@wtfalch/foundry 0.21.0 → 0.22.0

package/dist/plan/platform-providers.js

@@ -8,7 +8,7 @@ import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment,
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -318,6 +318,18 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
+        // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
+        if (this.archon?.runsInsideApp) {
+            blocked.archonRunsInsideApp = true;
+            // A deploy the step triggered and did not wait for: while it runs, a
+            // second deploy must not be planned.
+            const deployment = recordedIds[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY];
+            if (platform.archon.enabled &&
+                deployment &&
+                (await archonDeploymentState(this.archon.coolify, deployment)) === 'running') {
+                blocked.archonDeployRunning = `Archon is blocked, not planned: its deployment ${deployment} is still running; plan again when it has finished`;
+            }
+        }
         return blocked;
     }
     /**
@@ -347,7 +359,18 @@ export class FoundryPlatformStepExecutor {
                 !brokerDrifted &&
                 !bootstrapOperatorDrifted &&
                 (await archonRollingUpdateDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]));
-            if (accessDrifted || brokerDrifted || bootstrapOperatorDrifted || rollingUpdateDrifted)
+            // The deployment the step triggered failed or Coolify does not know it:
+            // plan the step again, which deploys again. A finished one is confirmed
+            // by the next run of the step (keys-synced), see `provisionPlatformArchon`.
+            const deployment = recordedIds[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY];
+            const redeployFailed = this.archon.runsInsideApp === true &&
+                Boolean(deployment) &&
+                (await archonDeploymentState(this.archon.coolify, deployment)) === 'failed';
+            if (accessDrifted ||
+                brokerDrifted ||
+                bootstrapOperatorDrifted ||
+                rollingUpdateDrifted ||
+                redeployFailed)
                 result.archon = true;
         }
         if (platform.auth.enabled && this.auth) {
@@ -596,7 +619,25 @@ export class FoundryPlatformStepExecutor {
         if (!db.internal_db_url) {
             throw new Error(`platform step coolify:jobs: database ${dbId} has no internal_db_url yet; not deploying the scheduler without a database`);
         }
-        const envs = [{ key: 'DATABASE_URL', value: db.internal_db_url }];
+        // The scheduler migrates as `DATABASE_URL_OWNER` and creates its own
+        // `jobs_rt` role from `DATABASE_URL` (jobs README, "Deploying"). An app
+        // with no owner URL still holds the owner's URL in `DATABASE_URL`, so
+        // that is never reused: a runtime URL is minted, once, and kept after.
+        const hasOwnerUrl = (await coolify.listEnvs(appId)).some((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview && e.value);
+        const runtimeUrl = await ensureAiRuntimeUrl(coolify, hasOwnerUrl ? [appId] : [], db.internal_db_url, 'platform step coolify:jobs');
+        const envs = [
+            { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
+            { key: 'DATABASE_URL', value: runtimeUrl },
+        ];
+        // Whether the scheduler runs on envs other than the ones written below.
+        // Marked and persisted before the first write, and cleared only after the
+        // deploy, so a run that dies in between leaves the mark and the next run
+        // deploys again (`CLAUDE.md` rule 4).
+        const pending = Boolean(recorded[JOBS_DEPLOY_PENDING_SCOPE_KEY]) || (await envsDiffer(coolify, appId, envs));
+        if (pending) {
+            context.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '1');
+            await context.persist?.();
+        }
         // SCHEDULER_ADMIN_TOKEN gates the admin API the org registrations use
         // (jobs README, "The admin API"); unset, every admin route answers 401.
         // Delivered to the host before it is written to the app, so a failed
@@ -629,8 +670,12 @@ export class FoundryPlatformStepExecutor {
         // a redeploy, so deploy after a create or a new token. Also when it is not
         // running, so a deploy that failed on an earlier run is retried.
         const running = (await coolify.getApplication(appId)).status?.startsWith('running') ?? false;
-        if (!existingApp || tokenJustSet || !running)
+        if (!existingApp || tokenJustSet || pending || !running)
             await coolify.deploy(appId);
+        if (pending) {
+            context.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '');
+            await context.persist?.();
+        }
         return { resourceId: appId };
     }
 }
@@ -2578,6 +2623,7 @@ async function provisionPlatformArchon(context, deps) {
     const appliedGitRef = recorded[PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY];
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
+    const selfRedeploy = deps.runsInsideApp === true;
     if (deps.accessEmails.length === 0) {
         throw new Error('platform:archon: no Access emails given; refusing to put Archon behind an Access app nobody can pass');
     }
@@ -3008,7 +3054,17 @@ async function provisionPlatformArchon(context, deps) {
     // patch above actually takes effect on the running container, not just on
     // Coolify's stored config.
     const rollingUpdateApplied = recorded[PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY] === '1';
-    const archonDeployedNow = keyUnsynced ||
+    // The deployment an earlier run triggered without waiting: read before
+    // deciding whether to deploy again.
+    const priorDeployment = selfRedeploy ? recorded[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY] : undefined;
+    const deployState = priorDeployment
+        ? await archonDeploymentState(deps.coolify, priorDeployment)
+        : 'none';
+    if (deployState === 'running' || deployState === 'unreadable') {
+        throw new Error(`platform:archon: the deployment ${priorDeployment} cannot be confirmed yet (${deployState === 'running' ? 'still running' : 'status unreadable'}); plan again later`);
+    }
+    const archonDeployedNow = (keyUnsynced && deployState !== 'finished') ||
+        deployState === 'failed' ||
         app.justCreated ||
         !app.running ||
         changed ||
@@ -3017,7 +3073,7 @@ async function provisionPlatformArchon(context, deps) {
         appliedGitRef !== gitRef ||
         !rollingUpdateApplied ||
         recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] !== hostname;
-    if (archonDeployedNow) {
+    if (archonDeployedNow && !selfRedeploy) {
         // #467: cleared before the deploy below is even attempted, not after --
         // a deploy that then fails, or a crash before `waitForHealthyVersion`
         // passes, must leave this run's attempt unconfirmed. Recording it only
@@ -3089,13 +3145,14 @@ async function provisionPlatformArchon(context, deps) {
     // Coolify's own deployment record finished, which is what actually closes
     // the loophole named in #252 (an old container staying healthy while the
     // deployment itself fails).
-    if (archonDeployedNow) {
+    if (archonDeployedNow && !selfRedeploy) {
         await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
     }
     // #398: the deployment finished and answers health, so Archon now runs with
     // the key id its env carries. `provisionPlatformIntegrations` drops the
     // previous public key only on this marker.
-    if (keyUnsynced && integrationsKeyId) {
+    // With `runsInsideApp` only once Coolify's deployment record says it finished.
+    if (keyUnsynced && integrationsKeyId && (!selfRedeploy || deployState === 'finished')) {
         await record(PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, integrationsKeyId);
     }
     // #475: confirmed only now, after the health check above has passed on a
@@ -3118,6 +3175,36 @@ async function provisionPlatformArchon(context, deps) {
     // it.
     await record(PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, brokerAppId);
     await record(PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, bootstrapOperator ?? 'none');
+    // The host runs inside this app: every marker is recorded above, so the
+    // deploy goes last and is not waited for -- the old container stops during
+    // it, and the response, the lease and the audit row must be done first.
+    if (selfRedeploy && !archonDeployedNow && deployState === 'finished') {
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, ''); // confirmed above
+    }
+    if (selfRedeploy && archonDeployedNow) {
+        await record(`coolify:app:${PLATFORM_ARCHON_KEY}`, appId);
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, 'pending');
+        let deploymentUuid;
+        try {
+            // `force` takes the branch that always creates a real deployment record
+            // (a skipped one answers with a uuid Coolify never stored).
+            const started = (await deps.coolify.deploy(appId, true));
+            const uuid = Array.isArray(started) ? started[0]?.deployment_uuid : undefined;
+            if (typeof uuid !== 'string' || !uuid) {
+                throw new Error('platform:archon: Coolify answered the deploy with no deployment_uuid');
+            }
+            deploymentUuid = uuid;
+        }
+        catch (error) {
+            // Not triggered: forget the applied ref so the next plan runs the step again.
+            await record(PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, '');
+            await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, '');
+            throw error;
+        }
+        // The next plan reads this deployment's status; a kill before this write
+        // leaves `pending`, which that plan reads as unconfirmed and plans again.
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, deploymentUuid);
+    }
     return { resourceId: appId };
 }
 // #211 round 6: mirrors `wtfalch/auth/broker/src/apps.ts`'s own `isValidFrom`
@@ -3538,6 +3625,28 @@ async function archonBootstrapOperatorDrifted(coolify, appId, recordedIds) {
  * version of this check never actually fired. `custom_network_aliases` and
  * `health_check_enabled` are both top-level there.
  */
+/**
+ * The state of the deployment Archon's step triggered without waiting
+ * (`PlatformArchonDeps.runsInsideApp`), from Coolify's own deployment record:
+ * `running` (queued or in progress), `finished`, `failed` (failed, cancelled,
+ * its uuid never recorded, or unknown to Coolify -- a 404), or `unreadable`
+ * for any other error. Status and a served request cannot tell a failed build
+ * from a success (the old container keeps serving), so this record is the
+ * only honest answer.
+ */
+async function archonDeploymentState(coolify, deploymentUuid) {
+    if (deploymentUuid === 'pending')
+        return 'failed';
+    try {
+        const { status } = await coolify.getDeployment(deploymentUuid);
+        if (status === 'queued' || status === 'in_progress')
+            return 'running';
+        return status === 'finished' ? 'finished' : 'failed';
+    }
+    catch (error) {
+        return isNotFoundError(error) ? 'failed' : 'unreadable';
+    }
+}
 async function archonRollingUpdateDrifted(coolify, appId) {
     if (!appId)
         return false;
@@ -4185,7 +4294,7 @@ async function provisionPlatformAi(context, deps) {
     // ---- env -----------------------------------------------------------------
     // Both database URLs are live credentials: handed to `bulkUpsertEnvs` and
     // nowhere else, never returned, recorded, logged or put in an error.
-    const runtimeUrl = await ensureAiRuntimeUrl(coolify, [runner.appId, worker.appId, migrate.appId], ownerUrl);
+    const runtimeUrl = await ensureAiRuntimeUrl(coolify, [runner.appId, worker.appId, migrate.appId], ownerUrl, 'platform:ai');
     const migrateEnvs = [
         { key: 'DATABASE_URL_OWNER', value: ownerUrl },
         { key: 'DATABASE_URL', value: runtimeUrl },
@@ -4556,7 +4665,7 @@ async function waitForAiMigration(coolify, appId, runtime, sleep) {
  * inside a try: Node's parse error carries the whole input, credential
  * included, so it is replaced with a fixed message.
  */
-async function ensureAiRuntimeUrl(coolify, appIds, ownerUrl) {
+async function ensureAiRuntimeUrl(coolify, appIds, ownerUrl, step) {
     for (const appId of appIds) {
         const existing = (await coolify.listEnvs(appId)).find((e) => e.key === 'DATABASE_URL' && !e.is_preview && e.value);
         if (existing)
@@ -4569,11 +4678,11 @@ async function ensureAiRuntimeUrl(coolify, appIds, ownerUrl) {
         ({ host, pathname, search } = new URL(ownerUrl));
     }
     catch {
-        throw new Error("platform:ai: the database's internal_db_url could not be parsed");
+        throw new Error(`${step}: the database's internal_db_url could not be parsed`);
     }
     const database = pathname.replace(/^\//, '');
     if (!/^[A-Za-z0-9_]+$/.test(database)) {
-        throw new Error("platform:ai: the database's name cannot form a runtime role name (letters, digits and _ only)");
+        throw new Error(`${step}: the database's name cannot form a runtime role name (letters, digits and _ only)`);
     }
     const password = randomBytes(24).toString('base64url');
     return `postgres://${database}_rt:${password}@${host}${pathname}${search}`;
@@ -7098,6 +7207,16 @@ export class ProvidersPlatformCoolifyReader {
                         databaseStatus = undefined;
                     }
                 }
+                // An app with no `DATABASE_URL_OWNER` predates the owner/runtime
+                // split, so `planJobs` plans the step again to set both URLs. Left
+                // out when the envs cannot be read: unknown is not "missing".
+                let ownerUrlMissing;
+                try {
+                    ownerUrlMissing = !(await this.client.listEnvs(app.uuid)).some((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview && e.value);
+                }
+                catch {
+                    ownerUrlMissing = undefined;
+                }
                 resources.push({
                     system: 'coolify',
                     kind: 'jobs',
@@ -7106,6 +7225,7 @@ export class ProvidersPlatformCoolifyReader {
                         uuid: app.uuid,
                         status: app.status,
                         ...(databaseStatus !== undefined && { databaseStatus }),
+                        ...(ownerUrlMissing && { ownerUrlMissing }),
                     },
                 });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -37,6 +37,7 @@
     "calls-sfu:deploy": "node scripts/calls-sfu-deploy.mjs"
   },
   "peerDependencies": {
+    "@wtfalch/providers": ">=0.7.4",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
@@ -44,7 +45,7 @@
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/edge": "0.9.0",
     "@wtfalch/email": "^0.17.0",
-    "@wtfalch/providers": "0.7.3",
+    "@wtfalch/providers": "0.7.5",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },