@wtfalch/foundry 0.16.2 → 0.16.4

package/dist/plan/executor.d.ts

@@ -142,6 +142,7 @@ export interface CoolifyPort {
     getDatabase(uuid: string): Promise<{
         uuid: string;
         internal_db_url?: string;
+        status?: string;
     }>;
     /**
      * Every database Coolify holds. `coolifyDatabase` finds its own by name and
@@ -236,6 +237,8 @@ export interface CoolifyPort {
         name?: string;
         description?: string;
         instant_deploy?: boolean;
+        /** Extra `docker run` options (`--entrypoint "..."` becomes the compose entrypoint). */
+        custom_docker_run_options?: string;
         /**
          * `host:container`, comma separated -- publishes host ports directly
          * (`@wtfalch/providers`' `CoolifyClient.createDockerImageApplication`
@@ -1357,6 +1360,25 @@ export declare const ACCESS_POLICY_NAME = "foundry: allowed emails";
  * uses for the org's own app.
  */
 export declare function isRunningOrStarting(status: string | undefined): boolean;
+/**
+ * Reads a Postgres database and starts it when Coolify reports it as not
+ * running. `createPostgresDatabase` does not start what it creates (no
+ * `instant_deploy`), and a database found by name or by recorded id may have
+ * been left stopped, so every site that points an app at a database calls this
+ * instead of `getDatabase`. Returns what `getDatabase` returned.
+ */
+export declare function getDatabaseStarted(coolify: {
+    getDatabase(uuid: string): Promise<{
+        uuid: string;
+        internal_db_url?: string;
+        status?: string;
+    }>;
+    raw(method: string, path: string, body?: unknown): Promise<unknown>;
+}, dbId: string): Promise<{
+    uuid: string;
+    internal_db_url?: string;
+    status?: string;
+}>;
 export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer {
     private readonly ports;
     constructor(ports: FoundryStepExecutorPorts);

package/dist/plan/executor.js

@@ -551,6 +551,20 @@ export function isRunningOrStarting(status) {
         return true;
     return !status.startsWith('exited') && !status.startsWith('stopped');
 }
+/**
+ * Reads a Postgres database and starts it when Coolify reports it as not
+ * running. `createPostgresDatabase` does not start what it creates (no
+ * `instant_deploy`), and a database found by name or by recorded id may have
+ * been left stopped, so every site that points an app at a database calls this
+ * instead of `getDatabase`. Returns what `getDatabase` returned.
+ */
+export async function getDatabaseStarted(coolify, dbId) {
+    const db = await coolify.getDatabase(dbId);
+    if (db.status !== undefined && !db.status.startsWith('running')) {
+        await coolify.raw('POST', `/databases/${dbId}/start`);
+    }
+    return db;
+}
 // ---------------------------------------------------------------------------
 // Executor
 // ---------------------------------------------------------------------------
@@ -1442,7 +1456,7 @@ export class FoundryStepExecutor {
      * never logged, never interpolated into a thrown error.
      */
     async pushDatabaseUrl(appId, dbId, dbName) {
-        const db = await this.ports.coolify.getDatabase(dbId);
+        const db = await getDatabaseStarted(this.ports.coolify, dbId);
         // Nothing to push; `planApp` reports this as blocked from the live reader.
         if (!db.internal_db_url)
             return { pushed: false, changed: false };
@@ -2027,7 +2041,7 @@ export class FoundryStepExecutor {
         // recorded, logged, or interpolated into a thrown error. Its own call,
         // separate from the two app-env calls above, since it has nothing to
         // push once `internal_db_url` is absent.
-        const db = await this.ports.coolify.getDatabase(dbId);
+        const db = await getDatabaseStarted(this.ports.coolify, dbId);
         if (db.internal_db_url) {
             const dbEnvs = [
                 { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
@@ -2224,8 +2238,8 @@ export class FoundryStepExecutor {
         const masDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.masDb, 'mas', CALLS_MAS_DB_SCOPE_KEY);
         context.recordScopeId(CALLS_MAS_DB_SCOPE_KEY, masDbId);
         const [synapseDbRow, masDbRow] = await Promise.all([
-            this.ports.coolify.getDatabase(synapseDbId),
-            this.ports.coolify.getDatabase(masDbId),
+            getDatabaseStarted(this.ports.coolify, synapseDbId),
+            getDatabaseStarted(this.ports.coolify, masDbId),
         ]);
         const synapseDb = synapseDbRow.internal_db_url
             ? parseCallsDbUrl(synapseDbRow.internal_db_url)
@@ -2517,9 +2531,9 @@ export class FoundryStepExecutor {
         const serviceDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.serviceDb, 'chat', CHAT_SERVICE_DB_SCOPE_KEY);
         context.recordScopeId(CHAT_SERVICE_DB_SCOPE_KEY, serviceDbId);
         const [synapseDbRow, masDbRow, serviceDbRow] = await Promise.all([
-            this.ports.coolify.getDatabase(synapseDbId),
-            this.ports.coolify.getDatabase(masDbId),
-            this.ports.coolify.getDatabase(serviceDbId),
+            getDatabaseStarted(this.ports.coolify, synapseDbId),
+            getDatabaseStarted(this.ports.coolify, masDbId),
+            getDatabaseStarted(this.ports.coolify, serviceDbId),
         ]);
         const synapseDb = synapseDbRow.internal_db_url
             ? parseCallsDbUrl(synapseDbRow.internal_db_url)
@@ -2692,7 +2706,7 @@ export class FoundryStepExecutor {
         const dbName = `${name}-db`;
         const dbId = await this.ensureCallsDatabase(context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY);
         context.recordScopeId(CALLS_SERVICE_DB_SCOPE_KEY, dbId);
-        const db = await this.ports.coolify.getDatabase(dbId);
+        const db = await getDatabaseStarted(this.ports.coolify, dbId);
         if (!db.internal_db_url) {
             throw new Error(`coolify:calls-service for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }

package/dist/plan/platform-diff.d.ts

@@ -46,6 +46,15 @@ export declare const PLATFORM_AUTH_KEY = "platform:auth";
  * that was never actually applied.
  */
 export declare const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = "auth_zitadel_applied_image_tag";
+/**
+ * The image has `Entrypoint /app/zitadel` and no `Cmd`, so without this it
+ * runs zitadel with no subcommand, exits, and restarts forever. Coolify turns
+ * `--entrypoint` in `custom_docker_run_options` into the compose `entrypoint`
+ * (its PATCH takes this field; it refuses `dockerfile`).
+ */
+export declare const AUTH_ZITADEL_RUN_OPTIONS = "--entrypoint \"/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external\"";
+/** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
+export declare const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = "zitadel_platform_auth_run_options_applied";
 /**
  * #251: the Synapse/MAS image tags an org's calls Matrix stack last
  * successful apply actually set live. `coolifyCalls` (`executor.ts`)

package/dist/plan/platform-diff.js

@@ -41,6 +41,15 @@ export const PLATFORM_AUTH_KEY = 'platform:auth';
  * that was never actually applied.
  */
 export const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = 'auth_zitadel_applied_image_tag';
+/**
+ * The image has `Entrypoint /app/zitadel` and no `Cmd`, so without this it
+ * runs zitadel with no subcommand, exits, and restarts forever. Coolify turns
+ * `--entrypoint` in `custom_docker_run_options` into the compose `entrypoint`
+ * (its PATCH takes this field; it refuses `dockerfile`).
+ */
+export const AUTH_ZITADEL_RUN_OPTIONS = '--entrypoint "/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external"';
+/** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
+export const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = 'zitadel_platform_auth_run_options_applied';
 /**
  * #251: the Synapse/MAS image tags an org's calls Matrix stack last
  * successful apply actually set live. `coolifyCalls` (`executor.ts`)
@@ -753,8 +762,15 @@ function planJobs(platform, byKey, claimed, observable) {
         claimed.add(key);
     if (!platform.jobs.enabled)
         return { step: null, blocked: null };
-    if (live)
-        return { step: null, blocked: null };
+    if (live) {
+        // The step also starts the scheduler's database (0.16.3), so a live app
+        // whose database the reader saw stopped plans it again. A status the
+        // reader could not read is absent, and plans nothing.
+        const databaseStatus = live.config.databaseStatus;
+        if (typeof databaseStatus !== 'string' || databaseStatus.startsWith('running')) {
+            return { step: null, blocked: null };
+        }
+    }
     // No Coolify reader means the host wired no Coolify at all for the
     // platform: the step's executor would throw every apply, and the scheduler
     // could never be seen live, so it would re-plan forever. A fixed text: it
@@ -1103,7 +1119,10 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
         connectorApplied &&
         brokerApplied &&
         brokerDeployed &&
-        loginClientApplied) {
+        loginClientApplied &&
+        // The ZITADEL run options reach the container only through the auth
+        // step's redeploy, so a platform recorded before them still plans it.
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
         return { step: null, blocked: null };
     }
     // The admin key was minted but never reached the host. ZITADEL shows a

package/dist/plan/platform-providers.d.ts

@@ -51,7 +51,7 @@ export declare const JOBS_ADMIN_TOKEN_REF = "jobs:scheduler:adminToken";
  * org's own app, reused here for the platform's one scheduler instead of once
  * per org.
  */
-type JobsCoolifyPort = Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'requireGithubApp' | 'findApplicationByName' | 'createGithubAppApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'getApplication' | 'deploy'>;
+type JobsCoolifyPort = Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'requireGithubApp' | 'findApplicationByName' | 'createGithubAppApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'getApplication' | 'deploy'>;
 /**
  * Options for {@link FoundryPlatformStepExecutor}'s constructor, replacing
  * four positional arguments that shifted on every merge that added a
@@ -340,7 +340,7 @@ export interface PlatformMailRuntime {
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy'>;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord' | 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'deleteAccessApp'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp'>;
@@ -770,7 +770,7 @@ export declare class ProvidersPlatformCloudflareReader implements PlatformCloudf
 export declare class ProvidersPlatformCoolifyReader implements PlatformCoolifyReader {
     private readonly client;
     private readonly platformStore;
-    constructor(client: Pick<CoolifyPort, 'getApplication' | 'listDatabaseBackups'>, platformStore: Pick<PlatformStore, 'getServiceIds'>);
+    constructor(client: Pick<CoolifyPort, 'getApplication' | 'getDatabase' | 'listDatabaseBackups'>, platformStore: Pick<PlatformStore, 'getServiceIds'>);
     listResources(): Promise<LiveResource[]>;
 }
 export {};

package/dist/plan/platform-providers.js

@@ -4,9 +4,9 @@ import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalc
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
-import { ACCESS_POLICY_NAME, isNotFoundError, isRunningOrStarting } from './executor.js';
+import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { coolifyDomains } from './hostnames.js';
-import { JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -429,7 +429,7 @@ export class FoundryPlatformStepExecutor {
             });
             appId = created.uuid;
         }
-        const db = await coolify.getDatabase(dbId);
+        const db = await getDatabaseStarted(coolify, dbId);
         if (!db.internal_db_url) {
             throw new Error(`platform step coolify:jobs: database ${dbId} has no internal_db_url yet; not deploying the scheduler without a database`);
         }
@@ -852,7 +852,7 @@ async function provisionPlatformAuth(context, deps) {
         dbId = created.uuid;
         await record(PLATFORM_AUTH_DB_SCOPE_KEY, dbId);
     }
-    const db = await deps.coolify.getDatabase(dbId);
+    const db = await getDatabaseStarted(deps.coolify, dbId);
     if (!db.internal_db_url) {
         // Static config check before either app is touched (`diff.ts`'s
         // `coolifyCalls` follows the same rule for its own databases): Coolify
@@ -871,6 +871,7 @@ async function provisionPlatformAuth(context, deps) {
             docker_registry_image_name: AUTH_ZITADEL_IMAGE,
             docker_registry_image_tag: AUTH_ZITADEL_IMAGE_TAG,
             ports_exposes: AUTH_ZITADEL_PORT,
+            custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
             name: PLATFORM_AUTH_ZITADEL_APP_NAME,
             description: `ZITADEL for the platform's own sign-in (#168, ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG})`,
             instant_deploy: false,
@@ -882,9 +883,14 @@ async function provisionPlatformAuth(context, deps) {
     // create must not leave the app unnamed for good, and the tunnel addresses
     // the app by this name. (The port cannot read the current name back, and
     // setting the same value again is harmless.)
+    // The run options go in the same patch, so an app made before they existed
+    // gets them too.
     await deps.coolify.updateApplication(zitadelAppId, {
         custom_internal_name: PLATFORM_AUTH_ZITADEL_INTERNAL_NAME,
+        custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
     });
+    // The container only takes new run options at its next deploy.
+    const zitadelRunOptionsNew = recorded[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] !== AUTH_ZITADEL_RUN_OPTIONS;
     // #251: only on create, never unconditionally -- nothing here patches
     // `docker_registry_image_tag` on an app `findOrCreatePlatformApp` found
     // already running, so that is the only moment this tag is actually live.
@@ -1012,9 +1018,12 @@ async function provisionPlatformAuth(context, deps) {
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
     // Deploy an app that was just created, is not running (a throw after the
     // create left it never deployed, or it stopped), or whose envs changed.
-    if (zitadelApp.justCreated || !zitadelApp.running || zitadelEnvsChanged) {
+    if (zitadelApp.justCreated || !zitadelApp.running || zitadelEnvsChanged || zitadelRunOptionsNew) {
         await deps.coolify.deploy(zitadelAppId);
         await record(PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY, zitadelAppId);
+        // Only now: the options are live once the deploy went out. A throw between
+        // the PATCH and here leaves the marker unset, so the next run deploys.
+        await record(PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, AUTH_ZITADEL_RUN_OPTIONS);
     }
     if (loginApp.justCreated || !loginApp.running || loginEnvsChanged) {
         await deps.coolify.deploy(loginAppId);
@@ -2108,7 +2117,7 @@ async function provisionPlatformArchon(context, deps) {
         }
         await record(PLATFORM_ARCHON_DB_SCOPE_KEY, dbId);
     }
-    const db = await deps.coolify.getDatabase(dbId);
+    const db = await getDatabaseStarted(deps.coolify, dbId);
     if (!db.internal_db_url) {
         throw new Error('coolify:app for the platform (archon): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
     }
@@ -3264,7 +3273,7 @@ async function provisionPlatformAi(context, deps) {
         }
         await record(PLATFORM_AI_DB_SCOPE_KEY, dbId);
     }
-    const db = await coolify.getDatabase(dbId);
+    const db = await getDatabaseStarted(coolify, dbId);
     if (!db.internal_db_url) {
         throw new Error('coolify:app for the platform (ai): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
     }
@@ -3987,7 +3996,7 @@ async function provisionPlatformFiles(context, deps) {
         }
         await record(PLATFORM_FILES_DB_SCOPE_KEY, dbId);
     }
-    const db = await deps.coolify.getDatabase(dbId);
+    const db = await getDatabaseStarted(deps.coolify, dbId);
     if (!db.internal_db_url) {
         throw new Error('coolify:app for the platform (files): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
     }
@@ -4346,7 +4355,7 @@ async function provisionPlatformIntegrations(action, context, deps) {
         }
         await record(INTEGRATIONS_DATABASE_SCOPE_KEY, dbId);
     }
-    const db = await coolify.getDatabase(dbId);
+    const db = await getDatabaseStarted(coolify, dbId);
     if (!db.internal_db_url) {
         throw new Error(`platform:integrations: database ${dbId} has no internal_db_url yet; not deploying the integrations host without a database`);
     }
@@ -5029,11 +5038,27 @@ export class ProvidersPlatformCoolifyReader {
         if (recordedAppId) {
             try {
                 const app = await this.client.getApplication(recordedAppId);
+                // The scheduler's database status, so `planJobs` can see a stopped
+                // one. Left out when it cannot be read: unknown is not "stopped".
+                let databaseStatus;
+                const databaseId = recorded[JOBS_DATABASE_SCOPE_KEY];
+                if (databaseId) {
+                    try {
+                        databaseStatus = (await this.client.getDatabase(databaseId)).status;
+                    }
+                    catch {
+                        databaseStatus = undefined;
+                    }
+                }
                 resources.push({
                     system: 'coolify',
                     kind: 'jobs',
                     key: JOBS_SCHEDULER_KEY,
-                    config: { uuid: app.uuid, status: app.status },
+                    config: {
+                        uuid: app.uuid,
+                        status: app.status,
+                        ...(databaseStatus !== undefined && { databaseStatus }),
+                    },
                 });
             }
             catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.2",
+  "version": "0.16.4",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",