@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/backup-gate.js

@@ -0,0 +1,261 @@
+import { backupScopeKey, companyDatabaseKeys, databasesForService } from './company-backups.js';
+import { LOG_DIR } from './executor.js';
+/** A confirmed stateful upgrade needs a dump that finished within this many hours. */
+export const BACKUP_MAX_AGE_HOURS = 26;
+/** A move deletes the databases, so the dump it relies on is at most this old. */
+export const MOVE_BACKUP_MAX_AGE_MINUTES = 60;
+/** How long one Coolify call of the gate may take. */
+const GATE_CALL_TIMEOUT_MS = 30_000;
+/**
+ * Thrown before any step runs when a confirmed upgrade of a stateful service
+ * has no fresh finished backup. The message names the service and nothing
+ * else: no database name, uuid or URL. There is no override.
+ */
+export class UpgradeBackupMissingError extends Error {
+    service;
+    scheduleOnly;
+    constructor(service, 
+    /** True when this Coolify has no executions route, so only the schedule was checked. */
+    scheduleOnly = false) {
+        const note = scheduleOnly
+            ? ' (this Coolify has no executions route, so only the schedule was checked, and it is missing, disabled or not saved to S3)'
+            : '';
+        super(`upgrade of ${service} refused: no finished backup of its database in the last ${BACKUP_MAX_AGE_HOURS} hours${note}`);
+        this.service = service;
+        this.scheduleOnly = scheduleOnly;
+        this.name = 'UpgradeBackupMissingError';
+    }
+}
+/**
+ * A network move is refused when the host has no backup gate, when a database of the project has no
+ * verified dump under {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes old, or when the project holds
+ * something no dump covers (the company's mail server, an app with a volume) or cannot be read. The
+ * message names no database, app, uuid or URL. There is no override: such a company is moved by hand.
+ */
+export class NetworkMoveBackupMissingError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason === 'no-gate'
+            ? 'network move refused: this host has no backup gate, so a fresh backup cannot be checked'
+            : reason === 'no-backup'
+                ? `network move refused: not every database in the company's project has a finished dump from the last ${MOVE_BACKUP_MAX_AGE_MINUTES} minutes, checked in Coolify; take one now, or move this company by hand with docs/runbooks/network-move.md`
+                : "network move refused: the company's project holds something no backup covers (its mail server or an app with a volume), or Coolify could not be asked; move this company by hand with docs/runbooks/network-move.md");
+        this.reason = reason;
+        this.name = 'NetworkMoveBackupMissingError';
+    }
+}
+async function withinTimeout(call) {
+    let timer;
+    try {
+        return await Promise.race([
+            call(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), GATE_CALL_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Coolify 4.x answers `GET /databases/{uuid}/backups/{backup}/executions` with
+ * `{ executions: [{ uuid, filename, size, created_at, message, status }] }`,
+ * newest first; `status` is `success`, `failed` or `running`. Read from
+ * `routes/api.php` and `DatabasesController::list_backup_executions` on the
+ * v4.x branch, 2026-10-10; not run against a live instance. Anything else is
+ * a shape this gate cannot trust, so it throws.
+ */
+function parseExecutions(body) {
+    const list = Array.isArray(body) ? body : body?.executions;
+    if (!Array.isArray(list))
+        throw new Error('executions list has an unexpected shape');
+    return list.map((row) => {
+        const r = row;
+        if (!r ||
+            typeof r.uuid !== 'string' ||
+            typeof r.status !== 'string' ||
+            typeof r.created_at !== 'string') {
+            throw new Error('executions list has an unexpected shape');
+        }
+        return { uuid: r.uuid, status: r.status, created_at: r.created_at };
+    });
+}
+/** The executions of one schedule, or `null` when this Coolify has no such route. */
+async function readExecutions(coolify, databaseUuid, backupUuid) {
+    try {
+        const list = coolify.listDatabaseBackupExecutions?.bind(coolify);
+        if (list)
+            return parseExecutions(await withinTimeout(() => list(databaseUuid, backupUuid)));
+        return parseExecutions(await withinTimeout(() => coolify.raw('GET', `/databases/${databaseUuid}/backups/${backupUuid}/executions`)));
+    }
+    catch (e) {
+        if (isRouteMissing(e))
+            return null;
+        throw e;
+    }
+}
+function isRouteMissing(error) {
+    const status = error?.status;
+    if (typeof status === 'number')
+        return status === 404;
+    const message = error instanceof Error ? error.message : String(error);
+    return /^\S+ \S+ \S+ → 404:/.test(message);
+}
+/** The newest `success` execution that is not older than the window, or null. */
+function freshSuccess(executions, now, maxAgeMs = BACKUP_MAX_AGE_HOURS * 3_600_000, skewMs = 3_600_000) {
+    const oldest = now - maxAgeMs;
+    let best = null;
+    for (const execution of executions) {
+        if (execution.status !== 'success')
+            continue;
+        const at = Date.parse(execution.created_at);
+        if (Number.isNaN(at) || at < oldest || at > now + skewMs)
+            continue;
+        if (!best || at > best.at)
+            best = { execution, at };
+    }
+    return best?.execution ?? null;
+}
+/**
+ * Refuses a confirmed upgrade of a stateful service whose database has no
+ * finished backup in the last {@link BACKUP_MAX_AGE_HOURS} hours. Runs after
+ * `unconfirmedUpgrades` and before any step. A service whose database the
+ * company does not have passes (there is nothing to migrate); a database that
+ * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
+ * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
+ * not covered here (plan note `backup-not-covered:mail`).
+ *
+ * Where this Coolify has no executions route, the fallback is that the
+ * schedule exists, is enabled and saves to S3; that proves a dump is
+ * scheduled, not that one ran, so it passes with no backup id.
+ *
+ * Returns the uuid of the newest fresh execution across the checked
+ * databases, for the caller to record as `backupId`, or `null`.
+ */
+export async function requireFreshBackupsForUpgrades(plan, confirmed, ports) {
+    const now = (ports.now ?? Date.now)();
+    const keys = ports.scope?.keys ?? companyDatabaseKeys({ id: ports.orgId });
+    const names = Object.keys(keys);
+    const confirmedSet = new Set(confirmed ?? []);
+    let backupId = null;
+    let newest = 0;
+    for (const change of plan.versionChanges ?? []) {
+        if (!change.needsConfirmation || !confirmedSet.has(change.service))
+            continue;
+        const wanted = (ports.scope?.forService ?? databasesForService)(change.service);
+        const dbs = wanted === 'all' ? names : wanted;
+        for (const db of dbs) {
+            const databaseUuid = ports.recordedIds[keys[db]];
+            if (!databaseUuid)
+                continue;
+            let backupUuid = ports.recordedIds[backupScopeKey(db)];
+            if (!backupUuid && ports.scope) {
+                const schedules = await withinTimeout(() => ports.coolify.listDatabaseBackups(databaseUuid)).catch(() => []);
+                backupUuid = schedules.find((x) => x.enabled && x.save_s3)?.uuid;
+            }
+            if (!backupUuid)
+                throw new UpgradeBackupMissingError(change.service);
+            let executions;
+            try {
+                executions = await readExecutions(ports.coolify, databaseUuid, backupUuid);
+            }
+            catch {
+                // An unreadable list is not a fresh backup. The cause stays out of the
+                // message: it can carry a response body.
+                throw new UpgradeBackupMissingError(change.service);
+            }
+            if (executions === null) {
+                const schedules = await withinTimeout(() => ports.coolify.listDatabaseBackups(databaseUuid)).catch(() => []);
+                const ok = schedules.some((s) => s.uuid === backupUuid && s.enabled && s.save_s3);
+                if (!ok)
+                    throw new UpgradeBackupMissingError(change.service, true);
+                continue;
+            }
+            const fresh = freshSuccess(executions, now);
+            if (!fresh)
+                throw new UpgradeBackupMissingError(change.service);
+            const at = Date.parse(fresh.created_at);
+            if (at >= newest) {
+                newest = at;
+                backupId = fresh.uuid;
+            }
+        }
+    }
+    return { backupId };
+}
+/**
+ * The gate for a move to the company's own network, which deletes every database of the project. It
+ * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.
+ * It passes only when every database in the project has a successful dump, seen in Coolify's
+ * executions, from the last {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes, and the project holds nothing
+ * a dump does not cover. It refuses (`by-hand`) the company's own mail server and any app with a
+ * volume other than its log volume, and (`no-backup`) a database with no schedule or no execution, an
+ * unreadable list, and a Coolify with no executions route. A company with neither database nor volume passes.
+ */
+export async function requireFreshBackupsForMove(ports) {
+    const { coolify } = ports;
+    const listResources = coolify.listResources?.bind(coolify);
+    const listStorages = coolify.listStorages?.bind(coolify);
+    if (!ports.projectUuid || !listResources || !listStorages || ports.ownsMail) {
+        throw new NetworkMoveBackupMissingError('by-hand');
+    }
+    const projectUuid = ports.projectUuid;
+    const now = (ports.now ?? Date.now)();
+    let resources;
+    try {
+        resources = await withinTimeout(() => listResources(projectUuid));
+    }
+    catch {
+        throw new NetworkMoveBackupMissingError('by-hand');
+    }
+    for (const app of resources.filter((r) => r.kind === 'application')) {
+        if (typeof app.key !== 'string')
+            throw new NetworkMoveBackupMissingError('by-hand');
+        const appUuid = app.key;
+        let storages;
+        try {
+            storages = await withinTimeout(() => listStorages(appUuid));
+        }
+        catch {
+            throw new NetworkMoveBackupMissingError('by-hand');
+        }
+        if ((storages.persistent_storages ?? []).some((v) => v.mount_path !== LOG_DIR)) {
+            throw new NetworkMoveBackupMissingError('by-hand');
+        }
+    }
+    for (const database of resources.filter((r) => r.kind === 'database')) {
+        if (typeof database.key !== 'string')
+            throw new NetworkMoveBackupMissingError('no-backup');
+        const databaseUuid = database.key;
+        let fresh = false;
+        try {
+            const schedules = await withinTimeout(() => coolify.listDatabaseBackups(databaseUuid));
+            for (const schedule of schedules) {
+                // A missing executions route is a refusal: a schedule alone proves no dump ran.
+                const executions = await readExecutions(coolify, databaseUuid, schedule.uuid);
+                if (executions &&
+                    freshSuccess(executions, now, MOVE_BACKUP_MAX_AGE_MINUTES * 60_000, 5 * 60_000)) {
+                    fresh = true;
+                    break;
+                }
+            }
+        }
+        catch {
+            // The cause can carry a response body.
+            throw new NetworkMoveBackupMissingError('no-backup');
+        }
+        if (!fresh)
+            throw new NetworkMoveBackupMissingError('no-backup');
+    }
+}
+/**
+ * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
+ * integrations each migrate their own database when the new container starts. The owner company runs its own
+ * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ */
+export function platformDatabasesForService(service) {
+    if (service === 'postgres')
+        return 'all';
+    return service === 'archon' || service === 'ai' || service === 'integrations' ? [service] : [];
+}

package/dist/plan/broker-entries.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg, HostingEntry } from '../org.js';
+import { type DeclaredOrg, type HostingEntry } from '../org.js';
 import type { DeclaredOrgStore, PlatformStore } from '../store.js';
 import type { CoolifyPort } from './executor.js';
 /**
@@ -64,6 +64,13 @@ export interface BrokerPort {
     /** The platform's `PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY` value, if any. */
     recordedDeploy(): Promise<string | undefined>;
     recordDeploy(value: string): Promise<void>;
+    /**
+     * The id of Archon's own sign-in organisation, when the platform has made it.
+     * No other entry may sign in that organisation, so an entry that does is
+     * refused before anything is written. Optional: a port that cannot read it
+     * (an older host) skips the check.
+     */
+    archonOrganisationId?(): Promise<string | undefined>;
 }
 /** {@link BrokerPort} over the platform's recorded ids and a Coolify client. */
 export declare class PlatformBrokerPort implements BrokerPort {
@@ -89,6 +96,7 @@ export declare class PlatformBrokerPort implements BrokerPort {
     setAuthApps(raw: string): Promise<void>;
     deploy(): Promise<void>;
     recordedDeploy(): Promise<string | undefined>;
+    archonOrganisationId(): Promise<string | undefined>;
     recordDeploy(value: string): Promise<void>;
 }
 /**

package/dist/plan/broker-entries.js

@@ -1,8 +1,9 @@
 import { randomUUID } from 'node:crypto';
+import { isFoundryOwnedBrokerEntryName, } from '../org.js';
 import { entryClientIdScopeKey } from './agora.js';
 import { entryHostnames } from './hostnames.js';
-import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, parseBrokerDeployRecord, } from './platform-diff.js';
-import { brokerDeployNeeded, brokerDeployRecordValue, missingBrokerInputs, validateBrokerAppEntry, } from './platform-providers.js';
+import { PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, parseBrokerDeployRecord, } from './platform-diff.js';
+import { archonOrgConflicts, brokerDeployNeeded, brokerDeployRecordValue, missingBrokerInputs, validateBrokerAppEntry, } from './platform-providers.js';
 /**
  * F5 (https://github.com/wtfalch/foundry/issues/314): an entry with
  * `uses.auth` gets one entry in the broker's `AUTH_APPS`. The org executor has
@@ -99,6 +100,9 @@ export class PlatformBrokerPort {
     async recordedDeploy() {
         return (await this.options.store.getServiceIds())[PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY];
     }
+    async archonOrganisationId() {
+        return (await this.options.store.getServiceIds())[PLATFORM_ARCHON_ORG_SCOPE_KEY] || undefined;
+    }
     async recordDeploy(value) {
         const { leases, store } = this.options;
         const lease = await leases?.acquireMutationLease('platform', randomUUID(), 60_000);
@@ -130,6 +134,11 @@ export async function writeBrokerEntry(broker, input) {
     const { want, appKey, previous } = input;
     const label = `broker entry '${want.name}'`;
     const brokerAppId = await broker.appId();
+    // Archon's organisation holds Archon's people only: its key must be the one entry that signs in there.
+    const archonOrgId = await broker.archonOrganisationId?.();
+    if (archonOrgConflicts([want], archonOrgId).length > 0) {
+        throw new Error(`${label} would sign in Archon's own organisation, which no other entry may`);
+    }
     const env = (await broker.listEnvs()).find((e) => e.key === 'AUTH_APPS' && !e.is_preview);
     // A value that reads back empty is not an empty list: writing over it
     // would drop every hand-written entry.
@@ -154,7 +163,15 @@ export async function writeBrokerEntry(broker, input) {
         entry.name === want.name &&
         (entry.organizationId === want.organizationId ||
             (previous !== null && entry.organizationId === previous.organizationId));
-    const isReplaced = (entry) => want.replaces !== null && isObject(entry) && entry.name === want.replaces && !isOwn(entry);
+    if (want.replaces !== null && isFoundryOwnedBrokerEntryName(want.replaces)) {
+        throw new Error(`${label}: it may not replace '${want.replaces}', a broker entry foundry writes itself`);
+    }
+    // Only an entry in the same organisation: another company's entry of that name stays.
+    const isReplaced = (entry) => want.replaces !== null &&
+        isObject(entry) &&
+        entry.name === want.replaces &&
+        entry.organizationId === want.organizationId &&
+        !isOwn(entry);
     const entry = {
         ...(current.find(isOwn) ?? {}),
         organizationId: want.organizationId,

package/dist/plan/build-record.d.ts

@@ -0,0 +1,56 @@
+import type { PlanNote } from '../plan.js';
+import type { DeployAndWaitPort } from './deploy-health.js';
+/**
+ * What commit Coolify built for an app foundry deployed, and a plan note when
+ * the commit now running differs. Coolify returns no image digest for an app
+ * it built from git, so the built commit is the only thing recorded. A deploy
+ * made outside foundry (a push, a manual deploy in Coolify) shows up as a
+ * different commit.
+ */
+/** One row of Coolify's deployment history, as `CoolifyClient.listApplicationDeployments` returns it. */
+export interface BuildDeploymentRow {
+    deployment_uuid: string;
+    /** Absent on a port that builds from no git commit (the local stand-in). */
+    commit?: string;
+    status: string;
+}
+export interface BuildRecordPort {
+    listApplicationDeployments?(uuid: string, take?: number): Promise<BuildDeploymentRow[]>;
+}
+/** The scope key holding the 40 character commit of the deployment foundry started for `name`. */
+export declare function builtCommitScopeKey(name: string): string;
+/** The scope key holding the Coolify application uuid `builtCommitScopeKey(name)` was read from, so a later plan can read the live commit. */
+export declare function builtAppScopeKey(name: string): string;
+/**
+ * Records the commit of the deployment with uuid `deploymentUuid` (the one
+ * the deploy returned, not the newest row) under `built_commit_<name>`, and
+ * the application uuid under `built_app_<name>`.
+ *
+ * Best effort: a port without the list call, a failed or timed-out read, a
+ * missing row or a commit that is not 40 hex characters records nothing and
+ * returns the reason. The deploy has already succeeded, so a failure here
+ * leaves no key and the plan shows no note for this app; it never fails the
+ * step. The reason names no response body.
+ */
+export declare function recordBuiltCommit(coolify: DeployAndWaitPort, input: {
+    appId: string;
+    deploymentUuid: string;
+    name: string;
+}, record: (key: string, value: string) => void | Promise<void>): Promise<{
+    recorded: true;
+} | {
+    recorded: false;
+    reason: string;
+}>;
+/**
+ * The commit of each recorded app's latest finished deployment, keyed by
+ * app name. An app whose read fails or has no finished deployment is left
+ * out, so it gives no note.
+ */
+export declare function readLiveBuilds(coolify: BuildRecordPort | undefined, recorded: Readonly<Record<string, string>>): Promise<Record<string, string>>;
+/**
+ * One `build-drift:<name>` note per app whose live commit differs from the
+ * recorded one. An app with no recorded commit (never deployed by foundry) or
+ * no live commit gives none. The description carries 12 character shas only.
+ */
+export declare function buildDriftNotes(recorded: Readonly<Record<string, string>>, live: Readonly<Record<string, string | undefined>>): PlanNote[];

package/dist/plan/build-record.js

@@ -0,0 +1,109 @@
+const BUILT_COMMIT_PREFIX = 'built_commit_';
+const BUILT_APP_PREFIX = 'built_app_';
+const FULL_SHA = /^[0-9a-f]{40}$/;
+/** Coolify's own client has a request timeout; this bounds the whole read so a stuck call cannot hold a deploy step. */
+const LIST_TIMEOUT_MS = 15_000;
+const SHORT_SHA_LENGTH = 12;
+/** The scope key holding the 40 character commit of the deployment foundry started for `name`. */
+export function builtCommitScopeKey(name) {
+    return `${BUILT_COMMIT_PREFIX}${name}`;
+}
+/** The scope key holding the Coolify application uuid `builtCommitScopeKey(name)` was read from, so a later plan can read the live commit. */
+export function builtAppScopeKey(name) {
+    return `${BUILT_APP_PREFIX}${name}`;
+}
+async function withTimeout(work, label) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`${label} timed out`)), LIST_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Records the commit of the deployment with uuid `deploymentUuid` (the one
+ * the deploy returned, not the newest row) under `built_commit_<name>`, and
+ * the application uuid under `built_app_<name>`.
+ *
+ * Best effort: a port without the list call, a failed or timed-out read, a
+ * missing row or a commit that is not 40 hex characters records nothing and
+ * returns the reason. The deploy has already succeeded, so a failure here
+ * leaves no key and the plan shows no note for this app; it never fails the
+ * step. The reason names no response body.
+ */
+export async function recordBuiltCommit(coolify, input, record) {
+    if (!coolify.listApplicationDeployments) {
+        return { recorded: false, reason: 'the Coolify port cannot list deployments' };
+    }
+    let rows;
+    try {
+        rows = await withTimeout(coolify.listApplicationDeployments(input.appId), 'deployment list');
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.message.endsWith('timed out')
+            ? error.message
+            : 'the deployment list failed';
+        return { recorded: false, reason };
+    }
+    const row = rows.find((candidate) => candidate.deployment_uuid === input.deploymentUuid);
+    if (!row)
+        return { recorded: false, reason: 'the deployment is not in the list' };
+    if (!row.commit || !FULL_SHA.test(row.commit))
+        return { recorded: false, reason: 'the deployment has no git commit' };
+    await record(builtCommitScopeKey(input.name), row.commit);
+    await record(builtAppScopeKey(input.name), input.appId);
+    return { recorded: true };
+}
+/**
+ * The commit of each recorded app's latest finished deployment, keyed by
+ * app name. An app whose read fails or has no finished deployment is left
+ * out, so it gives no note.
+ */
+export async function readLiveBuilds(coolify, recorded) {
+    const live = {};
+    const list = coolify?.listApplicationDeployments?.bind(coolify);
+    if (!list)
+        return live;
+    for (const [key, appId] of Object.entries(recorded)) {
+        if (!key.startsWith(BUILT_APP_PREFIX) || !appId)
+            continue;
+        try {
+            const rows = await withTimeout(list(appId), 'deployment list');
+            const finished = rows.find((row) => row.status === 'finished');
+            if (finished?.commit && FULL_SHA.test(finished.commit)) {
+                live[key.slice(BUILT_APP_PREFIX.length)] = finished.commit;
+            }
+        }
+        catch (error) {
+            // Unreadable now: no live value, so no note for this app. The next plan reads again.
+            void error;
+        }
+    }
+    return live;
+}
+/**
+ * One `build-drift:<name>` note per app whose live commit differs from the
+ * recorded one. An app with no recorded commit (never deployed by foundry) or
+ * no live commit gives none. The description carries 12 character shas only.
+ */
+export function buildDriftNotes(recorded, live) {
+    const notes = [];
+    for (const [key, recordedSha] of Object.entries(recorded)) {
+        if (!key.startsWith(BUILT_COMMIT_PREFIX))
+            continue;
+        const name = key.slice(BUILT_COMMIT_PREFIX.length);
+        const liveSha = live[name];
+        if (!recordedSha || !liveSha || liveSha === recordedSha)
+            continue;
+        notes.push({
+            key: `build-drift:${name}`,
+            service: name,
+            description: `${name}: running build ${liveSha.slice(0, SHORT_SHA_LENGTH)} differs from the recorded ${recordedSha.slice(0, SHORT_SHA_LENGTH)}`,
+        });
+    }
+    return notes.sort((a, b) => a.key.localeCompare(b.key));
+}

package/dist/plan/calls-matrix.d.ts

@@ -47,6 +47,15 @@
 export declare const SYNAPSE_IMAGE = "ghcr.io/element-hq/synapse";
 export declare const SYNAPSE_TAG: string;
 export declare const MAS_IMAGE: string;
+/** MAS listens here in both the calls and the chat config (`http.listeners[0].binds`). */
+export declare const MAS_PORT = 8080;
+/**
+ * The inline Dockerfile of a MAS app: the published image plus its entry command. That image is distroless: no
+ * shell and no HTTP client, so Coolify's own check (always `sh -c`) cannot run in it. A static busybox is copied in
+ * and an exec-form HEALTHCHECK asks MAS's `/health` (a `SELECT 1` on its database). Coolify keeps a Dockerfile's
+ * HEALTHCHECK when its own check is off (`health_check_enabled: false`).
+ */
+export declare function masDockerfile(): string;
 /** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
 export declare const MAS_TAG: string;
 /**

package/dist/plan/calls-matrix.js

@@ -1,5 +1,5 @@
 import { generateKeyPairSync, randomBytes } from 'node:crypto';
-import { VERSIONS } from '../bootstrap/versions.js';
+import { VERSIONS, pinnedRef } from '../bootstrap/versions.js';
 /**
  * The calls Matrix stack (#128, part 1 of 2 -- see that issue's "If this
  * passes about 800 changed lines, split it" note): pure config generation
@@ -49,6 +49,23 @@ import { VERSIONS } from '../bootstrap/versions.js';
 export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
 export const SYNAPSE_TAG = VERSIONS.synapse;
 export const MAS_IMAGE = `ghcr.io/element-hq/matrix-authentication-service:${VERSIONS.mas}`;
+/** MAS listens here in both the calls and the chat config (`http.listeners[0].binds`). */
+export const MAS_PORT = 8080;
+/**
+ * The inline Dockerfile of a MAS app: the published image plus its entry command. That image is distroless: no
+ * shell and no HTTP client, so Coolify's own check (always `sh -c`) cannot run in it. A static busybox is copied in
+ * and an exec-form HEALTHCHECK asks MAS's `/health` (a `SELECT 1` on its database). Coolify keeps a Dockerfile's
+ * HEALTHCHECK when its own check is off (`health_check_enabled: false`).
+ */
+export function masDockerfile() {
+    return [
+        `FROM busybox:${pinnedRef('busybox')} AS busybox`,
+        `FROM ghcr.io/element-hq/matrix-authentication-service:${pinnedRef('mas')}`,
+        'COPY --from=busybox /bin/busybox /busybox',
+        'CMD ["server", "--config", "/config/config.yaml"]',
+        `HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 CMD ["/busybox", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:${MAS_PORT}/health"]`,
+    ].join('\n');
+}
 /** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
 export const MAS_TAG = VERSIONS.mas;
 /**

package/dist/plan/cloudflared-connector.d.ts

@@ -7,6 +7,12 @@ import type { CoolifyPort } from './executor.js';
  * `versions.json` (#247).
  */
 export declare const CLOUDFLARED_IMAGE_REF: string;
+/**
+ * Where the connector serves its metrics, which include `/ready` (200 with at least one edge connection, else 503).
+ * The image is distroless, so its check is the binary's own `tunnel ready` in exec form: a Dockerfile HEALTHCHECK,
+ * kept by Coolify while its own check is off. The port is not published; only the container network reaches it.
+ */
+export declare const CLOUDFLARED_METRICS_PORT = 20241;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -24,7 +30,7 @@ export declare function cloudflaredDockerfile(): string;
  * archon) calls this once with its own app name and scope key.
  */
 export interface EnsureCloudflaredConnectorInput {
-    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
+    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
     tunnels: Pick<TunnelPort, 'getTunnelToken'>;
     /** The Cloudflare tunnel this connector dials into (already created and configured by the caller). */
     tunnelId: string;

package/dist/plan/cloudflared-connector.js

@@ -1,4 +1,4 @@
-import { VERSIONS } from '../bootstrap/versions.js';
+import { VERSIONS, pinnedRef } from '../bootstrap/versions.js';
 import { isNotFoundError } from './executor.js';
 /**
  * #197: the pinned `cloudflared` image, the same release tag as
@@ -7,6 +7,12 @@ import { isNotFoundError } from './executor.js';
  * `versions.json` (#247).
  */
 export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
+/**
+ * Where the connector serves its metrics, which include `/ready` (200 with at least one edge connection, else 503).
+ * The image is distroless, so its check is the binary's own `tunnel ready` in exec form: a Dockerfile HEALTHCHECK,
+ * kept by Coolify while its own check is off. The port is not published; only the container network reaches it.
+ */
+export const CLOUDFLARED_METRICS_PORT = 20241;
 /**
  * The inline Dockerfile a docker-image `cloudflared` app needs, copied from
  * `scripts/shared-ingress.mjs`'s `cloudflaredDockerfile()`: the published
@@ -17,7 +23,12 @@ export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudfla
  * variable `cloudflared` reads at boot.
  */
 export function cloudflaredDockerfile() {
-    return `FROM ${CLOUDFLARED_IMAGE_REF}\nCMD ["tunnel", "--no-autoupdate", "run"]\n`;
+    return [
+        `FROM cloudflare/cloudflared:${pinnedRef('cloudflared')}`,
+        `CMD ["tunnel", "--no-autoupdate", "--metrics", "0.0.0.0:${CLOUDFLARED_METRICS_PORT}", "run"]`,
+        `HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 CMD ["cloudflared", "tunnel", "--metrics", "127.0.0.1:${CLOUDFLARED_METRICS_PORT}", "ready"]`,
+        '',
+    ].join('\n');
 }
 /**
  * Finds or creates the one Coolify app that runs `cloudflared` for
@@ -79,6 +90,8 @@ export async function ensureCloudflaredConnector(input) {
         });
         appId = created.uuid;
         justCreated = true;
+        // Before the first deploy: Coolify reads the Dockerfile's HEALTHCHECK only while its own check is off.
+        await coolify.updateApplication(appId, { health_check_enabled: false });
     }
     if (appId !== input.recordedConnectorAppId)
         await input.recordAppId(appId);

package/dist/plan/company-backups.d.ts

@@ -0,0 +1,31 @@
+import type { DeclaredOrg } from '../org.js';
+import type { UnmanagedItem } from '../plan.js';
+import type { DraftStep } from './diff.js';
+/**
+ * F6: the Postgres databases of a company that get a nightly backup, and the
+ * recorded id each one's uuid sits under. The keys are second, documented
+ * copies of the constants in `executor.ts` and `platform-providers.ts` (the
+ * way `PLATFORM_BACKUP_DATABASE_SCOPE_KEYS` copies the platform's): a renamed
+ * key shows up as a database the planner no longer sees, and the test in
+ * `platform-providers.backup.test.ts` plans every name here from a recorded id.
+ * `app` is the hosting entry's database, recorded as a resource id.
+ */
+export declare function companyDatabaseKeys(org: Pick<DeclaredOrg, 'id'>): Readonly<Record<string, string>>;
+/** What every recorded-id key of a company database's backup schedule starts with. */
+export declare const BACKUP_SCOPE_PREFIX = "backup_";
+/** The recorded-id key a company database's backup schedule uuid is stored under. */
+export declare function backupScopeKey(db: string): string;
+/** The databases an upgrade of `service` can migrate, by the names in {@link companyDatabaseKeys}. Empty: not coverable here. */
+export declare function databasesForService(service: string): readonly string[] | 'all';
+/**
+ * One `coolify:backup:<orgSlug>:<db>` step per company database that has a
+ * recorded uuid and no recorded backup yet. `storageUuid` undefined means the
+ * host did not wire backups, so nothing is planned and nothing is said; null
+ * means the platform's backup storage is not registered, so each database is
+ * reported as blocked instead (rule 2). A company that runs its own mail
+ * server carries a note that the Stalwart volume has no Postgres to dump.
+ */
+export declare function planCompanyBackups(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, storageUuid: string | null | undefined): {
+    steps: DraftStep[];
+    blocked: UnmanagedItem[];
+};