unknown add-on: {$addonKey}");
-        }
-
-        if ($quantity < 1) {
-            throw new RuntimeException('An add-on is booked at least once.');
-        }
-
-        try {
-            return $this->book($subscription, $addonKey, $quantity, $order, $price);
-        } catch (UniqueConstraintViolationException) {
-            // A concurrent retry won. The unique index on (order_id, addon_key)
-            // is what actually enforces "one order books one module" — the
-            // lookup below is only the fast path, and two transactions can both
-            // pass it.
-            return SubscriptionAddon::query()
-                ->where('order_id', $order?->id)
-                ->where('addon_key', $addonKey)
-                ->firstOrFail();
-        }
-    }
-
-    private function book(Subscription $subscription, string $addonKey, int $quantity, ?Order $order, int $price): SubscriptionAddon
-    {
-        // The booking and its entry in the register commit together: if the
-        // record could fail afterwards, retrying the same order would find the
-        // add-on already there and skip the event for good.
-        return DB::transaction(function () use ($subscription, $addonKey, $quantity, $order, $price) {
-            // Idempotent against a retried webhook: one order books one module.
-            if ($order !== null) {
-                $existing = SubscriptionAddon::query()
-                    ->where('order_id', $order->id)
-                    ->where('addon_key', $addonKey)
-                    ->first();
-
-                if ($existing !== null) {
-                    return $existing;
-                }
-            }
-
-            $addon = SubscriptionAddon::create([
-                'subscription_id' => $subscription->id,
-                'order_id' => $order?->id,
-                'addon_key' => $addonKey,
-                'price_cents' => $price,
-                'currency' => Subscription::catalogueCurrency(),
-                'quantity' => $quantity,
-                'booked_at' => now(),
-            ]);
-
-            ($this->record)(
-                event: SubscriptionRecord::EVENT_ADDON_BOOKED,
-                subscription: $subscription,
-                netCents: $addon->monthlyCents(),
-                extra: ['addon' => ['key' => $addonKey, 'quantity' => $quantity, 'price_cents' => $price]],
-                order: $order,
-                stripe: ['event' => $order?->stripe_event_id],
-                // What was actually charged for the module, on the same terms
-                // as a plan purchase: a discount or a free booking has to be
-                // reconcilable, not reconstructed from the catalogue.
-                chargedGrossCents: $order?->stripe_event_id !== null ? (int) $order->amount_cents : null,
-            );
-
-            return $addon;
-        });
-    }
-
-    /**
-     * Stop charging for a module, without losing what it cost.
-     *
-     * Cancelled, not deleted: what a customer was paying, and until when, is
-     * part of the same record as what they bought.
-     */
-    public function cancel(SubscriptionAddon $addon): SubscriptionAddon
-    {
-        return DB::transaction(function () use ($addon) {
-            // Claim the cancellation conditionally, so two requests arriving
-            // together write one event between them. Checking `isActive()` on
-            // separate instances and updating afterwards lets both through, and
-            // the register would show a module cancelled twice.
-            $claimed = SubscriptionAddon::query()
-                ->whereKey($addon->getKey())
-                ->whereNull('cancelled_at')
-                ->update(['cancelled_at' => now(), 'updated_at' => now()]);
-
-            if ($claimed === 0) {
-                return $addon->refresh();
-            }
-
-            $addon->refresh();
-
-            ($this->record)(
-                event: SubscriptionRecord::EVENT_ADDON_CANCELLED,
-                subscription: $addon->subscription,
-                netCents: -$addon->monthlyCents(),
-                extra: ['addon' => ['key' => $addon->addon_key, 'quantity' => $addon->quantity]],
-                order: $addon->order,
-            );
-
-            return $addon;
-        });
-    }
-}

app/Actions/Fortify/CreateNewUser.php

@@ -1,64 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\Customer;
-use App\Models\User;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\Rule;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\CreatesNewUsers;
-
-class CreateNewUser implements CreatesNewUsers
-{
-    use PasswordValidationRules;
-
-    /**
-     * Validate and create a newly registered user.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function create(array $input): User
-    {
-        Validator::make($input, [
-            'name' => ['required', 'string', 'max:255'],
-            'email' => [
-                'required',
-                'string',
-                'email',
-                'max:255',
-                Rule::unique(User::class),
-                // Never let public signup claim an existing (possibly not-yet-
-                // provisioned) customer's email — ensureUser() would later link
-                // that account and hand over the customer's portal.
-                Rule::unique(Customer::class, 'email'),
-            ],
-            'password' => $this->passwordRules(),
-        ])->validate();
-
-        // Create the user and its linked customer atomically — a public signup is
-        // a customer, and the portal (Billing::purchase, Settings, …) needs one.
-        // Either both exist or neither, so a failure never orphans a user.
-        return DB::transaction(function () use ($input) {
-            $user = User::create([
-                'name' => $input['name'],
-                'email' => $input['email'],
-                'password' => Hash::make($input['password']),
-            ]);
-
-            Customer::query()->create([
-                'user_id' => $user->id,
-                'name' => $input['name'],
-                'email' => $input['email'],
-                'locale' => app()->getLocale(),
-                'status' => 'active',
-            ]);
-
-            return $user;
-        });
-    }
-}

app/Actions/Fortify/PasswordValidationRules.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use Illuminate\Contracts\Validation\Rule;
-use Illuminate\Validation\Rules\Password;
-
-trait PasswordValidationRules
-{
-    /**
-     * Get the validation rules used to validate passwords.
-     *
-     * @return array<int, Rule|array<mixed>|string>
-     */
-    protected function passwordRules(): array
-    {
-        return ['required', 'string', Password::default(), 'confirmed'];
-    }
-}

app/Actions/Fortify/ResetUserPassword.php

@@ -1,32 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\User;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\ResetsUserPasswords;
-
-class ResetUserPassword implements ResetsUserPasswords
-{
-    use PasswordValidationRules;
-
-    /**
-     * Validate and reset the user's forgotten password.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function reset(User $user, array $input): void
-    {
-        Validator::make($input, [
-            'password' => $this->passwordRules(),
-        ])->validate();
-
-        $user->forceFill([
-            'password' => Hash::make($input['password']),
-        ])->save();
-    }
-}

app/Actions/Fortify/UpdateUserPassword.php

@@ -1,35 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\User;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\UpdatesUserPasswords;
-
-class UpdateUserPassword implements UpdatesUserPasswords
-{
-    use PasswordValidationRules;
-
-    /**
-     * Validate and update the user's password.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function update(User $user, array $input): void
-    {
-        Validator::make($input, [
-            'current_password' => ['required', 'string', 'current_password:web'],
-            'password' => $this->passwordRules(),
-        ], [
-            'current_password.current_password' => __('The provided password does not match your current password.'),
-        ])->validateWithBag('updatePassword');
-
-        $user->forceFill([
-            'password' => Hash::make($input['password']),
-        ])->save();
-    }
-}

app/Actions/Fortify/UpdateUserProfileInformation.php

@@ -1,61 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\User;
-use Illuminate\Contracts\Auth\MustVerifyEmail;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\Rule;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\UpdatesUserProfileInformation;
-
-class UpdateUserProfileInformation implements UpdatesUserProfileInformation
-{
-    /**
-     * Validate and update the given user's profile information.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function update(User $user, array $input): void
-    {
-        Validator::make($input, [
-            'name' => ['required', 'string', 'max:255'],
-
-            'email' => [
-                'required',
-                'string',
-                'email',
-                'max:255',
-                Rule::unique('users')->ignore($user->id),
-            ],
-        ])->validateWithBag('updateProfileInformation');
-
-        if ($input['email'] !== $user->email &&
-            $user instanceof MustVerifyEmail) {
-            $this->updateVerifiedUser($user, $input);
-        } else {
-            $user->forceFill([
-                'name' => $input['name'],
-                'email' => $input['email'],
-            ])->save();
-        }
-    }
-
-    /**
-     * Update the given verified user's profile information.
-     *
-     * @param  array<string, string>  $input
-     */
-    protected function updateVerifiedUser(User $user, array $input): void
-    {
-        $user->forceFill([
-            'name' => $input['name'],
-            'email' => $input['email'],
-            'email_verified_at' => null,
-        ])->save();
-
-        $user->sendEmailVerificationNotification();
-    }
-}

app/Actions/OpenSubscription.php

@@ -1,96 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Models\SubscriptionRecord;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\DB;
-
-/**
- * Opens the contract a paid order bought.
- *
- * This is the moment the catalogue stops applying. Everything the customer is
- * owed — price, quotas, seats, the hardware behind the plan — is copied onto
- * the subscription here and never read from the catalogue again. Provisioning
- * sizes the machine from this row, so an operator editing a plan afterwards
- * cannot reach a customer who has already paid.
- *
- * `price_cents` is the catalogue's NET price, which is what PlanChange prorates
- * against — deliberately not `Order::amount_cents`, which holds the GROSS total
- * Stripe actually charged. The two can legitimately differ (VAT, and later
- * coupons), and reconciling them is not this action's job: the proof register
- * records what was charged per event, and Stripe's invoice is the authority for
- * the amount. Copying a gross total into this net field would silently corrupt
- * every pro-rata calculation that reads it.
- */
-class OpenSubscription
-{
-    public function __construct(private RecordCommercialEvent $record) {}
-
-    public function __invoke(Order $order, string $term = Subscription::TERM_MONTHLY): Subscription
-    {
-        // A retried webhook must not open a second contract for one purchase.
-        $existing = Subscription::query()->where('order_id', $order->id)->first();
-
-        if ($existing !== null) {
-            return $existing;
-        }
-
-        $start = now();
-
-        // The contract and its entry in the register commit together. If the
-        // record could fail after the subscription is in, the next webhook
-        // retry would find the contract, return early, and leave a paid sale
-        // permanently missing from the evidence.
-        return DB::transaction(fn () => $this->open($order, $term, $start));
-    }
-
-    private function open(Order $order, string $term, Carbon $start): Subscription
-    {
-        $subscription = Subscription::create(array_merge(
-            // The version the order carries, when the checkout recorded one:
-            // what the customer saw beats what happens to be on sale by the
-            // time their payment reaches us.
-            Subscription::snapshotFrom($order->plan, $term, $order->plan_version_id),
-            [
-                'customer_id' => $order->customer_id,
-                'order_id' => $order->id,
-                // Carried from the checkout: from here on, Stripe's events
-                // name this and nothing else.
-                'stripe_subscription_id' => $order->stripe_subscription_id,
-                'started_at' => $start,
-                'current_period_start' => $start,
-                'current_period_end' => $term === Subscription::TERM_YEARLY
-                    ? $start->copy()->addYear()
-                    : $start->copy()->addMonth(),
-                'status' => 'active',
-            ],
-        ));
-
-        // The sale, entered in the register the moment it happens. Written from
-        // the contract that was just frozen, so the evidence and the contract
-        // cannot describe different purchases.
-        ($this->record)(
-            event: SubscriptionRecord::EVENT_PURCHASE,
-            subscription: $subscription,
-            netCents: $subscription->price_cents,
-            at: $start,
-            stripe: ['event' => $order->stripe_event_id],
-            // The order carries what Stripe actually took — gross, including
-            // whatever tax or discount applied on the day. The contract price
-            // is what was agreed; this is what was paid, and the register has
-            // to be able to state both.
-            //
-            // Keyed on the Stripe id, not on the amount being non-zero: a fully
-            // discounted checkout charges zero, and reading that as "no amount
-            // recorded" would file a free sale as though it had been paid for
-            // in full. An order without a Stripe id was never charged through
-            // a checkout at all, and has nothing to report.
-            chargedGrossCents: $order->stripe_event_id !== null ? (int) $order->amount_cents : null,
-        );
-
-        return $subscription;
-    }
-}

app/Actions/RecordCommercialEvent.php

@@ -1,146 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Models\SubscriptionRecord;
-use App\Services\Billing\TaxTreatment;
-use Illuminate\Support\Carbon;
-
-/**
- * Writes one row into the proof register.
- *
- * Every commercial event goes through here so that the flat columns are filled
- * the same way each time — an evidence table where the amount means one thing
- * in one row and another in the next is not evidence.
- *
- * Amounts are stated three ways on purpose. Net is what the catalogue and the
- * contract deal in; gross is what was actually charged; the tax between them
- * depends on the customer and on the day, and recomputing it later from a rate
- * that has since changed would produce a different answer to the one on the
- * invoice.
- */
-class RecordCommercialEvent
-{
-    /**
-     * @param  array<string, mixed>  $extra  merged into the JSON snapshot
-     * @param  array<string, string|null>  $stripe  event / invoice / subscription ids
-     */
-    public function __invoke(
-        string $event,
-        Subscription $subscription,
-        int $netCents,
-        ?Carbon $at = null,
-        array $extra = [],
-        array $stripe = [],
-        ?int $chargedGrossCents = null,
-        ?Order $order = null,
-        ?string $eventKey = null,
-    ): SubscriptionRecord {
-        $at ??= now();
-        $customer = $subscription->customer;
-        $tax = TaxTreatment::for($customer);
-
-        $agreedNet = $netCents;
-        $expectedGross = $tax->grossCents($agreedNet);
-
-        // The flat columns describe the TRANSACTION, not the contract: gross is
-        // what was taken from the customer, and net and tax are that gross
-        // split by the rate that applied on the day.
-        //
-        // Split, not subtracted from the agreed price. A discount lowers the
-        // taxable amount; it does not create negative VAT, and recording
-        // 14900 charged against a 179,00 contract as "minus 30,00 tax" would
-        // make the register wrong in exactly the case someone audits.
-        if ($chargedGrossCents !== null) {
-            $gross = $chargedGrossCents;
-            $net = (int) round($gross / (1 + $tax->rate));
-        } else {
-            $net = $agreedNet;
-            $gross = $expectedGross;
-        }
-
-        $version = $subscription->planVersion;
-
-        return SubscriptionRecord::create([
-            'event' => $event,
-            // What makes this event "the same one" if it arrives again. Unique
-            // where set, so a duplicate delivery collides in the database
-            // rather than in a check that two of them can both pass.
-            'event_key' => $eventKey,
-
-            'customer_id' => $subscription->customer_id,
-            'subscription_id' => $subscription->id,
-            // The order this event belongs to — a booked module has its own,
-            // and pointing it at the original plan purchase would file every
-            // add-on under the wrong transaction.
-            'order_id' => $order?->id ?? $subscription->order_id,
-            'plan_version_id' => $subscription->plan_version_id,
-
-            // Copied rather than joined: these have to still answer the question
-            // after the customer, the plan or the version have gone.
-            'customer_name' => $customer?->name,
-            'plan_key' => $subscription->plan,
-            'plan_version' => $version?->version,
-            'term' => $subscription->term,
-
-            'net_cents' => $net,
-            'tax_cents' => $gross - $net,
-            'gross_cents' => $gross,
-            'currency' => $subscription->currency,
-            'tax_rate' => round($tax->rate * 100, 2),
-            'reverse_charge' => $tax->reverseCharge,
-
-            'stripe_event_id' => $stripe['event'] ?? null,
-            'stripe_invoice_id' => $stripe['invoice'] ?? null,
-            'stripe_subscription_id' => $stripe['subscription'] ?? null,
-
-            'occurred_at' => $at,
-
-            'snapshot_version' => SubscriptionRecord::SNAPSHOT_VERSION,
-            // The long tail: everything nobody has thought to ask about yet.
-            // The flat columns above are what gets queried.
-            'snapshot' => array_merge([
-                'subscription' => $subscription->only(Subscription::FROZEN),
-                'plan' => [
-                    'key' => $subscription->plan,
-                    'version' => $version?->version,
-                    'version_id' => $subscription->plan_version_id,
-                    'family' => $version?->family?->name,
-                    'capabilities' => $version?->capabilities(),
-                ],
-                'period' => [
-                    'start' => $subscription->current_period_start?->toIso8601String(),
-                    'end' => $subscription->current_period_end?->toIso8601String(),
-                ],
-                'addons' => $subscription->addons()->active()->get()
-                    ->map(fn ($addon) => [
-                        'key' => $addon->addon_key,
-                        'price_cents' => $addon->price_cents,
-                        'quantity' => $addon->quantity,
-                        'booked_at' => $addon->booked_at?->toIso8601String(),
-                    ])->all(),
-                'customer' => [
-                    'name' => $customer?->name,
-                    'email' => $customer?->email,
-                    'vat_id' => $customer?->vat_id,
-                ],
-                // Kept even when they agree. A charge that differs from the
-                // catalogue plus tax is exactly the thing someone will ask
-                // about later, and reconciling it silently would erase the
-                // question along with the answer.
-                'amounts' => [
-                    // What was agreed, beside what was actually taken. The
-                    // flat columns state the transaction; this states whether
-                    // it came out at the contract price, which is the question
-                    // someone asks a year later.
-                    'agreed_net_cents' => $agreedNet,
-                    'expected_gross_cents' => $expectedGross,
-                    'charged_gross_cents' => $gross,
-                    'matches_catalogue' => $gross === $expectedGross,
-                ],
-            ], $extra),
-        ]);
-    }
-}

app/Actions/StartCustomerProvisioning.php

@@ -1,230 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Customer;
-use App\Models\Order;
-use App\Models\ProvisioningRun;
-use App\Models\Subscription;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-use Throwable;
-
-/**
- * Turns a paid Stripe event into a customer + order + provisioning run. The
- * order's unique stripe_event_id is the idempotency key: a duplicate webhook
- * never starts a second run.
- */
-class StartCustomerProvisioning
-{
-    public function __construct(
-        private OpenSubscription $openSubscription,
-        private ApplyStripeBillingEvent $billing,
-    ) {}
-
-    /**
-     * @param  array{id:string,email:string,name:?string,stripe_customer_id:?string,plan:string,datacenter:string,amount_cents:int,currency:string}  $event
-     */
-    public function fromStripeEvent(array $event): ?Order
-    {
-        $existing = Order::query()->where('stripe_event_id', $event['id'])->first();
-
-        if ($existing !== null) {
-            $this->resume($existing);
-
-            return null;
-        }
-
-        $customer = $this->resolveCustomer($event);
-        $customer->ensureUser(); // portal login (also enables admin impersonation)
-
-        try {
-            [$order, $run] = DB::transaction(function () use ($event, $customer) {
-                $order = Order::create([
-                    'customer_id' => $customer->id,
-                    'plan' => $event['plan'],
-                    // Set once Stripe checkout carries it (phase 5). Null means
-                    // "whatever is on sale when the webhook lands", which is
-                    // what this did before the column existed.
-                    'plan_version_id' => $event['plan_version_id'] ?? null,
-                    'amount_cents' => $event['amount_cents'],
-                    'currency' => $event['currency'],
-                    'datacenter' => $event['datacenter'],
-                    'stripe_event_id' => $event['id'],
-                    'stripe_subscription_id' => $event['stripe_subscription_id'] ?? null,
-                    'status' => 'paid',
-                ]);
-
-                $run = ProvisioningRun::create([
-                    'subject_type' => Order::class,
-                    'subject_id' => $order->id,
-                    'pipeline' => 'customer',
-                    'status' => ProvisioningRun::STATUS_PENDING,
-                    'current_step' => 0,
-                    // Snapshot resolved branding so retries apply identical inputs
-                    // (unset customer → CluPilot defaults, resolved once here).
-                    'context' => ['branding' => $customer->brandingResolved()],
-                ]);
-
-                return [$order, $run];
-            });
-        } catch (UniqueConstraintViolationException) {
-            // A concurrent delivery won the race. Both requests will answer
-            // Stripe with a 2xx, so this is the last look anyone takes at this
-            // payment — if the winner then dies before opening the contract, no
-            // retry is coming to fix it. So finish its work rather than just
-            // stepping aside. The unique index on subscriptions.order_id keeps
-            // both from opening one.
-            $winner = Order::query()->where('stripe_event_id', $event['id'])->first();
-
-            if ($winner !== null) {
-                $this->resume($winner);
-            }
-
-            return null;
-        }
-
-        $this->openContract($order);
-
-        AdvanceRunJob::dispatch($run->uuid); // after commit
-
-        return $order;
-    }
-
-    /**
-     * Finish what a crash interrupted.
-     *
-     * The order commits before the contract is opened, so that a failure there
-     * can never erase the record of a payment — but that leaves a window in
-     * which a paid order exists with no contract and nothing running. Stripe
-     * retries until it gets a 2xx, so a retry is exactly the chance to close
-     * that window. Simply returning "already processed" would strand a paying
-     * customer permanently, because no later webhook would ever look again.
-     *
-     * Safe to run on every duplicate: opening a contract is idempotent. A run
-     * that was merely never dispatched needs no nudge from here — the scheduler
-     * tick sweeps pending runs. A run that already ran and FAILED for want of
-     * the contract does, because nothing sweeps failed runs.
-     */
-    private function resume(Order $order): void
-    {
-        if ($order->subscription()->exists()) {
-            return;
-        }
-
-        $this->openContract($order);
-
-        if ($order->subscription()->exists()) {
-            $this->reviveRunStrandedWithoutAContract($order);
-        }
-    }
-
-    /**
-     * Restart a run that failed only because the contract was missing.
-     *
-     * Narrow on purpose. `no_subscription` is returned before anything is built
-     * — the run never got past validating the order or reserving resources — so
-     * there is nothing half-made to trip over. A run that failed for any other
-     * reason failed at something a contract does not fix, and restarting it
-     * would just repeat whatever went wrong.
-     */
-    private function reviveRunStrandedWithoutAContract(Order $order): void
-    {
-        $run = $order->runs()->where('pipeline', 'customer')->latest('id')->first();
-
-        if ($run?->status !== ProvisioningRun::STATUS_FAILED
-            || ! str_contains((string) $run->error, 'no_subscription')) {
-            return;
-        }
-
-        // onProvisioningFailed() marked the order failed on the way down.
-        $order->update(['status' => 'paid']);
-
-        $run->update([
-            'status' => ProvisioningRun::STATUS_PENDING,
-            'current_step' => 0,
-            'attempt' => 0,
-            'next_attempt_at' => null,
-            'error' => null,
-        ]);
-
-        AdvanceRunJob::dispatch($run->uuid);
-
-        Log::info('Restarted a run that was stranded without a contract.', [
-            'order_id' => $order->id, 'run' => $run->uuid,
-        ]);
-    }
-
-    /**
-     * Freeze what they bought, while the catalogue still says what they were
-     * shown.
-     *
-     * Deliberately AFTER the order is committed, and deliberately swallowing
-     * its failure. The order is the record that money changed hands: if opening
-     * the contract could roll it back, an unsellable plan, a missing price or
-     * any unforeseen fault would erase the evidence of a payment we have
-     * already taken — and Stripe, seeing no 2xx, would retry a webhook that can
-     * never succeed. A missing contract is recoverable and loud: the run stops
-     * at ValidateOrder with `no_subscription`, in the operator's face.
-     *
-     * Two cases are expected to land here: a plan the catalogue cannot sell,
-     * and a payment in a currency it cannot price — freezing a EUR price onto a
-     * CHF payment would put the contract and the payment in permanent
-     * disagreement.
-     */
-    private function openContract(Order $order): void
-    {
-        try {
-            // A checkout that recorded its version is owed THAT version, even
-            // if the window has closed or the plan has been withdrawn since —
-            // they paid for what they were shown. Only a purchase with no
-            // recorded version has to ask what is on sale now.
-            $deliverable = $order->plan_version_id !== null
-                ? app(PlanCatalogue::class)->isDeliverable($order->plan, $order->plan_version_id)
-                : Subscription::knowsPlan($order->plan);
-
-            $sellable = $deliverable
-                && strtoupper((string) $order->currency) === Subscription::catalogueCurrency();
-
-            if (! $sellable) {
-                Log::warning('No contract opened: the catalogue cannot sell this order.', [
-                    'order_id' => $order->id, 'plan' => $order->plan, 'currency' => $order->currency,
-                ]);
-
-                return;
-            }
-
-            $subscription = ($this->openSubscription)($order);
-
-            // Anything Stripe sent about this contract before it existed —
-            // a renewal, a failure, a cancellation — applied now, in the order
-            // they were raised.
-            $this->billing->replayHeldFor($subscription);
-        } catch (Throwable $e) {
-            Log::error('Failed to open a contract for a paid order.', [
-                'order_id' => $order->id, 'plan' => $order->plan, 'error' => $e->getMessage(),
-            ]);
-        }
-    }
-
-    /**
-     * Find or create the customer, race-safe against the unique email index so a
-     * concurrent first-time purchase can't create two customers for one email.
-     *
-     * @param  array{email:string,name:?string,stripe_customer_id:?string}  $event
-     */
-    private function resolveCustomer(array $event): Customer
-    {
-        try {
-            return Customer::query()->firstOrCreate(
-                ['email' => $event['email']],
-                ['name' => $event['name'] ?? $event['email'], 'stripe_customer_id' => $event['stripe_customer_id'] ?? null],
-            );
-        } catch (UniqueConstraintViolationException) {
-            return Customer::query()->where('email', $event['email'])->firstOrFail();
-        }
-    }
-}

app/Actions/StartHostOnboarding.php

@@ -1,49 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Host;
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use Illuminate\Support\Facades\Crypt;
-use Illuminate\Support\Facades\DB;
-
-/**
- * Registers a fresh host and kicks off its onboarding run. The one-time root
- * password lives encrypted in the run context and is scrubbed after SSH trust
- * is established.
- */
-class StartHostOnboarding
-{
-    /**
-     * @param  array{name: string, datacenter: string, public_ip: string, root_password: string}  $input
-     */
-    public function run(array $input): Host
-    {
-        // Host + run are created atomically; a partial insert would otherwise
-        // leave a permanently pending host with no run.
-        [$host, $run] = DB::transaction(function () use ($input) {
-            $host = Host::create([
-                'name' => $input['name'],
-                'datacenter' => $input['datacenter'],
-                'public_ip' => $input['public_ip'],
-                'status' => 'pending',
-            ]);
-
-            $run = ProvisioningRun::create([
-                'subject_type' => Host::class,
-                'subject_id' => $host->id,
-                'pipeline' => 'host',
-                'status' => ProvisioningRun::STATUS_PENDING,
-                'current_step' => 0,
-                'context' => ['root_password' => Crypt::encryptString($input['root_password'])],
-            ]);
-
-            return [$host, $run];
-        });
-
-        AdvanceRunJob::dispatch($run->uuid); // after commit — the run definitely exists
-
-        return $host;
-    }
-}

app/Console/Commands/CheckPlanCatalogue.php

@@ -1,99 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Models\PlanFamily;
-use App\Models\PlanVersion;
-use App\Models\Subscription;
-use Illuminate\Console\Command;
-
-/**
- * Tells the owner whether the catalogue is in a state that can actually sell.
- *
- * Everything here is computed at read time, which means a broken window or a
- * missing price does not announce itself until a customer hits it. This is the
- * thing to run after editing plans — before finding out from a failed checkout.
- */
-class CheckPlanCatalogue extends Command
-{
-    protected $signature = 'plans:check';
-
-    protected $description = 'Check the plan catalogue for overlaps, gaps and missing prices';
-
-    public function handle(): int
-    {
-        $currency = Subscription::catalogueCurrency();
-        $problems = [];
-        $now = now();
-
-        $families = PlanFamily::query()->with('versions.prices')->orderBy('tier')->get();
-
-        if ($families->isEmpty()) {
-            $this->error('The catalogue is empty. Nothing can be sold.');
-
-            return self::FAILURE;
-        }
-
-        foreach ($families as $family) {
-            $live = $family->versions->filter(fn (PlanVersion $v) => $v->isAvailableAt($now));
-
-            if ($live->count() > 1) {
-                $problems[] = "{$family->key}: {$live->count()} versions on sale at once (".
-                    $live->pluck('version')->implode(', ').') — overlapping windows.';
-            }
-
-            if ($family->sales_enabled && $live->isEmpty()) {
-                $problems[] = "{$family->key}: on sale, but no version is available right now.";
-            }
-
-            foreach ($family->versions as $version) {
-                if (! $version->isPublished()) {
-                    continue;
-                }
-
-                foreach ([Subscription::TERM_MONTHLY, Subscription::TERM_YEARLY] as $term) {
-                    $priced = $version->prices
-                        ->first(fn ($p) => $p->term === $term && $p->currency === $currency);
-
-                    if ($priced === null) {
-                        $problems[] = "{$family->key} v{$version->version}: no {$term} price in {$currency}.";
-                    }
-                }
-            }
-        }
-
-        // A contract that cannot say which version it was sold under has lost
-        // its provenance, which is the one thing the version table is for.
-        $orphaned = Subscription::query()->whereNull('plan_version_id')->count();
-
-        if ($orphaned > 0) {
-            $problems[] = "{$orphaned} subscription(s) have no plan version recorded.";
-        }
-
-        foreach ($families as $family) {
-            $state = $family->sales_enabled ? 'on sale' : 'withdrawn';
-            $version = $family->versions->first(fn (PlanVersion $v) => $v->isAvailableAt($now));
-            $this->line(sprintf(
-                '  %-12s tier %d  %-10s %s',
-                $family->key,
-                $family->tier,
-                $state,
-                $version !== null ? "v{$version->version}" : '—',
-            ));
-        }
-
-        if ($problems === []) {
-            $this->newLine();
-            $this->info('Catalogue is consistent.');
-
-            return self::SUCCESS;
-        }
-
-        $this->newLine();
-        foreach ($problems as $problem) {
-            $this->error('  '.$problem);
-        }
-
-        return self::FAILURE;
-    }
-}

app/Console/Commands/ConsoleAccess.php

@@ -1,103 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Http\Middleware\RestrictConsoleNetwork;
-use App\Support\Settings;
-use Illuminate\Console\Command;
-
-/**
- * The way back in when the console has locked its owner out.
- *
- * The allowlist is managed in the console — which is fine until the address you
- * manage it from changes, and then the page that would fix the problem is the
- * page the problem blocks. Every gate needs a door that does not depend on
- * itself, and on a server that door is a shell.
- */
-class ConsoleAccess extends Command
-{
-    protected $signature = 'clupilot:console-access
-                            {action=show : show|allow|deny|open|close}
-                            {value? : an address or CIDR, for allow and deny}';
-
-    protected $description = 'Show or change who may reach the operator console';
-
-    public function handle(): int
-    {
-        $action = (string) $this->argument('action');
-        $value = trim((string) $this->argument('value'));
-
-        return match ($action) {
-            'show' => $this->show(),
-            'allow' => $this->allow($value),
-            'deny' => $this->deny($value),
-            'open' => $this->setRestricted(false),
-            'close' => $this->setRestricted(true),
-            default => $this->refuse("Unknown action: {$action}"),
-        };
-    }
-
-    private function show(): int
-    {
-        $this->line('  restricted : '.(RestrictConsoleNetwork::isRestricted() ? 'yes' : 'no — anyone reaching the hostname gets in'));
-        $this->line('  always     : '.implode(', ', (array) config('admin_access.trusted_ranges', [])).'  (VPN, not removable)');
-
-        $own = (array) Settings::get('console.allowed_ips', []);
-        $this->line('  additional : '.($own === [] ? '(none)' : implode(', ', $own)));
-
-        return self::SUCCESS;
-    }
-
-    private function allow(string $value): int
-    {
-        if ($value === '') {
-            return $this->refuse('Give an address or range: clupilot:console-access allow 203.0.113.7');
-        }
-
-        // An entry that matches nothing would be stored, reported as success,
-        // and leave whoever is recovering still locked out.
-        if (! RestrictConsoleNetwork::isNetwork($value)) {
-            return $this->refuse("Not an address or a range: {$value}");
-        }
-
-        $list = (array) Settings::get('console.allowed_ips', []);
-
-        if (! in_array($value, $list, true)) {
-            $list[] = $value;
-            Settings::set('console.allowed_ips', array_values($list));
-        }
-
-        $this->info("{$value} may now reach the console.");
-
-        return $this->show();
-    }
-
-    private function deny(string $value): int
-    {
-        Settings::set('console.allowed_ips', array_values(array_filter(
-            (array) Settings::get('console.allowed_ips', []),
-            fn ($entry) => $entry !== $value,
-        )));
-
-        $this->info("{$value} removed.");
-
-        return $this->show();
-    }
-
-    private function setRestricted(bool $on): int
-    {
-        // No lock-out check here on purpose: this command IS the recovery path,
-        // and it is only reachable by someone who already has the server.
-        Settings::set('console.network_restricted', $on);
-        $this->info($on ? 'Console restricted to the VPN and the listed addresses.' : 'Restriction lifted.');
-
-        return $this->show();
-    }
-
-    private function refuse(string $message): int
-    {
-        $this->error($message);
-
-        return self::FAILURE;
-    }
-}

app/Console/Commands/CreateAdmin.php

@@ -1,79 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Models\Customer;
-use App\Models\User;
-use Illuminate\Console\Command;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Validation\Rules\Password;
-use Illuminate\Support\Facades\Validator;
-use Spatie\Permission\PermissionRegistrar;
-
-/**
- * Creates (or promotes) an operator with the Owner role — the account the
- * installer sets up so a fresh server is usable immediately.
- *
- * Promotion is deliberate: running this twice with the same address should fix
- * a lost role, not fail with "email already taken".
- */
-class CreateAdmin extends Command
-{
-    protected $signature = 'clupilot:create-admin
-                            {--email= : Login address}
-                            {--name= : Display name}
-                            {--password= : Leave empty to be prompted}';
-
-    protected $description = 'Create or promote an operator account with the Owner role';
-
-    public function handle(): int
-    {
-        $email = $this->option('email') ?: $this->ask('Email');
-        $name = $this->option('name') ?: $this->ask('Name', 'Administrator');
-        $password = $this->option('password') ?: $this->secret('Password');
-
-        $validator = Validator::make(
-            ['email' => $email, 'name' => $name, 'password' => $password],
-            [
-                'email' => 'required|email|max:255',
-                'name' => 'required|string|max:255',
-                'password' => ['required', Password::min(12)],
-            ],
-        );
-
-        if ($validator->fails()) {
-            foreach ($validator->errors()->all() as $error) {
-                $this->error($error);
-            }
-
-            return self::FAILURE;
-        }
-
-        // An operator address that also belongs to a customer would block that
-        // customer from ever getting a portal login.
-        if (Customer::query()->where('email', $email)->exists()) {
-            $this->error('That address already belongs to a customer.');
-
-            return self::FAILURE;
-        }
-
-        $user = User::query()->firstOrNew(['email' => $email]);
-        $existed = $user->exists;
-
-        $user->fill([
-            'name' => $name,
-            'password' => Hash::make($password),
-            'is_admin' => true,
-            'email_verified_at' => $user->email_verified_at ?? now(),
-        ])->save();
-
-        $user->syncRoles(['Owner']);
-        app(PermissionRegistrar::class)->forgetCachedPermissions();
-
-        $this->info($existed
-            ? "Existing account {$email} promoted to Owner and password reset."
-            : "Owner account {$email} created.");
-
-        return self::SUCCESS;
-    }
-}

app/Console/Commands/SyncStripeCatalogue.php

@@ -1,135 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Models\PlanFamily;
-use App\Models\PlanPrice;
-use App\Models\PlanVersion;
-use App\Services\Stripe\StripeClient;
-use Illuminate\Console\Command;
-
-/**
- * Mirrors our catalogue into Stripe: a Product per plan family, a Price per
- * priced row.
- *
- * Stripe owns the recurring billing — retries, dunning, off-session SCA,
- * invoice numbering — so it needs to know what it is billing for. It does not
- * need to know how big the VM is, and it is not asked.
- *
- * Idempotent by construction: a row that already carries an id is skipped. That
- * matters more here than usual, because a Stripe Price cannot be edited, so a
- * second run that minted duplicates would leave two live prices for one plan
- * and no way to tell which a customer is on.
- *
- * Only PUBLISHED versions are synced. A draft has promised nothing, and a
- * Product for it would be a price list entry for something that may never
- * exist.
- */
-class SyncStripeCatalogue extends Command
-{
-    protected $signature = 'stripe:sync-catalogue {--dry-run : Show what would be created without touching Stripe}';
-
-    protected $description = 'Create the Stripe products and prices for the plan catalogue';
-
-    public function handle(StripeClient $stripe): int
-    {
-        $dryRun = (bool) $this->option('dry-run');
-
-        if (! $dryRun && ! $stripe->isConfigured()) {
-            $this->error('Stripe is not configured (STRIPE_SECRET is empty). Nothing was created.');
-
-            return self::FAILURE;
-        }
-
-        $created = 0;
-
-        foreach (PlanFamily::query()->with('versions.prices')->orderBy('tier')->get() as $family) {
-            $published = $family->versions->filter(fn (PlanVersion $version) => $version->isPublished());
-
-            // A family whose versions are all drafts has promised nothing, so
-            // it has no business appearing in Stripe's price list yet.
-            if ($published->isEmpty()) {
-                continue;
-            }
-
-            $productId = $family->stripe_product_id;
-
-            if ($productId === null) {
-                $this->line("  product  {$family->key} — {$family->name}");
-                $created++;
-
-                if (! $dryRun) {
-                    $productId = $stripe->createProduct(
-                        $family->name,
-                        ['plan_family' => $family->key, 'plan_family_id' => (string) $family->id],
-                        // Keyed on our row, so a crash between Stripe creating
-                        // the product and us storing its id gives back the same
-                        // product on the next run rather than a second one.
-                        idempotencyKey: "clupilot-product-{$family->id}",
-                    );
-                    $family->update(['stripe_product_id' => $productId]);
-                }
-            }
-
-            foreach ($published as $version) {
-                foreach ($version->prices as $price) {
-                    if ($price->stripe_price_id !== null) {
-                        continue;
-                    }
-
-                    $this->line(sprintf(
-                        '  price    %s v%d %s %d %s',
-                        $family->key, $version->version, $price->term, $price->amount_cents, $price->currency,
-                    ));
-                    $created++;
-
-                    if ($dryRun || $productId === null) {
-                        continue;
-                    }
-
-                    $priceId = $stripe->createPrice(
-                        productId: $productId,
-                        amountCents: $price->amount_cents,
-                        currency: $price->currency,
-                        interval: $price->term === 'yearly' ? 'year' : 'month',
-                        metadata: [
-                            'plan_family' => $family->key,
-                            'plan_version' => (string) $version->version,
-                            'plan_version_id' => (string) $version->id,
-                            'plan_price_id' => (string) $price->id,
-                        ],
-                        idempotencyKey: "clupilot-price-{$price->id}",
-                    );
-
-                    // Written straight through the query builder: stripe_price_id
-                    // is not part of what publication froze, and the model would
-                    // otherwise have to be re-read first.
-                    PlanPrice::query()->whereKey($price->id)->update(['stripe_price_id' => $priceId]);
-                }
-            }
-        }
-
-        $this->newLine();
-
-        if ($created === 0) {
-            $this->info('Stripe is already in step with the catalogue.');
-
-            return self::SUCCESS;
-        }
-
-        $this->info($dryRun
-            ? "{$created} object(s) would be created. Run without --dry-run to create them."
-            : "{$created} object(s) created in Stripe.");
-
-        return self::SUCCESS;
-    }
-
-    /** Versions whose prices are live in Stripe, for the status line. */
-    public static function syncedVersions(): int
-    {
-        return PlanVersion::query()
-            ->whereNotNull('published_at')
-            ->whereHas('prices', fn ($q) => $q->whereNotNull('stripe_price_id'))
-            ->count();
-    }
-}

app/Console/TickProvisioning.php

@@ -1,46 +0,0 @@
-<?php
-
-namespace App\Console;
-
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-
-/**
- * Scheduler tick (every minute): dispatch an advance job for every run that is
- * due. Immediate dispatch on advance handles the fast path; this catches
- * waiting/retrying runs and anything a crashed worker left behind.
- *
- * PENDING counts as left behind. A run is created and dispatched in two steps,
- * and a process that dies between them leaves a paid customer with a run that
- * nothing will ever pick up. Re-dispatching one that is merely fresh is free —
- * the runner takes a per-run lock and the second job returns immediately.
- */
-class TickProvisioning
-{
-    /**
-     * How long a run may sit pending before it counts as stranded.
-     *
-     * Long enough that an ordinary queue backlog is not mistaken for a crash:
-     * sweeping a run whose first job is merely still queued would start a
-     * second chain of continuations alongside the first, and both would keep
-     * dispatching for the rest of the pipeline.
-     */
-    private const STRANDED_AFTER_MINUTES = 5;
-
-    public function __invoke(): void
-    {
-        ProvisioningRun::query()
-            ->where(function ($q) {
-                $q
-                    ->whereIn('status', [ProvisioningRun::STATUS_RUNNING, ProvisioningRun::STATUS_WAITING])
-                    ->orWhere(fn ($stranded) => $stranded
-                        ->where('status', ProvisioningRun::STATUS_PENDING)
-                        ->where('created_at', '<=', now()->subMinutes(self::STRANDED_AFTER_MINUTES)));
-            })
-            ->where(function ($q) {
-                $q->whereNull('next_attempt_at')->orWhere('next_attempt_at', '<=', now());
-            })
-            ->get()
-            ->each(fn (ProvisioningRun $run) => AdvanceRunJob::dispatch($run->uuid));
-    }
-}

app/Http/Controllers/Controller.php

@@ -2,9 +2,7 @@
 
 namespace App\Http\Controllers;
 
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-
 abstract class Controller
 {
-    use AuthorizesRequests;
+    //
 }

app/Http/Controllers/ImpersonationController.php

@@ -1,41 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Models\Customer;
-use App\Models\User;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Support\Facades\Auth;
-
-/**
- * Admin impersonation: an admin can log in as a customer's portal account to
- * inspect their portal during an incident, then return to the admin session.
- */
-class ImpersonationController extends Controller
-{
-    /** Admin-gated: become the customer. */
-    public function start(Customer $customer): RedirectResponse
-    {
-        $this->authorize('customers.impersonate');
-        $user = $customer->ensureUser();
-
-        session(['impersonator_id' => Auth::id()]);
-        Auth::login($user);
-
-        return redirect()->route('dashboard');
-    }
-
-    /** Return to the admin session (available while impersonating). */
-    public function leave(): RedirectResponse
-    {
-        $adminId = session()->pull('impersonator_id');
-
-        if ($adminId !== null && ($admin = User::query()->find($adminId)) !== null) {
-            Auth::login($admin);
-
-            return redirect()->route('admin.overview');
-        }
-
-        return redirect()->route('dashboard');
-    }
-}

app/Http/Controllers/StripeWebhookController.php

@@ -1,137 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Actions\ApplyStripeBillingEvent;
-use App\Actions\StartCustomerProvisioning;
-use Illuminate\Http\JsonResponse;
-use Illuminate\Http\Request;
-
-/**
- * Stripe webhook: verifies the signature (when a secret is configured) and turns
- * a paid checkout into a provisioning run. Idempotent via the order's
- * stripe_event_id — Stripe retries a webhook until it gets a 2xx.
- */
-class StripeWebhookController extends Controller
-{
-    public function __invoke(
-        Request $request,
-        StartCustomerProvisioning $action,
-        ApplyStripeBillingEvent $billing,
-    ): JsonResponse {
-        $payload = $request->getContent();
-        $secret = (string) config('services.stripe.webhook_secret');
-
-        if (blank($secret)) {
-            // Fail closed: an unconfigured secret must not authorize provisioning
-            // outside local/testing.
-            abort_unless(app()->environment('local', 'testing'), 400, 'Stripe webhook secret not configured');
-        } elseif (! $this->signatureValid($payload, (string) $request->header('Stripe-Signature'), $secret)) {
-            abort(400, 'invalid signature');
-        }
-
-        $event = json_decode($payload, true) ?: [];
-        $object = $event['data']['object'] ?? [];
-        $type = $event['type'] ?? '';
-
-        // The billing cycle is Stripe's: once a contract exists, they decide
-        // when it renews, when a payment failed, and when it has ended. Handled
-        // before the checkout branch because none of these are checkouts.
-        $applied = $billing->dispatch($event);
-
-        if ($applied !== false) {
-            if ($applied === null) {
-                // Either already applied, or about a contract that does not
-                // exist yet — a checkout takes a moment to become one, and
-                // Stripe does not deliver in order. Holding it costs a row and
-                // saves a cancellation we would otherwise never hear about
-                // again; a replay is a no-op if it was simply a duplicate.
-                $billing->hold($event);
-            }
-
-            // 2xx either way. Stripe retrying would not change the answer, and
-            // anything worth replaying is now held rather than dropped.
-            return response()->json(['handled' => $type, 'applied' => $applied !== null]);
-        }
-
-        // Paid triggers: a synchronous checkout (completed + paid) OR an async
-        // method clearing later (async_payment_succeeded). Ignore everything else,
-        // including the still-unpaid completed event for async methods.
-        $paid = ($type === 'checkout.session.completed' && ($object['payment_status'] ?? null) === 'paid')
-            || $type === 'checkout.session.async_payment_succeeded';
-        if (! $paid) {
-            return response()->json(['ignored' => true]);
-        }
-
-        $meta = $object['metadata'] ?? [];
-
-        // A real email is required — never merge unrelated customers under a
-        // manufactured address or send credentials into the void.
-        $email = $object['customer_details']['email'] ?? $object['customer_email'] ?? ($meta['email'] ?? null);
-        if (blank($email)) {
-            return response()->json(['ignored' => 'no_customer_email']);
-        }
-
-        $action->fromStripeEvent([
-            // Deduplicate on the checkout session id (stable across the completed
-            // and async-succeeded events for one purchase), not the event id.
-            'id' => (string) ($object['id'] ?? $event['id'] ?? ''),
-            'email' => $email,
-            'name' => $object['customer_details']['name'] ?? ($meta['name'] ?? null),
-            'stripe_customer_id' => $object['customer'] ?? null,
-            // The handle every later billing event arrives with. Without it an
-            // invoice.paid cannot be matched to the contract it renews.
-            'stripe_subscription_id' => is_string($object['subscription'] ?? null) ? $object['subscription'] : null,
-            'plan' => $meta['plan'] ?? 'start',
-            // What the customer was actually shown. Absent on a session created
-            // before phase 5 put it there, and then the version on sale applies.
-            'plan_version_id' => isset($meta['plan_version_id']) ? (int) $meta['plan_version_id'] : null,
-            'datacenter' => $meta['datacenter'] ?? 'fsn',
-            'amount_cents' => (int) ($object['amount_total'] ?? $object['amount'] ?? 0),
-            'currency' => strtoupper($object['currency'] ?? 'eur'),
-        ]);
-
-        return response()->json(['ok' => true]);
-    }
-
-    /** Stripe's default replay tolerance, in seconds. */
-    private const SIGNATURE_TOLERANCE = 300;
-
-    /** Verify Stripe's `t=…,v1=…` signature: HMAC-SHA256 of "{t}.{payload}". */
-    private function signatureValid(string $payload, string $header, string $secret): bool
-    {
-        if (blank($header)) {
-            return false;
-        }
-
-        $timestamp = null;
-        $signatures = [];
-        foreach (explode(',', $header) as $segment) {
-            [$key, $value] = array_pad(explode('=', $segment, 2), 2, '');
-            if ($key === 't') {
-                $timestamp = $value;
-            } elseif ($key === 'v1') {
-                $signatures[] = $value; // keep every v1 (secret rotation sends several)
-            }
-        }
-
-        if ($timestamp === null || $signatures === []) {
-            return false;
-        }
-
-        // Reject replays outside the tolerance window.
-        if (abs(time() - (int) $timestamp) > self::SIGNATURE_TOLERANCE) {
-            return false;
-        }
-
-        $expected = hash_hmac('sha256', $timestamp.'.'.$payload, $secret);
-
-        foreach ($signatures as $signature) {
-            if (hash_equals($expected, $signature)) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-}

app/Http/Middleware/EnsureAdmin.php

@@ -1,23 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-class EnsureAdmin
-{
-    /**
-     * Only operators with the console.view capability may reach the admin console.
-     * Legacy is_admin accounts are migrated to roles by the seed_roles_and_permissions
-     * migration and the seeder — the gate never trusts the bare is_admin flag, so
-     * an RBAC revocation is never silently undone here.
-     */
-    public function handle(Request $request, Closure $next): Response
-    {
-        abort_unless((bool) $request->user()?->can('console.view'), 403);
-
-        return $next($request);
-    }
-}

app/Http/Middleware/EnsureCustomerActive.php

@@ -1,39 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Models\Customer;
-use Closure;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Enforce customer account lifecycle on portal requests: a suspended or closed
- * customer must lose access. Admins are exempt, and an active impersonation
- * session is exempt so operators can still inspect a suspended customer's portal.
- */
-class EnsureCustomerActive
-{
-    public function handle(Request $request, Closure $next): Response
-    {
-        $user = $request->user();
-
-        if ($user !== null && ! $user->isOperator() && ! $request->session()->has('impersonator_id')) {
-            $customer = Customer::query()->where('user_id', $user->id)->first()
-                ?? Customer::query()->where('email', $user->email)->first();
-
-            if ($customer !== null && ($customer->status === 'suspended' || $customer->status === 'closed' || $customer->closed_at !== null)) {
-                Auth::logout();
-                $request->session()->invalidate();
-                $request->session()->regenerateToken();
-
-                $key = $customer->closed_at !== null || $customer->status === 'closed' ? 'auth.account_closed' : 'auth.account_suspended';
-
-                return redirect()->route('login')->withErrors(['email' => __($key)]);
-            }
-        }
-
-        return $next($request);
-    }
-}

app/Http/Middleware/PublicSiteGate.php

@@ -1,68 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Support\Settings;
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\IpUtils;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Hides the marketing site and the customer portal while the product is still
- * being built, without hiding it from us.
- *
- * Switched from the console (site.public). Anyone coming through the management
- * VPN, and any signed-in operator, sees the real thing; everyone else — crawlers
- * included — gets a placeholder.
- *
- * Answers 503 with Retry-After and X-Robots-Tag rather than 200: a 200 would
- * invite search engines to index the placeholder as the site's content, and
- * getting that out of an index again is much harder than keeping it out.
- */
-class PublicSiteGate
-{
-    /**
-     * Paths that must keep working regardless: the console itself (otherwise the
-     * switch could not be flipped back), Stripe's webhook, and the health check.
-     *
-     * Livewire is deliberately NOT in this list. Its endpoint is shared by the
-     * console and the portal, so exempting it would leave a signed-in customer
-     * able to drive portal components — including billing — while the portal is
-     * supposed to be offline. Operators pass the check below anyway, which is
-     * what the console actually needs.
-     *
-     * Nor is /login, and that has a consequence worth knowing before you hide
-     * the site: /admin sends a guest to /login, which is not the console, so
-     * SIGNING IN while hidden needs the request to come from a trusted range —
-     * the management VPN, or an address put in TRUSTED_RANGES for the initial
-     * setup. Exempting the login flow by hostname instead would mean trusting a
-     * Host header, which the caller chooses, and one forged header would unhide
-     * the entire portal.
-     */
-    private const ALWAYS_ALLOWED = ['admin', 'admin/*', 'webhooks/*', 'up', 'robots.txt'];
-
-    public function handle(Request $request, Closure $next): Response
-    {
-        if ($request->is(...self::ALWAYS_ALLOWED) || Settings::bool('site.public', true)) {
-            return $next($request);
-        }
-
-        if ($this->fromManagementNetwork($request) || $request->user()?->isOperator()) {
-            return $next($request);
-        }
-
-        return response()->view('coming-soon', [], 503)->withHeaders([
-            'Retry-After' => 3600,
-            'X-Robots-Tag' => 'noindex, nofollow, noarchive',
-            'Cache-Control' => 'no-store',
-        ]);
-    }
-
-    private function fromManagementNetwork(Request $request): bool
-    {
-        $ranges = (array) config('admin_access.trusted_ranges', []);
-
-        return $ranges !== [] && IpUtils::checkIp((string) $request->ip(), $ranges);
-    }
-}

app/Http/Middleware/RestrictAdminHost.php

@@ -1,48 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Serves the operator console only on the hostnames listed in ADMIN_HOSTS.
- *
- * Responds 404 (not 403) on any other host: a public domain must not even
- * disclose that an admin console exists here. Empty list = no restriction, so
- * this can be rolled out without locking anyone out.
- *
- * Host-based rather than IP-based on purpose: behind a reverse proxy without
- * TrustProxies, request->ip() is the proxy's address, so an IP allowlist would
- * be misleading. The real network-level control stays in the proxy.
- */
-class RestrictAdminHost
-{
-    public function handle(Request $request, Closure $next): Response
-    {
-        // Path-scoped and prepended to the `web` group rather than attached to
-        // the admin route group: route middleware is reordered by Laravel's
-        // priority list, which puts `auth` first — a guest would then be
-        // redirected to /login and thereby learn the console exists. Running
-        // ahead of the whole route stack makes the 404 deterministic.
-        if (! $request->is('admin', 'admin/*')) {
-            return $next($request);
-        }
-
-        // Lowercased here as well as in the config: DNS names are
-        // case-insensitive and getHost() always returns lowercase, so a
-        // capitalised ADMIN_HOSTS entry must not lock operators out — whatever
-        // route the value took into the config (env, cached config, runtime set).
-        $allowed = array_map(
-            fn ($host) => strtolower((string) $host),
-            (array) config('admin_access.hosts', []),
-        );
-
-        if ($allowed !== [] && ! in_array($request->getHost(), $allowed, true)) {
-            abort(404);
-        }
-
-        return $next($request);
-    }
-}

app/Http/Middleware/RestrictConsoleNetwork.php

@@ -1,133 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Support\Settings;
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\IpUtils;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Who may reach the operator console, by network address.
- *
- * RestrictAdminHost answers "under which NAME does the console respond" — and a
- * Host header is chosen by the caller, so it can never answer "who is asking".
- * This one can: the client address behind a trusted proxy is not something the
- * client gets to pick.
- *
- * The management VPN always counts. Beyond that the owner keeps a list — an
- * office line, a home connection — so being away from the VPN does not mean
- * being locked out. That list lives in the console rather than in a proxy
- * config file, because the person who needs to change it is the person sitting
- * in the console.
- *
- * 404, never 403: a stranger must not learn that a console lives here.
- *
- * This is not a substitute for a firewall. It runs after PHP has started, so it
- * bounds who can USE the console, not who can make the server work. Where a
- * network-level ACL is also possible, both belong there.
- */
-class RestrictConsoleNetwork
-{
-    public function handle(Request $request, Closure $next): Response
-    {
-        // Path-scoped and prepended to the `web` group for the same reason
-        // RestrictAdminHost is: route middleware gets reordered behind `auth`,
-        // and a guest would then be redirected to /login and thereby learn the
-        // console exists.
-        if (! $request->is('admin', 'admin/*')) {
-            return $next($request);
-        }
-
-        if (! self::isRestricted()) {
-            return $next($request);
-        }
-
-        if (! self::allows((string) $request->ip())) {
-            abort(404);
-        }
-
-        return $next($request);
-    }
-
-    /** Whether the owner has switched the restriction on at all. */
-    public static function isRestricted(): bool
-    {
-        return Settings::bool('console.network_restricted', false);
-    }
-
-    /**
-     * Every network that may reach the console.
-     *
-     * The VPN is always in it and is not removable — it is the one path that
-     * exists independently of whatever the owner has typed into the list, and
-     * without it a bad entry would leave nobody able to fix the entry.
-     *
-     * @return array<int, string>
-     */
-    public static function allowedRanges(): array
-    {
-        $vpn = (array) config('admin_access.trusted_ranges', []);
-        $own = (array) Settings::get('console.allowed_ips', []);
-
-        return array_values(array_unique(array_filter(array_merge(
-            $vpn,
-            array_map('trim', array_map('strval', $own)),
-        ))));
-    }
-
-    public static function allows(string $ip): bool
-    {
-        return self::covers($ip, self::allowedRanges());
-    }
-
-    /**
-     * Would this address still get in, given that list?
-     *
-     * Split out so the "you are about to lock yourself out" decision can be
-     * made — and tested — without a request: it is the one check whose failure
-     * mode is that nobody can reach the page that would fix it.
-     *
-     * @param  array<int, string>  $extra  the owner's list AFTER the change
-     */
-    public static function wouldStillAllow(string $ip, array $extra): bool
-    {
-        $vpn = (array) config('admin_access.trusted_ranges', []);
-
-        return self::covers($ip, array_merge($vpn, $extra));
-    }
-
-    /**
-     * Whether a value is an address or a CIDR range at all.
-     *
-     * Shared by the console and the recovery command on purpose: an entry that
-     * matches nothing is stored happily and reports success, and the operator
-     * then switches the restriction on believing they are covered. That is the
-     * exact situation the recovery command exists to get out of.
-     */
-    public static function isNetwork(string $value): bool
-    {
-        [$address, $prefix] = array_pad(explode('/', $value, 2), 2, null);
-
-        if (filter_var($address, FILTER_VALIDATE_IP) === false) {
-            return false;
-        }
-
-        if ($prefix === null) {
-            return true;
-        }
-
-        $max = str_contains((string) $address, ':') ? 128 : 32;
-
-        return ctype_digit((string) $prefix) && (int) $prefix >= 0 && (int) $prefix <= $max;
-    }
-
-    /** @param array<int, string> $ranges */
-    private static function covers(string $ip, array $ranges): bool
-    {
-        $ranges = array_values(array_filter($ranges));
-
-        return $ranges !== [] && $ip !== '' && IpUtils::checkIp($ip, $ranges);
-    }
-}

app/Livewire/Admin/ConfirmDeleteDatacenter.php

@@ -1,60 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use App\Models\Host;
-use Illuminate\Database\QueryException;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for deleting a datacenter (R5). Guarded: a datacenter that still
- * has hosts cannot be deleted — it would orphan host placement — so the modal
- * blocks and explains instead. Otherwise it is safe to hard-delete an unused code.
- */
-class ConfirmDeleteDatacenter extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public int $hostCount = 0;
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
-        $dc = Datacenter::query()->where('uuid', $uuid)->withCount('hosts')->firstOrFail();
-        $this->uuid = $uuid;
-        $this->name = $dc->name;
-        $this->hostCount = $dc->hosts_count;
-    }
-
-    public function delete()
-    {
-        $this->authorize('datacenters.manage');
-        $dc = Datacenter::query()->where('uuid', $this->uuid)->first();
-        if ($dc === null) {
-            return $this->redirectRoute('admin.datacenters', navigate: true);
-        }
-
-        // The hosts.datacenter → datacenters.code foreign key (restrictOnDelete)
-        // is the source of truth: the DB refuses to orphan a host. We pre-check
-        // for a friendly message and catch the constraint as the race backstop.
-        if (Host::query()->where('datacenter', $dc->code)->exists()) {
-            return $this->redirectRoute('admin.datacenters', navigate: true);
-        }
-
-        try {
-            $dc->delete();
-        } catch (QueryException) {
-            // A host was created for this code concurrently — leave it intact.
-        }
-
-        return $this->redirectRoute('admin.datacenters', navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-delete-datacenter');
-    }
-}

app/Livewire/Admin/ConfirmDeletePlanDraft.php

@@ -1,60 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\PlanVersion;
-use App\Services\Billing\PlanCatalogue;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for discarding an unpublished plan version.
- *
- * Only a draft can be discarded at all — a published version is what customers
- * are contracted to, and the model refuses to delete one. So this is a small
- * destructive action, and the modal says which one it is rather than leaving
- * "delete" next to a row that might be either.
- */
-class ConfirmDeletePlanDraft extends ModalComponent
-{
-    public string $uuid;
-
-    public int $version;
-
-    public string $plan = '';
-
-    public function mount(string $uuid): void
-    {
-        // Modals are reachable without the page's guards, so this is the real
-        // check, not a convenience one.
-        $this->authorize('plans.manage');
-
-        $version = PlanVersion::query()->with('family')->where('uuid', $uuid)->firstOrFail();
-        abort_if($version->isPublished(), 403);
-
-        $this->uuid = $uuid;
-        $this->version = $version->version;
-        $this->plan = $version->family->name;
-    }
-
-    public function delete(): void
-    {
-        $this->authorize('plans.manage');
-
-        $version = PlanVersion::query()->where('uuid', $this->uuid)->first();
-
-        // The catalogue decides, in one conditional statement. Checking here and
-        // deleting afterwards would leave a window in which the version is
-        // published between the two — and a published version must never go.
-        if ($version !== null && ! app(PlanCatalogue::class)->discardDraft($version)) {
-            $this->dispatch('notify', message: __('plans.discard_too_late'));
-        }
-
-        $this->dispatch('plan-draft-deleted');
-        $this->closeModal();
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-delete-plan-draft');
-    }
-}

app/Livewire/Admin/ConfirmDeleteVpnPeer.php

@@ -1,58 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\VpnPeer;
-use App\Provisioning\Jobs\ApplyVpnPeer;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for revoking a VPN access for good (R5). Deleting a peer that
- * belongs to a host cuts CluPilot's own management path to that machine, so the
- * modal says so plainly rather than hiding the option.
- */
-class ConfirmDeleteVpnPeer extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public ?string $hostName = null;
-
-    public function mount(string $uuid): void
-    {
-        // Modals are reachable without the route middleware, so this is the
-        // real guard, not a convenience check.
-        $peer = VpnPeer::query()->with('host')->where('uuid', $uuid)->firstOrFail();
-        $this->authorize('delete', $peer);
-        $this->uuid = $uuid;
-        $this->name = $peer->name;
-        $this->hostName = $peer->host?->name;
-    }
-
-    public function delete(): void
-    {
-        $peer = VpnPeer::query()->where('uuid', $this->uuid)->first();
-        if ($peer !== null) {
-            $this->authorize('delete', $peer);
-
-            // A tombstone that still carries a usable private key is a liability.
-            $peer->purgeSecret();
-            // Soft-delete, so the row survives as a tombstone until the hub has
-            // actually dropped the peer. A hard delete here would let the next
-            // sync adopt the still-present peer back as a live access —
-            // silently restoring what was just revoked. ApplyVpnPeer purges the
-            // tombstone once removal succeeded; SyncVpnPeers retries if not.
-            $peer->delete();
-            ApplyVpnPeer::dispatch($peer->public_key, null, false);
-        }
-
-        $this->dispatch('vpn-peer-deleted');
-        $this->closeModal();
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-delete-vpn-peer');
-    }
-}

app/Livewire/Admin/ConfirmRemoveHost.php

@@ -1,46 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Host;
-use App\Provisioning\Jobs\PurgeHost;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for the destructive "remove host" action (R5). Deregisters the
- * CluPilot record only — it does not touch the physical server. The host is
- * deactivated immediately and purged asynchronously so removal never blocks on
- * (or races) an in-flight provisioning step.
- */
-class ConfirmRemoveHost extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public function mount(string $uuid): void
-    {
-        $this->uuid = $uuid;
-        $this->name = Host::query()->where('uuid', $uuid)->value('name') ?? '';
-    }
-
-    public function remove()
-    {
-        $this->authorize('hosts.manage');
-        $host = Host::query()->where('uuid', $this->uuid)->first();
-
-        if ($host !== null) {
-            // Deactivate now (out of placement, visibly removed), finalize on the
-            // provisioning worker which waits for the runner lock.
-            $host->update(['status' => 'disabled']);
-            PurgeHost::dispatch($host->uuid);
-        }
-
-        return $this->redirectRoute('admin.hosts', navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-remove-host');
-    }
-}

app/Livewire/Admin/Customers.php

@@ -1,112 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Customer;
-use App\Models\PlanFamily;
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Customers extends Component
-{
-    /** Suspend / reactivate a customer account (a guarded lifecycle action, not delete). */
-    public function toggleSuspend(string $uuid): void
-    {
-        $this->authorize('customers.manage');
-        $customer = Customer::query()->where('uuid', $uuid)->first();
-        if ($customer === null) {
-            return;
-        }
-
-        // A closed account is terminal — the suspend/reactivate toggle must not
-        // resurrect it to active while closed_at is still set.
-        if ($customer->closed_at !== null || $customer->status === 'closed') {
-            return;
-        }
-
-        $customer->update([
-            'status' => $customer->status === 'suspended' ? 'active' : 'suspended',
-        ]);
-
-        $this->dispatch('notify', message: __('admin.customer_'.($customer->status === 'suspended' ? 'suspended' : 'reactivated')));
-    }
-
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $plans = app(PlanCatalogue::class)->sellable();
-
-        $customers = Customer::query()
-            ->with(['instances.subscription'])
-            ->orderBy('name')
-            ->get();
-
-        $rows = $customers->map(function (Customer $c) use ($plans, $locale) {
-            $instance = $c->instances->sortByDesc('id')->first();
-            $planKey = $instance->plan ?? null;
-            // What this customer actually pays, off their contract — not what
-            // the plan costs today. Otherwise a price rise inflates reported
-            // revenue for every grandfathered customer overnight.
-            //
-            // Per MONTH, whatever the term: a yearly contract stores the whole
-            // year, and adding that to a monthly column would report twelve
-            // times the revenue for anyone who paid up front.
-            $contract = $instance?->subscription;
-            $priceCents = (int) ($contract?->monthlyPriceCents()
-                ?? ($planKey !== null ? ($plans[$planKey]['price_cents'] ?? 0) : 0));
-
-            return [
-                'uuid' => $c->uuid,
-                'name' => $c->name,
-                'plan' => $planKey !== null ? __('billing.plan.'.$planKey) : '—',
-                'mrr' => Number::currency($priceCents / 100, in: 'EUR', locale: $locale),
-                'instance' => $instance->subdomain ?? '—',
-                // Only an instance that exists can hand out an admin login.
-                'instance_uuid' => ($instance?->status === 'active') ? $instance->uuid : null,
-                'closed' => $c->closed_at !== null || $c->status === 'closed',
-                'suspended' => $c->status === 'suspended',
-                'status' => match (true) {
-                    $c->closed_at !== null || $c->status === 'closed' => 'closed',
-                    $c->status === 'suspended' => 'suspended',
-                    default => $instance->status ?? $c->status ?? 'provisioning',
-                },
-            ];
-        })->all();
-
-        // Plan distribution for the doughnut — derived from live instances, and
-        // keyed by what customers are actually ON, not by what is on sale. A
-        // withdrawn plan still has customers, and dropping them from the chart
-        // would quietly understate the estate.
-        $labels = [];
-        $counts = [];
-        foreach (PlanFamily::query()->orderBy('tier')->pluck('key') as $planKey) {
-            $n = $customers->filter(fn (Customer $c) => $c->instances->contains('plan', $planKey))->count();
-            if ($n > 0) {
-                $labels[] = __('billing.plan.'.$planKey);
-                $counts[] = $n;
-            }
-        }
-
-        return view('livewire.admin.customers', [
-            'rows' => $rows,
-            'plansChart' => [
-                'type' => 'doughnut',
-                'data' => [
-                    'labels' => $labels,
-                    'datasets' => [[
-                        'data' => $counts,
-                        'backgroundColor' => ['token:info', 'token:accent', 'token:success-bright', 'token:warning'],
-                        'borderWidth' => 0,
-                    ]],
-                ],
-                'options' => [
-                    'cutout' => '62%',
-                    'plugins' => ['legend' => ['position' => 'bottom', 'labels' => ['boxWidth' => 10, 'padding' => 12]]],
-                ],
-            ],
-        ]);
-    }
-}

app/Livewire/Admin/Datacenters.php

@@ -1,67 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Datacenters extends Component
-{
-    #[Validate(['required', 'string', 'max:8', 'regex:/^[a-z0-9]([a-z0-9-]{0,6}[a-z0-9])?$/', 'unique:datacenters,code'])]
-    public string $code = '';
-
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    // Country picked from config/countries.php (no manual code typos).
-    #[Validate('nullable|string|max:2')]
-    public string $location = '';
-
-    public function save(): void
-    {
-        $this->authorize('datacenters.manage');
-        // Normalize before validating so the unique check matches how the row is
-        // stored — otherwise `FSN` passes the rule but the lowercased insert collides.
-        $this->code = strtolower(trim($this->code));
-
-        // Country must be one of the curated list — a forged request can bypass
-        // the <select>, so enforce membership server-side (mirrors EditDatacenter).
-        $data = $this->validate([
-            // A datacenter code becomes a DNS label (fsn-01.node.clupilot.com),
-            // so it has to be one: lowercase, no underscores, no leading or
-            // trailing dash.
-            'code' => ['required', 'string', 'max:8', 'regex:/^[a-z0-9]([a-z0-9-]{0,6}[a-z0-9])?$/', 'unique:datacenters,code'],
-            'name' => 'required|string|max:255',
-            'location' => ['nullable', Rule::in(array_keys((array) config('countries')))],
-        ]);
-
-        Datacenter::create([
-            'code' => $data['code'],
-            'name' => $data['name'],
-            'location' => $data['location'] ?: null,
-            'active' => true,
-        ]);
-
-        $this->reset('code', 'name', 'location');
-        $this->dispatch('notify', message: __('datacenters.created'));
-    }
-
-    public function toggle(string $uuid): void
-    {
-        $this->authorize('datacenters.manage');
-        $datacenter = Datacenter::query()->where('uuid', $uuid)->first();
-        $datacenter?->update(['active' => ! $datacenter->active]);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.datacenters', [
-            'datacenters' => Datacenter::query()->withCount('hosts')->orderBy('name')->get(),
-            'countries' => config('countries'),
-        ]);
-    }
-}

app/Livewire/Admin/EditDatacenter.php

@@ -1,74 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Validate;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Edit a datacenter's name and location in a modal (avoids the row-height jump
- * of inline editing). The code is immutable — it is referenced by hosts. Country
- * is picked from a list so it can't be mistyped.
- */
-class EditDatacenter extends ModalComponent
-{
-    public string $uuid = '';
-
-    public string $code = '';
-
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    public string $location = '';
-
-    /** The location present when the modal opened — a pre-curation free-form value. */
-    public string $originalLocation = '';
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
-        $dc = Datacenter::query()->where('uuid', $uuid)->firstOrFail();
-        $this->uuid = $uuid;
-        $this->code = $dc->code;
-        $this->name = $dc->name;
-        $this->location = (string) $dc->location;
-        $this->originalLocation = (string) $dc->location;
-    }
-
-    public function save()
-    {
-        $this->authorize('datacenters.manage');
-
-        // Accept the configured countries plus the record's own legacy value, so a
-        // datacenter created before the curated list can still be edited. The
-        // legacy value is read from the DB — never from the client-hydrated
-        // property, which could be forged to whitelist an arbitrary location.
-        $dc = Datacenter::query()->where('uuid', $this->uuid)->firstOrFail();
-        $allowed = array_keys((array) config('countries'));
-        if ($dc->location) {
-            $allowed[] = $dc->location;
-        }
-        $data = $this->validate([
-            'name' => 'required|string|max:255',
-            'location' => ['nullable', Rule::in($allowed)], // array form — a legacy value may contain commas
-        ]);
-
-        Datacenter::query()->where('uuid', $this->uuid)->update([
-            'name' => $data['name'],
-            'location' => $data['location'] ?: null,
-        ]);
-
-        $this->dispatch('notify', message: __('datacenters.updated'));
-
-        return $this->redirectRoute('admin.datacenters', navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.edit-datacenter', [
-            'countries' => config('countries'),
-        ]);
-    }
-}

app/Livewire/Admin/HostCreate.php

@@ -1,46 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Actions\StartHostOnboarding;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class HostCreate extends Component
-{
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    #[Validate('required|string|exists:datacenters,code,active,1')]
-    public string $datacenter = '';
-
-    public function mount(): void
-    {
-        $this->datacenter = (string) \App\Models\Datacenter::query()->active()->orderBy('name')->value('code');
-    }
-
-    #[Validate('required|ip|unique:hosts,public_ip')]
-    public string $public_ip = '';
-
-    #[Validate('required|string|min:8')]
-    public string $root_password = '';
-
-    public function save(StartHostOnboarding $action)
-    {
-        $this->authorize('hosts.manage');
-        $data = $this->validate();
-
-        $host = $action->run($data);
-
-        return $this->redirectRoute('admin.hosts.show', ['host' => $host->uuid], navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.host-create', [
-            'datacenters' => \App\Models\Datacenter::query()->active()->orderBy('name')->get(),
-        ]);
-    }
-}

app/Livewire/Admin/HostDetail.php

@@ -1,117 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Host;
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use Illuminate\Support\Collection;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class HostDetail extends Component
-{
-    public Host $host;
-
-    public function mount(Host $host): void
-    {
-        $this->host = $host;
-    }
-
-    /** Live refresh whenever any run advances (admins-only channel). */
-    #[On('echo-private:admin.runs,StepAdvanced')]
-    public function onStepAdvanced(): void
-    {
-        $this->host->refresh();
-    }
-
-    /** Adjust the capacity reserve (% of storage kept free for headroom). */
-    public function saveReserve(int $reserve): void
-    {
-        $this->authorize('hosts.manage');
-        $reserve = max(0, min(90, $reserve));
-        $this->host->update(['reserve_pct' => $reserve]);
-        $this->dispatch('notify', message: __('hosts.detail.reserve_saved'));
-    }
-
-    /**
-     * Drain / return a host: toggle between active and disabled. Disabled takes
-     * it out of placement (maintenance) without purging it — distinct from the
-     * destructive "remove host". Never touches a host mid-onboarding.
-     */
-    public function toggleMaintenance(): void
-    {
-        $this->authorize('hosts.manage');
-        if ($this->host->status === 'active') {
-            $this->host->update(['status' => 'disabled']);
-        } elseif ($this->host->status === 'disabled') {
-            $this->host->update(['status' => 'active']);
-        }
-    }
-
-    public function retry(): void
-    {
-        $this->authorize('hosts.manage');
-        $run = $this->currentRun();
-
-        if ($run !== null && $run->status === ProvisioningRun::STATUS_FAILED) {
-            $run->update([
-                'status' => ProvisioningRun::STATUS_RUNNING,
-                'attempt' => 0,
-                'next_attempt_at' => now(),
-                'started_at' => now(), // reset the step timer so it doesn't re-time-out instantly
-                'error' => null,
-            ]);
-            $this->host->update(['status' => 'onboarding']);
-            AdvanceRunJob::dispatch($run->uuid);
-        }
-    }
-
-    private function currentRun(): ?ProvisioningRun
-    {
-        return $this->host->runs()->latest('id')->first();
-    }
-
-    /** @return array<int, array{label: string, state: string}> */
-    private function buildSteps(?ProvisioningRun $run): array
-    {
-        $pipeline = config('provisioning.pipelines.host', []);
-        $current = $run?->current_step ?? 0;
-        $status = $run?->status;
-
-        $steps = [];
-        foreach ($pipeline as $index => $class) {
-            if ($status === ProvisioningRun::STATUS_COMPLETED || $index < $current) {
-                $state = 'done';
-            } elseif ($index === $current) {
-                $state = $status === ProvisioningRun::STATUS_FAILED ? 'failed' : 'running';
-            } else {
-                $state = 'pending';
-            }
-
-            $steps[] = ['label' => __(app($class)->label()), 'state' => $state];
-        }
-
-        return $steps;
-    }
-
-    public function render()
-    {
-        $run = $this->currentRun();
-
-        /** @var Collection $events */
-        $events = $run
-            ? $run->events()->latest('id')->limit(30)->get()
-            : collect();
-
-        return view('livewire.admin.host-detail', [
-            'run' => $run,
-            'steps' => $this->buildSteps($run),
-            'events' => $events,
-            'instances' => $this->host->instances()->latest('id')->get(),
-            'health' => $this->host->healthState(),
-        ]);
-    }
-}

app/Livewire/Admin/Hosts.php

@@ -1,53 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use App\Models\Host;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Url;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Hosts extends Component
-{
-    #[Url(as: 'q')]
-    public string $search = '';
-
-    #[Url]
-    public string $datacenter = '';
-
-    #[Url]
-    public string $status = '';
-
-    public function updated(): void
-    {
-        // no-op; keeps the query string in sync as filters change
-    }
-
-    public function clearFilters(): void
-    {
-        $this->reset('search', 'datacenter', 'status');
-    }
-
-    public function render()
-    {
-        $hosts = Host::query()
-            ->withCount('instances')
-            ->when($this->search !== '', function ($q) {
-                $term = '%'.$this->search.'%';
-                $q->where(fn ($w) => $w->where('name', 'like', $term)->orWhere('public_ip', 'like', $term));
-            })
-            ->when($this->datacenter !== '', fn ($q) => $q->where('datacenter', $this->datacenter))
-            ->when($this->status !== '', fn ($q) => $q->where('status', $this->status))
-            ->orderBy('datacenter')->orderBy('name')
-            ->get();
-
-        return view('livewire.admin.hosts', [
-            'hosts' => $hosts,
-            'datacenters' => Datacenter::query()->orderBy('name')->get(),
-            'statuses' => ['pending', 'onboarding', 'active', 'error', 'disabled'],
-            'total' => Host::query()->count(),
-        ]);
-    }
-}

app/Livewire/Admin/InstanceAdminAccess.php

@@ -1,107 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Instance;
-use App\Provisioning\Jobs\IssueInstanceAdminAccess;
-use App\Services\Wireguard\ConfigHandoff;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\RateLimiter;
-use Illuminate\Support\Str;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Administrator access to a customer's Nextcloud.
- *
- * Not impersonation: that borrows a portal session. This resets our managed
- * admin account inside the customer's installation and hands the credentials
- * over once — the only thing stock Nextcloud offers, and honest about what it
- * does rather than pretending to be a passwordless jump.
- *
- * The operator's own password is required, every time. Taking control of a
- * customer's installation is not something an unattended browser should be able
- * to do on its own.
- */
-class InstanceAdminAccess extends ModalComponent
-{
-    public string $uuid;
-
-    public string $subdomain = '';
-
-    public string $password = '';
-
-    /** Opaque handle; the credentials never enter the component snapshot. */
-    public ?string $token = null;
-
-    public bool $waiting = false;
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('instances.adminlogin');
-
-        $instance = Instance::query()->where('uuid', $uuid)->firstOrFail();
-        $this->uuid = $uuid;
-        $this->subdomain = $instance->subdomain;
-    }
-
-    public function hydrate(): void
-    {
-        $this->authorize('instances.adminlogin');
-    }
-
-    public function request(): void
-    {
-        $this->authorize('instances.adminlogin');
-        $this->resetErrorBag('password');
-
-        $key = 'instance-admin:'.auth()->id();
-        if (RateLimiter::tooManyAttempts($key, 5)) {
-            $this->addError('password', __('instances.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]));
-
-            return;
-        }
-
-        if (! Hash::check($this->password, auth()->user()->password)) {
-            RateLimiter::hit($key, 300);
-            $this->addError('password', __('instances.wrong_password'));
-
-            return;
-        }
-
-        RateLimiter::clear($key);
-        $this->reset('password');
-
-        // The reset runs on the provisioning worker — it owns the tunnel. The
-        // token is where it will leave the result.
-        $this->token = Str::random(40);
-        $this->waiting = true;
-
-        IssueInstanceAdminAccess::dispatch($this->uuid, $this->token, (int) auth()->id());
-    }
-
-    public function render()
-    {
-        $payload = null;
-
-        if ($this->token !== null) {
-            $raw = ConfigHandoff::get($this->token);
-
-            if ($raw !== null) {
-                // Consumed on the first read: leaving it in the cache would make
-                // "shown once" a figure of speech — any replayed component
-                // request could fetch the password again for ten minutes. The
-                // payload lives in a local variable, so it reaches the view and
-                // nothing else.
-                ConfigHandoff::forget($this->token);
-                $this->token = null;
-                $this->waiting = false;
-                $payload = json_decode($raw, true);
-            }
-        }
-
-        return view('livewire.admin.instance-admin-access', [
-            'credentials' => isset($payload['password']) ? $payload : null,
-            'failed' => isset($payload['error']) ? $payload['error'] : null,
-        ]);
-    }
-}

app/Livewire/Admin/Instances.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Instances extends Component
-{
-    public function render()
-    {
-        return view('livewire.admin.instances', [
-            'rows' => [
-                ['sub' => 'kanzlei-berger', 'host' => 'pve-fsn-1', 'vmid' => 1042, 'storage' => '235 / 500 GB', 'version' => 'NC 31.0.4', 'status' => 'active'],
-                ['sub' => 'stb-reiss', 'host' => 'pve-fsn-1', 'vmid' => 1051, 'storage' => '88 / 250 GB', 'version' => 'NC 31.0.4', 'status' => 'active'],
-                ['sub' => 'notariat-kuelz', 'host' => 'pve-fsn-2', 'vmid' => 1067, 'storage' => '612 / 1000 GB', 'version' => 'NC 31.0.4', 'status' => 'active'],
-                ['sub' => 'ordination-fux', 'host' => 'pve-fsn-2', 'vmid' => 1072, 'storage' => '2 / 100 GB', 'version' => 'NC 31.0.4', 'status' => 'provisioning'],
-                ['sub' => 'buero-lang', 'host' => 'pve-fsn-3', 'vmid' => 1074, 'storage' => '—', 'version' => 'NC 31.0.4', 'status' => 'provisioning'],
-                ['sub' => 'weingut-prantl', 'host' => 'pve-hel-1', 'vmid' => 1075, 'storage' => '4 / 100 GB', 'version' => 'NC 31.0.4', 'status' => 'provisioning'],
-                ['sub' => 'praxis-sommer', 'host' => 'pve-fsn-3', 'vmid' => 1039, 'storage' => '41 / 100 GB', 'version' => 'NC 31.0.4', 'status' => 'suspended'],
-            ],
-        ]);
-    }
-}

app/Livewire/Admin/Maintenance.php

@@ -1,248 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use App\Models\Host;
-use App\Models\MaintenanceWindow;
-use App\Services\Maintenance\MaintenanceNotifier;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\DB;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Maintenance extends Component
-{
-    #[Validate('required|string|max:255')]
-    public string $title = '';
-
-    #[Validate('nullable|string|max:2000')]
-    public string $publicDescription = '';
-
-    #[Validate('nullable|string|max:2000')]
-    public string $internalNotes = '';
-
-    #[Validate('required|date')]
-    public string $startsAt = '';
-
-    #[Validate('required|date')]
-    public string $endsAt = '';
-
-    /** @var array<int> */
-    public array $hostIds = [];
-
-    /** Toggle every host of one datacenter (select-all / deselect-all). */
-    public function selectDatacenter(string $code): void
-    {
-        $this->authorize('maintenance.manage');
-        $ids = Host::query()->where('datacenter', $code)->pluck('id')->map(fn ($id) => (string) $id)->all();
-        $current = array_map('strval', $this->hostIds);
-
-        $this->hostIds = empty(array_diff($ids, $current))
-            ? array_values(array_diff($current, $ids))   // all selected → clear them
-            : array_values(array_unique([...$current, ...$ids]));
-    }
-
-    /**
-     * Set the end from the start. Typing a full timestamp by hand is the
-     * fiddliest part of this form, and the end is almost always "start plus a
-     * round number of minutes".
-     */
-    public function setDuration(int $minutes): void
-    {
-        $this->authorize('maintenance.manage');
-
-        $start = $this->parsed($this->startsAt);
-        if ($start === null) {
-            // No start yet: assume the next half hour, which is what someone
-            // scheduling a window in a hurry means anyway.
-            $start = now()->addMinutes(30 - (now()->minute % 30))->startOfMinute();
-            $this->startsAt = $start->format('Y-m-d\TH:i');
-        }
-
-        $this->endsAt = $start->copy()->addMinutes($minutes)->format('Y-m-d\TH:i');
-    }
-
-    /** Minutes between start and end, or null while either is unusable. */
-    public function durationMinutes(): ?int
-    {
-        $start = $this->parsed($this->startsAt);
-        $end = $this->parsed($this->endsAt);
-
-        if ($start === null || $end === null || $end->lessThanOrEqualTo($start)) {
-            return null;
-        }
-
-        return (int) $start->diffInMinutes($end);
-    }
-
-    private function parsed(string $value): ?\Illuminate\Support\Carbon
-    {
-        if (trim($value) === '') {
-            return null;
-        }
-
-        try {
-            return \Illuminate\Support\Carbon::parse($value);
-        } catch (\Throwable) {
-            return null;   // half-typed input is normal while the field is live
-        }
-    }
-
-    public function saveDraft(): void
-    {
-        $this->authorize('maintenance.manage');
-        $this->persist('draft');
-    }
-
-    public function publish(): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = $this->persist('scheduled');
-        if ($window !== null) {
-            app(MaintenanceNotifier::class)->announce($window);
-        }
-    }
-
-    private function persist(string $state): ?MaintenanceWindow
-    {
-        $data = $this->validate([
-            'title' => 'required|string|max:255',
-            'publicDescription' => 'nullable|string|max:2000',
-            'internalNotes' => 'nullable|string|max:2000',
-            'startsAt' => 'required|date',
-            'endsAt' => 'required|date',
-            'hostIds' => 'array',
-            'hostIds.*' => 'integer|exists:hosts,id',
-        ]);
-
-        $starts = Carbon::parse($data['startsAt']);
-        $ends = Carbon::parse($data['endsAt']);
-
-        if ($ends->lessThanOrEqualTo($starts)) {
-            $this->addError('endsAt', __('maintenance.end_after_start'));
-
-            return null;
-        }
-        // A window always needs a host — otherwise a hostless draft can never be
-        // published (there is no edit-hosts action) and is stuck.
-        if (empty($this->hostIds)) {
-            $this->addError('hostIds', __('maintenance.need_host'));
-
-            return null;
-        }
-        if ($state === 'scheduled' && $ends->isPast()) {
-            $this->addError('endsAt', __('maintenance.end_future'));
-
-            return null;
-        }
-
-        // Create the window and attach hosts atomically so a bad id can't leave
-        // an orphaned scheduled window behind.
-        $window = DB::transaction(function () use ($data, $starts, $ends, $state) {
-            $window = MaintenanceWindow::create([
-                'title' => $data['title'],
-                'public_description' => $data['publicDescription'] ?: null,
-                'internal_notes' => $data['internalNotes'] ?: null,
-                'starts_at' => $starts,
-                'ends_at' => $ends,
-                'state' => $state,
-                'created_by' => auth()->id(),
-                'published_at' => $state === 'scheduled' ? now() : null,
-            ]);
-            $window->hosts()->sync(array_map('intval', $data['hostIds'] ?? []));
-
-            return $window;
-        });
-
-        $this->reset('title', 'publicDescription', 'internalNotes', 'startsAt', 'endsAt', 'hostIds');
-        $this->dispatch('notify', message: __($state === 'scheduled' ? 'maintenance.published' : 'maintenance.draft_saved'));
-
-        return $window;
-    }
-
-    public function publishExisting(string $uuid): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
-        if ($window === null || $window->state !== 'draft') {
-            return;
-        }
-        if ($window->hosts()->count() === 0 || $window->ends_at->isPast()) {
-            $this->dispatch('notify', message: __('maintenance.need_host'));
-
-            return;
-        }
-        $window->update(['state' => 'scheduled', 'published_at' => now()]);
-        app(MaintenanceNotifier::class)->announce($window);
-        $this->dispatch('notify', message: __('maintenance.published'));
-    }
-
-    /**
-     * Re-run announcements for a published window. Idempotent (ledger-guarded),
-     * so it only fills gaps — the retry path when a transient queue outage left
-     * some affected customers un-notified.
-     */
-    public function resend(string $uuid): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
-        // Only announce for a window that has not yet ended (derived state).
-        if ($window === null || ! in_array($window->derivedState(), ['upcoming', 'active'], true)) {
-            return;
-        }
-        app(MaintenanceNotifier::class)->announce($window);
-        $this->dispatch('notify', message: __('maintenance.notified'));
-    }
-
-    public function cancel(string $uuid): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
-        // Cannot cancel what is already cancelled or has already completed.
-        if ($window === null || in_array($window->derivedState(), ['cancelled', 'completed'], true)) {
-            return;
-        }
-        $wasPublished = $window->state === 'scheduled';
-        $window->update(['state' => 'cancelled', 'cancelled_at' => now()]);
-
-        // Customers who received an announcement are told it's cancelled. The
-        // MessageSending listener suppresses still-pending announcements, and the
-        // MessageSent listener catches the race (an announcement that delivers
-        // just as we cancel) by queuing a catch-up cancellation for it.
-        if ($wasPublished) {
-            app(MaintenanceNotifier::class)->notifyCancellation($window);
-        }
-
-        $this->dispatch('notify', message: __('maintenance.cancelled'));
-    }
-
-    public function render()
-    {
-        $windows = MaintenanceWindow::query()
-            ->withCount('hosts')
-            ->orderByDesc('starts_at')
-            ->get()
-            ->map(fn (MaintenanceWindow $w) => [
-                'uuid' => $w->uuid,
-                'title' => $w->title,
-                'starts_at' => $w->starts_at,
-                'ends_at' => $w->ends_at,
-                'state' => $w->derivedState(),
-                'hosts' => $w->hosts_count,
-                'affected' => $w->affectedCustomers()->count(),
-                'is_draft' => $w->state === 'draft',
-                'notifiable' => $w->state === 'scheduled' && in_array($w->derivedState(), ['upcoming', 'active'], true),
-                'cancellable' => in_array($w->derivedState(), ['draft', 'upcoming', 'active'], true),
-            ]);
-
-        return view('livewire.admin.maintenance', [
-            'windows' => $windows,
-            'datacenters' => Datacenter::query()->orderBy('name')->get(),
-            'hosts' => Host::query()->orderBy('datacenter')->orderBy('name')->get(),
-            'durationMinutes' => $this->durationMinutes(),
-        ]);
-    }
-}

app/Livewire/Admin/Overview.php

@@ -1,82 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Overview extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $months = collect(range(11, 0))
-            ->map(fn ($i) => Carbon::now()->locale($locale)->startOfMonth()->subMonths($i)->isoFormat('MMM'))
-            ->all();
-
-        return view('livewire.admin.overview', [
-            'kpis' => [
-                ['label' => __('admin.kpi.customers'), 'value' => '42', 'delta' => '+3', 'tone' => 'success'],
-                ['label' => __('admin.kpi.instances'), 'value' => '39', 'sub' => __('admin.kpi.instances_sub'), 'tone' => 'success'],
-                ['label' => __('admin.kpi.hosts'), 'value' => '4', 'sub' => __('admin.kpi.hosts_sub'), 'tone' => 'muted'],
-                ['label' => __('admin.kpi.mrr'), 'value' => Number::currency(7842, in: 'EUR', locale: $locale), 'delta' => '+6,2 %', 'tone' => 'success'],
-            ],
-            'fleetChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => $months,
-                    'datasets' => [[
-                        'label' => __('admin.kpi.instances'),
-                        'data' => [21, 23, 25, 27, 28, 30, 31, 33, 35, 36, 38, 39],
-                        'borderColor' => 'token:accent',
-                        'backgroundColor' => 'token:accent/0.12',
-                        'fill' => true, 'tension' => 0.35, 'pointRadius' => 0, 'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => ['x' => ['grid' => ['display' => false]], 'y' => ['grid' => ['color' => 'token:border']]],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-            'revenueChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => $months,
-                    'datasets' => [[
-                        'label' => 'MRR',
-                        'data' => [4100, 4460, 4900, 5300, 5600, 6050, 6300, 6700, 7050, 7300, 7620, 7842],
-                        'borderColor' => 'token:accent',
-                        'fill' => true,
-                        'tension' => 0.35,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => ['x' => ['grid' => ['display' => false]], 'y' => ['beginAtZero' => true, 'grid' => ['color' => 'token:border']]],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-            // Per-host storage load as capacity meters (a ranked comparison, not a
-            // trend — so meters, not a chart). level drives the meter colour.
-            'hostLoad' => [
-                ['name' => 'pve-fsn-1', 'pct' => 72, 'level' => 'warn'],
-                ['name' => 'pve-fsn-2', 'pct' => 64, 'level' => 'ok'],
-                ['name' => 'pve-fsn-3', 'pct' => 81, 'level' => 'high'],
-                ['name' => 'pve-hel-1', 'pct' => 38, 'level' => 'ok'],
-            ],
-            'runs' => [
-                ['customer' => 'Ordination Dr. Fux', 'step' => __('admin.run.deploy'), 'state' => 'running'],
-                ['customer' => 'Architekturbüro Lang', 'step' => __('admin.run.dns'), 'state' => 'running'],
-                ['customer' => 'Weingut Prantl', 'step' => __('admin.run.acceptance'), 'state' => 'running'],
-            ],
-            'alerts' => [
-                ['level' => 'warning', 'text' => __('admin.alert.host_load', ['host' => 'pve-fsn-3'])],
-                ['level' => 'info', 'text' => __('admin.alert.cert_soon', ['n' => 3])],
-            ],
-        ]);
-    }
-}

app/Livewire/Admin/PlanVersions.php

@@ -1,243 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\PlanFamily;
-use App\Models\PlanVersion;
-use App\Models\Subscription;
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Support\Carbon;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-use RuntimeException;
-
-/**
- * The versions of one plan: what it can do, what it costs, and when it sells.
- *
- * The page is built around the one rule that matters here — a draft can be
- * edited freely, a published version cannot be touched at all. So drafting and
- * publishing are separate acts, and publishing says plainly that it is final.
- */
-#[Layout('layouts.admin')]
-class PlanVersions extends Component
-{
-    public string $uuid;
-
-    /** The draft being written. */
-    public int $quotaGb = 100;
-
-    public int $trafficGb = 1000;
-
-    public int $seats = 5;
-
-    public int $ramMb = 4096;
-
-    public int $cores = 2;
-
-    public int $diskGb = 120;
-
-    public string $performance = 'standard';
-
-    public ?int $templateVmid = 9000;
-
-    /** @var array<int, string> */
-    public array $features = [];
-
-    public int $monthlyCents = 4900;
-
-    public int $yearlyCents = 58800;
-
-    /** Publishing: when it goes on sale, and optionally when it stops. */
-    public string $availableFrom = '';
-
-    public string $availableUntil = '';
-
-    public ?string $publishing = null;
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('plans.manage');
-
-        $family = PlanFamily::query()->where('uuid', $uuid)->firstOrFail();
-        $this->uuid = $uuid;
-
-        // Start the draft from what this plan is today, so the common case —
-        // "same plan, new price" — is a single edit rather than nine.
-        $latest = $family->versions()->orderByDesc('version')->first();
-
-        if ($latest !== null) {
-            $this->quotaGb = $latest->quota_gb;
-            $this->trafficGb = $latest->traffic_gb;
-            $this->seats = $latest->seats;
-            $this->ramMb = $latest->ram_mb;
-            $this->cores = $latest->cores;
-            $this->diskGb = $latest->disk_gb;
-            $this->performance = (string) ($latest->performance ?? 'standard');
-            $this->templateVmid = $latest->template_vmid;
-            $this->features = $latest->features ?? [];
-
-            $monthly = $latest->priceFor(Subscription::TERM_MONTHLY);
-            $yearly = $latest->priceFor(Subscription::TERM_YEARLY);
-            $this->monthlyCents = $monthly?->amount_cents ?? $this->monthlyCents;
-            $this->yearlyCents = $yearly?->amount_cents ?? $this->yearlyCents;
-        }
-    }
-
-    private function family(): PlanFamily
-    {
-        return PlanFamily::query()->where('uuid', $this->uuid)->firstOrFail();
-    }
-
-    /** Write a new draft. Nothing is promised until it is published. */
-    public function draft(): void
-    {
-        $this->authorize('plans.manage');
-
-        // Every bound is explicit, and generous rather than tight. A mistyped
-        // figure has to come back as a message on the field; without an upper
-        // limit it overflows the column instead and the owner gets a 500 with
-        // no idea which number was wrong.
-        $data = $this->validate([
-            'quotaGb' => 'required|integer|min:1|max:1000000',
-            'trafficGb' => 'required|integer|min:0|max:10000000',
-            'seats' => 'required|integer|min:1|max:100000',
-            'ramMb' => 'required|integer|min:512|max:4194304',
-            'cores' => 'required|integer|min:1|max:512',
-            // The disk has to hold the customer's quota plus the system itself.
-            'diskGb' => 'required|integer|min:1|max:1000000|gte:quotaGb',
-            // One of the classes we actually have a label for. Free text means
-            // a typo is published, frozen, and shown to customers forever as a
-            // raw translation key.
-            'performance' => ['required', Rule::in(array_keys((array) __('billing.perf')))],
-            // Required, not nullable: a version without a blueprint can be
-            // published and sold, and then fails provisioning every time.
-            'templateVmid' => 'required|integer|min:100|max:999999999',
-            'features' => 'array',
-            // Same reason as the performance class: a request can carry
-            // anything, and an unknown key is frozen at publication and shown
-            // to customers as a raw translation key.
-            'features.*' => ['string', Rule::in(array_keys((array) __('billing.feature')))],
-            // 9,999,999.99 in the catalogue currency — far past anything we
-            // would charge, far short of overflowing an unsigned int.
-            'monthlyCents' => 'required|integer|min:0|max:999999999',
-            'yearlyCents' => 'required|integer|min:0|max:999999999',
-        ]);
-
-        $version = app(PlanCatalogue::class)->draft(
-            $this->family(),
-            [
-                'quota_gb' => $data['quotaGb'],
-                'traffic_gb' => $data['trafficGb'],
-                'seats' => $data['seats'],
-                'ram_mb' => $data['ramMb'],
-                'cores' => $data['cores'],
-                'disk_gb' => $data['diskGb'],
-                'performance' => $data['performance'],
-                'template_vmid' => $data['templateVmid'],
-                'features' => array_values($data['features']),
-            ],
-            // Both terms, because publishing refuses a version that is not
-            // priced for each — better to find that out here than in front of
-            // a customer.
-            [
-                Subscription::TERM_MONTHLY => $data['monthlyCents'],
-                Subscription::TERM_YEARLY => $data['yearlyCents'],
-            ],
-        );
-
-        $this->dispatch('notify', message: __('plans.draft_created', ['version' => $version->version]));
-    }
-
-    /** Open the publish form for one draft. */
-    public function choose(string $versionUuid): void
-    {
-        $this->publishing = $versionUuid;
-        $this->availableFrom = now()->format('Y-m-d\TH:i');
-        $this->availableUntil = '';
-    }
-
-    public function cancelPublish(): void
-    {
-        $this->reset('publishing', 'availableFrom', 'availableUntil');
-    }
-
-    /**
-     * Publish: fix the terms and put them on sale.
-     *
-     * Everything that can refuse this — an unpriced version, a window that
-     * overlaps another — refuses before anything is written, so a rejected
-     * publish leaves an editable draft rather than a stranded one.
-     */
-    public function publish(): void
-    {
-        $this->authorize('plans.manage');
-
-        $this->validate([
-            'availableFrom' => 'required|date',
-            'availableUntil' => 'nullable|date|after:availableFrom',
-        ]);
-
-        $version = PlanVersion::query()->where('uuid', $this->publishing)->firstOrFail();
-        abort_unless($version->plan_family_id === $this->family()->id, 404);
-
-        try {
-            app(PlanCatalogue::class)->publish(
-                $version,
-                Carbon::parse($this->availableFrom),
-                $this->availableUntil !== '' ? Carbon::parse($this->availableUntil) : null,
-            );
-        } catch (RuntimeException $e) {
-            $this->addError('availableFrom', $e->getMessage());
-
-            return;
-        }
-
-        $this->cancelPublish();
-        $this->dispatch('notify', message: __('plans.published', ['version' => $version->version]));
-    }
-
-    /**
-     * Close a running version's window — the ordinary way to take a plan off
-     * sale for good, since a published version can never be deleted.
-     */
-    public function close(string $versionUuid): void
-    {
-        $this->authorize('plans.manage');
-
-        $version = PlanVersion::query()->where('uuid', $versionUuid)->firstOrFail();
-        abort_unless($version->plan_family_id === $this->family()->id, 404);
-
-        try {
-            app(PlanCatalogue::class)->schedule($version, $version->available_from, now());
-        } catch (RuntimeException $e) {
-            $this->addError('availableFrom', $e->getMessage());
-
-            return;
-        }
-
-        $this->dispatch('notify', message: __('plans.closed', ['version' => $version->version]));
-    }
-
-    #[On('plan-draft-deleted')]
-    public function refresh(): void
-    {
-        // Livewire re-renders; the listener exists so the modal can say so.
-    }
-
-    public function render()
-    {
-        $family = $this->family();
-        $now = now();
-
-        return view('livewire.admin.plan-versions', [
-            'family' => $family,
-            'versions' => $family->versions()->with('prices')->orderByDesc('version')->get(),
-            'now' => $now,
-            'featureKeys' => array_keys((array) __('billing.feature')),
-            'performanceClasses' => (array) __('billing.perf'),
-            'currency' => Subscription::catalogueCurrency(),
-        ]);
-    }
-}

app/Livewire/Admin/Plans.php

@@ -1,116 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\PlanFamily;
-use App\Services\Billing\PlanCatalogue;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-/**
- * The plan lines we sell, and whether each is currently on sale.
- *
- * Deliberately shallow: a family is a name and a rank, and everything that can
- * be got wrong — capabilities, prices, windows — lives one level down on the
- * versions, where publishing makes it permanent.
- */
-#[Layout('layouts.admin')]
-class Plans extends Component
-{
-    #[Validate(['required', 'string', 'max:32', 'regex:/^[a-z][a-z0-9_]*$/', 'unique:plan_families,key'])]
-    public string $key = '';
-
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    #[Validate('required|integer|min:0|max:255')]
-    public int $tier = 1;
-
-    public function mount(): void
-    {
-        // The page itself, not only its buttons. Hiding the nav entry and
-        // guarding the mutations still leaves the whole catalogue — prices,
-        // drafts, unreleased plans — readable to any operator who types the URL.
-        $this->authorize('plans.manage');
-    }
-
-    public function save(): void
-    {
-        $this->authorize('plans.manage');
-
-        $this->key = strtolower(trim($this->key));
-
-        $data = $this->validate([
-            // The key is permanent once created — orders, instances and every
-            // contract snapshot store it as a string — so it has to be a plain
-            // identifier, not something anyone will want to prettify later.
-            'key' => ['required', 'string', 'max:32', 'regex:/^[a-z][a-z0-9_]*$/', 'unique:plan_families,key'],
-            'name' => 'required|string|max:255',
-            'tier' => 'required|integer|min:0|max:255',
-        ]);
-
-        PlanFamily::create([
-            'key' => $data['key'],
-            'name' => $data['name'],
-            'tier' => $data['tier'],
-            // Nothing to sell until a version is published, so it starts able
-            // to sell and simply has nothing available.
-            'sales_enabled' => true,
-        ]);
-
-        $this->reset('key', 'name', 'tier');
-        $this->tier = 1;
-        $this->dispatch('notify', message: __('plans.created'));
-    }
-
-    /**
-     * The kill switch: stop selling this plan now, without touching a window.
-     *
-     * Existing customers keep their contract and their machine — this only
-     * decides whether anyone new can buy it.
-     */
-    public function toggleSales(string $uuid): void
-    {
-        $this->authorize('plans.manage');
-
-        $family = PlanFamily::query()->where('uuid', $uuid)->first();
-        $family?->update(['sales_enabled' => ! $family->sales_enabled]);
-
-        $this->dispatch('notify', message: __($family?->sales_enabled ? 'plans.now_selling' : 'plans.withdrawn'));
-    }
-
-    public function render()
-    {
-        $now = now();
-
-        $families = PlanFamily::query()
-            ->with(['versions.prices'])
-            ->withCount('versions')
-            ->orderBy('tier')
-            ->get()
-            ->map(fn (PlanFamily $family) => [
-                'uuid' => $family->uuid,
-                'key' => $family->key,
-                'name' => $family->name,
-                'tier' => $family->tier,
-                'sales_enabled' => $family->sales_enabled,
-                'versions_count' => $family->versions_count,
-                'live' => $family->versions->first(fn ($v) => $v->isAvailableAt($now)),
-                // What is queued up next, so a scheduled launch is visible
-                // before a customer discovers it.
-                'next' => $family->versions
-                    ->filter(fn ($v) => $v->isPublished() && $v->available_from->greaterThan($now))
-                    ->sortBy('available_from')
-                    ->first(),
-                'drafts' => $family->versions->filter(fn ($v) => ! $v->isPublished())->count(),
-            ]);
-
-        return view('livewire.admin.plans', [
-            'families' => $families,
-            // The shop's own answer, so this page cannot disagree with what a
-            // customer actually sees.
-            'sellable' => array_keys(app(PlanCatalogue::class)->sellable()),
-        ]);
-    }
-}

app/Livewire/Admin/Provisioning.php

@@ -1,160 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Livewire\Concerns\BuildsRunSteps;
-use App\Models\Host;
-use App\Models\Instance;
-use App\Models\Order;
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Provisioning extends Component
-{
-    use BuildsRunSteps;
-
-    #[On('echo-private:admin.runs,StepAdvanced')]
-    public function onStepAdvanced(): void
-    {
-        // A round-trip re-renders with fresh run state.
-    }
-
-    /** Retry a failed run from its current step (mirrors the host-detail retry). */
-    public function retry(string $uuid): void
-    {
-        $this->authorize('provisioning.retry');
-        // Atomically claim the run: only the request that transitions it out of
-        // FAILED proceeds, so two concurrent retries can't double-dispatch.
-        $claimed = ProvisioningRun::query()
-            ->where('uuid', $uuid)
-            ->where('status', ProvisioningRun::STATUS_FAILED)
-            ->update([
-                'status' => ProvisioningRun::STATUS_RUNNING,
-                'attempt' => 0,
-                'next_attempt_at' => now(),
-                'started_at' => now(), // reset the step timer so it doesn't re-time-out instantly
-                'error' => null,
-            ]);
-        if ($claimed === 0) {
-            return; // already retried by a concurrent request
-        }
-        $run = ProvisioningRun::query()->where('uuid', $uuid)->first();
-        if ($run === null) {
-            return;
-        }
-
-        // Move the subject out of its error state so the console reflects the retry.
-        $subject = $run->subject;
-        if ($subject instanceof Host) {
-            $subject->update(['status' => 'onboarding']);
-        } elseif ($subject instanceof Order) {
-            $subject->update(['status' => 'provisioning']);
-            Instance::query()->where('order_id', $subject->id)->where('status', 'failed')->update(['status' => 'provisioning']);
-        }
-
-        AdvanceRunJob::dispatch($run->uuid);
-        $this->dispatch('notify', message: __('admin.run_retried'));
-    }
-
-    /**
-     * A run that claims to be in progress but hasn't advanced in a while looks
-     * stuck — unless it is in a legitimate scheduled backoff (next_attempt_at in
-     * the future, e.g. RunRunner's retry delay of up to 300 s).
-     */
-    private function isStale(ProvisioningRun $run): bool
-    {
-        if (! in_array($run->status, ['running', 'waiting'], true)) {
-            return false;
-        }
-        if ($run->next_attempt_at !== null && $run->next_attempt_at->isFuture()) {
-            return false; // waiting out a scheduled retry/poll — not stuck
-        }
-
-        // Compare against the CURRENT step's own allowed duration — some steps
-        // (VM clone, Proxmox install) legitimately run for many minutes — plus a
-        // small grace. Only past its own deadline without advancing is it stuck.
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $class = $pipeline[$run->current_step] ?? null;
-        $maxSeconds = $class !== null ? app($class)->maxDuration() : 120;
-
-        return $run->updated_at !== null && $run->updated_at->lt(now()->subSeconds($maxSeconds + 30));
-    }
-
-    private function subjectLabel(ProvisioningRun $run): string
-    {
-        $subject = $run->subject;
-
-        if ($subject instanceof Order) {
-            return $subject->customer?->name ?? 'Order';
-        }
-        if ($subject instanceof Host) {
-            return $subject->name;
-        }
-
-        return class_basename($run->subject_type);
-    }
-
-    public function render()
-    {
-        $runs = ProvisioningRun::query()->latest('id')->limit(30)->get();
-
-        $active = $runs->first(fn (ProvisioningRun $r) => in_array(
-            $r->status, ['pending', 'running', 'waiting'], true
-        )) ?? $runs->first();
-
-        return view('livewire.admin.provisioning', [
-            'hasActive' => $active !== null && in_array($active->status, ['pending', 'running', 'waiting'], true),
-            'rows' => $runs->map(function (ProvisioningRun $r) {
-                $total = max(count(config('provisioning.pipelines.'.$r->pipeline, [])), 1);
-                $done = $r->status === ProvisioningRun::STATUS_COMPLETED ? $total : $r->current_step;
-
-                return [
-                    'uuid' => $r->uuid,
-                    'customer' => $this->subjectLabel($r),
-                    'pipeline' => $r->pipeline,
-                    'step' => $r->status === 'completed' ? '—' : $this->currentStepLabel($r),
-                    'n' => ($r->current_step + 1).'/'.$total,
-                    'percent' => (int) round($done / $total * 100),
-                    'attempt' => $r->attempt,
-                    'state' => $this->runState($r),
-                    'failed' => $r->status === ProvisioningRun::STATUS_FAILED,
-                    'activity' => $r->updated_at?->diffForHumans() ?? '—',
-                    'stale' => $this->isStale($r),
-                ];
-            })->all(),
-            'panel' => $active ? $this->panelFor($active) : null,
-        ]);
-    }
-
-    /** Compact "current run" readout for the right column. */
-    private function panelFor(ProvisioningRun $run): array
-    {
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $total = max(count($pipeline), 1);
-        $current = min($run->current_step, $total - 1);
-        $completed = $run->status === ProvisioningRun::STATUS_COMPLETED;
-        $done = $completed ? $total : $current;
-
-        return [
-            'uuid' => $run->uuid,
-            'subject' => $this->subjectLabel($run),
-            'pipeline' => $run->pipeline,
-            'attempt' => $run->attempt,
-            'status' => $this->runState($run),                       // running|done|failed
-            'failed' => $run->status === ProvisioningRun::STATUS_FAILED,
-            'current' => $completed ? null : (isset($pipeline[$current]) ? __(app($pipeline[$current])->label()) : null),
-            'next' => isset($pipeline[$current + 1]) && ! $completed ? __(app($pipeline[$current + 1])->label()) : null,
-            'error' => $run->error,
-            'done' => $done,
-            'total' => $total,
-            'percent' => (int) round($done / $total * 100),
-            'activity' => $run->updated_at?->diffForHumans() ?? '—',
-            'started' => $run->started_at?->diffForHumans() ?? null,
-            'stale' => $this->isStale($run),
-        ];
-    }
-}

app/Livewire/Admin/Revenue.php

@@ -1,64 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Revenue extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $eur = fn (int $v) => Number::currency($v, in: 'EUR', locale: $locale);
-        $months = collect(range(11, 0))
-            ->map(fn ($i) => Carbon::now()->locale($locale)->startOfMonth()->subMonths($i)->isoFormat('MMM'))
-            ->all();
-
-        return view('livewire.admin.revenue', [
-            'kpis' => [
-                ['label' => __('admin.rev.mrr'), 'value' => $eur(7842), 'delta' => '+6,2 %'],
-                ['label' => __('admin.rev.arr'), 'value' => $eur(94104), 'delta' => '+18 %'],
-                ['label' => __('admin.rev.arpu'), 'value' => $eur(187), 'delta' => '+1,4 %'],
-                ['label' => __('admin.rev.churn'), 'value' => '1,8 %', 'delta' => '−0,3 %'],
-            ],
-            'mrrChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => $months,
-                    'datasets' => [[
-                        'label' => 'MRR',
-                        'data' => [4100, 4460, 4900, 5300, 5600, 6050, 6300, 6700, 7050, 7300, 7620, 7842],
-                        'borderColor' => 'token:accent', 'backgroundColor' => 'token:accent/0.12',
-                        'fill' => true, 'tension' => 0.35, 'pointRadius' => 0, 'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => ['x' => ['grid' => ['display' => false]], 'y' => ['grid' => ['color' => 'token:border']]],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-            'planChart' => [
-                'type' => 'doughnut',
-                'data' => [
-                    'labels' => ['Solo', 'Team', 'Enterprise'],
-                    'datasets' => [[
-                        'data' => [1659, 3366, 1796],
-                        'backgroundColor' => ['token:info', 'token:accent', 'token:success-bright'],
-                        'borderWidth' => 0,
-                    ]],
-                ],
-                'options' => ['cutout' => '62%', 'plugins' => ['legend' => ['position' => 'bottom', 'labels' => ['boxWidth' => 10, 'padding' => 12]]]],
-            ],
-            'payments' => [
-                ['customer' => 'Notariat Külz', 'amount' => $eur(449), 'when' => '01.07.'],
-                ['customer' => 'Kanzlei Berger', 'amount' => $eur(198), 'when' => '01.07.'],
-                ['customer' => 'Steuerberatung Reiss', 'amount' => $eur(198), 'when' => '01.07.'],
-                ['customer' => 'Ordination Dr. Fux', 'amount' => $eur(79), 'when' => '30.06.'],
-            ],
-        ]);
-    }
-}

app/Livewire/Admin/Settings.php

@@ -1,360 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Customer;
-use App\Models\User;
-use App\Models\VpnPeer;
-use App\Support\Settings as AppSettings;
-use App\Provisioning\Jobs\ApplyVpnPeer;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Str;
-use Spatie\Permission\Models\Role;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-/**
- * Operator settings: the signed-in operator's own account plus (Owner-only)
- * staff management. All staff mutations are capability-gated server-side and
- * protect the last-Owner and self-role invariants transactionally.
- */
-#[Layout('layouts.admin')]
-class Settings extends Component
-{
-    // My account
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    #[Validate('required|email|max:255')]
-    public string $email = '';
-
-    // Invite staff
-    #[Validate('required|string|max:255')]
-    public string $staffName = '';
-
-    #[Validate('required|email|max:255')]
-    public string $staffEmail = '';
-
-    #[Validate('required|in:Owner,Admin,Support,Billing,Read-only')]
-    public string $staffRole = 'Support';
-
-    /** Shown once after inviting, since email delivery is still mocked. */
-    public ?string $invitedEmail = null;
-
-    public ?string $invitedPassword = null;
-
-    public function mount(): void
-    {
-        $this->name = auth()->user()->name;
-        $this->email = auth()->user()->email;
-    }
-
-    /**
-     * Take the marketing site and the customer portal offline, or back online.
-     * The console keeps working either way — otherwise this switch could only
-     * ever be flipped once.
-     */
-    public function toggleSiteVisibility(): void
-    {
-        $this->authorize('site.manage');
-
-        $public = ! AppSettings::bool('site.public', true);
-        AppSettings::set('site.public', $public);
-
-        $this->dispatch('notify', message: $public
-            ? __('admin_settings.site_now_public')
-            : __('admin_settings.site_now_hidden'));
-    }
-
-    public function saveAccount(): void
-    {
-        $user = auth()->user();
-        $data = $this->validate([
-            'name' => 'required|string|max:255',
-            'email' => 'required|email|max:255|unique:users,email,'.$user->id,
-        ]);
-
-        // An operator email must never collide with a customer's — that would
-        // block the customer from ever obtaining a portal login (ensureUser).
-        if (Customer::query()->where('email', $data['email'])->exists()) {
-            $this->addError('email', __('admin_settings.is_customer'));
-
-            return;
-        }
-
-        $user->update($data);
-        $this->dispatch('notify', message: __('admin_settings.account_saved'));
-    }
-
-    public function inviteStaff(): void
-    {
-        $this->authorize('staff.manage');
-        $data = $this->validate([
-            'staffName' => 'required|string|max:255',
-            'staffEmail' => 'required|email|max:255|unique:users,email',
-            'staffRole' => 'required|in:Owner,Admin,Support,Billing,Read-only',
-        ]);
-
-        // Only an Owner may create another Owner.
-        if ($data['staffRole'] === 'Owner' && ! auth()->user()->hasRole('Owner')) {
-            $this->addError('staffRole', __('admin_settings.owner_only'));
-
-            return;
-        }
-        // Never turn a customer's portal login into an operator.
-        if (Customer::query()->where('email', $data['staffEmail'])->exists()) {
-            $this->addError('staffEmail', __('admin_settings.is_customer'));
-
-            return;
-        }
-
-        // Email/password-setup delivery is still mocked, so generate a temporary
-        // password and surface it once to the Owner to share securely — the
-        // account is usable immediately (a proper invite link follows with mail).
-        $temp = Str::password(14);
-        $user = User::create([
-            'name' => $data['staffName'],
-            'email' => $data['staffEmail'],
-            'password' => Hash::make($temp),
-            'is_admin' => true,
-        ]);
-        $user->assignRole($data['staffRole']);
-
-        $this->invitedEmail = $data['staffEmail'];
-        $this->invitedPassword = $temp;
-        $this->reset('staffName', 'staffEmail');
-        $this->staffRole = 'Support';
-        $this->dispatch('notify', message: __('admin_settings.staff_invited'));
-    }
-
-    public function setStaffRole(int $id, string $role): void
-    {
-        $this->authorize('staff.manage');
-        if (! in_array($role, User::OPERATOR_ROLES, true)) {
-            return;
-        }
-
-        $result = DB::transaction(function () use ($id, $role) {
-            // Serialize on the Owner role so the global owner count can't be
-            // raced to zero by concurrent demotions of different owners.
-            Role::query()->where('name', 'Owner')->lockForUpdate()->first();
-
-            $target = User::query()->whereKey($id)->lockForUpdate()->first();
-            if ($target === null) {
-                return 'gone';
-            }
-            if ($target->id === auth()->id()) {
-                return 'self';
-            }
-            // Only existing operators may be re-roled — never escalate a customer
-            // (or any non-staff) user into the console via a tampered id.
-            if (! $target->isOperator() || Customer::query()->where('email', $target->email)->exists()) {
-                return 'not_staff';
-            }
-            // Granting or revoking Owner is Owner-only.
-            if (($role === 'Owner' || $target->hasRole('Owner')) && ! auth()->user()->hasRole('Owner')) {
-                return 'owner_only';
-            }
-            // Never demote the last Owner.
-            if ($target->hasRole('Owner') && $role !== 'Owner' && $this->ownerCount() <= 1) {
-                return 'last_owner';
-            }
-            $target->syncRoles([$role]);
-
-            return 'ok';
-        });
-
-        $this->flash($result);
-    }
-
-    public function revokeStaff(int $id): void
-    {
-        $this->authorize('staff.manage');
-
-        $revokedPeers = [];
-
-        $result = DB::transaction(function () use ($id, &$revokedPeers) {
-            Role::query()->where('name', 'Owner')->lockForUpdate()->first();
-
-            $target = User::query()->whereKey($id)->lockForUpdate()->first();
-            if ($target === null || ! $target->isOperator()) {
-                return 'gone';
-            }
-            if ($target->id === auth()->id()) {
-                return 'self';
-            }
-            if ($target->hasRole('Owner') && $this->ownerCount() <= 1) {
-                return 'last_owner';
-            }
-            $target->syncRoles([]);
-            $target->update(['is_admin' => false]);
-
-            // Taking away the console but leaving the tunnel would be the worst
-            // of both: no access to the panel, still a route into the
-            // management network. Same revocation path as the VPN page uses.
-            foreach (VpnPeer::query()->where('user_id', $target->id)->get() as $peer) {
-                $peer->purgeSecret();
-                $peer->delete();
-                $revokedPeers[] = $peer->public_key;
-            }
-
-            return 'revoked';
-        });
-
-        // Dispatched only once the rows are committed: a worker picking the job
-        // up mid-transaction would still see the peer as active, leave it on the
-        // hub, and never be asked again — a revoked colleague would keep their
-        // tunnel until the next reconciliation happened to notice.
-        foreach ($revokedPeers as $publicKey) {
-            ApplyVpnPeer::dispatch($publicKey, null, false);
-        }
-
-        $this->flash($result);
-    }
-
-    private function flash(string $result): void
-    {
-        $msg = match ($result) {
-            'ok' => __('admin_settings.role_updated'),
-            'revoked' => __('admin_settings.staff_revoked'),
-            'self' => __('admin_settings.not_self'),
-            'owner_only' => __('admin_settings.owner_only'),
-            'last_owner' => __('admin_settings.last_owner'),
-            'not_staff' => __('admin_settings.not_staff'),
-            default => null,
-        };
-        if ($msg !== null) {
-            $this->dispatch('notify', message: $msg);
-        }
-    }
-
-    private function ownerCount(): int
-    {
-        return User::query()->whereHas('roles', fn ($q) => $q->where('name', 'Owner'))->count();
-    }
-
-    /** A new entry for the console allowlist: a single address or a CIDR range. */
-    public string $consoleIp = '';
-
-    /**
-     * Add a network that may reach the console without the VPN.
-     *
-     * Validated as an address or CIDR before it is stored: a typo that silently
-     * matches nothing is how someone locks themselves out while believing they
-     * have not.
-     */
-    public function addConsoleIp(): void
-    {
-        $this->authorize('site.manage');
-
-        $value = trim($this->consoleIp);
-
-        if (! \App\Http\Middleware\RestrictConsoleNetwork::isNetwork($value)) {
-            $this->addError('consoleIp', __('admin_settings.console_ip_invalid'));
-
-            return;
-        }
-
-        $list = (array) AppSettings::get('console.allowed_ips', []);
-
-        if (! in_array($value, $list, true)) {
-            $list[] = $value;
-            AppSettings::set('console.allowed_ips', array_values($list));
-        }
-
-        $this->consoleIp = '';
-        $this->dispatch('notify', message: __('admin_settings.console_ip_added', ['ip' => $value]));
-    }
-
-    /**
-     * Remove one — unless it is the reason you can see this page.
-     *
-     * Refusing here rather than warning afterwards: by the time the page
-     * reloads, the request that would show the warning has already been
-     * rejected. The VPN is never in this list, so an operator on the VPN can
-     * always clear it out.
-     */
-    public function removeConsoleIp(string $value): void
-    {
-        $this->authorize('site.manage');
-
-        $list = array_values(array_filter(
-            (array) AppSettings::get('console.allowed_ips', []),
-            fn ($entry) => $entry !== $value,
-        ));
-
-        $ip = (string) request()->ip();
-
-        if (\App\Http\Middleware\RestrictConsoleNetwork::isRestricted()
-            && ! \App\Http\Middleware\RestrictConsoleNetwork::wouldStillAllow($ip, $list)) {
-            $this->dispatch('notify', message: __('admin_settings.console_ip_last', ['ip' => $ip]));
-
-            return;
-        }
-
-        AppSettings::set('console.allowed_ips', $list);
-        $this->dispatch('notify', message: __('admin_settings.console_ip_removed', ['ip' => $value]));
-    }
-
-    /**
-     * Switch the restriction on or off.
-     *
-     * Turning it ON is refused unless the address doing the switching is
-     * already covered — otherwise the click that secures the console is also
-     * the click that locks its owner out of it.
-     */
-    public function toggleConsoleRestriction(): void
-    {
-        $this->authorize('site.manage');
-
-        $on = ! \App\Http\Middleware\RestrictConsoleNetwork::isRestricted();
-
-        if ($on && ! \App\Http\Middleware\RestrictConsoleNetwork::allows((string) request()->ip())) {
-            $this->dispatch('notify', message: __('admin_settings.console_lock_refused', ['ip' => (string) request()->ip()]));
-
-            return;
-        }
-
-        AppSettings::set('console.network_restricted', $on);
-        $this->dispatch('notify', message: __($on ? 'admin_settings.console_locked' : 'admin_settings.console_unlocked'));
-    }
-
-
-    public function render()
-    {
-        $staff = User::query()
-            ->whereHas('roles', fn ($q) => $q->whereIn('name', User::OPERATOR_ROLES))
-            ->with('roles')
-            ->orderBy('name')
-            ->get()
-            ->map(fn (User $u) => [
-                'id' => $u->id,
-                'name' => $u->name,
-                'email' => $u->email,
-                'role' => $u->roles->first()?->name ?? '—',
-                'self' => $u->id === auth()->id(),
-            ]);
-
-        return view('livewire.admin.settings', [
-            'sitePublic' => AppSettings::bool('site.public', true),
-            'canManageSite' => auth()->user()?->can('site.manage') ?? false,
-            // Shown so nobody has to guess why they still see the real site.
-            'viewerOnVpn' => \Symfony\Component\HttpFoundation\IpUtils::checkIp(
-                (string) request()->ip(),
-                (array) config('admin_access.trusted_ranges', []),
-            ),
-            // Who may reach the console, and from where the viewer is asking —
-            // shown so the consequence of a change is visible before it is made.
-            'consoleRestricted' => \App\Http\Middleware\RestrictConsoleNetwork::isRestricted(),
-            'consoleIps' => (array) AppSettings::get('console.allowed_ips', []),
-            'consoleVpnRanges' => (array) config('admin_access.trusted_ranges', []),
-            'viewerIp' => (string) request()->ip(),
-            'staff' => $staff,
-            'roles' => User::OPERATOR_ROLES,
-            'canManageStaff' => auth()->user()->can('staff.manage'),
-            'isOwner' => auth()->user()->hasRole('Owner'),
-        ]);
-    }
-}

app/Livewire/Admin/Vpn.php

@@ -1,357 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Host;
-use App\Models\VpnPeer;
-use App\Provisioning\Jobs\ApplyVpnPeer;
-use App\Provisioning\Jobs\SyncVpnPeers;
-use App\Models\User;
-use App\Services\Wireguard\ConfigHandoff;
-use App\Services\Wireguard\ConfigVault;
-use App\Services\Wireguard\Keypair;
-use App\Services\Wireguard\QrCode;
-use App\Services\Wireguard\WireguardHub;
-use Illuminate\Database\QueryException;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Str;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-/**
- * VPN access management. The console container has no wg0, so live state is
- * read from the database and refreshed by SyncVpnPeers on the provisioning
- * queue — the poll below only nudges that job, it never talks to WireGuard.
- */
-#[Layout('layouts.admin')]
-class Vpn extends Component
-{
-    public string $name = '';
-
-    /** Optional: a peer that generated its own key never hands us the private half. */
-    public string $publicKey = '';
-
-    /** Opaque handle for the freshly created config; see ConfigHandoff. */
-    public ?string $configToken = null;
-
-    public ?string $newConfigName = null;
-
-    /** Owner of the new access. Defaults to the operator creating it. */
-    public ?int $ownerId = null;
-
-    /** Keep the config so its owner can fetch it again behind their password. */
-    public bool $storeConfig = false;
-
-    public bool $showQr = false;
-
-    public function mount(): void
-    {
-        $this->authorize('viewAny', VpnPeer::class);
-        $this->ownerId = auth()->id();
-    }
-
-    /**
-     * mount() runs once; every later request — including the five-second poll —
-     * only hydrates. Without this, revoking vpn.manage would not take effect
-     * until the operator happened to reload the page, and the open tab would
-     * keep serving fresh peer state.
-     */
-    public function hydrate(): void
-    {
-        $this->authorize('viewAny', VpnPeer::class);
-    }
-
-    public function create(): void
-    {
-        $this->authorize('create', VpnPeer::class);
-
-        $this->validate([
-            'name' => 'required|string|max:255',
-            'publicKey' => 'nullable|string|max:64',
-            // An access belongs to a person, and only to an operator: a customer
-            // account must never own a way into the management network.
-            'ownerId' => ['required', Rule::exists('users', 'id')],
-        ]);
-
-        // Storing needs a key. Without one we would either write the credential
-        // in the clear or pretend we stored it — both worse than saying no.
-        if ($this->storeConfig && ! ConfigVault::available()) {
-            $this->addError('storeConfig', __('vpn.vault_unavailable'));
-
-            return;
-        }
-
-        $ownKey = trim($this->publicKey) !== '';
-
-        if ($this->storeConfig && $ownKey) {
-            $this->addError('storeConfig', __('vpn.cannot_store_foreign_key'));
-
-            return;
-        }
-
-        if ($ownKey && ! Keypair::isValidKey(trim($this->publicKey))) {
-            $this->addError('publicKey', __('vpn.invalid_key'));
-
-            return;
-        }
-
-        $keypair = $ownKey ? null : Keypair::generate();
-        $publicKey = $ownKey ? trim($this->publicKey) : $keypair->publicKey;
-
-        $hub = app(WireguardHub::class);
-
-        // Same lock the host pipeline holds while it reserves an address
-        // (ConfigureWireguard). Addresses come from one subnet but live in two
-        // tables, so neither unique index can catch the other's insert — the
-        // shared lock is what keeps a host and an access off the same tunnel IP.
-        try {
-            // Filled inside the transaction; only the handoff needs it afterwards.
-        $plainConfig = null;
-
-        $peer = Cache::lock('wireguard:allocate', 30)->block(10, function () use ($hub, $publicKey, $keypair, &$plainConfig) {
-            return DB::transaction(function () use ($hub, $publicKey, $keypair, &$plainConfig) {
-                // The owner row is locked for the whole insert, and revokeStaff()
-                // locks the same row: without that, a revocation could commit
-                // between the check and the insert, find no peer to remove, and
-                // leave the revoked colleague with a brand-new tunnel.
-                $owner = User::query()->whereKey($this->ownerId)->lockForUpdate()->first();
-                if ($owner === null || ! $owner->isOperator()) {
-                    return 'owner_must_be_operator';
-                }
-
-                // Inside the lock: checking before it would let two concurrent
-                // requests both pass and the loser hit the unique index as a
-                // 500. withTrashed, because a revoked peer keeps its key until
-                // the hub confirms removal.
-                $existing = VpnPeer::withTrashed()->where('public_key', $publicKey)->first();
-                if ($existing !== null) {
-                    return $existing->trashed() ? 'pending_removal' : 'duplicate_key';
-                }
-
-                // A host's key may not have been adopted into vpn_peers yet.
-                // Re-using it would make `wg set` rewrite that host's allowed-ip
-                // to the address allocated here — cutting the management tunnel
-                // to a live machine.
-                if (Host::query()->where('wg_pubkey', $publicKey)->exists()) {
-                    return 'host_key';
-                }
-
-                $ip = $hub->allocateIp();
-
-                // Built and encrypted here so the stored config is part of the
-                // same insert. Doing it afterwards could leave a live access
-                // whose config was never stored — unrecoverable, and the
-                // operator would create a second one not knowing why.
-                $secret = null;
-                if ($keypair !== null) {
-                    $plainConfig = $this->clientConfig($keypair, $ip);
-                    if ($this->storeConfig) {
-                        $secret = ConfigVault::encrypt($plainConfig);
-                    }
-                }
-
-                return VpnPeer::create([
-                    'name' => trim($this->name),
-                    'kind' => VpnPeer::KIND_STAFF,
-                    'user_id' => $this->ownerId,
-                    'public_key' => $publicKey,
-                    'allowed_ip' => $ip,
-                    'config_secret' => $secret,
-                    'enabled' => true,
-                    'present' => false,
-                    'created_by' => auth()->id(),
-                ]);
-                });
-            });
-        } catch (QueryException) {
-            // Backstop: the unique index caught a writer that did not take this
-            // lock. Report it like any other duplicate instead of a 500.
-            $this->addError('publicKey', __('vpn.duplicate_key'));
-
-            return;
-        }
-
-        if (is_string($peer)) {
-            $field = $peer === 'owner_must_be_operator' ? 'ownerId' : 'publicKey';
-            $this->addError($field, __('vpn.'.$peer));
-
-            return;
-        }
-
-        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, true);
-
-        // Whatever was on screen belongs to the previous access. Leaving it up
-        // after creating another one would present the wrong private config
-        // under the new name — and someone would hand it out.
-        $this->dismissConfig();
-
-        // Only a key we generated can be turned into a ready-to-use config.
-        if ($plainConfig !== null) {
-            $this->configToken = ConfigHandoff::put($plainConfig);
-            $this->newConfigName = $peer->name;
-        }
-
-        $this->reset('name', 'publicKey', 'storeConfig');
-        $this->ownerId = auth()->id();
-        $this->dispatch('notify', message: __('vpn.created'));
-    }
-
-    public function toggle(string $uuid): void
-    {
-        // Looked up globally and then judged by the policy: filtering it out of
-        // the query here would turn "not allowed" into a button that silently
-        // does nothing, which is exactly how the portal used to lie to people.
-        $peer = VpnPeer::query()->where('uuid', $uuid)->first();
-        if ($peer === null) {
-            return;
-        }
-        $this->authorize('block', $peer);
-
-        $peer->update(['enabled' => ! $peer->enabled]);
-        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, $peer->enabled);
-
-        $this->dispatch('notify', message: $peer->enabled ? __('vpn.unblocked') : __('vpn.blocked'));
-    }
-
-    #[On('vpn-peer-deleted')]
-    public function peerDeleted(): void
-    {
-        $this->dispatch('notify', message: __('vpn.deleted'));
-    }
-
-    /**
-     * Replace an access's keypair.
-     *
-     * The way back for an access whose config was never stored: nobody can hand
-     * out a private key that no longer exists, so the honest option is a new
-     * one. The old key stops working the moment the hub is updated, which is
-     * also what makes this the right tool for a lost or leaked device.
-     */
-    public function reissue(string $uuid): void
-    {
-        $peer = VpnPeer::query()->where('uuid', $uuid)->first();
-        if ($peer === null) {
-            return;
-        }
-        $this->authorize('update', $peer);
-
-        if ($peer->kind !== VpnPeer::KIND_STAFF) {
-            $this->dispatch('notify', message: __('vpn.reissue_staff_only'));
-
-            return;
-        }
-
-        $keypair = Keypair::generate();
-        $oldKey = $peer->public_key;
-        $config = $this->clientConfig($keypair, $peer->allowed_ip);
-
-        $peer->forceFill([
-            'public_key' => $keypair->publicKey,
-            'present' => false,
-            // Only re-stored when the vault can actually be used: without the key
-            // this would throw, and the console tells people to re-issue
-            // precisely when a stored config has become unreadable.
-            'config_secret' => $peer->hasStoredConfig() && ConfigVault::available()
-                ? ConfigVault::encrypt($config)
-                : null,
-        ])->save();
-
-        // Old key off the hub first, then the new one on: the other order would
-        // briefly leave two peers claiming the same tunnel address.
-        ApplyVpnPeer::dispatch($oldKey, null, false, force: true);
-        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, true);
-
-        $this->dismissConfig();
-        $this->configToken = ConfigHandoff::put($config);
-        $this->newConfigName = $peer->name;
-
-        $this->dispatch('notify', message: __('vpn.reissued'));
-    }
-
-    public function dismissConfig(): void
-    {
-        ConfigHandoff::forget($this->configToken);
-        $this->reset('configToken', 'newConfigName', 'showQr');
-    }
-
-    /**
-     * The list this operator is allowed to see: their own accesses, plus
-     * everything when they hold vpn.view.all. Filtering in the query as well as
-     * in the actions, so a forged uuid cannot reach a peer the page never showed.
-     */
-    private function visiblePeers()
-    {
-        $query = VpnPeer::query();
-
-        if (! auth()->user()?->can('vpn.view.all')) {
-            $query->where('kind', VpnPeer::KIND_STAFF)->where('user_id', auth()->id());
-        }
-
-        return $query;
-    }
-
-    public function toggleQr(): void
-    {
-        $this->showQr = ! $this->showQr;
-    }
-
-    /**
-     * wg-quick takes the interface name from the filename, and Linux caps
-     * interface names at 15 characters — so the label is slugged and cut rather
-     * than handing the operator a file that fails to come up.
-     */
-    public function configFilename(): string
-    {
-        $slug = Str::slug((string) $this->newConfigName) ?: 'clupilot';
-
-        return Str::limit($slug, 15, '').'.conf';
-    }
-
-    /** Polled by the view; throttled so a room full of open tabs cannot flood the queue. */
-    public function refreshPeers(): void
-    {
-        if (Cache::add('vpn:sync-dispatched', true, 8)) {
-            SyncVpnPeers::dispatch();
-        }
-    }
-
-    private function clientConfig(Keypair $keypair, string $ip): string
-    {
-        $hub = app(WireguardHub::class);
-
-        return implode("\n", [
-            '[Interface]',
-            'PrivateKey = '.$keypair->privateKey,
-            'Address = '.$ip.'/32',
-            '',
-            '[Peer]',
-            'PublicKey = '.$hub->publicKey(),
-            'Endpoint = '.$hub->endpoint(),
-            'AllowedIPs = '.config('provisioning.wireguard.subnet', '10.66.0.0/24'),
-            'PersistentKeepalive = 25',
-            '',
-        ]);
-    }
-
-    public function render()
-    {
-        $hub = app(WireguardHub::class);
-
-        return view('livewire.admin.vpn', [
-            'newConfig' => $config = ConfigHandoff::get($this->configToken),
-            'qrSvg' => $this->showQr && $config !== null ? QrCode::svg($config) : null,
-            'peers' => $this->visiblePeers()->with(['host', 'owner'])->orderByDesc('present')->orderBy('name')->get(),
-            'operators' => User::query()
-                ->whereHas('roles', fn ($q) => $q->whereIn('name', User::OPERATOR_ROLES))
-                ->orderBy('name')->get(['id', 'name', 'email']),
-            'canManage' => auth()->user()?->can('vpn.manage.all') ?? false,
-            'vaultAvailable' => ConfigVault::available(),
-            'hubEndpoint' => $hub->endpoint(),
-            'hubPublicKey' => $hub->publicKey(),
-            'lastSync' => VpnPeer::query()->max('observed_at'),
-        ]);
-    }
-}

app/Livewire/Admin/VpnConfigAccess.php

@@ -1,133 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\VpnPeer;
-use App\Services\Wireguard\ConfigHandoff;
-use App\Services\Wireguard\ConfigVault;
-use App\Services\Wireguard\QrCode;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Gate;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Log;
-use Illuminate\Support\Facades\RateLimiter;
-use Illuminate\Support\Str;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Retrieving a stored VPN config again, behind the owner's own password.
- *
- * The password is asked for on EVERY retrieval, not once per session: Laravel's
- * password.confirm middleware keeps a 15-minute session stamp, which would
- * authorise unlimited later downloads from an unattended browser — not what
- * "enter your password to download it" means.
- */
-class VpnConfigAccess extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public string $password = '';
-
-    /** Opaque handle; the plaintext never enters the component snapshot. */
-    public ?string $token = null;
-
-    public bool $showQr = false;
-
-    public function mount(string $uuid): void
-    {
-        $peer = VpnPeer::query()->where('uuid', $uuid)->firstOrFail();
-        $this->authorize('downloadConfig', $peer);
-
-        $this->uuid = $uuid;
-        $this->name = $peer->name;
-    }
-
-    /**
-     * Every later request re-checks: once revealed, the plaintext sits in the
-     * handoff cache for ten minutes, and an open modal would otherwise keep
-     * handing it out after the access was revoked or reassigned — exactly the
-     * window purgeSecret() exists to close.
-     */
-    public function hydrate(): void
-    {
-        $peer = VpnPeer::withTrashed()->where('uuid', $this->uuid)->first();
-
-        if ($peer === null || Gate::denies('downloadConfig', $peer)) {
-            ConfigHandoff::forget($this->token);
-            $this->token = null;
-            abort(403);
-        }
-    }
-
-    public function reveal(): void
-    {
-        // A retry must not still be showing the previous attempt's complaint.
-        $this->resetErrorBag('password');
-
-        $peer = VpnPeer::query()->where('uuid', $this->uuid)->firstOrFail();
-        $this->authorize('downloadConfig', $peer);
-
-        // Rate-limited per user, so a stolen session cannot grind the password.
-        $key = 'vpn-config:'.auth()->id();
-        if (RateLimiter::tooManyAttempts($key, 5)) {
-            $this->addError('password', __('vpn.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]));
-
-            return;
-        }
-
-        if (! Hash::check($this->password, auth()->user()->password)) {
-            RateLimiter::hit($key, 300);
-            Log::warning('VPN config download refused: wrong password', [
-                'user_id' => auth()->id(), 'peer' => $peer->uuid,
-            ]);
-            $this->addError('password', __('vpn.wrong_password'));
-
-            return;
-        }
-
-        RateLimiter::clear($key);
-
-        $plaintext = ConfigVault::decrypt((string) $peer->config_secret);
-        if ($plaintext === null) {
-            // Wrong or rotated key, or a tampered record. Never guess.
-            $this->addError('password', __('vpn.config_unreadable'));
-
-            return;
-        }
-
-        // Counted in the database, not read-modify-written here: two concurrent
-        // retrievals would otherwise record one. This is an audit trail, so
-        // under-reporting is the one failure mode it must not have.
-        VpnPeer::query()->whereKey($peer->getKey())->update([
-            'last_downloaded_at' => now(),
-            'download_count' => DB::raw('download_count + 1'),
-        ]);
-
-        Log::info('VPN config downloaded', ['user_id' => auth()->id(), 'peer' => $peer->uuid]);
-
-        $this->reset('password');
-        $this->token = ConfigHandoff::put($plaintext);
-    }
-
-    public function toggleQr(): void
-    {
-        $this->showQr = ! $this->showQr;
-    }
-
-    public function filename(): string
-    {
-        return Str::limit(Str::slug($this->name) ?: 'clupilot', 15, '').'.conf';
-    }
-
-    public function render()
-    {
-        $config = ConfigHandoff::get($this->token);
-
-        return view('livewire.admin.vpn-config-access', [
-            'config' => $config,
-            'qrSvg' => $config !== null && $this->showQr ? QrCode::svg($config) : null,
-        ]);
-    }
-}

app/Livewire/Auth/Login.php

@@ -1,15 +0,0 @@
-<?php
-
-namespace App\Livewire\Auth;
-
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal')]
-class Login extends Component
-{
-    public function render()
-    {
-        return view('livewire.auth.login');
-    }
-}

app/Livewire/Auth/Register.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace App\Livewire\Auth;
-
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-/**
- * Full-page signup view (R1/R2). The POST is handled by Fortify's registration
- * feature (register.store → App\Actions\Fortify\CreateNewUser).
- */
-#[Layout('layouts.portal')]
-class Register extends Component
-{
-    public function render()
-    {
-        return view('livewire.auth.register');
-    }
-}

app/Livewire/Auth/TwoFactorChallenge.php

@@ -1,15 +0,0 @@
-<?php
-
-namespace App\Livewire\Auth;
-
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal')]
-class TwoFactorChallenge extends Component
-{
-    public function render()
-    {
-        return view('livewire.auth.two-factor-challenge');
-    }
-}

app/Livewire/Backups.php

@@ -1,58 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Backups extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $gb = fn (float $v) => Number::format($v, precision: 1, locale: $locale).' GB';
-        $date = fn (string $iso, string $fmt) => Carbon::parse($iso)->locale($locale)->isoFormat($fmt);
-
-        // 14 days of backup sizes for the bar chart.
-        $sizes = [18.1, 18.1, 18.2, 18.2, 18.2, 18.3, 18.3, 18.3, 18.3, 18.4, 18.4, 18.3, 18.4, 18.4];
-
-        $rows = [];
-        foreach (range(0, 6) as $i) {
-            $rows[] = [
-                'when' => $date(Carbon::parse('2026-07-24')->subDays($i)->toDateString(), 'dd, D. MMMM').', 03:1'.($i % 3 + 1),
-                'size' => $gb(18.4 - $i * 0.02),
-                'status' => 'ok',
-            ];
-        }
-
-        return view('livewire.backups', [
-            'rows' => $rows,
-            'lastTest' => $date('2026-07-01', 'LL'),
-            'sizeChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => array_map(fn ($i) => $date(Carbon::parse('2026-07-24')->subDays(13 - $i)->toDateString(), 'D.'), range(0, 13)),
-                    'datasets' => [[
-                        'label' => 'GB',
-                        'data' => $sizes,
-                        'borderColor' => 'token:accent',
-                        'fill' => true,
-                        'tension' => 0.35,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['grid' => ['display' => false]],
-                        'y' => ['beginAtZero' => false, 'grid' => ['color' => 'token:border']],
-                    ],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-        ]);
-    }
-}

app/Livewire/Billing.php

@@ -1,183 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Customer;
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Services\Billing\AddonCatalogue;
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Support\Facades\DB;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Billing extends Component
-{
-    use ResolvesCustomer;
-
-    /**
-     * Record a purchase intent (order). Fulfillment (Stripe checkout + resize) is
-     * mocked for now — the order is created with status 'pending'.
-     */
-    public function purchase(string $type, ?string $key = null): void
-    {
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        $instance = $customer->instances()->latest('id')->first();
-        $currentPlan = $instance?->plan ?? 'start';
-        $plans = app(PlanCatalogue::class)->sellable();
-        $addons = (array) config('provisioning.addons');
-
-        [$plan, $amount, $addonKey] = match ($type) {
-            'upgrade' => [$key, (int) ($plans[$key]['price_cents'] ?? 0), null],
-            'storage' => [$currentPlan, (int) config('provisioning.storage_addon.price_cents', 0), null],
-            'traffic' => [$currentPlan, (int) config('provisioning.traffic.addon.price_cents', 0), null],
-            'addon' => [$currentPlan, (int) ($addons[$key]['price_cents'] ?? 0), $key],
-            default => [null, 0, null],
-        };
-
-        // Guard against invalid keys / non-upgrades.
-        $valid = match ($type) {
-            // By rank, matching PlanChange and the cards on the page. Comparing
-            // prices would call a grandfathered plan an upgrade to a smaller
-            // one and charge for the privilege.
-            'upgrade' => isset($plans[$key])
-                && (int) ($plans[$key]['tier'] ?? 0) > (int) ($instance?->subscription?->tier ?? $plans[$currentPlan]['tier'] ?? 0),
-            'storage' => true,
-            // Always available: running out of traffic is exactly when someone
-            // needs to be able to buy more, whatever plan they are on.
-            'traffic' => true,
-            'addon' => isset($addons[$key]),
-            default => false,
-        };
-        if (! $valid || $plan === null) {
-            return;
-        }
-
-        $datacenter = $instance?->host?->datacenter
-            ?? $customer->orders()->latest('id')->value('datacenter')
-            ?? 'fsn';
-
-        // A cart cannot hold two plan changes: they contradict each other and no
-        // checkout could resolve which one the customer meant. Choosing another
-        // replaces the pending one — add-ons still stack.
-        //
-        // Replacement and insert run together with the customer row locked:
-        // two clicks in flight could otherwise both delete and then both
-        // insert, leaving exactly the two upgrades this rule exists to prevent.
-        $replaced = DB::transaction(function () use ($customer, $type, $plan, $addonKey, $amount, $datacenter) {
-            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-
-            $replaced = $type === 'upgrade'
-                ? Order::query()
-                    ->where('customer_id', $customer->id)
-                    ->where('status', 'pending')
-                    ->where('type', 'upgrade')
-                    ->delete()
-                : 0;
-
-            Order::create([
-                'customer_id' => $customer->id,
-                'plan' => $plan,
-                'type' => $type,
-                'addon_key' => $addonKey,
-                'amount_cents' => $amount,
-                'currency' => 'EUR',
-                'datacenter' => $datacenter,
-                'status' => 'pending',
-            ]);
-
-            return $replaced;
-        });
-
-        if ($replaced > 0) {
-            $this->dispatch('notify', message: __('billing.cart.plan_replaced'));
-        }
-
-        $this->dispatch('notify', message: __('billing.purchased'));
-    }
-
-    #[\Livewire\Attributes\On('order-removed')]
-    public function orderRemoved(): void
-    {
-        $this->dispatch('notify', message: __('billing.cart.removed'));
-    }
-
-    /**
-     * The terms to show as "your plan": the contract if there is one, and only
-     * otherwise the catalogue — someone browsing before they have bought.
-     *
-     * @param  array<string, mixed>  $catalogue
-     * @return array<string, mixed>
-     */
-    private function currentTerms(?Subscription $subscription, array $catalogue): array
-    {
-        if ($subscription === null) {
-            return $catalogue;
-        }
-
-        return [
-            'tier' => $subscription->tier,
-            // Per month: the card says "/ month", and a yearly contract stores
-            // the whole year.
-            'price_cents' => $subscription->monthlyPriceCents(),
-            'currency' => $subscription->currency,
-            'quota_gb' => $subscription->quota_gb,
-            'traffic_gb' => $subscription->traffic_gb,
-            'seats' => $subscription->seats,
-            'performance' => $subscription->performance,
-            'features' => $subscription->planVersion?->features ?? ($catalogue['features'] ?? []),
-        ];
-    }
-
-    public function render()
-    {
-        $customer = $this->customer();
-        $instance = $customer?->instances()->latest('id')->first();
-        $plans = app(PlanCatalogue::class)->sellable();
-        $currentKey = $instance?->plan ?? 'start';
-
-        // Rank, not price: a grandfathered plan can cost less than a smaller
-        // one does today, and offering that as an "upgrade" would charge a
-        // customer immediately for losing resources.
-        $currentTier = (int) ($instance?->subscription?->tier ?? $plans[$currentKey]['tier'] ?? 0);
-
-        $upgrades = collect($plans)
-            ->filter(fn ($p) => (int) ($p['tier'] ?? 0) > $currentTier)
-            ->keys()->all();
-
-        return view('livewire.billing', [
-            'currentKey' => $currentKey,
-            // What they HAVE comes from their contract; only what they could
-            // BUY comes from the shop. Reading this off the catalogue showed a
-            // customer today's price as though it were theirs, and dropped the
-            // card entirely once their plan stopped being sold.
-            'current' => $this->currentTerms($instance?->subscription, $plans[$currentKey] ?? []),
-            'instance' => $instance,
-            'plans' => $plans,
-            'features' => collect($plans)->map(fn ($p) => $p['features'] ?? [])->all(),
-            'upgrades' => $upgrades,
-            'storage' => (array) config('provisioning.storage_addon'),
-            'trafficAddon' => (array) config('provisioning.traffic.addon'),
-            // Resolved once: the cart and the plan cards must not state
-            // different tax treatments on the same page.
-            'tax' => \App\Services\Billing\TaxTreatment::for($customer),
-            'trafficMeter' => $instance !== null ? \App\Services\Traffic\TrafficMeter::for($instance) : null,
-            // Booked modules at the price they were booked at; everything else
-            // at today's. Reading them all off the catalogue would re-price
-            // half a customer's bill behind their back.
-            'addons' => collect(app(AddonCatalogue::class)->forSubscription($instance?->subscription))
-                ->except(AddonCatalogue::STORAGE)
-                ->all(),
-            'totalMonthlyCents' => $instance?->subscription?->totalMonthlyCents(),
-            'pending' => $customer
-                ? $customer->orders()->where('status', 'pending')->latest('id')->get()
-                : collect(),
-        ]);
-    }
-}

app/Livewire/Cloud.php

@@ -1,91 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\MaintenanceWindow;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Cloud extends Component
-{
-    use ResolvesCustomer;
-
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $growth = [180, 188, 195, 199, 204, 210, 214, 219, 223, 228, 231, 235];
-
-        // The card is built from the customer's real service instance, so the
-        // maintenance badge below can be scoped to exactly that instance's host.
-        $customer = $this->customer();
-        $shown = $customer?->instances()
-            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
-            ->latest('id')->first();
-        $maintenance = MaintenanceWindow::forInstance($shown)->first();
-
-        // The instance carries what was actually provisioned, and the contract
-        // what was bought. Neither is the catalogue, which only describes what
-        // we would sell someone new — never what this customer already has.
-        $contract = $shown?->subscription;
-        $planKey = $shown?->plan ?? 'team';
-        $quota = (int) ($shown?->quota_gb ?? $contract?->quota_gb ?? 500);
-        // Usage metering is not wired yet — scale the illustrative curve into the
-        // instance's quota so the chart and the "x / y GB" label never disagree.
-        $curveMax = max($growth);
-        if ($curveMax > $quota) {
-            $growth = array_map(fn ($v) => (int) round($v / $curveMax * $quota), $growth);
-        }
-        $used = $growth[count($growth) - 1];
-        $domain = $shown?->custom_domain
-            ?: ($shown?->subdomain ? $shown->subdomain.'.'.config('provisioning.dns.zone', 'clupilot.com') : 'cloud.example.com');
-
-        return view('livewire.cloud', [
-            'instance' => [
-                'name' => $customer ? __('cloud.instance_name', ['name' => $customer->name]) : __('cloud.title'),
-                'domain' => $domain,
-                'status' => $shown->status ?? 'active',
-                'plan' => __('cloud.plan_line', [
-                    'plan' => 'CluPilot Cloud '.__('billing.plan.'.$planKey),
-                    // The line ends in "/mo", so a yearly contract has to be
-                    // divided down before it goes in.
-                    'price' => (int) round(($contract?->monthlyPriceCents() ?? 0) / 100),
-                ]),
-                'location' => __('cloud.datacenter'),
-                'version' => 'Nextcloud 31.0.4',
-                'php' => 'PHP 8.3 · MariaDB 11.4',
-                'storageUsed' => $used,
-                'storageQuota' => $quota,
-                'seats' => __('billing.seats_count', ['count' => $contract?->seats ?? 0]),
-                'performance' => __('billing.perf.'.($contract?->performance ?? 'standard')),
-            ],
-            'storageChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => ['', '', '', '', '', '', '', '', '', '', '', __('cloud.now')],
-                    'datasets' => [[
-                        'label' => 'GB',
-                        'data' => $growth,
-                        'borderColor' => 'token:accent',
-                        'backgroundColor' => 'token:accent/0.10',
-                        'fill' => true,
-                        'tension' => 0.35,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['grid' => ['display' => false]],
-                        'y' => ['beginAtZero' => false, 'grid' => ['color' => 'token:border']],
-                    ],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-            'storageLabel' => Number::format($used, locale: $locale).' / '.Number::format($quota, locale: $locale).' GB',
-            'maintenance' => $maintenance,
-        ]);
-    }
-}

app/Livewire/Concerns/BuildsRunSteps.php

@@ -1,56 +0,0 @@
-<?php
-
-namespace App\Livewire\Concerns;
-
-use App\Models\ProvisioningRun;
-
-/**
- * Builds the {label, state} array a progress stepper renders from a run's
- * pipeline + current step + status. Shared by admin and customer views.
- */
-trait BuildsRunSteps
-{
-    /** @return array<int, array{label: string, state: string}> */
-    protected function buildRunSteps(?ProvisioningRun $run): array
-    {
-        if ($run === null) {
-            return [];
-        }
-
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $current = $run->current_step;
-        $status = $run->status;
-
-        $steps = [];
-        foreach ($pipeline as $index => $class) {
-            if ($status === ProvisioningRun::STATUS_COMPLETED || $index < $current) {
-                $state = 'done';
-            } elseif ($index === $current) {
-                $state = $status === ProvisioningRun::STATUS_FAILED ? 'failed' : 'running';
-            } else {
-                $state = 'pending';
-            }
-
-            $steps[] = ['label' => __(app($class)->label()), 'state' => $state];
-        }
-
-        return $steps;
-    }
-
-    protected function currentStepLabel(ProvisioningRun $run): string
-    {
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $class = $pipeline[$run->current_step] ?? null;
-
-        return $class ? __(app($class)->label()) : '—';
-    }
-
-    protected function runState(ProvisioningRun $run): string
-    {
-        return match ($run->status) {
-            ProvisioningRun::STATUS_COMPLETED => 'done',
-            ProvisioningRun::STATUS_FAILED => 'failed',
-            default => 'running',
-        };
-    }
-}

app/Livewire/Concerns/ResolvesCustomer.php

@@ -1,39 +0,0 @@
-<?php
-
-namespace App\Livewire\Concerns;
-
-use App\Models\Customer;
-
-/**
- * Resolves the customer behind the signed-in portal user.
- *
- * Operator accounts (admins) have no Customer, so customer-scoped actions must
- * NOT silently no-op — that reads as a dead button. requireCustomer() surfaces
- * an explicit message instead and returns null so the caller can bail.
- */
-trait ResolvesCustomer
-{
-    protected function customer(): ?Customer
-    {
-        $user = auth()->user();
-        if (! $user) {
-            return null;
-        }
-
-        // Prefer the explicit link; fall back to email for legacy unlinked accounts.
-        return Customer::query()->where('user_id', $user->id)->first()
-            ?? Customer::query()->where('email', $user->email)->first();
-    }
-
-    /** Same as customer(), but tells the user why nothing happened. */
-    protected function requireCustomer(): ?Customer
-    {
-        $customer = $this->customer();
-
-        if ($customer === null) {
-            $this->dispatch('notify', message: __('dashboard.no_customer_action'));
-        }
-
-        return $customer;
-    }
-}

app/Livewire/ConfirmCancelPackage.php

@@ -1,78 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Instance;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Cancel the customer's package (R5). Per the founder's decision: effective at
- * the end of the billing term, irreversible once confirmed; at term end the
- * customer receives a finished data export, then the instance is deprovisioned
- * (both mocked for now). Requires typing the instance subdomain to confirm.
- */
-class ConfirmCancelPackage extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $confirmName = '';
-
-    public function cancelPackage()
-    {
-        $customer = $this->customer();
-        // Target the ACTIVE package explicitly — a newer failed/deprovisioned
-        // record must not shadow an older active instance (v1: one active/customer).
-        $instance = $customer?->instances()->where('status', 'active')->latest('id')->first();
-
-        if ($instance === null) {
-            // Explain rather than silently closing: no customer behind this login
-            // (e.g. an operator account) or no active package to cancel.
-            $this->addError('confirmName', __($customer === null ? 'dashboard.no_customer_action' : 'settings.no_package'));
-
-            return null;
-        }
-
-        // Typed confirmation must match the instance subdomain.
-        if (trim($this->confirmName) !== (string) $instance->subdomain) {
-            $this->addError('confirmName', __('settings.cancel_mismatch'));
-
-            return;
-        }
-
-        $instance->update([
-            'status' => 'cancellation_scheduled',
-            'cancel_requested_at' => now(),
-            'service_ends_at' => $this->currentPeriodEnd($instance),
-        ]);
-
-        return $this->redirectRoute('settings', navigate: true);
-    }
-
-    /**
-     * End of the current monthly billing period, anchored on the subscription
-     * start (the order date) rather than assuming calendar-month billing.
-     */
-    private function currentPeriodEnd(Instance $instance): \Illuminate\Support\Carbon
-    {
-        $start = $instance->order?->created_at ?? $instance->created_at ?? now();
-
-        // Always add from the immutable start so the billing-day anchor is kept
-        // (chaining addMonth would drift a Jan-31 start to Feb-28 → Mar-28).
-        $months = 1;
-        while ($start->copy()->addMonthsNoOverflow($months)->lessThanOrEqualTo(now())) {
-            $months++;
-        }
-
-        return $start->copy()->addMonthsNoOverflow($months);
-    }
-
-    public function render()
-    {
-        $instance = $this->customer()?->instances()->where('status', 'active')->latest('id')->first();
-
-        return view('livewire.confirm-cancel-package', [
-            'subdomain' => $instance?->subdomain ?? '',
-        ]);
-    }
-}

app/Livewire/ConfirmCloseAccount.php

@@ -1,65 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Customer;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Close the whole CluPilot account (R5). Guarded: only allowed when no active
- * package remains — an active subscription must be cancelled first. Sets
- * closed_at; financial records are retained. Requires typing "LOESCHEN".
- */
-class ConfirmCloseAccount extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $confirmWord = '';
-
-    public function closeAccount()
-    {
-        $customer = $this->customer();
-        // No customer behind this login (e.g. an operator account) — say so
-        // instead of leaving the button looking broken.
-        if ($customer === null) {
-            $this->addError('confirmWord', __('dashboard.no_customer_action'));
-
-            return null;
-        }
-
-        if ($this->hasActivePackage($customer)) {
-            $this->addError('confirmWord', __('settings.close_blocked'));
-
-            return;
-        }
-
-        if (mb_strtoupper(trim($this->confirmWord)) !== __('settings.close_keyword')) {
-            $this->addError('confirmWord', __('settings.close_mismatch'));
-
-            return;
-        }
-
-        $customer->update(['closed_at' => now(), 'status' => 'closed']);
-
-        return $this->redirectRoute('settings', navigate: true);
-    }
-
-    private function hasActivePackage(Customer $customer): bool
-    {
-        // Only genuinely-live packages block closure — a failed/cancelled/
-        // deprovisioned instance does not retain a service.
-        return $customer->instances()
-            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
-            ->exists();
-    }
-
-    public function render()
-    {
-        $customer = $this->customer();
-
-        return view('livewire.confirm-close-account', [
-            'blocked' => $customer !== null && $this->hasActivePackage($customer),
-        ]);
-    }
-}

app/Livewire/ConfirmRemoveOrder.php

@@ -1,73 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Order;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Taking a not-yet-paid purchase back out of the cart.
- *
- * Scoped to the signed-in customer's own orders: modals are reachable without
- * the page's own guards, so the ownership check belongs here, not in the view
- * that happens to link to it.
- */
-class ConfirmRemoveOrder extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $uuid;
-
-    public string $label = '';
-
-    public int $amountCents = 0;
-
-    public function mount(string $uuid): void
-    {
-        $order = $this->order($uuid);
-        abort_if($order === null, 404);
-
-        $this->uuid = $uuid;
-        $this->label = $order->label();
-        $this->amountCents = $order->amount_cents;
-    }
-
-    public function remove(): void
-    {
-        $order = $this->order($this->uuid);
-
-        // Gone or already paid for: say so instead of pretending it worked.
-        if ($order === null) {
-            $this->dispatch('notify', message: __('billing.cart.gone'));
-            $this->closeModal();
-
-            return;
-        }
-
-        $order->delete();
-
-        $this->dispatch('order-removed');
-        $this->closeModal();
-    }
-
-    /** @return Order|null the customer's own, still-pending order */
-    private function order(string $uuid): ?Order
-    {
-        $customer = $this->customer();
-        if ($customer === null) {
-            return null;
-        }
-
-        return Order::query()
-            ->where('customer_id', $customer->id)
-            ->where('uuid', $uuid)
-            ->where('status', 'pending')
-            ->first();
-    }
-
-    public function render()
-    {
-        return view('livewire.confirm-remove-order');
-    }
-}

app/Livewire/CustomerProvisioning.php

@@ -1,59 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\BuildsRunSteps;
-use App\Models\Customer;
-use App\Models\Order;
-use App\Models\ProvisioningRun;
-use Livewire\Component;
-
-/**
- * Embedded live provisioning progress for the logged-in customer's order.
- * Polls only itself so the dashboard's charts don't churn. Renders nothing once
- * provisioning has completed.
- */
-class CustomerProvisioning extends Component
-{
-    use BuildsRunSteps;
-
-    private function currentRun(): ?ProvisioningRun
-    {
-        $user = auth()->user();
-        if ($user === null) {
-            return null;
-        }
-
-        $customer = Customer::query()->where('email', $user->email)->first();
-        if ($customer === null) {
-            return null;
-        }
-
-        return ProvisioningRun::query()
-            ->where('subject_type', Order::class)
-            ->whereIn('subject_id', $customer->orders()->select('id'))
-            ->latest('id')
-            ->first();
-    }
-
-    public function render()
-    {
-        $run = $this->currentRun();
-
-        // Show the card while provisioning is in flight OR terminally failed; but
-        // only POLL while it can still change (terminal failed must not poll forever).
-        $show = $run !== null && $run->status !== ProvisioningRun::STATUS_COMPLETED;
-        $polling = $run !== null && in_array($run->status, [
-            ProvisioningRun::STATUS_PENDING,
-            ProvisioningRun::STATUS_RUNNING,
-            ProvisioningRun::STATUS_WAITING,
-        ], true);
-
-        return view('livewire.customer-provisioning', [
-            'active' => $show,
-            'polling' => $polling,
-            'failed' => $run?->status === ProvisioningRun::STATUS_FAILED,
-            'steps' => $show ? $this->buildRunSteps($run) : [],
-        ]);
-    }
-}

app/Livewire/Dashboard.php

@@ -1,133 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Services\Traffic\TrafficMeter;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Dashboard extends Component
-{
-    use ResolvesCustomer;
-
-    public function render()
-    {
-        // Real numbers where they exist: traffic is metered, unlike the
-        // fixtures below, and a customer needs to see it before it runs out.
-        $instance = $this->customer()?->instances()->latest('id')->first();
-        $traffic = $instance !== null ? TrafficMeter::for($instance) : null;
-
-        // Locale-aware date / number formatting for the fixture values below.
-        $locale = app()->getLocale();
-        $date = fn (string $iso, string $fmt) => Carbon::parse($iso)->locale($locale)->isoFormat($fmt);
-        $gb = fn (float $v) => Number::format($v, precision: 1, locale: $locale).' GB';
-        // Fixture data until the provisioning engine (separate handoff) supplies
-        // real instances / metrics. Tenant-specific values stand in for DB rows.
-        $storageUsed = 235;
-        $storageQuota = 500;
-        $storagePercent = (int) round($storageUsed / max(1, $storageQuota) * 100);
-
-        // ~30 days of availability, gently trending near 100%.
-        $availability = [99.95, 99.97, 99.96, 99.98, 99.99, 99.97, 99.98, 99.99, 99.99, 99.98,
-            99.97, 99.99, 100, 99.98, 99.99, 99.99, 99.97, 99.98, 99.99, 100,
-            99.98, 99.99, 99.99, 99.98, 100, 99.99, 99.98, 99.99, 100, 99.98];
-
-        return view('livewire.dashboard', [
-            'traffic' => $traffic,
-            'storageUsed' => $storageUsed,
-            'storageQuota' => $storageQuota,
-            'storagePercent' => $storagePercent,
-            'usersActive' => 8,
-            'usersQuota' => 20,
-            'lastBackup' => '03:12',
-            'availability' => Number::format(99.98, precision: 2, locale: $locale),
-
-            'storageChart' => [
-                'type' => 'doughnut',
-                'data' => [
-                    'datasets' => [[
-                        'data' => [$storagePercent, 100 - $storagePercent],
-                        'backgroundColor' => ['token:accent', 'token:surface-2'],
-                        'borderWidth' => 0,
-                    ]],
-                ],
-                'options' => [
-                    'cutout' => '76%',
-                    'plugins' => [
-                        'legend' => ['display' => false],
-                        'tooltip' => ['enabled' => false],
-                    ],
-                ],
-            ],
-
-            'availabilityChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => array_fill(0, count($availability), ''),
-                    'datasets' => [[
-                        'data' => $availability,
-                        'borderColor' => 'token:success-bright',
-                        'backgroundColor' => 'token:success-bright/0.12',
-                        'fill' => true,
-                        'tension' => 0.4,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['display' => false],
-                        'y' => ['display' => false, 'min' => 99.9, 'max' => 100],
-                    ],
-                    'plugins' => [
-                        'legend' => ['display' => false],
-                        'tooltip' => ['enabled' => false],
-                    ],
-                ],
-            ],
-
-            'cloud' => [
-                'name' => 'Cloud der Kanzlei Berger',
-                'domain' => 'cloud.kanzlei-berger.at',
-                'package' => __('dashboard.cloud.plan_line', ['plan' => 'CluPilot Cloud Team', 'price' => 179]),
-                'since' => $date('2026-03-14', 'LL'),
-                'location' => __('dashboard.cloud.datacenter'),
-                'version' => 'Nextcloud 31.0.4',
-            ],
-
-            'onboarding' => [
-                ['label' => __('dashboard.onboarding.instance'), 'done' => true, 'date' => $date('2026-03-14', 'D. MMMM')],
-                ['label' => __('dashboard.onboarding.domain'), 'done' => true, 'date' => $date('2026-03-15', 'D. MMMM')],
-                ['label' => __('dashboard.onboarding.branding'), 'done' => true, 'date' => $date('2026-03-15', 'D. MMMM')],
-                ['label' => __('dashboard.onboarding.users'), 'done' => true, 'date' => $date('2026-03-16', 'D. MMMM')],
-                ['label' => __('dashboard.onboarding.migration'), 'done' => false, 'date' => null],
-                ['label' => __('dashboard.onboarding.training'), 'done' => false, 'date' => null],
-                ['label' => __('dashboard.onboarding.docs'), 'done' => false, 'date' => null],
-            ],
-
-            'backups' => [
-                ['when' => __('dashboard.today').', 03:12', 'size' => $gb(18.4)],
-                ['when' => __('dashboard.yesterday').', 03:09', 'size' => $gb(18.4)],
-                ['when' => $date('2026-07-21', 'D. MMMM').', 03:11', 'size' => $gb(18.3)],
-            ],
-
-            'modules' => [
-                ['icon' => 'cloud', 'name' => 'Nextcloud + Collabora', 'desc' => __('dashboard.modules.nextcloud'), 'status' => 'active'],
-                ['icon' => 'shield-check', 'name' => 'Vaultwarden', 'desc' => __('dashboard.modules.vaultwarden'), 'status' => 'active'],
-                ['icon' => 'receipt', 'name' => 'Paperless-ngx', 'desc' => __('dashboard.modules.paperless'), 'status' => 'available'],
-                ['icon' => 'pen', 'name' => __('dashboard.modules.signature_name'), 'desc' => __('dashboard.modules.signature'), 'status' => 'soon'],
-            ],
-
-            'activity' => [
-                ['icon' => 'download', 'text' => __('dashboard.activity_items.backup_ok'), 'time' => '03:12'],
-                ['icon' => 'shield-check', 'text' => __('dashboard.activity_items.security'), 'time' => '04:01'],
-                ['icon' => 'users', 'text' => __('dashboard.activity_items.upload'), 'time' => '07:56'],
-                ['icon' => 'shield-check', 'text' => __('dashboard.activity_items.cert'), 'time' => __('dashboard.yesterday').' 22:10'],
-            ],
-        ]);
-    }
-}

app/Livewire/Invoices.php

@@ -1,58 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Invoices extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $eur = fn (float $v) => Number::currency($v, in: 'EUR', locale: $locale);
-        $date = fn (string $iso) => Carbon::parse($iso)->locale($locale)->isoFormat('LL');
-
-        $months = collect(['2026-03-01', '2026-04-01', '2026-05-01', '2026-06-01', '2026-07-01'])
-            ->map(fn ($m) => Carbon::parse($m)->locale($locale)->isoFormat('MMM'))->all();
-
-        $rows = [
-            ['no' => 'CP-2026-0007', 'date' => $date('2026-07-01'), 'amount' => $eur(198), 'status' => 'paid'],
-            ['no' => 'CP-2026-0006', 'date' => $date('2026-06-01'), 'amount' => $eur(198), 'status' => 'paid'],
-            ['no' => 'CP-2026-0005', 'date' => $date('2026-05-01'), 'amount' => $eur(198), 'status' => 'paid'],
-            ['no' => 'CP-2026-0004', 'date' => $date('2026-04-01'), 'amount' => $eur(179), 'status' => 'paid'],
-            ['no' => 'CP-2026-0003', 'date' => $date('2026-03-15'), 'amount' => $eur(179), 'status' => 'paid'],
-        ];
-
-        return view('livewire.invoices', [
-            'rows' => $rows,
-            'nextCharge' => $date('2026-08-01'),
-            'nextAmount' => $eur(198),
-            'spendChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => $months,
-                    'datasets' => [[
-                        'label' => 'EUR',
-                        'data' => [179, 179, 198, 198, 198],
-                        'borderColor' => 'token:accent',
-                        'fill' => true,
-                        'tension' => 0.35,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['grid' => ['display' => false]],
-                        'y' => ['beginAtZero' => true, 'grid' => ['color' => 'token:border']],
-                    ],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-        ]);
-    }
-}

app/Livewire/Settings.php

@@ -1,162 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use Illuminate\Support\Facades\Storage;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-use Livewire\WithFileUploads;
-
-class Settings extends Component
-{
-    use ResolvesCustomer, WithFileUploads;
-
-    // Company / billing profile
-    #[Validate('required|string|max:255')]
-    public string $companyName = '';
-
-    #[Validate('nullable|string|max:255')]
-    public string $contactName = '';
-
-    #[Validate('nullable|string|max:64')]
-    public string $phone = '';
-
-    #[Validate('nullable|string|max:64')]
-    public string $vatId = '';
-
-    #[Validate('nullable|string|max:2000')]
-    public string $billingAddress = '';
-
-    // Branding
-    #[Validate('nullable|string|max:255')]
-    public string $brandDisplayName = '';
-
-    #[Validate('nullable|regex:/^#[0-9a-fA-F]{6}$/')]
-    public string $brandPrimary = '';
-
-    #[Validate('nullable|regex:/^#[0-9a-fA-F]{6}$/')]
-    public string $brandAccent = '';
-
-    /** New logo upload (validated on save). */
-    public $logo = null;
-
-    public ?string $brandLogoPath = null;
-
-    public function mount(): void
-    {
-        $c = $this->customer();
-        if ($c === null) {
-            return;
-        }
-        $this->companyName = $c->name ?? '';
-        $this->contactName = $c->contact_name ?? '';
-        $this->phone = $c->phone ?? '';
-        $this->vatId = $c->vat_id ?? '';
-        $this->billingAddress = $c->billing_address ?? '';
-        $this->brandDisplayName = $c->brand_display_name ?? '';
-        $this->brandPrimary = $c->brand_primary_color ?? '';
-        $this->brandAccent = $c->brand_accent_color ?? '';
-        $this->brandLogoPath = $c->brand_logo_path;
-    }
-
-    public function saveProfile(): void
-    {
-        $c = $this->requireCustomer();
-        if ($c === null) {
-            return;
-        }
-
-        $this->validateOnly('companyName');
-        $data = $this->validate([
-            'companyName' => 'required|string|max:255',
-            'contactName' => 'nullable|string|max:255',
-            'phone' => 'nullable|string|max:64',
-            'vatId' => 'nullable|string|max:64',
-            'billingAddress' => 'nullable|string|max:2000',
-        ]);
-
-        $c->update([
-            'name' => $data['companyName'],
-            'contact_name' => $data['contactName'] ?: null,
-            'phone' => $data['phone'] ?: null,
-            'vat_id' => $data['vatId'] ?: null,
-            'billing_address' => $data['billingAddress'] ?: null,
-        ]);
-
-        $this->dispatch('notify', message: __('settings.profile_saved'));
-    }
-
-    public function saveBranding(): void
-    {
-        $c = $this->requireCustomer();
-        if ($c === null) {
-            return;
-        }
-
-        $this->validate([
-            'brandDisplayName' => 'nullable|string|max:255',
-            'brandPrimary' => 'nullable|regex:/^#[0-9a-fA-F]{6}$/',
-            'brandAccent' => 'nullable|regex:/^#[0-9a-fA-F]{6}$/',
-            'logo' => 'nullable|image|mimes:png,webp|max:2048',
-        ]);
-
-        // Store the new upload, but keep the old file until the DB row that
-        // references it is updated — delete the old one only after that commits,
-        // so a failed update never orphans a file or dangles a reference.
-        $oldToDelete = null;
-        if ($this->logo !== null) {
-            $oldToDelete = $this->brandLogoPath;
-            $this->brandLogoPath = $this->logo->store('branding', 'public');
-            $this->logo = null;
-        }
-
-        $c->update([
-            'brand_display_name' => $this->brandDisplayName ?: null,
-            'brand_primary_color' => $this->brandPrimary ?: null,
-            'brand_accent_color' => $this->brandAccent ?: null,
-            'brand_logo_path' => $this->brandLogoPath,
-        ]);
-
-        if ($oldToDelete !== null && $oldToDelete !== $this->brandLogoPath) {
-            Storage::disk('public')->delete($oldToDelete);
-        }
-
-        $this->dispatch('notify', message: __('settings.branding_saved'));
-    }
-
-    public function removeLogo(): void
-    {
-        $c = $this->requireCustomer();
-        if ($c === null) {
-            return;
-        }
-        if ($this->brandLogoPath !== null) {
-            Storage::disk('public')->delete($this->brandLogoPath);
-        }
-        $this->brandLogoPath = null;
-        $c->update(['brand_logo_path' => null]);
-        $this->dispatch('notify', message: __('settings.branding_saved'));
-    }
-
-    #[Layout('layouts.portal-app')]
-    public function render()
-    {
-        $c = $this->customer();
-        // Prefer the active/cancelling instance for the package section so the
-        // controls line up with what cancellation actually targets.
-        $active = $c?->instances()->where('status', 'active')->latest('id')->first();
-        $scheduled = $c?->instances()->where('status', 'cancellation_scheduled')->latest('id')->first();
-        $instance = $active ?? $scheduled ?? $c?->instances()->latest('id')->first();
-
-        return view('livewire.settings', [
-            'customer' => $c,
-            'instance' => $instance,
-            'branding' => $c?->brandingResolved(),
-            'logoUrl' => $this->brandLogoPath ? Storage::disk('public')->url($this->brandLogoPath) : null,
-            'hasActivePackage' => $active !== null,
-            'cancellationScheduled' => $active === null && $scheduled !== null,
-        ]);
-    }
-}

app/Livewire/Support.php

@@ -1,30 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use Illuminate\Support\Carbon;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Support extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $date = fn (string $iso) => Carbon::parse($iso)->locale($locale)->isoFormat('LL');
-
-        return view('livewire.support', [
-            'tickets' => [
-                ['subject' => __('support.ticket_migration'), 'ref' => '#4821', 'date' => $date('2026-07-22'), 'status' => 'open'],
-                ['subject' => __('support.ticket_training'), 'ref' => '#4790', 'date' => $date('2026-07-18'), 'status' => 'progress'],
-                ['subject' => __('support.ticket_smtp'), 'ref' => '#4712', 'date' => $date('2026-07-04'), 'status' => 'closed'],
-            ],
-            'faqs' => [
-                ['q' => __('support.faq_q1'), 'a' => __('support.faq_a1')],
-                ['q' => __('support.faq_q2'), 'a' => __('support.faq_a2')],
-                ['q' => __('support.faq_q3'), 'a' => __('support.faq_a3')],
-            ],
-        ]);
-    }
-}

app/Livewire/Users.php

@@ -1,203 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Customer;
-use App\Models\Seat;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\DB;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Users extends Component
-{
-    use ResolvesCustomer;
-
-    #[Validate('required|email|max:255')]
-    public string $inviteEmail = '';
-
-    #[Validate('nullable|string|max:255')]
-    public string $inviteName = '';
-
-    #[Validate('required|in:admin,member,readonly')]
-    public string $inviteRole = 'member';
-
-    public function mount(): void
-    {
-        // Every customer starts with themselves as the owner seat. firstOrCreate
-        // keyed on (customer_id, email) is idempotent; the catch covers the
-        // concurrent-first-visit race against the unique index.
-        $customer = $this->customer();
-        if ($customer !== null && $customer->seats()->count() === 0) {
-            try {
-                $customer->seats()->firstOrCreate(
-                    ['email' => $customer->email],
-                    ['name' => $customer->name, 'role' => 'owner', 'status' => 'active', 'invited_at' => now()],
-                );
-            } catch (UniqueConstraintViolationException) {
-                // Another concurrent first visit created it — fine.
-            }
-        }
-    }
-
-    public function invite(): void
-    {
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        $data = $this->validate();
-
-        // Serialize the limit check with the insert so two concurrent invites for
-        // the last free seat can't both pass (lock the customer row).
-        $result = DB::transaction(function () use ($customer, $data) {
-            $locked = Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-
-            if ($locked->seats()->where('email', $data['inviteEmail'])->exists()) {
-                return 'duplicate';
-            }
-            if ($this->usedSeats($locked) >= $this->seatLimit($locked)) {
-                return 'limit';
-            }
-
-            $locked->seats()->create([
-                'email' => $data['inviteEmail'],
-                'name' => $data['inviteName'] ?: null,
-                'role' => $data['inviteRole'],
-                'status' => 'invited',
-                'invited_at' => now(),
-            ]);
-
-            return 'ok';
-        });
-
-        if ($result === 'limit') {
-            $this->addError('inviteEmail', __('users.limit_reached'));
-
-            return;
-        }
-        if ($result === 'duplicate') {
-            $this->addError('inviteEmail', __('users.duplicate'));
-
-            return;
-        }
-
-        $this->reset('inviteEmail', 'inviteName', 'inviteRole');
-        $this->inviteRole = 'member';
-        $this->dispatch('notify', message: __('users.invited'));
-    }
-
-    public function setRole(string $uuid, string $role): void
-    {
-        if (! in_array($role, Seat::ROLES, true)) {
-            return;
-        }
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        // Lock the customer so a concurrent owner change can't race past the guard.
-        $ok = DB::transaction(function () use ($customer, $uuid, $role) {
-            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-            $seat = $customer->seats()->where('uuid', $uuid)->first();
-            if ($seat === null) {
-                return true;
-            }
-            if ($seat->role === 'owner' && $role !== 'owner' && $customer->seats()->where('role', 'owner')->count() <= 1) {
-                return false; // would remove the last owner
-            }
-            $seat->update(['role' => $role]);
-
-            return true;
-        });
-
-        if (! $ok) {
-            $this->dispatch('notify', message: __('users.last_owner'));
-        }
-    }
-
-    public function revoke(string $uuid): void
-    {
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        $result = DB::transaction(function () use ($customer, $uuid) {
-            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-            $seat = $customer->seats()->where('uuid', $uuid)->first();
-            if ($seat === null) {
-                return 'gone';
-            }
-            if ($seat->role === 'owner' && $customer->seats()->where('role', 'owner')->count() <= 1) {
-                return 'last_owner';
-            }
-            $seat->delete();
-
-            return 'ok';
-        });
-
-        if ($result === 'last_owner') {
-            $this->dispatch('notify', message: __('users.last_owner'));
-        } elseif ($result === 'ok') {
-            $this->dispatch('notify', message: __('users.revoked'));
-        }
-    }
-
-    public function resend(string $uuid): void
-    {
-        // Invite delivery is mocked for now.
-        if ($this->seat($uuid) !== null) {
-            $this->dispatch('notify', message: __('users.resent'));
-        }
-    }
-
-    private function ownerCount(): int
-    {
-        $customer = $this->customer();
-
-        return $customer ? $customer->seats()->where('role', 'owner')->count() : 0;
-    }
-
-    private function usedSeats(Customer $customer): int
-    {
-        return $customer->seats()->where('status', '!=', 'revoked')->count();
-    }
-
-    private function seatLimit(Customer $customer): int
-    {
-        // The entitlement follows the active (or cancelling) package, not a newer
-        // failed/deprovisioned record.
-        $instance = $customer->instances()->whereIn('status', ['active', 'cancellation_scheduled'])->latest('id')->first()
-            ?? $customer->instances()->latest('id')->first();
-        // From the contract: how many people a customer may invite is part of
-        // what they bought. Cutting a plan's seats in the catalogue must not
-        // lock users out of an existing customer's cloud.
-        return (int) ($instance?->subscription?->seats ?? 5);
-    }
-
-    private function seat(string $uuid): ?Seat
-    {
-        $customer = $this->customer();
-
-        return $customer?->seats()->where('uuid', $uuid)->first();
-    }
-
-    public function render()
-    {
-        $customer = $this->customer();
-        $seats = $customer ? $customer->seats()->orderByRaw("role = 'owner' desc")->orderBy('email')->get() : collect();
-
-        return view('livewire.users', [
-            'seats' => $seats,
-            'used' => $customer ? $this->usedSeats($customer) : 0,
-            'limit' => $customer ? $this->seatLimit($customer) : 0,
-            'roles' => Seat::ROLES,
-        ]);
-    }
-}

app/Mail/MaintenanceAnnouncementMail.php

@@ -1,47 +0,0 @@
-<?php
-
-namespace App\Mail;
-
-use App\Models\Customer;
-use App\Models\MaintenanceWindow;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Mail\Mailable;
-use Illuminate\Mail\Mailables\Content;
-use Illuminate\Mail\Mailables\Envelope;
-use Illuminate\Mail\Mailables\Headers;
-use Illuminate\Queue\SerializesModels;
-
-class MaintenanceAnnouncementMail extends Mailable implements ShouldQueue
-{
-    use Queueable, SerializesModels;
-
-    /** The ledger row this mail confirms once actually delivered. */
-    public ?int $notificationId = null;
-
-    public function __construct(
-        public MaintenanceWindow $window,
-        public Customer $customer,
-    ) {}
-
-    public function headers(): Headers
-    {
-        return new Headers(text: $this->notificationId ? ['X-CP-Notification' => (string) $this->notificationId] : []);
-    }
-
-    public function envelope(): Envelope
-    {
-        return new Envelope(subject: __('maintenance.mail_subject', ['title' => $this->window->title]));
-    }
-
-    public function content(): Content
-    {
-        return new Content(markdown: 'mail.maintenance-announcement', with: [
-            'title' => $this->window->title,
-            'description' => $this->window->public_description,
-            'startsAt' => $this->window->starts_at,
-            'endsAt' => $this->window->ends_at,
-            'name' => $this->customer->name,
-        ]);
-    }
-}

app/Mail/MaintenanceCancelledMail.php

@@ -1,44 +0,0 @@
-<?php
-
-namespace App\Mail;
-
-use App\Models\Customer;
-use App\Models\MaintenanceWindow;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Mail\Mailable;
-use Illuminate\Mail\Mailables\Content;
-use Illuminate\Mail\Mailables\Envelope;
-use Illuminate\Mail\Mailables\Headers;
-use Illuminate\Queue\SerializesModels;
-
-class MaintenanceCancelledMail extends Mailable implements ShouldQueue
-{
-    use Queueable, SerializesModels;
-
-    /** The ledger row this mail confirms once actually delivered. */
-    public ?int $notificationId = null;
-
-    public function __construct(
-        public MaintenanceWindow $window,
-        public Customer $customer,
-    ) {}
-
-    public function headers(): Headers
-    {
-        return new Headers(text: $this->notificationId ? ['X-CP-Notification' => (string) $this->notificationId] : []);
-    }
-
-    public function envelope(): Envelope
-    {
-        return new Envelope(subject: __('maintenance.mail_cancel_subject', ['title' => $this->window->title]));
-    }
-
-    public function content(): Content
-    {
-        return new Content(markdown: 'mail.maintenance-cancelled', with: [
-            'title' => $this->window->title,
-            'name' => $this->customer->name,
-        ]);
-    }
-}

app/Models/Backup.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class Backup extends Model
-{
-    protected $fillable = ['instance_id', 'external_job_id', 'schedule', 'last_ok_at', 'status'];
-
-    protected function casts(): array
-    {
-        return ['last_ok_at' => 'datetime'];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/Builders/AppendOnlyBuilder.php

@@ -1,41 +0,0 @@
-<?php
-
-namespace App\Models\Builders;
-
-use Illuminate\Database\Eloquent\Builder;
-use RuntimeException;
-
-/**
- * A query builder that refuses to rewrite history.
- *
- * Model events (`updating`, `deleting`) only fire for instance operations, so a
- * guard on the model alone still lets `Model::query()->where(...)->update(...)`
- * through — which is exactly the shape a careless data fix takes. For a table
- * whose value IS that it cannot be edited, the guard has to sit where the bulk
- * operations pass.
- *
- * Not a security boundary: anyone with database access can still do as they
- * please. It is a guard against the application quietly doing it by accident,
- * which is the realistic way a register loses its meaning.
- */
-class AppendOnlyBuilder extends Builder
-{
-    public function update(array $values)
-    {
-        throw new RuntimeException(
-            'The proof register is append-only. Record a correcting event instead of editing history.'
-        );
-    }
-
-    public function delete()
-    {
-        throw new RuntimeException(
-            'The proof register is append-only. A record that can be deleted is not evidence.'
-        );
-    }
-
-    public function forceDelete()
-    {
-        return $this->delete();
-    }
-}

app/Models/Concerns/HasUuid.php

@@ -1,26 +0,0 @@
-<?php
-
-namespace App\Models\Concerns;
-
-use Illuminate\Support\Str;
-
-/**
- * Assigns a random UUID on creation. Records that expose a `uuid` column use it
- * as their route key (R11: URLs address records by UUID, not integer PK).
- */
-trait HasUuid
-{
-    protected static function bootHasUuid(): void
-    {
-        static::creating(function ($model) {
-            if (empty($model->uuid)) {
-                $model->uuid = (string) Str::uuid();
-            }
-        });
-    }
-
-    public function getRouteKeyName(): string
-    {
-        return 'uuid';
-    }
-}

app/Models/Customer.php

@@ -1,144 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Str;
-use RuntimeException;
-
-class Customer extends Model
-{
-    /** Comparable form: spaces and punctuation are cosmetic in a VAT number. */
-    public static function normaliseVatId(?string $value): string
-    {
-        return strtoupper(preg_replace('/[\s.-]+/', '', (string) $value) ?? '');
-    }
-
-    public function normalisedVatId(): string
-    {
-        return self::normaliseVatId($this->vat_id);
-    }
-
-    /**
-     * True only for the value that was actually checked. Binding it to the
-     * value rather than to a flag means editing the field cannot inherit the
-     * old confirmation, whichever code path does the editing.
-     */
-    public function hasVerifiedVatId(): bool
-    {
-        // Both sides normalised: a verifier that stores the number in display
-        // form ("DE 811 907 980") must not invalidate a genuine confirmation.
-        return $this->vat_id_verified_at !== null
-            && $this->normalisedVatId() !== ''
-            && $this->normalisedVatId() === self::normaliseVatId($this->vat_id_verified_value);
-    }
-
-    /** @use HasFactory<\Database\Factories\CustomerFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'user_id', 'name', 'contact_name', 'email', 'phone', 'vat_id', 'vat_id_verified_at', 'vat_id_verified_value', 'billing_address',
-        'locale', 'stripe_customer_id', 'status', 'closed_at',
-        'brand_display_name', 'brand_logo_path', 'brand_primary_color', 'brand_accent_color',
-    ];
-
-    protected function casts(): array
-    {
-        return ['closed_at' => 'datetime', 'vat_id_verified_at' => 'datetime'];
-    }
-
-    public function seats(): HasMany
-    {
-        return $this->hasMany(Seat::class);
-    }
-
-    /**
-     * Resolve branding: customer values where set, else CluPilot defaults. Used
-     * for previews and snapshotted into the provisioning run so retries are
-     * deterministic. NULL is stored for "unset" — defaults are never copied in.
-     *
-     * @return array{display_name:string,logo_path:?string,primary_color:string,accent_color:string,is_default:bool}
-     */
-    public function brandingResolved(): array
-    {
-        $defaults = (array) config('provisioning.branding_defaults');
-
-        return [
-            'display_name' => $this->brand_display_name ?: ($defaults['display_name'] ?? 'CluPilot'),
-            'logo_path' => $this->brand_logo_path ?: ($defaults['logo_path'] ?? null),
-            'primary_color' => $this->brand_primary_color ?: ($defaults['primary_color'] ?? '#f97316'),
-            'accent_color' => $this->brand_accent_color ?: ($defaults['accent_color'] ?? '#c2560a'),
-            'is_default' => $this->brand_display_name === null
-                && $this->brand_logo_path === null
-                && $this->brand_primary_color === null
-                && $this->brand_accent_color === null,
-        ];
-    }
-
-    public function user(): BelongsTo
-    {
-        return $this->belongsTo(User::class);
-    }
-
-    public function orders(): HasMany
-    {
-        return $this->hasMany(Order::class);
-    }
-
-    public function instances(): HasMany
-    {
-        return $this->hasMany(Instance::class);
-    }
-
-    /**
-     * Find or create the portal login account for this customer and link it.
-     * Race-safe against the unique email index, and never links an operator
-     * account — that would carry admin authorization into an impersonated
-     * "customer" session.
-     */
-    public function ensureUser(): User
-    {
-        if ($this->user) {
-            return $this->user;
-        }
-
-        if (($existing = User::query()->where('email', $this->email)->first()) !== null) {
-            $this->assertNotAdmin($existing);
-            $this->update(['user_id' => $existing->id]);
-
-            return $existing;
-        }
-
-        try {
-            $user = User::query()->create([
-                'email' => $this->email,
-                'name' => $this->name,
-                'password' => Hash::make(Str::random(40)),
-                'is_admin' => false,
-            ]);
-        } catch (UniqueConstraintViolationException) {
-            // Concurrent first-time creation — re-fetch and link the winner.
-            $user = User::query()->where('email', $this->email)->firstOrFail();
-            $this->assertNotAdmin($user);
-        }
-
-        $this->update(['user_id' => $user->id]);
-
-        return $user->refresh();
-    }
-
-    private function assertNotAdmin(User $user): void
-    {
-        if ($user->is_admin || $user->isOperator()) {
-            throw new RuntimeException(
-                "Refusing to link operator account {$user->email} as a portal login for customer {$this->id}.",
-            );
-        }
-    }
-}

app/Models/Datacenter.php

@@ -1,31 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-
-class Datacenter extends Model
-{
-    /** @use HasFactory<\Database\Factories\DatacenterFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = ['code', 'name', 'location', 'active'];
-
-    protected function casts(): array
-    {
-        return ['active' => 'boolean'];
-    }
-
-    public function scopeActive(Builder $query): Builder
-    {
-        return $query->where('active', true);
-    }
-
-    public function hosts()
-    {
-        return $this->hasMany(Host::class, 'datacenter', 'code');
-    }
-}

app/Models/DnsRecord.php

@@ -1,16 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class DnsRecord extends Model
-{
-    protected $fillable = ['instance_id', 'provider', 'record_id', 'fqdn', 'type', 'value'];
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/Host.php

@@ -1,129 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use App\Provisioning\Contracts\ProvisioningSubject;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsToMany;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\MorphMany;
-
-class Host extends Model implements ProvisioningSubject
-{
-    /** @use HasFactory<\Database\Factories\HostFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'name', 'datacenter', 'cluster', 'public_ip', 'wg_ip', 'wg_pubkey',
-        'ssh_host_key', 'api_token_ref', 'total_gb', 'total_ram_mb', 'cpu_cores',
-        'cpu_weight', 'reserve_pct', 'pve_version', 'node', 'status', 'last_seen_at', 'dns_name', 'dns_record_id',
-    ];
-
-    protected $hidden = ['api_token_ref'];
-
-    protected function casts(): array
-    {
-        return [
-            'api_token_ref' => 'encrypted',
-            'last_seen_at' => 'datetime',
-            'total_gb' => 'integer',
-            'total_ram_mb' => 'integer',
-            'cpu_cores' => 'integer',
-            'cpu_weight' => 'integer',
-            'reserve_pct' => 'integer',
-        ];
-    }
-
-    /** Placement runs (polymorphic subject). */
-    public function runs(): MorphMany
-    {
-        return $this->morphMany(ProvisioningRun::class, 'subject');
-    }
-
-    /** Runner hook: a failed onboarding run moves the host to the error status. */
-    public function onProvisioningFailed(): void
-    {
-        $this->update(['status' => 'error']);
-    }
-
-    public function instances(): HasMany
-    {
-        return $this->hasMany(Instance::class);
-    }
-
-    public function maintenanceWindows(): BelongsToMany
-    {
-        return $this->belongsToMany(MaintenanceWindow::class);
-    }
-
-    /** Free committable storage: total minus reserve. */
-    public function freeGb(): int
-    {
-        if ($this->total_gb === null) {
-            return 0;
-        }
-
-        return (int) floor($this->total_gb * (100 - $this->reserve_pct) / 100);
-    }
-
-    /**
-     * Host storage already committed, counted as the VM disk allocation
-     * (disk_gb) since that is what is actually placed on the host — not the
-     * (smaller) Nextcloud user quota. A failed instance still counts while its VM
-     * exists (has a vmid); a failure before any VM was created releases it.
-     */
-    public function committedGb(): int
-    {
-        return (int) $this->instances()
-            ->where(fn ($q) => $q->where('status', '!=', 'failed')->orWhereNotNull('vmid'))
-            ->sum('disk_gb');
-    }
-
-    /** Storage still available for new instances. */
-    public function availableGb(): int
-    {
-        return max(0, $this->freeGb() - $this->committedGb());
-    }
-
-    /** Used-storage percentage (committed vs committable free), 0–100. */
-    public function usedPct(): int
-    {
-        $free = $this->freeGb();
-
-        return $free > 0 ? min(100, (int) round($this->committedGb() / $free * 100)) : 0;
-    }
-
-    /**
-     * Heartbeat health from last_seen_at: online (≤5 min), stale (≤30 min),
-     * offline (older or never seen). Drives the health dot in the console.
-     */
-    public function healthState(): string
-    {
-        if ($this->last_seen_at === null) {
-            return 'offline';
-        }
-        $minutes = $this->last_seen_at->diffInMinutes(now());
-
-        return match (true) {
-            $minutes <= 5 => 'online',
-            $minutes <= 30 => 'stale',
-            default => 'offline',
-        };
-    }
-
-    /**
-     * Placement (spec §1): first active host in the datacenter with enough free
-     * committable storage. Cluster is ignored in v1.0.
-     */
-    public static function placeableIn(string $datacenter, int $quotaGb): ?self
-    {
-        return self::query()
-            ->where('datacenter', $datacenter)
-            ->where('status', 'active')
-            ->orderBy('name')
-            ->get()
-            ->first(fn (self $host) => $host->availableGb() >= $quotaGb);
-    }
-}

app/Models/Instance.php

@@ -1,85 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\HasOne;
-
-class Instance extends Model
-{
-    /** @use HasFactory<\Database\Factories\InstanceFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'customer_id', 'order_id', 'host_id', 'vmid', 'guest_ip', 'plan', 'quota_gb', 'traffic_addons', 'disk_gb',
-        'ram_mb', 'cores', 'subdomain', 'custom_domain', 'nc_admin_ref',
-        'route_written', 'cert_ok', 'status', 'cancel_requested_at', 'service_ends_at',
-    ];
-
-    protected $hidden = ['nc_admin_ref'];
-
-    protected function casts(): array
-    {
-        return [
-            'nc_admin_ref' => 'encrypted',
-            'route_written' => 'boolean',
-            'cert_ok' => 'boolean',
-            'vmid' => 'integer',
-            'traffic_addons' => 'integer',
-            'quota_gb' => 'integer',
-            'disk_gb' => 'integer',
-            'ram_mb' => 'integer',
-            'cores' => 'integer',
-            'cancel_requested_at' => 'datetime',
-            'service_ends_at' => 'datetime',
-        ];
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-
-    public function order(): BelongsTo
-    {
-        return $this->belongsTo(Order::class);
-    }
-
-    /**
-     * The contract this machine fulfils. The authority on what the customer is
-     * entitled to — the catalogue only describes what we sell today.
-     */
-    public function subscription(): HasOne
-    {
-        return $this->hasOne(Subscription::class);
-    }
-
-    public function host(): BelongsTo
-    {
-        return $this->belongsTo(Host::class);
-    }
-
-    public function dnsRecords(): HasMany
-    {
-        return $this->hasMany(DnsRecord::class);
-    }
-
-    public function backups(): HasMany
-    {
-        return $this->hasMany(Backup::class);
-    }
-
-    public function monitoringTargets(): HasMany
-    {
-        return $this->hasMany(MonitoringTarget::class);
-    }
-
-    public function onboardingTasks(): HasMany
-    {
-        return $this->hasMany(OnboardingTask::class);
-    }
-}

app/Models/InstanceTraffic.php

@@ -1,37 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class InstanceTraffic extends Model
-{
-    protected $table = 'instance_traffic';
-
-    protected $guarded = [];
-
-    protected function casts(): array
-    {
-        return [
-            'rx_bytes' => 'integer',
-            'tx_bytes' => 'integer',
-            'last_netin' => 'integer',
-            'last_netout' => 'integer',
-            'notified_percent' => 'integer',
-            'throttled' => 'boolean',
-            'sampled_at' => 'datetime',
-            'throttled_at' => 'datetime',
-        ];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-
-    public static function currentPeriod(): string
-    {
-        return now()->format('Y-m');
-    }
-}

app/Models/MaintenanceNotification.php

@@ -1,26 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class MaintenanceNotification extends Model
-{
-    protected $fillable = ['maintenance_window_id', 'customer_id', 'event', 'email', 'sent_at', 'claimed_at'];
-
-    protected function casts(): array
-    {
-        return ['sent_at' => 'datetime', 'claimed_at' => 'datetime'];
-    }
-
-    public function window(): BelongsTo
-    {
-        return $this->belongsTo(MaintenanceWindow::class, 'maintenance_window_id');
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-}

app/Models/MaintenanceWindow.php

@@ -1,130 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsToMany;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Support\Collection;
-
-class MaintenanceWindow extends Model
-{
-    /** @use HasFactory<\Database\Factories\MaintenanceWindowFactory> */
-    use HasFactory, HasUuid;
-
-    /** How far before the start the banner appears (Codex: 72 h). */
-    public const DISPLAY_HOURS = 72;
-
-    protected $fillable = [
-        'title', 'public_description', 'internal_notes', 'starts_at', 'ends_at',
-        'state', 'created_by', 'published_at', 'cancelled_at', 'cancellation_reason',
-    ];
-
-    protected function casts(): array
-    {
-        return [
-            'starts_at' => 'datetime',
-            'ends_at' => 'datetime',
-            'published_at' => 'datetime',
-            'cancelled_at' => 'datetime',
-        ];
-    }
-
-    public function hosts(): BelongsToMany
-    {
-        return $this->belongsToMany(Host::class);
-    }
-
-    public function deliveries(): HasMany
-    {
-        return $this->hasMany(MaintenanceNotification::class);
-    }
-
-    /** Derived lifecycle state — never stored (Codex). */
-    public function derivedState(): string
-    {
-        if ($this->state === 'cancelled') {
-            return 'cancelled';
-        }
-        if ($this->state === 'draft') {
-            return 'draft';
-        }
-        if (now()->lt($this->starts_at)) {
-            return 'upcoming';
-        }
-        if (now()->lte($this->ends_at)) {
-            return 'active';
-        }
-
-        return 'completed';
-    }
-
-    public function isPublished(): bool
-    {
-        return $this->state === 'scheduled';
-    }
-
-    /** Service-bearing customers on the assigned hosts (recomputed live). */
-    public function affectedCustomers(): Collection
-    {
-        $hostIds = $this->hosts()->pluck('hosts.id');
-        if ($hostIds->isEmpty()) {
-            return collect();
-        }
-
-        return Customer::query()
-            ->whereHas('instances', fn (Builder $q) => $q
-                ->whereIn('host_id', $hostIds)
-                ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled']))
-            ->get();
-    }
-
-    /**
-     * Scheduled windows within the display horizon that affect ONE instance's
-     * host — for a per-instance badge, so a customer with several instances
-     * never sees another instance's maintenance on this card.
-     */
-    public static function forInstance(?Instance $instance): Collection
-    {
-        if ($instance === null || $instance->host_id === null) {
-            return collect();
-        }
-
-        return self::query()
-            ->where('state', 'scheduled')
-            ->where('ends_at', '>=', now())
-            ->where('starts_at', '<=', now()->addHours(self::DISPLAY_HOURS))
-            ->whereHas('hosts', fn (Builder $q) => $q->whereKey($instance->host_id))
-            ->orderBy('starts_at')
-            ->get();
-    }
-
-    /**
-     * Scheduled windows to show a given customer right now: within the display
-     * horizon (72 h before start until the end) and touching one of the
-     * customer's service instances' hosts.
-     */
-    public static function bannerFor(Customer $customer): Collection
-    {
-        $hostIds = Instance::query()
-            ->where('customer_id', $customer->id)
-            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
-            ->whereNotNull('host_id')
-            ->pluck('host_id')->unique();
-
-        if ($hostIds->isEmpty()) {
-            return collect();
-        }
-
-        return self::query()
-            ->where('state', 'scheduled')
-            ->where('ends_at', '>=', now())
-            ->where('starts_at', '<=', now()->addHours(self::DISPLAY_HOURS))
-            ->whereHas('hosts', fn (Builder $q) => $q->whereIn('hosts.id', $hostIds))
-            ->orderBy('starts_at')
-            ->get();
-    }
-}

app/Models/MonitoringTarget.php

@@ -1,16 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class MonitoringTarget extends Model
-{
-    protected $fillable = ['instance_id', 'external_id', 'url', 'status'];
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/OnboardingTask.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class OnboardingTask extends Model
-{
-    protected $fillable = ['instance_id', 'key', 'done', 'done_at'];
-
-    protected function casts(): array
-    {
-        return ['done' => 'boolean', 'done_at' => 'datetime'];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/Order.php

@@ -1,109 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use App\Services\Billing\TaxTreatment;
-use App\Provisioning\Contracts\ProvisioningSubject;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasOne;
-use Illuminate\Database\Eloquent\Relations\MorphMany;
-
-class Order extends Model implements ProvisioningSubject
-{
-    /** @use HasFactory<\Database\Factories\OrderFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'customer_id', 'plan', 'plan_version_id', 'type', 'addon_key', 'amount_cents', 'currency',
-        'datacenter', 'stripe_event_id', 'stripe_subscription_id', 'status',
-    ];
-
-    protected function casts(): array
-    {
-        return ['amount_cents' => 'integer', 'plan_version_id' => 'integer'];
-    }
-
-    /**
-     * What this order actually buys, in words.
-     *
-     * Lives on the model rather than in the view: the cart, the invoice list and
-     * any future confirmation mail must not each invent their own wording for
-     * the same row.
-     */
-    public function label(): string
-    {
-        return match ($this->type) {
-            'upgrade' => __('billing.cart.upgrade', ['plan' => ucfirst($this->plan)]),
-            'storage' => __('billing.cart.storage', ['gb' => (int) config('provisioning.storage_addon.gb', 100)]),
-            'traffic' => __('billing.cart.traffic', ['gb' => (int) config('provisioning.traffic.addon.gb', 1000)]),
-            'addon' => __('billing.addon.'.$this->addon_key.'.name'),
-            default => __('billing.cart.plan', ['plan' => ucfirst($this->plan)]),
-        };
-    }
-
-    /**
-     * Monthly or one-off.
-     *
-     * Traffic is bought for the month that is running out and does not renew;
-     * everything else changes the recurring bill.
-     */
-    public function isRecurring(): bool
-    {
-        return $this->type !== 'traffic';
-    }
-
-    /**
-     * Net is what is stored; gross is what gets charged — and how much VAT that
-     * is depends on the customer, not on a global setting.
-     */
-    public function grossCents(): int
-    {
-        return $this->taxTreatment()->grossCents($this->amount_cents);
-    }
-
-    public function taxTreatment(): TaxTreatment
-    {
-        return TaxTreatment::for($this->customer);
-    }
-
-    /** Only a pending order is still the customer's to change. */
-    public function isRemovable(): bool
-    {
-        return $this->status === 'pending';
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-
-    public function instance(): HasOne
-    {
-        return $this->hasOne(Instance::class);
-    }
-
-    /** The contract this order opened, if it was the purchase that opened one. */
-    public function subscription(): HasOne
-    {
-        return $this->hasOne(Subscription::class);
-    }
-
-    public function runs(): MorphMany
-    {
-        return $this->morphMany(ProvisioningRun::class, 'subject');
-    }
-
-    /**
-     * Runner hook: a failed provisioning run marks the order failed (no
-     * auto-refund) AND releases the reserved instance, so its quota stops
-     * counting against host capacity.
-     */
-    public function onProvisioningFailed(): void
-    {
-        $this->update(['status' => 'failed']);
-        $this->instance()->update(['status' => 'failed']);
-    }
-}

app/Models/PlanFamily.php

@@ -1,94 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Support\Carbon;
-use RuntimeException;
-
-/**
- * A plan line — the thing that has a name.
- *
- * "Team" stays Team through every price change and every resize. Orders,
- * instances and contracts have referred to plans by `key` since day one, so the
- * key is the one part of a family that must never move.
- */
-class PlanFamily extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $family) {
-            // Orders, instances and every subscription snapshot store this
-            // string. Renaming it does not rename those — it orphans them, and
-            // a checkout in flight for this family stops matching its own
-            // version. Display names are what the `name` column is for.
-            if ($family->isDirty('key')) {
-                throw new RuntimeException(
-                    'A plan family key is permanent; existing orders and contracts refer to it by name. '.
-                    'Change the display name instead.'
-                );
-            }
-        });
-
-        static::deleting(function (self $family) {
-            if ($family->versions()->whereNotNull('published_at')->exists()) {
-                throw new RuntimeException(
-                    'A plan family with published versions cannot be deleted; customers are contracted to them. '.
-                    'Switch sales off instead — it disappears from the shop and stays on record.'
-                );
-            }
-
-            // Only drafts left. The foreign key restricts, so they have to go
-            // explicitly — and nothing was ever promised on a draft.
-            $family->versions->each->delete();
-        });
-    }
-
-    protected function casts(): array
-    {
-        return [
-            'tier' => 'integer',
-            'sales_enabled' => 'boolean',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function versions(): HasMany
-    {
-        return $this->hasMany(PlanVersion::class);
-    }
-
-    /**
-     * The version on sale at a given moment, or null.
-     *
-     * Resolved with sole(): two overlapping windows are a mistake we want to
-     * hear about, not one we want silently resolved by whichever row the
-     * database happened to return first.
-     *
-     * @throws \Illuminate\Database\MultipleRecordsFoundException on overlap
-     */
-    public function versionAt(?Carbon $at = null): ?PlanVersion
-    {
-        $query = $this->versions()->available($at);
-
-        return $query->count() === 0 ? null : $query->sole();
-    }
-
-    /** On sale right now: not killed by the switch, and a version is running. */
-    public function isSellableAt(?Carbon $at = null): bool
-    {
-        return $this->sales_enabled && $this->versionAt($at) !== null;
-    }
-}

app/Models/PlanPrice.php

@@ -1,85 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use RuntimeException;
-
-/**
- * What a version costs for one term.
- *
- * One row per version AND term, each with its own Stripe Price id — a Stripe
- * Price carries its own recurring interval, so monthly and yearly can never
- * share one. Amounts are NET; what is actually charged depends on the
- * customer's tax treatment.
- *
- * Frozen with its version. Repricing means publishing a new version, which is
- * what Stripe requires anyway — a Stripe Price is immutable, so a rise mints a
- * new one and existing subscriptions keep the old.
- *
- * The reason is not tidiness. A checkout is not instant: the session opens, the
- * customer types their card details, the webhook arrives. An amount edited in
- * that gap would contract them at a price they were never quoted, while their
- * payment carries the old one. Only `stripe_price_id` stays writable, because
- * it is filled in after the fact.
- */
-class PlanPrice extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    /** What publishing the version nails down. */
-    public const FROZEN = ['plan_version_id', 'term', 'amount_cents', 'currency'];
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $price) {
-            // A draft is still a draft: nothing has been quoted to anyone.
-            if ($price->version?->isPublished() !== true) {
-                return;
-            }
-
-            $frozen = array_intersect(array_keys($price->getDirty()), self::FROZEN);
-
-            if ($frozen !== []) {
-                throw new RuntimeException(
-                    'The price of a published plan version is fixed; tried to change: '.implode(', ', $frozen).
-                    '. Publish a new version instead — someone may be at the checkout looking at this one.'
-                );
-            }
-        });
-
-        static::deleting(function (self $price) {
-            // Same loophole as editing. Remove the price of a version someone is
-            // checking out on, and their payment lands on a plan that can no
-            // longer be priced — the order is recorded, no contract opens, and
-            // they are left paid-for and unprovisioned.
-            if ($price->version?->isPublished() === true) {
-                throw new RuntimeException(
-                    'The price of a published plan version cannot be deleted. '.
-                    'Close the version\'s availability window instead.'
-                );
-            }
-        });
-    }
-
-    protected function casts(): array
-    {
-        return ['amount_cents' => 'integer'];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function version(): BelongsTo
-    {
-        return $this->belongsTo(PlanVersion::class, 'plan_version_id');
-    }
-}

app/Models/PlanVersion.php

@@ -1,167 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Support\Carbon;
-use RuntimeException;
-
-/**
- * What a plan WAS at a point in time.
- *
- * A customer buys a version, not a name. Once a version is published it is
- * fixed: publication is a promise made in public, and it is made whether or not
- * anyone has bought yet — which is why the lock is on publication and not on
- * the first sale. Selling different terms means publishing a new version, and
- * the old one keeps describing what its customers are owed.
- *
- * The availability WINDOW is not frozen. Rescheduling when a version is sold
- * changes nothing about what it promises, and the owner has to be able to move
- * a launch date without rewriting the plan.
- */
-class PlanVersion extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    /** Everything publication nails down. */
-    public const FROZEN = [
-        'plan_family_id', 'version', 'quota_gb', 'traffic_gb', 'seats', 'ram_mb',
-        'cores', 'disk_gb', 'performance', 'template_vmid', 'features', 'published_at',
-    ];
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $version) {
-            // A draft is still a draft: nothing has been promised to anyone.
-            if ($version->getOriginal('published_at') === null) {
-                return;
-            }
-
-            $frozen = array_intersect(array_keys($version->getDirty()), self::FROZEN);
-
-            if ($frozen !== []) {
-                throw new RuntimeException(
-                    'A published plan version is immutable; tried to change: '.implode(', ', $frozen).
-                    '. Publish a new version instead — the customers on this one bought these terms.'
-                );
-            }
-        });
-
-        static::deleting(function (self $version) {
-            // Deleting is the loophole that would undo the rest. Contracts and
-            // orders point here to record what was sold, and the foreign keys
-            // null out on delete — so removing a published version quietly
-            // erases the provenance of every customer on it, and can leave an
-            // in-flight checkout resolving against whatever replaced it.
-            if ($version->isPublished()) {
-                throw new RuntimeException(
-                    'A published plan version cannot be deleted; customers are contracted to it. '.
-                    'Close its availability window instead — it stops being sold and stays on record.'
-                );
-            }
-        });
-    }
-
-    protected function casts(): array
-    {
-        return [
-            'version' => 'integer',
-            'quota_gb' => 'integer',
-            'traffic_gb' => 'integer',
-            'seats' => 'integer',
-            'ram_mb' => 'integer',
-            'cores' => 'integer',
-            'disk_gb' => 'integer',
-            'template_vmid' => 'integer',
-            'features' => 'array',
-            'available_from' => 'datetime',
-            'available_until' => 'datetime',
-            'published_at' => 'datetime',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function family(): BelongsTo
-    {
-        return $this->belongsTo(PlanFamily::class, 'plan_family_id');
-    }
-
-    public function prices(): HasMany
-    {
-        return $this->hasMany(PlanPrice::class);
-    }
-
-    /**
-     * Published, and inside its window at `$at`.
-     *
-     * Half-open [from, until): `until` is the first moment the version is no
-     * longer sold, so a successor starting exactly then leaves neither a gap
-     * nor an overlap.
-     */
-    public function scopeAvailable(Builder $query, ?Carbon $at = null): Builder
-    {
-        $at ??= now();
-
-        return $query
-            ->whereNotNull('published_at')
-            ->where('available_from', '<=', $at)
-            ->where(fn (Builder $open) => $open
-                ->whereNull('available_until')
-                ->orWhere('available_until', '>', $at));
-    }
-
-    public function isAvailableAt(?Carbon $at = null): bool
-    {
-        $at ??= now();
-
-        return $this->published_at !== null
-            && $this->available_from->lessThanOrEqualTo($at)
-            && ($this->available_until === null || $this->available_until->greaterThan($at));
-    }
-
-    public function isPublished(): bool
-    {
-        return $this->published_at !== null;
-    }
-
-    public function priceFor(string $term, ?string $currency = null): ?PlanPrice
-    {
-        return $this->prices()
-            ->where('term', $term)
-            ->where('currency', $currency ?? Subscription::catalogueCurrency())
-            ->first();
-    }
-
-    /**
-     * The capabilities, in the shape the rest of the app already speaks.
-     *
-     * @return array<string, mixed>
-     */
-    public function capabilities(): array
-    {
-        return [
-            'tier' => (int) $this->family->tier,
-            'quota_gb' => $this->quota_gb,
-            'traffic_gb' => $this->traffic_gb,
-            'seats' => $this->seats,
-            'ram_mb' => $this->ram_mb,
-            'cores' => $this->cores,
-            'disk_gb' => $this->disk_gb,
-            'performance' => $this->performance,
-            'template_vmid' => $this->template_vmid,
-            'features' => $this->features ?? [],
-        ];
-    }
-}

app/Models/ProvisioningRun.php

@@ -1,78 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\MorphTo;
-
-class ProvisioningRun extends Model
-{
-    /** @use HasFactory<\Database\Factories\ProvisioningRunFactory> */
-    use HasFactory, HasUuid;
-
-    public const STATUS_PENDING = 'pending';
-    public const STATUS_RUNNING = 'running';
-    public const STATUS_WAITING = 'waiting';
-    public const STATUS_PAUSED = 'paused';
-    public const STATUS_COMPLETED = 'completed';
-    public const STATUS_FAILED = 'failed';
-
-    protected $fillable = [
-        'subject_type', 'subject_id', 'pipeline', 'current_step', 'status',
-        'attempt', 'max_attempts', 'next_attempt_at', 'started_at', 'finished_at',
-        'error', 'context',
-    ];
-
-    protected function casts(): array
-    {
-        return [
-            'context' => 'array',
-            'next_attempt_at' => 'datetime',
-            'started_at' => 'datetime',
-            'finished_at' => 'datetime',
-            'current_step' => 'integer',
-            'attempt' => 'integer',
-            'max_attempts' => 'integer',
-        ];
-    }
-
-    public function subject(): MorphTo
-    {
-        return $this->morphTo();
-    }
-
-    public function events(): HasMany
-    {
-        return $this->hasMany(ProvisioningStepEvent::class, 'run_id');
-    }
-
-    public function resources(): HasMany
-    {
-        return $this->hasMany(RunResource::class, 'run_id');
-    }
-
-    /** Read a single key from the json context. */
-    public function context(string $key, mixed $default = null): mixed
-    {
-        return data_get($this->context, $key, $default);
-    }
-
-    /** Merge values into the json context and persist. */
-    public function mergeContext(array $values): void
-    {
-        $this->context = array_merge($this->context ?? [], $values);
-        $this->save();
-    }
-
-    /** Remove a key from the json context and persist (e.g. scrubbing a secret). */
-    public function forgetContext(string $key): void
-    {
-        $context = $this->context ?? [];
-        unset($context[$key]);
-        $this->context = $context;
-        $this->save();
-    }
-}

app/Models/ProvisioningStepEvent.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-/**
- * Append-only run event. Eloquent manages created_at only (no updated_at).
- */
-class ProvisioningStepEvent extends Model
-{
-    public const UPDATED_AT = null;
-
-    protected $fillable = ['run_id', 'step', 'attempt', 'outcome', 'message', 'external_ref'];
-
-    public function run(): BelongsTo
-    {
-        return $this->belongsTo(ProvisioningRun::class, 'run_id');
-    }
-}

app/Models/RunResource.php

@@ -1,27 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-/**
- * Idempotency breadcrumb: an external resource created during a run (wg peer,
- * pve token, vmid …). Persisted before the creating step advances.
- */
-class RunResource extends Model
-{
-    public const UPDATED_AT = null;
-
-    protected $fillable = ['run_id', 'host_id', 'kind', 'external_id'];
-
-    public function run(): BelongsTo
-    {
-        return $this->belongsTo(ProvisioningRun::class, 'run_id');
-    }
-
-    public function host(): BelongsTo
-    {
-        return $this->belongsTo(Host::class, 'host_id');
-    }
-}

app/Models/Seat.php

@@ -1,28 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class Seat extends Model
-{
-    /** @use HasFactory<\Database\Factories\SeatFactory> */
-    use HasFactory, HasUuid;
-
-    public const ROLES = ['owner', 'admin', 'member', 'readonly'];
-
-    protected $fillable = ['customer_id', 'email', 'name', 'role', 'status', 'invited_at'];
-
-    protected function casts(): array
-    {
-        return ['invited_at' => 'datetime'];
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-}

app/Models/StripePendingEvent.php

@@ -1,24 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-
-/**
- * A billing event held until the contract it is about exists.
- *
- * See the migration for why: Stripe does not guarantee delivery order, and
- * answering 2xx to an event we cannot match yet would drop it for good.
- */
-class StripePendingEvent extends Model
-{
-    protected $guarded = [];
-
-    protected function casts(): array
-    {
-        return [
-            'payload' => 'array',
-            'raised_at' => 'datetime',
-        ];
-    }
-}

app/Models/Subscription.php

@@ -1,204 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use RuntimeException;
-
-class Subscription extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    public const TERM_MONTHLY = 'monthly';
-
-    public const TERM_YEARLY = 'yearly';
-
-    /**
-     * The conditions the customer is owed. Changing any of these after the fact
-     * would rewrite a contract, so the model refuses — a price rise applies to
-     * new subscriptions, never to existing ones.
-     */
-    public const FROZEN = [
-        'plan', 'plan_version_id', 'term', 'price_cents', 'currency', 'quota_gb', 'traffic_gb',
-        'seats', 'ram_mb', 'cores', 'disk_gb', 'performance', 'tier', 'started_at',
-    ];
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $subscription) {
-            $frozen = array_intersect(array_keys($subscription->getDirty()), self::FROZEN);
-
-            if ($frozen !== []) {
-                throw new RuntimeException(
-                    'A subscription snapshot is immutable; tried to change: '.implode(', ', $frozen).
-                    '. Cancel this subscription and start a new one instead.'
-                );
-            }
-        });
-    }
-
-    protected function casts(): array
-    {
-        return [
-            'price_cents' => 'integer',
-            'quota_gb' => 'integer',
-            'traffic_gb' => 'integer',
-            'seats' => 'integer',
-            'ram_mb' => 'integer',
-            'cores' => 'integer',
-            'disk_gb' => 'integer',
-            'template_vmid' => 'integer',
-            'tier' => 'integer',
-            'started_at' => 'datetime',
-            'current_period_start' => 'datetime',
-            'current_period_end' => 'datetime',
-            'pending_effective_at' => 'datetime',
-            'cancelled_at' => 'datetime',
-            'stripe_event_at' => 'datetime',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-
-    public function order(): BelongsTo
-    {
-        return $this->belongsTo(Order::class);
-    }
-
-    /** Which version of the plan this contract was sold under. */
-    public function planVersion(): BelongsTo
-    {
-        return $this->belongsTo(PlanVersion::class, 'plan_version_id');
-    }
-
-    /** Modules booked onto this contract, each frozen at its booked price. */
-    public function addons(): HasMany
-    {
-        return $this->hasMany(SubscriptionAddon::class);
-    }
-
-    /** Every commercial event this contract has been through. */
-    public function records(): HasMany
-    {
-        return $this->hasMany(SubscriptionRecord::class);
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-
-    /** Whether the catalogue still sells this plan at all. */
-    public static function knowsPlan(string $plan): bool
-    {
-        return app(PlanCatalogue::class)->isSellable($plan);
-    }
-
-    /** The single currency every catalogue price is expressed in. */
-    public static function catalogueCurrency(): string
-    {
-        return strtoupper((string) config('provisioning.currency', 'EUR'));
-    }
-
-    /**
-     * Take the version on sale right now and freeze it onto a new subscription.
-     *
-     * Reads the catalogue tables, never config: there is one source, and it is
-     * the one the owner can actually edit. An unknown, withdrawn or unpriced
-     * plan throws rather than returning something plausible — a contract opened
-     * from a guess is worse than a purchase that visibly fails.
-     */
-    public static function snapshotFrom(string $plan, string $term = self::TERM_MONTHLY, ?int $versionId = null): array
-    {
-        // A typo would otherwise be priced monthly while carrying an unknown
-        // term — a subscription whose price and billing period disagree.
-        if (! in_array($term, [self::TERM_MONTHLY, self::TERM_YEARLY], true)) {
-            throw new RuntimeException("Unknown term: {$term}");
-        }
-
-        // Honour the version the customer was actually shown, even if it has
-        // stopped being sold since — a checkout that completes just after a
-        // scheduled transition must not contract them to terms they never saw.
-        $version = $versionId !== null
-            ? app(PlanCatalogue::class)->soldVersion($plan, $versionId)
-            : app(PlanCatalogue::class)->currentVersion($plan);
-        $price = $version->priceFor($term);
-
-        if ($price === null) {
-            throw new RuntimeException("Plan '{$plan}' is not sold on a {$term} term.");
-        }
-
-        return [
-            'plan' => $plan,
-            // Which version this contract was sold under. A historical
-            // reference resolved by plan NAME would hand back today's terms.
-            'plan_version_id' => $version->id,
-            'term' => $term,
-            'price_cents' => $price->amount_cents,
-            'currency' => $price->currency,
-            'quota_gb' => $version->quota_gb,
-            'traffic_gb' => $version->traffic_gb,
-            'seats' => $version->seats,
-            'ram_mb' => $version->ram_mb,
-            'cores' => $version->cores,
-            'disk_gb' => $version->disk_gb,
-            'performance' => $version->performance,
-            // Copied so provisioning never has to ask the catalogue what to
-            // clone. Not in FROZEN — see the migration for why.
-            'template_vmid' => $version->template_vmid,
-            // Frozen too: which direction a later change goes must not depend
-            // on where the plan sits in today's catalogue.
-            'tier' => (int) $version->family->tier,
-        ];
-    }
-
-    public function isYearly(): bool
-    {
-        return $this->term === self::TERM_YEARLY;
-    }
-
-    /**
-     * What this contract works out to per month.
-     *
-     * `price_cents` is the price of a TERM, and a yearly term holds the whole
-     * year. Everything that prints a monthly figure — the plan card, the cloud
-     * page, the revenue column — has to divide, and every one of them getting
-     * it right separately is not something to rely on.
-     */
-    public function monthlyPriceCents(): int
-    {
-        return $this->isYearly()
-            ? (int) round($this->price_cents / 12)
-            : (int) $this->price_cents;
-    }
-
-    /**
-     * The whole monthly bill, net: the plan plus every module still booked.
-     *
-     * All of it frozen — that is the owner's rule. A total assembled from the
-     * contract for the plan and from today's catalogue for the modules would
-     * protect half a customer's price and quietly re-price the other half.
-     */
-    public function totalMonthlyCents(): int
-    {
-        return $this->monthlyPriceCents() + $this->addons
-            ->where('cancelled_at', null)
-            ->sum(fn (SubscriptionAddon $addon) => $addon->monthlyCents());
-    }
-}

app/Models/SubscriptionAddon.php

@@ -1,84 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use RuntimeException;
-
-/**
- * One booked module, at the price it was booked at.
- *
- * Frozen for the same reason the subscription is: the customer agreed to a
- * figure, and raising it afterwards would rewrite that agreement. Cancelling
- * sets `cancelled_at` rather than deleting the row — what someone was paying,
- * and until when, is evidence.
- */
-class SubscriptionAddon extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    /** What the customer agreed to. */
-    public const FROZEN = ['subscription_id', 'addon_key', 'price_cents', 'currency', 'quantity', 'booked_at'];
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $addon) {
-            $frozen = array_intersect(array_keys($addon->getDirty()), self::FROZEN);
-
-            if ($frozen !== []) {
-                throw new RuntimeException(
-                    'A booked module is frozen at its booked price; tried to change: '.implode(', ', $frozen).
-                    '. Cancel it and book it again at today\'s price instead.'
-                );
-            }
-        });
-    }
-
-    protected function casts(): array
-    {
-        return [
-            'price_cents' => 'integer',
-            'quantity' => 'integer',
-            'booked_at' => 'datetime',
-            'cancelled_at' => 'datetime',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function subscription(): BelongsTo
-    {
-        return $this->belongsTo(Subscription::class);
-    }
-
-    public function order(): BelongsTo
-    {
-        return $this->belongsTo(Order::class);
-    }
-
-    public function scopeActive(Builder $query): Builder
-    {
-        return $query->whereNull('cancelled_at');
-    }
-
-    /** Net per month for this booking, packs included. */
-    public function monthlyCents(): int
-    {
-        return $this->price_cents * $this->quantity;
-    }
-
-    public function isActive(): bool
-    {
-        return $this->cancelled_at === null;
-    }
-}

app/Models/SubscriptionRecord.php

@@ -1,118 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Builders\AppendOnlyBuilder;
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use RuntimeException;
-
-/**
- * One commercial event, written once and never again.
- *
- * A register that can be edited proves nothing. So the model refuses updates
- * and deletes outright: a mistake is corrected by recording the correction,
- * which is how ledgers have always worked and why they can be trusted.
- */
-class SubscriptionRecord extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    public const EVENT_PURCHASE = 'purchase';
-
-    public const EVENT_UPGRADE = 'upgrade';
-
-    public const EVENT_DOWNGRADE = 'downgrade';
-
-    /** A term that renewed and was paid. Stripe's invoice says so. */
-    public const EVENT_RENEWAL = 'renewal';
-
-    /** A renewal Stripe could not collect. Their dunning takes it from here. */
-    public const EVENT_PAYMENT_FAILED = 'payment_failed';
-
-    /**
-     * A paid invoice that is not a cycle renewal — a proration, or a charge
-     * raised by hand. Money received, so it belongs in the register, but it
-     * does not start a new term and must not move the period.
-     */
-    public const EVENT_INVOICE_PAID = 'invoice_paid';
-
-    public const EVENT_ADDON_BOOKED = 'addon_booked';
-
-    public const EVENT_ADDON_CANCELLED = 'addon_cancelled';
-
-    public const EVENT_CANCELLATION = 'cancellation';
-
-    /** The shape of the `snapshot` column. Bump when it changes. */
-    public const SNAPSHOT_VERSION = 1;
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function () {
-            throw new RuntimeException(
-                'The proof register is append-only. Record a correcting event instead of editing history.'
-            );
-        });
-
-        static::deleting(function () {
-            throw new RuntimeException(
-                'The proof register is append-only. A record that can be deleted is not evidence.'
-            );
-        });
-    }
-
-    protected function casts(): array
-    {
-        return [
-            'net_cents' => 'integer',
-            'tax_cents' => 'integer',
-            'gross_cents' => 'integer',
-            'tax_rate' => 'decimal:2',
-            'reverse_charge' => 'boolean',
-            'plan_version' => 'integer',
-            'snapshot_version' => 'integer',
-            'snapshot' => 'array',
-            'occurred_at' => 'datetime',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    /**
-     * The model events above only fire for instance operations. A bulk
-     * `query()->update()` or `->delete()` would sail straight past them, so the
-     * builder refuses those too.
-     */
-    public function newEloquentBuilder($query): AppendOnlyBuilder
-    {
-        return new AppendOnlyBuilder($query);
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-
-    public function subscription(): BelongsTo
-    {
-        return $this->belongsTo(Subscription::class);
-    }
-
-    public function order(): BelongsTo
-    {
-        return $this->belongsTo(Order::class);
-    }
-
-    public function planVersion(): BelongsTo
-    {
-        return $this->belongsTo(PlanVersion::class, 'plan_version_id');
-    }
-}

app/Models/User.php

@@ -9,24 +9,13 @@ use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
-use Laravel\Fortify\TwoFactorAuthenticatable;
-use Spatie\Permission\Traits\HasRoles;
 
-#[Fillable(['name', 'email', 'password', 'is_admin'])]
-#[Hidden(['password', 'remember_token', 'two_factor_secret', 'two_factor_recovery_codes'])]
+#[Fillable(['name', 'email', 'password'])]
+#[Hidden(['password', 'remember_token'])]
 class User extends Authenticatable
 {
     /** @use HasFactory<UserFactory> */
-    use HasFactory, HasRoles, Notifiable, TwoFactorAuthenticatable;
-
-    /** The five operator roles that grant access to the admin console. */
-    public const OPERATOR_ROLES = ['Owner', 'Admin', 'Support', 'Billing', 'Read-only', 'Developer'];
-
-    /** True when this user holds an operator role (the RBAC console boundary). */
-    public function isOperator(): bool
-    {
-        return $this->hasAnyRole(self::OPERATOR_ROLES);
-    }
+    use HasFactory, Notifiable;
 
     /**
      * Get the attributes that should be cast.
@@ -38,7 +27,6 @@ class User extends Authenticatable
         return [
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
-            'is_admin' => 'boolean',
         ];
     }
 }

app/Models/VpnPeer.php

@@ -1,111 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\SoftDeletes;
-
-class VpnPeer extends Model
-{
-    use HasFactory;
-    use HasUuids;
-    use SoftDeletes;
-
-    /** A tunnel is considered live if the last handshake is recent. WireGuard
-     *  re-handshakes about every two minutes, so three is the first value that
-     *  does not flap for an idle-but-connected peer. */
-    public const ONLINE_AFTER_MINUTES = 3;
-
-    /** A person's access. Requires an owner. */
-    public const KIND_STAFF = 'staff';
-
-    /** Registered by the host pipeline for a Proxmox host. Requires host_id. */
-    public const KIND_HOST = 'host';
-
-    /** Found on the interface without a match — adopted so it stays visible. */
-    public const KIND_SYSTEM = 'system';
-
-    protected $guarded = [];
-
-    protected function casts(): array
-    {
-        return [
-            'enabled' => 'boolean',
-            'present' => 'boolean',
-            'last_handshake_at' => 'datetime',
-            'secret_purged_at' => 'datetime',
-            'last_downloaded_at' => 'datetime',
-            'observed_at' => 'datetime',
-            'rx_bytes' => 'integer',
-            'tx_bytes' => 'integer',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function host(): BelongsTo
-    {
-        return $this->belongsTo(Host::class);
-    }
-
-    public function creator(): BelongsTo
-    {
-        return $this->belongsTo(User::class, 'created_by');
-    }
-
-    /** The person this access belongs to (staff peers only). */
-    public function owner(): BelongsTo
-    {
-        return $this->belongsTo(User::class, 'user_id');
-    }
-
-    public function hasStoredConfig(): bool
-    {
-        return $this->config_secret !== null;
-    }
-
-    /**
-     * Overwrite the stored credential. Called on revocation: a tombstone that
-     * still carries a usable private key is a liability, not a record.
-     */
-    public function purgeSecret(): void
-    {
-        if ($this->config_secret === null) {
-            return;
-        }
-
-        $this->forceFill(['config_secret' => null, 'secret_purged_at' => now()])->saveQuietly();
-    }
-
-    public function isOnline(): bool
-    {
-        return $this->enabled
-            && $this->present
-            && $this->last_handshake_at !== null
-            && $this->last_handshake_at->gt(now()->subMinutes(self::ONLINE_AFTER_MINUTES));
-    }
-
-    /**
-     * blocked  — operator revoked it; it must not be on the hub
-     * pending  — desired and observed state disagree; a job is still applying it
-     * online   — configured and handshaking
-     * idle     — configured, but no recent handshake
-     */
-    public function status(): string
-    {
-        if (! $this->enabled) {
-            return $this->present ? 'pending' : 'blocked';
-        }
-        if (! $this->present) {
-            return 'pending';
-        }
-
-        return $this->isOnline() ? 'online' : 'idle';
-    }
-}

app/Notifications/CloudReady.php

@@ -1,49 +0,0 @@
-<?php
-
-namespace App\Notifications;
-
-use App\Models\Instance;
-use Illuminate\Bus\Queueable;
-use Illuminate\Notifications\Messages\MailMessage;
-use Illuminate\Notifications\Notification;
-use Illuminate\Support\Facades\Crypt;
-
-/**
- * Delivers the initial admin credentials once provisioning completes.
- *
- * Sent SYNCHRONOUSLY from CompleteProvisioning (not queued): the step only
- * records the `credentials_sent` breadcrumb and scrubs the password AFTER the
- * send returns, so a mail failure re-runs the step (password preserved) instead
- * of losing the credential in a failed queue job. Delivery is at-least-once — a
- * crash in the tiny window after send but before the breadcrumb can re-send a
- * duplicate welcome email, which is preferable to a lost credential.
- */
-class CloudReady extends Notification
-{
-    use Queueable;
-
-    public function __construct(
-        public Instance $instance,
-        public string $adminUser,
-        public string $adminPasswordEncrypted, // ciphertext — safe to serialize into the queue
-    ) {}
-
-    /** @return array<int, string> */
-    public function via(object $notifiable): array
-    {
-        return ['mail'];
-    }
-
-    public function toMail(object $notifiable): MailMessage
-    {
-        $url = 'https://'.$this->instance->subdomain.'.'.config('provisioning.dns.zone');
-
-        return (new MailMessage)
-            ->subject(__('provisioning.mail.ready_subject'))
-            ->greeting(__('provisioning.mail.ready_greeting'))
-            ->line(__('provisioning.mail.ready_line'))
-            ->line(__('provisioning.mail.ready_user', ['user' => $this->adminUser]))
-            ->line(__('provisioning.mail.ready_password', ['password' => Crypt::decryptString($this->adminPasswordEncrypted)]))
-            ->action(__('provisioning.mail.ready_action'), $url);
-    }
-}

app/Policies/VpnPeerPolicy.php

@@ -1,83 +0,0 @@
-<?php
-
-namespace App\Policies;
-
-use App\Models\User;
-use App\Models\VpnPeer;
-
-/**
- * Who may see and do what with a VPN access.
- *
- * Ownership is record-level and lives here; permissions describe elevated
- * capabilities (vpn.view.all, vpn.manage.all) and are checked through Gate.
- * The two are kept apart on purpose: seeing an access is not managing it, and
- * neither of them is holding its private key.
- *
- * There is no Gate::before super-admin shortcut in this application, so these
- * rules are the whole story — in particular downloadConfig() cannot be
- * out-voted by a role.
- */
-class VpnPeerPolicy
-{
-    public function viewAny(User $user): bool
-    {
-        // Every operator may at least reach the page to find their own access.
-        return $user->isOperator();
-    }
-
-    public function view(User $user, VpnPeer $peer): bool
-    {
-        return $this->owns($user, $peer) || $user->can('vpn.view.all');
-    }
-
-    public function create(User $user): bool
-    {
-        // Not self-service: an access reaches the management network, so issuing
-        // one is an administrative act even for oneself.
-        return $user->can('vpn.manage.all');
-    }
-
-    /** Rename, reassign, change stored-config settings. */
-    public function update(User $user, VpnPeer $peer): bool
-    {
-        return $user->can('vpn.manage.all');
-    }
-
-    /** Block / unblock. Owners may switch their own access off and on again. */
-    public function block(User $user, VpnPeer $peer): bool
-    {
-        return $user->can('vpn.manage.all') || $this->owns($user, $peer);
-    }
-
-    public function delete(User $user, VpnPeer $peer): bool
-    {
-        return $user->can('vpn.manage.all') || $this->owns($user, $peer);
-    }
-
-    /**
-     * The private half of someone's credential. Owner only — explicitly NOT
-     * vpn.view.all and NOT vpn.manage.all: an administrator who needs access
-     * revokes this one and issues themselves their own, which keeps the record
-     * of who holds what intact.
-     */
-    public function downloadConfig(User $user, VpnPeer $peer): bool
-    {
-        return $this->owns($user, $peer)
-            && $peer->config_secret !== null
-            && ! $peer->trashed();
-    }
-
-    /**
-     * isOperator() is part of ownership on purpose: roles can be taken away by
-     * other paths than revokeStaff() — a direct role edit, for instance. Losing
-     * the console must close these doors by itself, not rely on whoever removed
-     * the role also remembering the tunnel.
-     */
-    private function owns(User $user, VpnPeer $peer): bool
-    {
-        return $user->isOperator()
-            && $peer->kind === VpnPeer::KIND_STAFF
-            && $peer->user_id !== null
-            && $peer->user_id === $user->id;
-    }
-}

app/Providers/AppServiceProvider.php

@@ -2,33 +2,7 @@
 
 namespace App\Providers;
 
-use App\Provisioning\PipelineRegistry;
-use App\Services\Dns\HetznerDnsClient;
-use App\Services\Dns\HttpHetznerDnsClient;
-use App\Services\Monitoring\HttpMonitoringClient;
-use App\Services\Monitoring\MonitoringClient;
-use App\Services\Proxmox\HttpProxmoxClient;
-use App\Services\Proxmox\ProxmoxClient;
-use App\Services\Stripe\HttpStripeClient;
-use App\Services\Stripe\StripeClient;
-use App\Services\Ssh\PhpseclibRemoteShell;
-use App\Services\Ssh\RemoteShell;
-use App\Services\Traefik\SshTraefikWriter;
-use App\Services\Traefik\TraefikWriter;
-use App\Services\Wireguard\LocalWireguardHub;
-use App\Services\Wireguard\WireguardHub;
-use App\Http\Middleware\EnsureAdmin;
-use App\Http\Middleware\EnsureCustomerActive;
-use App\Http\Middleware\RestrictAdminHost;
-use App\Http\Middleware\RestrictConsoleNetwork;
-use App\Mail\MaintenanceCancelledMail;
-use App\Models\MaintenanceNotification;
-use App\Services\Maintenance\MaintenanceNotifier;
-use Illuminate\Mail\Events\MessageSending;
-use Illuminate\Mail\Events\MessageSent;
-use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
-use Livewire\Livewire;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -37,18 +11,7 @@ class AppServiceProvider extends ServiceProvider
      */
     public function register(): void
     {
-        $this->app->singleton(PipelineRegistry::class, fn () => new PipelineRegistry(
-            config('provisioning.pipelines', []),
-        ));
-
-        // Real I/O implementations; tests swap in fakes via app()->instance().
-        $this->app->bind(RemoteShell::class, PhpseclibRemoteShell::class);
-        $this->app->bind(WireguardHub::class, LocalWireguardHub::class);
-        $this->app->bind(ProxmoxClient::class, HttpProxmoxClient::class);
-        $this->app->bind(HetznerDnsClient::class, HttpHetznerDnsClient::class);
-        $this->app->bind(TraefikWriter::class, SshTraefikWriter::class);
-        $this->app->bind(MonitoringClient::class, HttpMonitoringClient::class);
-        $this->app->bind(StripeClient::class, HttpStripeClient::class);
+        //
     }
 
     /**
@@ -56,80 +19,6 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        // Livewire posts every component action to /livewire/update, which a
-        // path-based guard would skip. Marking the host restriction persistent
-        // makes Livewire re-apply it from the component's original route, so an
-        // admin action cannot be driven through a public hostname.
-        // Livewire re-applies only the middleware on this list when an action
-        // posts to /livewire/update. Its own defaults cover `auth` — but not
-        // ours. Without these two, a signed-in NON-operator could drive console
-        // components, and a suspended customer could keep driving the portal:
-        // the page would never load for them, but the page is not where the
-        // actions run.
-        Livewire::addPersistentMiddleware([
-            RestrictAdminHost::class,
-            RestrictConsoleNetwork::class,
-            EnsureAdmin::class,
-            EnsureCustomerActive::class,
-        ]);
-
-        // Send-time guard for maintenance mail (X-CP-Notification carries the
-        // ledger id). Deliberately READ-ONLY — it never marks the row sent or
-        // claimed, because returning false makes Laravel treat the send as a
-        // successful cancellation: pre-claiming here would silently DROP a mail
-        // whose transport later fails and retries. It only suppresses a send that
-        // is definitively pointless: the window was cancelled, or a sibling copy
-        // already delivered (sent_at set). sent_at is recorded on real delivery
-        // in MessageSent, so nothing is ever lost.
         //
-        // Residual: two jobs whose MessageSending both fire before either's
-        // MessageSent (true simultaneous multi-worker send of a stale resend) can
-        // still both deliver. That cannot happen on the current single-worker
-        // log-mail setup; true exactly-once needs a transactional outbox + a
-        // dedicated delivery worker keyed on claimed_at, to be added with real mail.
-        Event::listen(MessageSending::class, function (MessageSending $event) {
-            $header = $event->message->getHeaders()->get('X-CP-Notification');
-            if ($header === null) {
-                return null;
-            }
-            $notification = MaintenanceNotification::query()->with('window')->find((int) $header->getBodyAsString());
-            if ($notification === null) {
-                return null;
-            }
-            if ($notification->sent_at !== null) {
-                return false; // already delivered — suppress a duplicate copy
-            }
-            if ($notification->event === 'announcement' && $notification->window?->state === 'cancelled') {
-                return false; // window cancelled meanwhile — do not deliver
-            }
-
-            return null;
-        });
-
-        // Stamp a maintenance-notification ledger row as delivered only once the
-        // mail is actually sent (the X-CP-Notification header carries the id).
-        // Until then sent_at stays null → the row is a retryable marker. If an
-        // announcement delivered for an already-cancelled window (the cancel race),
-        // queue a catch-up cancellation so that customer isn't left mis-informed.
-        Event::listen(MessageSent::class, function (MessageSent $event) {
-            $header = $event->message->getHeaders()->get('X-CP-Notification');
-            if ($header === null) {
-                return;
-            }
-            $notification = MaintenanceNotification::query()->with(['window', 'customer'])->find((int) $header->getBodyAsString());
-            if ($notification === null) {
-                return;
-            }
-            $notification->update(['sent_at' => now()]);
-
-            if ($notification->event === 'announcement' && $notification->window?->state === 'cancelled' && $notification->customer !== null) {
-                app(MaintenanceNotifier::class)->deliver(
-                    $notification->window,
-                    $notification->customer,
-                    'cancelled',
-                    new MaintenanceCancelledMail($notification->window, $notification->customer),
-                );
-            }
-        });
     }
 }

app/Providers/FortifyServiceProvider.php

@@ -1,60 +0,0 @@
-<?php
-
-namespace App\Providers;
-
-use App\Actions\Fortify\CreateNewUser;
-use App\Actions\Fortify\ResetUserPassword;
-use App\Actions\Fortify\UpdateUserPassword;
-use App\Actions\Fortify\UpdateUserProfileInformation;
-use Illuminate\Cache\RateLimiting\Limit;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\RateLimiter;
-use Illuminate\Support\ServiceProvider;
-use Illuminate\Support\Str;
-use Laravel\Fortify\Actions\RedirectIfTwoFactorAuthenticatable;
-use Laravel\Fortify\Fortify;
-
-class FortifyServiceProvider extends ServiceProvider
-{
-    /**
-     * Register any application services.
-     */
-    public function register(): void
-    {
-        //
-    }
-
-    /**
-     * Bootstrap any application services.
-     */
-    public function boot(): void
-    {
-        Fortify::createUsersUsing(CreateNewUser::class);
-        Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);
-        Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
-        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
-        Fortify::redirectUserForTwoFactorAuthenticationUsing(RedirectIfTwoFactorAuthenticatable::class);
-
-        RateLimiter::for('login', function (Request $request) {
-            $throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
-
-            return Limit::perMinute(5)->by($throttleKey);
-        });
-
-        RateLimiter::for('two-factor', function (Request $request) {
-            return Limit::perMinute(5)->by($request->session()->get('login.id'));
-        });
-
-        // Registration is public (no per-account key), so throttle per IP to blunt
-        // signup spam / CPU-exhaustion via repeated password hashing.
-        RateLimiter::for('registration', fn (Request $request) => Limit::perMinute(10)->by($request->ip()));
-
-        RateLimiter::for('passkeys', function (Request $request) {
-            $credentialId = $request->input('credential.id');
-
-            return Limit::perMinute(10)->by(
-                ($credentialId ?: $request->session()->getId()).'|'.$request->ip()
-            );
-        });
-    }
-}