@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/migrations/0052_platform_mail_relay.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: `mail_relay` true puts one shared relay container on host
+-- port 25, which routes each message by recipient domain to a company's own
+-- mail server or to the platform's; false (the default) keeps the platform
+-- Stalwart bound to port 25 directly. Mirrors src/store/schema.ts's
+-- `foundryDeclaredPlatform` table addition.
+
+alter table foundry_declared_platform
+  add column if not exists mail_relay boolean not null default false;

package/dist/migrations/0053_heartbeats_provider.sql

@@ -0,0 +1,9 @@
+-- @wtfalch/foundry: foundry#544 -- which Healthchecks instance manages the
+-- platform's heartbeat checks, decoupled from whether foundry also deploys
+-- its own self-hosted server (`hc_enabled`, foundry#540). 'self-hosted' is
+-- the default and today's only behaviour; 'hosted' needs no self-hosted
+-- server applied at all. Mirrors `src/store/schema.ts`'s
+-- `foundryDeclaredPlatform` table addition.
+
+alter table foundry_declared_platform
+  add column if not exists heartbeats_provider text not null default 'self-hosted';

package/dist/migrations/0053_org_version_pin.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: a company's version hold. `version_pin` is a json object of
+-- part to git ref or image tag (auth, mail, files, jobs, sfu, calls); null
+-- follows the platform. Additive. Mirrors src/store/schema.ts's `declaredOrgs`.
+
+alter table foundry_declared_orgs
+  add column if not exists version_pin jsonb;

package/dist/org.d.ts

@@ -316,7 +316,14 @@ export interface HostingEntry {
     hostnames: string[];
     /** A Postgres database beside the app. At most one entry per org. */
     database: boolean;
-    /** Deploy on every push to `branch`. Default: `true`. */
+    /**
+     * The Linux capabilities of the entry's app container. Absent or `'restricted'`: all dropped, then only the
+     * few a web server or node entrypoint needs added back. `'standard'`: Docker's defaults minus raw sockets,
+     * device nodes, file capabilities, chroot and audit writes. A fallback for an image that will not start
+     * restricted.
+     */
+    capabilities?: 'restricted' | 'standard';
+    /** Deploy on every push to `branch`. A host should declare `false`; foundry creates every other app with auto-deploy off. */
     autoDeploy: boolean;
     /**
      * Cloudflare Access gates on this entry's own `hostnames`. Empty means no
@@ -486,13 +493,11 @@ export declare function appEntry(hosting: HostingConfig): HostingEntry | undefin
  * sends from. Each is read from `StepExecutionContext.recordedIds()` in
  * `executor.ts`'s `pushAppEnv`, never minted again there.
  */
-export type AppEnvSource = 'filesOrganisationId' | 'aiOrganisationId' | 'mailDomain' | 'sharedSecret' | 'platformMailKey';
+export type AppEnvSource = 'filesOrganisationId' | 'aiOrganisationId' | 'mailDomain' | 'sharedSecret';
 /**
- * Two sources are secrets. `sharedSecret` is {@link EnvSharedSecret}.
- * `platformMailKey` is the platform's held Lettermint key, handed over as the
- * value of the declared env name (the platform's own apps call it
- * `LETTERMINT_API_TOKEN`). Any hosting entry of any customer org may name it
- * (William, 2026-10-04): mail is Lettermint, and the key is the platform's.
+ * `sharedSecret` is the one secret source: {@link EnvSharedSecret}. The
+ * platform's Lettermint key is not a source any more (2026-10-11): each
+ * company uses its own mail key.
  */
 export declare const APP_ENV_SOURCES: ReadonlySet<AppEnvSource>;
 /** The sources whose value is a secret: resolved at apply time, never recorded. */
@@ -516,6 +521,29 @@ export declare function validateHosting(hosting: HostingConfig, names?: {
     locked: ReadonlySet<string>;
 }): string | null;
 export declare function validateDomain(domain: string): string | null;
+/**
+ * A broker entry name foundry writes itself: Archon's, and any company's Boule.
+ * A hosting entry may not declare that it replaces one.
+ */
+export declare function isFoundryOwnedBrokerEntryName(name: string): boolean;
+/**
+ * `null` when `domain` may be claimed by company `orgId`, given the platform's
+ * apex and owner company and every other company's declared domain; otherwise
+ * the reason it may not. The platform's apex and anything under it belong to
+ * the owner company alone, and no company takes a parent or subdomain of
+ * another's, since Cloudflare would resolve both to one zone.
+ */
+export declare function validateDomainClaim(domain: string, claim: {
+    orgId: string;
+    platform: {
+        apex: string;
+        ownerOrgId: string;
+    } | null;
+    others: readonly {
+        id: string;
+        domain: string | null;
+    }[];
+}): string | null;
 /**
  * `null` when `site` is valid; otherwise the reason it is not (#101).
  *
@@ -526,11 +554,9 @@ export declare function validateDomain(domain: string): string | null;
  * and cms there (`site`), never both -- both would otherwise fight over the
  * same hostname (https://github.com/wtfalch/foundry/issues/99).
  *
- * - `site.enabled` requires `domain` to be set -- a site with nowhere to
- *   live is not a site.
- * - `site.enabled` requires `site.usesDomain` -- unlike mail, chat, calls
- *   and the issuer, the site has no meaning anywhere but the org's own
- *   domain, so turning it on always means the domain opt-in too.
+ * - `site.enabled` with a `domain` requires `site.usesDomain`: the site then
+ *   lives on the domain. Without a `domain` it lives on `<slug>.oikos.host`
+ *   and `site.usesDomain` must be off.
  * - `site.enabled` and `hosting.enabled` cannot both be on.
  * - `site.enabled` refuses an `issuerApps` entry named `cms`: the fixed cms
  *   client (#139, `plan/diff.ts`'s `planCmsClient`) already owns the
@@ -548,6 +574,40 @@ export declare function validateSite(org: DeclaredOrg): string | null;
  * reason to pin at all.
  */
 export declare function validateCalls(org: DeclaredOrg): string | null;
+/** The parts of a company that can be held on their own version. */
+export declare const VERSION_PIN_PARTS: readonly ["auth", "mail", "files", "jobs", "sfu", "calls"];
+export type VersionPinPart = (typeof VERSION_PIN_PARTS)[number];
+/**
+ * A part held at a git ref (auth, files, jobs) or an image tag (mail, sfu, calls). Absent part: the platform's value.
+ * `calls` is the Synapse tag of the calls stack. It is used when the stack is created; a running stack is not moved
+ * (nothing patches the image tag of an existing app, see the Synapse create in `plan/executor.ts`).
+ */
+export type VersionPin = Partial<Record<VersionPinPart, string>>;
+/**
+ * `versionPin` holds parts of a company on an older release while others move.
+ * Every value is a fixed ref or tag: a floating one would defeat the hold.
+ * Also run on a stored value when it is read, so a bad row is not trusted.
+ */
+export declare function validateVersionPin(org: Pick<DeclaredOrg, 'versionPin'>): string | null;
+/**
+ * Every company runs its own sign-in, mail, files, jobs and calls SFU in its own containers, the platform's owner company too.
+ * A company without a domain runs them on oikos.host.
+ */
+export interface ServicesConfig {
+    /** true: own copies of the services. false (default): the platform's shared ones. */
+    own: boolean;
+    /**
+     * Which slice of the server's SFU ports this company's media server takes.
+     * Required when `own` and `calls.enabled`. 1 to {@link SFU_SLOT_MAX}.
+     * Slice n holds UDP (50000 + (n-1)*500) .. (50000 + n*500 - 1) and TCP 7881 + n.
+     */
+    sfuSlot?: number | null;
+}
+export declare const SFU_SLOT_MAX = 20;
+/** The only reader of `services.own`. Every company runs its own services, the platform's owner company too; a company without a domain runs them on oikos.host. */
+export declare function ownsServices(org: Pick<DeclaredOrg, 'services'>): boolean;
+/** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
+export declare function validateServices(org: DeclaredOrg): string | null;
 /**
  * Per-org SSO. Decided to exist in #14 ("Also in scope") and its resolved
  * research #3 ("per-org SSO code exists unused"); nothing about its
@@ -822,6 +882,10 @@ export interface DeclaredOrg {
     site: SiteConfig;
     /** `enabled: false`, `issuerApps: []` by default -- a brand new org has no hosted app (#71). */
     hosting: HostingConfig;
+    /** Absent means `{ own: false }`. Optional so every existing literal and test fixture compiles unchanged, as `calls.versionPin` and `MailConfig.mailApps` do. */
+    services?: ServicesConfig;
+    /** Parts of this company held on their own version. Absent or null follows the platform. Ignored for the owner company. */
+    versionPin?: VersionPin | null;
     sso: SsoConfig;
     guests: GuestsConfig;
     solo: SoloConfig;

package/dist/org.js

@@ -1,4 +1,4 @@
-import { floatingTagBlocked } from './bootstrap/versions.js';
+import { floatingRefBlocked, floatingTagBlocked } from './bootstrap/versions.js';
 /** {@link MailConfig.mailApps} when the org declares none of its own (#34, decided 2026-09-30). */
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
@@ -41,24 +41,18 @@ export function appEntry(hosting) {
     return hosting.entries.find((entry) => entry.key === APP_ENTRY_KEY);
 }
 /**
- * Two sources are secrets. `sharedSecret` is {@link EnvSharedSecret}.
- * `platformMailKey` is the platform's held Lettermint key, handed over as the
- * value of the declared env name (the platform's own apps call it
- * `LETTERMINT_API_TOKEN`). Any hosting entry of any customer org may name it
- * (William, 2026-10-04): mail is Lettermint, and the key is the platform's.
+ * `sharedSecret` is the one secret source: {@link EnvSharedSecret}. The
+ * platform's Lettermint key is not a source any more (2026-10-11): each
+ * company uses its own mail key.
  */
 export const APP_ENV_SOURCES = new Set([
     'filesOrganisationId',
     'aiOrganisationId',
     'mailDomain',
     'sharedSecret',
-    'platformMailKey',
 ]);
 /** The sources whose value is a secret: resolved at apply time, never recorded. */
-export const SECRET_APP_ENV_SOURCES = new Set([
-    'sharedSecret',
-    'platformMailKey',
-]);
+export const SECRET_APP_ENV_SOURCES = new Set(['sharedSecret']);
 /** The held-key ref of an org's shared secret. */
 export const sharedSecretRef = (orgId, name) => `foundry:shared-secret:${orgId}:${name}`;
 const ISSUER_APP_KINDS = new Set(['web', 'native', 'api']);
@@ -336,6 +330,11 @@ function validateHostingEntry(entry, enabled) {
     if (entry.healthPath !== null && !entry.healthPath.startsWith('/')) {
         return `${at} healthPath must start with '/', or be null`;
     }
+    if (entry.capabilities !== undefined &&
+        entry.capabilities !== 'restricted' &&
+        entry.capabilities !== 'standard') {
+        return `${at} capabilities must be 'restricted' or 'standard'`;
+    }
     if (entry.database && !enabled) {
         return `${at} database requires hosting.enabled`;
     }
@@ -347,6 +346,9 @@ function validateHostingEntry(entry, enabled) {
             return `${at} env '${name}' is set by foundry and cannot be declared`;
         }
         if (typeof value !== 'string') {
+            if (value?.from === 'platformMailKey') {
+                return `${at} env '${name}' has an unknown source 'platformMailKey': each company uses its own mail key`;
+            }
             if (!APP_ENV_SOURCES.has(value?.from)) {
                 return `${at} env '${name}' has an unknown source '${value?.from}'`;
             }
@@ -387,6 +389,10 @@ function validateEntryAuth(entry, hosting, domain) {
         (typeof auth.replacesBrokerEntry !== 'string' || auth.replacesBrokerEntry === '')) {
         return `${at} replacesBrokerEntry must be the non-empty name of a broker entry`;
     }
+    if (typeof auth.replacesBrokerEntry === 'string' &&
+        isFoundryOwnedBrokerEntryName(auth.replacesBrokerEntry)) {
+        return `${at} replacesBrokerEntry '${auth.replacesBrokerEntry}' is a broker entry foundry writes itself`;
+    }
     if (!hasExactHostname(entry, hosting, domain)) {
         return `${at} needs an exact hostname to sign in at`;
     }
@@ -627,6 +633,9 @@ function urlHasPassword(value) {
  * as {@link validateBuyerIdentity}/{@link validateOwners}.
  */
 const DOMAIN_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const SHARED_ZONE = 'oikos.host';
+/** The mail relay accepts only a letters-only top-level label (`plan/mail-relay.ts`); one domain it rejects would block the relay step for every company. */
+const RELAY_TLD = /^[a-z]{2,63}$/;
 export function validateDomain(domain) {
     if (domain.length > 253) {
         return `domain '${domain}' exceeds 253 characters`;
@@ -640,6 +649,45 @@ export function validateDomain(domain) {
             return `domain '${domain}' has an invalid label '${label}': must be 1-63 characters, lowercase a-z, 0-9 and hyphen, and may not start or end with a hyphen`;
         }
     }
+    if (!RELAY_TLD.test(labels[labels.length - 1] ?? '')) {
+        return `domain '${domain}' must end in a top-level label of 2 to 63 letters`;
+    }
+    // oikos.host is the shared zone every company without a domain runs on; no company owns it or a name under it.
+    if (domain === SHARED_ZONE || domain.endsWith(`.${SHARED_ZONE}`)) {
+        return `domain '${domain}' is on ${SHARED_ZONE}, the shared zone for companies without a domain; a company cannot own it`;
+    }
+    return null;
+}
+/**
+ * A broker entry name foundry writes itself: Archon's, and any company's Boule.
+ * A hosting entry may not declare that it replaces one.
+ */
+export function isFoundryOwnedBrokerEntryName(name) {
+    return name === 'archon' || name.endsWith('-boule');
+}
+/** True when one name is the other or a subdomain of the other. */
+function domainsOverlap(a, b) {
+    return a === b || a.endsWith(`.${b}`) || b.endsWith(`.${a}`);
+}
+/**
+ * `null` when `domain` may be claimed by company `orgId`, given the platform's
+ * apex and owner company and every other company's declared domain; otherwise
+ * the reason it may not. The platform's apex and anything under it belong to
+ * the owner company alone, and no company takes a parent or subdomain of
+ * another's, since Cloudflare would resolve both to one zone.
+ */
+export function validateDomainClaim(domain, claim) {
+    const { platform } = claim;
+    if (platform && claim.orgId !== platform.ownerOrgId && domainsOverlap(domain, platform.apex)) {
+        return `domain '${domain}' overlaps the platform's own domain, which only the owner company may use`;
+    }
+    for (const other of claim.others) {
+        if (other.id === claim.orgId || other.domain === null)
+            continue;
+        if (domainsOverlap(domain, other.domain)) {
+            return `domain '${domain}' is a parent or subdomain of ${other.domain}, which another company declares`;
+        }
+    }
     return null;
 }
 /**
@@ -652,11 +700,9 @@ export function validateDomain(domain) {
  * and cms there (`site`), never both -- both would otherwise fight over the
  * same hostname (https://github.com/wtfalch/foundry/issues/99).
  *
- * - `site.enabled` requires `domain` to be set -- a site with nowhere to
- *   live is not a site.
- * - `site.enabled` requires `site.usesDomain` -- unlike mail, chat, calls
- *   and the issuer, the site has no meaning anywhere but the org's own
- *   domain, so turning it on always means the domain opt-in too.
+ * - `site.enabled` with a `domain` requires `site.usesDomain`: the site then
+ *   lives on the domain. Without a `domain` it lives on `<slug>.oikos.host`
+ *   and `site.usesDomain` must be off.
  * - `site.enabled` and `hosting.enabled` cannot both be on.
  * - `site.enabled` refuses an `issuerApps` entry named `cms`: the fixed cms
  *   client (#139, `plan/diff.ts`'s `planCmsClient`) already owns the
@@ -666,12 +712,14 @@ export function validateDomain(domain) {
  *   to.
  */
 export function validateSite(org) {
-    if (org.site.enabled && !org.domain) {
-        return 'site.enabled requires domain';
-    }
-    if (org.site.enabled && !org.site.usesDomain) {
+    // A company without a domain has its site at `<slug>.oikos.host` and its editor
+    // at `<slug>-cms.oikos.host`; `site.usesDomain` is then off, and on with a domain.
+    if (org.site.enabled && org.domain && !org.site.usesDomain) {
         return 'site.enabled requires site.usesDomain';
     }
+    if (org.site.enabled && !org.domain && org.site.usesDomain) {
+        return 'site.usesDomain requires domain';
+    }
     if (org.site.enabled && org.hosting.enabled) {
         return 'site.enabled and hosting.enabled cannot both be on';
     }
@@ -691,6 +739,9 @@ export function validateSite(org) {
  * reason to pin at all.
  */
 export function validateCalls(org) {
+    // `usesDomain` serves the calls service at `calls.<domain>`; a company without a domain has none.
+    if (org.calls.usesDomain && org.domain === null)
+        return 'calls.usesDomain requires domain';
     const pin = org.calls.versionPin;
     if (!pin)
         return null;
@@ -706,6 +757,71 @@ export function validateCalls(org) {
     }
     return null;
 }
+/** The parts of a company that can be held on their own version. */
+export const VERSION_PIN_PARTS = ['auth', 'mail', 'files', 'jobs', 'sfu', 'calls'];
+const VERSION_PIN_LABELS = {
+    auth: { label: 'auth', example: 'v1.4.0', gitRef: true },
+    mail: { label: 'Stalwart', example: 'v0.16.24', gitRef: false },
+    files: { label: 'files', example: 'v1.4.0', gitRef: true },
+    jobs: { label: 'jobs', example: 'v1.4.0', gitRef: true },
+    sfu: { label: 'LiveKit', example: 'v1.9.0', gitRef: false },
+    calls: { label: 'Synapse', example: 'v1.161.0', gitRef: false },
+};
+const VERSION_PIN_VALUE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+/**
+ * `versionPin` holds parts of a company on an older release while others move.
+ * Every value is a fixed ref or tag: a floating one would defeat the hold.
+ * Also run on a stored value when it is read, so a bad row is not trusted.
+ */
+export function validateVersionPin(org) {
+    const pin = org.versionPin;
+    if (pin === undefined || pin === null)
+        return null;
+    if (typeof pin !== 'object' || Array.isArray(pin))
+        return 'versionPin must be an object';
+    for (const [part, value] of Object.entries(pin)) {
+        if (!VERSION_PIN_PARTS.includes(part)) {
+            return `versionPin.${part} is not a part; use auth, mail, files, jobs, sfu or calls`;
+        }
+        if (typeof value !== 'string' || value.trim() === '') {
+            return `versionPin.${part} must not be empty; remove the part to follow the platform`;
+        }
+        const meta = VERSION_PIN_LABELS[part];
+        const blocked = meta.gitRef
+            ? floatingRefBlocked(meta.label, value, meta.example)
+            : floatingTagBlocked(meta.label, value, meta.example);
+        if (blocked)
+            return `versionPin.${part} ${blocked}`;
+        if (!VERSION_PIN_VALUE.test(value) || value.includes('..')) {
+            return `versionPin.${part} must be a release name of letters, digits, ".", "_", "+" and "-" (at most 128 characters, no ".."); it goes to Coolify as a git ref or an image tag`;
+        }
+    }
+    return null;
+}
+export const SFU_SLOT_MAX = 20;
+/** The only reader of `services.own`. Every company runs its own services, the platform's owner company too; a company without a domain runs them on oikos.host. */
+export function ownsServices(org) {
+    return org.services?.own === true;
+}
+/** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
+export function validateServices(org) {
+    const slot = org.services?.sfuSlot ?? null;
+    if (!ownsServices(org)) {
+        return slot === null ? null : 'services.sfuSlot needs services.own';
+    }
+    const hasDomain = org.domain !== null;
+    if (org.issuer.usesDomain !== hasDomain) {
+        return 'services.own: issuer.usesDomain must be on exactly when the company has a domain';
+    }
+    if (org.mail.mode !== 'off' && org.mail.usesDomain !== hasDomain) {
+        return 'services.own: mail.usesDomain must be on exactly when the company has a domain';
+    }
+    if (org.calls.enabled &&
+        (slot === null || !Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX)) {
+        return `services.sfuSlot must be an integer from 1 to ${SFU_SLOT_MAX} when calls are enabled`;
+    }
+    return null;
+}
 const ORG_NUMBER_PATTERN = /^\d{9}$/;
 /**
  * `null` when `buyer` is valid; otherwise the reason it is not, for a caller

package/dist/plan/backup-gate.d.ts

@@ -0,0 +1,93 @@
+import type { OrgId } from '../org.js';
+import type { VersionChangeItem } from '../plan.js';
+import { type CoolifyPort } from './executor.js';
+/** A confirmed stateful upgrade needs a dump that finished within this many hours. */
+export declare const BACKUP_MAX_AGE_HOURS = 26;
+/** A move deletes the databases, so the dump it relies on is at most this old. */
+export declare const MOVE_BACKUP_MAX_AGE_MINUTES = 60;
+/**
+ * Thrown before any step runs when a confirmed upgrade of a stateful service
+ * has no fresh finished backup. The message names the service and nothing
+ * else: no database name, uuid or URL. There is no override.
+ */
+export declare class UpgradeBackupMissingError extends Error {
+    readonly service: string;
+    /** True when this Coolify has no executions route, so only the schedule was checked. */
+    readonly scheduleOnly: boolean;
+    constructor(service: string, 
+    /** True when this Coolify has no executions route, so only the schedule was checked. */
+    scheduleOnly?: boolean);
+}
+/**
+ * A network move is refused when the host has no backup gate, when a database of the project has no
+ * verified dump under {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes old, or when the project holds
+ * something no dump covers (the company's mail server, an app with a volume) or cannot be read. The
+ * message names no database, app, uuid or URL. There is no override: such a company is moved by hand.
+ */
+export declare class NetworkMoveBackupMissingError extends Error {
+    readonly reason: 'no-gate' | 'no-backup' | 'by-hand';
+    constructor(reason: 'no-gate' | 'no-backup' | 'by-hand');
+}
+export interface BackupGatePorts {
+    /** The company's recorded ids (`AppliedState.serviceIds`): database uuids and `backup_<db>` schedule uuids. */
+    recordedIds: Readonly<Record<string, string>>;
+    coolify: Pick<CoolifyPort, 'listDatabaseBackups' | 'raw'> & Partial<Pick<CoolifyPort, 'listDatabaseBackupExecutions'>>;
+    /** The org's id, for the `app` database key. Unused when `scope` is given. */
+    orgId: OrgId;
+    /**
+     * The platform's databases instead of a company's: the recorded-id key of
+     * each database, and which of them an upgrade of a service migrates. The
+     * platform's backup steps record no schedule uuid, so the schedule is found
+     * by listing the database's schedules (enabled, saved to S3).
+     */
+    scope?: {
+        keys: Readonly<Record<string, string>>;
+        forService(service: string): readonly string[] | 'all';
+    };
+    now?: () => number;
+}
+/**
+ * Refuses a confirmed upgrade of a stateful service whose database has no
+ * finished backup in the last {@link BACKUP_MAX_AGE_HOURS} hours. Runs after
+ * `unconfirmedUpgrades` and before any step. A service whose database the
+ * company does not have passes (there is nothing to migrate); a database that
+ * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
+ * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
+ * not covered here (plan note `backup-not-covered:mail`).
+ *
+ * Where this Coolify has no executions route, the fallback is that the
+ * schedule exists, is enabled and saves to S3; that proves a dump is
+ * scheduled, not that one ran, so it passes with no backup id.
+ *
+ * Returns the uuid of the newest fresh execution across the checked
+ * databases, for the caller to record as `backupId`, or `null`.
+ */
+export declare function requireFreshBackupsForUpgrades(plan: {
+    versionChanges?: readonly VersionChangeItem[];
+}, confirmed: readonly string[] | undefined, ports: BackupGatePorts): Promise<{
+    backupId: string | null;
+}>;
+export interface MoveGatePorts {
+    /** The company's Coolify project (`coolify_project`). */
+    projectUuid: string | undefined;
+    /** The company runs its own mail server: its volume has no dump. */
+    ownsMail: boolean;
+    coolify: BackupGatePorts['coolify'] & Partial<Pick<CoolifyPort, 'listResources' | 'listStorages'>>;
+    now?: () => number;
+}
+/**
+ * The gate for a move to the company's own network, which deletes every database of the project. It
+ * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.
+ * It passes only when every database in the project has a successful dump, seen in Coolify's
+ * executions, from the last {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes, and the project holds nothing
+ * a dump does not cover. It refuses (`by-hand`) the company's own mail server and any app with a
+ * volume other than its log volume, and (`no-backup`) a database with no schedule or no execution, an
+ * unreadable list, and a Coolify with no executions route. A company with neither database nor volume passes.
+ */
+export declare function requireFreshBackupsForMove(ports: MoveGatePorts): Promise<void>;
+/**
+ * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
+ * integrations each migrate their own database when the new container starts. The owner company runs its own
+ * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ */
+export declare function platformDatabasesForService(service: string): readonly string[] | 'all';