@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/org.js

@@ -1,4 +1,4 @@
-import { floatingTagBlocked } from './bootstrap/versions.js';
+import { floatingRefBlocked, floatingTagBlocked } from './bootstrap/versions.js';
 /** {@link MailConfig.mailApps} when the org declares none of its own (#34, decided 2026-09-30). */
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
@@ -41,24 +41,18 @@ export function appEntry(hosting) {
     return hosting.entries.find((entry) => entry.key === APP_ENTRY_KEY);
 }
 /**
- * Two sources are secrets. `sharedSecret` is {@link EnvSharedSecret}.
- * `platformMailKey` is the platform's held Lettermint key, handed over as the
- * value of the declared env name (the platform's own apps call it
- * `LETTERMINT_API_TOKEN`). Any hosting entry of any customer org may name it
- * (William, 2026-10-04): mail is Lettermint, and the key is the platform's.
+ * `sharedSecret` is the one secret source: {@link EnvSharedSecret}. The
+ * platform's Lettermint key is not a source any more (2026-10-11): each
+ * company uses its own mail key.
  */
 export const APP_ENV_SOURCES = new Set([
     'filesOrganisationId',
     'aiOrganisationId',
     'mailDomain',
     'sharedSecret',
-    'platformMailKey',
 ]);
 /** The sources whose value is a secret: resolved at apply time, never recorded. */
-export const SECRET_APP_ENV_SOURCES = new Set([
-    'sharedSecret',
-    'platformMailKey',
-]);
+export const SECRET_APP_ENV_SOURCES = new Set(['sharedSecret']);
 /** The held-key ref of an org's shared secret. */
 export const sharedSecretRef = (orgId, name) => `foundry:shared-secret:${orgId}:${name}`;
 const ISSUER_APP_KINDS = new Set(['web', 'native', 'api']);
@@ -336,6 +330,11 @@ function validateHostingEntry(entry, enabled) {
     if (entry.healthPath !== null && !entry.healthPath.startsWith('/')) {
         return `${at} healthPath must start with '/', or be null`;
     }
+    if (entry.capabilities !== undefined &&
+        entry.capabilities !== 'restricted' &&
+        entry.capabilities !== 'standard') {
+        return `${at} capabilities must be 'restricted' or 'standard'`;
+    }
     if (entry.database && !enabled) {
         return `${at} database requires hosting.enabled`;
     }
@@ -347,6 +346,9 @@ function validateHostingEntry(entry, enabled) {
             return `${at} env '${name}' is set by foundry and cannot be declared`;
         }
         if (typeof value !== 'string') {
+            if (value?.from === 'platformMailKey') {
+                return `${at} env '${name}' has an unknown source 'platformMailKey': each company uses its own mail key`;
+            }
             if (!APP_ENV_SOURCES.has(value?.from)) {
                 return `${at} env '${name}' has an unknown source '${value?.from}'`;
             }
@@ -387,6 +389,10 @@ function validateEntryAuth(entry, hosting, domain) {
         (typeof auth.replacesBrokerEntry !== 'string' || auth.replacesBrokerEntry === '')) {
         return `${at} replacesBrokerEntry must be the non-empty name of a broker entry`;
     }
+    if (typeof auth.replacesBrokerEntry === 'string' &&
+        isFoundryOwnedBrokerEntryName(auth.replacesBrokerEntry)) {
+        return `${at} replacesBrokerEntry '${auth.replacesBrokerEntry}' is a broker entry foundry writes itself`;
+    }
     if (!hasExactHostname(entry, hosting, domain)) {
         return `${at} needs an exact hostname to sign in at`;
     }
@@ -627,6 +633,9 @@ function urlHasPassword(value) {
  * as {@link validateBuyerIdentity}/{@link validateOwners}.
  */
 const DOMAIN_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const SHARED_ZONE = 'oikos.host';
+/** The mail relay accepts only a letters-only top-level label (`plan/mail-relay.ts`); one domain it rejects would block the relay step for every company. */
+const RELAY_TLD = /^[a-z]{2,63}$/;
 export function validateDomain(domain) {
     if (domain.length > 253) {
         return `domain '${domain}' exceeds 253 characters`;
@@ -640,6 +649,45 @@ export function validateDomain(domain) {
             return `domain '${domain}' has an invalid label '${label}': must be 1-63 characters, lowercase a-z, 0-9 and hyphen, and may not start or end with a hyphen`;
         }
     }
+    if (!RELAY_TLD.test(labels[labels.length - 1] ?? '')) {
+        return `domain '${domain}' must end in a top-level label of 2 to 63 letters`;
+    }
+    // oikos.host is the shared zone every company without a domain runs on; no company owns it or a name under it.
+    if (domain === SHARED_ZONE || domain.endsWith(`.${SHARED_ZONE}`)) {
+        return `domain '${domain}' is on ${SHARED_ZONE}, the shared zone for companies without a domain; a company cannot own it`;
+    }
+    return null;
+}
+/**
+ * A broker entry name foundry writes itself: Archon's, and any company's Boule.
+ * A hosting entry may not declare that it replaces one.
+ */
+export function isFoundryOwnedBrokerEntryName(name) {
+    return name === 'archon' || name.endsWith('-boule');
+}
+/** True when one name is the other or a subdomain of the other. */
+function domainsOverlap(a, b) {
+    return a === b || a.endsWith(`.${b}`) || b.endsWith(`.${a}`);
+}
+/**
+ * `null` when `domain` may be claimed by company `orgId`, given the platform's
+ * apex and owner company and every other company's declared domain; otherwise
+ * the reason it may not. The platform's apex and anything under it belong to
+ * the owner company alone, and no company takes a parent or subdomain of
+ * another's, since Cloudflare would resolve both to one zone.
+ */
+export function validateDomainClaim(domain, claim) {
+    const { platform } = claim;
+    if (platform && claim.orgId !== platform.ownerOrgId && domainsOverlap(domain, platform.apex)) {
+        return `domain '${domain}' overlaps the platform's own domain, which only the owner company may use`;
+    }
+    for (const other of claim.others) {
+        if (other.id === claim.orgId || other.domain === null)
+            continue;
+        if (domainsOverlap(domain, other.domain)) {
+            return `domain '${domain}' is a parent or subdomain of ${other.domain}, which another company declares`;
+        }
+    }
     return null;
 }
 /**
@@ -652,11 +700,9 @@ export function validateDomain(domain) {
  * and cms there (`site`), never both -- both would otherwise fight over the
  * same hostname (https://github.com/wtfalch/foundry/issues/99).
  *
- * - `site.enabled` requires `domain` to be set -- a site with nowhere to
- *   live is not a site.
- * - `site.enabled` requires `site.usesDomain` -- unlike mail, chat, calls
- *   and the issuer, the site has no meaning anywhere but the org's own
- *   domain, so turning it on always means the domain opt-in too.
+ * - `site.enabled` with a `domain` requires `site.usesDomain`: the site then
+ *   lives on the domain. Without a `domain` it lives on `<slug>.oikos.host`
+ *   and `site.usesDomain` must be off.
  * - `site.enabled` and `hosting.enabled` cannot both be on.
  * - `site.enabled` refuses an `issuerApps` entry named `cms`: the fixed cms
  *   client (#139, `plan/diff.ts`'s `planCmsClient`) already owns the
@@ -666,12 +712,14 @@ export function validateDomain(domain) {
  *   to.
  */
 export function validateSite(org) {
-    if (org.site.enabled && !org.domain) {
-        return 'site.enabled requires domain';
-    }
-    if (org.site.enabled && !org.site.usesDomain) {
+    // A company without a domain has its site at `<slug>.oikos.host` and its editor
+    // at `<slug>-cms.oikos.host`; `site.usesDomain` is then off, and on with a domain.
+    if (org.site.enabled && org.domain && !org.site.usesDomain) {
         return 'site.enabled requires site.usesDomain';
     }
+    if (org.site.enabled && !org.domain && org.site.usesDomain) {
+        return 'site.usesDomain requires domain';
+    }
     if (org.site.enabled && org.hosting.enabled) {
         return 'site.enabled and hosting.enabled cannot both be on';
     }
@@ -691,6 +739,9 @@ export function validateSite(org) {
  * reason to pin at all.
  */
 export function validateCalls(org) {
+    // `usesDomain` serves the calls service at `calls.<domain>`; a company without a domain has none.
+    if (org.calls.usesDomain && org.domain === null)
+        return 'calls.usesDomain requires domain';
     const pin = org.calls.versionPin;
     if (!pin)
         return null;
@@ -706,8 +757,49 @@ export function validateCalls(org) {
     }
     return null;
 }
+/** The parts of a company that can be held on their own version. */
+export const VERSION_PIN_PARTS = ['auth', 'mail', 'files', 'jobs', 'sfu', 'calls'];
+const VERSION_PIN_LABELS = {
+    auth: { label: 'auth', example: 'v1.4.0', gitRef: true },
+    mail: { label: 'Stalwart', example: 'v0.16.24', gitRef: false },
+    files: { label: 'files', example: 'v1.4.0', gitRef: true },
+    jobs: { label: 'jobs', example: 'v1.4.0', gitRef: true },
+    sfu: { label: 'LiveKit', example: 'v1.9.0', gitRef: false },
+    calls: { label: 'Synapse', example: 'v1.161.0', gitRef: false },
+};
+const VERSION_PIN_VALUE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+/**
+ * `versionPin` holds parts of a company on an older release while others move.
+ * Every value is a fixed ref or tag: a floating one would defeat the hold.
+ * Also run on a stored value when it is read, so a bad row is not trusted.
+ */
+export function validateVersionPin(org) {
+    const pin = org.versionPin;
+    if (pin === undefined || pin === null)
+        return null;
+    if (typeof pin !== 'object' || Array.isArray(pin))
+        return 'versionPin must be an object';
+    for (const [part, value] of Object.entries(pin)) {
+        if (!VERSION_PIN_PARTS.includes(part)) {
+            return `versionPin.${part} is not a part; use auth, mail, files, jobs, sfu or calls`;
+        }
+        if (typeof value !== 'string' || value.trim() === '') {
+            return `versionPin.${part} must not be empty; remove the part to follow the platform`;
+        }
+        const meta = VERSION_PIN_LABELS[part];
+        const blocked = meta.gitRef
+            ? floatingRefBlocked(meta.label, value, meta.example)
+            : floatingTagBlocked(meta.label, value, meta.example);
+        if (blocked)
+            return `versionPin.${part} ${blocked}`;
+        if (!VERSION_PIN_VALUE.test(value) || value.includes('..')) {
+            return `versionPin.${part} must be a release name of letters, digits, ".", "_", "+" and "-" (at most 128 characters, no ".."); it goes to Coolify as a git ref or an image tag`;
+        }
+    }
+    return null;
+}
 export const SFU_SLOT_MAX = 20;
-/** The only reader of `services.own`: an org without `services` runs the platform's shared services. */
+/** The only reader of `services.own`. Every company runs its own services, the platform's owner company too; a company without a domain runs them on oikos.host. */
 export function ownsServices(org) {
     return org.services?.own === true;
 }
@@ -717,14 +809,12 @@ export function validateServices(org) {
     if (!ownsServices(org)) {
         return slot === null ? null : 'services.sfuSlot needs services.own';
     }
-    if (org.domain === null) {
-        return "services.own needs the org's own domain: the issuer is auth.<domain>";
-    }
-    if (!org.issuer.usesDomain) {
-        return 'services.own needs issuer.usesDomain: the issuer is auth.<domain>';
+    const hasDomain = org.domain !== null;
+    if (org.issuer.usesDomain !== hasDomain) {
+        return 'services.own: issuer.usesDomain must be on exactly when the company has a domain';
     }
-    if (org.mail.mode !== 'off' && !org.mail.usesDomain) {
-        return "services.own needs mail.usesDomain: the company's mail server serves its own domain";
+    if (org.mail.mode !== 'off' && org.mail.usesDomain !== hasDomain) {
+        return 'services.own: mail.usesDomain must be on exactly when the company has a domain';
     }
     if (org.calls.enabled &&
         (slot === null || !Number.isInteger(slot) || slot < 1 || slot > SFU_SLOT_MAX)) {

package/dist/plan/backup-gate.d.ts

@@ -0,0 +1,93 @@
+import type { OrgId } from '../org.js';
+import type { VersionChangeItem } from '../plan.js';
+import { type CoolifyPort } from './executor.js';
+/** A confirmed stateful upgrade needs a dump that finished within this many hours. */
+export declare const BACKUP_MAX_AGE_HOURS = 26;
+/** A move deletes the databases, so the dump it relies on is at most this old. */
+export declare const MOVE_BACKUP_MAX_AGE_MINUTES = 60;
+/**
+ * Thrown before any step runs when a confirmed upgrade of a stateful service
+ * has no fresh finished backup. The message names the service and nothing
+ * else: no database name, uuid or URL. There is no override.
+ */
+export declare class UpgradeBackupMissingError extends Error {
+    readonly service: string;
+    /** True when this Coolify has no executions route, so only the schedule was checked. */
+    readonly scheduleOnly: boolean;
+    constructor(service: string, 
+    /** True when this Coolify has no executions route, so only the schedule was checked. */
+    scheduleOnly?: boolean);
+}
+/**
+ * A network move is refused when the host has no backup gate, when a database of the project has no
+ * verified dump under {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes old, or when the project holds
+ * something no dump covers (the company's mail server, an app with a volume) or cannot be read. The
+ * message names no database, app, uuid or URL. There is no override: such a company is moved by hand.
+ */
+export declare class NetworkMoveBackupMissingError extends Error {
+    readonly reason: 'no-gate' | 'no-backup' | 'by-hand';
+    constructor(reason: 'no-gate' | 'no-backup' | 'by-hand');
+}
+export interface BackupGatePorts {
+    /** The company's recorded ids (`AppliedState.serviceIds`): database uuids and `backup_<db>` schedule uuids. */
+    recordedIds: Readonly<Record<string, string>>;
+    coolify: Pick<CoolifyPort, 'listDatabaseBackups' | 'raw'> & Partial<Pick<CoolifyPort, 'listDatabaseBackupExecutions'>>;
+    /** The org's id, for the `app` database key. Unused when `scope` is given. */
+    orgId: OrgId;
+    /**
+     * The platform's databases instead of a company's: the recorded-id key of
+     * each database, and which of them an upgrade of a service migrates. The
+     * platform's backup steps record no schedule uuid, so the schedule is found
+     * by listing the database's schedules (enabled, saved to S3).
+     */
+    scope?: {
+        keys: Readonly<Record<string, string>>;
+        forService(service: string): readonly string[] | 'all';
+    };
+    now?: () => number;
+}
+/**
+ * Refuses a confirmed upgrade of a stateful service whose database has no
+ * finished backup in the last {@link BACKUP_MAX_AGE_HOURS} hours. Runs after
+ * `unconfirmedUpgrades` and before any step. A service whose database the
+ * company does not have passes (there is nothing to migrate); a database that
+ * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
+ * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
+ * not covered here (plan note `backup-not-covered:mail`).
+ *
+ * Where this Coolify has no executions route, the fallback is that the
+ * schedule exists, is enabled and saves to S3; that proves a dump is
+ * scheduled, not that one ran, so it passes with no backup id.
+ *
+ * Returns the uuid of the newest fresh execution across the checked
+ * databases, for the caller to record as `backupId`, or `null`.
+ */
+export declare function requireFreshBackupsForUpgrades(plan: {
+    versionChanges?: readonly VersionChangeItem[];
+}, confirmed: readonly string[] | undefined, ports: BackupGatePorts): Promise<{
+    backupId: string | null;
+}>;
+export interface MoveGatePorts {
+    /** The company's Coolify project (`coolify_project`). */
+    projectUuid: string | undefined;
+    /** The company runs its own mail server: its volume has no dump. */
+    ownsMail: boolean;
+    coolify: BackupGatePorts['coolify'] & Partial<Pick<CoolifyPort, 'listResources' | 'listStorages'>>;
+    now?: () => number;
+}
+/**
+ * The gate for a move to the company's own network, which deletes every database of the project. It
+ * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.
+ * It passes only when every database in the project has a successful dump, seen in Coolify's
+ * executions, from the last {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes, and the project holds nothing
+ * a dump does not cover. It refuses (`by-hand`) the company's own mail server and any app with a
+ * volume other than its log volume, and (`no-backup`) a database with no schedule or no execution, an
+ * unreadable list, and a Coolify with no executions route. A company with neither database nor volume passes.
+ */
+export declare function requireFreshBackupsForMove(ports: MoveGatePorts): Promise<void>;
+/**
+ * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
+ * integrations each migrate their own database when the new container starts. The owner company runs its own
+ * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ */
+export declare function platformDatabasesForService(service: string): readonly string[] | 'all';

package/dist/plan/backup-gate.js

@@ -0,0 +1,261 @@
+import { backupScopeKey, companyDatabaseKeys, databasesForService } from './company-backups.js';
+import { LOG_DIR } from './executor.js';
+/** A confirmed stateful upgrade needs a dump that finished within this many hours. */
+export const BACKUP_MAX_AGE_HOURS = 26;
+/** A move deletes the databases, so the dump it relies on is at most this old. */
+export const MOVE_BACKUP_MAX_AGE_MINUTES = 60;
+/** How long one Coolify call of the gate may take. */
+const GATE_CALL_TIMEOUT_MS = 30_000;
+/**
+ * Thrown before any step runs when a confirmed upgrade of a stateful service
+ * has no fresh finished backup. The message names the service and nothing
+ * else: no database name, uuid or URL. There is no override.
+ */
+export class UpgradeBackupMissingError extends Error {
+    service;
+    scheduleOnly;
+    constructor(service, 
+    /** True when this Coolify has no executions route, so only the schedule was checked. */
+    scheduleOnly = false) {
+        const note = scheduleOnly
+            ? ' (this Coolify has no executions route, so only the schedule was checked, and it is missing, disabled or not saved to S3)'
+            : '';
+        super(`upgrade of ${service} refused: no finished backup of its database in the last ${BACKUP_MAX_AGE_HOURS} hours${note}`);
+        this.service = service;
+        this.scheduleOnly = scheduleOnly;
+        this.name = 'UpgradeBackupMissingError';
+    }
+}
+/**
+ * A network move is refused when the host has no backup gate, when a database of the project has no
+ * verified dump under {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes old, or when the project holds
+ * something no dump covers (the company's mail server, an app with a volume) or cannot be read. The
+ * message names no database, app, uuid or URL. There is no override: such a company is moved by hand.
+ */
+export class NetworkMoveBackupMissingError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason === 'no-gate'
+            ? 'network move refused: this host has no backup gate, so a fresh backup cannot be checked'
+            : reason === 'no-backup'
+                ? `network move refused: not every database in the company's project has a finished dump from the last ${MOVE_BACKUP_MAX_AGE_MINUTES} minutes, checked in Coolify; take one now, or move this company by hand with docs/runbooks/network-move.md`
+                : "network move refused: the company's project holds something no backup covers (its mail server or an app with a volume), or Coolify could not be asked; move this company by hand with docs/runbooks/network-move.md");
+        this.reason = reason;
+        this.name = 'NetworkMoveBackupMissingError';
+    }
+}
+async function withinTimeout(call) {
+    let timer;
+    try {
+        return await Promise.race([
+            call(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), GATE_CALL_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Coolify 4.x answers `GET /databases/{uuid}/backups/{backup}/executions` with
+ * `{ executions: [{ uuid, filename, size, created_at, message, status }] }`,
+ * newest first; `status` is `success`, `failed` or `running`. Read from
+ * `routes/api.php` and `DatabasesController::list_backup_executions` on the
+ * v4.x branch, 2026-10-10; not run against a live instance. Anything else is
+ * a shape this gate cannot trust, so it throws.
+ */
+function parseExecutions(body) {
+    const list = Array.isArray(body) ? body : body?.executions;
+    if (!Array.isArray(list))
+        throw new Error('executions list has an unexpected shape');
+    return list.map((row) => {
+        const r = row;
+        if (!r ||
+            typeof r.uuid !== 'string' ||
+            typeof r.status !== 'string' ||
+            typeof r.created_at !== 'string') {
+            throw new Error('executions list has an unexpected shape');
+        }
+        return { uuid: r.uuid, status: r.status, created_at: r.created_at };
+    });
+}
+/** The executions of one schedule, or `null` when this Coolify has no such route. */
+async function readExecutions(coolify, databaseUuid, backupUuid) {
+    try {
+        const list = coolify.listDatabaseBackupExecutions?.bind(coolify);
+        if (list)
+            return parseExecutions(await withinTimeout(() => list(databaseUuid, backupUuid)));
+        return parseExecutions(await withinTimeout(() => coolify.raw('GET', `/databases/${databaseUuid}/backups/${backupUuid}/executions`)));
+    }
+    catch (e) {
+        if (isRouteMissing(e))
+            return null;
+        throw e;
+    }
+}
+function isRouteMissing(error) {
+    const status = error?.status;
+    if (typeof status === 'number')
+        return status === 404;
+    const message = error instanceof Error ? error.message : String(error);
+    return /^\S+ \S+ \S+ → 404:/.test(message);
+}
+/** The newest `success` execution that is not older than the window, or null. */
+function freshSuccess(executions, now, maxAgeMs = BACKUP_MAX_AGE_HOURS * 3_600_000, skewMs = 3_600_000) {
+    const oldest = now - maxAgeMs;
+    let best = null;
+    for (const execution of executions) {
+        if (execution.status !== 'success')
+            continue;
+        const at = Date.parse(execution.created_at);
+        if (Number.isNaN(at) || at < oldest || at > now + skewMs)
+            continue;
+        if (!best || at > best.at)
+            best = { execution, at };
+    }
+    return best?.execution ?? null;
+}
+/**
+ * Refuses a confirmed upgrade of a stateful service whose database has no
+ * finished backup in the last {@link BACKUP_MAX_AGE_HOURS} hours. Runs after
+ * `unconfirmedUpgrades` and before any step. A service whose database the
+ * company does not have passes (there is nothing to migrate); a database that
+ * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
+ * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
+ * not covered here (plan note `backup-not-covered:mail`).
+ *
+ * Where this Coolify has no executions route, the fallback is that the
+ * schedule exists, is enabled and saves to S3; that proves a dump is
+ * scheduled, not that one ran, so it passes with no backup id.
+ *
+ * Returns the uuid of the newest fresh execution across the checked
+ * databases, for the caller to record as `backupId`, or `null`.
+ */
+export async function requireFreshBackupsForUpgrades(plan, confirmed, ports) {
+    const now = (ports.now ?? Date.now)();
+    const keys = ports.scope?.keys ?? companyDatabaseKeys({ id: ports.orgId });
+    const names = Object.keys(keys);
+    const confirmedSet = new Set(confirmed ?? []);
+    let backupId = null;
+    let newest = 0;
+    for (const change of plan.versionChanges ?? []) {
+        if (!change.needsConfirmation || !confirmedSet.has(change.service))
+            continue;
+        const wanted = (ports.scope?.forService ?? databasesForService)(change.service);
+        const dbs = wanted === 'all' ? names : wanted;
+        for (const db of dbs) {
+            const databaseUuid = ports.recordedIds[keys[db]];
+            if (!databaseUuid)
+                continue;
+            let backupUuid = ports.recordedIds[backupScopeKey(db)];
+            if (!backupUuid && ports.scope) {
+                const schedules = await withinTimeout(() => ports.coolify.listDatabaseBackups(databaseUuid)).catch(() => []);
+                backupUuid = schedules.find((x) => x.enabled && x.save_s3)?.uuid;
+            }
+            if (!backupUuid)
+                throw new UpgradeBackupMissingError(change.service);
+            let executions;
+            try {
+                executions = await readExecutions(ports.coolify, databaseUuid, backupUuid);
+            }
+            catch {
+                // An unreadable list is not a fresh backup. The cause stays out of the
+                // message: it can carry a response body.
+                throw new UpgradeBackupMissingError(change.service);
+            }
+            if (executions === null) {
+                const schedules = await withinTimeout(() => ports.coolify.listDatabaseBackups(databaseUuid)).catch(() => []);
+                const ok = schedules.some((s) => s.uuid === backupUuid && s.enabled && s.save_s3);
+                if (!ok)
+                    throw new UpgradeBackupMissingError(change.service, true);
+                continue;
+            }
+            const fresh = freshSuccess(executions, now);
+            if (!fresh)
+                throw new UpgradeBackupMissingError(change.service);
+            const at = Date.parse(fresh.created_at);
+            if (at >= newest) {
+                newest = at;
+                backupId = fresh.uuid;
+            }
+        }
+    }
+    return { backupId };
+}
+/**
+ * The gate for a move to the company's own network, which deletes every database of the project. It
+ * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.
+ * It passes only when every database in the project has a successful dump, seen in Coolify's
+ * executions, from the last {@link MOVE_BACKUP_MAX_AGE_MINUTES} minutes, and the project holds nothing
+ * a dump does not cover. It refuses (`by-hand`) the company's own mail server and any app with a
+ * volume other than its log volume, and (`no-backup`) a database with no schedule or no execution, an
+ * unreadable list, and a Coolify with no executions route. A company with neither database nor volume passes.
+ */
+export async function requireFreshBackupsForMove(ports) {
+    const { coolify } = ports;
+    const listResources = coolify.listResources?.bind(coolify);
+    const listStorages = coolify.listStorages?.bind(coolify);
+    if (!ports.projectUuid || !listResources || !listStorages || ports.ownsMail) {
+        throw new NetworkMoveBackupMissingError('by-hand');
+    }
+    const projectUuid = ports.projectUuid;
+    const now = (ports.now ?? Date.now)();
+    let resources;
+    try {
+        resources = await withinTimeout(() => listResources(projectUuid));
+    }
+    catch {
+        throw new NetworkMoveBackupMissingError('by-hand');
+    }
+    for (const app of resources.filter((r) => r.kind === 'application')) {
+        if (typeof app.key !== 'string')
+            throw new NetworkMoveBackupMissingError('by-hand');
+        const appUuid = app.key;
+        let storages;
+        try {
+            storages = await withinTimeout(() => listStorages(appUuid));
+        }
+        catch {
+            throw new NetworkMoveBackupMissingError('by-hand');
+        }
+        if ((storages.persistent_storages ?? []).some((v) => v.mount_path !== LOG_DIR)) {
+            throw new NetworkMoveBackupMissingError('by-hand');
+        }
+    }
+    for (const database of resources.filter((r) => r.kind === 'database')) {
+        if (typeof database.key !== 'string')
+            throw new NetworkMoveBackupMissingError('no-backup');
+        const databaseUuid = database.key;
+        let fresh = false;
+        try {
+            const schedules = await withinTimeout(() => coolify.listDatabaseBackups(databaseUuid));
+            for (const schedule of schedules) {
+                // A missing executions route is a refusal: a schedule alone proves no dump ran.
+                const executions = await readExecutions(coolify, databaseUuid, schedule.uuid);
+                if (executions &&
+                    freshSuccess(executions, now, MOVE_BACKUP_MAX_AGE_MINUTES * 60_000, 5 * 60_000)) {
+                    fresh = true;
+                    break;
+                }
+            }
+        }
+        catch {
+            // The cause can carry a response body.
+            throw new NetworkMoveBackupMissingError('no-backup');
+        }
+        if (!fresh)
+            throw new NetworkMoveBackupMissingError('no-backup');
+    }
+}
+/**
+ * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
+ * integrations each migrate their own database when the new container starts. The owner company runs its own
+ * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ */
+export function platformDatabasesForService(service) {
+    if (service === 'postgres')
+        return 'all';
+    return service === 'archon' || service === 'ai' || service === 'integrations' ? [service] : [];
+}

package/dist/plan/broker-entries.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg, HostingEntry } from '../org.js';
+import { type DeclaredOrg, type HostingEntry } from '../org.js';
 import type { DeclaredOrgStore, PlatformStore } from '../store.js';
 import type { CoolifyPort } from './executor.js';
 /**
@@ -64,6 +64,13 @@ export interface BrokerPort {
     /** The platform's `PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY` value, if any. */
     recordedDeploy(): Promise<string | undefined>;
     recordDeploy(value: string): Promise<void>;
+    /**
+     * The id of Archon's own sign-in organisation, when the platform has made it.
+     * No other entry may sign in that organisation, so an entry that does is
+     * refused before anything is written. Optional: a port that cannot read it
+     * (an older host) skips the check.
+     */
+    archonOrganisationId?(): Promise<string | undefined>;
 }
 /** {@link BrokerPort} over the platform's recorded ids and a Coolify client. */
 export declare class PlatformBrokerPort implements BrokerPort {
@@ -89,6 +96,7 @@ export declare class PlatformBrokerPort implements BrokerPort {
     setAuthApps(raw: string): Promise<void>;
     deploy(): Promise<void>;
     recordedDeploy(): Promise<string | undefined>;
+    archonOrganisationId(): Promise<string | undefined>;
     recordDeploy(value: string): Promise<void>;
 }
 /**