.env.example

@@ -63,150 +63,23 @@ REVERB_SERVER_PORT=8080
 # browser-side (baked into built assets): the address a browser can reach
 VITE_REVERB_APP_KEY=change-me-app-key
 VITE_REVERB_HOST=localhost
-VITE_REVERB_PORT=443
-VITE_REVERB_SCHEME=https
+VITE_REVERB_PORT=8080
+VITE_REVERB_SCHEME=http
 VITE_APP_NAME=CluPilot
 
 # Vite HMR host the browser connects to (dev). Set to the reachable VM address
 # when developing against a remote host; localhost for local-only.
 VITE_HMR_HOST=localhost
 
-# ── Mail ─────────────────────────────────────────────────────────────────
-# DEV: `log` writes mails to storage/logs (nothing is sent).
-# PROD: switch to smtp and fill in the credentials below.
+# ── Mail (dev → log) ─────────────────────────────────────────────────────
 MAIL_MAILER=log
 MAIL_FROM_ADDRESS=hello@clupilot.local
 MAIL_FROM_NAME=CluPilot
-# MAIL_MAILER=smtp
-# MAIL_HOST=smtp.your-provider.tld
-# MAIL_PORT=587
-# MAIL_USERNAME=
-# MAIL_PASSWORD=
-# MAIL_SCHEME=tls           # tls | smtps (465)
-
-# ═════════════════════════════════════════════════════════════════════════
-#  CluPilot operations — fill these in to run real provisioning.
-#  Everything below is OPTIONAL for local dev: left blank, the services are
-#  no-ops/fakes and the app + test suite still run. Only real infrastructure
-#  work (host onboarding, customer provisioning) needs them.
-# ═════════════════════════════════════════════════════════════════════════
-
-# ── Stripe (payments) ────────────────────────────────────────────────────
-# WEBHOOK_SECRET is READ BY CODE today (signature check on /webhooks/stripe).
-# Outside local/testing a missing secret makes the webhook fail closed.
-STRIPE_WEBHOOK_SECRET=
-# Not read yet — needed once the Checkout flow is built (currently the portal
-# only records a purchase intent):
-STRIPE_KEY=
-STRIPE_SECRET=
-
-# ── DNS (Hetzner DNS API) ────────────────────────────────────────────────
-# Creates <subdomain>.<zone> A-records for each customer instance.
-HETZNER_DNS_TOKEN=
-CLUPILOT_DNS_ZONE=clupilot.com
-
-# ── Traefik (reverse proxy + TLS) ────────────────────────────────────────
-# Directory ON THE PROXMOX HOST where CluPilot writes dynamic route files.
-TRAEFIK_DYNAMIC_PATH=/etc/traefik/dynamic
-
-# ── WireGuard hub (this CluPilot VM) ─────────────────────────────────────
-# Hosts join this hub during onboarding; CluPilot reaches them over the tunnel.
-CLUPILOT_WG_SUBNET=10.66.0.0/24
-CLUPILOT_WG_HUB_IP=10.66.0.1
-CLUPILOT_WG_ENDPOINT=              # public host:port peers dial, e.g. vpn.clupilot.com:51820
-CLUPILOT_WG_HUB_PUBKEY=            # `wg pubkey < /etc/wireguard/privatekey`
-CLUPILOT_WG_CONFIG_PATH=/etc/wireguard/wg0.conf
-
-# ── SSH identity for host onboarding ─────────────────────────────────────
-# Deployed to each fresh server after the one-time root password login.
-# PREFERRED: point at files (a multi-line PEM cannot live in .env).
-#   ssh-keygen -t ed25519 -N '' -C clupilot -f storage/app/ssh/clupilot
-CLUPILOT_SSH_PUBLIC_KEY_PATH=
-CLUPILOT_SSH_PRIVATE_KEY_PATH=
-# Alternative (single-line values only):
-CLUPILOT_SSH_PUBLIC_KEY=
-CLUPILOT_SSH_PRIVATE_KEY=
-CLUPILOT_SSH_COMMAND_TIMEOUT=2000
-
-# ── Monitoring ───────────────────────────────────────────────────────────
-# The built-in client speaks a GENERIC REST API:
-#   GET/POST /monitors, GET/DELETE /monitors/{id}
-# For Uptime Kuma use the bundled bridge below (Kuma's own REST API is
-# read-only — monitor CRUD goes through Socket.IO):
-#   MONITORING_API_URL=http://kuma-bridge:8080
-# Leave blank to disable monitoring entirely: provisioning records a stable
-# breadcrumb and its own health checks (occ status, TLS, admin user) still
-# gate acceptance.
-MONITORING_API_URL=
-MONITORING_API_TOKEN=
-
-# ── Uptime Kuma (über die mitgelieferte Bridge) ───────────────────────────
-# Kuma kann Monitore nur über Socket.IO anlegen, daher die Bridge:
-#   docker compose --profile monitoring up -d --build kuma-bridge
-# Danach hier MONITORING_API_URL auf die Bridge zeigen lassen:
-#   MONITORING_API_URL=http://kuma-bridge:8080
-# MONITORING_API_TOKEN ist gleichzeitig das Bridge-Token (frei wählbar, lang).
-KUMA_URL=
-KUMA_USERNAME=
-KUMA_PASSWORD=
-KUMA_TOTP=
-
-# Monitoring-Verhalten bei Ausfall:
-#   MONITORING_REQUIRED=false -> Bereitstellung läuft weiter (Warn-Event), Standard
-#   MONITORING_REQUIRED=true  -> Lauf schlägt fehl, wenn Monitoring nicht erreichbar
-MONITORING_REQUIRED=false
-MONITORING_ATTEMPTS=2
-
-# ── Admin-Konsole: erlaubte Hostnamen ────────────────────────────────────
-# Die Proxmox-Hosts UND das Admin-Dashboard dürfen nie öffentlich erreichbar
-# sein. Primär regelt das dein Reverse Proxy (nur www/app/ws/api öffentlich);
-# dies ist die zweite Verteidigungslinie IN der App: auf jedem anderen Host
-# antwortet /admin mit 404 (nicht 403 — verrät nicht, dass es die Konsole gibt).
-# Komma-getrennt. LEER = keine Einschränkung (aktueller Dev-Stand).
-# Beispiel: # Schluessel fuer gespeicherte VPN-Konfigurationen (32 Byte, base64).
-# Bewusst getrennt von APP_KEY. Leer = Speichern deaktiviert.
-# Erzeugen: head -c 32 /dev/urandom | base64
-VPN_CONFIG_KEY=
-
-# Netze, die als "wir" gelten, solange die Website versteckt ist
-# (WireGuard-Subnetz). Alles andere sieht die Platzhalterseite.
-TRUSTED_RANGES=10.66.0.0/24,127.0.0.1
-
-# Umsatzsteuersatz des Verkäufers in Prozent. Preise in der Konfiguration
-# sind NETTO; die Oberfläche weist beides aus.
-CLUPILOT_TAX_PERCENT=20
-
-ADMIN_HOSTS=admin.dev.clupilot.com,10.10.90.185,localhost,127.0.0.1
-
-# ── Nextcloud blueprint template ─────────────────────────────────────────
-# NOT an env var: set the Proxmox template VMID per plan in
-# config/provisioning.php → plans.*.template_vmid (default 9000).
 
 # ── docker-compose knobs (host-side) ─────────────────────────────────────
 HOST_UID=1000
 HOST_GID=1000
-# Behind a reverse proxy — which is every production install — these must stay
-# on loopback: Docker publishes ports ahead of UFW, so anything on 0.0.0.0 is
-# reachable from the internet regardless of the firewall, and reaching a backend
-# directly skips every hostname and address rule the proxy enforces.
-# For local development without a proxy, set APP_PORT=80.
-APP_PORT=127.0.0.1:8080
-# Vite dev server (HMR). Off by default: over the HTTPS domains the
-# browser cannot load assets from http://<ip>:5173. Set true only when
-# working over http://10.10.90.185, then run: docker compose up -d app
-VITE_AUTOSTART=false
+APP_PORT=80
 VITE_PORT=5173
-REVERB_HOST_PORT=127.0.0.1:8081
+REVERB_HOST_PORT=8080
 DB_HOST_PORT=3306
-
-# ── CI (Gitea Actions) ──────────────────────────────────────────────────────
-# Registrierungs-Token aus Gitea: Repo → Settings → Actions → Runners →
-# "Create new runner". Danach:  docker compose --profile ci up -d runner
-GITEA_INSTANCE_URL=https://git.bave.dev
-GITEA_RUNNER_TOKEN=
-GITEA_RUNNER_NAME=clupilot-local
-# Passend zur Server-Version halten (1.20 verträgt keinen aktuellen Runner).
-GITEA_RUNNER_VERSION=0.2.6
-
-# Zone in der Zeiten ANGEZEIGT werden. Gespeichert wird immer UTC.
-APP_DISPLAY_TIMEZONE=Europe/Vienna

.gitea/workflows/tests.yml

@@ -1,118 +0,0 @@
-# CluPilot CI — runs on Gitea Actions (GitHub-Actions syntax, own runner).
-#
-# Deliberately not mirrored to GitHub: this repository describes how our
-# infrastructure is provisioned, and the same workflow runs at home. If we ever
-# move, this file goes along unchanged.
-name: tests
-
-on:
-  push:
-    branches: [main, 'feat/**']
-  pull_request:
-
-jobs:
-  pest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.2.2
-
-      - name: Set up PHP
-        # Pinned: the floating v2 tag now requires node24, which the runner
-        # matching Gitea 1.20 cannot execute. 2.34.1 is the newest that still
-        # declares node20.
-        uses: shivammathur/setup-php@2.34.1
-        with:
-          php-version: '8.4'
-          extensions: mbstring, pdo_sqlite, sodium, redis, bcmath, gd, zip
-          coverage: none
-
-      - name: Install PHP dependencies
-        # Source clones, not dist archives: dist downloads go through GitHub's
-        # API, which throttles anonymous callers and left a half-installed
-        # vendor/ behind — the tests then failed with 500s that had nothing to
-        # do with the code. Cloning is slower and does not need anyone's quota.
-        # Swap back to --prefer-dist once a GitHub token is configured.
-        run: composer install --no-interaction --prefer-source --no-progress
-
-      - name: Prepare environment
-        run: |
-          cp .env.example .env
-          php artisan key:generate
-
-      - name: Tests
-        # phpunit.xml pins its own sqlite/array drivers, so no services needed.
-        run: ./vendor/bin/pest --colors=always
-
-  assets:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.2.2
-
-      - uses: actions/setup-node@v4.1.0
-        with:
-          node-version: '22'
-
-      - name: Install JS dependencies
-        run: npm ci --no-fund --no-audit
-
-      # A build failure here is what used to surface as "the design is broken"
-      # only after deploying — catch it before it ships.
-      - name: Build assets
-        run: npm run build
-
-  release:
-    # Only a green run produces the tag the console offers as an update.
-    needs: [pest, assets]
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Tag this commit as tested
-        run: |
-          tag="tested-$(date -u +%Y%m%d-%H%M)-$(git rev-parse --short HEAD)"
-          git tag "$tag"
-          git push origin "$tag"
-
-      # A release is cut by editing VERSION and merging it — nothing else. The
-      # tag is created here, only after the suite is green, and only if it does
-      # not already exist. Never moved: servers are pinned to these, and a tag
-      # that changes underneath them means two machines claiming one version.
-      - name: Tag the release when VERSION changed
-        run: |
-          version="$(tr -d ' \n\r' < VERSION)"
-          # Anchored, because a `case` glob does not anchor: `[0-9]*.[0-9]*`
-          # happily accepts 1x.2y.3garbage and would tag it.
-          printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
-            || { echo "VERSION is not MAJOR.MINOR.PATCH: '$version'" >&2; exit 1; }
-
-          # Only the commit that RAISED the version is the release. Without
-          # this, any later green push finds the tag missing and claims it —
-          # and the tag would then name code the bump never described. Runs
-          # overlap and finish out of order; that is enough for it to happen.
-          previous="$(git show 'HEAD^:VERSION' 2>/dev/null | tr -d ' \n\r' || true)"
-          if [ "$previous" = "$version" ]; then
-            echo "::notice::VERSION is unchanged ($version) — nothing to release."
-            exit 0
-          fi
-
-          tag="v${version}"
-          git fetch --tags --force origin
-
-          if existing="$(git rev-parse -q --verify "refs/tags/${tag}^{commit}")"; then
-            # Already released. The invariant is that the tag points at the
-            # commit VERSION was raised in — if a later commit still carries
-            # that number, that is fine, but the tag must not be re-pointed.
-            if [ "$existing" != "$(git rev-parse HEAD)" ]; then
-              echo "::notice::${tag} already exists at ${existing}; leaving it alone."
-            fi
-            exit 0
-          fi
-
-          git config user.name  "CluPilot CI"
-          git config user.email "ci@clupilot.local"
-          git tag -a "$tag" -m "CluPilot ${version}"
-          git push origin "$tag"
-          echo "::notice::Released ${tag}"

.gitignore

@@ -28,4 +28,3 @@ Thumbs.db
 
 # Gitea push token (parent home dir; never track)
 .env.gitea
-clupilot.env

CLAUDE.md

@@ -1,152 +0,0 @@
-# CluPilot — verbindliche Regeln (Repo-Teil)
-
-Die **Vollfassung der Regeln R1–R17 liegt beim Nutzer**, nicht im Repo. Die
-Kurzfassung steht in `docs/handoffs/2026-07-25-clupilot-state-handoff.md` §9.
-Bei Konflikt: **STOP & fragen.**
-
-Diese Datei hält die Regeln fest, die aus konkreten Fehlern im laufenden Betrieb
-entstanden sind — sie sind nicht verhandelbar und werden per Test erzwungen.
-
----
-
-## R18 — Icon-Größe und Zeilenumbruch
-
-**Ein Icon steht neben seinem Text, nie darüber, und nie größer als bestellt.**
-
-Verboten:
-
-1. **Icon zwingt den Text auf eine zweite Zeile.** Ein Navigationseintrag, ein
-   Button, ein Tabellen-Action ist **einzeilig**. Zwei Zeilen sind nur erlaubt,
-   wenn der Text selbst bewusst zweizeilig gesetzt ist (Label + Unterzeile) —
-   dann steht das Icon links davon, nicht darüber.
-2. **Icon größer als die Zeile, in der es sitzt.** Standard ist `size-5` (20px)
-   in der Navigation, `size-4` (16px) in Buttons, Tabellen und Fließtext.
-   Größer nur, wenn es als eigenständiges Element gemeint ist (Leerzustand,
-   Statusplakette).
-
-### Warum das zweimal schiefging
-
-- **Zeilenumbruch.** Tailwinds Preflight setzt `svg { display: block }`. Ein
-  Icon in einem *inline*-Elternteil schiebt den folgenden Text damit auf die
-  nächste Zeile. Genau so wurde aus dem Eintrag „Zugangsdaten" ein doppelt so
-  hoher Kasten mit Schloss oben und Wort darunter.
-- **Größe.** `.size-4` und `.size-5` haben **dieselbe Spezifität**, also
-  entscheidet die Reihenfolge im Stylesheet — und Tailwind gibt `.size-4` *vor*
-  `.size-5` aus. Eine Komponente, die `size-5` bedingungslos mitmergt, überstimmt
-  damit **jedes** `class="size-4"` am Aufrufort. Alle so geschriebenen Icons
-  liefen still auf 20px.
-
-### Wie es jetzt gebaut ist
-
-- `resources/views/components/ui/icon.blade.php` setzt seine Standardgröße
-  **nur**, wenn der Aufrufort keine `size-`/`w-`/`h-`-Klasse mitgibt, und
-  rendert `inline-block shrink-0 align-middle` statt des Preflight-`block`.
-- `resources/views/components/ui/nav-item.blade.php` legt Label und Icon in eine
-  eigene Flex-Zeile, damit ein Icon auch im falschen Slot daneben landet.
-- Icons in `<x-ui.nav-item>` gehören in `<x-slot:icon>`, nicht in den
-  Default-Slot.
-
-### Erzwungen durch
-
-`tests/Feature/IconLayoutTest.php` — Größe des Aufruforts gewinnt, Icon bleibt
-`inline-block`, Nav-Eintrag bleibt einzeilig aus beiden Slots, und kein
-Blade-File im Repo darf ein Icon am Icon-Slot vorbeischmuggeln.
-
----
-
-## R19 — Zeitzone: gespeichert in UTC, angezeigt auf der Wanduhr
-
-**Jede Zeit, die ein Mensch liest, geht vorher durch `->local()`.**
-
-Verboten:
-
-1. **Einen gespeicherten Zeitstempel direkt formatieren.** `$model->created_at->isoFormat(…)`
-   liefert UTC. Richtig ist `$model->created_at->local()->isoFormat(…)`.
-2. **`->timezone(config('app.timezone'))`.** Das ist die *Speicher*zone und bleibt
-   UTC — der Aufruf sieht aus wie eine Umrechnung und ist keine.
-3. **Ein `datetime-local`-Feld nur in eine Richtung behandeln.** Rein und raus
-   gehören zusammen: `LocalTime::toField()` und `LocalTime::fromField()`.
-   Ein Feld hat keine Zeitzone; es sind die Ziffern, die jemand auf der eigenen
-   Uhr abliest.
-
-Ausgenommen: `diffForHumans()` ist relativ und in jeder Zone gleich.
-
-### Warum das durchgerutscht ist
-
-Die Konsole kündigte eine Aktualisierung „spätestens um 15:21" an, während die
-Uhr 17:21 zeigte. Zwei der vierzehn betroffenen Ansichten sahen sogar behandelt
-aus — sie riefen `->timezone(config('app.timezone'))`, was sich liest wie „in
-Ortszeit umrechnen" und, weil diese Zone UTC ist, nichts tut. Eine Attrappe ist
-schlimmer als gar kein Aufruf: sie hält den Nächsten vom Nachsehen ab.
-
-Schlimmer als die Anzeigen waren zwei **Formulare**: Wartungsfenster und
-Paketversionen füllten ihre Felder mit UTC und lasen sie als UTC zurück. Ein
-eingetragenes „21:00" wurde zu 23:00 Ortszeit.
-
-Und die Tests deckten es nicht auf, weil sie den erwarteten Wert **mit demselben
-falschen Aufruf** bildeten. Ein Test, der die Implementierung nachrechnet, prüft
-nichts.
-
-### Wie es jetzt gebaut ist
-
-- `config('app.display_timezone')` (`APP_DISPLAY_TIMEZONE`, Vorgabe
-  `Europe/Vienna`) getrennt von `app.timezone`, das UTC bleibt.
-- `->local()` als Carbon-Makro in `AppServiceProvider`. Es **kopiert** vor dem
-  Umstellen: `Illuminate\Support\Carbon` ist mutabel, sonst schriebe das bloße
-  Anzeigen das Modellattribut um. Beide Klassen bekommen denselben Rumpf —
-  Carbon führt Makros in *einer* globalen Tabelle, die zweite Registrierung
-  ersetzt die erste für alle.
-- `App\Support\LocalTime` hält beide Feldrichtungen nebeneinander, damit niemand
-  eine ändert, ohne die andere zu sehen.
-
-### Erzwungen durch
-
-`tests/Feature/DisplayTimezoneTest.php` — kein Blade und kein Livewire-Bauteil
-darf absolut formatieren ohne `->local()`, die UTC-Attrappe ist verboten,
-Speicherzone bleibt UTC, Sommer- **und** Winterzeit werden geprüft, `->local()`
-verändert das Original nicht, und der Feld-Round-Trip kommt als derselbe
-Zeitpunkt zurück.
-
----
-
-## R20 — Bearbeiten passiert im Modal, nie in der Zeile
-
-**Sobald etwas Eingabefelder hat, geht ein Modal auf.**
-
-Verboten:
-
-1. **Inline-Bearbeitung in einer Tabellenzeile.** Kein `<input>`, kein
-   `<textarea>` in einem `<td>`. Die Zeile wächst, die Spalten daneben springen,
-   und eine halb im Bearbeitungsmodus stehende Tabelle liest sich wie ein
-   Darstellungsfehler, nicht wie ein Formular.
-2. **Ein Bearbeiten-Knopf, der eine Methode am Seiten-Bauteil aufruft.** Er
-   schickt `openModal` — alles andere ist der Inline-Editor unter neuem Namen.
-
-Nicht betroffen: Formulare, die *die Seite sind* — Anlegen-Formulare, die
-Einstellungsseite, die Einladen-Zeile über einer Tabelle. Die bearbeiten keinen
-bestehenden Datensatz an Ort und Stelle.
-
-Ausnahmen, die kein Modal brauchen: ein einzelnes `<select>` oder eine
-Checkbox in der Zeile (Rolle umstellen, aktiv schalten). Ein Klick, ein Wert,
-keine Höhenänderung.
-
-### Warum das aufgeschrieben wurde
-
-Das Projekt hatte das Modal längst — `EditDatacenter`, mit genau dieser
-Begründung im Kopfkommentar („avoids the row-height jump of inline editing").
-Die Benutzertabelle hat es einfach nicht benutzt, und ich habe die
-Bearbeitung inline gebaut, obwohl das Muster danebenlag.
-
-### Wie es jetzt gebaut ist
-
-- `App\Livewire\EditSeat` als `ModalComponent`, geöffnet über
-  `$dispatch('openModal', { component: 'edit-seat', arguments: { uuid } })`.
-- Ein Modal ist **ohne** die Route-Middleware der Seite erreichbar. Es löst
-  deshalb den Kunden selbst auf und liest den Datensatz neu, statt einer vom
-  Browser hydrierten Eigenschaft zu glauben.
-
-### Erzwungen durch
-
-`tests/Feature/EditInModalTest.php` — kein Seiten-Blade darf ein Eingabefeld in
-einem `<td>` wachsen lassen, und die Benutzertabelle muss `edit-seat` per
-`openModal` öffnen.

VERSION

@@ -1 +0,0 @@
-1.0.0

app/Actions/ApplyStripeBillingEvent.php

@@ -1,459 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\StripePendingEvent;
-use App\Models\Subscription;
-use App\Models\SubscriptionRecord;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-
-/**
- * What Stripe tells us about the billing cycle, applied to the contract.
- *
- * The division of labour: Stripe owns the money — retries, dunning, off-session
- * SCA, invoice numbering — and we own capability, because Stripe does not know
- * how big the VM should be. So these handlers move period boundaries and status,
- * and write the register. They never re-derive an amount: the invoice is the
- * authority for what was charged, and recomputing it here from our own
- * catalogue would produce a second, disagreeing answer.
- *
- * Every handler is idempotent. Stripe retries a webhook until it gets a 2xx,
- * and it also sends the same event to several endpoints — so "already applied"
- * is the normal case, not the exception.
- */
-class ApplyStripeBillingEvent
-{
-    /**
-     * Precedence when two events share a second — highest wins.
-     *
-     * Ordered by how much the event settles: a payment that went through is the
-     * last word, a snapshot of the subscription is a running picture, and a
-     * failed attempt is the least final of the three, since a retry may already
-     * have succeeded.
-     */
-    private const RANK_PAID = 3;
-
-    private const RANK_UPDATED = 2;
-
-    private const RANK_FAILED = 1;
-
-    public function __construct(private RecordCommercialEvent $record) {}
-
-    /**
-     * A renewal was paid. Move the period on and enter it in the register.
-     *
-     * @param  array<string, mixed>  $invoice
-     */
-    public function invoicePaid(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
-    {
-        $subscription = $this->resolve($invoice['subscription'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        $reason = (string) ($invoice['billing_reason'] ?? '');
-
-        // The checkout's own invoice is not a renewal — it is the purchase, and
-        // OpenSubscription has already entered it. Recording it again here
-        // would double every customer's first payment in the register.
-        if ($reason === 'subscription_create') {
-            return null;
-        }
-
-        // Only a cycle renewal moves the term on. Stripe also sends paid
-        // invoices for prorations and for charges raised by hand, and those are
-        // money received without being the start of a new month — calling them
-        // renewals would push the period forward on a top-up.
-        $isRenewal = $reason === 'subscription_cycle';
-        $invoiceId = (string) ($invoice['id'] ?? '');
-
-        [$start, $end] = $this->period($invoice);
-
-        // A contract that has ended stays ended (mutateInOrder refuses one), so
-        // a final invoice arriving after the deletion cannot hand a departed
-        // customer their service back. The payment is still entered in the
-        // register below; it did happen.
-        if ($isRenewal && $start !== null && $end !== null) {
-            $this->mutateInOrder($subscription, $eventAt, self::RANK_PAID, fn (Subscription $fresh) => $end
-                // Never backwards: a renewal delayed behind the next one would
-                // otherwise shorten the term the customer has already paid for.
-                ->greaterThanOrEqualTo($fresh->current_period_end)
-                    // Period boundaries are not part of the frozen snapshot:
-                    // what the customer is owed does not change, only which
-                    // month it is.
-                    ? [
-                        'current_period_start' => $start,
-                        'current_period_end' => $end,
-                        'status' => 'active',
-                        'stripe_status' => 'active',
-                    ]
-                    : null);
-        }
-
-        // One invoice, one entry — enforced by the unique index rather than by
-        // a check, because Stripe can deliver the same invoice twice at once
-        // and both deliveries would pass a check.
-        $event = $isRenewal ? SubscriptionRecord::EVENT_RENEWAL : SubscriptionRecord::EVENT_INVOICE_PAID;
-
-        return $this->recordOnce(
-            fn () => ($this->record)(
-                event: $event,
-                subscription: $subscription->refresh(),
-                netCents: $isRenewal ? $subscription->price_cents : 0,
-                stripe: [
-                    'invoice' => $invoiceId ?: null,
-                    'subscription' => $subscription->stripe_subscription_id,
-                ],
-                // The exact kind, kept so a proration or a manual charge stays
-                // distinguishable from an ordinary renewal.
-                extra: ['billing_reason' => $reason ?: null],
-                // Stripe's total is what was actually taken, tax and all. Ours
-                // is what was agreed; the register states both.
-                chargedGrossCents: isset($invoice['amount_paid']) ? (int) $invoice['amount_paid'] : null,
-                eventKey: $invoiceId !== '' ? "{$event}:{$invoiceId}" : null,
-            )
-        );
-    }
-
-    /**
-     * A renewal failed. Recorded, and nothing else: Stripe runs the dunning
-     * schedule, and cutting a customer off on the first failed attempt would
-     * punish an expired card as though it were a refusal to pay.
-     *
-     * @param  array<string, mixed>  $invoice
-     */
-    public function invoicePaymentFailed(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
-    {
-        $subscription = $this->resolve($invoice['subscription'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        $invoiceId = (string) ($invoice['id'] ?? '');
-
-        // Only if this is the newest word we have. A failed attempt delayed
-        // behind the successful retry would otherwise flip a customer who has
-        // since paid back to past_due.
-        $this->mutateInOrder($subscription, $eventAt, self::RANK_FAILED, fn () => ['stripe_status' => 'past_due']);
-
-        return $this->recordOnce(
-            fn () => ($this->record)(
-                event: SubscriptionRecord::EVENT_PAYMENT_FAILED,
-                subscription: $subscription->refresh(),
-                netCents: 0,
-                stripe: [
-                    'invoice' => $invoiceId ?: null,
-                    'subscription' => $subscription->stripe_subscription_id,
-                ],
-                extra: ['attempt' => $invoice['attempt_count'] ?? null],
-                chargedGrossCents: 0,
-                // Per attempt, not per invoice: Stripe retries a failing
-                // payment on a schedule, and each attempt is its own event.
-                eventKey: $invoiceId !== ''
-                    ? 'payment_failed:'.$invoiceId.':'.($invoice['attempt_count'] ?? 0)
-                    : null,
-            )
-        );
-    }
-
-    /**
-     * Stripe's own status changed. Theirs is the authority on whether the money
-     * is arriving; we copy it, and leave what the customer may USE to our own
-     * status, which only a cancellation or an operator changes.
-     *
-     * @param  array<string, mixed>  $object
-     */
-    public function subscriptionUpdated(array $object, ?Carbon $eventAt = null): ?Subscription
-    {
-        $subscription = $this->resolve($object['id'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        [$start, $end] = $this->period($object);
-
-        // Ended is ended, whatever order events arrive in — and an older
-        // snapshot must never overwrite a newer one it was delivered behind.
-        $this->mutateInOrder($subscription, $eventAt, self::RANK_UPDATED, fn () => array_filter([
-            'stripe_status' => $object['status'] ?? null,
-            'current_period_start' => $start,
-            'current_period_end' => $end,
-        ], fn ($value) => $value !== null));
-
-        return $subscription;
-    }
-
-    /**
-     * The subscription has ended at Stripe. That is the end of the contract,
-     * so it goes in the register — a cancellation nobody recorded is exactly
-     * the kind of gap the register exists to prevent.
-     *
-     * @param  array<string, mixed>  $object
-     */
-    public function subscriptionDeleted(array $object, ?Carbon $eventAt = null): ?SubscriptionRecord
-    {
-        $subscription = $this->resolve($object['id'] ?? null);
-
-        if ($subscription === null) {
-            return null;
-        }
-
-        $endedAt = isset($object['ended_at'])
-            ? Carbon::createFromTimestamp((int) $object['ended_at'])
-            : now();
-
-        // The ending and its entry in the register commit together. Marking the
-        // contract cancelled first and failing before the record would leave a
-        // retry seeing "already cancelled" and returning — and the end of a
-        // contract would never be entered at all.
-        return $this->recordOnce(fn () => DB::transaction(function () use ($subscription, $object, $endedAt, $eventAt) {
-            // Held while we decide, so a renewal arriving at the same moment
-            // cannot reactivate the contract between this and the write.
-            $subscription = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->firstOrFail();
-
-            // No ordering guard: an ending is final, so a late delivery of it
-            // is still correct. Only the running picture can go stale.
-            $subscription->update([
-                'status' => 'cancelled',
-                'stripe_status' => $object['status'] ?? 'canceled',
-                'cancelled_at' => $endedAt,
-                'stripe_event_at' => $eventAt,
-            ]);
-
-            return ($this->record)(
-                event: SubscriptionRecord::EVENT_CANCELLATION,
-                subscription: $subscription->refresh(),
-                netCents: 0,
-                at: $endedAt,
-                stripe: ['subscription' => $subscription->stripe_subscription_id],
-                chargedGrossCents: 0,
-                // A contract ends once. Two deliveries arriving together would
-                // both pass a status check; only one can take this key.
-                eventKey: 'cancellation:'.$subscription->id,
-            );
-        }));
-    }
-
-    /**
-     * Whether this event is the newest word we have about the contract.
-     *
-     * Stripe does not guarantee delivery order, and the state here is a
-     * running picture rather than a log: applying a stale snapshot on top of a
-     * fresher one is how a paid-up customer ends up looking overdue. The
-     * register is unaffected — each entry is keyed by what it is about, so a
-     * late arrival still lands once, in its proper place.
-     */
-    /**
-     * Decide and write in one step, with the contract's row held.
-     *
-     * The ordering guard is only worth as much as its atomicity: two
-     * deliveries for the same contract can both read a stale copy, both pass
-     * the check, and the loser then overwrites the winner — a renewal
-     * reactivating a contract a deletion had just ended, or an old failure
-     * burying a payment that went through. So the row is re-read under a lock
-     * and re-judged inside the transaction that writes it.
-     *
-     * `$changes` returns the columns to set, or null to decline.
-     *
-     * @param  callable(Subscription): ?array<string, mixed>  $changes
-     */
-    private function mutateInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank, callable $changes): void
-    {
-        DB::transaction(function () use ($subscription, $eventAt, $rank, $changes) {
-            $fresh = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->first();
-
-            if ($fresh === null
-                || $fresh->status === 'cancelled'
-                || ! $this->appliesInOrder($fresh, $eventAt, $rank)) {
-                return;
-            }
-
-            $values = $changes($fresh);
-
-            if ($values === null) {
-                return;
-            }
-
-            if ($eventAt !== null) {
-                $values['stripe_event_at'] = $eventAt;
-                $values['stripe_event_rank'] = $rank;
-            }
-
-            $fresh->update($values);
-        });
-
-        $subscription->refresh();
-    }
-
-    private function appliesInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank): bool
-    {
-        if ($eventAt === null || $subscription->stripe_event_at === null) {
-            return true;   // nothing to compare against
-        }
-
-        if ($eventAt->greaterThan($subscription->stripe_event_at)) {
-            return true;
-        }
-
-        if ($eventAt->lessThan($subscription->stripe_event_at)) {
-            return false;
-        }
-
-        // Same second, which Stripe's one-second timestamps make common enough
-        // to matter: a failed attempt and the retry that succeeded can share
-        // one. Decide by what the event says about the money.
-        return $rank >= (int) ($subscription->stripe_event_rank ?? 0);
-    }
-
-    /**
-     * Write a register entry, unless one already exists for this invoice and
-     * event.
-     *
-     * The uniqueness lives in the database, on (stripe_invoice_id, event).
-     * Checking first and inserting afterwards leaves a window that Stripe
-     * delivering the same invoice twice at once walks straight through — and a
-     * register that counts a payment twice is worse than one that is late.
-     *
-     * @param  callable(): SubscriptionRecord  $write
-     */
-    private function recordOnce(callable $write): ?SubscriptionRecord
-    {
-        try {
-            return $write();
-        } catch (UniqueConstraintViolationException) {
-            return null; // already recorded by a concurrent delivery
-        }
-    }
-
-    /**
-     * Hold an event whose contract does not exist yet, so it is not lost.
-     *
-     * @param  array<string, mixed>  $event
-     */
-    public function hold(array $event): void
-    {
-        $subscriptionId = $event['data']['object']['subscription']
-            ?? $event['data']['object']['id']
-            ?? null;
-
-        if (! is_string($subscriptionId) || ! is_string($event['id'] ?? null)) {
-            return;
-        }
-
-        // Only what we could not match. A handler returns null for several
-        // reasons — already recorded, or deliberately skipped, like every
-        // checkout's own invoice — and holding those would fill the table with
-        // rows that replayHeldFor() can never revisit, because their contract
-        // is right there. Nothing to wait for means nothing to hold.
-        if (Subscription::query()->where('stripe_subscription_id', $subscriptionId)->exists()) {
-            // Unless it appeared just now: the contract can be created between
-            // the handler missing it and this check, and the replay that would
-            // have collected it has then already been and gone. Apply it here
-            // instead of dropping it. Safe to repeat — the handlers are
-            // idempotent, so an event that was a no-op stays one.
-            $this->dispatch($event);
-
-            return;
-        }
-
-        StripePendingEvent::query()->updateOrCreate(
-            ['stripe_event_id' => $event['id']],
-            [
-                'stripe_subscription_id' => $subscriptionId,
-                'type' => (string) ($event['type'] ?? ''),
-                'raised_at' => isset($event['created']) && is_numeric($event['created'])
-                    ? Carbon::createFromTimestamp((int) $event['created'])
-                    : null,
-                'payload' => $event,
-            ],
-        );
-    }
-
-    /**
-     * Replay everything held for a contract that has just appeared.
-     *
-     * In their original order, so the ordering guard sees them as Stripe raised
-     * them rather than as they happened to be stored.
-     */
-    public function replayHeldFor(Subscription $subscription): int
-    {
-        if ($subscription->stripe_subscription_id === null) {
-            return 0;
-        }
-
-        $held = StripePendingEvent::query()
-            ->where('stripe_subscription_id', $subscription->stripe_subscription_id)
-            ->orderBy('raised_at')
-            ->orderBy('id')
-            ->get();
-
-        foreach ($held as $pending) {
-            $this->dispatch($pending->payload ?? []);
-            $pending->delete();
-        }
-
-        return $held->count();
-    }
-
-    /**
-     * Route one event to its handler. Returns false for a type we do not
-     * handle, so the caller can tell "not ours" from "nothing to do".
-     *
-     * @param  array<string, mixed>  $event
-     */
-    public function dispatch(array $event): mixed
-    {
-        $object = $event['data']['object'] ?? [];
-        $raisedAt = isset($event['created']) && is_numeric($event['created'])
-            ? Carbon::createFromTimestamp((int) $event['created'])
-            : null;
-
-        return match ($event['type'] ?? '') {
-            'invoice.paid' => $this->invoicePaid($object, $raisedAt),
-            'invoice.payment_failed' => $this->invoicePaymentFailed($object, $raisedAt),
-            'customer.subscription.updated' => $this->subscriptionUpdated($object, $raisedAt),
-            'customer.subscription.deleted' => $this->subscriptionDeleted($object, $raisedAt),
-            default => false,
-        };
-    }
-
-    /**
-     * Find the contract a Stripe event is about.
-     *
-     * An unknown id is logged and dropped rather than raised: Stripe delivers
-     * events for objects created by hand in the dashboard, and by other
-     * environments pointed at the same endpoint. Failing the webhook for those
-     * would have Stripe retry something that can never succeed.
-     */
-    private function resolve(mixed $stripeSubscriptionId): ?Subscription
-    {
-        $id = is_string($stripeSubscriptionId) ? $stripeSubscriptionId : null;
-
-        if ($id === null) {
-            return null;
-        }
-
-        return Subscription::query()->where('stripe_subscription_id', $id)->first();
-    }
-
-    /**
-     * @param  array<string, mixed>  $object
-     * @return array{0: ?Carbon, 1: ?Carbon}
-     */
-    private function period(array $object): array
-    {
-        $start = $object['period_start'] ?? $object['current_period_start'] ?? null;
-        $end = $object['period_end'] ?? $object['current_period_end'] ?? null;
-
-        return [
-            is_numeric($start) ? Carbon::createFromTimestamp((int) $start) : null,
-            is_numeric($end) ? Carbon::createFromTimestamp((int) $end) : null,
-        ];
-    }
-}

app/Actions/BookAddon.php

@@ -1,132 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Models\SubscriptionAddon;
-use App\Models\SubscriptionRecord;
-use App\Services\Billing\AddonCatalogue;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\DB;
-use RuntimeException;
-
-/**
- * Books a module onto a contract at today's price, and freezes it there.
- *
- * Booking is the moment the module's price stops moving for this customer, for
- * exactly the reason the plan's price does: they agreed to a figure. What they
- * have NOT booked stays on the live catalogue — that is a sale still to be
- * made, at whatever it costs now.
- */
-class BookAddon
-{
-    public function __construct(private RecordCommercialEvent $record) {}
-
-    public function __invoke(Subscription $subscription, string $addonKey, int $quantity = 1, ?Order $order = null): SubscriptionAddon
-    {
-        $price = app(AddonCatalogue::class)->priceCents($addonKey);
-
-        if ($price === null) {
-            throw new RuntimeException("Unknown add-on: {$addonKey}");
-        }
-
-        if ($quantity < 1) {
-            throw new RuntimeException('An add-on is booked at least once.');
-        }
-
-        try {
-            return $this->book($subscription, $addonKey, $quantity, $order, $price);
-        } catch (UniqueConstraintViolationException) {
-            // A concurrent retry won. The unique index on (order_id, addon_key)
-            // is what actually enforces "one order books one module" — the
-            // lookup below is only the fast path, and two transactions can both
-            // pass it.
-            return SubscriptionAddon::query()
-                ->where('order_id', $order?->id)
-                ->where('addon_key', $addonKey)
-                ->firstOrFail();
-        }
-    }
-
-    private function book(Subscription $subscription, string $addonKey, int $quantity, ?Order $order, int $price): SubscriptionAddon
-    {
-        // The booking and its entry in the register commit together: if the
-        // record could fail afterwards, retrying the same order would find the
-        // add-on already there and skip the event for good.
-        return DB::transaction(function () use ($subscription, $addonKey, $quantity, $order, $price) {
-            // Idempotent against a retried webhook: one order books one module.
-            if ($order !== null) {
-                $existing = SubscriptionAddon::query()
-                    ->where('order_id', $order->id)
-                    ->where('addon_key', $addonKey)
-                    ->first();
-
-                if ($existing !== null) {
-                    return $existing;
-                }
-            }
-
-            $addon = SubscriptionAddon::create([
-                'subscription_id' => $subscription->id,
-                'order_id' => $order?->id,
-                'addon_key' => $addonKey,
-                'price_cents' => $price,
-                'currency' => Subscription::catalogueCurrency(),
-                'quantity' => $quantity,
-                'booked_at' => now(),
-            ]);
-
-            ($this->record)(
-                event: SubscriptionRecord::EVENT_ADDON_BOOKED,
-                subscription: $subscription,
-                netCents: $addon->monthlyCents(),
-                extra: ['addon' => ['key' => $addonKey, 'quantity' => $quantity, 'price_cents' => $price]],
-                order: $order,
-                stripe: ['event' => $order?->stripe_event_id],
-                // What was actually charged for the module, on the same terms
-                // as a plan purchase: a discount or a free booking has to be
-                // reconcilable, not reconstructed from the catalogue.
-                chargedGrossCents: $order?->stripe_event_id !== null ? (int) $order->amount_cents : null,
-            );
-
-            return $addon;
-        });
-    }
-
-    /**
-     * Stop charging for a module, without losing what it cost.
-     *
-     * Cancelled, not deleted: what a customer was paying, and until when, is
-     * part of the same record as what they bought.
-     */
-    public function cancel(SubscriptionAddon $addon): SubscriptionAddon
-    {
-        return DB::transaction(function () use ($addon) {
-            // Claim the cancellation conditionally, so two requests arriving
-            // together write one event between them. Checking `isActive()` on
-            // separate instances and updating afterwards lets both through, and
-            // the register would show a module cancelled twice.
-            $claimed = SubscriptionAddon::query()
-                ->whereKey($addon->getKey())
-                ->whereNull('cancelled_at')
-                ->update(['cancelled_at' => now(), 'updated_at' => now()]);
-
-            if ($claimed === 0) {
-                return $addon->refresh();
-            }
-
-            $addon->refresh();
-
-            ($this->record)(
-                event: SubscriptionRecord::EVENT_ADDON_CANCELLED,
-                subscription: $addon->subscription,
-                netCents: -$addon->monthlyCents(),
-                extra: ['addon' => ['key' => $addon->addon_key, 'quantity' => $addon->quantity]],
-                order: $addon->order,
-            );
-
-            return $addon;
-        });
-    }
-}

app/Actions/Fortify/CreateNewUser.php

@@ -1,64 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\Customer;
-use App\Models\User;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\Rule;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\CreatesNewUsers;
-
-class CreateNewUser implements CreatesNewUsers
-{
-    use PasswordValidationRules;
-
-    /**
-     * Validate and create a newly registered user.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function create(array $input): User
-    {
-        Validator::make($input, [
-            'name' => ['required', 'string', 'max:255'],
-            'email' => [
-                'required',
-                'string',
-                'email',
-                'max:255',
-                Rule::unique(User::class),
-                // Never let public signup claim an existing (possibly not-yet-
-                // provisioned) customer's email — ensureUser() would later link
-                // that account and hand over the customer's portal.
-                Rule::unique(Customer::class, 'email'),
-            ],
-            'password' => $this->passwordRules(),
-        ])->validate();
-
-        // Create the user and its linked customer atomically — a public signup is
-        // a customer, and the portal (Billing::purchase, Settings, …) needs one.
-        // Either both exist or neither, so a failure never orphans a user.
-        return DB::transaction(function () use ($input) {
-            $user = User::create([
-                'name' => $input['name'],
-                'email' => $input['email'],
-                'password' => Hash::make($input['password']),
-            ]);
-
-            Customer::query()->create([
-                'user_id' => $user->id,
-                'name' => $input['name'],
-                'email' => $input['email'],
-                'locale' => app()->getLocale(),
-                'status' => 'active',
-            ]);
-
-            return $user;
-        });
-    }
-}

app/Actions/Fortify/PasswordValidationRules.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use Illuminate\Contracts\Validation\Rule;
-use Illuminate\Validation\Rules\Password;
-
-trait PasswordValidationRules
-{
-    /**
-     * Get the validation rules used to validate passwords.
-     *
-     * @return array<int, Rule|array<mixed>|string>
-     */
-    protected function passwordRules(): array
-    {
-        return ['required', 'string', Password::default(), 'confirmed'];
-    }
-}

app/Actions/Fortify/ResetUserPassword.php

@@ -1,32 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\User;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\ResetsUserPasswords;
-
-class ResetUserPassword implements ResetsUserPasswords
-{
-    use PasswordValidationRules;
-
-    /**
-     * Validate and reset the user's forgotten password.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function reset(User $user, array $input): void
-    {
-        Validator::make($input, [
-            'password' => $this->passwordRules(),
-        ])->validate();
-
-        $user->forceFill([
-            'password' => Hash::make($input['password']),
-        ])->save();
-    }
-}

app/Actions/Fortify/UpdateUserPassword.php

@@ -1,35 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\User;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\UpdatesUserPasswords;
-
-class UpdateUserPassword implements UpdatesUserPasswords
-{
-    use PasswordValidationRules;
-
-    /**
-     * Validate and update the user's password.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function update(User $user, array $input): void
-    {
-        Validator::make($input, [
-            'current_password' => ['required', 'string', 'current_password:web'],
-            'password' => $this->passwordRules(),
-        ], [
-            'current_password.current_password' => __('The provided password does not match your current password.'),
-        ])->validateWithBag('updatePassword');
-
-        $user->forceFill([
-            'password' => Hash::make($input['password']),
-        ])->save();
-    }
-}

app/Actions/Fortify/UpdateUserProfileInformation.php

@@ -1,61 +0,0 @@
-<?php
-
-namespace App\Actions\Fortify;
-
-use App\Models\User;
-use Illuminate\Contracts\Auth\MustVerifyEmail;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\Rule;
-use Illuminate\Validation\ValidationException;
-use Laravel\Fortify\Contracts\UpdatesUserProfileInformation;
-
-class UpdateUserProfileInformation implements UpdatesUserProfileInformation
-{
-    /**
-     * Validate and update the given user's profile information.
-     *
-     * @param  array<string, string>  $input
-     *
-     * @throws ValidationException
-     */
-    public function update(User $user, array $input): void
-    {
-        Validator::make($input, [
-            'name' => ['required', 'string', 'max:255'],
-
-            'email' => [
-                'required',
-                'string',
-                'email',
-                'max:255',
-                Rule::unique('users')->ignore($user->id),
-            ],
-        ])->validateWithBag('updateProfileInformation');
-
-        if ($input['email'] !== $user->email &&
-            $user instanceof MustVerifyEmail) {
-            $this->updateVerifiedUser($user, $input);
-        } else {
-            $user->forceFill([
-                'name' => $input['name'],
-                'email' => $input['email'],
-            ])->save();
-        }
-    }
-
-    /**
-     * Update the given verified user's profile information.
-     *
-     * @param  array<string, string>  $input
-     */
-    protected function updateVerifiedUser(User $user, array $input): void
-    {
-        $user->forceFill([
-            'name' => $input['name'],
-            'email' => $input['email'],
-            'email_verified_at' => null,
-        ])->save();
-
-        $user->sendEmailVerificationNotification();
-    }
-}

app/Actions/OpenSubscription.php

@@ -1,96 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Models\SubscriptionRecord;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\DB;
-
-/**
- * Opens the contract a paid order bought.
- *
- * This is the moment the catalogue stops applying. Everything the customer is
- * owed — price, quotas, seats, the hardware behind the plan — is copied onto
- * the subscription here and never read from the catalogue again. Provisioning
- * sizes the machine from this row, so an operator editing a plan afterwards
- * cannot reach a customer who has already paid.
- *
- * `price_cents` is the catalogue's NET price, which is what PlanChange prorates
- * against — deliberately not `Order::amount_cents`, which holds the GROSS total
- * Stripe actually charged. The two can legitimately differ (VAT, and later
- * coupons), and reconciling them is not this action's job: the proof register
- * records what was charged per event, and Stripe's invoice is the authority for
- * the amount. Copying a gross total into this net field would silently corrupt
- * every pro-rata calculation that reads it.
- */
-class OpenSubscription
-{
-    public function __construct(private RecordCommercialEvent $record) {}
-
-    public function __invoke(Order $order, string $term = Subscription::TERM_MONTHLY): Subscription
-    {
-        // A retried webhook must not open a second contract for one purchase.
-        $existing = Subscription::query()->where('order_id', $order->id)->first();
-
-        if ($existing !== null) {
-            return $existing;
-        }
-
-        $start = now();
-
-        // The contract and its entry in the register commit together. If the
-        // record could fail after the subscription is in, the next webhook
-        // retry would find the contract, return early, and leave a paid sale
-        // permanently missing from the evidence.
-        return DB::transaction(fn () => $this->open($order, $term, $start));
-    }
-
-    private function open(Order $order, string $term, Carbon $start): Subscription
-    {
-        $subscription = Subscription::create(array_merge(
-            // The version the order carries, when the checkout recorded one:
-            // what the customer saw beats what happens to be on sale by the
-            // time their payment reaches us.
-            Subscription::snapshotFrom($order->plan, $term, $order->plan_version_id),
-            [
-                'customer_id' => $order->customer_id,
-                'order_id' => $order->id,
-                // Carried from the checkout: from here on, Stripe's events
-                // name this and nothing else.
-                'stripe_subscription_id' => $order->stripe_subscription_id,
-                'started_at' => $start,
-                'current_period_start' => $start,
-                'current_period_end' => $term === Subscription::TERM_YEARLY
-                    ? $start->copy()->addYear()
-                    : $start->copy()->addMonth(),
-                'status' => 'active',
-            ],
-        ));
-
-        // The sale, entered in the register the moment it happens. Written from
-        // the contract that was just frozen, so the evidence and the contract
-        // cannot describe different purchases.
-        ($this->record)(
-            event: SubscriptionRecord::EVENT_PURCHASE,
-            subscription: $subscription,
-            netCents: $subscription->price_cents,
-            at: $start,
-            stripe: ['event' => $order->stripe_event_id],
-            // The order carries what Stripe actually took — gross, including
-            // whatever tax or discount applied on the day. The contract price
-            // is what was agreed; this is what was paid, and the register has
-            // to be able to state both.
-            //
-            // Keyed on the Stripe id, not on the amount being non-zero: a fully
-            // discounted checkout charges zero, and reading that as "no amount
-            // recorded" would file a free sale as though it had been paid for
-            // in full. An order without a Stripe id was never charged through
-            // a checkout at all, and has nothing to report.
-            chargedGrossCents: $order->stripe_event_id !== null ? (int) $order->amount_cents : null,
-        );
-
-        return $subscription;
-    }
-}

app/Actions/RecordCommercialEvent.php

@@ -1,146 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Models\SubscriptionRecord;
-use App\Services\Billing\TaxTreatment;
-use Illuminate\Support\Carbon;
-
-/**
- * Writes one row into the proof register.
- *
- * Every commercial event goes through here so that the flat columns are filled
- * the same way each time — an evidence table where the amount means one thing
- * in one row and another in the next is not evidence.
- *
- * Amounts are stated three ways on purpose. Net is what the catalogue and the
- * contract deal in; gross is what was actually charged; the tax between them
- * depends on the customer and on the day, and recomputing it later from a rate
- * that has since changed would produce a different answer to the one on the
- * invoice.
- */
-class RecordCommercialEvent
-{
-    /**
-     * @param  array<string, mixed>  $extra  merged into the JSON snapshot
-     * @param  array<string, string|null>  $stripe  event / invoice / subscription ids
-     */
-    public function __invoke(
-        string $event,
-        Subscription $subscription,
-        int $netCents,
-        ?Carbon $at = null,
-        array $extra = [],
-        array $stripe = [],
-        ?int $chargedGrossCents = null,
-        ?Order $order = null,
-        ?string $eventKey = null,
-    ): SubscriptionRecord {
-        $at ??= now();
-        $customer = $subscription->customer;
-        $tax = TaxTreatment::for($customer);
-
-        $agreedNet = $netCents;
-        $expectedGross = $tax->grossCents($agreedNet);
-
-        // The flat columns describe the TRANSACTION, not the contract: gross is
-        // what was taken from the customer, and net and tax are that gross
-        // split by the rate that applied on the day.
-        //
-        // Split, not subtracted from the agreed price. A discount lowers the
-        // taxable amount; it does not create negative VAT, and recording
-        // 14900 charged against a 179,00 contract as "minus 30,00 tax" would
-        // make the register wrong in exactly the case someone audits.
-        if ($chargedGrossCents !== null) {
-            $gross = $chargedGrossCents;
-            $net = (int) round($gross / (1 + $tax->rate));
-        } else {
-            $net = $agreedNet;
-            $gross = $expectedGross;
-        }
-
-        $version = $subscription->planVersion;
-
-        return SubscriptionRecord::create([
-            'event' => $event,
-            // What makes this event "the same one" if it arrives again. Unique
-            // where set, so a duplicate delivery collides in the database
-            // rather than in a check that two of them can both pass.
-            'event_key' => $eventKey,
-
-            'customer_id' => $subscription->customer_id,
-            'subscription_id' => $subscription->id,
-            // The order this event belongs to — a booked module has its own,
-            // and pointing it at the original plan purchase would file every
-            // add-on under the wrong transaction.
-            'order_id' => $order?->id ?? $subscription->order_id,
-            'plan_version_id' => $subscription->plan_version_id,
-
-            // Copied rather than joined: these have to still answer the question
-            // after the customer, the plan or the version have gone.
-            'customer_name' => $customer?->name,
-            'plan_key' => $subscription->plan,
-            'plan_version' => $version?->version,
-            'term' => $subscription->term,
-
-            'net_cents' => $net,
-            'tax_cents' => $gross - $net,
-            'gross_cents' => $gross,
-            'currency' => $subscription->currency,
-            'tax_rate' => round($tax->rate * 100, 2),
-            'reverse_charge' => $tax->reverseCharge,
-
-            'stripe_event_id' => $stripe['event'] ?? null,
-            'stripe_invoice_id' => $stripe['invoice'] ?? null,
-            'stripe_subscription_id' => $stripe['subscription'] ?? null,
-
-            'occurred_at' => $at,
-
-            'snapshot_version' => SubscriptionRecord::SNAPSHOT_VERSION,
-            // The long tail: everything nobody has thought to ask about yet.
-            // The flat columns above are what gets queried.
-            'snapshot' => array_merge([
-                'subscription' => $subscription->only(Subscription::FROZEN),
-                'plan' => [
-                    'key' => $subscription->plan,
-                    'version' => $version?->version,
-                    'version_id' => $subscription->plan_version_id,
-                    'family' => $version?->family?->name,
-                    'capabilities' => $version?->capabilities(),
-                ],
-                'period' => [
-                    'start' => $subscription->current_period_start?->toIso8601String(),
-                    'end' => $subscription->current_period_end?->toIso8601String(),
-                ],
-                'addons' => $subscription->addons()->active()->get()
-                    ->map(fn ($addon) => [
-                        'key' => $addon->addon_key,
-                        'price_cents' => $addon->price_cents,
-                        'quantity' => $addon->quantity,
-                        'booked_at' => $addon->booked_at?->toIso8601String(),
-                    ])->all(),
-                'customer' => [
-                    'name' => $customer?->name,
-                    'email' => $customer?->email,
-                    'vat_id' => $customer?->vat_id,
-                ],
-                // Kept even when they agree. A charge that differs from the
-                // catalogue plus tax is exactly the thing someone will ask
-                // about later, and reconciling it silently would erase the
-                // question along with the answer.
-                'amounts' => [
-                    // What was agreed, beside what was actually taken. The
-                    // flat columns state the transaction; this states whether
-                    // it came out at the contract price, which is the question
-                    // someone asks a year later.
-                    'agreed_net_cents' => $agreedNet,
-                    'expected_gross_cents' => $expectedGross,
-                    'charged_gross_cents' => $gross,
-                    'matches_catalogue' => $gross === $expectedGross,
-                ],
-            ], $extra),
-        ]);
-    }
-}

app/Actions/StartCustomerProvisioning.php

@@ -1,230 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Customer;
-use App\Models\Order;
-use App\Models\ProvisioningRun;
-use App\Models\Subscription;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-use Throwable;
-
-/**
- * Turns a paid Stripe event into a customer + order + provisioning run. The
- * order's unique stripe_event_id is the idempotency key: a duplicate webhook
- * never starts a second run.
- */
-class StartCustomerProvisioning
-{
-    public function __construct(
-        private OpenSubscription $openSubscription,
-        private ApplyStripeBillingEvent $billing,
-    ) {}
-
-    /**
-     * @param  array{id:string,email:string,name:?string,stripe_customer_id:?string,plan:string,datacenter:string,amount_cents:int,currency:string}  $event
-     */
-    public function fromStripeEvent(array $event): ?Order
-    {
-        $existing = Order::query()->where('stripe_event_id', $event['id'])->first();
-
-        if ($existing !== null) {
-            $this->resume($existing);
-
-            return null;
-        }
-
-        $customer = $this->resolveCustomer($event);
-        $customer->ensureUser(); // portal login (also enables admin impersonation)
-
-        try {
-            [$order, $run] = DB::transaction(function () use ($event, $customer) {
-                $order = Order::create([
-                    'customer_id' => $customer->id,
-                    'plan' => $event['plan'],
-                    // Set once Stripe checkout carries it (phase 5). Null means
-                    // "whatever is on sale when the webhook lands", which is
-                    // what this did before the column existed.
-                    'plan_version_id' => $event['plan_version_id'] ?? null,
-                    'amount_cents' => $event['amount_cents'],
-                    'currency' => $event['currency'],
-                    'datacenter' => $event['datacenter'],
-                    'stripe_event_id' => $event['id'],
-                    'stripe_subscription_id' => $event['stripe_subscription_id'] ?? null,
-                    'status' => 'paid',
-                ]);
-
-                $run = ProvisioningRun::create([
-                    'subject_type' => Order::class,
-                    'subject_id' => $order->id,
-                    'pipeline' => 'customer',
-                    'status' => ProvisioningRun::STATUS_PENDING,
-                    'current_step' => 0,
-                    // Snapshot resolved branding so retries apply identical inputs
-                    // (unset customer → CluPilot defaults, resolved once here).
-                    'context' => ['branding' => $customer->brandingResolved()],
-                ]);
-
-                return [$order, $run];
-            });
-        } catch (UniqueConstraintViolationException) {
-            // A concurrent delivery won the race. Both requests will answer
-            // Stripe with a 2xx, so this is the last look anyone takes at this
-            // payment — if the winner then dies before opening the contract, no
-            // retry is coming to fix it. So finish its work rather than just
-            // stepping aside. The unique index on subscriptions.order_id keeps
-            // both from opening one.
-            $winner = Order::query()->where('stripe_event_id', $event['id'])->first();
-
-            if ($winner !== null) {
-                $this->resume($winner);
-            }
-
-            return null;
-        }
-
-        $this->openContract($order);
-
-        AdvanceRunJob::dispatch($run->uuid); // after commit
-
-        return $order;
-    }
-
-    /**
-     * Finish what a crash interrupted.
-     *
-     * The order commits before the contract is opened, so that a failure there
-     * can never erase the record of a payment — but that leaves a window in
-     * which a paid order exists with no contract and nothing running. Stripe
-     * retries until it gets a 2xx, so a retry is exactly the chance to close
-     * that window. Simply returning "already processed" would strand a paying
-     * customer permanently, because no later webhook would ever look again.
-     *
-     * Safe to run on every duplicate: opening a contract is idempotent. A run
-     * that was merely never dispatched needs no nudge from here — the scheduler
-     * tick sweeps pending runs. A run that already ran and FAILED for want of
-     * the contract does, because nothing sweeps failed runs.
-     */
-    private function resume(Order $order): void
-    {
-        if ($order->subscription()->exists()) {
-            return;
-        }
-
-        $this->openContract($order);
-
-        if ($order->subscription()->exists()) {
-            $this->reviveRunStrandedWithoutAContract($order);
-        }
-    }
-
-    /**
-     * Restart a run that failed only because the contract was missing.
-     *
-     * Narrow on purpose. `no_subscription` is returned before anything is built
-     * — the run never got past validating the order or reserving resources — so
-     * there is nothing half-made to trip over. A run that failed for any other
-     * reason failed at something a contract does not fix, and restarting it
-     * would just repeat whatever went wrong.
-     */
-    private function reviveRunStrandedWithoutAContract(Order $order): void
-    {
-        $run = $order->runs()->where('pipeline', 'customer')->latest('id')->first();
-
-        if ($run?->status !== ProvisioningRun::STATUS_FAILED
-            || ! str_contains((string) $run->error, 'no_subscription')) {
-            return;
-        }
-
-        // onProvisioningFailed() marked the order failed on the way down.
-        $order->update(['status' => 'paid']);
-
-        $run->update([
-            'status' => ProvisioningRun::STATUS_PENDING,
-            'current_step' => 0,
-            'attempt' => 0,
-            'next_attempt_at' => null,
-            'error' => null,
-        ]);
-
-        AdvanceRunJob::dispatch($run->uuid);
-
-        Log::info('Restarted a run that was stranded without a contract.', [
-            'order_id' => $order->id, 'run' => $run->uuid,
-        ]);
-    }
-
-    /**
-     * Freeze what they bought, while the catalogue still says what they were
-     * shown.
-     *
-     * Deliberately AFTER the order is committed, and deliberately swallowing
-     * its failure. The order is the record that money changed hands: if opening
-     * the contract could roll it back, an unsellable plan, a missing price or
-     * any unforeseen fault would erase the evidence of a payment we have
-     * already taken — and Stripe, seeing no 2xx, would retry a webhook that can
-     * never succeed. A missing contract is recoverable and loud: the run stops
-     * at ValidateOrder with `no_subscription`, in the operator's face.
-     *
-     * Two cases are expected to land here: a plan the catalogue cannot sell,
-     * and a payment in a currency it cannot price — freezing a EUR price onto a
-     * CHF payment would put the contract and the payment in permanent
-     * disagreement.
-     */
-    private function openContract(Order $order): void
-    {
-        try {
-            // A checkout that recorded its version is owed THAT version, even
-            // if the window has closed or the plan has been withdrawn since —
-            // they paid for what they were shown. Only a purchase with no
-            // recorded version has to ask what is on sale now.
-            $deliverable = $order->plan_version_id !== null
-                ? app(PlanCatalogue::class)->isDeliverable($order->plan, $order->plan_version_id)
-                : Subscription::knowsPlan($order->plan);
-
-            $sellable = $deliverable
-                && strtoupper((string) $order->currency) === Subscription::catalogueCurrency();
-
-            if (! $sellable) {
-                Log::warning('No contract opened: the catalogue cannot sell this order.', [
-                    'order_id' => $order->id, 'plan' => $order->plan, 'currency' => $order->currency,
-                ]);
-
-                return;
-            }
-
-            $subscription = ($this->openSubscription)($order);
-
-            // Anything Stripe sent about this contract before it existed —
-            // a renewal, a failure, a cancellation — applied now, in the order
-            // they were raised.
-            $this->billing->replayHeldFor($subscription);
-        } catch (Throwable $e) {
-            Log::error('Failed to open a contract for a paid order.', [
-                'order_id' => $order->id, 'plan' => $order->plan, 'error' => $e->getMessage(),
-            ]);
-        }
-    }
-
-    /**
-     * Find or create the customer, race-safe against the unique email index so a
-     * concurrent first-time purchase can't create two customers for one email.
-     *
-     * @param  array{email:string,name:?string,stripe_customer_id:?string}  $event
-     */
-    private function resolveCustomer(array $event): Customer
-    {
-        try {
-            return Customer::query()->firstOrCreate(
-                ['email' => $event['email']],
-                ['name' => $event['name'] ?? $event['email'], 'stripe_customer_id' => $event['stripe_customer_id'] ?? null],
-            );
-        } catch (UniqueConstraintViolationException) {
-            return Customer::query()->where('email', $event['email'])->firstOrFail();
-        }
-    }
-}

app/Actions/StartHostOnboarding.php

@@ -1,49 +0,0 @@
-<?php
-
-namespace App\Actions;
-
-use App\Models\Host;
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use Illuminate\Support\Facades\Crypt;
-use Illuminate\Support\Facades\DB;
-
-/**
- * Registers a fresh host and kicks off its onboarding run. The one-time root
- * password lives encrypted in the run context and is scrubbed after SSH trust
- * is established.
- */
-class StartHostOnboarding
-{
-    /**
-     * @param  array{name: string, datacenter: string, public_ip: string, root_password: string}  $input
-     */
-    public function run(array $input): Host
-    {
-        // Host + run are created atomically; a partial insert would otherwise
-        // leave a permanently pending host with no run.
-        [$host, $run] = DB::transaction(function () use ($input) {
-            $host = Host::create([
-                'name' => $input['name'],
-                'datacenter' => $input['datacenter'],
-                'public_ip' => $input['public_ip'],
-                'status' => 'pending',
-            ]);
-
-            $run = ProvisioningRun::create([
-                'subject_type' => Host::class,
-                'subject_id' => $host->id,
-                'pipeline' => 'host',
-                'status' => ProvisioningRun::STATUS_PENDING,
-                'current_step' => 0,
-                'context' => ['root_password' => Crypt::encryptString($input['root_password'])],
-            ]);
-
-            return [$host, $run];
-        });
-
-        AdvanceRunJob::dispatch($run->uuid); // after commit — the run definitely exists
-
-        return $host;
-    }
-}

app/Console/Commands/CheckPlanCatalogue.php

@@ -1,99 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Models\PlanFamily;
-use App\Models\PlanVersion;
-use App\Models\Subscription;
-use Illuminate\Console\Command;
-
-/**
- * Tells the owner whether the catalogue is in a state that can actually sell.
- *
- * Everything here is computed at read time, which means a broken window or a
- * missing price does not announce itself until a customer hits it. This is the
- * thing to run after editing plans — before finding out from a failed checkout.
- */
-class CheckPlanCatalogue extends Command
-{
-    protected $signature = 'plans:check';
-
-    protected $description = 'Check the plan catalogue for overlaps, gaps and missing prices';
-
-    public function handle(): int
-    {
-        $currency = Subscription::catalogueCurrency();
-        $problems = [];
-        $now = now();
-
-        $families = PlanFamily::query()->with('versions.prices')->orderBy('tier')->get();
-
-        if ($families->isEmpty()) {
-            $this->error('The catalogue is empty. Nothing can be sold.');
-
-            return self::FAILURE;
-        }
-
-        foreach ($families as $family) {
-            $live = $family->versions->filter(fn (PlanVersion $v) => $v->isAvailableAt($now));
-
-            if ($live->count() > 1) {
-                $problems[] = "{$family->key}: {$live->count()} versions on sale at once (".
-                    $live->pluck('version')->implode(', ').') — overlapping windows.';
-            }
-
-            if ($family->sales_enabled && $live->isEmpty()) {
-                $problems[] = "{$family->key}: on sale, but no version is available right now.";
-            }
-
-            foreach ($family->versions as $version) {
-                if (! $version->isPublished()) {
-                    continue;
-                }
-
-                foreach ([Subscription::TERM_MONTHLY, Subscription::TERM_YEARLY] as $term) {
-                    $priced = $version->prices
-                        ->first(fn ($p) => $p->term === $term && $p->currency === $currency);
-
-                    if ($priced === null) {
-                        $problems[] = "{$family->key} v{$version->version}: no {$term} price in {$currency}.";
-                    }
-                }
-            }
-        }
-
-        // A contract that cannot say which version it was sold under has lost
-        // its provenance, which is the one thing the version table is for.
-        $orphaned = Subscription::query()->whereNull('plan_version_id')->count();
-
-        if ($orphaned > 0) {
-            $problems[] = "{$orphaned} subscription(s) have no plan version recorded.";
-        }
-
-        foreach ($families as $family) {
-            $state = $family->sales_enabled ? 'on sale' : 'withdrawn';
-            $version = $family->versions->first(fn (PlanVersion $v) => $v->isAvailableAt($now));
-            $this->line(sprintf(
-                '  %-12s tier %d  %-10s %s',
-                $family->key,
-                $family->tier,
-                $state,
-                $version !== null ? "v{$version->version}" : '—',
-            ));
-        }
-
-        if ($problems === []) {
-            $this->newLine();
-            $this->info('Catalogue is consistent.');
-
-            return self::SUCCESS;
-        }
-
-        $this->newLine();
-        foreach ($problems as $problem) {
-            $this->error('  '.$problem);
-        }
-
-        return self::FAILURE;
-    }
-}

app/Console/Commands/ConsoleAccess.php

@@ -1,145 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Http\Middleware\RestrictConsoleNetwork;
-use App\Support\Settings;
-use Illuminate\Console\Command;
-
-/**
- * The way back in when the console has locked its owner out.
- *
- * The allowlist is managed in the console — which is fine until the address you
- * manage it from changes, and then the page that would fix the problem is the
- * page the problem blocks. Every gate needs a door that does not depend on
- * itself, and on a server that door is a shell.
- */
-class ConsoleAccess extends Command
-{
-    protected $signature = 'clupilot:console-access
-                            {action=show : show|allow|deny|open|close|caddy}
-                            {value? : an address or CIDR, for allow and deny}';
-
-    protected $description = 'Show or change who may reach the operator console';
-
-    public function handle(): int
-    {
-        $action = (string) $this->argument('action');
-        $value = trim((string) $this->argument('value'));
-
-        return match ($action) {
-            'show' => $this->show(),
-            'allow' => $this->allow($value),
-            'deny' => $this->deny($value),
-            'open' => $this->setRestricted(false),
-            'close' => $this->setRestricted(true),
-            'caddy' => $this->caddy(),
-            default => $this->refuse("Unknown action: {$action}"),
-        };
-    }
-
-    /**
-     * The allowlist as a Caddy matcher, for the reverse proxy to import.
-     *
-     * The proxy has its own allowlist, hard-coded, and it runs FIRST — so
-     * everything the owner adds in the console has no effect whatsoever, and
-     * the console's own access page is a decoration. Worse, when the owner's
-     * address changes they are turned away by the proxy before the application
-     * they could have fixed it in is ever reached.
-     *
-     * Emitting the matcher from the same list the console manages makes the
-     * console the single authority. The agent on the host writes this out and
-     * reloads the proxy.
-     */
-    private function caddy(): int
-    {
-        // Always the allowlist — never 0.0.0.0/0, not even when the console's
-        // own restriction is switched off.
-        //
-        // The owner's rule is absolute: the console is reachable over the
-        // management VPN, or from an address they have listed, and from nowhere
-        // else. Letting the console's "open" switch also open the PROXY would
-        // put the console on the public internet with one click, which is
-        // exactly the state that rule exists to prevent. Switching it off
-        // relaxes the application's own check; the proxy keeps its list.
-        $ranges = RestrictConsoleNetwork::allowedRanges();
-
-        // Never empty: an empty remote_ip matcher matches NOTHING in Caddy, and
-        // the console would become unreachable from anywhere at all — including
-        // from the place someone would fix it. Loopback always survives, so a
-        // shell on the box is always a way back.
-        if ($ranges === []) {
-            $ranges = ['127.0.0.1', '::1'];
-        }
-
-        $this->line('# Generated from the console allowlist — do not edit by hand.');
-        $this->line('# Regenerated by deploy/update-agent.sh; edit it in the console.');
-        $this->line('@allowed remote_ip '.implode(' ', $ranges));
-
-        return self::SUCCESS;
-    }
-
-    private function show(): int
-    {
-        $this->line('  restricted : '.(RestrictConsoleNetwork::isRestricted() ? 'yes' : 'no — anyone reaching the hostname gets in'));
-        $this->line('  always     : '.implode(', ', (array) config('admin_access.trusted_ranges', [])).'  (VPN, not removable)');
-
-        $own = (array) Settings::get('console.allowed_ips', []);
-        $this->line('  additional : '.($own === [] ? '(none)' : implode(', ', $own)));
-
-        return self::SUCCESS;
-    }
-
-    private function allow(string $value): int
-    {
-        if ($value === '') {
-            return $this->refuse('Give an address or range: clupilot:console-access allow 203.0.113.7');
-        }
-
-        // An entry that matches nothing would be stored, reported as success,
-        // and leave whoever is recovering still locked out.
-        if (! RestrictConsoleNetwork::isNetwork($value)) {
-            return $this->refuse("Not an address or a range: {$value}");
-        }
-
-        $list = (array) Settings::get('console.allowed_ips', []);
-
-        if (! in_array($value, $list, true)) {
-            $list[] = $value;
-            Settings::set('console.allowed_ips', array_values($list));
-        }
-
-        $this->info("{$value} may now reach the console.");
-
-        return $this->show();
-    }
-
-    private function deny(string $value): int
-    {
-        Settings::set('console.allowed_ips', array_values(array_filter(
-            (array) Settings::get('console.allowed_ips', []),
-            fn ($entry) => $entry !== $value,
-        )));
-
-        $this->info("{$value} removed.");
-
-        return $this->show();
-    }
-
-    private function setRestricted(bool $on): int
-    {
-        // No lock-out check here on purpose: this command IS the recovery path,
-        // and it is only reachable by someone who already has the server.
-        Settings::set('console.network_restricted', $on);
-        $this->info($on ? 'Console restricted to the VPN and the listed addresses.' : 'Restriction lifted.');
-
-        return $this->show();
-    }
-
-    private function refuse(string $message): int
-    {
-        $this->error($message);
-
-        return self::FAILURE;
-    }
-}

app/Console/Commands/CreateAdmin.php

@@ -1,79 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Models\Customer;
-use App\Models\User;
-use Illuminate\Console\Command;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Validation\Rules\Password;
-use Illuminate\Support\Facades\Validator;
-use Spatie\Permission\PermissionRegistrar;
-
-/**
- * Creates (or promotes) an operator with the Owner role — the account the
- * installer sets up so a fresh server is usable immediately.
- *
- * Promotion is deliberate: running this twice with the same address should fix
- * a lost role, not fail with "email already taken".
- */
-class CreateAdmin extends Command
-{
-    protected $signature = 'clupilot:create-admin
-                            {--email= : Login address}
-                            {--name= : Display name}
-                            {--password= : Leave empty to be prompted}';
-
-    protected $description = 'Create or promote an operator account with the Owner role';
-
-    public function handle(): int
-    {
-        $email = $this->option('email') ?: $this->ask('Email');
-        $name = $this->option('name') ?: $this->ask('Name', 'Administrator');
-        $password = $this->option('password') ?: $this->secret('Password');
-
-        $validator = Validator::make(
-            ['email' => $email, 'name' => $name, 'password' => $password],
-            [
-                'email' => 'required|email|max:255',
-                'name' => 'required|string|max:255',
-                'password' => ['required', Password::min(12)],
-            ],
-        );
-
-        if ($validator->fails()) {
-            foreach ($validator->errors()->all() as $error) {
-                $this->error($error);
-            }
-
-            return self::FAILURE;
-        }
-
-        // An operator address that also belongs to a customer would block that
-        // customer from ever getting a portal login.
-        if (Customer::query()->where('email', $email)->exists()) {
-            $this->error('That address already belongs to a customer.');
-
-            return self::FAILURE;
-        }
-
-        $user = User::query()->firstOrNew(['email' => $email]);
-        $existed = $user->exists;
-
-        $user->fill([
-            'name' => $name,
-            'password' => Hash::make($password),
-            'is_admin' => true,
-            'email_verified_at' => $user->email_verified_at ?? now(),
-        ])->save();
-
-        $user->syncRoles(['Owner']);
-        app(PermissionRegistrar::class)->forgetCachedPermissions();
-
-        $this->info($existed
-            ? "Existing account {$email} promoted to Owner and password reset."
-            : "Owner account {$email} created.");
-
-        return self::SUCCESS;
-    }
-}

app/Console/Commands/SyncStripeCatalogue.php

@@ -1,135 +0,0 @@
-<?php
-
-namespace App\Console\Commands;
-
-use App\Models\PlanFamily;
-use App\Models\PlanPrice;
-use App\Models\PlanVersion;
-use App\Services\Stripe\StripeClient;
-use Illuminate\Console\Command;
-
-/**
- * Mirrors our catalogue into Stripe: a Product per plan family, a Price per
- * priced row.
- *
- * Stripe owns the recurring billing — retries, dunning, off-session SCA,
- * invoice numbering — so it needs to know what it is billing for. It does not
- * need to know how big the VM is, and it is not asked.
- *
- * Idempotent by construction: a row that already carries an id is skipped. That
- * matters more here than usual, because a Stripe Price cannot be edited, so a
- * second run that minted duplicates would leave two live prices for one plan
- * and no way to tell which a customer is on.
- *
- * Only PUBLISHED versions are synced. A draft has promised nothing, and a
- * Product for it would be a price list entry for something that may never
- * exist.
- */
-class SyncStripeCatalogue extends Command
-{
-    protected $signature = 'stripe:sync-catalogue {--dry-run : Show what would be created without touching Stripe}';
-
-    protected $description = 'Create the Stripe products and prices for the plan catalogue';
-
-    public function handle(StripeClient $stripe): int
-    {
-        $dryRun = (bool) $this->option('dry-run');
-
-        if (! $dryRun && ! $stripe->isConfigured()) {
-            $this->error('Stripe is not configured (STRIPE_SECRET is empty). Nothing was created.');
-
-            return self::FAILURE;
-        }
-
-        $created = 0;
-
-        foreach (PlanFamily::query()->with('versions.prices')->orderBy('tier')->get() as $family) {
-            $published = $family->versions->filter(fn (PlanVersion $version) => $version->isPublished());
-
-            // A family whose versions are all drafts has promised nothing, so
-            // it has no business appearing in Stripe's price list yet.
-            if ($published->isEmpty()) {
-                continue;
-            }
-
-            $productId = $family->stripe_product_id;
-
-            if ($productId === null) {
-                $this->line("  product  {$family->key} — {$family->name}");
-                $created++;
-
-                if (! $dryRun) {
-                    $productId = $stripe->createProduct(
-                        $family->name,
-                        ['plan_family' => $family->key, 'plan_family_id' => (string) $family->id],
-                        // Keyed on our row, so a crash between Stripe creating
-                        // the product and us storing its id gives back the same
-                        // product on the next run rather than a second one.
-                        idempotencyKey: "clupilot-product-{$family->id}",
-                    );
-                    $family->update(['stripe_product_id' => $productId]);
-                }
-            }
-
-            foreach ($published as $version) {
-                foreach ($version->prices as $price) {
-                    if ($price->stripe_price_id !== null) {
-                        continue;
-                    }
-
-                    $this->line(sprintf(
-                        '  price    %s v%d %s %d %s',
-                        $family->key, $version->version, $price->term, $price->amount_cents, $price->currency,
-                    ));
-                    $created++;
-
-                    if ($dryRun || $productId === null) {
-                        continue;
-                    }
-
-                    $priceId = $stripe->createPrice(
-                        productId: $productId,
-                        amountCents: $price->amount_cents,
-                        currency: $price->currency,
-                        interval: $price->term === 'yearly' ? 'year' : 'month',
-                        metadata: [
-                            'plan_family' => $family->key,
-                            'plan_version' => (string) $version->version,
-                            'plan_version_id' => (string) $version->id,
-                            'plan_price_id' => (string) $price->id,
-                        ],
-                        idempotencyKey: "clupilot-price-{$price->id}",
-                    );
-
-                    // Written straight through the query builder: stripe_price_id
-                    // is not part of what publication froze, and the model would
-                    // otherwise have to be re-read first.
-                    PlanPrice::query()->whereKey($price->id)->update(['stripe_price_id' => $priceId]);
-                }
-            }
-        }
-
-        $this->newLine();
-
-        if ($created === 0) {
-            $this->info('Stripe is already in step with the catalogue.');
-
-            return self::SUCCESS;
-        }
-
-        $this->info($dryRun
-            ? "{$created} object(s) would be created. Run without --dry-run to create them."
-            : "{$created} object(s) created in Stripe.");
-
-        return self::SUCCESS;
-    }
-
-    /** Versions whose prices are live in Stripe, for the status line. */
-    public static function syncedVersions(): int
-    {
-        return PlanVersion::query()
-            ->whereNotNull('published_at')
-            ->whereHas('prices', fn ($q) => $q->whereNotNull('stripe_price_id'))
-            ->count();
-    }
-}

app/Console/TickProvisioning.php

@@ -1,46 +0,0 @@
-<?php
-
-namespace App\Console;
-
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-
-/**
- * Scheduler tick (every minute): dispatch an advance job for every run that is
- * due. Immediate dispatch on advance handles the fast path; this catches
- * waiting/retrying runs and anything a crashed worker left behind.
- *
- * PENDING counts as left behind. A run is created and dispatched in two steps,
- * and a process that dies between them leaves a paid customer with a run that
- * nothing will ever pick up. Re-dispatching one that is merely fresh is free —
- * the runner takes a per-run lock and the second job returns immediately.
- */
-class TickProvisioning
-{
-    /**
-     * How long a run may sit pending before it counts as stranded.
-     *
-     * Long enough that an ordinary queue backlog is not mistaken for a crash:
-     * sweeping a run whose first job is merely still queued would start a
-     * second chain of continuations alongside the first, and both would keep
-     * dispatching for the rest of the pipeline.
-     */
-    private const STRANDED_AFTER_MINUTES = 5;
-
-    public function __invoke(): void
-    {
-        ProvisioningRun::query()
-            ->where(function ($q) {
-                $q
-                    ->whereIn('status', [ProvisioningRun::STATUS_RUNNING, ProvisioningRun::STATUS_WAITING])
-                    ->orWhere(fn ($stranded) => $stranded
-                        ->where('status', ProvisioningRun::STATUS_PENDING)
-                        ->where('created_at', '<=', now()->subMinutes(self::STRANDED_AFTER_MINUTES)));
-            })
-            ->where(function ($q) {
-                $q->whereNull('next_attempt_at')->orWhere('next_attempt_at', '<=', now());
-            })
-            ->get()
-            ->each(fn (ProvisioningRun $run) => AdvanceRunJob::dispatch($run->uuid));
-    }
-}

app/Http/Controllers/Controller.php

@@ -2,9 +2,7 @@
 
 namespace App\Http\Controllers;
 
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-
 abstract class Controller
 {
-    use AuthorizesRequests;
+    //
 }

app/Http/Controllers/ImpersonationController.php

@@ -1,41 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Models\Customer;
-use App\Models\User;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Support\Facades\Auth;
-
-/**
- * Admin impersonation: an admin can log in as a customer's portal account to
- * inspect their portal during an incident, then return to the admin session.
- */
-class ImpersonationController extends Controller
-{
-    /** Admin-gated: become the customer. */
-    public function start(Customer $customer): RedirectResponse
-    {
-        $this->authorize('customers.impersonate');
-        $user = $customer->ensureUser();
-
-        session(['impersonator_id' => Auth::id()]);
-        Auth::login($user);
-
-        return redirect()->route('dashboard');
-    }
-
-    /** Return to the admin session (available while impersonating). */
-    public function leave(): RedirectResponse
-    {
-        $adminId = session()->pull('impersonator_id');
-
-        if ($adminId !== null && ($admin = User::query()->find($adminId)) !== null) {
-            Auth::login($admin);
-
-            return redirect()->route('admin.overview');
-        }
-
-        return redirect()->route('dashboard');
-    }
-}

app/Http/Controllers/LandingController.php

@@ -1,167 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Contracts\View\View;
-use Illuminate\Support\Facades\Log;
-use Throwable;
-
-/**
- * The public price sheet.
- *
- * Prices, storage and seat counts are read from the catalogue rather than
- * written into the page. They were hard-coded here once, and the page and the
- * catalogue had already drifted apart on three of four plans — a visitor was
- * quoted 249 € for a plan that charged 399 € at checkout. The marketing site is
- * a reader of the catalogue like every other caller.
- *
- * The catalogue fails loudly by design: an empty or overlapping catalogue is an
- * outage for commerce, not something to paper over. But a public website is not
- * commerce — a mistyped availability window must not take the company's front
- * page down with it. So the failure is caught HERE and only here: the page
- * still renders, the price sheet is replaced by "on request", and nobody is
- * shown a number the checkout would not honour.
- */
-class LandingController extends Controller
-{
-    /** Presentation that belongs to the marketing page, not to the catalogue. */
-    private const COPY = [
-        'start' => ['audience' => 'Für kleine Teams', 'note' => 'Einstieg für Büros, die heute noch Dateien per Mail schicken.'],
-        'team' => ['audience' => 'Für wachsende Teams', 'note' => 'Der Regelfall — Einschulung des gesamten Teams inklusive.'],
-        'business' => ['audience' => 'Für dokumentenlastige Betriebe', 'note' => 'Mehr Speicher, längere Aufbewahrung, bevorzugte Reaktionszeit.'],
-        'enterprise' => ['audience' => 'Individuell für Ihr Unternehmen', 'note' => 'Umfang, Einrichtung und Reaktionszeiten nach Vereinbarung.'],
-    ];
-
-    /** Catalogue feature keys, in the words a customer uses. */
-    private const FEATURES = [
-        'managed_updates' => 'Updates & Wartung',
-        'daily_backups' => 'Tägliche Sicherung',
-        'monitoring' => 'Überwachung rund um die Uhr',
-        'subdomain' => 'Adresse auf clupilot.cloud',
-        'custom_domain' => 'Eigene Domain',
-        'office' => 'Office im Browser',
-        'branding' => 'Ihr Logo & Ihre Farben',
-        'priority_support' => 'Bevorzugter Support',
-        'premium_sla' => 'Vereinbarte Reaktionszeiten',
-        'extended_retention' => 'Verlängerte Aufbewahrung',
-        'audit_log' => 'Protokollierung der Zugriffe',
-        'onboarding' => 'Begleitete Einführung',
-    ];
-
-    /** The plan carrying the recommendation mark. */
-    private const RECOMMENDED = 'team';
-
-    public function __invoke(): View
-    {
-        $plans = $this->plans();
-
-        return view('landing', [
-            'plans' => $plans,
-            'featureRows' => $this->featureRows($plans),
-            'recommended' => self::RECOMMENDED,
-        ]);
-    }
-
-    /**
-     * Every feature any sellable plan carries, in the catalogue's narrative
-     * order — the row headings of the price sheet.
-     *
-     * Built from what is on sale rather than from the full list, so a feature
-     * no current plan offers does not appear as an empty row.
-     *
-     * @param  array<int, array<string, mixed>>  $plans
-     * @return array<int, string>
-     */
-    private function featureRows(array $plans): array
-    {
-        $offered = array_merge(...array_column($plans, 'features')) ?: [];
-
-        return array_values(array_filter(
-            self::FEATURES,
-            fn (string $label) => in_array($label, $offered, true),
-        ));
-    }
-
-    /**
-     * @return array<int, array<string, mixed>>  empty when the catalogue cannot be read
-     */
-    private function plans(): array
-    {
-        try {
-            $sellable = app(PlanCatalogue::class)->sellable();
-        } catch (Throwable $e) {
-            // Deliberately swallowed: see the class docblock. Logged at error
-            // level because a shop that cannot list its plans is not selling.
-            Log::error('Landing page could not read the plan catalogue', ['exception' => $e]);
-
-            return [];
-        }
-
-        $plans = [];
-
-        foreach ($sellable as $key => $plan) {
-            $plans[] = [
-                'key' => $key,
-                'name' => $plan['name'],
-                'audience' => self::COPY[$key]['audience'] ?? '',
-                'note' => self::COPY[$key]['note'] ?? '',
-                'price' => $this->money((int) $plan['price_cents'], (string) $plan['currency']),
-                'storage' => $this->storage((int) $plan['quota_gb']),
-                'traffic' => $this->storage((int) $plan['traffic_gb']),
-                'seats' => (int) $plan['seats'],
-                'features' => $this->features($plan['features'] ?? []),
-                'recommended' => $key === self::RECOMMENDED,
-            ];
-        }
-
-        return $plans;
-    }
-
-    /** Currencies we have a symbol for; anything else prints its ISO code. */
-    private const SYMBOLS = ['EUR' => '€', 'CHF' => 'CHF', 'USD' => '$', 'GBP' => '£'];
-
-    /**
-     * A price as the sheet prints it, currency included.
-     *
-     * The symbol comes from the catalogue rather than from the template: the
-     * currency is configurable (CLUPILOT_CURRENCY), and a page that says "€"
-     * while the checkout charges francs is the same two-sources-of-truth
-     * mistake as a hard-coded amount, only harder to notice.
-     *
-     * Whole units when the amount is whole — a price sheet reads "179", not
-     * "179,00".
-     */
-    private function money(int $cents, string $currency): string
-    {
-        $amount = $cents % 100 === 0
-            ? number_format($cents / 100, 0, ',', '.')
-            : number_format($cents / 100, 2, ',', '.');
-
-        // Non-breaking: in a narrow table column "49 €" otherwise wraps, and the
-        // currency ends up on a line of its own under the number.
-        return $amount."\u{00A0}".(self::SYMBOLS[strtoupper($currency)] ?? strtoupper($currency));
-    }
-
-    private function storage(int $gb): string
-    {
-        return $gb >= 1000 && $gb % 1000 === 0
-            ? ($gb / 1000).' TB'
-            : $gb.' GB';
-    }
-
-    /**
-     * @param  array<int, string>  $keys
-     * @return array<int, string>
-     */
-    private function features(array $keys): array
-    {
-        // Unknown keys are dropped rather than printed raw: a feature added to
-        // the catalogue without a translation would otherwise appear on the
-        // public page as "premium_sla".
-        return array_values(array_filter(array_map(
-            fn (string $key) => self::FEATURES[$key] ?? null,
-            $keys,
-        )));
-    }
-}

app/Http/Controllers/StatusController.php

@@ -1,194 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Models\Instance;
-use App\Models\MonitoringTarget;
-use App\Models\ProvisioningRun;
-use Illuminate\Contracts\View\View;
-use Illuminate\Support\Carbon;
-
-/**
- * The public service status page.
- *
- * It lived at /legal/status, next to the imprint and the terms, which is a
- * filing mistake: nothing about the current health of the platform is a legal
- * document. It has its own address now.
- *
- * Every line on it is derived from a record. Where there is no signal the
- * component says "not monitored" rather than "operational" — a status page that
- * reports green because it has nothing to look at is worse than no status page,
- * because someone will believe it.
- *
- * Aggregate only: counts, never customer names, instance addresses or host
- * names. This page is world-readable and the estate is not public information.
- */
-class StatusController extends Controller
-{
-    /** A backup older than this stops counting as current. */
-    private const BACKUP_STALE_AFTER_HOURS = 48;
-
-    /**
-     * How old a monitoring verdict may be before it stops counting.
-     *
-     * The sync job runs every five minutes; four missed runs is a monitoring
-     * pipeline that has stopped, and a verdict from then says nothing about now.
-     */
-    private const MONITORING_STALE_AFTER_MINUTES = 20;
-
-    /** How far back a provisioning failure still says something about now. */
-    private const PROVISIONING_WINDOW_HOURS = 24;
-
-    public function __invoke(): View
-    {
-        $components = [
-            $this->portal(),
-            $this->instances(),
-            $this->provisioning(),
-            $this->backups(),
-        ];
-
-        // The worst individual state is the state of the whole thing. Averaging
-        // it would let one outage disappear behind three healthy components.
-        $overall = match (true) {
-            in_array('down', array_column($components, 'state'), true) => 'down',
-            in_array('degraded', array_column($components, 'state'), true) => 'degraded',
-            in_array('unknown', array_column($components, 'state'), true) => 'unknown',
-            default => 'operational',
-        };
-
-        return view('status', [
-            'components' => $components,
-            'overall' => $overall,
-            'checkedAt' => Carbon::now(),
-        ]);
-    }
-
-    /**
-     * The portal and the website.
-     *
-     * Answering this request is the measurement. There is no honest way for a
-     * page to report that the server serving it is down.
-     *
-     * @return array<string, mixed>
-     */
-    private function portal(): array
-    {
-        return [
-            'key' => 'portal',
-            'state' => 'operational',
-            'detail' => null,
-        ];
-    }
-
-    /**
-     * Customer instances, from what monitoring last saw.
-     *
-     * @return array<string, mixed>
-     */
-    private function instances(): array
-    {
-        $total = Instance::query()->where('status', 'active')->count();
-
-        if ($total === 0) {
-            return ['key' => 'instances', 'state' => 'operational', 'detail' => null];
-        }
-
-        // Only targets belonging to instances that are actually in service. A
-        // healthy check on a decommissioned instance says nothing about a live
-        // one, and counting it would let coverage look complete when it is not.
-        $onActive = fn ($query) => $query->whereHas(
-            'instance',
-            fn ($instance) => $instance->where('status', 'active'),
-        );
-
-        // Only verdicts the sync job has actually refreshed. A row that has
-        // never been checked, or was last checked long enough ago that the
-        // answer means nothing, is not evidence of health — and this column was
-        // for a long time exactly that: written 'up' at provisioning and never
-        // touched again.
-        $fresh = Carbon::now()->subMinutes(self::MONITORING_STALE_AFTER_MINUTES);
-        $checked = fn ($query) => $query->tap($onActive)->where('checked_at', '>=', $fresh);
-
-        $watched = MonitoringTarget::query()->tap($checked)->distinct()->count('instance_id');
-        $down = MonitoringTarget::query()->tap($checked)->where('status', '!=', 'up')->distinct()->count('instance_id');
-
-        // Down first, then coverage. An instance nobody is watching is not a
-        // healthy instance — it is an unanswered question, and reporting the
-        // absence of a check as the absence of a problem is the one thing this
-        // page must never do.
-        return [
-            'key' => 'instances',
-            'state' => match (true) {
-                $down > 0 && $down >= $watched => 'down',
-                $down > 0 => 'degraded',
-                $watched < $total => 'unknown',
-                default => 'operational',
-            },
-            'detail' => match (true) {
-                $down > 0 => ['down' => $down, 'total' => $watched],
-                $watched < $total => ['down' => $total - $watched, 'total' => $total],
-                default => null,
-            },
-        ];
-    }
-
-    /**
-     * Whether new instances are being delivered.
-     *
-     * @return array<string, mixed>
-     */
-    private function provisioning(): array
-    {
-        $since = Carbon::now()->subHours(self::PROVISIONING_WINDOW_HOURS);
-
-        $failed = ProvisioningRun::query()
-            ->where('status', ProvisioningRun::STATUS_FAILED)
-            ->where('updated_at', '>=', $since)
-            ->count();
-
-        return [
-            'key' => 'provisioning',
-            'state' => $failed === 0 ? 'operational' : 'degraded',
-            'detail' => $failed > 0 ? ['failed' => $failed] : null,
-        ];
-    }
-
-    /**
-     * Whether the last backup of every instance is recent.
-     *
-     * @return array<string, mixed>
-     */
-    private function backups(): array
-    {
-        // Counted from the INSTANCES that need protecting, not from the backup
-        // rows that happen to exist. An active instance with no schedule at all
-        // has no row — so counting rows would leave it out of the arithmetic
-        // entirely and report the estate as protected because the backups that
-        // do exist are fine.
-        $total = Instance::query()->where('status', 'active')->count();
-
-        if ($total === 0) {
-            return ['key' => 'backups', 'state' => 'operational', 'detail' => null];
-        }
-
-        $fresh = Carbon::now()->subHours(self::BACKUP_STALE_AFTER_HOURS);
-
-        $protected = Instance::query()
-            ->where('status', 'active')
-            ->whereHas('backups', fn ($backup) => $backup->where('last_ok_at', '>=', $fresh))
-            ->count();
-
-        $unprotected = $total - $protected;
-
-        return [
-            'key' => 'backups',
-            'state' => match (true) {
-                $unprotected === 0 => 'operational',
-                $unprotected >= $total => 'down',
-                default => 'degraded',
-            },
-            'detail' => $unprotected > 0 ? ['stale' => $unprotected, 'total' => $total] : null,
-        ];
-    }
-}

app/Http/Controllers/StripeWebhookController.php

@@ -1,137 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Actions\ApplyStripeBillingEvent;
-use App\Actions\StartCustomerProvisioning;
-use Illuminate\Http\JsonResponse;
-use Illuminate\Http\Request;
-
-/**
- * Stripe webhook: verifies the signature (when a secret is configured) and turns
- * a paid checkout into a provisioning run. Idempotent via the order's
- * stripe_event_id — Stripe retries a webhook until it gets a 2xx.
- */
-class StripeWebhookController extends Controller
-{
-    public function __invoke(
-        Request $request,
-        StartCustomerProvisioning $action,
-        ApplyStripeBillingEvent $billing,
-    ): JsonResponse {
-        $payload = $request->getContent();
-        $secret = (string) config('services.stripe.webhook_secret');
-
-        if (blank($secret)) {
-            // Fail closed: an unconfigured secret must not authorize provisioning
-            // outside local/testing.
-            abort_unless(app()->environment('local', 'testing'), 400, 'Stripe webhook secret not configured');
-        } elseif (! $this->signatureValid($payload, (string) $request->header('Stripe-Signature'), $secret)) {
-            abort(400, 'invalid signature');
-        }
-
-        $event = json_decode($payload, true) ?: [];
-        $object = $event['data']['object'] ?? [];
-        $type = $event['type'] ?? '';
-
-        // The billing cycle is Stripe's: once a contract exists, they decide
-        // when it renews, when a payment failed, and when it has ended. Handled
-        // before the checkout branch because none of these are checkouts.
-        $applied = $billing->dispatch($event);
-
-        if ($applied !== false) {
-            if ($applied === null) {
-                // Either already applied, or about a contract that does not
-                // exist yet — a checkout takes a moment to become one, and
-                // Stripe does not deliver in order. Holding it costs a row and
-                // saves a cancellation we would otherwise never hear about
-                // again; a replay is a no-op if it was simply a duplicate.
-                $billing->hold($event);
-            }
-
-            // 2xx either way. Stripe retrying would not change the answer, and
-            // anything worth replaying is now held rather than dropped.
-            return response()->json(['handled' => $type, 'applied' => $applied !== null]);
-        }
-
-        // Paid triggers: a synchronous checkout (completed + paid) OR an async
-        // method clearing later (async_payment_succeeded). Ignore everything else,
-        // including the still-unpaid completed event for async methods.
-        $paid = ($type === 'checkout.session.completed' && ($object['payment_status'] ?? null) === 'paid')
-            || $type === 'checkout.session.async_payment_succeeded';
-        if (! $paid) {
-            return response()->json(['ignored' => true]);
-        }
-
-        $meta = $object['metadata'] ?? [];
-
-        // A real email is required — never merge unrelated customers under a
-        // manufactured address or send credentials into the void.
-        $email = $object['customer_details']['email'] ?? $object['customer_email'] ?? ($meta['email'] ?? null);
-        if (blank($email)) {
-            return response()->json(['ignored' => 'no_customer_email']);
-        }
-
-        $action->fromStripeEvent([
-            // Deduplicate on the checkout session id (stable across the completed
-            // and async-succeeded events for one purchase), not the event id.
-            'id' => (string) ($object['id'] ?? $event['id'] ?? ''),
-            'email' => $email,
-            'name' => $object['customer_details']['name'] ?? ($meta['name'] ?? null),
-            'stripe_customer_id' => $object['customer'] ?? null,
-            // The handle every later billing event arrives with. Without it an
-            // invoice.paid cannot be matched to the contract it renews.
-            'stripe_subscription_id' => is_string($object['subscription'] ?? null) ? $object['subscription'] : null,
-            'plan' => $meta['plan'] ?? 'start',
-            // What the customer was actually shown. Absent on a session created
-            // before phase 5 put it there, and then the version on sale applies.
-            'plan_version_id' => isset($meta['plan_version_id']) ? (int) $meta['plan_version_id'] : null,
-            'datacenter' => $meta['datacenter'] ?? 'fsn',
-            'amount_cents' => (int) ($object['amount_total'] ?? $object['amount'] ?? 0),
-            'currency' => strtoupper($object['currency'] ?? 'eur'),
-        ]);
-
-        return response()->json(['ok' => true]);
-    }
-
-    /** Stripe's default replay tolerance, in seconds. */
-    private const SIGNATURE_TOLERANCE = 300;
-
-    /** Verify Stripe's `t=…,v1=…` signature: HMAC-SHA256 of "{t}.{payload}". */
-    private function signatureValid(string $payload, string $header, string $secret): bool
-    {
-        if (blank($header)) {
-            return false;
-        }
-
-        $timestamp = null;
-        $signatures = [];
-        foreach (explode(',', $header) as $segment) {
-            [$key, $value] = array_pad(explode('=', $segment, 2), 2, '');
-            if ($key === 't') {
-                $timestamp = $value;
-            } elseif ($key === 'v1') {
-                $signatures[] = $value; // keep every v1 (secret rotation sends several)
-            }
-        }
-
-        if ($timestamp === null || $signatures === []) {
-            return false;
-        }
-
-        // Reject replays outside the tolerance window.
-        if (abs(time() - (int) $timestamp) > self::SIGNATURE_TOLERANCE) {
-            return false;
-        }
-
-        $expected = hash_hmac('sha256', $timestamp.'.'.$payload, $secret);
-
-        foreach ($signatures as $signature) {
-            if (hash_equals($expected, $signature)) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-}

app/Http/Middleware/EnsureAdmin.php

@@ -1,23 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-class EnsureAdmin
-{
-    /**
-     * Only operators with the console.view capability may reach the admin console.
-     * Legacy is_admin accounts are migrated to roles by the seed_roles_and_permissions
-     * migration and the seeder — the gate never trusts the bare is_admin flag, so
-     * an RBAC revocation is never silently undone here.
-     */
-    public function handle(Request $request, Closure $next): Response
-    {
-        abort_unless((bool) $request->user()?->can('console.view'), 403);
-
-        return $next($request);
-    }
-}

app/Http/Middleware/EnsureCustomerActive.php

@@ -1,39 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Models\Customer;
-use Closure;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Enforce customer account lifecycle on portal requests: a suspended or closed
- * customer must lose access. Admins are exempt, and an active impersonation
- * session is exempt so operators can still inspect a suspended customer's portal.
- */
-class EnsureCustomerActive
-{
-    public function handle(Request $request, Closure $next): Response
-    {
-        $user = $request->user();
-
-        if ($user !== null && ! $user->isOperator() && ! $request->session()->has('impersonator_id')) {
-            $customer = Customer::query()->where('user_id', $user->id)->first()
-                ?? Customer::query()->where('email', $user->email)->first();
-
-            if ($customer !== null && ($customer->status === 'suspended' || $customer->status === 'closed' || $customer->closed_at !== null)) {
-                Auth::logout();
-                $request->session()->invalidate();
-                $request->session()->regenerateToken();
-
-                $key = $customer->closed_at !== null || $customer->status === 'closed' ? 'auth.account_closed' : 'auth.account_suspended';
-
-                return redirect()->route('login')->withErrors(['email' => __($key)]);
-            }
-        }
-
-        return $next($request);
-    }
-}

app/Http/Middleware/PublicSiteGate.php

@@ -1,76 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Support\AdminArea;
-use App\Support\Settings;
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\IpUtils;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Hides the marketing site and the customer portal while the product is still
- * being built, without hiding it from us.
- *
- * Switched from the console (site.public). Anyone coming through the management
- * VPN, and any signed-in operator, sees the real thing; everyone else — crawlers
- * included — gets a placeholder.
- *
- * Answers 503 with Retry-After and X-Robots-Tag rather than 200: a 200 would
- * invite search engines to index the placeholder as the site's content, and
- * getting that out of an index again is much harder than keeping it out.
- */
-class PublicSiteGate
-{
-    /**
-     * Paths that must keep working regardless: the console itself (otherwise the
-     * switch could not be flipped back), Stripe's webhook, and the health check.
-     *
-     * Livewire is deliberately NOT in this list. Its endpoint is shared by the
-     * console and the portal, so exempting it would leave a signed-in customer
-     * able to drive portal components — including billing — while the portal is
-     * supposed to be offline. Operators pass the check below anyway, which is
-     * what the console actually needs.
-     *
-     * Nor is /login, and that has a consequence worth knowing before you hide
-     * the site: /admin sends a guest to /login, which is not the console, so
-     * SIGNING IN while hidden needs the request to come from a trusted range —
-     * the management VPN, or an address put in TRUSTED_RANGES for the initial
-     * setup. Exempting the login flow by hostname instead would mean trusting a
-     * Host header, which the caller chooses, and one forged header would unhide
-     * the entire portal.
-     */
-    private const ALWAYS_ALLOWED = ['webhooks/*', 'up', 'robots.txt'];
-
-    public function handle(Request $request, Closure $next): Response
-    {
-        // The console is exempt wherever it currently lives. This used to be
-        // the literal paths 'admin' and 'admin/*', which stops matching the
-        // moment the console moves to the root of its own hostname — and the
-        // result would be 503 on the sign-in page of the console, which is the
-        // only place the switch can be turned back on. Asking AdminArea keeps
-        // the exemption attached to the console rather than to a path that
-        // happened to be true once.
-        if (AdminArea::isConsole($request) || $request->is(...self::ALWAYS_ALLOWED) || Settings::bool('site.public', true)) {
-            return $next($request);
-        }
-
-        if ($this->fromManagementNetwork($request) || $request->user()?->isOperator()) {
-            return $next($request);
-        }
-
-        return response()->view('coming-soon', [], 503)->withHeaders([
-            'Retry-After' => 3600,
-            'X-Robots-Tag' => 'noindex, nofollow, noarchive',
-            'Cache-Control' => 'no-store',
-        ]);
-    }
-
-    private function fromManagementNetwork(Request $request): bool
-    {
-        $ranges = (array) config('admin_access.trusted_ranges', []);
-
-        return $ranges !== [] && IpUtils::checkIp((string) $request->ip(), $ranges);
-    }
-}

app/Http/Middleware/RestrictAdminHost.php

@@ -1,93 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Support\AdminArea;
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * The console answers only on its own hostname — and that hostname answers
- * only the console.
- *
- * Both halves matter. The first keeps the console off the public domains. The
- * second is what actually separates the two products: binding the console
- * routes to a hostname does not stop the CUSTOMER routes from answering there
- * as well, because they are registered without a hostname. Without this,
- * app.clupilot.com and admin.clupilot.com would still serve each other's pages
- * wherever the paths did not collide.
- *
- * 404 in both directions, never 403: a stranger must not learn that a console
- * lives here, and an operator on the wrong host should see the same nothing a
- * stranger does.
- *
- * A handful of endpoints are shared by both sides and must answer on either
- * host — Livewire's own endpoints and the authentication actions. They are
- * listed explicitly below, because the failure mode of getting that list wrong
- * is "the console is broken" rather than "the rule is wrong", and a list you
- * can read is easier to correct than a rule you have to infer.
- */
-class RestrictAdminHost
-{
-    /**
-     * Endpoints both the console and the portal need, on whichever host the
-     * caller is currently on.
-     *
-     * Livewire's component endpoint is guarded separately and more strictly:
-     * the console's own middleware is registered as persistent, so an action
-     * posted to /livewire/update is re-checked against the component's real
-     * route. Letting the path through here does not let anything through there.
-     */
-    private const SHARED = [
-        'livewire/*',
-        'login',
-        'logout',
-        'two-factor-challenge',
-        'up',
-    ];
-
-    public function handle(Request $request, Closure $next): Response
-    {
-        // Not host-bound (development, a fresh checkout): the console keeps its
-        // /admin prefix on any host and nothing is separated. Upgrading must
-        // not lock anyone out of a system that was working.
-        if (! AdminArea::isHostBound()) {
-            return $next($request);
-        }
-
-        $isConsoleRoute = $this->isConsoleRoute($request);
-        $onConsoleHost = AdminArea::covers($request->getHost());
-
-        // The console, reached through a hostname that is not the console's.
-        if ($isConsoleRoute && ! $onConsoleHost) {
-            abort(404);
-        }
-
-        // The portal or the public site, reached through the console's
-        // hostname. Only once exclusivity is switched on: a machine that lists
-        // its own IP in ADMIN_HOSTS so the console is reachable without DNS
-        // still has to serve the portal from that same address.
-        if (AdminArea::isExclusive() && $onConsoleHost && ! $isConsoleRoute && ! $request->is(...self::SHARED)) {
-            abort(404);
-        }
-
-        return $next($request);
-    }
-
-    /**
-     * Console routes are the ones named `admin.*`.
-     *
-     * By name rather than by path: the path is exactly what changes between
-     * host-bound and fallback mode, and a rule written against it would be
-     * wrong in one of them.
-     */
-    private function isConsoleRoute(Request $request): bool
-    {
-        $name = $request->route()?->getName();
-
-        // Covers admin.* and the alternate-host registrations (admin.viaN.*),
-        // which are the same console reached by a recovery hostname.
-        return $name !== null && str_starts_with($name, 'admin.');
-    }
-}

app/Http/Middleware/RestrictConsoleNetwork.php

@@ -1,134 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use App\Support\AdminArea;
-use App\Support\Settings;
-use Closure;
-use Illuminate\Http\Request;
-use Symfony\Component\HttpFoundation\IpUtils;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Who may reach the operator console, by network address.
- *
- * RestrictAdminHost answers "under which NAME does the console respond" — and a
- * Host header is chosen by the caller, so it can never answer "who is asking".
- * This one can: the client address behind a trusted proxy is not something the
- * client gets to pick.
- *
- * The management VPN always counts. Beyond that the owner keeps a list — an
- * office line, a home connection — so being away from the VPN does not mean
- * being locked out. That list lives in the console rather than in a proxy
- * config file, because the person who needs to change it is the person sitting
- * in the console.
- *
- * 404, never 403: a stranger must not learn that a console lives here.
- *
- * This is not a substitute for a firewall. It runs after PHP has started, so it
- * bounds who can USE the console, not who can make the server work. Where a
- * network-level ACL is also possible, both belong there.
- */
-class RestrictConsoleNetwork
-{
-    public function handle(Request $request, Closure $next): Response
-    {
-        // Scoped to the console, wherever the console currently is. Asking
-        // AdminArea rather than testing the path: once the console moves to the
-        // root of its own hostname there is no `/admin` left to match, and a
-        // guard that silently stops matching is worse than no guard.
-        if (! AdminArea::isConsole($request)) {
-            return $next($request);
-        }
-
-        if (! self::isRestricted()) {
-            return $next($request);
-        }
-
-        if (! self::allows((string) $request->ip())) {
-            abort(404);
-        }
-
-        return $next($request);
-    }
-
-    /** Whether the owner has switched the restriction on at all. */
-    public static function isRestricted(): bool
-    {
-        return Settings::bool('console.network_restricted', false);
-    }
-
-    /**
-     * Every network that may reach the console.
-     *
-     * The VPN is always in it and is not removable — it is the one path that
-     * exists independently of whatever the owner has typed into the list, and
-     * without it a bad entry would leave nobody able to fix the entry.
-     *
-     * @return array<int, string>
-     */
-    public static function allowedRanges(): array
-    {
-        $vpn = (array) config('admin_access.trusted_ranges', []);
-        $own = (array) Settings::get('console.allowed_ips', []);
-
-        return array_values(array_unique(array_filter(array_merge(
-            $vpn,
-            array_map('trim', array_map('strval', $own)),
-        ))));
-    }
-
-    public static function allows(string $ip): bool
-    {
-        return self::covers($ip, self::allowedRanges());
-    }
-
-    /**
-     * Would this address still get in, given that list?
-     *
-     * Split out so the "you are about to lock yourself out" decision can be
-     * made — and tested — without a request: it is the one check whose failure
-     * mode is that nobody can reach the page that would fix it.
-     *
-     * @param  array<int, string>  $extra  the owner's list AFTER the change
-     */
-    public static function wouldStillAllow(string $ip, array $extra): bool
-    {
-        $vpn = (array) config('admin_access.trusted_ranges', []);
-
-        return self::covers($ip, array_merge($vpn, $extra));
-    }
-
-    /**
-     * Whether a value is an address or a CIDR range at all.
-     *
-     * Shared by the console and the recovery command on purpose: an entry that
-     * matches nothing is stored happily and reports success, and the operator
-     * then switches the restriction on believing they are covered. That is the
-     * exact situation the recovery command exists to get out of.
-     */
-    public static function isNetwork(string $value): bool
-    {
-        [$address, $prefix] = array_pad(explode('/', $value, 2), 2, null);
-
-        if (filter_var($address, FILTER_VALIDATE_IP) === false) {
-            return false;
-        }
-
-        if ($prefix === null) {
-            return true;
-        }
-
-        $max = str_contains((string) $address, ':') ? 128 : 32;
-
-        return ctype_digit((string) $prefix) && (int) $prefix >= 0 && (int) $prefix <= $max;
-    }
-
-    /** @param array<int, string> $ranges */
-    private static function covers(string $ip, array $ranges): bool
-    {
-        $ranges = array_values(array_filter($ranges));
-
-        return $ranges !== [] && $ip !== '' && IpUtils::checkIp($ip, $ranges);
-    }
-}

app/Http/Responses/ConsoleAwareLoginResponse.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Http\Responses;
-
-use Illuminate\Http\JsonResponse;
-use Laravel\Fortify\Contracts\LoginResponse;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Where an ordinary sign-in lands. See LandsWhereSignedIn for the decision;
- * TwoFactorLoginResponse below makes the same one after a challenge.
- */
-class ConsoleAwareLoginResponse implements LoginResponse
-{
-    use LandsWhereSignedIn;
-
-    public function toResponse($request): Response
-    {
-        return $this->landing($request, new JsonResponse(['two_factor' => false], 200));
-    }
-}

app/Http/Responses/ConsoleAwareTwoFactorLoginResponse.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace App\Http\Responses;
-
-use Illuminate\Http\JsonResponse;
-use Laravel\Fortify\Contracts\TwoFactorLoginResponse;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Where a sign-in completed by two-factor challenge lands.
- *
- * Fortify never reaches LoginResponse on this path, so binding only that one
- * left every account with two-factor enabled — which is the ones most likely to
- * be operators — landing in the customer portal.
- */
-class ConsoleAwareTwoFactorLoginResponse implements TwoFactorLoginResponse
-{
-    use LandsWhereSignedIn;
-
-    public function toResponse($request): Response
-    {
-        // Fortify answers an empty 204 here, not a body. Kept.
-        return $this->landing($request, new JsonResponse('', 204));
-    }
-}

app/Http/Responses/LandsWhereSignedIn.php

@@ -1,62 +0,0 @@
-<?php
-
-namespace App\Http\Responses;
-
-use App\Support\AdminArea;
-use Illuminate\Http\JsonResponse;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Support\Facades\Auth;
-use Laravel\Fortify\Fortify;
-use Symfony\Component\HttpFoundation\Response;
-
-/**
- * Where a completed sign-in lands, shared by both ways of completing one.
- *
- * Fortify has two exits: LoginResponse for an ordinary sign-in, and
- * TwoFactorLoginResponse after a challenge. Binding only the first left every
- * account with two-factor enabled on the old behaviour — landing in the
- * customer portal, and on a console-only host landing on a 404. Whichever exit
- * is taken, the decision has to be the same one.
- */
-trait LandsWhereSignedIn
-{
-    protected function landing($request, JsonResponse $success): Response
-    {
-        // Where they were heading counts as much as where they posted from: in
-        // shared mode everyone signs in at /login, so the request itself never
-        // looks like the console even when /admin is the destination.
-        $onConsole = AdminArea::isConsole($request)
-            || AdminArea::pointsAtConsole($request->session()?->get('url.intended'));
-
-        // Authorization first, before any branch. Answering JSON early let a
-        // non-operator keep the session on the console host that a browser
-        // request would have had taken away.
-        if ($onConsole && ! $request->user()?->can('console.view')) {
-            // Taken away at the moment it was created: the session exists as
-            // soon as Fortify authenticates, and a guard that merely refuses
-            // each page afterwards leaves it sitting in the browser.
-            Auth::guard('web')->logout();
-            $request->session()->invalidate();
-            $request->session()->regenerateToken();
-
-            if ($request->wantsJson()) {
-                return new JsonResponse(['message' => __('auth.not_an_operator')], 403);
-            }
-
-            return redirect()->to(AdminArea::home())->withErrors([
-                Fortify::username() => __('auth.not_an_operator'),
-            ]);
-        }
-
-        // Fortify answers JSON to a JSON client. Replacing that with a redirect
-        // would break every caller that is not a browser.
-        if ($request->wantsJson()) {
-            // The caller supplies it: Fortify answers {"two_factor":false} to an
-            // ordinary sign-in and an empty 204 after a challenge, and a client
-            // keying off the status code breaks if the two are merged.
-            return $success;
-        }
-
-        return redirect()->intended($onConsole ? AdminArea::home() : Fortify::redirects('login'));
-    }
-}

app/Livewire/Admin/ConfirmDeleteDatacenter.php

@@ -1,60 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use App\Models\Host;
-use Illuminate\Database\QueryException;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for deleting a datacenter (R5). Guarded: a datacenter that still
- * has hosts cannot be deleted — it would orphan host placement — so the modal
- * blocks and explains instead. Otherwise it is safe to hard-delete an unused code.
- */
-class ConfirmDeleteDatacenter extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public int $hostCount = 0;
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
-        $dc = Datacenter::query()->where('uuid', $uuid)->withCount('hosts')->firstOrFail();
-        $this->uuid = $uuid;
-        $this->name = $dc->name;
-        $this->hostCount = $dc->hosts_count;
-    }
-
-    public function delete()
-    {
-        $this->authorize('datacenters.manage');
-        $dc = Datacenter::query()->where('uuid', $this->uuid)->first();
-        if ($dc === null) {
-            return $this->redirectRoute('admin.datacenters', navigate: true);
-        }
-
-        // The hosts.datacenter → datacenters.code foreign key (restrictOnDelete)
-        // is the source of truth: the DB refuses to orphan a host. We pre-check
-        // for a friendly message and catch the constraint as the race backstop.
-        if (Host::query()->where('datacenter', $dc->code)->exists()) {
-            return $this->redirectRoute('admin.datacenters', navigate: true);
-        }
-
-        try {
-            $dc->delete();
-        } catch (QueryException) {
-            // A host was created for this code concurrently — leave it intact.
-        }
-
-        return $this->redirectRoute('admin.datacenters', navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-delete-datacenter');
-    }
-}

app/Livewire/Admin/ConfirmDeletePlanDraft.php

@@ -1,60 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\PlanVersion;
-use App\Services\Billing\PlanCatalogue;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for discarding an unpublished plan version.
- *
- * Only a draft can be discarded at all — a published version is what customers
- * are contracted to, and the model refuses to delete one. So this is a small
- * destructive action, and the modal says which one it is rather than leaving
- * "delete" next to a row that might be either.
- */
-class ConfirmDeletePlanDraft extends ModalComponent
-{
-    public string $uuid;
-
-    public int $version;
-
-    public string $plan = '';
-
-    public function mount(string $uuid): void
-    {
-        // Modals are reachable without the page's guards, so this is the real
-        // check, not a convenience one.
-        $this->authorize('plans.manage');
-
-        $version = PlanVersion::query()->with('family')->where('uuid', $uuid)->firstOrFail();
-        abort_if($version->isPublished(), 403);
-
-        $this->uuid = $uuid;
-        $this->version = $version->version;
-        $this->plan = $version->family->name;
-    }
-
-    public function delete(): void
-    {
-        $this->authorize('plans.manage');
-
-        $version = PlanVersion::query()->where('uuid', $this->uuid)->first();
-
-        // The catalogue decides, in one conditional statement. Checking here and
-        // deleting afterwards would leave a window in which the version is
-        // published between the two — and a published version must never go.
-        if ($version !== null && ! app(PlanCatalogue::class)->discardDraft($version)) {
-            $this->dispatch('notify', message: __('plans.discard_too_late'));
-        }
-
-        $this->dispatch('plan-draft-deleted');
-        $this->closeModal();
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-delete-plan-draft');
-    }
-}

app/Livewire/Admin/ConfirmDeleteVpnPeer.php

@@ -1,58 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\VpnPeer;
-use App\Provisioning\Jobs\ApplyVpnPeer;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for revoking a VPN access for good (R5). Deleting a peer that
- * belongs to a host cuts CluPilot's own management path to that machine, so the
- * modal says so plainly rather than hiding the option.
- */
-class ConfirmDeleteVpnPeer extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public ?string $hostName = null;
-
-    public function mount(string $uuid): void
-    {
-        // Modals are reachable without the route middleware, so this is the
-        // real guard, not a convenience check.
-        $peer = VpnPeer::query()->with('host')->where('uuid', $uuid)->firstOrFail();
-        $this->authorize('delete', $peer);
-        $this->uuid = $uuid;
-        $this->name = $peer->name;
-        $this->hostName = $peer->host?->name;
-    }
-
-    public function delete(): void
-    {
-        $peer = VpnPeer::query()->where('uuid', $this->uuid)->first();
-        if ($peer !== null) {
-            $this->authorize('delete', $peer);
-
-            // A tombstone that still carries a usable private key is a liability.
-            $peer->purgeSecret();
-            // Soft-delete, so the row survives as a tombstone until the hub has
-            // actually dropped the peer. A hard delete here would let the next
-            // sync adopt the still-present peer back as a live access —
-            // silently restoring what was just revoked. ApplyVpnPeer purges the
-            // tombstone once removal succeeded; SyncVpnPeers retries if not.
-            $peer->delete();
-            ApplyVpnPeer::dispatch($peer->public_key, null, false);
-        }
-
-        $this->dispatch('vpn-peer-deleted');
-        $this->closeModal();
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-delete-vpn-peer');
-    }
-}

app/Livewire/Admin/ConfirmRemoveHost.php

@@ -1,46 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Host;
-use App\Provisioning\Jobs\PurgeHost;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Confirmation for the destructive "remove host" action (R5). Deregisters the
- * CluPilot record only — it does not touch the physical server. The host is
- * deactivated immediately and purged asynchronously so removal never blocks on
- * (or races) an in-flight provisioning step.
- */
-class ConfirmRemoveHost extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public function mount(string $uuid): void
-    {
-        $this->uuid = $uuid;
-        $this->name = Host::query()->where('uuid', $uuid)->value('name') ?? '';
-    }
-
-    public function remove()
-    {
-        $this->authorize('hosts.manage');
-        $host = Host::query()->where('uuid', $this->uuid)->first();
-
-        if ($host !== null) {
-            // Deactivate now (out of placement, visibly removed), finalize on the
-            // provisioning worker which waits for the runner lock.
-            $host->update(['status' => 'disabled']);
-            PurgeHost::dispatch($host->uuid);
-        }
-
-        return $this->redirectRoute('admin.hosts', navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.confirm-remove-host');
-    }
-}

app/Livewire/Admin/Customers.php

@@ -1,112 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Customer;
-use App\Models\PlanFamily;
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Customers extends Component
-{
-    /** Suspend / reactivate a customer account (a guarded lifecycle action, not delete). */
-    public function toggleSuspend(string $uuid): void
-    {
-        $this->authorize('customers.manage');
-        $customer = Customer::query()->where('uuid', $uuid)->first();
-        if ($customer === null) {
-            return;
-        }
-
-        // A closed account is terminal — the suspend/reactivate toggle must not
-        // resurrect it to active while closed_at is still set.
-        if ($customer->closed_at !== null || $customer->status === 'closed') {
-            return;
-        }
-
-        $customer->update([
-            'status' => $customer->status === 'suspended' ? 'active' : 'suspended',
-        ]);
-
-        $this->dispatch('notify', message: __('admin.customer_'.($customer->status === 'suspended' ? 'suspended' : 'reactivated')));
-    }
-
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $plans = app(PlanCatalogue::class)->sellable();
-
-        $customers = Customer::query()
-            ->with(['instances.subscription'])
-            ->orderBy('name')
-            ->get();
-
-        $rows = $customers->map(function (Customer $c) use ($plans, $locale) {
-            $instance = $c->instances->sortByDesc('id')->first();
-            $planKey = $instance->plan ?? null;
-            // What this customer actually pays, off their contract — not what
-            // the plan costs today. Otherwise a price rise inflates reported
-            // revenue for every grandfathered customer overnight.
-            //
-            // Per MONTH, whatever the term: a yearly contract stores the whole
-            // year, and adding that to a monthly column would report twelve
-            // times the revenue for anyone who paid up front.
-            $contract = $instance?->subscription;
-            $priceCents = (int) ($contract?->monthlyPriceCents()
-                ?? ($planKey !== null ? ($plans[$planKey]['price_cents'] ?? 0) : 0));
-
-            return [
-                'uuid' => $c->uuid,
-                'name' => $c->name,
-                'plan' => $planKey !== null ? __('billing.plan.'.$planKey) : '—',
-                'mrr' => Number::currency($priceCents / 100, in: 'EUR', locale: $locale),
-                'instance' => $instance->subdomain ?? '—',
-                // Only an instance that exists can hand out an admin login.
-                'instance_uuid' => ($instance?->status === 'active') ? $instance->uuid : null,
-                'closed' => $c->closed_at !== null || $c->status === 'closed',
-                'suspended' => $c->status === 'suspended',
-                'status' => match (true) {
-                    $c->closed_at !== null || $c->status === 'closed' => 'closed',
-                    $c->status === 'suspended' => 'suspended',
-                    default => $instance->status ?? $c->status ?? 'provisioning',
-                },
-            ];
-        })->all();
-
-        // Plan distribution for the doughnut — derived from live instances, and
-        // keyed by what customers are actually ON, not by what is on sale. A
-        // withdrawn plan still has customers, and dropping them from the chart
-        // would quietly understate the estate.
-        $labels = [];
-        $counts = [];
-        foreach (PlanFamily::query()->orderBy('tier')->pluck('key') as $planKey) {
-            $n = $customers->filter(fn (Customer $c) => $c->instances->contains('plan', $planKey))->count();
-            if ($n > 0) {
-                $labels[] = __('billing.plan.'.$planKey);
-                $counts[] = $n;
-            }
-        }
-
-        return view('livewire.admin.customers', [
-            'rows' => $rows,
-            'plansChart' => [
-                'type' => 'doughnut',
-                'data' => [
-                    'labels' => $labels,
-                    'datasets' => [[
-                        'data' => $counts,
-                        'backgroundColor' => ['token:info', 'token:accent', 'token:success-bright', 'token:warning'],
-                        'borderWidth' => 0,
-                    ]],
-                ],
-                'options' => [
-                    'cutout' => '62%',
-                    'plugins' => ['legend' => ['position' => 'bottom', 'labels' => ['boxWidth' => 10, 'padding' => 12]]],
-                ],
-            ],
-        ]);
-    }
-}

app/Livewire/Admin/Datacenters.php

@@ -1,67 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Datacenters extends Component
-{
-    #[Validate(['required', 'string', 'max:8', 'regex:/^[a-z0-9]([a-z0-9-]{0,6}[a-z0-9])?$/', 'unique:datacenters,code'])]
-    public string $code = '';
-
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    // Country picked from config/countries.php (no manual code typos).
-    #[Validate('nullable|string|max:2')]
-    public string $location = '';
-
-    public function save(): void
-    {
-        $this->authorize('datacenters.manage');
-        // Normalize before validating so the unique check matches how the row is
-        // stored — otherwise `FSN` passes the rule but the lowercased insert collides.
-        $this->code = strtolower(trim($this->code));
-
-        // Country must be one of the curated list — a forged request can bypass
-        // the <select>, so enforce membership server-side (mirrors EditDatacenter).
-        $data = $this->validate([
-            // A datacenter code becomes a DNS label (fsn-01.node.clupilot.com),
-            // so it has to be one: lowercase, no underscores, no leading or
-            // trailing dash.
-            'code' => ['required', 'string', 'max:8', 'regex:/^[a-z0-9]([a-z0-9-]{0,6}[a-z0-9])?$/', 'unique:datacenters,code'],
-            'name' => 'required|string|max:255',
-            'location' => ['nullable', Rule::in(array_keys((array) config('countries')))],
-        ]);
-
-        Datacenter::create([
-            'code' => $data['code'],
-            'name' => $data['name'],
-            'location' => $data['location'] ?: null,
-            'active' => true,
-        ]);
-
-        $this->reset('code', 'name', 'location');
-        $this->dispatch('notify', message: __('datacenters.created'));
-    }
-
-    public function toggle(string $uuid): void
-    {
-        $this->authorize('datacenters.manage');
-        $datacenter = Datacenter::query()->where('uuid', $uuid)->first();
-        $datacenter?->update(['active' => ! $datacenter->active]);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.datacenters', [
-            'datacenters' => Datacenter::query()->withCount('hosts')->orderBy('name')->get(),
-            'countries' => config('countries'),
-        ]);
-    }
-}

app/Livewire/Admin/EditDatacenter.php

@@ -1,97 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Validate;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Edit a datacenter's name and location in a modal (avoids the row-height jump
- * of inline editing). The code is immutable — it is referenced by hosts. Country
- * is picked from a list so it can't be mistyped.
- */
-class EditDatacenter extends ModalComponent
-{
-    public string $uuid = '';
-
-    public string $code = '';
-
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    public string $location = '';
-
-    /** The location present when the modal opened — a pre-curation free-form value. */
-    public string $originalLocation = '';
-
-    /**
-     * Whether new hosts and orders may still be placed here.
-     *
-     * The column and the scope existed; the form did not offer it, so a
-     * datacenter could be created and never switched off again — the one
-     * lifecycle action a location actually needs.
-     */
-    public bool $active = true;
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
-        $dc = Datacenter::query()->where('uuid', $uuid)->firstOrFail();
-        $this->uuid = $uuid;
-        $this->code = $dc->code;
-        $this->name = $dc->name;
-        $this->location = (string) $dc->location;
-        $this->originalLocation = (string) $dc->location;
-        $this->active = (bool) $dc->active;
-    }
-
-    public function save()
-    {
-        $this->authorize('datacenters.manage');
-
-        // Accept the configured countries plus the record's own legacy value, so a
-        // datacenter created before the curated list can still be edited. The
-        // legacy value is read from the DB — never from the client-hydrated
-        // property, which could be forged to whitelist an arbitrary location.
-        $dc = Datacenter::query()->where('uuid', $this->uuid)->firstOrFail();
-        $allowed = array_keys((array) config('countries'));
-        if ($dc->location) {
-            $allowed[] = $dc->location;
-        }
-        $data = $this->validate([
-            'name' => 'required|string|max:255',
-            'location' => ['nullable', Rule::in($allowed)], // array form — a legacy value may contain commas
-            'active' => 'boolean',
-        ]);
-
-        // Only on the transition, and compared against what is STORED: an
-        // already-inactive location would otherwise announce that it had just
-        // been switched off every time its name was edited.
-        $justDeactivated = $dc->active && ! $data['active'];
-        $hostsLeftRunning = $justDeactivated ? $dc->hosts()->count() : 0;
-
-        Datacenter::query()->where('uuid', $this->uuid)->update([
-            'name' => $data['name'],
-            'location' => $data['location'] ?: null,
-            'active' => $data['active'],
-        ]);
-
-        // One message, not two. Both go through the same toast, and the second
-        // replaces the first — so the generic "saved" would swallow the only
-        // sentence that says the hosts there are still running.
-        $this->dispatch('notify', message: $hostsLeftRunning > 0
-            ? __('datacenters.deactivated_with_hosts', ['n' => $hostsLeftRunning])
-            : __('datacenters.updated'));
-
-        return $this->redirectRoute('admin.datacenters', navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.edit-datacenter', [
-            'countries' => config('countries'),
-        ]);
-    }
-}

app/Livewire/Admin/HostCreate.php

@@ -1,46 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Actions\StartHostOnboarding;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class HostCreate extends Component
-{
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    #[Validate('required|string|exists:datacenters,code,active,1')]
-    public string $datacenter = '';
-
-    public function mount(): void
-    {
-        $this->datacenter = (string) \App\Models\Datacenter::query()->active()->orderBy('name')->value('code');
-    }
-
-    #[Validate('required|ip|unique:hosts,public_ip')]
-    public string $public_ip = '';
-
-    #[Validate('required|string|min:8')]
-    public string $root_password = '';
-
-    public function save(StartHostOnboarding $action)
-    {
-        $this->authorize('hosts.manage');
-        $data = $this->validate();
-
-        $host = $action->run($data);
-
-        return $this->redirectRoute('admin.hosts.show', ['host' => $host->uuid], navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.admin.host-create', [
-            'datacenters' => \App\Models\Datacenter::query()->active()->orderBy('name')->get(),
-        ]);
-    }
-}

app/Livewire/Admin/HostDetail.php

@@ -1,117 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Host;
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use Illuminate\Support\Collection;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class HostDetail extends Component
-{
-    public Host $host;
-
-    public function mount(Host $host): void
-    {
-        $this->host = $host;
-    }
-
-    /** Live refresh whenever any run advances (admins-only channel). */
-    #[On('echo-private:admin.runs,StepAdvanced')]
-    public function onStepAdvanced(): void
-    {
-        $this->host->refresh();
-    }
-
-    /** Adjust the capacity reserve (% of storage kept free for headroom). */
-    public function saveReserve(int $reserve): void
-    {
-        $this->authorize('hosts.manage');
-        $reserve = max(0, min(90, $reserve));
-        $this->host->update(['reserve_pct' => $reserve]);
-        $this->dispatch('notify', message: __('hosts.detail.reserve_saved'));
-    }
-
-    /**
-     * Drain / return a host: toggle between active and disabled. Disabled takes
-     * it out of placement (maintenance) without purging it — distinct from the
-     * destructive "remove host". Never touches a host mid-onboarding.
-     */
-    public function toggleMaintenance(): void
-    {
-        $this->authorize('hosts.manage');
-        if ($this->host->status === 'active') {
-            $this->host->update(['status' => 'disabled']);
-        } elseif ($this->host->status === 'disabled') {
-            $this->host->update(['status' => 'active']);
-        }
-    }
-
-    public function retry(): void
-    {
-        $this->authorize('hosts.manage');
-        $run = $this->currentRun();
-
-        if ($run !== null && $run->status === ProvisioningRun::STATUS_FAILED) {
-            $run->update([
-                'status' => ProvisioningRun::STATUS_RUNNING,
-                'attempt' => 0,
-                'next_attempt_at' => now(),
-                'started_at' => now(), // reset the step timer so it doesn't re-time-out instantly
-                'error' => null,
-            ]);
-            $this->host->update(['status' => 'onboarding']);
-            AdvanceRunJob::dispatch($run->uuid);
-        }
-    }
-
-    private function currentRun(): ?ProvisioningRun
-    {
-        return $this->host->runs()->latest('id')->first();
-    }
-
-    /** @return array<int, array{label: string, state: string}> */
-    private function buildSteps(?ProvisioningRun $run): array
-    {
-        $pipeline = config('provisioning.pipelines.host', []);
-        $current = $run?->current_step ?? 0;
-        $status = $run?->status;
-
-        $steps = [];
-        foreach ($pipeline as $index => $class) {
-            if ($status === ProvisioningRun::STATUS_COMPLETED || $index < $current) {
-                $state = 'done';
-            } elseif ($index === $current) {
-                $state = $status === ProvisioningRun::STATUS_FAILED ? 'failed' : 'running';
-            } else {
-                $state = 'pending';
-            }
-
-            $steps[] = ['label' => __(app($class)->label()), 'state' => $state];
-        }
-
-        return $steps;
-    }
-
-    public function render()
-    {
-        $run = $this->currentRun();
-
-        /** @var Collection $events */
-        $events = $run
-            ? $run->events()->latest('id')->limit(30)->get()
-            : collect();
-
-        return view('livewire.admin.host-detail', [
-            'run' => $run,
-            'steps' => $this->buildSteps($run),
-            'events' => $events,
-            'instances' => $this->host->instances()->latest('id')->get(),
-            'health' => $this->host->healthState(),
-        ]);
-    }
-}

app/Livewire/Admin/Hosts.php

@@ -1,53 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Datacenter;
-use App\Models\Host;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Url;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Hosts extends Component
-{
-    #[Url(as: 'q')]
-    public string $search = '';
-
-    #[Url]
-    public string $datacenter = '';
-
-    #[Url]
-    public string $status = '';
-
-    public function updated(): void
-    {
-        // no-op; keeps the query string in sync as filters change
-    }
-
-    public function clearFilters(): void
-    {
-        $this->reset('search', 'datacenter', 'status');
-    }
-
-    public function render()
-    {
-        $hosts = Host::query()
-            ->withCount('instances')
-            ->when($this->search !== '', function ($q) {
-                $term = '%'.$this->search.'%';
-                $q->where(fn ($w) => $w->where('name', 'like', $term)->orWhere('public_ip', 'like', $term));
-            })
-            ->when($this->datacenter !== '', fn ($q) => $q->where('datacenter', $this->datacenter))
-            ->when($this->status !== '', fn ($q) => $q->where('status', $this->status))
-            ->orderBy('datacenter')->orderBy('name')
-            ->get();
-
-        return view('livewire.admin.hosts', [
-            'hosts' => $hosts,
-            'datacenters' => Datacenter::query()->orderBy('name')->get(),
-            'statuses' => ['pending', 'onboarding', 'active', 'error', 'disabled'],
-            'total' => Host::query()->count(),
-        ]);
-    }
-}

app/Livewire/Admin/InstanceAdminAccess.php

@@ -1,107 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Instance;
-use App\Provisioning\Jobs\IssueInstanceAdminAccess;
-use App\Services\Wireguard\ConfigHandoff;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\RateLimiter;
-use Illuminate\Support\Str;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Administrator access to a customer's Nextcloud.
- *
- * Not impersonation: that borrows a portal session. This resets our managed
- * admin account inside the customer's installation and hands the credentials
- * over once — the only thing stock Nextcloud offers, and honest about what it
- * does rather than pretending to be a passwordless jump.
- *
- * The operator's own password is required, every time. Taking control of a
- * customer's installation is not something an unattended browser should be able
- * to do on its own.
- */
-class InstanceAdminAccess extends ModalComponent
-{
-    public string $uuid;
-
-    public string $subdomain = '';
-
-    public string $password = '';
-
-    /** Opaque handle; the credentials never enter the component snapshot. */
-    public ?string $token = null;
-
-    public bool $waiting = false;
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('instances.adminlogin');
-
-        $instance = Instance::query()->where('uuid', $uuid)->firstOrFail();
-        $this->uuid = $uuid;
-        $this->subdomain = $instance->subdomain;
-    }
-
-    public function hydrate(): void
-    {
-        $this->authorize('instances.adminlogin');
-    }
-
-    public function request(): void
-    {
-        $this->authorize('instances.adminlogin');
-        $this->resetErrorBag('password');
-
-        $key = 'instance-admin:'.auth()->id();
-        if (RateLimiter::tooManyAttempts($key, 5)) {
-            $this->addError('password', __('instances.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]));
-
-            return;
-        }
-
-        if (! Hash::check($this->password, auth()->user()->password)) {
-            RateLimiter::hit($key, 300);
-            $this->addError('password', __('instances.wrong_password'));
-
-            return;
-        }
-
-        RateLimiter::clear($key);
-        $this->reset('password');
-
-        // The reset runs on the provisioning worker — it owns the tunnel. The
-        // token is where it will leave the result.
-        $this->token = Str::random(40);
-        $this->waiting = true;
-
-        IssueInstanceAdminAccess::dispatch($this->uuid, $this->token, (int) auth()->id());
-    }
-
-    public function render()
-    {
-        $payload = null;
-
-        if ($this->token !== null) {
-            $raw = ConfigHandoff::get($this->token);
-
-            if ($raw !== null) {
-                // Consumed on the first read: leaving it in the cache would make
-                // "shown once" a figure of speech — any replayed component
-                // request could fetch the password again for ten minutes. The
-                // payload lives in a local variable, so it reaches the view and
-                // nothing else.
-                ConfigHandoff::forget($this->token);
-                $this->token = null;
-                $this->waiting = false;
-                $payload = json_decode($raw, true);
-            }
-        }
-
-        return view('livewire.admin.instance-admin-access', [
-            'credentials' => isset($payload['password']) ? $payload : null,
-            'failed' => isset($payload['error']) ? $payload['error'] : null,
-        ]);
-    }
-}

app/Livewire/Admin/Instances.php

@@ -1,50 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Instance;
-use Illuminate\Support\Facades\Lang;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-use Livewire\WithPagination;
-
-/**
- * Every instance on the estate, from the instances table.
- *
- * This page used to list seven invented instances on four invented hosts,
- * complete with a Nextcloud version column. The version is not recorded
- * anywhere, so the column is gone rather than filled in with something
- * plausible — and the storage column now shows the quota that was actually
- * sold, not a made-up "used of total", because used disk is not collected.
- */
-#[Layout('layouts.admin')]
-class Instances extends Component
-{
-    use WithPagination;
-
-    public function render()
-    {
-        $instances = Instance::query()
-            ->with(['customer', 'host'])
-            ->orderByDesc('id')
-            ->paginate(25);
-
-        return view('livewire.admin.instances', [
-            'instances' => $instances,
-            'rows' => $instances->getCollection()->map(fn (Instance $i) => [
-                'address' => $i->custom_domain ?: $i->subdomain,
-                'customer' => $i->customer?->name ?? '—',
-                'host' => $i->host?->name ?? '—',
-                'vmid' => $i->vmid ?? '—',
-                'plan' => $i->plan !== null ? __('billing.plan.'.$i->plan) : '—',
-                'quota' => $i->quota_gb !== null ? $i->quota_gb.' GB' : '—',
-                'status' => $status = $i->status ?? 'provisioning',
-                // A status the lifecycle adds later must show as itself, never
-                // as "admin.status.whatever" in front of the owner.
-                'status_label' => Lang::has('admin.status.'.$status)
-                    ? __('admin.status.'.$status)
-                    : $status,
-            ])->all(),
-        ]);
-    }
-}

app/Livewire/Admin/Maintenance.php

@@ -1,242 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Support\LocalTime;
-use App\Models\Datacenter;
-use App\Models\Host;
-use App\Models\MaintenanceWindow;
-use App\Services\Maintenance\MaintenanceNotifier;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\DB;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Maintenance extends Component
-{
-    #[Validate('required|string|max:255')]
-    public string $title = '';
-
-    #[Validate('nullable|string|max:2000')]
-    public string $publicDescription = '';
-
-    #[Validate('nullable|string|max:2000')]
-    public string $internalNotes = '';
-
-    #[Validate('required|date')]
-    public string $startsAt = '';
-
-    #[Validate('required|date')]
-    public string $endsAt = '';
-
-    /** @var array<int> */
-    public array $hostIds = [];
-
-    /** Toggle every host of one datacenter (select-all / deselect-all). */
-    public function selectDatacenter(string $code): void
-    {
-        $this->authorize('maintenance.manage');
-        $ids = Host::query()->where('datacenter', $code)->pluck('id')->map(fn ($id) => (string) $id)->all();
-        $current = array_map('strval', $this->hostIds);
-
-        $this->hostIds = empty(array_diff($ids, $current))
-            ? array_values(array_diff($current, $ids))   // all selected → clear them
-            : array_values(array_unique([...$current, ...$ids]));
-    }
-
-    /**
-     * Set the end from the start. Typing a full timestamp by hand is the
-     * fiddliest part of this form, and the end is almost always "start plus a
-     * round number of minutes".
-     */
-    public function setDuration(int $minutes): void
-    {
-        $this->authorize('maintenance.manage');
-
-        $start = $this->parsed($this->startsAt);
-        if ($start === null) {
-            // No start yet: assume the next half hour, which is what someone
-            // scheduling a window in a hurry means anyway.
-            $start = now()->addMinutes(30 - (now()->minute % 30))->startOfMinute();
-            $this->startsAt = LocalTime::toField($start);
-        }
-
-        $this->endsAt = LocalTime::toField($start->copy()->addMinutes($minutes));
-    }
-
-    /** Minutes between start and end, or null while either is unusable. */
-    public function durationMinutes(): ?int
-    {
-        $start = $this->parsed($this->startsAt);
-        $end = $this->parsed($this->endsAt);
-
-        if ($start === null || $end === null || $end->lessThanOrEqualTo($start)) {
-            return null;
-        }
-
-        return (int) $start->diffInMinutes($end);
-    }
-
-    /** What the operator typed, as UTC. Half-typed input is normal here. */
-    private function parsed(string $value): ?\Illuminate\Support\Carbon
-    {
-        return LocalTime::fromField($value);
-    }
-
-    public function saveDraft(): void
-    {
-        $this->authorize('maintenance.manage');
-        $this->persist('draft');
-    }
-
-    public function publish(): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = $this->persist('scheduled');
-        if ($window !== null) {
-            app(MaintenanceNotifier::class)->announce($window);
-        }
-    }
-
-    private function persist(string $state): ?MaintenanceWindow
-    {
-        $data = $this->validate([
-            'title' => 'required|string|max:255',
-            'publicDescription' => 'nullable|string|max:2000',
-            'internalNotes' => 'nullable|string|max:2000',
-            'startsAt' => 'required|date',
-            'endsAt' => 'required|date',
-            'hostIds' => 'array',
-            'hostIds.*' => 'integer|exists:hosts,id',
-        ]);
-
-        $starts = LocalTime::fromField($data['startsAt']);
-        $ends = LocalTime::fromField($data['endsAt']);
-
-        if ($ends->lessThanOrEqualTo($starts)) {
-            $this->addError('endsAt', __('maintenance.end_after_start'));
-
-            return null;
-        }
-        // A window always needs a host — otherwise a hostless draft can never be
-        // published (there is no edit-hosts action) and is stuck.
-        if (empty($this->hostIds)) {
-            $this->addError('hostIds', __('maintenance.need_host'));
-
-            return null;
-        }
-        if ($state === 'scheduled' && $ends->isPast()) {
-            $this->addError('endsAt', __('maintenance.end_future'));
-
-            return null;
-        }
-
-        // Create the window and attach hosts atomically so a bad id can't leave
-        // an orphaned scheduled window behind.
-        $window = DB::transaction(function () use ($data, $starts, $ends, $state) {
-            $window = MaintenanceWindow::create([
-                'title' => $data['title'],
-                'public_description' => $data['publicDescription'] ?: null,
-                'internal_notes' => $data['internalNotes'] ?: null,
-                'starts_at' => $starts,
-                'ends_at' => $ends,
-                'state' => $state,
-                'created_by' => auth()->id(),
-                'published_at' => $state === 'scheduled' ? now() : null,
-            ]);
-            $window->hosts()->sync(array_map('intval', $data['hostIds'] ?? []));
-
-            return $window;
-        });
-
-        $this->reset('title', 'publicDescription', 'internalNotes', 'startsAt', 'endsAt', 'hostIds');
-        $this->dispatch('notify', message: __($state === 'scheduled' ? 'maintenance.published' : 'maintenance.draft_saved'));
-
-        return $window;
-    }
-
-    public function publishExisting(string $uuid): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
-        if ($window === null || $window->state !== 'draft') {
-            return;
-        }
-        if ($window->hosts()->count() === 0 || $window->ends_at->isPast()) {
-            $this->dispatch('notify', message: __('maintenance.need_host'));
-
-            return;
-        }
-        $window->update(['state' => 'scheduled', 'published_at' => now()]);
-        app(MaintenanceNotifier::class)->announce($window);
-        $this->dispatch('notify', message: __('maintenance.published'));
-    }
-
-    /**
-     * Re-run announcements for a published window. Idempotent (ledger-guarded),
-     * so it only fills gaps — the retry path when a transient queue outage left
-     * some affected customers un-notified.
-     */
-    public function resend(string $uuid): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
-        // Only announce for a window that has not yet ended (derived state).
-        if ($window === null || ! in_array($window->derivedState(), ['upcoming', 'active'], true)) {
-            return;
-        }
-        app(MaintenanceNotifier::class)->announce($window);
-        $this->dispatch('notify', message: __('maintenance.notified'));
-    }
-
-    public function cancel(string $uuid): void
-    {
-        $this->authorize('maintenance.manage');
-        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
-        // Cannot cancel what is already cancelled or has already completed.
-        if ($window === null || in_array($window->derivedState(), ['cancelled', 'completed'], true)) {
-            return;
-        }
-        $wasPublished = $window->state === 'scheduled';
-        $window->update(['state' => 'cancelled', 'cancelled_at' => now()]);
-
-        // Customers who received an announcement are told it's cancelled. The
-        // MessageSending listener suppresses still-pending announcements, and the
-        // MessageSent listener catches the race (an announcement that delivers
-        // just as we cancel) by queuing a catch-up cancellation for it.
-        if ($wasPublished) {
-            app(MaintenanceNotifier::class)->notifyCancellation($window);
-        }
-
-        $this->dispatch('notify', message: __('maintenance.cancelled'));
-    }
-
-    public function render()
-    {
-        $windows = MaintenanceWindow::query()
-            ->withCount('hosts')
-            ->orderByDesc('starts_at')
-            ->get()
-            ->map(fn (MaintenanceWindow $w) => [
-                'uuid' => $w->uuid,
-                'title' => $w->title,
-                'starts_at' => $w->starts_at,
-                'ends_at' => $w->ends_at,
-                'state' => $w->derivedState(),
-                'hosts' => $w->hosts_count,
-                'affected' => $w->affectedCustomers()->count(),
-                'is_draft' => $w->state === 'draft',
-                'notifiable' => $w->state === 'scheduled' && in_array($w->derivedState(), ['upcoming', 'active'], true),
-                'cancellable' => in_array($w->derivedState(), ['draft', 'upcoming', 'active'], true),
-            ]);
-
-        return view('livewire.admin.maintenance', [
-            'windows' => $windows,
-            'datacenters' => Datacenter::query()->orderBy('name')->get(),
-            'hosts' => Host::query()->orderBy('datacenter')->orderBy('name')->get(),
-            'durationMinutes' => $this->durationMinutes(),
-        ]);
-    }
-}

app/Livewire/Admin/Overview.php

@@ -1,304 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Livewire\Concerns\BuildsRunSteps;
-use App\Models\Customer;
-use App\Models\Host;
-use App\Models\Instance;
-use App\Models\MonitoringTarget;
-use App\Models\ProvisioningRun;
-use App\Models\Subscription;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-/**
- * The console's front page — every figure on it comes from the database.
- *
- * It used to be invented: forty-two customers, €7,842 of monthly revenue, hosts
- * named pve-fsn-1..3, a twelve-month growth curve. It looked like an operating
- * business and reported nothing. Anything without a real source has been
- * removed rather than approximated — the revenue trend line especially, because
- * there is no revenue history to draw it from, and a plausible line is worse
- * than no line.
- */
-#[Layout('layouts.admin')]
-class Overview extends Component
-{
-    // current_step is an index into the pipeline, not a name. The provisioning
-    // page already owns the translation from one to the other; sharing it keeps
-    // the two pages from naming the same step differently.
-    use BuildsRunSteps;
-
-    /** A host is presumed missing once it has not checked in for this long. */
-    private const HOST_SILENT_AFTER_MINUTES = 30;
-
-    public function render()
-    {
-        $locale = app()->getLocale();
-
-        $customersOpen = Customer::query()->where('status', '!=', 'closed')->whereNull('closed_at')->count();
-        $customersSuspended = Customer::query()->where('status', 'suspended')->count();
-
-        $instancesByStatus = Instance::query()
-            ->selectRaw('status, count(*) as n')
-            ->groupBy('status')
-            ->pluck('n', 'status');
-
-        $hostsByStatus = Host::query()
-            ->selectRaw('status, count(*) as n')
-            ->groupBy('status')
-            ->pluck('n', 'status');
-
-        return view('livewire.admin.overview', [
-            'kpis' => [
-                [
-                    'label' => __('admin.kpi.customers'),
-                    'value' => (string) $customersOpen,
-                    'sub' => $customersSuspended > 0
-                        ? __('admin.kpi.customers_suspended', ['n' => $customersSuspended])
-                        : null,
-                ],
-                [
-                    'label' => __('admin.kpi.instances'),
-                    'value' => (string) ($instancesByStatus['active'] ?? 0),
-                    'sub' => __('admin.kpi.instances_of', ['n' => $instancesByStatus->sum()]),
-                ],
-                [
-                    'label' => __('admin.kpi.hosts'),
-                    'value' => (string) ($hostsByStatus['active'] ?? 0),
-                    'sub' => __('admin.kpi.hosts_of', ['n' => $hostsByStatus->sum()]),
-                ],
-                [
-                    'label' => __('admin.kpi.mrr'),
-                    'value' => $this->monthlyRevenue($locale),
-                    'sub' => __('admin.kpi.mrr_sub'),
-                ],
-            ],
-            'newInstances' => $this->newInstancesPerMonth($locale),
-            'hostLoad' => $this->hostLoad(),
-            'runs' => $this->openRuns(),
-            'notices' => $notices = $this->notices(),
-            'noticeCount' => count($notices),
-        ]);
-    }
-
-    /**
-     * What the estate bills per month, net.
-     *
-     * Off the contracts, not the catalogue: a price rise must not inflate
-     * reported revenue for every grandfathered customer overnight. Add-ons
-     * included and yearly terms divided — totalMonthlyCents() owns both rules.
-     *
-     * Grouped by currency and never summed across them. Adding francs to euros
-     * produces a number that is wrong in a way nobody notices.
-     */
-    private function monthlyRevenue(string $locale): string
-    {
-        $byCurrency = [];
-
-        Subscription::query()
-            ->where('status', 'active')
-            ->with('addons')
-            ->chunkById(200, function ($subscriptions) use (&$byCurrency) {
-                foreach ($subscriptions as $subscription) {
-                    $currency = strtoupper((string) $subscription->currency);
-                    $byCurrency[$currency] = ($byCurrency[$currency] ?? 0) + $subscription->totalMonthlyCents();
-                }
-            });
-
-        if ($byCurrency === []) {
-            return Number::currency(0, in: Subscription::catalogueCurrency(), locale: $locale);
-        }
-
-        return collect($byCurrency)
-            ->map(fn (int $cents, string $currency) => Number::currency($cents / 100, in: $currency, locale: $locale))
-            ->implode(' · ');
-    }
-
-    /**
-     * Instances created per month over the last twelve.
-     *
-     * Deliberately "created", not "in operation": reconstructing how many were
-     * running at the end of some past month would need a history nobody keeps,
-     * and the honest version of that chart is this one with a truthful label.
-     *
-     * @return array<string, mixed>
-     */
-    private function newInstancesPerMonth(string $locale): array
-    {
-        $start = Carbon::now()->startOfMonth()->subMonths(11);
-
-        $counts = Instance::query()
-            ->where('created_at', '>=', $start)
-            ->get(['created_at'])
-            ->countBy(fn (Instance $i) => $i->created_at->local()->format('Y-m'));
-
-        $labels = [];
-        $data = [];
-
-        for ($i = 0; $i < 12; $i++) {
-            $month = $start->copy()->addMonths($i);
-            $labels[] = $month->local()->locale($locale)->isoFormat('MMM');
-            $data[] = (int) ($counts[$month->local()->format('Y-m')] ?? 0);
-        }
-
-        return [
-            'empty' => array_sum($data) === 0,
-            'config' => [
-                'type' => 'bar',
-                'data' => [
-                    'labels' => $labels,
-                    'datasets' => [[
-                        'label' => __('admin.new_instances'),
-                        'data' => $data,
-                        'backgroundColor' => 'token:accent',
-                        'borderRadius' => 3,
-                        'maxBarThickness' => 26,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['grid' => ['display' => false]],
-                        // Whole instances only — a y-axis offering "1.5 instances"
-                        // is the giveaway that a chart was never looked at.
-                        'y' => ['beginAtZero' => true, 'ticks' => ['precision' => 0], 'grid' => ['color' => 'token:border']],
-                    ],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-        ];
-    }
-
-    /**
-     * Storage committed on each host, against the capacity placement may use.
-     *
-     * Deliberately the model's own committedGb()/freeGb()/usedPct() rather than
-     * a quicker sum here. Placement counts the VM disk allocation, ignores a
-     * failed instance that never got a VM, and subtracts the host's reserve —
-     * a dashboard doing its own arithmetic would show a host as comfortable
-     * while placement was already refusing to put anything on it, and the
-     * disagreement would only surface when an order failed.
-     *
-     * @return array<int, array<string, mixed>>
-     */
-    private function hostLoad(): array
-    {
-        return Host::query()
-            // Preloaded so listing hosts is one query, not one per host.
-            ->withSum(['instances as committed_disk_gb' => fn ($q) => $q->occupyingHost()], 'disk_gb')
-            ->orderBy('name')
-            ->get()
-            ->map(function (Host $host) {
-                $usable = $host->freeGb();
-                $committed = $host->committedGb();
-                // Same ratio usedPct() states, computed from the two values
-                // already in hand rather than asking the host to sum again.
-                $pct = $usable > 0 ? min(100, (int) round($committed / $usable * 100)) : 0;
-
-                return [
-                    'name' => $host->name,
-                    'pct' => $pct,
-                    'detail' => $usable > 0 ? "{$committed} / {$usable} GB" : __('admin.host_no_capacity'),
-                    'level' => match (true) {
-                        $usable === 0 => 'unknown',
-                        $pct >= 90 => 'high',
-                        $pct >= 75 => 'warn',
-                        default => 'ok',
-                    },
-                ];
-            })
-            ->all();
-    }
-
-    /**
-     * Provisioning runs that have not finished.
-     *
-     * @return array<int, array<string, mixed>>
-     */
-    private function openRuns(): array
-    {
-        return ProvisioningRun::query()
-            ->whereIn('status', [
-                ProvisioningRun::STATUS_PENDING,
-                ProvisioningRun::STATUS_RUNNING,
-                ProvisioningRun::STATUS_WAITING,
-                ProvisioningRun::STATUS_PAUSED,
-            ])
-            // Nested through the morph, so naming the customer does not cost a
-            // query per run.
-            ->with(['subject' => fn ($morph) => $morph->morphWith([Instance::class => ['customer']])])
-            ->latest('id')
-            ->limit(6)
-            ->get()
-            ->map(fn (ProvisioningRun $run) => [
-                'subject' => $this->describeSubject($run),
-                'step' => $this->currentStepLabel($run),
-                'status' => $run->status,
-            ])
-            ->all();
-    }
-
-    /**
-     * Everything currently wrong, from the records that know it.
-     *
-     * There is no invented alert here. If this list is empty, nothing in the
-     * database is reporting a problem — which is a statement worth being able
-     * to trust.
-     *
-     * @return array<int, array<string, string>>
-     */
-    private function notices(): array
-    {
-        $notices = [];
-
-        $failedRuns = ProvisioningRun::query()->where('status', ProvisioningRun::STATUS_FAILED)->count();
-        if ($failedRuns > 0) {
-            $notices[] = ['level' => 'warning', 'text' => __('admin.notice.failed_runs', ['n' => $failedRuns])];
-        }
-
-        foreach (Host::query()->where('status', 'error')->pluck('name') as $name) {
-            $notices[] = ['level' => 'warning', 'text' => __('admin.notice.host_error', ['host' => $name])];
-        }
-
-        $silent = Host::query()
-            ->where('status', 'active')
-            ->where(fn ($q) => $q
-                ->whereNull('last_seen_at')
-                ->orWhere('last_seen_at', '<', Carbon::now()->subMinutes(self::HOST_SILENT_AFTER_MINUTES)))
-            ->pluck('name');
-        foreach ($silent as $name) {
-            $notices[] = ['level' => 'warning', 'text' => __('admin.notice.host_silent', [
-                'host' => $name, 'minutes' => self::HOST_SILENT_AFTER_MINUTES,
-            ])];
-        }
-
-        // Distinct instances, not targets: one instance can be watched by
-        // several checks, and counting checks would report three outages where
-        // one machine is down. And only verdicts the sync job has refreshed —
-        // an unchecked row is not a healthy one, nor a failing one.
-        $down = MonitoringTarget::query()
-            ->where('status', 'down')
-            ->where('checked_at', '>=', Carbon::now()->subMinutes(20))
-            ->distinct()
-            ->count('instance_id');
-        if ($down > 0) {
-            $notices[] = ['level' => 'warning', 'text' => __('admin.notice.monitoring_down', ['n' => $down])];
-        }
-
-        return $notices;
-    }
-
-    private function describeSubject(ProvisioningRun $run): string
-    {
-        $subject = $run->subject;
-
-        return match (true) {
-            $subject instanceof Instance => $subject->customer?->name ?? $subject->subdomain ?? '—',
-            $subject instanceof Host => $subject->name,
-            default => class_basename($run->subject_type ?? '').' #'.$run->subject_id,
-        };
-    }
-}

app/Livewire/Admin/PlanVersions.php

@@ -1,262 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Support\LocalTime;
-use App\Models\PlanFamily;
-use App\Models\PlanVersion;
-use App\Models\Subscription;
-use App\Services\Billing\PlanCatalogue;
-use App\Support\Money;
-use Illuminate\Support\Carbon;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-use RuntimeException;
-
-/**
- * The versions of one plan: what it can do, what it costs, and when it sells.
- *
- * The page is built around the one rule that matters here — a draft can be
- * edited freely, a published version cannot be touched at all. So drafting and
- * publishing are separate acts, and publishing says plainly that it is final.
- */
-#[Layout('layouts.admin')]
-class PlanVersions extends Component
-{
-    public string $uuid;
-
-    /** The draft being written. */
-    public int $quotaGb = 100;
-
-    public int $trafficGb = 1000;
-
-    public int $seats = 5;
-
-    public int $ramMb = 4096;
-
-    public int $cores = 2;
-
-    public int $diskGb = 120;
-
-    public string $performance = 'standard';
-
-    public ?int $templateVmid = 9000;
-
-    /** @var array<int, string> */
-    public array $features = [];
-
-    /**
-     * In EUROS, as typed. The catalogue stores cents; asking the owner to type
-     * them too turned €799 into "79900", where one slipped digit is a factor of
-     * ten on an invoice. Money::toCents does the conversion, once.
-     */
-    public string $monthlyPrice = '49,00';
-
-    public string $yearlyPrice = '588,00';
-
-    /** Publishing: when it goes on sale, and optionally when it stops. */
-    public string $availableFrom = '';
-
-    public string $availableUntil = '';
-
-    public ?string $publishing = null;
-
-    public function mount(string $uuid): void
-    {
-        $this->authorize('plans.manage');
-
-        $family = PlanFamily::query()->where('uuid', $uuid)->firstOrFail();
-        $this->uuid = $uuid;
-
-        // Start the draft from what this plan is today, so the common case —
-        // "same plan, new price" — is a single edit rather than nine.
-        $latest = $family->versions()->orderByDesc('version')->first();
-
-        if ($latest !== null) {
-            $this->quotaGb = $latest->quota_gb;
-            $this->trafficGb = $latest->traffic_gb;
-            $this->seats = $latest->seats;
-            $this->ramMb = $latest->ram_mb;
-            $this->cores = $latest->cores;
-            $this->diskGb = $latest->disk_gb;
-            $this->performance = (string) ($latest->performance ?? 'standard');
-            $this->templateVmid = $latest->template_vmid;
-            $this->features = $latest->features ?? [];
-
-            $monthly = $latest->priceFor(Subscription::TERM_MONTHLY);
-            $yearly = $latest->priceFor(Subscription::TERM_YEARLY);
-            $this->monthlyPrice = Money::fromCents($monthly?->amount_cents ?? 4900);
-            $this->yearlyPrice = Money::fromCents($yearly?->amount_cents ?? 58800);
-        }
-    }
-
-    private function family(): PlanFamily
-    {
-        return PlanFamily::query()->where('uuid', $this->uuid)->firstOrFail();
-    }
-
-    /** Write a new draft. Nothing is promised until it is published. */
-    public function draft(): void
-    {
-        $this->authorize('plans.manage');
-
-        // Every bound is explicit, and generous rather than tight. A mistyped
-        // figure has to come back as a message on the field; without an upper
-        // limit it overflows the column instead and the owner gets a 500 with
-        // no idea which number was wrong.
-        $data = $this->validate([
-            'quotaGb' => 'required|integer|min:1|max:1000000',
-            'trafficGb' => 'required|integer|min:0|max:10000000',
-            'seats' => 'required|integer|min:1|max:100000',
-            'ramMb' => 'required|integer|min:512|max:4194304',
-            'cores' => 'required|integer|min:1|max:512',
-            // The disk has to hold the customer's quota plus the system itself.
-            'diskGb' => 'required|integer|min:1|max:1000000|gte:quotaGb',
-            // One of the classes we actually have a label for. Free text means
-            // a typo is published, frozen, and shown to customers forever as a
-            // raw translation key.
-            'performance' => ['required', Rule::in(array_keys((array) __('billing.perf')))],
-            // Required, not nullable: a version without a blueprint can be
-            // published and sold, and then fails provisioning every time.
-            'templateVmid' => 'required|integer|min:100|max:999999999',
-            'features' => 'array',
-            // Same reason as the performance class: a request can carry
-            // anything, and an unknown key is frozen at publication and shown
-            // to customers as a raw translation key.
-            'features.*' => ['string', Rule::in(array_keys((array) __('billing.feature')))],
-            // Euros with at most two decimals, either separator. The upper
-            // bound lives in Money's pattern: nine whole digits is far past
-            // anything we would charge and far short of overflowing the column.
-            // Checked as a rule, not afterwards: a price fault has to be
-            // reported alongside every other fault on the form, and a check
-            // that runs after validate() never runs at all once some other
-            // field has already thrown.
-            'monthlyPrice' => ['required', 'string', $price = function (string $attribute, mixed $value, callable $fail) {
-                if (Money::toCents((string) $value) === null) {
-                    $fail(__('plans.price_invalid'));
-                }
-            }],
-            'yearlyPrice' => ['required', 'string', $price],
-        ]);
-
-        $monthlyCents = Money::toCents($data['monthlyPrice']);
-        $yearlyCents = Money::toCents($data['yearlyPrice']);
-
-        $version = app(PlanCatalogue::class)->draft(
-            $this->family(),
-            [
-                'quota_gb' => $data['quotaGb'],
-                'traffic_gb' => $data['trafficGb'],
-                'seats' => $data['seats'],
-                'ram_mb' => $data['ramMb'],
-                'cores' => $data['cores'],
-                'disk_gb' => $data['diskGb'],
-                'performance' => $data['performance'],
-                'template_vmid' => $data['templateVmid'],
-                'features' => array_values($data['features']),
-            ],
-            // Both terms, because publishing refuses a version that is not
-            // priced for each — better to find that out here than in front of
-            // a customer.
-            [
-                Subscription::TERM_MONTHLY => $monthlyCents,
-                Subscription::TERM_YEARLY => $yearlyCents,
-            ],
-        );
-
-        $this->dispatch('notify', message: __('plans.draft_created', ['version' => $version->version]));
-    }
-
-    /** Open the publish form for one draft. */
-    public function choose(string $versionUuid): void
-    {
-        $this->publishing = $versionUuid;
-        $this->availableFrom = LocalTime::toField(now());
-        $this->availableUntil = '';
-    }
-
-    public function cancelPublish(): void
-    {
-        $this->reset('publishing', 'availableFrom', 'availableUntil');
-    }
-
-    /**
-     * Publish: fix the terms and put them on sale.
-     *
-     * Everything that can refuse this — an unpriced version, a window that
-     * overlaps another — refuses before anything is written, so a rejected
-     * publish leaves an editable draft rather than a stranded one.
-     */
-    public function publish(): void
-    {
-        $this->authorize('plans.manage');
-
-        $this->validate([
-            'availableFrom' => 'required|date',
-            'availableUntil' => 'nullable|date|after:availableFrom',
-        ]);
-
-        $version = PlanVersion::query()->where('uuid', $this->publishing)->firstOrFail();
-        abort_unless($version->plan_family_id === $this->family()->id, 404);
-
-        try {
-            app(PlanCatalogue::class)->publish(
-                $version,
-                LocalTime::fromField($this->availableFrom),
-                LocalTime::fromField($this->availableUntil),
-            );
-        } catch (RuntimeException $e) {
-            $this->addError('availableFrom', $e->getMessage());
-
-            return;
-        }
-
-        $this->cancelPublish();
-        $this->dispatch('notify', message: __('plans.published', ['version' => $version->version]));
-    }
-
-    /**
-     * Close a running version's window — the ordinary way to take a plan off
-     * sale for good, since a published version can never be deleted.
-     */
-    public function close(string $versionUuid): void
-    {
-        $this->authorize('plans.manage');
-
-        $version = PlanVersion::query()->where('uuid', $versionUuid)->firstOrFail();
-        abort_unless($version->plan_family_id === $this->family()->id, 404);
-
-        try {
-            app(PlanCatalogue::class)->schedule($version, $version->available_from, now());
-        } catch (RuntimeException $e) {
-            $this->addError('availableFrom', $e->getMessage());
-
-            return;
-        }
-
-        $this->dispatch('notify', message: __('plans.closed', ['version' => $version->version]));
-    }
-
-    #[On('plan-draft-deleted')]
-    public function refresh(): void
-    {
-        // Livewire re-renders; the listener exists so the modal can say so.
-    }
-
-    public function render()
-    {
-        $family = $this->family();
-        $now = now();
-
-        return view('livewire.admin.plan-versions', [
-            'family' => $family,
-            'versions' => $family->versions()->with('prices')->orderByDesc('version')->get(),
-            'now' => $now,
-            'featureKeys' => array_keys((array) __('billing.feature')),
-            'performanceClasses' => (array) __('billing.perf'),
-            'currency' => Subscription::catalogueCurrency(),
-        ]);
-    }
-}

app/Livewire/Admin/Plans.php

@@ -1,116 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\PlanFamily;
-use App\Services\Billing\PlanCatalogue;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-/**
- * The plan lines we sell, and whether each is currently on sale.
- *
- * Deliberately shallow: a family is a name and a rank, and everything that can
- * be got wrong — capabilities, prices, windows — lives one level down on the
- * versions, where publishing makes it permanent.
- */
-#[Layout('layouts.admin')]
-class Plans extends Component
-{
-    #[Validate(['required', 'string', 'max:32', 'regex:/^[a-z][a-z0-9_]*$/', 'unique:plan_families,key'])]
-    public string $key = '';
-
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    #[Validate('required|integer|min:0|max:255')]
-    public int $tier = 1;
-
-    public function mount(): void
-    {
-        // The page itself, not only its buttons. Hiding the nav entry and
-        // guarding the mutations still leaves the whole catalogue — prices,
-        // drafts, unreleased plans — readable to any operator who types the URL.
-        $this->authorize('plans.manage');
-    }
-
-    public function save(): void
-    {
-        $this->authorize('plans.manage');
-
-        $this->key = strtolower(trim($this->key));
-
-        $data = $this->validate([
-            // The key is permanent once created — orders, instances and every
-            // contract snapshot store it as a string — so it has to be a plain
-            // identifier, not something anyone will want to prettify later.
-            'key' => ['required', 'string', 'max:32', 'regex:/^[a-z][a-z0-9_]*$/', 'unique:plan_families,key'],
-            'name' => 'required|string|max:255',
-            'tier' => 'required|integer|min:0|max:255',
-        ]);
-
-        PlanFamily::create([
-            'key' => $data['key'],
-            'name' => $data['name'],
-            'tier' => $data['tier'],
-            // Nothing to sell until a version is published, so it starts able
-            // to sell and simply has nothing available.
-            'sales_enabled' => true,
-        ]);
-
-        $this->reset('key', 'name', 'tier');
-        $this->tier = 1;
-        $this->dispatch('notify', message: __('plans.created'));
-    }
-
-    /**
-     * The kill switch: stop selling this plan now, without touching a window.
-     *
-     * Existing customers keep their contract and their machine — this only
-     * decides whether anyone new can buy it.
-     */
-    public function toggleSales(string $uuid): void
-    {
-        $this->authorize('plans.manage');
-
-        $family = PlanFamily::query()->where('uuid', $uuid)->first();
-        $family?->update(['sales_enabled' => ! $family->sales_enabled]);
-
-        $this->dispatch('notify', message: __($family?->sales_enabled ? 'plans.now_selling' : 'plans.withdrawn'));
-    }
-
-    public function render()
-    {
-        $now = now();
-
-        $families = PlanFamily::query()
-            ->with(['versions.prices'])
-            ->withCount('versions')
-            ->orderBy('tier')
-            ->get()
-            ->map(fn (PlanFamily $family) => [
-                'uuid' => $family->uuid,
-                'key' => $family->key,
-                'name' => $family->name,
-                'tier' => $family->tier,
-                'sales_enabled' => $family->sales_enabled,
-                'versions_count' => $family->versions_count,
-                'live' => $family->versions->first(fn ($v) => $v->isAvailableAt($now)),
-                // What is queued up next, so a scheduled launch is visible
-                // before a customer discovers it.
-                'next' => $family->versions
-                    ->filter(fn ($v) => $v->isPublished() && $v->available_from->greaterThan($now))
-                    ->sortBy('available_from')
-                    ->first(),
-                'drafts' => $family->versions->filter(fn ($v) => ! $v->isPublished())->count(),
-            ]);
-
-        return view('livewire.admin.plans', [
-            'families' => $families,
-            // The shop's own answer, so this page cannot disagree with what a
-            // customer actually sees.
-            'sellable' => array_keys(app(PlanCatalogue::class)->sellable()),
-        ]);
-    }
-}

app/Livewire/Admin/Provisioning.php

@@ -1,160 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Livewire\Concerns\BuildsRunSteps;
-use App\Models\Host;
-use App\Models\Instance;
-use App\Models\Order;
-use App\Models\ProvisioningRun;
-use App\Provisioning\Jobs\AdvanceRunJob;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-#[Layout('layouts.admin')]
-class Provisioning extends Component
-{
-    use BuildsRunSteps;
-
-    #[On('echo-private:admin.runs,StepAdvanced')]
-    public function onStepAdvanced(): void
-    {
-        // A round-trip re-renders with fresh run state.
-    }
-
-    /** Retry a failed run from its current step (mirrors the host-detail retry). */
-    public function retry(string $uuid): void
-    {
-        $this->authorize('provisioning.retry');
-        // Atomically claim the run: only the request that transitions it out of
-        // FAILED proceeds, so two concurrent retries can't double-dispatch.
-        $claimed = ProvisioningRun::query()
-            ->where('uuid', $uuid)
-            ->where('status', ProvisioningRun::STATUS_FAILED)
-            ->update([
-                'status' => ProvisioningRun::STATUS_RUNNING,
-                'attempt' => 0,
-                'next_attempt_at' => now(),
-                'started_at' => now(), // reset the step timer so it doesn't re-time-out instantly
-                'error' => null,
-            ]);
-        if ($claimed === 0) {
-            return; // already retried by a concurrent request
-        }
-        $run = ProvisioningRun::query()->where('uuid', $uuid)->first();
-        if ($run === null) {
-            return;
-        }
-
-        // Move the subject out of its error state so the console reflects the retry.
-        $subject = $run->subject;
-        if ($subject instanceof Host) {
-            $subject->update(['status' => 'onboarding']);
-        } elseif ($subject instanceof Order) {
-            $subject->update(['status' => 'provisioning']);
-            Instance::query()->where('order_id', $subject->id)->where('status', 'failed')->update(['status' => 'provisioning']);
-        }
-
-        AdvanceRunJob::dispatch($run->uuid);
-        $this->dispatch('notify', message: __('admin.run_retried'));
-    }
-
-    /**
-     * A run that claims to be in progress but hasn't advanced in a while looks
-     * stuck — unless it is in a legitimate scheduled backoff (next_attempt_at in
-     * the future, e.g. RunRunner's retry delay of up to 300 s).
-     */
-    private function isStale(ProvisioningRun $run): bool
-    {
-        if (! in_array($run->status, ['running', 'waiting'], true)) {
-            return false;
-        }
-        if ($run->next_attempt_at !== null && $run->next_attempt_at->isFuture()) {
-            return false; // waiting out a scheduled retry/poll — not stuck
-        }
-
-        // Compare against the CURRENT step's own allowed duration — some steps
-        // (VM clone, Proxmox install) legitimately run for many minutes — plus a
-        // small grace. Only past its own deadline without advancing is it stuck.
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $class = $pipeline[$run->current_step] ?? null;
-        $maxSeconds = $class !== null ? app($class)->maxDuration() : 120;
-
-        return $run->updated_at !== null && $run->updated_at->lt(now()->subSeconds($maxSeconds + 30));
-    }
-
-    private function subjectLabel(ProvisioningRun $run): string
-    {
-        $subject = $run->subject;
-
-        if ($subject instanceof Order) {
-            return $subject->customer?->name ?? 'Order';
-        }
-        if ($subject instanceof Host) {
-            return $subject->name;
-        }
-
-        return class_basename($run->subject_type);
-    }
-
-    public function render()
-    {
-        $runs = ProvisioningRun::query()->latest('id')->limit(30)->get();
-
-        $active = $runs->first(fn (ProvisioningRun $r) => in_array(
-            $r->status, ['pending', 'running', 'waiting'], true
-        )) ?? $runs->first();
-
-        return view('livewire.admin.provisioning', [
-            'hasActive' => $active !== null && in_array($active->status, ['pending', 'running', 'waiting'], true),
-            'rows' => $runs->map(function (ProvisioningRun $r) {
-                $total = max(count(config('provisioning.pipelines.'.$r->pipeline, [])), 1);
-                $done = $r->status === ProvisioningRun::STATUS_COMPLETED ? $total : $r->current_step;
-
-                return [
-                    'uuid' => $r->uuid,
-                    'customer' => $this->subjectLabel($r),
-                    'pipeline' => $r->pipeline,
-                    'step' => $r->status === 'completed' ? '—' : $this->currentStepLabel($r),
-                    'n' => ($r->current_step + 1).'/'.$total,
-                    'percent' => (int) round($done / $total * 100),
-                    'attempt' => $r->attempt,
-                    'state' => $this->runState($r),
-                    'failed' => $r->status === ProvisioningRun::STATUS_FAILED,
-                    'activity' => $r->updated_at?->diffForHumans() ?? '—',
-                    'stale' => $this->isStale($r),
-                ];
-            })->all(),
-            'panel' => $active ? $this->panelFor($active) : null,
-        ]);
-    }
-
-    /** Compact "current run" readout for the right column. */
-    private function panelFor(ProvisioningRun $run): array
-    {
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $total = max(count($pipeline), 1);
-        $current = min($run->current_step, $total - 1);
-        $completed = $run->status === ProvisioningRun::STATUS_COMPLETED;
-        $done = $completed ? $total : $current;
-
-        return [
-            'uuid' => $run->uuid,
-            'subject' => $this->subjectLabel($run),
-            'pipeline' => $run->pipeline,
-            'attempt' => $run->attempt,
-            'status' => $this->runState($run),                       // running|done|failed
-            'failed' => $run->status === ProvisioningRun::STATUS_FAILED,
-            'current' => $completed ? null : (isset($pipeline[$current]) ? __(app($pipeline[$current])->label()) : null),
-            'next' => isset($pipeline[$current + 1]) && ! $completed ? __(app($pipeline[$current + 1])->label()) : null,
-            'error' => $run->error,
-            'done' => $done,
-            'total' => $total,
-            'percent' => (int) round($done / $total * 100),
-            'activity' => $run->updated_at?->diffForHumans() ?? '—',
-            'started' => $run->started_at?->diffForHumans() ?? null,
-            'stale' => $this->isStale($run),
-        ];
-    }
-}

app/Livewire/Admin/Revenue.php

@@ -1,203 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Subscription;
-use App\Models\SubscriptionRecord;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-/**
- * Revenue, from the contracts and the commercial register.
- *
- * What was here before was a story: €7,842 MRR, 1.8 % churn, a twelve-month
- * curve, four payments from customers who do not exist. All of it is gone.
- *
- * Two figures that used to be shown are not shown any more, because there is
- * nothing to compute them from and an estimate would be indistinguishable from
- * a measurement:
- *
- *  - the MRR trend, which needs a monthly revenue history nobody records;
- *  - churn, which needs cancellations over a period, and cancelled_at alone
- *    does not say what the base was.
- *
- * ARR is shown, but only as what it is: this month's recurring revenue times
- * twelve, labelled as a projection rather than as measured turnover.
- */
-#[Layout('layouts.admin')]
-class Revenue extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $totals = $this->recurringTotals();
-
-        return view('livewire.admin.revenue', [
-            'kpis' => [
-                [
-                    'label' => __('admin.rev.mrr'),
-                    'value' => $this->format($totals, fn (array $t) => $t['cents'] / 100, $locale),
-                    'sub' => __('admin.rev.mrr_sub'),
-                ],
-                [
-                    'label' => __('admin.rev.arr'),
-                    'value' => $this->format($totals, fn (array $t) => $t['cents'] * 12 / 100, $locale),
-                    'sub' => __('admin.rev.arr_sub'),
-                ],
-                [
-                    'label' => __('admin.rev.arpu'),
-                    'value' => $this->format(
-                        $totals,
-                        fn (array $t) => count($t['customers']) > 0 ? $t['cents'] / count($t['customers']) / 100 : 0,
-                        $locale,
-                    ),
-                    'sub' => __('admin.rev.arpu_sub'),
-                ],
-                [
-                    'label' => __('admin.rev.contracts'),
-                    'value' => (string) array_sum(array_column($totals, 'contracts')),
-                    'sub' => __('admin.rev.contracts_sub'),
-                ],
-            ],
-            'planCharts' => $this->planCharts(),
-            'payments' => $this->recentPayments($locale),
-        ]);
-    }
-
-    /**
-     * Recurring revenue per currency, off the contracts.
-     *
-     * Never summed across currencies. Frozen contract prices, not the
-     * catalogue, so a price rise does not retroactively inflate what
-     * grandfathered customers are reported to pay. Add-ons included and yearly
-     * terms divided — totalMonthlyCents() owns both of those rules.
-     *
-     * @return array<string, array{cents:int, customers:array<int,bool>, contracts:int}>
-     */
-    private function recurringTotals(): array
-    {
-        $totals = [];
-
-        Subscription::query()
-            ->where('status', 'active')
-            ->with('addons')
-            ->chunkById(200, function ($subscriptions) use (&$totals) {
-                foreach ($subscriptions as $subscription) {
-                    $currency = strtoupper((string) $subscription->currency);
-                    $totals[$currency] ??= ['cents' => 0, 'customers' => [], 'contracts' => 0];
-                    $totals[$currency]['cents'] += $subscription->totalMonthlyCents();
-                    $totals[$currency]['contracts']++;
-                    // A customer with two contracts is one customer — ARPU
-                    // divided by contracts would understate it.
-                    $totals[$currency]['customers'][(int) $subscription->customer_id] = true;
-                }
-            });
-
-        return $totals;
-    }
-
-    /**
-     * @param  array<string, array{cents:int, customers:array<int,bool>, contracts:int}>  $totals
-     * @param  callable(array{cents:int, customers:array<int,bool>, contracts:int}): float  $amount
-     */
-    private function format(array $totals, callable $amount, string $locale): string
-    {
-        if ($totals === []) {
-            return Number::currency(0, in: Subscription::catalogueCurrency(), locale: $locale);
-        }
-
-        return collect($totals)
-            ->map(fn (array $t, string $currency) => Number::currency($amount($t), in: $currency, locale: $locale))
-            ->implode(' · ');
-    }
-
-    /**
-     * Recurring revenue split by plan — one chart per currency.
-     *
-     * By what customers are ON, not by what is on sale: a withdrawn plan still
-     * bills, and leaving it out would understate the total the chart sits next
-     * to.
-     *
-     * Per currency, because a doughnut adds its slices together. Two currencies
-     * in one ring produces a total that is not an amount of anything, and it
-     * looks exactly as convincing as a correct one.
-     *
-     * @return array<int, array{currency:string, config:array<string,mixed>}>
-     */
-    private function planCharts(): array
-    {
-        $byCurrency = [];
-
-        Subscription::query()
-            ->where('status', 'active')
-            ->with('addons')
-            ->chunkById(200, function ($subscriptions) use (&$byCurrency) {
-                foreach ($subscriptions as $subscription) {
-                    $currency = strtoupper((string) $subscription->currency);
-                    $plan = (string) $subscription->plan;
-                    $byCurrency[$currency][$plan] = ($byCurrency[$currency][$plan] ?? 0)
-                        + $subscription->totalMonthlyCents();
-                }
-            });
-
-        $charts = [];
-
-        foreach ($byCurrency as $currency => $byPlan) {
-            arsort($byPlan);
-
-            $charts[] = [
-                'currency' => $currency,
-                'config' => [
-                    'type' => 'doughnut',
-                    'data' => [
-                        'labels' => array_map(fn (string $key) => __('billing.plan.'.$key), array_keys($byPlan)),
-                        'datasets' => [[
-                            'data' => array_map(fn (int $cents) => round($cents / 100, 2), array_values($byPlan)),
-                            'backgroundColor' => ['token:accent', 'token:info', 'token:success-bright', 'token:warning'],
-                            'borderWidth' => 0,
-                        ]],
-                    ],
-                    'options' => [
-                        'cutout' => '62%',
-                        'plugins' => ['legend' => ['position' => 'bottom', 'labels' => ['boxWidth' => 10, 'padding' => 12]]],
-                    ],
-                ],
-            ];
-        }
-
-        return $charts;
-    }
-
-    /**
-     * The last payments actually recorded.
-     *
-     * Both kinds count: an ordinary billing cycle is written as `renewal`, and
-     * `invoice_paid` is reserved for everything else Stripe charges for — a
-     * proration, a manual invoice. Listing only the second would show a
-     * payments panel with no ordinary payments in it.
-     *
-     * Gross, because that is what left the customer's account. The register
-     * holds net and tax separately for the books.
-     *
-     * @return array<int, array<string, string>>
-     */
-    private function recentPayments(string $locale): array
-    {
-        return SubscriptionRecord::query()
-            ->whereIn('event', [SubscriptionRecord::EVENT_RENEWAL, SubscriptionRecord::EVENT_INVOICE_PAID])
-            ->orderByDesc('occurred_at')
-            ->limit(8)
-            ->get()
-            ->map(fn (SubscriptionRecord $r) => [
-                'customer' => $r->customer_name ?: '—',
-                'amount' => Number::currency(
-                    (int) ($r->gross_cents ?: $r->net_cents) / 100,
-                    in: strtoupper((string) ($r->currency ?: Subscription::catalogueCurrency())),
-                    locale: $locale,
-                ),
-                'when' => $r->occurred_at?->local()->translatedFormat('d. MMM') ?? '—',
-            ])
-            ->all();
-    }
-}

app/Livewire/Admin/Secrets.php

@@ -1,146 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Livewire\Concerns\ConfirmsPassword;
-use App\Services\Secrets\SecretVault;
-use App\Services\Stripe\StripeCheck;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-use Throwable;
-
-/**
- * Credentials, changeable from the console instead of over SSH.
- *
- * Two gates, not one. The capability decides who may open the page at all; the
- * password decides whether this SESSION may see or change anything. The second
- * exists because the realistic threat is not a stranger — it is an unlocked
- * machine, and a signed-in session is exactly what that gives away.
- *
- * Both are enforced on every action, server-side. A Livewire action is
- * reachable by anyone who can post to /livewire/update, and the buttons not
- * being on screen has never stopped anybody.
- *
- * The value being entered lives in a public property only while it is being
- * typed, and is cleared the moment it is stored — a Livewire property travels
- * to the browser and back in the component snapshot.
- */
-#[Layout('layouts.admin')]
-class Secrets extends Component
-{
-    use ConfirmsPassword;
-
-    /**
-     * The new value being entered, keyed by a DOTLESS form key.
-     *
-     * Livewire reads a dot in a property path as nesting, so binding to
-     * `entered.stripe.secret` writes `entered['stripe']['secret']` and the
-     * value never arrives where the save looks for it. The registry keys keep
-     * their dots; the form does not.
-     */
-    public array $entered = [];
-
-    /** Result of the last connection test, for display only. */
-    public ?array $check = null;
-
-    public function mount(): void
-    {
-        $this->authorize('secrets.manage');
-    }
-
-    public function save(string $key): void
-    {
-        $this->guard();
-
-        $field = self::field($key);
-        $value = trim((string) ($this->entered[$field] ?? ''));
-
-        if ($value === '') {
-            $this->addError('entered.'.$field, __('secrets.empty'));
-
-            return;
-        }
-
-        try {
-            app(SecretVault::class)->put($key, $value, auth()->user());
-        } catch (Throwable $e) {
-            $this->addError('entered.'.$field, $e->getMessage());
-
-            return;
-        }
-
-        // Out of the component state as soon as it is stored.
-        $this->entered[$field] = '';
-        $this->check = null;
-        $this->dispatch('notify', message: __('secrets.saved'));
-    }
-
-    public function forget(string $key): void
-    {
-        $this->guard();
-
-        app(SecretVault::class)->forget($key);
-        $this->check = null;
-        $this->dispatch('notify', message: __('secrets.removed'));
-    }
-
-    /**
-     * Try the key that is in force — or the one being typed, before storing it.
-     *
-     * Checking the candidate first is the point: a key that is saved and wrong
-     * fails later, somewhere else, usually in front of a customer.
-     */
-    public function test(string $key): void
-    {
-        $this->guard();
-
-        // The checker named by THIS entry, not a fixed one. When the area held a
-        // single Stripe key a hard-coded StripeCheck was the same thing; with
-        // four entries it would have reported on Stripe while the operator was
-        // looking at the DNS token.
-        $checker = SecretVault::REGISTRY[$key]['check'] ?? null;
-        abort_if($checker === null, 404);
-
-        $candidate = trim((string) ($this->entered[self::field($key)] ?? '')) ?: null;
-        $this->check = app($checker)->run($candidate);
-    }
-
-    /** The dotless form key for a registry key. */
-    public static function field(string $key): string
-    {
-        return str_replace('.', '_', $key);
-    }
-
-    /** Capability AND a recent password, on every single action. */
-    private function guard(): void
-    {
-        $this->authorize('secrets.manage');
-        abort_unless($this->passwordRecentlyConfirmed(), 403);
-    }
-
-    public function render()
-    {
-        $vault = app(SecretVault::class);
-        $unlocked = $this->passwordRecentlyConfirmed();
-
-        return view('livewire.admin.secrets', [
-            'unlocked' => $unlocked,
-            'usable' => $vault->isUsable(),
-            'entries' => collect(SecretVault::REGISTRY)
-                ->map(fn (array $meta, string $key) => [
-                    'key' => $key,
-                    'field' => self::field($key),
-                    'label' => __($meta['label']),
-                    // Only where a checker exists. A test button that cannot
-                    // actually test is a promise the page does not keep.
-                    'testable' => isset($meta['check']),
-                    'source' => $vault->source($key),
-                    // Only ever an outline, and only once unlocked.
-                    'outline' => $unlocked ? $vault->outline($key) : null,
-                    'updated_at' => $unlocked ? $vault->updatedAt($key) : null,
-                ])
-                ->values()
-                ->all(),
-        ]);
-    }
-}

app/Livewire/Admin/Settings.php

@@ -1,384 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Customer;
-use App\Models\User;
-use App\Models\VpnPeer;
-use App\Services\Deployment\UpdateChannel;
-use App\Support\Settings as AppSettings;
-use App\Provisioning\Jobs\ApplyVpnPeer;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Str;
-use Spatie\Permission\Models\Role;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-/**
- * Operator settings: the signed-in operator's own account plus (Owner-only)
- * staff management. All staff mutations are capability-gated server-side and
- * protect the last-Owner and self-role invariants transactionally.
- */
-#[Layout('layouts.admin')]
-class Settings extends Component
-{
-    use \App\Livewire\Concerns\ChangesOwnPassword;
-
-    // My account
-    #[Validate('required|string|max:255')]
-    public string $name = '';
-
-    #[Validate('required|email|max:255')]
-    public string $email = '';
-
-    // Invite staff
-    #[Validate('required|string|max:255')]
-    public string $staffName = '';
-
-    #[Validate('required|email|max:255')]
-    public string $staffEmail = '';
-
-    #[Validate('required|in:Owner,Admin,Support,Billing,Read-only')]
-    public string $staffRole = 'Support';
-
-    /** Shown once after inviting, since email delivery is still mocked. */
-    public ?string $invitedEmail = null;
-
-    public ?string $invitedPassword = null;
-
-    public function mount(): void
-    {
-        $this->name = auth()->user()->name;
-        $this->email = auth()->user()->email;
-    }
-
-    /**
-     * Take the marketing site and the customer portal offline, or back online.
-     * The console keeps working either way — otherwise this switch could only
-     * ever be flipped once.
-     */
-    public function toggleSiteVisibility(): void
-    {
-        $this->authorize('site.manage');
-
-        $public = ! AppSettings::bool('site.public', true);
-        AppSettings::set('site.public', $public);
-
-        $this->dispatch('notify', message: $public
-            ? __('admin_settings.site_now_public')
-            : __('admin_settings.site_now_hidden'));
-    }
-
-    public function saveAccount(): void
-    {
-        $user = auth()->user();
-        $data = $this->validate([
-            'name' => 'required|string|max:255',
-            'email' => 'required|email|max:255|unique:users,email,'.$user->id,
-        ]);
-
-        // An operator email must never collide with a customer's — that would
-        // block the customer from ever obtaining a portal login (ensureUser).
-        if (Customer::query()->where('email', $data['email'])->exists()) {
-            $this->addError('email', __('admin_settings.is_customer'));
-
-            return;
-        }
-
-        $user->update($data);
-        $this->dispatch('notify', message: __('admin_settings.account_saved'));
-    }
-
-    public function inviteStaff(): void
-    {
-        $this->authorize('staff.manage');
-        $data = $this->validate([
-            'staffName' => 'required|string|max:255',
-            'staffEmail' => 'required|email|max:255|unique:users,email',
-            'staffRole' => 'required|in:Owner,Admin,Support,Billing,Read-only',
-        ]);
-
-        // Only an Owner may create another Owner.
-        if ($data['staffRole'] === 'Owner' && ! auth()->user()->hasRole('Owner')) {
-            $this->addError('staffRole', __('admin_settings.owner_only'));
-
-            return;
-        }
-        // Never turn a customer's portal login into an operator.
-        if (Customer::query()->where('email', $data['staffEmail'])->exists()) {
-            $this->addError('staffEmail', __('admin_settings.is_customer'));
-
-            return;
-        }
-
-        // Email/password-setup delivery is still mocked, so generate a temporary
-        // password and surface it once to the Owner to share securely — the
-        // account is usable immediately (a proper invite link follows with mail).
-        $temp = Str::password(14);
-        $user = User::create([
-            'name' => $data['staffName'],
-            'email' => $data['staffEmail'],
-            'password' => Hash::make($temp),
-            'is_admin' => true,
-        ]);
-        $user->assignRole($data['staffRole']);
-
-        $this->invitedEmail = $data['staffEmail'];
-        $this->invitedPassword = $temp;
-        $this->reset('staffName', 'staffEmail');
-        $this->staffRole = 'Support';
-        $this->dispatch('notify', message: __('admin_settings.staff_invited'));
-    }
-
-    public function setStaffRole(int $id, string $role): void
-    {
-        $this->authorize('staff.manage');
-        if (! in_array($role, User::OPERATOR_ROLES, true)) {
-            return;
-        }
-
-        $result = DB::transaction(function () use ($id, $role) {
-            // Serialize on the Owner role so the global owner count can't be
-            // raced to zero by concurrent demotions of different owners.
-            Role::query()->where('name', 'Owner')->lockForUpdate()->first();
-
-            $target = User::query()->whereKey($id)->lockForUpdate()->first();
-            if ($target === null) {
-                return 'gone';
-            }
-            if ($target->id === auth()->id()) {
-                return 'self';
-            }
-            // Only existing operators may be re-roled — never escalate a customer
-            // (or any non-staff) user into the console via a tampered id.
-            if (! $target->isOperator() || Customer::query()->where('email', $target->email)->exists()) {
-                return 'not_staff';
-            }
-            // Granting or revoking Owner is Owner-only.
-            if (($role === 'Owner' || $target->hasRole('Owner')) && ! auth()->user()->hasRole('Owner')) {
-                return 'owner_only';
-            }
-            // Never demote the last Owner.
-            if ($target->hasRole('Owner') && $role !== 'Owner' && $this->ownerCount() <= 1) {
-                return 'last_owner';
-            }
-            $target->syncRoles([$role]);
-
-            return 'ok';
-        });
-
-        $this->flash($result);
-    }
-
-    public function revokeStaff(int $id): void
-    {
-        $this->authorize('staff.manage');
-
-        $revokedPeers = [];
-
-        $result = DB::transaction(function () use ($id, &$revokedPeers) {
-            Role::query()->where('name', 'Owner')->lockForUpdate()->first();
-
-            $target = User::query()->whereKey($id)->lockForUpdate()->first();
-            if ($target === null || ! $target->isOperator()) {
-                return 'gone';
-            }
-            if ($target->id === auth()->id()) {
-                return 'self';
-            }
-            if ($target->hasRole('Owner') && $this->ownerCount() <= 1) {
-                return 'last_owner';
-            }
-            $target->syncRoles([]);
-            $target->update(['is_admin' => false]);
-
-            // Taking away the console but leaving the tunnel would be the worst
-            // of both: no access to the panel, still a route into the
-            // management network. Same revocation path as the VPN page uses.
-            foreach (VpnPeer::query()->where('user_id', $target->id)->get() as $peer) {
-                $peer->purgeSecret();
-                $peer->delete();
-                $revokedPeers[] = $peer->public_key;
-            }
-
-            return 'revoked';
-        });
-
-        // Dispatched only once the rows are committed: a worker picking the job
-        // up mid-transaction would still see the peer as active, leave it on the
-        // hub, and never be asked again — a revoked colleague would keep their
-        // tunnel until the next reconciliation happened to notice.
-        foreach ($revokedPeers as $publicKey) {
-            ApplyVpnPeer::dispatch($publicKey, null, false);
-        }
-
-        $this->flash($result);
-    }
-
-    private function flash(string $result): void
-    {
-        $msg = match ($result) {
-            'ok' => __('admin_settings.role_updated'),
-            'revoked' => __('admin_settings.staff_revoked'),
-            'self' => __('admin_settings.not_self'),
-            'owner_only' => __('admin_settings.owner_only'),
-            'last_owner' => __('admin_settings.last_owner'),
-            'not_staff' => __('admin_settings.not_staff'),
-            default => null,
-        };
-        if ($msg !== null) {
-            $this->dispatch('notify', message: $msg);
-        }
-    }
-
-    private function ownerCount(): int
-    {
-        return User::query()->whereHas('roles', fn ($q) => $q->where('name', 'Owner'))->count();
-    }
-
-    /** A new entry for the console allowlist: a single address or a CIDR range. */
-    public string $consoleIp = '';
-
-    /**
-     * Add a network that may reach the console without the VPN.
-     *
-     * Validated as an address or CIDR before it is stored: a typo that silently
-     * matches nothing is how someone locks themselves out while believing they
-     * have not.
-     */
-    public function addConsoleIp(): void
-    {
-        $this->authorize('site.manage');
-
-        $value = trim($this->consoleIp);
-
-        if (! \App\Http\Middleware\RestrictConsoleNetwork::isNetwork($value)) {
-            $this->addError('consoleIp', __('admin_settings.console_ip_invalid'));
-
-            return;
-        }
-
-        $list = (array) AppSettings::get('console.allowed_ips', []);
-
-        if (! in_array($value, $list, true)) {
-            $list[] = $value;
-            AppSettings::set('console.allowed_ips', array_values($list));
-        }
-
-        $this->consoleIp = '';
-        $this->dispatch('notify', message: __('admin_settings.console_ip_added', ['ip' => $value]));
-    }
-
-    /**
-     * Remove one — unless it is the reason you can see this page.
-     *
-     * Refusing here rather than warning afterwards: by the time the page
-     * reloads, the request that would show the warning has already been
-     * rejected. The VPN is never in this list, so an operator on the VPN can
-     * always clear it out.
-     */
-    public function removeConsoleIp(string $value): void
-    {
-        $this->authorize('site.manage');
-
-        $list = array_values(array_filter(
-            (array) AppSettings::get('console.allowed_ips', []),
-            fn ($entry) => $entry !== $value,
-        ));
-
-        $ip = (string) request()->ip();
-
-        if (\App\Http\Middleware\RestrictConsoleNetwork::isRestricted()
-            && ! \App\Http\Middleware\RestrictConsoleNetwork::wouldStillAllow($ip, $list)) {
-            $this->dispatch('notify', message: __('admin_settings.console_ip_last', ['ip' => $ip]));
-
-            return;
-        }
-
-        AppSettings::set('console.allowed_ips', $list);
-        $this->dispatch('notify', message: __('admin_settings.console_ip_removed', ['ip' => $value]));
-    }
-
-    /**
-     * Switch the restriction on or off.
-     *
-     * Turning it ON is refused unless the address doing the switching is
-     * already covered — otherwise the click that secures the console is also
-     * the click that locks its owner out of it.
-     */
-    public function toggleConsoleRestriction(): void
-    {
-        $this->authorize('site.manage');
-
-        $on = ! \App\Http\Middleware\RestrictConsoleNetwork::isRestricted();
-
-        if ($on && ! \App\Http\Middleware\RestrictConsoleNetwork::allows((string) request()->ip())) {
-            $this->dispatch('notify', message: __('admin_settings.console_lock_refused', ['ip' => (string) request()->ip()]));
-
-            return;
-        }
-
-        AppSettings::set('console.network_restricted', $on);
-        $this->dispatch('notify', message: __($on ? 'admin_settings.console_locked' : 'admin_settings.console_unlocked'));
-    }
-
-
-    /**
-     * Ask the host-side agent to update this installation.
-     *
-     * Deliberately a request rather than an action: see UpdateChannel. The
-     * button cannot report success, because success means this container is
-     * restarted out from under the response — so it reports that the update was
-     * asked for, and the page shows the outcome once the agent has written it.
-     */
-    public function requestUpdate(): void
-    {
-        $this->authorize('site.manage');
-
-        $accepted = app(UpdateChannel::class)->request(auth()->user()->email);
-
-        $this->dispatch('notify', message: __($accepted
-            ? 'admin_settings.update_requested'
-            : 'admin_settings.update_already_requested'));
-    }
-
-    public function render()
-    {
-        $staff = User::query()
-            ->whereHas('roles', fn ($q) => $q->whereIn('name', User::OPERATOR_ROLES))
-            ->with('roles')
-            ->orderBy('name')
-            ->get()
-            ->map(fn (User $u) => [
-                'id' => $u->id,
-                'name' => $u->name,
-                'email' => $u->email,
-                'role' => $u->roles->first()?->name ?? '—',
-                'self' => $u->id === auth()->id(),
-            ]);
-
-        return view('livewire.admin.settings', [
-            'update' => app(UpdateChannel::class)->state(),
-            'updateLog' => app(UpdateChannel::class)->lastLog(),
-            'sitePublic' => AppSettings::bool('site.public', true),
-            'canManageSite' => auth()->user()?->can('site.manage') ?? false,
-            // Shown so nobody has to guess why they still see the real site.
-            'viewerOnVpn' => \Symfony\Component\HttpFoundation\IpUtils::checkIp(
-                (string) request()->ip(),
-                (array) config('admin_access.trusted_ranges', []),
-            ),
-            // Who may reach the console, and from where the viewer is asking —
-            // shown so the consequence of a change is visible before it is made.
-            'consoleRestricted' => \App\Http\Middleware\RestrictConsoleNetwork::isRestricted(),
-            'consoleIps' => (array) AppSettings::get('console.allowed_ips', []),
-            'consoleVpnRanges' => (array) config('admin_access.trusted_ranges', []),
-            'viewerIp' => (string) request()->ip(),
-            'staff' => $staff,
-            'roles' => User::OPERATOR_ROLES,
-            'canManageStaff' => auth()->user()->can('staff.manage'),
-            'isOwner' => auth()->user()->hasRole('Owner'),
-        ]);
-    }
-}

app/Livewire/Admin/Vpn.php

@@ -1,389 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\Host;
-use App\Models\VpnPeer;
-use App\Provisioning\Jobs\ApplyVpnPeer;
-use App\Provisioning\Jobs\SyncVpnPeers;
-use App\Models\User;
-use App\Services\Wireguard\ConfigHandoff;
-use App\Services\Wireguard\ConfigVault;
-use App\Services\Wireguard\Keypair;
-use App\Services\Wireguard\QrCode;
-use App\Services\Wireguard\WireguardHub;
-use Illuminate\Database\QueryException;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Str;
-use Illuminate\Validation\Rule;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-/**
- * VPN access management. The console container has no wg0, so live state is
- * read from the database and refreshed by SyncVpnPeers on the provisioning
- * queue — the poll below only nudges that job, it never talks to WireGuard.
- */
-#[Layout('layouts.admin')]
-class Vpn extends Component
-{
-    public string $name = '';
-
-    /** Optional: a peer that generated its own key never hands us the private half. */
-    public string $publicKey = '';
-
-    /** Opaque handle for the freshly created config; see ConfigHandoff. */
-    public ?string $configToken = null;
-
-    public ?string $newConfigName = null;
-
-    /** Owner of the new access. Defaults to the operator creating it. */
-    public ?int $ownerId = null;
-
-    /** Keep the config so its owner can fetch it again behind their password. */
-    public bool $storeConfig = false;
-
-    public bool $showQr = false;
-
-    public function mount(): void
-    {
-        $this->authorize('viewAny', VpnPeer::class);
-        $this->ownerId = auth()->id();
-    }
-
-    /**
-     * mount() runs once; every later request — including the five-second poll —
-     * only hydrates. Without this, revoking vpn.manage would not take effect
-     * until the operator happened to reload the page, and the open tab would
-     * keep serving fresh peer state.
-     */
-    public function hydrate(): void
-    {
-        $this->authorize('viewAny', VpnPeer::class);
-    }
-
-    public function create(): void
-    {
-        $this->authorize('create', VpnPeer::class);
-
-        $this->validate([
-            'name' => 'required|string|max:255',
-            'publicKey' => 'nullable|string|max:64',
-            // An access belongs to a person, and only to an operator: a customer
-            // account must never own a way into the management network.
-            'ownerId' => ['required', Rule::exists('users', 'id')],
-        ]);
-
-        // Storing needs a key. Without one we would either write the credential
-        // in the clear or pretend we stored it — both worse than saying no.
-        if ($this->storeConfig && ! ConfigVault::available()) {
-            $this->addError('storeConfig', __('vpn.vault_unavailable'));
-
-            return;
-        }
-
-        $ownKey = trim($this->publicKey) !== '';
-
-        if ($this->storeConfig && $ownKey) {
-            $this->addError('storeConfig', __('vpn.cannot_store_foreign_key'));
-
-            return;
-        }
-
-        if ($ownKey && ! Keypair::isValidKey(trim($this->publicKey))) {
-            $this->addError('publicKey', __('vpn.invalid_key'));
-
-            return;
-        }
-
-        $keypair = $ownKey ? null : Keypair::generate();
-        $publicKey = $ownKey ? trim($this->publicKey) : $keypair->publicKey;
-
-        $hub = app(WireguardHub::class);
-
-        // Same lock the host pipeline holds while it reserves an address
-        // (ConfigureWireguard). Addresses come from one subnet but live in two
-        // tables, so neither unique index can catch the other's insert — the
-        // shared lock is what keeps a host and an access off the same tunnel IP.
-        try {
-            // Filled inside the transaction; only the handoff needs it afterwards.
-        $plainConfig = null;
-
-        $peer = Cache::lock('wireguard:allocate', 30)->block(10, function () use ($hub, $publicKey, $keypair, &$plainConfig) {
-            return DB::transaction(function () use ($hub, $publicKey, $keypair, &$plainConfig) {
-                // The owner row is locked for the whole insert, and revokeStaff()
-                // locks the same row: without that, a revocation could commit
-                // between the check and the insert, find no peer to remove, and
-                // leave the revoked colleague with a brand-new tunnel.
-                $owner = User::query()->whereKey($this->ownerId)->lockForUpdate()->first();
-                if ($owner === null || ! $owner->isOperator()) {
-                    return 'owner_must_be_operator';
-                }
-
-                // Inside the lock: checking before it would let two concurrent
-                // requests both pass and the loser hit the unique index as a
-                // 500. withTrashed, because a revoked peer keeps its key until
-                // the hub confirms removal.
-                $existing = VpnPeer::withTrashed()->where('public_key', $publicKey)->first();
-                if ($existing !== null) {
-                    return $existing->trashed() ? 'pending_removal' : 'duplicate_key';
-                }
-
-                // A host's key may not have been adopted into vpn_peers yet.
-                // Re-using it would make `wg set` rewrite that host's allowed-ip
-                // to the address allocated here — cutting the management tunnel
-                // to a live machine.
-                if (Host::query()->where('wg_pubkey', $publicKey)->exists()) {
-                    return 'host_key';
-                }
-
-                $ip = $hub->allocateIp();
-
-                // Built and encrypted here so the stored config is part of the
-                // same insert. Doing it afterwards could leave a live access
-                // whose config was never stored — unrecoverable, and the
-                // operator would create a second one not knowing why.
-                $secret = null;
-                if ($keypair !== null) {
-                    $plainConfig = $this->clientConfig($keypair, $ip);
-                    if ($this->storeConfig) {
-                        $secret = ConfigVault::encrypt($plainConfig);
-                    }
-                }
-
-                return VpnPeer::create([
-                    'name' => trim($this->name),
-                    'kind' => VpnPeer::KIND_STAFF,
-                    'user_id' => $this->ownerId,
-                    'public_key' => $publicKey,
-                    'allowed_ip' => $ip,
-                    'config_secret' => $secret,
-                    'enabled' => true,
-                    'present' => false,
-                    'created_by' => auth()->id(),
-                ]);
-                });
-            });
-        } catch (QueryException) {
-            // Backstop: the unique index caught a writer that did not take this
-            // lock. Report it like any other duplicate instead of a 500.
-            $this->addError('publicKey', __('vpn.duplicate_key'));
-
-            return;
-        }
-
-        if (is_string($peer)) {
-            $field = $peer === 'owner_must_be_operator' ? 'ownerId' : 'publicKey';
-            $this->addError($field, __('vpn.'.$peer));
-
-            return;
-        }
-
-        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, true);
-
-        // Whatever was on screen belongs to the previous access. Leaving it up
-        // after creating another one would present the wrong private config
-        // under the new name — and someone would hand it out.
-        $this->dismissConfig();
-
-        // Only a key we generated can be turned into a ready-to-use config.
-        if ($plainConfig !== null) {
-            $this->configToken = ConfigHandoff::put($plainConfig);
-            $this->newConfigName = $peer->name;
-        }
-
-        $this->reset('name', 'publicKey', 'storeConfig');
-        $this->ownerId = auth()->id();
-        $this->dispatch('notify', message: __('vpn.created'));
-    }
-
-    public function toggle(string $uuid): void
-    {
-        // Looked up globally and then judged by the policy: filtering it out of
-        // the query here would turn "not allowed" into a button that silently
-        // does nothing, which is exactly how the portal used to lie to people.
-        $peer = VpnPeer::query()->where('uuid', $uuid)->first();
-        if ($peer === null) {
-            return;
-        }
-        $this->authorize('block', $peer);
-
-        $peer->update(['enabled' => ! $peer->enabled]);
-        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, $peer->enabled);
-
-        $this->dispatch('notify', message: $peer->enabled ? __('vpn.unblocked') : __('vpn.blocked'));
-    }
-
-    #[On('vpn-peer-deleted')]
-    public function peerDeleted(): void
-    {
-        $this->dispatch('notify', message: __('vpn.deleted'));
-    }
-
-    /**
-     * Replace an access's keypair.
-     *
-     * The way back for an access whose config was never stored: nobody can hand
-     * out a private key that no longer exists, so the honest option is a new
-     * one. The old key stops working the moment the hub is updated, which is
-     * also what makes this the right tool for a lost or leaked device.
-     */
-    public function reissue(string $uuid): void
-    {
-        $peer = VpnPeer::query()->where('uuid', $uuid)->first();
-        if ($peer === null) {
-            return;
-        }
-        $this->authorize('update', $peer);
-
-        if ($peer->kind !== VpnPeer::KIND_STAFF) {
-            $this->dispatch('notify', message: __('vpn.reissue_staff_only'));
-
-            return;
-        }
-
-        $keypair = Keypair::generate();
-        $oldKey = $peer->public_key;
-        $config = $this->clientConfig($keypair, $peer->allowed_ip);
-
-        $peer->forceFill([
-            'public_key' => $keypair->publicKey,
-            'present' => false,
-            // Only re-stored when the vault can actually be used: without the key
-            // this would throw, and the console tells people to re-issue
-            // precisely when a stored config has become unreadable.
-            'config_secret' => $peer->hasStoredConfig() && ConfigVault::available()
-                ? ConfigVault::encrypt($config)
-                : null,
-        ])->save();
-
-        // Old key off the hub first, then the new one on: the other order would
-        // briefly leave two peers claiming the same tunnel address.
-        ApplyVpnPeer::dispatch($oldKey, null, false, force: true);
-        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, true);
-
-        $this->dismissConfig();
-        $this->configToken = ConfigHandoff::put($config);
-        $this->newConfigName = $peer->name;
-
-        $this->dispatch('notify', message: __('vpn.reissued'));
-    }
-
-    public function dismissConfig(): void
-    {
-        ConfigHandoff::forget($this->configToken);
-        $this->reset('configToken', 'newConfigName', 'showQr');
-    }
-
-    /**
-     * The list this operator is allowed to see: their own accesses, plus
-     * everything when they hold vpn.view.all. Filtering in the query as well as
-     * in the actions, so a forged uuid cannot reach a peer the page never showed.
-     */
-    private function visiblePeers()
-    {
-        $query = VpnPeer::query();
-
-        if (! auth()->user()?->can('vpn.view.all')) {
-            $query->where('kind', VpnPeer::KIND_STAFF)->where('user_id', auth()->id());
-        }
-
-        return $query;
-    }
-
-    public function toggleQr(): void
-    {
-        $this->showQr = ! $this->showQr;
-    }
-
-    /**
-     * wg-quick takes the interface name from the filename, and Linux caps
-     * interface names at 15 characters — so the label is slugged and cut rather
-     * than handing the operator a file that fails to come up.
-     */
-    public function configFilename(): string
-    {
-        $slug = Str::slug((string) $this->newConfigName) ?: 'clupilot';
-
-        return Str::limit($slug, 15, '').'.conf';
-    }
-
-    /** Polled by the view; throttled so a room full of open tabs cannot flood the queue. */
-    public function refreshPeers(): void
-    {
-        if (Cache::add('vpn:sync-dispatched', true, 8)) {
-            SyncVpnPeers::dispatch();
-        }
-    }
-
-    /**
-     * What the client sends through the tunnel: the management subnet, and only
-     * that.
-     *
-     * It is tempting to add the server's own public address here, because the
-     * console lives at a public hostname and without that route the phone sends
-     * the request out over the mobile network instead — it arrives from a
-     * carrier address, the proxy refuses it, and the operator sees a blank page
-     * while the VPN app says "connected".
-     *
-     * That fix cannot work. The WireGuard endpoint is the SAME address. Routing
-     * it into the tunnel routes the handshake packets into the tunnel too, and
-     * a tunnel cannot carry the packets that establish it — the result is a
-     * loop and a connection that never comes up at all. Strictly worse: the
-     * same symptom, now with no way in.
-     *
-     * The console has to be reachable at an address that is INSIDE the subnet
-     * for the VPN to be the way in. That is a deployment change (the proxy
-     * answering on the hub address, and a name that resolves to it), not
-     * something this config line can express.
-     */
-    private static function allowedIps(string $endpoint): string
-    {
-        return (string) config('provisioning.wireguard.subnet', '10.66.0.0/24');
-    }
-
-    private function clientConfig(Keypair $keypair, string $ip): string
-    {
-        $hub = app(WireguardHub::class);
-
-        return implode("\n", [
-            '[Interface]',
-            'PrivateKey = '.$keypair->privateKey,
-            'Address = '.$ip.'/32',
-            // Only present when the console is actually reachable inside the
-            // tunnel. Setting it otherwise would hand the device a resolver
-            // that does not exist and take its name resolution with it.
-            ...(config('admin_access.vpn_ready')
-                ? ['DNS = '.config('provisioning.wireguard.hub_address', '10.66.0.1')]
-                : []),
-            '',
-            '[Peer]',
-            'PublicKey = '.$hub->publicKey(),
-            'Endpoint = '.$hub->endpoint(),
-            'AllowedIPs = '.self::allowedIps($hub->endpoint()),
-            'PersistentKeepalive = 25',
-            '',
-        ]);
-    }
-
-    public function render()
-    {
-        $hub = app(WireguardHub::class);
-
-        return view('livewire.admin.vpn', [
-            'newConfig' => $config = ConfigHandoff::get($this->configToken),
-            'qrSvg' => $this->showQr && $config !== null ? QrCode::svg($config) : null,
-            'peers' => $this->visiblePeers()->with(['host', 'owner'])->orderByDesc('present')->orderBy('name')->get(),
-            'operators' => User::query()
-                ->whereHas('roles', fn ($q) => $q->whereIn('name', User::OPERATOR_ROLES))
-                ->orderBy('name')->get(['id', 'name', 'email']),
-            'canManage' => auth()->user()?->can('vpn.manage.all') ?? false,
-            'vaultAvailable' => ConfigVault::available(),
-            'hubEndpoint' => $hub->endpoint(),
-            'hubPublicKey' => $hub->publicKey(),
-            'lastSync' => VpnPeer::query()->max('observed_at'),
-        ]);
-    }
-}

app/Livewire/Admin/VpnConfigAccess.php

@@ -1,133 +0,0 @@
-<?php
-
-namespace App\Livewire\Admin;
-
-use App\Models\VpnPeer;
-use App\Services\Wireguard\ConfigHandoff;
-use App\Services\Wireguard\ConfigVault;
-use App\Services\Wireguard\QrCode;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Gate;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Log;
-use Illuminate\Support\Facades\RateLimiter;
-use Illuminate\Support\Str;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Retrieving a stored VPN config again, behind the owner's own password.
- *
- * The password is asked for on EVERY retrieval, not once per session: Laravel's
- * password.confirm middleware keeps a 15-minute session stamp, which would
- * authorise unlimited later downloads from an unattended browser — not what
- * "enter your password to download it" means.
- */
-class VpnConfigAccess extends ModalComponent
-{
-    public string $uuid;
-
-    public string $name = '';
-
-    public string $password = '';
-
-    /** Opaque handle; the plaintext never enters the component snapshot. */
-    public ?string $token = null;
-
-    public bool $showQr = false;
-
-    public function mount(string $uuid): void
-    {
-        $peer = VpnPeer::query()->where('uuid', $uuid)->firstOrFail();
-        $this->authorize('downloadConfig', $peer);
-
-        $this->uuid = $uuid;
-        $this->name = $peer->name;
-    }
-
-    /**
-     * Every later request re-checks: once revealed, the plaintext sits in the
-     * handoff cache for ten minutes, and an open modal would otherwise keep
-     * handing it out after the access was revoked or reassigned — exactly the
-     * window purgeSecret() exists to close.
-     */
-    public function hydrate(): void
-    {
-        $peer = VpnPeer::withTrashed()->where('uuid', $this->uuid)->first();
-
-        if ($peer === null || Gate::denies('downloadConfig', $peer)) {
-            ConfigHandoff::forget($this->token);
-            $this->token = null;
-            abort(403);
-        }
-    }
-
-    public function reveal(): void
-    {
-        // A retry must not still be showing the previous attempt's complaint.
-        $this->resetErrorBag('password');
-
-        $peer = VpnPeer::query()->where('uuid', $this->uuid)->firstOrFail();
-        $this->authorize('downloadConfig', $peer);
-
-        // Rate-limited per user, so a stolen session cannot grind the password.
-        $key = 'vpn-config:'.auth()->id();
-        if (RateLimiter::tooManyAttempts($key, 5)) {
-            $this->addError('password', __('vpn.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]));
-
-            return;
-        }
-
-        if (! Hash::check($this->password, auth()->user()->password)) {
-            RateLimiter::hit($key, 300);
-            Log::warning('VPN config download refused: wrong password', [
-                'user_id' => auth()->id(), 'peer' => $peer->uuid,
-            ]);
-            $this->addError('password', __('vpn.wrong_password'));
-
-            return;
-        }
-
-        RateLimiter::clear($key);
-
-        $plaintext = ConfigVault::decrypt((string) $peer->config_secret);
-        if ($plaintext === null) {
-            // Wrong or rotated key, or a tampered record. Never guess.
-            $this->addError('password', __('vpn.config_unreadable'));
-
-            return;
-        }
-
-        // Counted in the database, not read-modify-written here: two concurrent
-        // retrievals would otherwise record one. This is an audit trail, so
-        // under-reporting is the one failure mode it must not have.
-        VpnPeer::query()->whereKey($peer->getKey())->update([
-            'last_downloaded_at' => now(),
-            'download_count' => DB::raw('download_count + 1'),
-        ]);
-
-        Log::info('VPN config downloaded', ['user_id' => auth()->id(), 'peer' => $peer->uuid]);
-
-        $this->reset('password');
-        $this->token = ConfigHandoff::put($plaintext);
-    }
-
-    public function toggleQr(): void
-    {
-        $this->showQr = ! $this->showQr;
-    }
-
-    public function filename(): string
-    {
-        return Str::limit(Str::slug($this->name) ?: 'clupilot', 15, '').'.conf';
-    }
-
-    public function render()
-    {
-        $config = ConfigHandoff::get($this->token);
-
-        return view('livewire.admin.vpn-config-access', [
-            'config' => $config,
-            'qrSvg' => $config !== null && $this->showQr ? QrCode::svg($config) : null,
-        ]);
-    }
-}

app/Livewire/Auth/Login.php

@@ -1,15 +0,0 @@
-<?php
-
-namespace App\Livewire\Auth;
-
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal')]
-class Login extends Component
-{
-    public function render()
-    {
-        return view('livewire.auth.login');
-    }
-}

app/Livewire/Auth/Register.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace App\Livewire\Auth;
-
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-/**
- * Full-page signup view (R1/R2). The POST is handled by Fortify's registration
- * feature (register.store → App\Actions\Fortify\CreateNewUser).
- */
-#[Layout('layouts.portal')]
-class Register extends Component
-{
-    public function render()
-    {
-        return view('livewire.auth.register');
-    }
-}

app/Livewire/Auth/TwoFactorChallenge.php

@@ -1,15 +0,0 @@
-<?php
-
-namespace App\Livewire\Auth;
-
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal')]
-class TwoFactorChallenge extends Component
-{
-    public function render()
-    {
-        return view('livewire.auth.two-factor-challenge');
-    }
-}

app/Livewire/Backups.php

@@ -1,58 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Backups extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $gb = fn (float $v) => Number::format($v, precision: 1, locale: $locale).' GB';
-        $date = fn (string $iso, string $fmt) => Carbon::parse($iso)->local()->locale($locale)->isoFormat($fmt);
-
-        // 14 days of backup sizes for the bar chart.
-        $sizes = [18.1, 18.1, 18.2, 18.2, 18.2, 18.3, 18.3, 18.3, 18.3, 18.4, 18.4, 18.3, 18.4, 18.4];
-
-        $rows = [];
-        foreach (range(0, 6) as $i) {
-            $rows[] = [
-                'when' => $date(Carbon::parse('2026-07-24')->subDays($i)->toDateString(), 'dd, D. MMMM').', 03:1'.($i % 3 + 1),
-                'size' => $gb(18.4 - $i * 0.02),
-                'status' => 'ok',
-            ];
-        }
-
-        return view('livewire.backups', [
-            'rows' => $rows,
-            'lastTest' => $date('2026-07-01', 'LL'),
-            'sizeChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => array_map(fn ($i) => $date(Carbon::parse('2026-07-24')->subDays(13 - $i)->toDateString(), 'D.'), range(0, 13)),
-                    'datasets' => [[
-                        'label' => 'GB',
-                        'data' => $sizes,
-                        'borderColor' => 'token:accent',
-                        'fill' => true,
-                        'tension' => 0.35,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['grid' => ['display' => false]],
-                        'y' => ['beginAtZero' => false, 'grid' => ['color' => 'token:border']],
-                    ],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-        ]);
-    }
-}

app/Livewire/Billing.php

@@ -1,204 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Customer;
-use App\Models\Order;
-use App\Models\Subscription;
-use App\Services\Billing\AddonCatalogue;
-use App\Services\Billing\DowngradeCheck;
-use App\Services\Billing\PlanCatalogue;
-use Illuminate\Support\Facades\DB;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Billing extends Component
-{
-    use ResolvesCustomer;
-
-    /**
-     * Record a purchase intent (order). Fulfillment (Stripe checkout + resize) is
-     * mocked for now — the order is created with status 'pending'.
-     */
-    public function purchase(string $type, ?string $key = null): void
-    {
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        $instance = $customer->instances()->latest('id')->first();
-        $currentPlan = $instance?->plan ?? 'start';
-        $plans = app(PlanCatalogue::class)->sellable();
-        $addons = (array) config('provisioning.addons');
-
-        [$plan, $amount, $addonKey] = match ($type) {
-            'upgrade', 'downgrade' => [$key, (int) ($plans[$key]['price_cents'] ?? 0), null],
-            'storage' => [$currentPlan, (int) config('provisioning.storage_addon.price_cents', 0), null],
-            'traffic' => [$currentPlan, (int) config('provisioning.traffic.addon.price_cents', 0), null],
-            'addon' => [$currentPlan, (int) ($addons[$key]['price_cents'] ?? 0), $key],
-            default => [null, 0, null],
-        };
-
-        // Guard against invalid keys / non-upgrades.
-        $valid = match ($type) {
-            // By rank, matching PlanChange and the cards on the page. Comparing
-            // prices would call a grandfathered plan an upgrade to a smaller
-            // one and charge for the privilege.
-            'upgrade' => isset($plans[$key])
-                && (int) ($plans[$key]['tier'] ?? 0) > (int) ($instance?->subscription?->tier ?? $plans[$currentPlan]['tier'] ?? 0),
-            // Re-checked here and not only in the view: the button can be
-            // hidden and the action still called — a stale tab, a second
-            // window, anyone with the component name. A limit enforced only in
-            // markup is not enforced.
-            'downgrade' => isset($plans[$key])
-                && (int) ($plans[$key]['tier'] ?? 0) < (int) ($instance?->subscription?->tier ?? $plans[$currentPlan]['tier'] ?? 0)
-                && DowngradeCheck::for($customer, $instance, $plans[$key])->allowed,
-            'storage' => true,
-            // Always available: running out of traffic is exactly when someone
-            // needs to be able to buy more, whatever plan they are on.
-            'traffic' => true,
-            'addon' => isset($addons[$key]),
-            default => false,
-        };
-        if (! $valid || $plan === null) {
-            return;
-        }
-
-        $datacenter = $instance?->host?->datacenter
-            ?? $customer->orders()->latest('id')->value('datacenter')
-            ?? 'fsn';
-
-        // A cart cannot hold two plan changes: they contradict each other and no
-        // checkout could resolve which one the customer meant. Choosing another
-        // replaces the pending one — add-ons still stack.
-        //
-        // Replacement and insert run together with the customer row locked:
-        // two clicks in flight could otherwise both delete and then both
-        // insert, leaving exactly the two upgrades this rule exists to prevent.
-        $replaced = DB::transaction(function () use ($customer, $type, $plan, $addonKey, $amount, $datacenter) {
-            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-
-            // Up and down are the same kind of change and contradict each
-            // other just as much, so either replaces a pending one of both.
-            $replaced = in_array($type, ['upgrade', 'downgrade'], true)
-                ? Order::query()
-                    ->where('customer_id', $customer->id)
-                    ->where('status', 'pending')
-                    ->whereIn('type', ['upgrade', 'downgrade'])
-                    ->delete()
-                : 0;
-
-            Order::create([
-                'customer_id' => $customer->id,
-                'plan' => $plan,
-                'type' => $type,
-                'addon_key' => $addonKey,
-                'amount_cents' => $amount,
-                'currency' => 'EUR',
-                'datacenter' => $datacenter,
-                'status' => 'pending',
-            ]);
-
-            return $replaced;
-        });
-
-        if ($replaced > 0) {
-            $this->dispatch('notify', message: __('billing.cart.plan_replaced'));
-        }
-
-        $this->dispatch('notify', message: __('billing.purchased'));
-    }
-
-    #[\Livewire\Attributes\On('order-removed')]
-    public function orderRemoved(): void
-    {
-        $this->dispatch('notify', message: __('billing.cart.removed'));
-    }
-
-    /**
-     * The terms to show as "your plan": the contract if there is one, and only
-     * otherwise the catalogue — someone browsing before they have bought.
-     *
-     * @param  array<string, mixed>  $catalogue
-     * @return array<string, mixed>
-     */
-    private function currentTerms(?Subscription $subscription, array $catalogue): array
-    {
-        if ($subscription === null) {
-            return $catalogue;
-        }
-
-        return [
-            'tier' => $subscription->tier,
-            // Per month: the card says "/ month", and a yearly contract stores
-            // the whole year.
-            'price_cents' => $subscription->monthlyPriceCents(),
-            'currency' => $subscription->currency,
-            'quota_gb' => $subscription->quota_gb,
-            'traffic_gb' => $subscription->traffic_gb,
-            'seats' => $subscription->seats,
-            'performance' => $subscription->performance,
-            'features' => $subscription->planVersion?->features ?? ($catalogue['features'] ?? []),
-        ];
-    }
-
-    public function render()
-    {
-        $customer = $this->customer();
-        $instance = $customer?->instances()->latest('id')->first();
-        $plans = app(PlanCatalogue::class)->sellable();
-        $currentKey = $instance?->plan ?? 'start';
-
-        // Rank, not price: a grandfathered plan can cost less than a smaller
-        // one does today, and offering that as an "upgrade" would charge a
-        // customer immediately for losing resources.
-        $currentTier = (int) ($instance?->subscription?->tier ?? $plans[$currentKey]['tier'] ?? 0);
-
-        // Smaller plans, each with the reason it cannot be taken today. Shown
-        // WITH the reason rather than hidden: a customer who cannot downgrade
-        // needs to know what to delete, and a plan that silently disappears
-        // reads as "not offered any more".
-        $downgrades = collect($plans)
-            ->filter(fn ($p) => (int) ($p['tier'] ?? 0) < $currentTier)
-            ->sortByDesc(fn ($p) => (int) ($p['tier'] ?? 0))
-            ->map(fn ($p, $k) => $p + ['check' => DowngradeCheck::for($customer, $instance, $p)])
-            ->all();
-
-        $upgrades = collect($plans)
-            ->filter(fn ($p) => (int) ($p['tier'] ?? 0) > $currentTier)
-            ->keys()->all();
-
-        return view('livewire.billing', [
-            'currentKey' => $currentKey,
-            // What they HAVE comes from their contract; only what they could
-            // BUY comes from the shop. Reading this off the catalogue showed a
-            // customer today's price as though it were theirs, and dropped the
-            // card entirely once their plan stopped being sold.
-            'current' => $this->currentTerms($instance?->subscription, $plans[$currentKey] ?? []),
-            'instance' => $instance,
-            'plans' => $plans,
-            'features' => collect($plans)->map(fn ($p) => $p['features'] ?? [])->all(),
-            'upgrades' => $upgrades,
-            'downgrades' => $downgrades,
-            'storage' => (array) config('provisioning.storage_addon'),
-            'trafficAddon' => (array) config('provisioning.traffic.addon'),
-            // Resolved once: the cart and the plan cards must not state
-            // different tax treatments on the same page.
-            'tax' => \App\Services\Billing\TaxTreatment::for($customer),
-            'trafficMeter' => $instance !== null ? \App\Services\Traffic\TrafficMeter::for($instance) : null,
-            // Booked modules at the price they were booked at; everything else
-            // at today's. Reading them all off the catalogue would re-price
-            // half a customer's bill behind their back.
-            'addons' => collect(app(AddonCatalogue::class)->forSubscription($instance?->subscription))
-                ->except(AddonCatalogue::STORAGE)
-                ->all(),
-            'totalMonthlyCents' => $instance?->subscription?->totalMonthlyCents(),
-            'pending' => $customer
-                ? $customer->orders()->where('status', 'pending')->latest('id')->get()
-                : collect(),
-        ]);
-    }
-}

app/Livewire/Cloud.php

@@ -1,89 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\MaintenanceWindow;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Cloud extends Component
-{
-    use ResolvesCustomer;
-
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $growth = [180, 188, 195, 199, 204, 210, 214, 219, 223, 228, 231, 235];
-
-        // The card is built from the customer's real service instance, so the
-        // maintenance badge below can be scoped to exactly that instance's host.
-        $customer = $this->customer();
-        $shown = $customer?->instances()
-            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
-            ->latest('id')->first();
-        $maintenance = MaintenanceWindow::forInstance($shown)->first();
-
-        // The instance carries what was actually provisioned, and the contract
-        // what was bought. Neither is the catalogue, which only describes what
-        // we would sell someone new — never what this customer already has.
-        $contract = $shown?->subscription;
-        $planKey = $shown?->plan ?? 'team';
-        $quota = (int) ($shown?->quota_gb ?? $contract?->quota_gb ?? 500);
-        // Usage metering is not wired yet — scale the illustrative curve into the
-        // instance's quota so the chart and the "x / y GB" label never disagree.
-        $curveMax = max($growth);
-        if ($curveMax > $quota) {
-            $growth = array_map(fn ($v) => (int) round($v / $curveMax * $quota), $growth);
-        }
-        $used = $growth[count($growth) - 1];
-        $domain = $shown?->custom_domain
-            ?: ($shown?->subdomain ? $shown->subdomain.'.'.config('provisioning.dns.zone', 'clupilot.com') : 'cloud.example.com');
-
-        return view('livewire.cloud', [
-            'instance' => [
-                'name' => $customer ? __('cloud.instance_name', ['name' => $customer->name]) : __('cloud.title'),
-                'domain' => $domain,
-                'status' => $shown->status ?? 'active',
-                'plan' => __('cloud.plan_line', [
-                    'plan' => 'CluPilot Cloud '.__('billing.plan.'.$planKey),
-                    // The line ends in "/mo", so a yearly contract has to be
-                    // divided down before it goes in.
-                    'price' => (int) round(($contract?->monthlyPriceCents() ?? 0) / 100),
-                ]),
-                'location' => __('cloud.datacenter'),
-                'storageUsed' => $used,
-                'storageQuota' => $quota,
-                'seats' => __('billing.seats_count', ['count' => $contract?->seats ?? 0]),
-                'performance' => __('billing.perf.'.($contract?->performance ?? 'standard')),
-            ],
-            'storageChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => ['', '', '', '', '', '', '', '', '', '', '', __('cloud.now')],
-                    'datasets' => [[
-                        'label' => 'GB',
-                        'data' => $growth,
-                        'borderColor' => 'token:accent',
-                        'backgroundColor' => 'token:accent/0.10',
-                        'fill' => true,
-                        'tension' => 0.35,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['grid' => ['display' => false]],
-                        'y' => ['beginAtZero' => false, 'grid' => ['color' => 'token:border']],
-                    ],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-            'storageLabel' => Number::format($used, locale: $locale).' / '.Number::format($quota, locale: $locale).' GB',
-            'maintenance' => $maintenance,
-        ]);
-    }
-}

app/Livewire/Concerns/BuildsRunSteps.php

@@ -1,56 +0,0 @@
-<?php
-
-namespace App\Livewire\Concerns;
-
-use App\Models\ProvisioningRun;
-
-/**
- * Builds the {label, state} array a progress stepper renders from a run's
- * pipeline + current step + status. Shared by admin and customer views.
- */
-trait BuildsRunSteps
-{
-    /** @return array<int, array{label: string, state: string}> */
-    protected function buildRunSteps(?ProvisioningRun $run): array
-    {
-        if ($run === null) {
-            return [];
-        }
-
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $current = $run->current_step;
-        $status = $run->status;
-
-        $steps = [];
-        foreach ($pipeline as $index => $class) {
-            if ($status === ProvisioningRun::STATUS_COMPLETED || $index < $current) {
-                $state = 'done';
-            } elseif ($index === $current) {
-                $state = $status === ProvisioningRun::STATUS_FAILED ? 'failed' : 'running';
-            } else {
-                $state = 'pending';
-            }
-
-            $steps[] = ['label' => __(app($class)->label()), 'state' => $state];
-        }
-
-        return $steps;
-    }
-
-    protected function currentStepLabel(ProvisioningRun $run): string
-    {
-        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
-        $class = $pipeline[$run->current_step] ?? null;
-
-        return $class ? __(app($class)->label()) : '—';
-    }
-
-    protected function runState(ProvisioningRun $run): string
-    {
-        return match ($run->status) {
-            ProvisioningRun::STATUS_COMPLETED => 'done',
-            ProvisioningRun::STATUS_FAILED => 'failed',
-            default => 'running',
-        };
-    }
-}

app/Livewire/Concerns/ChangesOwnPassword.php

@@ -1,67 +0,0 @@
-<?php
-
-namespace App\Livewire\Concerns;
-
-use App\Actions\Fortify\UpdateUserPassword;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Validation\ValidationException;
-
-/**
- * Changing your own password, from wherever you are signed in.
- *
- * There was no way to do it at all: Fortify's updatePasswords feature was off,
- * so an account created with a generated password kept it until someone opened
- * a shell on the server. Shared by the console and the customer portal because
- * the rules are the same in both, and having two copies of a password rule is
- * how one of them ends up weaker.
- *
- * Goes through Fortify's own action rather than hashing here, so the password
- * rules stay in the single place that already defines them.
- */
-trait ChangesOwnPassword
-{
-    public string $currentPassword = '';
-
-    public string $newPassword = '';
-
-    public string $newPasswordConfirmation = '';
-
-    public function updateOwnPassword(): void
-    {
-        // The current password is asked for, and checked here as well as in the
-        // action: an attacker on an unlocked machine should not be able to lock
-        // the owner out of their own account with two keystrokes.
-        $this->validate([
-            'currentPassword' => 'required|string',
-            'newPassword' => 'required|string',
-            'newPasswordConfirmation' => 'required|string',
-        ]);
-
-        if (! Hash::check($this->currentPassword, auth()->user()->password)) {
-            $this->addError('currentPassword', __('admin_settings.password_wrong'));
-
-            return;
-        }
-
-        try {
-            app(UpdateUserPassword::class)->update(auth()->user(), [
-                'current_password' => $this->currentPassword,
-                'password' => $this->newPassword,
-                'password_confirmation' => $this->newPasswordConfirmation,
-            ]);
-        } catch (ValidationException $e) {
-            foreach ($e->errors() as $field => $messages) {
-                $this->addError(match ($field) {
-                    'current_password' => 'currentPassword',
-                    'password' => 'newPassword',
-                    default => $field,
-                }, $messages[0]);
-            }
-
-            return;
-        }
-
-        $this->reset('currentPassword', 'newPassword', 'newPasswordConfirmation');
-        $this->dispatch('notify', message: __('admin_settings.password_changed'));
-    }
-}

app/Livewire/Concerns/ConfirmsPassword.php

@@ -1,94 +0,0 @@
-<?php
-
-namespace App\Livewire\Concerns;
-
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\RateLimiter;
-use Illuminate\Support\Str;
-
-/**
- * A password re-entry gate in front of the dangerous parts of a page.
- *
- * Used by anything where holding a signed-in session should not be enough on
- * its own: setting up two-factor authentication, and reading or changing stored
- * credentials. The threat is not a stranger — it is a colleague, or anyone, at
- * an unlocked machine.
- *
- * Stored in the SAME session key Laravel's own `password.confirm` middleware
- * uses, so a confirmation made here also satisfies any framework route behind
- * that middleware, and vice versa. Reinventing the marker would have produced
- * two independent notions of "recently confirmed", one of which would drift.
- *
- * Rate-limited, because a confirmation form is a password oracle: without a
- * limit it is an unauthenticated-feeling place to guess at a known account.
- */
-trait ConfirmsPassword
-{
-    public string $confirmablePassword = '';
-
-    /** How long one confirmation lasts. Laravel's own default. */
-    protected function confirmationWindow(): int
-    {
-        return (int) config('auth.password_timeout', 10800);
-    }
-
-    public function passwordRecentlyConfirmed(): bool
-    {
-        $at = (int) session('auth.password_confirmed_at', 0);
-
-        return $at > 0 && (time() - $at) < $this->confirmationWindow();
-    }
-
-    public function confirmPassword(): void
-    {
-        $key = 'confirm-password:'.auth()->id().'|'.request()->ip();
-
-        if (RateLimiter::tooManyAttempts($key, 5)) {
-            $this->addError('confirmablePassword', __('auth.throttle', [
-                'seconds' => RateLimiter::availableIn($key),
-            ]));
-
-            return;
-        }
-
-        if (! Hash::check($this->confirmablePassword, auth()->user()->password)) {
-            RateLimiter::hit($key, 60);
-            $this->addError('confirmablePassword', __('admin_settings.password_wrong'));
-            $this->reset('confirmablePassword');
-
-            return;
-        }
-
-        RateLimiter::clear($key);
-        $this->reset('confirmablePassword');
-
-        // Regenerated first: a confirmation raises what this session can do, and
-        // a session id that was already known to someone else must not be the
-        // one that gets the extra authority.
-        session()->regenerate();
-        session(['auth.password_confirmed_at' => time()]);
-    }
-
-    /** Give up the confirmation early — leaving a page should not keep it open. */
-    public function forgetPasswordConfirmation(): void
-    {
-        session()->forget('auth.password_confirmed_at');
-    }
-
-    /**
-     * A value shown only in outline: the last four characters, and nothing else.
-     *
-     * Enough to tell two keys apart, useless to anyone reading over a shoulder
-     * or scrolling back through a screen recording.
-     */
-    protected function outline(?string $value, int $keep = 4): ?string
-    {
-        if ($value === null || $value === '') {
-            return null;
-        }
-
-        return Str::length($value) <= $keep
-            ? str_repeat('•', Str::length($value))
-            : str_repeat('•', 8).Str::substr($value, -$keep);
-    }
-}

app/Livewire/Concerns/ResolvesCustomer.php

@@ -1,39 +0,0 @@
-<?php
-
-namespace App\Livewire\Concerns;
-
-use App\Models\Customer;
-
-/**
- * Resolves the customer behind the signed-in portal user.
- *
- * Operator accounts (admins) have no Customer, so customer-scoped actions must
- * NOT silently no-op — that reads as a dead button. requireCustomer() surfaces
- * an explicit message instead and returns null so the caller can bail.
- */
-trait ResolvesCustomer
-{
-    protected function customer(): ?Customer
-    {
-        $user = auth()->user();
-        if (! $user) {
-            return null;
-        }
-
-        // Prefer the explicit link; fall back to email for legacy unlinked accounts.
-        return Customer::query()->where('user_id', $user->id)->first()
-            ?? Customer::query()->where('email', $user->email)->first();
-    }
-
-    /** Same as customer(), but tells the user why nothing happened. */
-    protected function requireCustomer(): ?Customer
-    {
-        $customer = $this->customer();
-
-        if ($customer === null) {
-            $this->dispatch('notify', message: __('dashboard.no_customer_action'));
-        }
-
-        return $customer;
-    }
-}

app/Livewire/ConfirmCancelPackage.php

@@ -1,78 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Instance;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Cancel the customer's package (R5). Per the founder's decision: effective at
- * the end of the billing term, irreversible once confirmed; at term end the
- * customer receives a finished data export, then the instance is deprovisioned
- * (both mocked for now). Requires typing the instance subdomain to confirm.
- */
-class ConfirmCancelPackage extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $confirmName = '';
-
-    public function cancelPackage()
-    {
-        $customer = $this->customer();
-        // Target the ACTIVE package explicitly — a newer failed/deprovisioned
-        // record must not shadow an older active instance (v1: one active/customer).
-        $instance = $customer?->instances()->where('status', 'active')->latest('id')->first();
-
-        if ($instance === null) {
-            // Explain rather than silently closing: no customer behind this login
-            // (e.g. an operator account) or no active package to cancel.
-            $this->addError('confirmName', __($customer === null ? 'dashboard.no_customer_action' : 'settings.no_package'));
-
-            return null;
-        }
-
-        // Typed confirmation must match the instance subdomain.
-        if (trim($this->confirmName) !== (string) $instance->subdomain) {
-            $this->addError('confirmName', __('settings.cancel_mismatch'));
-
-            return;
-        }
-
-        $instance->update([
-            'status' => 'cancellation_scheduled',
-            'cancel_requested_at' => now(),
-            'service_ends_at' => $this->currentPeriodEnd($instance),
-        ]);
-
-        return $this->redirectRoute('settings', navigate: true);
-    }
-
-    /**
-     * End of the current monthly billing period, anchored on the subscription
-     * start (the order date) rather than assuming calendar-month billing.
-     */
-    private function currentPeriodEnd(Instance $instance): \Illuminate\Support\Carbon
-    {
-        $start = $instance->order?->created_at ?? $instance->created_at ?? now();
-
-        // Always add from the immutable start so the billing-day anchor is kept
-        // (chaining addMonth would drift a Jan-31 start to Feb-28 → Mar-28).
-        $months = 1;
-        while ($start->copy()->addMonthsNoOverflow($months)->lessThanOrEqualTo(now())) {
-            $months++;
-        }
-
-        return $start->copy()->addMonthsNoOverflow($months);
-    }
-
-    public function render()
-    {
-        $instance = $this->customer()?->instances()->where('status', 'active')->latest('id')->first();
-
-        return view('livewire.confirm-cancel-package', [
-            'subdomain' => $instance?->subdomain ?? '',
-        ]);
-    }
-}

app/Livewire/ConfirmCloseAccount.php

@@ -1,65 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Customer;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Close the whole CluPilot account (R5). Guarded: only allowed when no active
- * package remains — an active subscription must be cancelled first. Sets
- * closed_at; financial records are retained. Requires typing "LOESCHEN".
- */
-class ConfirmCloseAccount extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $confirmWord = '';
-
-    public function closeAccount()
-    {
-        $customer = $this->customer();
-        // No customer behind this login (e.g. an operator account) — say so
-        // instead of leaving the button looking broken.
-        if ($customer === null) {
-            $this->addError('confirmWord', __('dashboard.no_customer_action'));
-
-            return null;
-        }
-
-        if ($this->hasActivePackage($customer)) {
-            $this->addError('confirmWord', __('settings.close_blocked'));
-
-            return;
-        }
-
-        if (mb_strtoupper(trim($this->confirmWord)) !== __('settings.close_keyword')) {
-            $this->addError('confirmWord', __('settings.close_mismatch'));
-
-            return;
-        }
-
-        $customer->update(['closed_at' => now(), 'status' => 'closed']);
-
-        return $this->redirectRoute('settings', navigate: true);
-    }
-
-    private function hasActivePackage(Customer $customer): bool
-    {
-        // Only genuinely-live packages block closure — a failed/cancelled/
-        // deprovisioned instance does not retain a service.
-        return $customer->instances()
-            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
-            ->exists();
-    }
-
-    public function render()
-    {
-        $customer = $this->customer();
-
-        return view('livewire.confirm-close-account', [
-            'blocked' => $customer !== null && $this->hasActivePackage($customer),
-        ]);
-    }
-}

app/Livewire/ConfirmRemoveOrder.php

@@ -1,73 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Order;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Taking a not-yet-paid purchase back out of the cart.
- *
- * Scoped to the signed-in customer's own orders: modals are reachable without
- * the page's own guards, so the ownership check belongs here, not in the view
- * that happens to link to it.
- */
-class ConfirmRemoveOrder extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $uuid;
-
-    public string $label = '';
-
-    public int $amountCents = 0;
-
-    public function mount(string $uuid): void
-    {
-        $order = $this->order($uuid);
-        abort_if($order === null, 404);
-
-        $this->uuid = $uuid;
-        $this->label = $order->label();
-        $this->amountCents = $order->amount_cents;
-    }
-
-    public function remove(): void
-    {
-        $order = $this->order($this->uuid);
-
-        // Gone or already paid for: say so instead of pretending it worked.
-        if ($order === null) {
-            $this->dispatch('notify', message: __('billing.cart.gone'));
-            $this->closeModal();
-
-            return;
-        }
-
-        $order->delete();
-
-        $this->dispatch('order-removed');
-        $this->closeModal();
-    }
-
-    /** @return Order|null the customer's own, still-pending order */
-    private function order(string $uuid): ?Order
-    {
-        $customer = $this->customer();
-        if ($customer === null) {
-            return null;
-        }
-
-        return Order::query()
-            ->where('customer_id', $customer->id)
-            ->where('uuid', $uuid)
-            ->where('status', 'pending')
-            ->first();
-    }
-
-    public function render()
-    {
-        return view('livewire.confirm-remove-order');
-    }
-}

app/Livewire/CustomerProvisioning.php

@@ -1,59 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\BuildsRunSteps;
-use App\Models\Customer;
-use App\Models\Order;
-use App\Models\ProvisioningRun;
-use Livewire\Component;
-
-/**
- * Embedded live provisioning progress for the logged-in customer's order.
- * Polls only itself so the dashboard's charts don't churn. Renders nothing once
- * provisioning has completed.
- */
-class CustomerProvisioning extends Component
-{
-    use BuildsRunSteps;
-
-    private function currentRun(): ?ProvisioningRun
-    {
-        $user = auth()->user();
-        if ($user === null) {
-            return null;
-        }
-
-        $customer = Customer::query()->where('email', $user->email)->first();
-        if ($customer === null) {
-            return null;
-        }
-
-        return ProvisioningRun::query()
-            ->where('subject_type', Order::class)
-            ->whereIn('subject_id', $customer->orders()->select('id'))
-            ->latest('id')
-            ->first();
-    }
-
-    public function render()
-    {
-        $run = $this->currentRun();
-
-        // Show the card while provisioning is in flight OR terminally failed; but
-        // only POLL while it can still change (terminal failed must not poll forever).
-        $show = $run !== null && $run->status !== ProvisioningRun::STATUS_COMPLETED;
-        $polling = $run !== null && in_array($run->status, [
-            ProvisioningRun::STATUS_PENDING,
-            ProvisioningRun::STATUS_RUNNING,
-            ProvisioningRun::STATUS_WAITING,
-        ], true);
-
-        return view('livewire.customer-provisioning', [
-            'active' => $show,
-            'polling' => $polling,
-            'failed' => $run?->status === ProvisioningRun::STATUS_FAILED,
-            'steps' => $show ? $this->buildRunSteps($run) : [],
-        ]);
-    }
-}

app/Livewire/Dashboard.php

@@ -1,320 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Customer;
-use App\Models\Datacenter;
-use App\Models\Instance;
-use App\Models\InstanceMetric;
-use App\Models\MaintenanceWindow;
-use App\Models\Seat;
-use App\Models\Subscription;
-use App\Services\Traffic\TrafficMeter;
-use Illuminate\Support\Carbon;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-/**
- * The customer's Betriebsblatt: what they have, and the evidence that it is
- * being looked after.
- *
- * Every figure on this page comes from a record. Where something is not
- * measured yet — storage consumption, restore tests — the page says nothing
- * rather than showing a plausible number: this is the sheet a customer forwards
- * to their auditor, and one invented line on it is worse than a short register.
- */
-#[Layout('layouts.portal-app')]
-class Dashboard extends Component
-{
-    use ResolvesCustomer;
-
-    public function render()
-    {
-        $customer = $this->customer();
-
-        // The instance that is actually in service. A cancelled one still has
-        // rows, and would otherwise keep filling this page after it is gone.
-        $instance = $customer?->instances()
-            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
-            ->latest('id')
-            ->first();
-
-        $contract = $instance?->subscription;
-        $maintenance = MaintenanceWindow::forInstance($instance)->first();
-
-        return view('livewire.dashboard', [
-            'customer' => $customer,
-            'instance' => $instance,
-            'contract' => $contract,
-            'domain' => $this->domain($instance),
-            'location' => $this->location($instance),
-            'seats' => $this->seats($customer, $contract),
-            'traffic' => $instance !== null ? TrafficMeter::for($instance) : null,
-            // The measured series behind the template's ring and trend. Null
-            // where nothing has been sampled yet — a new instance has no
-            // fortnight, and drawing one at zero would tell its owner their
-            // data had vanished.
-            'disk' => $instance !== null ? $this->disk($instance) : null,
-            'availability' => $instance !== null ? InstanceMetric::availability($instance) : null,
-            'availabilityTrend' => $instance !== null ? InstanceMetric::availabilitySeries($instance) : [],
-            'seatBreakdown' => $this->seatBreakdown($customer),
-            'trend' => $instance !== null
-                ? InstanceMetric::series($instance)->map(fn (InstanceMetric $m) => $m->rx_bytes + $m->tx_bytes)->all()
-                : [],
-            'proofs' => $this->proofs($instance, $maintenance),
-            'openTasks' => $instance?->onboardingTasks()->where('done', false)->count() ?? 0,
-            // What the plan costs is true whether or not another invoice is
-            // coming — a customer who has given notice still pays until the
-            // term ends and still needs the figure on their master record.
-            'planPrice' => $contract === null ? null : [
-                'cents' => (int) $contract->price_cents,
-                'currency' => (string) ($contract->currency ?: 'EUR'),
-                'term' => (string) $contract->term,
-            ],
-            'nextInvoice' => $this->nextInvoice($contract, $instance),
-            'asOf' => Carbon::now(),
-        ]);
-    }
-
-    /**
-     * Who holds the seats, so the card can say something true underneath the
-     * figure rather than repeating it.
-     *
-     * @return array<string, int> role => count, roles with nobody omitted
-     */
-    private function seatBreakdown(?Customer $customer): array
-    {
-        if ($customer === null) {
-            return [];
-        }
-
-        return Seat::query()
-            ->where('customer_id', $customer->id)
-            ->whereIn('status', ['active', 'invited'])
-            ->selectRaw('role, COUNT(*) as n')
-            ->groupBy('role')
-            ->pluck('n', 'role')
-            ->filter()
-            ->all();
-    }
-
-    /**
-     * How full the instance is, as measured — not as sold.
-     *
-     * Null until the sampler has managed a reading. The card then states the
-     * contractual allowance, which is true, rather than a ring at a level
-     * nobody measured.
-     *
-     * @return array{used: int, total: int, percent: float, week_delta: int|null}|null
-     */
-    private function disk(Instance $instance): ?array
-    {
-        $metric = InstanceMetric::latestDisk($instance);
-
-        if ($metric === null || ! $metric->disk_total_bytes) {
-            return null;
-        }
-
-        // What it grew by this week, which is the line the template carries
-        // under the ring. Null when there is no reading a week back to compare
-        // against — an instance three days old has no weekly trend, and
-        // inventing "+0 GB" would read as "nothing happened".
-        $weekAgo = InstanceMetric::query()
-            ->where('instance_id', $instance->id)
-            ->whereNotNull('disk_used_bytes')
-            ->where('day', '<=', now()->subDays(7)->toDateString())
-            ->orderByDesc('day')
-            ->first();
-
-        return [
-            'used' => $metric->disk_used_bytes,
-            'total' => $metric->disk_total_bytes,
-            'percent' => round($metric->disk_used_bytes / max(1, $metric->disk_total_bytes) * 100, 1),
-            'week_delta' => $weekAgo !== null ? $metric->disk_used_bytes - $weekAgo->disk_used_bytes : null,
-        ];
-    }
-
-    /** The address the customer actually reaches their cloud at. */
-    private function domain(?Instance $instance): ?string
-    {
-        if ($instance === null) {
-            return null;
-        }
-
-        return $instance->custom_domain
-            ?: ($instance->subdomain
-                ? $instance->subdomain.'.'.config('provisioning.dns.zone', 'clupilot.com')
-                : null);
-    }
-
-    /**
-     * Where the data physically sits.
-     *
-     * Named from the datacenter register rather than from a translation string,
-     * because this is the line a customer copies into a processing record — it
-     * has to be the place their instance really runs on, not the place we
-     * usually sell.
-     *
-     * @return array{name: string, note: null}|null
-     */
-    private function location(?Instance $instance): ?array
-    {
-        $code = $instance?->host?->datacenter;
-
-        if ($code === null || $code === '') {
-            return null;
-        }
-
-        $datacenter = Datacenter::query()->where('code', $code)->first();
-
-        // The country, not the site. "Falkenstein" is how an operator places an
-        // instance; a customer's processing record says which jurisdiction the
-        // data sits in, and naming the building means editing customer-facing
-        // copy every time the estate grows.
-        return [
-            'name' => $datacenter?->location ?: $code,
-            'note' => null,
-        ];
-    }
-
-    /**
-     * Seats in use against seats bought.
-     *
-     * Invited seats count as used: the licence is committed the moment the
-     * invitation goes out, and showing them as free is how a customer finds out
-     * at the worst moment that they cannot add the person in front of them.
-     *
-     * @return array{used: int, total: int|null}
-     */
-    private function seats(?Customer $customer, ?Subscription $contract): array
-    {
-        return [
-            'used' => $customer === null ? 0 : Seat::query()
-                ->where('customer_id', $customer->id)
-                ->whereIn('status', ['active', 'invited'])
-                ->count(),
-            'total' => $contract?->seats,
-        ];
-    }
-
-    /**
-     * The proof register — what was done for this customer, and when.
-     *
-     * Only entries backed by a record. A row here is something the customer can
-     * be asked to evidence, so "we back up nightly" is not one; "the last backup
-     * completed at 03:12 and reported ok" is.
-     *
-     * @return array<int, array{key: string, at: \Illuminate\Support\Carbon|null, state: string, note: string|null}>
-     */
-    private function proofs(?Instance $instance, ?MaintenanceWindow $maintenance): array
-    {
-        if ($instance === null) {
-            return [];
-        }
-
-        $proofs = [];
-
-        // A failing job outranks a succeeding one, whatever their dates.
-        //
-        // Ordering by last_ok_at alone hides exactly the case this register
-        // exists for: last night's job failed and so has no success time at
-        // all, an older row that DID succeed sorts above it, and the sheet
-        // reports backups as fine. On the page a customer shows their auditor,
-        // a problem has to beat a date.
-        $backups = $instance->backups()->get();
-        $backup = $backups->first(fn ($b) => $b->status !== 'ok')
-            ?? $backups->sortByDesc('last_ok_at')->first();
-
-        if ($backup !== null) {
-            $proofs[] = [
-                'key' => 'backup',
-                'at' => $backup->last_ok_at,
-                // The job's own verdict, not "there is a row, so it worked".
-                'state' => $backup->status === 'ok' ? 'ok' : 'attention',
-                'note' => $backup->schedule,
-            ];
-        }
-
-        // A certificate that stopped renewing is the failure a customer meets as
-        // "my browser says my own cloud is unsafe", so it is stated either way.
-        $proofs[] = [
-            'key' => 'certificate',
-            'at' => null,
-            'state' => $instance->cert_ok ? 'ok' : 'attention',
-            'note' => null,
-        ];
-
-        if ($maintenance !== null) {
-            $proofs[] = [
-                'key' => 'maintenance',
-                'at' => $maintenance->starts_at,
-                'state' => 'planned',
-                'note' => $maintenance->title,
-            ];
-        }
-
-        if ($instance->service_ends_at !== null) {
-            $proofs[] = [
-                'key' => 'service_ends',
-                'at' => $instance->service_ends_at,
-                'state' => 'attention',
-                'note' => null,
-            ];
-        }
-
-        // Newest first, but an entry with no time of its own — the certificate —
-        // stays at the top rather than sinking to the bottom of the register.
-        usort($proofs, fn (array $a, array $b) => ($b['at']?->timestamp ?? PHP_INT_MAX) <=> ($a['at']?->timestamp ?? PHP_INT_MAX));
-
-        return $proofs;
-    }
-
-    /**
-     * What is owed next, from the contract rather than from a price list.
-     *
-     * The plan and the modules are kept apart. A customer with modules booked
-     * would otherwise read the plan's price as their bill and be short every
-     * month — and putting the combined figure next to the word "Paket" on the
-     * master record would be just as wrong in the other direction.
-     *
-     * Add-ons carry a MONTHLY price (SubscriptionAddon::monthlyCents), while the
-     * plan's price_cents is the price of a whole term. On a yearly contract the
-     * modules therefore multiply by twelve to land on the same invoice.
-     *
-     * Nothing at all once the customer has given notice. Cancelling leaves the
-     * subscription `active` until the term runs out — that is deliberate, the
-     * service keeps running — but `current_period_end` is then the day service
-     * ENDS, not the day the next charge falls. Billing a customer, on the sheet
-     * they check their invoices against, for a renewal that will never happen is
-     * the worst single line this page could carry. The end date is still stated;
-     * it is in the proof register as "contract ends".
-     *
-     * @return array{plan: int, addons: int, total: int, currency: string, due: \Illuminate\Support\Carbon|null, term: string}|null
-     */
-    private function nextInvoice(?Subscription $contract, ?Instance $instance): ?array
-    {
-        if ($contract === null || $contract->status === 'cancelled') {
-            return null;
-        }
-
-        if ($instance?->cancel_requested_at !== null || $instance?->service_ends_at !== null) {
-            return null;
-        }
-
-        $months = $contract->isYearly() ? 12 : 1;
-
-        $addons = $contract->addons
-            ->whereNull('cancelled_at')
-            ->sum(fn ($addon) => $addon->monthlyCents()) * $months;
-
-        return [
-            'plan' => (int) $contract->price_cents,
-            'addons' => (int) $addons,
-            'total' => (int) $contract->price_cents + (int) $addons,
-            'currency' => (string) ($contract->currency ?: 'EUR'),
-            'due' => $contract->current_period_end,
-            'term' => (string) $contract->term,
-        ];
-    }
-}

app/Livewire/EditSeat.php

@@ -1,108 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Seat;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Edit one seat, in a modal.
- *
- * Editing used to happen in the row itself. It worked and it looked wrong: the
- * row grew, the columns beside it jumped, and a table half in edit mode reads
- * as a rendering fault rather than as a form. Anything with fields of its own
- * gets a modal — see R20.
- *
- * A modal is reachable without passing the page's route middleware, so the
- * customer is resolved here rather than trusted from the caller: the uuid comes
- * from the browser and must never reach across customers.
- */
-class EditSeat extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $uuid = '';
-
-    public string $name = '';
-
-    public string $email = '';
-
-    /** Owners cannot be suspended or removed; everyone can be renamed. */
-    public bool $isOwner = false;
-
-    /**
-     * Whether the address may still be corrected.
-     *
-     * Only while the invitation is in flight. Once someone has accepted, the
-     * address IS the person: editing it would hand one employee's access to
-     * another with nobody told — a transfer of access wearing the clothes of a
-     * rename.
-     */
-    public bool $addressEditable = false;
-
-    public function mount(string $uuid): void
-    {
-        $seat = $this->seat($uuid);
-
-        abort_if($seat === null, 404);
-
-        $this->uuid = $uuid;
-        $this->name = (string) $seat->name;
-        $this->email = (string) $seat->email;
-        $this->isOwner = $seat->role === 'owner';
-        $this->addressEditable = $seat->status === 'invited';
-    }
-
-    public function save()
-    {
-        $customer = $this->requireCustomer();
-        $seat = $this->seat($this->uuid);
-
-        if ($customer === null || $seat === null) {
-            return $this->closeModal();
-        }
-
-        $rules = ['name' => 'nullable|string|max:255'];
-
-        // Re-read from the record, never from the hydrated property: a forged
-        // addressEditable would otherwise open the address of an accepted seat.
-        if ($seat->status === 'invited') {
-            $rules['email'] = 'required|email|max:255';
-        }
-
-        $data = $this->validate($rules);
-
-        $changes = ['name' => trim($data['name'] ?? '') ?: null];
-
-        if ($seat->status === 'invited') {
-            $address = trim($data['email']);
-
-            if ($address !== $seat->email) {
-                if ($customer->seats()->where('email', $address)->whereKeyNot($seat->id)->exists()) {
-                    $this->addError('email', __('users.duplicate'));
-
-                    return null;
-                }
-
-                $changes['email'] = $address;
-            }
-        }
-
-        $seat->update($changes);
-
-        $this->dispatch('notify', message: __('users.saved'));
-
-        return $this->redirectRoute('users', navigate: true);
-    }
-
-    private function seat(string $uuid): ?Seat
-    {
-        return $this->customer()?->seats()->where('uuid', $uuid)->first();
-    }
-
-    public function render()
-    {
-        return view('livewire.edit-seat');
-    }
-}

app/Livewire/Invoices.php

@@ -1,58 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Number;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Invoices extends Component
-{
-    public function render()
-    {
-        $locale = app()->getLocale();
-        $eur = fn (float $v) => Number::currency($v, in: 'EUR', locale: $locale);
-        $date = fn (string $iso) => Carbon::parse($iso)->local()->locale($locale)->isoFormat('LL');
-
-        $months = collect(['2026-03-01', '2026-04-01', '2026-05-01', '2026-06-01', '2026-07-01'])
-            ->map(fn ($m) => Carbon::parse($m)->local()->locale($locale)->isoFormat('MMM'))->all();
-
-        $rows = [
-            ['no' => 'CP-2026-0007', 'date' => $date('2026-07-01'), 'amount' => $eur(198), 'status' => 'paid'],
-            ['no' => 'CP-2026-0006', 'date' => $date('2026-06-01'), 'amount' => $eur(198), 'status' => 'paid'],
-            ['no' => 'CP-2026-0005', 'date' => $date('2026-05-01'), 'amount' => $eur(198), 'status' => 'paid'],
-            ['no' => 'CP-2026-0004', 'date' => $date('2026-04-01'), 'amount' => $eur(179), 'status' => 'paid'],
-            ['no' => 'CP-2026-0003', 'date' => $date('2026-03-15'), 'amount' => $eur(179), 'status' => 'paid'],
-        ];
-
-        return view('livewire.invoices', [
-            'rows' => $rows,
-            'nextCharge' => $date('2026-08-01'),
-            'nextAmount' => $eur(198),
-            'spendChart' => [
-                'type' => 'line',
-                'data' => [
-                    'labels' => $months,
-                    'datasets' => [[
-                        'label' => 'EUR',
-                        'data' => [179, 179, 198, 198, 198],
-                        'borderColor' => 'token:accent',
-                        'fill' => true,
-                        'tension' => 0.35,
-                        'pointRadius' => 0,
-                        'borderWidth' => 2,
-                    ]],
-                ],
-                'options' => [
-                    'scales' => [
-                        'x' => ['grid' => ['display' => false]],
-                        'y' => ['beginAtZero' => true, 'grid' => ['color' => 'token:border']],
-                    ],
-                    'plugins' => ['legend' => ['display' => false]],
-                ],
-            ],
-        ]);
-    }
-}

app/Livewire/NewSupportRequest.php

@@ -1,72 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\SupportRequest;
-use Illuminate\Validation\Rule;
-use LivewireUI\Modal\ModalComponent;
-
-/**
- * Raise a support request.
- *
- * The customer is asked for three things and nothing else: what it is about,
- * a subject, and the question. Everything an operator would otherwise have to
- * ask for — which customer, which instance, which plan — the system already
- * knows and attaches itself. Making somebody describe their own server back to
- * the people who built it is the part of support that annoys people most.
- */
-class NewSupportRequest extends ModalComponent
-{
-    use ResolvesCustomer;
-
-    public string $category = 'technical';
-
-    public string $subject = '';
-
-    public string $body = '';
-
-    public function save()
-    {
-        $customer = $this->requireCustomer();
-
-        if ($customer === null) {
-            return $this->closeModal();
-        }
-
-        $data = $this->validate([
-            'category' => ['required', Rule::in(SupportRequest::CATEGORIES)],
-            'subject' => 'required|string|min:3|max:150',
-            'body' => 'required|string|min:10|max:5000',
-        ]);
-
-        $instance = $customer->instances()
-            ->whereIn('status', ['active', 'cancellation_scheduled'])
-            ->latest('id')
-            ->first()
-            ?? $customer->instances()->latest('id')->first();
-
-        SupportRequest::create([
-            'customer_id' => $customer->id,
-            'instance_id' => $instance?->id,
-            'subject' => $data['subject'],
-            'category' => $data['category'],
-            'body' => $data['body'],
-            'status' => 'open',
-            // The person, not the account: on a shared login the account name
-            // says nothing about who is actually asking.
-            'reported_by' => auth()->user()?->name ?: auth()->user()?->email,
-        ]);
-
-        $this->dispatch('notify', message: __('support.sent'));
-
-        return $this->redirectRoute('support', navigate: true);
-    }
-
-    public function render()
-    {
-        return view('livewire.new-support-request', [
-            'categories' => SupportRequest::CATEGORIES,
-        ]);
-    }
-}

app/Livewire/Settings.php

@@ -1,248 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use Illuminate\Support\Facades\Storage;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-use Livewire\WithFileUploads;
-
-class Settings extends Component
-{
-    use \App\Livewire\Concerns\ChangesOwnPassword;
-    use \App\Livewire\Concerns\ConfirmsPassword;
-
-    /** Shown once, right after setting two-factor up. */
-    public ?array $recoveryCodes = null;
-
-    public string $twoFactorCode = '';
-
-    /**
-     * Start two-factor setup: generate the secret, then show the QR code.
-     *
-     * Not confirmed yet — Fortify keeps `two_factor_confirmed_at` null until a
-     * code from the app has been accepted, so someone who scans nothing and
-     * closes the tab is not left locked out of their own account.
-     */
-    public function enableTwoFactor(): void
-    {
-        $this->requireConfirmedPassword();
-
-        app(\Laravel\Fortify\Actions\EnableTwoFactorAuthentication::class)(auth()->user());
-    }
-
-    /** Accept a code from the app, which is what actually turns it on. */
-    public function confirmTwoFactor(): void
-    {
-        $this->requireConfirmedPassword();
-
-        try {
-            app(\Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication::class)(
-                auth()->user(),
-                $this->twoFactorCode,
-            );
-        } catch (\Illuminate\Validation\ValidationException $e) {
-            $this->addError('twoFactorCode', $e->errors()['code'][0] ?? __('settings.twofa_code_wrong'));
-
-            return;
-        }
-
-        $this->twoFactorCode = '';
-        // Shown once, here, because this is the only moment they exist in a
-        // form anyone will read. They stay retrievable afterwards, but nobody
-        // writes down what they were not shown.
-        $this->recoveryCodes = json_decode(decrypt(auth()->user()->two_factor_recovery_codes), true);
-        $this->dispatch('notify', message: __('settings.twofa_on'));
-    }
-
-    public function regenerateRecoveryCodes(): void
-    {
-        $this->requireConfirmedPassword();
-
-        app(\Laravel\Fortify\Actions\GenerateNewRecoveryCodes::class)(auth()->user());
-        $this->recoveryCodes = json_decode(decrypt(auth()->user()->refresh()->two_factor_recovery_codes), true);
-    }
-
-    public function disableTwoFactor(): void
-    {
-        $this->requireConfirmedPassword();
-
-        app(\Laravel\Fortify\Actions\DisableTwoFactorAuthentication::class)(auth()->user());
-        $this->recoveryCodes = null;
-        $this->dispatch('notify', message: __('settings.twofa_off'));
-    }
-
-    /**
-     * Every two-factor action goes through this.
-     *
-     * Server-side, on each call, and not merely by hiding the buttons: a
-     * Livewire action is reachable by anyone who can post to /livewire/update,
-     * and "the form was not on screen" has never stopped anybody.
-     */
-    private function requireConfirmedPassword(): void
-    {
-        abort_unless($this->passwordRecentlyConfirmed(), 403);
-    }
-
-    use ResolvesCustomer, WithFileUploads;
-
-    // Company / billing profile
-    #[Validate('required|string|max:255')]
-    public string $companyName = '';
-
-    #[Validate('nullable|string|max:255')]
-    public string $contactName = '';
-
-    #[Validate('nullable|string|max:64')]
-    public string $phone = '';
-
-    #[Validate('nullable|string|max:64')]
-    public string $vatId = '';
-
-    #[Validate('nullable|string|max:2000')]
-    public string $billingAddress = '';
-
-    // Branding
-    #[Validate('nullable|string|max:255')]
-    public string $brandDisplayName = '';
-
-    #[Validate('nullable|regex:/^#[0-9a-fA-F]{6}$/')]
-    public string $brandPrimary = '';
-
-    #[Validate('nullable|regex:/^#[0-9a-fA-F]{6}$/')]
-    public string $brandAccent = '';
-
-    /** New logo upload (validated on save). */
-    public $logo = null;
-
-    public ?string $brandLogoPath = null;
-
-    public function mount(): void
-    {
-        $c = $this->customer();
-        if ($c === null) {
-            return;
-        }
-        $this->companyName = $c->name ?? '';
-        $this->contactName = $c->contact_name ?? '';
-        $this->phone = $c->phone ?? '';
-        $this->vatId = $c->vat_id ?? '';
-        $this->billingAddress = $c->billing_address ?? '';
-        $this->brandDisplayName = $c->brand_display_name ?? '';
-        $this->brandPrimary = $c->brand_primary_color ?? '';
-        $this->brandAccent = $c->brand_accent_color ?? '';
-        $this->brandLogoPath = $c->brand_logo_path;
-    }
-
-    public function saveProfile(): void
-    {
-        $c = $this->requireCustomer();
-        if ($c === null) {
-            return;
-        }
-
-        $this->validateOnly('companyName');
-        $data = $this->validate([
-            'companyName' => 'required|string|max:255',
-            'contactName' => 'nullable|string|max:255',
-            'phone' => 'nullable|string|max:64',
-            'vatId' => 'nullable|string|max:64',
-            'billingAddress' => 'nullable|string|max:2000',
-        ]);
-
-        $c->update([
-            'name' => $data['companyName'],
-            'contact_name' => $data['contactName'] ?: null,
-            'phone' => $data['phone'] ?: null,
-            'vat_id' => $data['vatId'] ?: null,
-            'billing_address' => $data['billingAddress'] ?: null,
-        ]);
-
-        $this->dispatch('notify', message: __('settings.profile_saved'));
-    }
-
-    public function saveBranding(): void
-    {
-        $c = $this->requireCustomer();
-        if ($c === null) {
-            return;
-        }
-
-        $this->validate([
-            'brandDisplayName' => 'nullable|string|max:255',
-            'brandPrimary' => 'nullable|regex:/^#[0-9a-fA-F]{6}$/',
-            'brandAccent' => 'nullable|regex:/^#[0-9a-fA-F]{6}$/',
-            'logo' => 'nullable|image|mimes:png,webp|max:2048',
-        ]);
-
-        // Store the new upload, but keep the old file until the DB row that
-        // references it is updated — delete the old one only after that commits,
-        // so a failed update never orphans a file or dangles a reference.
-        $oldToDelete = null;
-        if ($this->logo !== null) {
-            $oldToDelete = $this->brandLogoPath;
-            $this->brandLogoPath = $this->logo->store('branding', 'public');
-            $this->logo = null;
-        }
-
-        $c->update([
-            'brand_display_name' => $this->brandDisplayName ?: null,
-            'brand_primary_color' => $this->brandPrimary ?: null,
-            'brand_accent_color' => $this->brandAccent ?: null,
-            'brand_logo_path' => $this->brandLogoPath,
-        ]);
-
-        if ($oldToDelete !== null && $oldToDelete !== $this->brandLogoPath) {
-            Storage::disk('public')->delete($oldToDelete);
-        }
-
-        $this->dispatch('notify', message: __('settings.branding_saved'));
-    }
-
-    public function removeLogo(): void
-    {
-        $c = $this->requireCustomer();
-        if ($c === null) {
-            return;
-        }
-        if ($this->brandLogoPath !== null) {
-            Storage::disk('public')->delete($this->brandLogoPath);
-        }
-        $this->brandLogoPath = null;
-        $c->update(['brand_logo_path' => null]);
-        $this->dispatch('notify', message: __('settings.branding_saved'));
-    }
-
-    #[Layout('layouts.portal-app')]
-    public function render()
-    {
-        $c = $this->customer();
-        // Prefer the active/cancelling instance for the package section so the
-        // controls line up with what cancellation actually targets.
-        $active = $c?->instances()->where('status', 'active')->latest('id')->first();
-        $scheduled = $c?->instances()->where('status', 'cancellation_scheduled')->latest('id')->first();
-        $instance = $active ?? $scheduled ?? $c?->instances()->latest('id')->first();
-
-        $user = auth()->user();
-
-        return view('livewire.settings', [
-            // Never the secret itself — only whether it exists, and the SVG
-            // Fortify renders from it. The secret in a Livewire property would
-            // travel to the browser and back in the component snapshot.
-            'twoFactorPending' => $user->two_factor_secret !== null && $user->two_factor_confirmed_at === null,
-            'twoFactorOn' => $user->two_factor_confirmed_at !== null,
-            'twoFactorQr' => $user->two_factor_secret !== null && $user->two_factor_confirmed_at === null
-                ? $user->twoFactorQrCodeSvg()
-                : null,
-            'passwordConfirmed' => $this->passwordRecentlyConfirmed(),
-            'customer' => $c,
-            'instance' => $instance,
-            'branding' => $c?->brandingResolved(),
-            'logoUrl' => $this->brandLogoPath ? Storage::disk('public')->url($this->brandLogoPath) : null,
-            'hasActivePackage' => $active !== null,
-            'cancellationScheduled' => $active === null && $scheduled !== null,
-        ]);
-    }
-}

app/Livewire/Support.php

@@ -1,41 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\SupportRequest;
-use Livewire\Attributes\Layout;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Support extends Component
-{
-    use ResolvesCustomer;
-
-    public function render()
-    {
-        $customer = $this->customer();
-
-        $requests = $customer
-            ? SupportRequest::query()
-                ->where('customer_id', $customer->id)
-                ->latest('created_at')
-                ->limit(20)
-                ->get()
-            : collect();
-
-        return view('livewire.support', [
-            'requests' => $requests,
-            'openCount' => $requests->filter(fn (SupportRequest $r) => $r->isOpen())->count(),
-            // The answers link into the panel where the panel can actually do
-            // the thing being asked about — an FAQ that only describes a button
-            // makes the reader hunt for it.
-            'faqs' => [
-                ['q' => __('support.faq_q1'), 'a' => __('support.faq_a1'), 'to' => route('backups'), 'cta' => __('support.faq_to_backups')],
-                ['q' => __('support.faq_q2'), 'a' => __('support.faq_a2'), 'to' => route('users'), 'cta' => __('support.faq_to_users')],
-                ['q' => __('support.faq_q3'), 'a' => __('support.faq_a3'), 'to' => null, 'cta' => null],
-                ['q' => __('support.faq_q4'), 'a' => __('support.faq_a4'), 'to' => route('billing'), 'cta' => __('support.faq_to_billing')],
-            ],
-        ]);
-    }
-}

app/Livewire/Users.php

@@ -1,242 +0,0 @@
-<?php
-
-namespace App\Livewire;
-
-use App\Livewire\Concerns\ResolvesCustomer;
-use App\Models\Customer;
-use App\Models\Seat;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\DB;
-use Livewire\Attributes\Layout;
-use Livewire\Attributes\Validate;
-use Livewire\Component;
-
-#[Layout('layouts.portal-app')]
-class Users extends Component
-{
-    use ResolvesCustomer;
-
-    #[Validate('required|email|max:255')]
-    public string $inviteEmail = '';
-
-    #[Validate('nullable|string|max:255')]
-    public string $inviteName = '';
-
-    #[Validate('required|in:admin,member,readonly')]
-    public string $inviteRole = 'member';
-
-
-    public function mount(): void
-    {
-        // Every customer starts with themselves as the owner seat. firstOrCreate
-        // keyed on (customer_id, email) is idempotent; the catch covers the
-        // concurrent-first-visit race against the unique index.
-        $customer = $this->customer();
-        if ($customer !== null && $customer->seats()->count() === 0) {
-            try {
-                $customer->seats()->firstOrCreate(
-                    ['email' => $customer->email],
-                    ['name' => $customer->name, 'role' => 'owner', 'status' => 'active', 'invited_at' => now()],
-                );
-            } catch (UniqueConstraintViolationException) {
-                // Another concurrent first visit created it — fine.
-            }
-        }
-    }
-
-    public function invite(): void
-    {
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        $data = $this->validate();
-
-        // Serialize the limit check with the insert so two concurrent invites for
-        // the last free seat can't both pass (lock the customer row).
-        $result = DB::transaction(function () use ($customer, $data) {
-            $locked = Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-
-            if ($locked->seats()->where('email', $data['inviteEmail'])->exists()) {
-                return 'duplicate';
-            }
-            if ($this->usedSeats($locked) >= $this->seatLimit($locked)) {
-                return 'limit';
-            }
-
-            $locked->seats()->create([
-                'email' => $data['inviteEmail'],
-                'name' => $data['inviteName'] ?: null,
-                'role' => $data['inviteRole'],
-                'status' => 'invited',
-                'invited_at' => now(),
-            ]);
-
-            return 'ok';
-        });
-
-        if ($result === 'limit') {
-            $this->addError('inviteEmail', __('users.limit_reached'));
-
-            return;
-        }
-        if ($result === 'duplicate') {
-            $this->addError('inviteEmail', __('users.duplicate'));
-
-            return;
-        }
-
-        $this->reset('inviteEmail', 'inviteName', 'inviteRole');
-        $this->inviteRole = 'member';
-        $this->dispatch('notify', message: __('users.invited'));
-    }
-
-    public function setRole(string $uuid, string $role): void
-    {
-        if (! in_array($role, Seat::ROLES, true)) {
-            return;
-        }
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        // Lock the customer so a concurrent owner change can't race past the guard.
-        $ok = DB::transaction(function () use ($customer, $uuid, $role) {
-            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-            $seat = $customer->seats()->where('uuid', $uuid)->first();
-            if ($seat === null) {
-                return true;
-            }
-            if ($seat->role === 'owner' && $role !== 'owner' && $customer->seats()->where('role', 'owner')->count() <= 1) {
-                return false; // would remove the last owner
-            }
-            $seat->update(['role' => $role]);
-
-            return true;
-        });
-
-        if (! $ok) {
-            $this->dispatch('notify', message: __('users.last_owner'));
-        }
-    }
-
-    /**
-     * Pause a seat without destroying it.
-     *
-     * The action an owner actually needs when someone leaves: access stops now,
-     * and the record of who held it survives — which is the half a deletion
-     * throws away, on a product sold on being able to show who had access to
-     * what.
-     */
-    public function suspend(string $uuid): void
-    {
-        $customer = $this->requireCustomer();
-
-        if ($customer === null) {
-            return;
-        }
-
-        $seat = $customer->seats()->where('uuid', $uuid)->first();
-
-        if ($seat === null || $seat->role === 'owner') {
-            // The owner cannot lock themselves out of their own cloud.
-            $this->dispatch('notify', message: __('users.owner_locked'));
-
-            return;
-        }
-
-        $seat->update(['status' => $seat->status === 'suspended' ? 'active' : 'suspended']);
-
-        $this->dispatch('notify', message: __(
-            $seat->status === 'suspended' ? 'users.suspended' : 'users.reactivated',
-        ));
-    }
-
-    public function revoke(string $uuid): void
-    {
-        $customer = $this->requireCustomer();
-        if ($customer === null) {
-            return;
-        }
-
-        $result = DB::transaction(function () use ($customer, $uuid) {
-            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
-            $seat = $customer->seats()->where('uuid', $uuid)->first();
-            if ($seat === null) {
-                return 'gone';
-            }
-            if ($seat->role === 'owner' && $customer->seats()->where('role', 'owner')->count() <= 1) {
-                return 'last_owner';
-            }
-            $seat->delete();
-
-            return 'ok';
-        });
-
-        if ($result === 'last_owner') {
-            $this->dispatch('notify', message: __('users.last_owner'));
-        } elseif ($result === 'ok') {
-            $this->dispatch('notify', message: __('users.revoked'));
-        }
-    }
-
-    public function resend(string $uuid): void
-    {
-        // Invite delivery is mocked for now.
-        if ($this->seat($uuid) !== null) {
-            $this->dispatch('notify', message: __('users.resent'));
-        }
-    }
-
-
-    private function ownerCount(): int
-    {
-        $customer = $this->customer();
-
-        return $customer ? $customer->seats()->where('role', 'owner')->count() : 0;
-    }
-
-    private function usedSeats(Customer $customer): int
-    {
-        return $customer->seats()->where('status', '!=', 'revoked')->count();
-    }
-
-    private function seatLimit(Customer $customer): int
-    {
-        // The entitlement follows the active (or cancelling) package, not a newer
-        // failed/deprovisioned record.
-        $instance = $customer->instances()->whereIn('status', ['active', 'cancellation_scheduled'])->latest('id')->first()
-            ?? $customer->instances()->latest('id')->first();
-        // From the contract: how many people a customer may invite is part of
-        // what they bought. Cutting a plan's seats in the catalogue must not
-        // lock users out of an existing customer's cloud.
-        return (int) ($instance?->subscription?->seats ?? 5);
-    }
-
-    private function seat(string $uuid): ?Seat
-    {
-        $customer = $this->customer();
-
-        return $customer?->seats()->where('uuid', $uuid)->first();
-    }
-
-    public function render()
-    {
-        $customer = $this->customer();
-        $seats = $customer ? $customer->seats()->orderByRaw("role = 'owner' desc")->orderBy('email')->get() : collect();
-
-        // The actions column is ALWAYS drawn. It used to be hidden when the
-        // only seat was the owner, on the reasoning that there was nothing to
-        // act on — but every seat can be renamed, and a column that disappears
-        // does not read as "nothing applies here", it reads as "this product
-        // cannot do that". Which is exactly how it was reported.
-        return view('livewire.users', [
-            'seats' => $seats,
-            'used' => $customer ? $this->usedSeats($customer) : 0,
-            'limit' => $customer ? $this->seatLimit($customer) : 0,
-            'roles' => Seat::ROLES,
-        ]);
-    }
-}

app/Mail/MaintenanceAnnouncementMail.php

@@ -1,47 +0,0 @@
-<?php
-
-namespace App\Mail;
-
-use App\Models\Customer;
-use App\Models\MaintenanceWindow;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Mail\Mailable;
-use Illuminate\Mail\Mailables\Content;
-use Illuminate\Mail\Mailables\Envelope;
-use Illuminate\Mail\Mailables\Headers;
-use Illuminate\Queue\SerializesModels;
-
-class MaintenanceAnnouncementMail extends Mailable implements ShouldQueue
-{
-    use Queueable, SerializesModels;
-
-    /** The ledger row this mail confirms once actually delivered. */
-    public ?int $notificationId = null;
-
-    public function __construct(
-        public MaintenanceWindow $window,
-        public Customer $customer,
-    ) {}
-
-    public function headers(): Headers
-    {
-        return new Headers(text: $this->notificationId ? ['X-CP-Notification' => (string) $this->notificationId] : []);
-    }
-
-    public function envelope(): Envelope
-    {
-        return new Envelope(subject: __('maintenance.mail_subject', ['title' => $this->window->title]));
-    }
-
-    public function content(): Content
-    {
-        return new Content(markdown: 'mail.maintenance-announcement', with: [
-            'title' => $this->window->title,
-            'description' => $this->window->public_description,
-            'startsAt' => $this->window->starts_at,
-            'endsAt' => $this->window->ends_at,
-            'name' => $this->customer->name,
-        ]);
-    }
-}

app/Mail/MaintenanceCancelledMail.php

@@ -1,44 +0,0 @@
-<?php
-
-namespace App\Mail;
-
-use App\Models\Customer;
-use App\Models\MaintenanceWindow;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Mail\Mailable;
-use Illuminate\Mail\Mailables\Content;
-use Illuminate\Mail\Mailables\Envelope;
-use Illuminate\Mail\Mailables\Headers;
-use Illuminate\Queue\SerializesModels;
-
-class MaintenanceCancelledMail extends Mailable implements ShouldQueue
-{
-    use Queueable, SerializesModels;
-
-    /** The ledger row this mail confirms once actually delivered. */
-    public ?int $notificationId = null;
-
-    public function __construct(
-        public MaintenanceWindow $window,
-        public Customer $customer,
-    ) {}
-
-    public function headers(): Headers
-    {
-        return new Headers(text: $this->notificationId ? ['X-CP-Notification' => (string) $this->notificationId] : []);
-    }
-
-    public function envelope(): Envelope
-    {
-        return new Envelope(subject: __('maintenance.mail_cancel_subject', ['title' => $this->window->title]));
-    }
-
-    public function content(): Content
-    {
-        return new Content(markdown: 'mail.maintenance-cancelled', with: [
-            'title' => $this->window->title,
-            'name' => $this->customer->name,
-        ]);
-    }
-}

app/Models/Backup.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class Backup extends Model
-{
-    protected $fillable = ['instance_id', 'external_job_id', 'schedule', 'last_ok_at', 'status'];
-
-    protected function casts(): array
-    {
-        return ['last_ok_at' => 'datetime'];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/Builders/AppendOnlyBuilder.php

@@ -1,41 +0,0 @@
-<?php
-
-namespace App\Models\Builders;
-
-use Illuminate\Database\Eloquent\Builder;
-use RuntimeException;
-
-/**
- * A query builder that refuses to rewrite history.
- *
- * Model events (`updating`, `deleting`) only fire for instance operations, so a
- * guard on the model alone still lets `Model::query()->where(...)->update(...)`
- * through — which is exactly the shape a careless data fix takes. For a table
- * whose value IS that it cannot be edited, the guard has to sit where the bulk
- * operations pass.
- *
- * Not a security boundary: anyone with database access can still do as they
- * please. It is a guard against the application quietly doing it by accident,
- * which is the realistic way a register loses its meaning.
- */
-class AppendOnlyBuilder extends Builder
-{
-    public function update(array $values)
-    {
-        throw new RuntimeException(
-            'The proof register is append-only. Record a correcting event instead of editing history.'
-        );
-    }
-
-    public function delete()
-    {
-        throw new RuntimeException(
-            'The proof register is append-only. A record that can be deleted is not evidence.'
-        );
-    }
-
-    public function forceDelete()
-    {
-        return $this->delete();
-    }
-}

app/Models/Concerns/HasUuid.php

@@ -1,26 +0,0 @@
-<?php
-
-namespace App\Models\Concerns;
-
-use Illuminate\Support\Str;
-
-/**
- * Assigns a random UUID on creation. Records that expose a `uuid` column use it
- * as their route key (R11: URLs address records by UUID, not integer PK).
- */
-trait HasUuid
-{
-    protected static function bootHasUuid(): void
-    {
-        static::creating(function ($model) {
-            if (empty($model->uuid)) {
-                $model->uuid = (string) Str::uuid();
-            }
-        });
-    }
-
-    public function getRouteKeyName(): string
-    {
-        return 'uuid';
-    }
-}

app/Models/Customer.php

@@ -1,144 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\UniqueConstraintViolationException;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Str;
-use RuntimeException;
-
-class Customer extends Model
-{
-    /** Comparable form: spaces and punctuation are cosmetic in a VAT number. */
-    public static function normaliseVatId(?string $value): string
-    {
-        return strtoupper(preg_replace('/[\s.-]+/', '', (string) $value) ?? '');
-    }
-
-    public function normalisedVatId(): string
-    {
-        return self::normaliseVatId($this->vat_id);
-    }
-
-    /**
-     * True only for the value that was actually checked. Binding it to the
-     * value rather than to a flag means editing the field cannot inherit the
-     * old confirmation, whichever code path does the editing.
-     */
-    public function hasVerifiedVatId(): bool
-    {
-        // Both sides normalised: a verifier that stores the number in display
-        // form ("DE 811 907 980") must not invalidate a genuine confirmation.
-        return $this->vat_id_verified_at !== null
-            && $this->normalisedVatId() !== ''
-            && $this->normalisedVatId() === self::normaliseVatId($this->vat_id_verified_value);
-    }
-
-    /** @use HasFactory<\Database\Factories\CustomerFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'user_id', 'name', 'contact_name', 'email', 'phone', 'vat_id', 'vat_id_verified_at', 'vat_id_verified_value', 'billing_address',
-        'locale', 'stripe_customer_id', 'status', 'closed_at',
-        'brand_display_name', 'brand_logo_path', 'brand_primary_color', 'brand_accent_color',
-    ];
-
-    protected function casts(): array
-    {
-        return ['closed_at' => 'datetime', 'vat_id_verified_at' => 'datetime'];
-    }
-
-    public function seats(): HasMany
-    {
-        return $this->hasMany(Seat::class);
-    }
-
-    /**
-     * Resolve branding: customer values where set, else CluPilot defaults. Used
-     * for previews and snapshotted into the provisioning run so retries are
-     * deterministic. NULL is stored for "unset" — defaults are never copied in.
-     *
-     * @return array{display_name:string,logo_path:?string,primary_color:string,accent_color:string,is_default:bool}
-     */
-    public function brandingResolved(): array
-    {
-        $defaults = (array) config('provisioning.branding_defaults');
-
-        return [
-            'display_name' => $this->brand_display_name ?: ($defaults['display_name'] ?? 'CluPilot'),
-            'logo_path' => $this->brand_logo_path ?: ($defaults['logo_path'] ?? null),
-            'primary_color' => $this->brand_primary_color ?: ($defaults['primary_color'] ?? '#f97316'),
-            'accent_color' => $this->brand_accent_color ?: ($defaults['accent_color'] ?? '#c2560a'),
-            'is_default' => $this->brand_display_name === null
-                && $this->brand_logo_path === null
-                && $this->brand_primary_color === null
-                && $this->brand_accent_color === null,
-        ];
-    }
-
-    public function user(): BelongsTo
-    {
-        return $this->belongsTo(User::class);
-    }
-
-    public function orders(): HasMany
-    {
-        return $this->hasMany(Order::class);
-    }
-
-    public function instances(): HasMany
-    {
-        return $this->hasMany(Instance::class);
-    }
-
-    /**
-     * Find or create the portal login account for this customer and link it.
-     * Race-safe against the unique email index, and never links an operator
-     * account — that would carry admin authorization into an impersonated
-     * "customer" session.
-     */
-    public function ensureUser(): User
-    {
-        if ($this->user) {
-            return $this->user;
-        }
-
-        if (($existing = User::query()->where('email', $this->email)->first()) !== null) {
-            $this->assertNotAdmin($existing);
-            $this->update(['user_id' => $existing->id]);
-
-            return $existing;
-        }
-
-        try {
-            $user = User::query()->create([
-                'email' => $this->email,
-                'name' => $this->name,
-                'password' => Hash::make(Str::random(40)),
-                'is_admin' => false,
-            ]);
-        } catch (UniqueConstraintViolationException) {
-            // Concurrent first-time creation — re-fetch and link the winner.
-            $user = User::query()->where('email', $this->email)->firstOrFail();
-            $this->assertNotAdmin($user);
-        }
-
-        $this->update(['user_id' => $user->id]);
-
-        return $user->refresh();
-    }
-
-    private function assertNotAdmin(User $user): void
-    {
-        if ($user->is_admin || $user->isOperator()) {
-            throw new RuntimeException(
-                "Refusing to link operator account {$user->email} as a portal login for customer {$this->id}.",
-            );
-        }
-    }
-}

app/Models/Datacenter.php

@@ -1,31 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-
-class Datacenter extends Model
-{
-    /** @use HasFactory<\Database\Factories\DatacenterFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = ['code', 'name', 'location', 'active'];
-
-    protected function casts(): array
-    {
-        return ['active' => 'boolean'];
-    }
-
-    public function scopeActive(Builder $query): Builder
-    {
-        return $query->where('active', true);
-    }
-
-    public function hosts()
-    {
-        return $this->hasMany(Host::class, 'datacenter', 'code');
-    }
-}

app/Models/DnsRecord.php

@@ -1,16 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class DnsRecord extends Model
-{
-    protected $fillable = ['instance_id', 'provider', 'record_id', 'fqdn', 'type', 'value'];
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/Host.php

@@ -1,139 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use App\Provisioning\Contracts\ProvisioningSubject;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsToMany;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\MorphMany;
-
-class Host extends Model implements ProvisioningSubject
-{
-    /** @use HasFactory<\Database\Factories\HostFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'name', 'datacenter', 'cluster', 'public_ip', 'wg_ip', 'wg_pubkey',
-        'ssh_host_key', 'api_token_ref', 'total_gb', 'total_ram_mb', 'cpu_cores',
-        'cpu_weight', 'reserve_pct', 'pve_version', 'node', 'status', 'last_seen_at', 'dns_name', 'dns_record_id',
-    ];
-
-    protected $hidden = ['api_token_ref'];
-
-    protected function casts(): array
-    {
-        return [
-            'api_token_ref' => 'encrypted',
-            'last_seen_at' => 'datetime',
-            'total_gb' => 'integer',
-            'total_ram_mb' => 'integer',
-            'cpu_cores' => 'integer',
-            'cpu_weight' => 'integer',
-            'reserve_pct' => 'integer',
-        ];
-    }
-
-    /** Placement runs (polymorphic subject). */
-    public function runs(): MorphMany
-    {
-        return $this->morphMany(ProvisioningRun::class, 'subject');
-    }
-
-    /** Runner hook: a failed onboarding run moves the host to the error status. */
-    public function onProvisioningFailed(): void
-    {
-        $this->update(['status' => 'error']);
-    }
-
-    public function instances(): HasMany
-    {
-        return $this->hasMany(Instance::class);
-    }
-
-    public function maintenanceWindows(): BelongsToMany
-    {
-        return $this->belongsToMany(MaintenanceWindow::class);
-    }
-
-    /** Free committable storage: total minus reserve. */
-    public function freeGb(): int
-    {
-        if ($this->total_gb === null) {
-            return 0;
-        }
-
-        return (int) floor($this->total_gb * (100 - $this->reserve_pct) / 100);
-    }
-
-    /**
-     * Host storage already committed, counted as the VM disk allocation
-     * (disk_gb) since that is what is actually placed on the host — not the
-     * (smaller) Nextcloud user quota. A failed instance still counts while its VM
-     * exists (has a vmid); a failure before any VM was created releases it.
-     */
-    public function committedGb(): int
-    {
-        // Answer a preloaded sum when the caller supplied one (see
-        // Instance::scopeOccupyingHost) — listing every host otherwise costs a
-        // query per host, twice over once usedPct() asks again.
-        //
-        // Tested for PRESENCE, not for null: SUM over no rows is null, so a
-        // host with nothing on it arrives preloaded-but-null. Reading that as
-        // "not preloaded" would re-query for exactly the empty hosts, which is
-        // the case the preload exists for.
-        if (array_key_exists('committed_disk_gb', $this->getAttributes())) {
-            return (int) $this->getAttributes()['committed_disk_gb'];
-        }
-
-        return (int) $this->instances()->occupyingHost()->sum('disk_gb');
-    }
-
-    /** Storage still available for new instances. */
-    public function availableGb(): int
-    {
-        return max(0, $this->freeGb() - $this->committedGb());
-    }
-
-    /** Used-storage percentage (committed vs committable free), 0–100. */
-    public function usedPct(): int
-    {
-        $free = $this->freeGb();
-
-        return $free > 0 ? min(100, (int) round($this->committedGb() / $free * 100)) : 0;
-    }
-
-    /**
-     * Heartbeat health from last_seen_at: online (≤5 min), stale (≤30 min),
-     * offline (older or never seen). Drives the health dot in the console.
-     */
-    public function healthState(): string
-    {
-        if ($this->last_seen_at === null) {
-            return 'offline';
-        }
-        $minutes = $this->last_seen_at->diffInMinutes(now());
-
-        return match (true) {
-            $minutes <= 5 => 'online',
-            $minutes <= 30 => 'stale',
-            default => 'offline',
-        };
-    }
-
-    /**
-     * Placement (spec §1): first active host in the datacenter with enough free
-     * committable storage. Cluster is ignored in v1.0.
-     */
-    public static function placeableIn(string $datacenter, int $quotaGb): ?self
-    {
-        return self::query()
-            ->where('datacenter', $datacenter)
-            ->where('status', 'active')
-            ->orderBy('name')
-            ->get()
-            ->first(fn (self $host) => $host->availableGb() >= $quotaGb);
-    }
-}

app/Models/Instance.php

@@ -1,102 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\HasOne;
-
-class Instance extends Model
-{
-    /** @use HasFactory<\Database\Factories\InstanceFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'customer_id', 'order_id', 'host_id', 'vmid', 'guest_ip', 'plan', 'quota_gb', 'traffic_addons', 'disk_gb',
-        'ram_mb', 'cores', 'subdomain', 'custom_domain', 'nc_admin_ref',
-        'route_written', 'cert_ok', 'status', 'cancel_requested_at', 'service_ends_at',
-    ];
-
-    protected $hidden = ['nc_admin_ref'];
-
-    protected function casts(): array
-    {
-        return [
-            'nc_admin_ref' => 'encrypted',
-            'route_written' => 'boolean',
-            'cert_ok' => 'boolean',
-            'vmid' => 'integer',
-            'traffic_addons' => 'integer',
-            'quota_gb' => 'integer',
-            'disk_gb' => 'integer',
-            'ram_mb' => 'integer',
-            'cores' => 'integer',
-            'cancel_requested_at' => 'datetime',
-            'service_ends_at' => 'datetime',
-        ];
-    }
-
-    /**
-     * Instances that are actually occupying storage on their host.
-     *
-     * A failed instance still holds its disk while its VM exists; a failure
-     * before any VM was created releases it. Kept here rather than written out
-     * at each call site so the host's own accounting and anything reporting on
-     * it cannot drift apart — a dashboard that counted differently from
-     * placement would call a host comfortable while orders were being refused
-     * on it.
-     *
-     * @param  \Illuminate\Database\Eloquent\Builder<self>  $query
-     */
-    public function scopeOccupyingHost($query): void
-    {
-        $query->where(fn ($q) => $q->where('status', '!=', 'failed')->orWhereNotNull('vmid'));
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-
-    public function order(): BelongsTo
-    {
-        return $this->belongsTo(Order::class);
-    }
-
-    /**
-     * The contract this machine fulfils. The authority on what the customer is
-     * entitled to — the catalogue only describes what we sell today.
-     */
-    public function subscription(): HasOne
-    {
-        return $this->hasOne(Subscription::class);
-    }
-
-    public function host(): BelongsTo
-    {
-        return $this->belongsTo(Host::class);
-    }
-
-    public function dnsRecords(): HasMany
-    {
-        return $this->hasMany(DnsRecord::class);
-    }
-
-    public function backups(): HasMany
-    {
-        return $this->hasMany(Backup::class);
-    }
-
-    public function monitoringTargets(): HasMany
-    {
-        return $this->hasMany(MonitoringTarget::class);
-    }
-
-    public function onboardingTasks(): HasMany
-    {
-        return $this->hasMany(OnboardingTask::class);
-    }
-}

app/Models/InstanceMetric.php

@@ -1,107 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Collection;
-
-/**
- * A day in the life of one instance: how full it was, and what it moved.
- *
- * Read by the customer panel to draw the storage ring and the transfer trend.
- * Written by CollectInstanceTraffic, which already visits every active
- * instance — a second scheduler entry hitting the same Proxmox API would only
- * double the load and the failure modes.
- */
-class InstanceMetric extends Model
-{
-    protected $fillable = ['instance_id', 'day', 'disk_used_bytes', 'disk_total_bytes', 'rx_bytes', 'tx_bytes', 'checks_total', 'checks_ok'];
-
-    protected function casts(): array
-    {
-        return [
-            'day' => 'date',
-            'disk_used_bytes' => 'integer',
-            'disk_total_bytes' => 'integer',
-            'rx_bytes' => 'integer',
-            'tx_bytes' => 'integer',
-            'checks_total' => 'integer',
-            'checks_ok' => 'integer',
-        ];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-
-    /**
-     * The last $days days, oldest first, with gaps left as gaps.
-     *
-     * A missing day is not a zero. Filling it would draw a cliff into the chart
-     * on every day the sampler could not reach the host, and the customer would
-     * read an outage that never happened.
-     *
-     * @return Collection<int, self>
-     */
-    public static function series(Instance $instance, int $days = 14): Collection
-    {
-        return self::query()
-            ->where('instance_id', $instance->id)
-            ->where('day', '>=', Carbon::today()->subDays($days - 1))
-            ->orderBy('day')
-            ->get();
-    }
-
-    /**
-     * Availability over the window, as a percentage, or null.
-     *
-     * Null when nothing was ever checked. Reporting an unmonitored instance as
-     * 100 % is the single most dishonest number this application could print —
-     * it is the figure a customer would quote to their own auditor.
-     */
-    public static function availability(Instance $instance, int $days = 30): ?float
-    {
-        $row = self::query()
-            ->where('instance_id', $instance->id)
-            ->where('day', '>=', Carbon::today()->subDays($days - 1))
-            ->selectRaw('SUM(checks_total) as total, SUM(checks_ok) as ok')
-            ->first();
-
-        $total = (int) ($row->total ?? 0);
-
-        return $total === 0 ? null : round((int) $row->ok / $total * 100, 2);
-    }
-
-    /**
-     * Daily availability for the trend, oldest first.
-     *
-     * Days without a single check are skipped rather than drawn at zero: our
-     * monitoring being down is not the customer's cloud being down.
-     *
-     * @return array<int, float>
-     */
-    public static function availabilitySeries(Instance $instance, int $days = 30): array
-    {
-        return self::query()
-            ->where('instance_id', $instance->id)
-            ->where('day', '>=', Carbon::today()->subDays($days - 1))
-            ->where('checks_total', '>', 0)
-            ->orderBy('day')
-            ->get()
-            ->map(fn (self $m) => round($m->checks_ok / max(1, $m->checks_total) * 100, 2))
-            ->all();
-    }
-
-    /** The most recent day that carries a disk reading, or null. */
-    public static function latestDisk(Instance $instance): ?self
-    {
-        return self::query()
-            ->where('instance_id', $instance->id)
-            ->whereNotNull('disk_used_bytes')
-            ->orderByDesc('day')
-            ->first();
-    }
-}

app/Models/InstanceTraffic.php

@@ -1,37 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class InstanceTraffic extends Model
-{
-    protected $table = 'instance_traffic';
-
-    protected $guarded = [];
-
-    protected function casts(): array
-    {
-        return [
-            'rx_bytes' => 'integer',
-            'tx_bytes' => 'integer',
-            'last_netin' => 'integer',
-            'last_netout' => 'integer',
-            'notified_percent' => 'integer',
-            'throttled' => 'boolean',
-            'sampled_at' => 'datetime',
-            'throttled_at' => 'datetime',
-        ];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-
-    public static function currentPeriod(): string
-    {
-        return now()->format('Y-m');
-    }
-}

app/Models/MaintenanceNotification.php

@@ -1,26 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class MaintenanceNotification extends Model
-{
-    protected $fillable = ['maintenance_window_id', 'customer_id', 'event', 'email', 'sent_at', 'claimed_at'];
-
-    protected function casts(): array
-    {
-        return ['sent_at' => 'datetime', 'claimed_at' => 'datetime'];
-    }
-
-    public function window(): BelongsTo
-    {
-        return $this->belongsTo(MaintenanceWindow::class, 'maintenance_window_id');
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-}

app/Models/MaintenanceWindow.php

@@ -1,130 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsToMany;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Support\Collection;
-
-class MaintenanceWindow extends Model
-{
-    /** @use HasFactory<\Database\Factories\MaintenanceWindowFactory> */
-    use HasFactory, HasUuid;
-
-    /** How far before the start the banner appears (Codex: 72 h). */
-    public const DISPLAY_HOURS = 72;
-
-    protected $fillable = [
-        'title', 'public_description', 'internal_notes', 'starts_at', 'ends_at',
-        'state', 'created_by', 'published_at', 'cancelled_at', 'cancellation_reason',
-    ];
-
-    protected function casts(): array
-    {
-        return [
-            'starts_at' => 'datetime',
-            'ends_at' => 'datetime',
-            'published_at' => 'datetime',
-            'cancelled_at' => 'datetime',
-        ];
-    }
-
-    public function hosts(): BelongsToMany
-    {
-        return $this->belongsToMany(Host::class);
-    }
-
-    public function deliveries(): HasMany
-    {
-        return $this->hasMany(MaintenanceNotification::class);
-    }
-
-    /** Derived lifecycle state — never stored (Codex). */
-    public function derivedState(): string
-    {
-        if ($this->state === 'cancelled') {
-            return 'cancelled';
-        }
-        if ($this->state === 'draft') {
-            return 'draft';
-        }
-        if (now()->lt($this->starts_at)) {
-            return 'upcoming';
-        }
-        if (now()->lte($this->ends_at)) {
-            return 'active';
-        }
-
-        return 'completed';
-    }
-
-    public function isPublished(): bool
-    {
-        return $this->state === 'scheduled';
-    }
-
-    /** Service-bearing customers on the assigned hosts (recomputed live). */
-    public function affectedCustomers(): Collection
-    {
-        $hostIds = $this->hosts()->pluck('hosts.id');
-        if ($hostIds->isEmpty()) {
-            return collect();
-        }
-
-        return Customer::query()
-            ->whereHas('instances', fn (Builder $q) => $q
-                ->whereIn('host_id', $hostIds)
-                ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled']))
-            ->get();
-    }
-
-    /**
-     * Scheduled windows within the display horizon that affect ONE instance's
-     * host — for a per-instance badge, so a customer with several instances
-     * never sees another instance's maintenance on this card.
-     */
-    public static function forInstance(?Instance $instance): Collection
-    {
-        if ($instance === null || $instance->host_id === null) {
-            return collect();
-        }
-
-        return self::query()
-            ->where('state', 'scheduled')
-            ->where('ends_at', '>=', now())
-            ->where('starts_at', '<=', now()->addHours(self::DISPLAY_HOURS))
-            ->whereHas('hosts', fn (Builder $q) => $q->whereKey($instance->host_id))
-            ->orderBy('starts_at')
-            ->get();
-    }
-
-    /**
-     * Scheduled windows to show a given customer right now: within the display
-     * horizon (72 h before start until the end) and touching one of the
-     * customer's service instances' hosts.
-     */
-    public static function bannerFor(Customer $customer): Collection
-    {
-        $hostIds = Instance::query()
-            ->where('customer_id', $customer->id)
-            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
-            ->whereNotNull('host_id')
-            ->pluck('host_id')->unique();
-
-        if ($hostIds->isEmpty()) {
-            return collect();
-        }
-
-        return self::query()
-            ->where('state', 'scheduled')
-            ->where('ends_at', '>=', now())
-            ->where('starts_at', '<=', now()->addHours(self::DISPLAY_HOURS))
-            ->whereHas('hosts', fn (Builder $q) => $q->whereIn('hosts.id', $hostIds))
-            ->orderBy('starts_at')
-            ->get();
-    }
-}

app/Models/MonitoringTarget.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class MonitoringTarget extends Model
-{
-    protected $fillable = ['instance_id', 'external_id', 'url', 'status', 'checked_at'];
-
-    protected function casts(): array
-    {
-        // Without the cast the freshness comparison happens between a string
-        // and a Carbon instance, and without checked_at being fillable the sync
-        // job's update silently drops it — leaving every verdict permanently
-        // stale, which reads on the status page as "not monitored".
-        return ['checked_at' => 'datetime'];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/OnboardingTask.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-class OnboardingTask extends Model
-{
-    protected $fillable = ['instance_id', 'key', 'done', 'done_at'];
-
-    protected function casts(): array
-    {
-        return ['done' => 'boolean', 'done_at' => 'datetime'];
-    }
-
-    public function instance(): BelongsTo
-    {
-        return $this->belongsTo(Instance::class);
-    }
-}

app/Models/Order.php

@@ -1,109 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use App\Services\Billing\TaxTreatment;
-use App\Provisioning\Contracts\ProvisioningSubject;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasOne;
-use Illuminate\Database\Eloquent\Relations\MorphMany;
-
-class Order extends Model implements ProvisioningSubject
-{
-    /** @use HasFactory<\Database\Factories\OrderFactory> */
-    use HasFactory, HasUuid;
-
-    protected $fillable = [
-        'customer_id', 'plan', 'plan_version_id', 'type', 'addon_key', 'amount_cents', 'currency',
-        'datacenter', 'stripe_event_id', 'stripe_subscription_id', 'status',
-    ];
-
-    protected function casts(): array
-    {
-        return ['amount_cents' => 'integer', 'plan_version_id' => 'integer'];
-    }
-
-    /**
-     * What this order actually buys, in words.
-     *
-     * Lives on the model rather than in the view: the cart, the invoice list and
-     * any future confirmation mail must not each invent their own wording for
-     * the same row.
-     */
-    public function label(): string
-    {
-        return match ($this->type) {
-            'upgrade' => __('billing.cart.upgrade', ['plan' => ucfirst($this->plan)]),
-            'storage' => __('billing.cart.storage', ['gb' => (int) config('provisioning.storage_addon.gb', 100)]),
-            'traffic' => __('billing.cart.traffic', ['gb' => (int) config('provisioning.traffic.addon.gb', 1000)]),
-            'addon' => __('billing.addon.'.$this->addon_key.'.name'),
-            default => __('billing.cart.plan', ['plan' => ucfirst($this->plan)]),
-        };
-    }
-
-    /**
-     * Monthly or one-off.
-     *
-     * Traffic is bought for the month that is running out and does not renew;
-     * everything else changes the recurring bill.
-     */
-    public function isRecurring(): bool
-    {
-        return $this->type !== 'traffic';
-    }
-
-    /**
-     * Net is what is stored; gross is what gets charged — and how much VAT that
-     * is depends on the customer, not on a global setting.
-     */
-    public function grossCents(): int
-    {
-        return $this->taxTreatment()->grossCents($this->amount_cents);
-    }
-
-    public function taxTreatment(): TaxTreatment
-    {
-        return TaxTreatment::for($this->customer);
-    }
-
-    /** Only a pending order is still the customer's to change. */
-    public function isRemovable(): bool
-    {
-        return $this->status === 'pending';
-    }
-
-    public function customer(): BelongsTo
-    {
-        return $this->belongsTo(Customer::class);
-    }
-
-    public function instance(): HasOne
-    {
-        return $this->hasOne(Instance::class);
-    }
-
-    /** The contract this order opened, if it was the purchase that opened one. */
-    public function subscription(): HasOne
-    {
-        return $this->hasOne(Subscription::class);
-    }
-
-    public function runs(): MorphMany
-    {
-        return $this->morphMany(ProvisioningRun::class, 'subject');
-    }
-
-    /**
-     * Runner hook: a failed provisioning run marks the order failed (no
-     * auto-refund) AND releases the reserved instance, so its quota stops
-     * counting against host capacity.
-     */
-    public function onProvisioningFailed(): void
-    {
-        $this->update(['status' => 'failed']);
-        $this->instance()->update(['status' => 'failed']);
-    }
-}

app/Models/PlanFamily.php

@@ -1,94 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Support\Carbon;
-use RuntimeException;
-
-/**
- * A plan line — the thing that has a name.
- *
- * "Team" stays Team through every price change and every resize. Orders,
- * instances and contracts have referred to plans by `key` since day one, so the
- * key is the one part of a family that must never move.
- */
-class PlanFamily extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $family) {
-            // Orders, instances and every subscription snapshot store this
-            // string. Renaming it does not rename those — it orphans them, and
-            // a checkout in flight for this family stops matching its own
-            // version. Display names are what the `name` column is for.
-            if ($family->isDirty('key')) {
-                throw new RuntimeException(
-                    'A plan family key is permanent; existing orders and contracts refer to it by name. '.
-                    'Change the display name instead.'
-                );
-            }
-        });
-
-        static::deleting(function (self $family) {
-            if ($family->versions()->whereNotNull('published_at')->exists()) {
-                throw new RuntimeException(
-                    'A plan family with published versions cannot be deleted; customers are contracted to them. '.
-                    'Switch sales off instead — it disappears from the shop and stays on record.'
-                );
-            }
-
-            // Only drafts left. The foreign key restricts, so they have to go
-            // explicitly — and nothing was ever promised on a draft.
-            $family->versions->each->delete();
-        });
-    }
-
-    protected function casts(): array
-    {
-        return [
-            'tier' => 'integer',
-            'sales_enabled' => 'boolean',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function versions(): HasMany
-    {
-        return $this->hasMany(PlanVersion::class);
-    }
-
-    /**
-     * The version on sale at a given moment, or null.
-     *
-     * Resolved with sole(): two overlapping windows are a mistake we want to
-     * hear about, not one we want silently resolved by whichever row the
-     * database happened to return first.
-     *
-     * @throws \Illuminate\Database\MultipleRecordsFoundException on overlap
-     */
-    public function versionAt(?Carbon $at = null): ?PlanVersion
-    {
-        $query = $this->versions()->available($at);
-
-        return $query->count() === 0 ? null : $query->sole();
-    }
-
-    /** On sale right now: not killed by the switch, and a version is running. */
-    public function isSellableAt(?Carbon $at = null): bool
-    {
-        return $this->sales_enabled && $this->versionAt($at) !== null;
-    }
-}

app/Models/PlanPrice.php

@@ -1,85 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use RuntimeException;
-
-/**
- * What a version costs for one term.
- *
- * One row per version AND term, each with its own Stripe Price id — a Stripe
- * Price carries its own recurring interval, so monthly and yearly can never
- * share one. Amounts are NET; what is actually charged depends on the
- * customer's tax treatment.
- *
- * Frozen with its version. Repricing means publishing a new version, which is
- * what Stripe requires anyway — a Stripe Price is immutable, so a rise mints a
- * new one and existing subscriptions keep the old.
- *
- * The reason is not tidiness. A checkout is not instant: the session opens, the
- * customer types their card details, the webhook arrives. An amount edited in
- * that gap would contract them at a price they were never quoted, while their
- * payment carries the old one. Only `stripe_price_id` stays writable, because
- * it is filled in after the fact.
- */
-class PlanPrice extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    /** What publishing the version nails down. */
-    public const FROZEN = ['plan_version_id', 'term', 'amount_cents', 'currency'];
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $price) {
-            // A draft is still a draft: nothing has been quoted to anyone.
-            if ($price->version?->isPublished() !== true) {
-                return;
-            }
-
-            $frozen = array_intersect(array_keys($price->getDirty()), self::FROZEN);
-
-            if ($frozen !== []) {
-                throw new RuntimeException(
-                    'The price of a published plan version is fixed; tried to change: '.implode(', ', $frozen).
-                    '. Publish a new version instead — someone may be at the checkout looking at this one.'
-                );
-            }
-        });
-
-        static::deleting(function (self $price) {
-            // Same loophole as editing. Remove the price of a version someone is
-            // checking out on, and their payment lands on a plan that can no
-            // longer be priced — the order is recorded, no contract opens, and
-            // they are left paid-for and unprovisioned.
-            if ($price->version?->isPublished() === true) {
-                throw new RuntimeException(
-                    'The price of a published plan version cannot be deleted. '.
-                    'Close the version\'s availability window instead.'
-                );
-            }
-        });
-    }
-
-    protected function casts(): array
-    {
-        return ['amount_cents' => 'integer'];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function version(): BelongsTo
-    {
-        return $this->belongsTo(PlanVersion::class, 'plan_version_id');
-    }
-}

app/Models/PlanVersion.php

@@ -1,167 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Concerns\HasUuids;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Support\Carbon;
-use RuntimeException;
-
-/**
- * What a plan WAS at a point in time.
- *
- * A customer buys a version, not a name. Once a version is published it is
- * fixed: publication is a promise made in public, and it is made whether or not
- * anyone has bought yet — which is why the lock is on publication and not on
- * the first sale. Selling different terms means publishing a new version, and
- * the old one keeps describing what its customers are owed.
- *
- * The availability WINDOW is not frozen. Rescheduling when a version is sold
- * changes nothing about what it promises, and the owner has to be able to move
- * a launch date without rewriting the plan.
- */
-class PlanVersion extends Model
-{
-    use HasFactory;
-    use HasUuids;
-
-    /** Everything publication nails down. */
-    public const FROZEN = [
-        'plan_family_id', 'version', 'quota_gb', 'traffic_gb', 'seats', 'ram_mb',
-        'cores', 'disk_gb', 'performance', 'template_vmid', 'features', 'published_at',
-    ];
-
-    protected $guarded = [];
-
-    protected static function booted(): void
-    {
-        static::updating(function (self $version) {
-            // A draft is still a draft: nothing has been promised to anyone.
-            if ($version->getOriginal('published_at') === null) {
-                return;
-            }
-
-            $frozen = array_intersect(array_keys($version->getDirty()), self::FROZEN);
-
-            if ($frozen !== []) {
-                throw new RuntimeException(
-                    'A published plan version is immutable; tried to change: '.implode(', ', $frozen).
-                    '. Publish a new version instead — the customers on this one bought these terms.'
-                );
-            }
-        });
-
-        static::deleting(function (self $version) {
-            // Deleting is the loophole that would undo the rest. Contracts and
-            // orders point here to record what was sold, and the foreign keys
-            // null out on delete — so removing a published version quietly
-            // erases the provenance of every customer on it, and can leave an
-            // in-flight checkout resolving against whatever replaced it.
-            if ($version->isPublished()) {
-                throw new RuntimeException(
-                    'A published plan version cannot be deleted; customers are contracted to it. '.
-                    'Close its availability window instead — it stops being sold and stays on record.'
-                );
-            }
-        });
-    }
-
-    protected function casts(): array
-    {
-        return [
-            'version' => 'integer',
-            'quota_gb' => 'integer',
-            'traffic_gb' => 'integer',
-            'seats' => 'integer',
-            'ram_mb' => 'integer',
-            'cores' => 'integer',
-            'disk_gb' => 'integer',
-            'template_vmid' => 'integer',
-            'features' => 'array',
-            'available_from' => 'datetime',
-            'available_until' => 'datetime',
-            'published_at' => 'datetime',
-        ];
-    }
-
-    public function uniqueIds(): array
-    {
-        return ['uuid'];
-    }
-
-    public function family(): BelongsTo
-    {
-        return $this->belongsTo(PlanFamily::class, 'plan_family_id');
-    }
-
-    public function prices(): HasMany
-    {
-        return $this->hasMany(PlanPrice::class);
-    }
-
-    /**
-     * Published, and inside its window at `$at`.
-     *
-     * Half-open [from, until): `until` is the first moment the version is no
-     * longer sold, so a successor starting exactly then leaves neither a gap
-     * nor an overlap.
-     */
-    public function scopeAvailable(Builder $query, ?Carbon $at = null): Builder
-    {
-        $at ??= now();
-
-        return $query
-            ->whereNotNull('published_at')
-            ->where('available_from', '<=', $at)
-            ->where(fn (Builder $open) => $open
-                ->whereNull('available_until')
-                ->orWhere('available_until', '>', $at));
-    }
-
-    public function isAvailableAt(?Carbon $at = null): bool
-    {
-        $at ??= now();
-
-        return $this->published_at !== null
-            && $this->available_from->lessThanOrEqualTo($at)
-            && ($this->available_until === null || $this->available_until->greaterThan($at));
-    }
-
-    public function isPublished(): bool
-    {
-        return $this->published_at !== null;
-    }
-
-    public function priceFor(string $term, ?string $currency = null): ?PlanPrice
-    {
-        return $this->prices()
-            ->where('term', $term)
-            ->where('currency', $currency ?? Subscription::catalogueCurrency())
-            ->first();
-    }
-
-    /**
-     * The capabilities, in the shape the rest of the app already speaks.
-     *
-     * @return array<string, mixed>
-     */
-    public function capabilities(): array
-    {
-        return [
-            'tier' => (int) $this->family->tier,
-            'quota_gb' => $this->quota_gb,
-            'traffic_gb' => $this->traffic_gb,
-            'seats' => $this->seats,
-            'ram_mb' => $this->ram_mb,
-            'cores' => $this->cores,
-            'disk_gb' => $this->disk_gb,
-            'performance' => $this->performance,
-            'template_vmid' => $this->template_vmid,
-            'features' => $this->features ?? [],
-        ];
-    }
-}

app/Models/ProvisioningRun.php

@@ -1,78 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use App\Models\Concerns\HasUuid;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\MorphTo;
-
-class ProvisioningRun extends Model
-{
-    /** @use HasFactory<\Database\Factories\ProvisioningRunFactory> */
-    use HasFactory, HasUuid;
-
-    public const STATUS_PENDING = 'pending';
-    public const STATUS_RUNNING = 'running';
-    public const STATUS_WAITING = 'waiting';
-    public const STATUS_PAUSED = 'paused';
-    public const STATUS_COMPLETED = 'completed';
-    public const STATUS_FAILED = 'failed';
-
-    protected $fillable = [
-        'subject_type', 'subject_id', 'pipeline', 'current_step', 'status',
-        'attempt', 'max_attempts', 'next_attempt_at', 'started_at', 'finished_at',
-        'error', 'context',
-    ];
-
-    protected function casts(): array
-    {
-        return [
-            'context' => 'array',
-            'next_attempt_at' => 'datetime',
-            'started_at' => 'datetime',
-            'finished_at' => 'datetime',
-            'current_step' => 'integer',
-            'attempt' => 'integer',
-            'max_attempts' => 'integer',
-        ];
-    }
-
-    public function subject(): MorphTo
-    {
-        return $this->morphTo();
-    }
-
-    public function events(): HasMany
-    {
-        return $this->hasMany(ProvisioningStepEvent::class, 'run_id');
-    }
-
-    public function resources(): HasMany
-    {
-        return $this->hasMany(RunResource::class, 'run_id');
-    }
-
-    /** Read a single key from the json context. */
-    public function context(string $key, mixed $default = null): mixed
-    {
-        return data_get($this->context, $key, $default);
-    }
-
-    /** Merge values into the json context and persist. */
-    public function mergeContext(array $values): void
-    {
-        $this->context = array_merge($this->context ?? [], $values);
-        $this->save();
-    }
-
-    /** Remove a key from the json context and persist (e.g. scrubbing a secret). */
-    public function forgetContext(string $key): void
-    {
-        $context = $this->context ?? [];
-        unset($context[$key]);
-        $this->context = $context;
-        $this->save();
-    }
-}

app/Models/ProvisioningStepEvent.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-/**
- * Append-only run event. Eloquent manages created_at only (no updated_at).
- */
-class ProvisioningStepEvent extends Model
-{
-    public const UPDATED_AT = null;
-
-    protected $fillable = ['run_id', 'step', 'attempt', 'outcome', 'message', 'external_ref'];
-
-    public function run(): BelongsTo
-    {
-        return $this->belongsTo(ProvisioningRun::class, 'run_id');
-    }
-}

app/Models/RunResource.php

@@ -1,27 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-/**
- * Idempotency breadcrumb: an external resource created during a run (wg peer,
- * pve token, vmid …). Persisted before the creating step advances.
- */
-class RunResource extends Model
-{
-    public const UPDATED_AT = null;
-
-    protected $fillable = ['run_id', 'host_id', 'kind', 'external_id'];
-
-    public function run(): BelongsTo
-    {
-        return $this->belongsTo(ProvisioningRun::class, 'run_id');
-    }
-
-    public function host(): BelongsTo
-    {
-        return $this->belongsTo(Host::class, 'host_id');
-    }
-}