@wtfalch/foundry 0.37.0 → 0.38.0

package/dist/index.d.ts

@@ -54,7 +54,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/plan/backup-gate.d.ts

@@ -52,8 +52,8 @@ export interface BackupGatePorts {
  * `unconfirmedUpgrades` and before any step. A service whose database the
  * company does not have passes (there is nothing to migrate); a database that
  * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
- * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
- * not covered here (plan note `backup-not-covered:mail`).
+ * old dump, or an unreadable list all refuse. `mail` is covered like the rest:
+ * Stalwart's data store is a Postgres database.
  *
  * Where this Coolify has no executions route, the fallback is that the
  * schedule exists, is enabled and saves to S3; that proves a dump is
@@ -88,6 +88,6 @@ export declare function requireFreshBackupsForMove(ports: MoveGatePorts): Promis
 /**
  * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
  * integrations each migrate their own database when the new container starts. The owner company runs its own
- * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ * sign-in, files and jobs, so the platform has no database for them; edge and hc have no Postgres.
  */
 export declare function platformDatabasesForService(service: string): readonly string[] | 'all';

package/dist/plan/backup-gate.js

@@ -123,8 +123,8 @@ function freshSuccess(executions, now, maxAgeMs = BACKUP_MAX_AGE_HOURS * 3_600_0
  * `unconfirmedUpgrades` and before any step. A service whose database the
  * company does not have passes (there is nothing to migrate); a database that
  * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
- * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
- * not covered here (plan note `backup-not-covered:mail`).
+ * old dump, or an unreadable list all refuse. `mail` is covered like the rest:
+ * Stalwart's data store is a Postgres database.
  *
  * Where this Coolify has no executions route, the fallback is that the
  * schedule exists, is enabled and saves to S3; that proves a dump is
@@ -252,10 +252,15 @@ export async function requireFreshBackupsForMove(ports) {
 /**
  * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
  * integrations each migrate their own database when the new container starts. The owner company runs its own
- * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ * sign-in, files and jobs, so the platform has no database for them; edge and hc have no Postgres.
  */
 export function platformDatabasesForService(service) {
     if (service === 'postgres')
         return 'all';
-    return service === 'archon' || service === 'ai' || service === 'integrations' ? [service] : [];
+    return service === 'archon' ||
+        service === 'ai' ||
+        service === 'integrations' ||
+        service === 'mail'
+        ? [service]
+        : [];
 }

package/dist/plan/company-backups.d.ts

@@ -11,6 +11,11 @@ import type { DraftStep } from './diff.js';
  * `app` is the hosting entry's database, recorded as a resource id.
  */
 export declare function companyDatabaseKeys(org: Pick<DeclaredOrg, 'id'>): Readonly<Record<string, string>>;
+/**
+ * The database a company backup schedule must name when the Coolify resource
+ * is not left to pick its first database. Absent: the resource's first database.
+ */
+export declare const COMPANY_BACKUP_DATABASE_NAMES: Readonly<Record<string, string>>;
 /** What every recorded-id key of a company database's backup schedule starts with. */
 export declare const BACKUP_SCOPE_PREFIX = "backup_";
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
@@ -22,8 +27,8 @@ export declare function databasesForService(service: string): readonly string[]
  * recorded uuid and no recorded backup yet. `storageUuid` undefined means the
  * host did not wire backups, so nothing is planned and nothing is said; null
  * means the platform's backup storage is not registered, so each database is
- * reported as blocked instead (rule 2). A company that runs its own mail
- * server carries a note that the Stalwart volume has no Postgres to dump.
+ * reported as blocked instead (rule 2). A company's mail server is one of
+ * these databases (Stalwart's data store), dumped like the rest.
  */
 export declare function planCompanyBackups(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, storageUuid: string | null | undefined): {
     steps: DraftStep[];

package/dist/plan/company-backups.js

@@ -1,6 +1,6 @@
-import { ownsServices } from '../org.js';
 import { BOULE_DATABASE_SCOPE_KEY } from './boule.js';
 import { CHAT_REKEY_MAS_DB_SCOPE_KEY, CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY } from './executor.js';
+import { MAIL_DATABASE_NAME, MAIL_DATABASE_SCOPE_KEY } from './mail-store.js';
 /**
  * F6: the Postgres databases of a company that get a nightly backup, and the
  * recorded id each one's uuid sits under. The keys are second, documented
@@ -14,6 +14,7 @@ export function companyDatabaseKeys(org) {
     return {
         app: `coolify:database:${org.id}`,
         cms: 'coolify_cms_database',
+        mail: MAIL_DATABASE_SCOPE_KEY,
         auth: 'coolify_platform_auth_database',
         files: 'coolify_platform_files_database',
         jobs: 'coolify_jobs_database',
@@ -28,6 +29,13 @@ export function companyDatabaseKeys(org) {
         chat_rekey_mas: CHAT_REKEY_MAS_DB_SCOPE_KEY,
     };
 }
+/**
+ * The database a company backup schedule must name when the Coolify resource
+ * is not left to pick its first database. Absent: the resource's first database.
+ */
+export const COMPANY_BACKUP_DATABASE_NAMES = {
+    mail: MAIL_DATABASE_NAME,
+};
 /** What every recorded-id key of a company database's backup schedule starts with. */
 export const BACKUP_SCOPE_PREFIX = 'backup_';
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
@@ -43,6 +51,8 @@ export function databasesForService(service) {
             return ['files'];
         case 'jobs':
             return ['jobs'];
+        case 'mail':
+            return ['mail'];
         case 'synapse':
             return ['synapse', 'chat_synapse'];
         case 'mas':
@@ -58,8 +68,8 @@ export function databasesForService(service) {
  * recorded uuid and no recorded backup yet. `storageUuid` undefined means the
  * host did not wire backups, so nothing is planned and nothing is said; null
  * means the platform's backup storage is not registered, so each database is
- * reported as blocked instead (rule 2). A company that runs its own mail
- * server carries a note that the Stalwart volume has no Postgres to dump.
+ * reported as blocked instead (rule 2). A company's mail server is one of
+ * these databases (Stalwart's data store), dumped like the rest.
  */
 export function planCompanyBackups(org, recordedIds, storageUuid) {
     const steps = [];
@@ -91,11 +101,5 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
             },
         });
     }
-    if (ownsServices(org)) {
-        blocked.push({
-            description: `${org.slug}'s mail server keeps its data on a volume, not in Postgres: no backup covers it yet`,
-            key: 'backup-not-covered:mail',
-        });
-    }
     return { steps, blocked };
 }

package/dist/plan/diff.js

@@ -14,6 +14,7 @@ import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
+import { mailStoreSwitchChange } from './mail-store.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
 import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
@@ -319,6 +320,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // uses, never `versionChangeLine`'s "X -> Y (redeploy)" -- nothing here
     // ever performs that redeploy.
     const versionChanges = [];
+    if (ownMail.step?.action.desired.switchMailStore) {
+        versionChanges.push(mailStoreSwitchChange(org.slug));
+    }
     if (org.calls.enabled && !calls.blocked) {
         const callsAppLive = Boolean(byKey.get(resourceKey('coolify', 'calls', org.id)));
         const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], versionPin?.calls ?? VERSIONS.synapse);

package/dist/plan/executor.js

@@ -13,7 +13,7 @@ import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
-import { BACKUP_SCOPE_PREFIX, backupScopeKey } from './company-backups.js';
+import { BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
@@ -2633,6 +2633,7 @@ export class FoundryStepExecutor {
             databaseUuid: databaseId,
             label: `${org.slug} ${database}`,
             storageUuid,
+            databaseName: COMPANY_BACKUP_DATABASE_NAMES[database],
         });
         context.recordScopeId(backupScopeKey(database), uuid);
         return undefined;
@@ -5813,12 +5814,17 @@ export class FoundryStepExecutor {
             },
             zitadel: own.zitadelFor({ issuerUrl, bearerRef: target.refs.instanceBearer }),
             zitadelForInstance: undefined,
+            runtime: {
+                ...own.provision.mail.runtime,
+                onSecret: (value) => this.handledSecrets.add(value),
+            },
         }, target, {
             hostname: action.desired.hostname,
             apex: hn.mailDomain,
             zone: hn.zone,
             mailHost: action.desired.mailHost,
             imageTag: action.desired.gitRef,
+            switchStore: action.desired.switchMailStore === true,
             hostPorts: bind ? `${bind}:${smtpPort}:25` : `${smtpPort}:25`,
             issuerUrl,
             mxRecord: null,

package/dist/plan/index.d.ts

@@ -23,6 +23,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
+export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export type { BackupGatePorts, MoveGatePorts } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
@@ -63,7 +64,7 @@ export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
 export type { EdgePlatformWorkers, EdgeWorkersOptions, PlatformWorkersPort, } from './edge-workers.js';
-export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
+export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';
 export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';
 export { createEdgeZones } from './edge-zones.js';

package/dist/plan/index.js

@@ -10,6 +10,7 @@ export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICE
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.

package/dist/plan/mail-store.d.ts

@@ -0,0 +1,34 @@
+import { type VersionChangeItem } from '../plan.js';
+/**
+ * Stalwart keeps its data (mail, accounts, settings, DKIM keys) in a Coolify
+ * Postgres, so the nightly dump of that database is the off-server backup.
+ * These keys are shared by the planners (which must not import
+ * `platform-providers.ts`) and by `provisionMailServer`.
+ */
+/** The recorded uuid of the mail Postgres, under the same name for the platform and every company. */
+export declare const MAIL_DATABASE_SCOPE_KEY = "coolify_mail_database";
+/** Recorded as {@link MAIL_STORE_POSTGRES} once the `Bootstrap` write has pointed Stalwart at the database. */
+export declare const MAIL_STORE_SCOPE_KEY = "mail_store";
+export declare const MAIL_STORE_POSTGRES = "postgres";
+/** The recorded uuid of the Stalwart app (`platform-providers.ts` re-exports it under its old name). */
+export declare const MAIL_APP_SCOPE_KEY = "coolify_platform_mail_app";
+/** The database and its owner, and the env var Stalwart reads the password from. */
+export declare const MAIL_DATABASE_NAME = "stalwart";
+export declare const MAIL_DATABASE_USER = "stalwart";
+export declare const MAIL_DATABASE_PASSWORD_ENV = "STALWART_DB_PASSWORD";
+/** The `confirmUpgrade` name that confirms the switch (`VersionChangeItem.service`). */
+export declare const MAIL_STORE_SWITCH_SERVICE = "mail-store";
+/**
+ * A Stalwart app is recorded and its data store was never moved to Postgres
+ * (no mail database recorded either: a fresh instance records that before it
+ * creates the app, so a crash halfway never reads as a volume-backed server).
+ */
+export declare function mailStoreIsLegacy(recorded: Readonly<Record<string, string>>): boolean;
+/** The one step description for the switch. `owner` is `the platform` or the company's slug. */
+export declare function mailStoreSwitchDescription(owner: string): string;
+/**
+ * The version-change line that makes `apply` refuse the plan until
+ * `confirmUpgrade` names `mail-store`. Fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export declare function mailStoreSwitchChange(owner: string): VersionChangeItem;

package/dist/plan/mail-store.js

@@ -0,0 +1,49 @@
+import { VERSION_CHANGE_KIND } from '../plan.js';
+/**
+ * Stalwart keeps its data (mail, accounts, settings, DKIM keys) in a Coolify
+ * Postgres, so the nightly dump of that database is the off-server backup.
+ * These keys are shared by the planners (which must not import
+ * `platform-providers.ts`) and by `provisionMailServer`.
+ */
+/** The recorded uuid of the mail Postgres, under the same name for the platform and every company. */
+export const MAIL_DATABASE_SCOPE_KEY = 'coolify_mail_database';
+/** Recorded as {@link MAIL_STORE_POSTGRES} once the `Bootstrap` write has pointed Stalwart at the database. */
+export const MAIL_STORE_SCOPE_KEY = 'mail_store';
+export const MAIL_STORE_POSTGRES = 'postgres';
+/** The recorded uuid of the Stalwart app (`platform-providers.ts` re-exports it under its old name). */
+export const MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+/** The database and its owner, and the env var Stalwart reads the password from. */
+export const MAIL_DATABASE_NAME = 'stalwart';
+export const MAIL_DATABASE_USER = 'stalwart';
+export const MAIL_DATABASE_PASSWORD_ENV = 'STALWART_DB_PASSWORD';
+/** The `confirmUpgrade` name that confirms the switch (`VersionChangeItem.service`). */
+export const MAIL_STORE_SWITCH_SERVICE = 'mail-store';
+/**
+ * A Stalwart app is recorded and its data store was never moved to Postgres
+ * (no mail database recorded either: a fresh instance records that before it
+ * creates the app, so a crash halfway never reads as a volume-backed server).
+ */
+export function mailStoreIsLegacy(recorded) {
+    return (Boolean(recorded[MAIL_APP_SCOPE_KEY]) &&
+        !recorded[MAIL_DATABASE_SCOPE_KEY] &&
+        recorded[MAIL_STORE_SCOPE_KEY] !== MAIL_STORE_POSTGRES);
+}
+/** The one step description for the switch. `owner` is `the platform` or the company's slug. */
+export function mailStoreSwitchDescription(owner) {
+    return `switch ${owner}'s mail store to Postgres (recreates the mail server; mail stored there is deleted)`;
+}
+/**
+ * The version-change line that makes `apply` refuse the plan until
+ * `confirmUpgrade` names `mail-store`. Fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export function mailStoreSwitchChange(owner) {
+    return {
+        kind: VERSION_CHANGE_KIND,
+        service: MAIL_STORE_SWITCH_SERVICE,
+        description: `${owner}'s mail server still stores its data on a volume: moving it to Postgres recreates the server and deletes the mail stored there; confirm with confirmUpgrade "${MAIL_STORE_SWITCH_SERVICE}"`,
+        from: 'volume',
+        to: 'postgres',
+        needsConfirmation: true,
+    };
+}

package/dist/plan/own-diff.js

@@ -6,6 +6,7 @@ import { brokerEntryAppliedScopeKey } from './broker-entries.js';
 import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
+import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
@@ -212,7 +213,9 @@ export function planOwnMail(options) {
     const smtpPort = options.smtpPort ?? OWN_MAIL_SMTP_PORT_BASE;
     if (!isOwnMailSmtpPort(smtpPort))
         return blocked('its mail port is outside the range foundry uses');
-    if (recordedIds[`coolify:own-mail:${org.id}`] &&
+    const storeSwitch = mailStoreIsLegacy(recordedIds);
+    if (!storeSwitch &&
+        recordedIds[`coolify:own-mail:${org.id}`] &&
         recordedIds[OWN_MAIL_SMTP_PORT_SCOPE_KEY] === String(smtpPort) &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
@@ -227,11 +230,19 @@ export function planOwnMail(options) {
                 system: 'coolify',
                 kind: 'own-mail',
                 key: org.id,
-                desired: { hostname, gitRef, mailHost: platformMailMxHost(platformApex), smtpPort },
+                desired: {
+                    hostname,
+                    gitRef,
+                    mailHost: platformMailMxHost(platformApex),
+                    smtpPort,
+                    ...(storeSwitch ? { switchMailStore: true } : {}),
+                },
             },
             step: {
-                description: `provision ${org.slug}'s own mail server`,
-                destroys: false,
+                description: storeSwitch
+                    ? mailStoreSwitchDescription(org.slug)
+                    : `provision ${org.slug}'s own mail server`,
+                destroys: storeSwitch,
                 migrates: false,
             },
         },

package/dist/plan/own-services.d.ts

@@ -26,6 +26,7 @@ export interface ServiceTarget {
         authTunnel: string;
         authCloudflared: string;
         mailApp: string;
+        mailDb: string;
         mailTunnel: string;
         mailCloudflared: string;
         filesDb: string;

package/dist/plan/own-services.js

@@ -17,6 +17,7 @@ export function platformTarget() {
             authTunnel: 'platform-auth-tunnel',
             authCloudflared: 'platform-auth-cloudflared',
             mailApp: 'platform-mail-stalwart',
+            mailDb: 'platform-mail-postgres',
             mailTunnel: 'platform-mail-tunnel',
             mailCloudflared: 'platform-mail-cloudflared',
             filesDb: 'platform-files-db',
@@ -66,6 +67,7 @@ export function orgTarget(org) {
             authTunnel: `${s}-auth-tunnel`,
             authCloudflared: `${s}-auth-cloudflared`,
             mailApp: `${s}-mail-stalwart`,
+            mailDb: `${s}-mail-postgres`,
             mailTunnel: `${s}-mail-tunnel`,
             mailCloudflared: `${s}-mail-cloudflared`,
             filesDb: `${s}-files-db`,

package/dist/plan/plan-apply.js

@@ -22,7 +22,7 @@ import { findNameClashes, nameClashMessage } from './org-names.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
@@ -1330,9 +1330,13 @@ export class FoundryPlanApply {
     async platformOwnerInput(platform) {
         const owner = await this.store.get(platform.ownerOrgId);
         if (!owner)
-            return { signIn: null, files: null };
+            return { signIn: null, files: null, chat: null };
         const recorded = (await this.store.getAppliedState(owner.id))?.serviceIds ?? {};
-        return { signIn: ownerSignInFrom(owner, recorded), files: ownerFilesFrom(owner, recorded) };
+        return {
+            signIn: ownerSignInFrom(owner, recorded),
+            files: ownerFilesFrom(owner, recorded),
+            chat: ownerChatFrom(owner, recorded),
+        };
     }
     /**
      * What the shared mail relay needs from the orgs. A route exists for an org

package/dist/plan/platform-diff.d.ts

@@ -1030,6 +1030,25 @@ export declare const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = "uptime_applied
 export declare const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = "uptime_applied_vars";
 /** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
 export declare const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = "uptime_removed";
+/**
+ * The chat bot's room (`!id:server`), recorded as soon as chat-service names it.
+ * Recorded before the bot's token is held, so a crash between the two leaves the room known.
+ */
+export declare const PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY = "platform_uptime_chat_room_id";
+/**
+ * A random id, recorded and persisted before the chat route is called (it mints the bot's token) and
+ * cleared once that token is held. Set while the token is not held, it means a token was minted that may
+ * be lost, so the next call asks the route to rotate it.
+ */
+export declare const PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY = "platform_uptime_chat_token_undelivered";
+/**
+ * The Worker's plain text variables: the chat homeserver and room foundry made, under whatever the
+ * host configured (a host value that is set wins). Unset values are left out.
+ */
+export declare function uptimeEffectiveVars(hostVars: Readonly<Record<string, string | undefined>> | undefined, chat: {
+    homeserverUrl: string;
+    roomId: string;
+} | null): Record<string, string | undefined>;
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export declare function uptimeVarsDigest(vars?: Readonly<Record<string, string | undefined>>): string;
 /** The Worker secret names the step sets: the three it mints, and each held one. */
@@ -1164,6 +1183,16 @@ export interface PlanPlatformOptions {
             access: boolean;
             vars: string;
         };
+        /**
+         * The uptime Worker's chat bot, when the host wired one. `pending`: the bot's token is not held and
+         * Company Included's chat is applied, so the step makes it. `blocked`: why it cannot yet (a fixed
+         * line, reported without stopping the rest of the Worker). Absent: no bot path, so the plan keeps
+         * asking for a hand-held credential.
+         */
+        uptimeChat?: {
+            pending: boolean;
+            blocked?: string;
+        };
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
         /**
@@ -1279,6 +1308,7 @@ export declare const PLATFORM_BACKUP_DATABASE_SCOPE_KEYS: {
     readonly archon: "coolify_platform_archon_database";
     readonly ai: "coolify_platform_ai_database";
     readonly integrations: "coolify_integrations_database";
+    readonly mail: "coolify_mail_database";
 };
 export type PlatformBackupServiceKey = keyof typeof PLATFORM_BACKUP_DATABASE_SCOPE_KEYS;
 export declare const PLATFORM_BACKUP_SERVICE_KEYS: readonly PlatformBackupServiceKey[];

package/dist/plan/platform-diff.js

@@ -7,6 +7,7 @@ import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
 import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
+import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
 import { signInDomainBlockedText } from './sign-in-org.js';
@@ -1155,6 +1156,28 @@ export const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = 'uptime_applied_secrets
 export const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = 'uptime_applied_vars';
 /** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
 export const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = 'uptime_removed';
+/**
+ * The chat bot's room (`!id:server`), recorded as soon as chat-service names it.
+ * Recorded before the bot's token is held, so a crash between the two leaves the room known.
+ */
+export const PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY = 'platform_uptime_chat_room_id';
+/**
+ * A random id, recorded and persisted before the chat route is called (it mints the bot's token) and
+ * cleared once that token is held. Set while the token is not held, it means a token was minted that may
+ * be lost, so the next call asks the route to rotate it.
+ */
+export const PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY = 'platform_uptime_chat_token_undelivered';
+/**
+ * The Worker's plain text variables: the chat homeserver and room foundry made, under whatever the
+ * host configured (a host value that is set wins). Unset values are left out.
+ */
+export function uptimeEffectiveVars(hostVars, chat) {
+    const host = Object.fromEntries(Object.entries(hostVars ?? {}).filter(([, v]) => Boolean(v)));
+    return {
+        ...(chat ? { CHAT_HOMESERVER_URL: chat.homeserverUrl, CHAT_ROOM_ID: chat.roomId } : {}),
+        ...host,
+    };
+}
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export function uptimeVarsDigest(vars = {}) {
     const set = Object.entries(vars)
@@ -1332,7 +1355,7 @@ export function planPlatform(platform, live, options = {}) {
         plannedSteps.push(heartbeats.step);
     // foundry#542: after Archon is applied (never merely planned): the Worker
     // probes Archon, and Archon's env takes the token this step mints.
-    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld);
+    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld, blocked.uptimeChat);
     if (uptime.step)
         plannedSteps.push(uptime.step);
     if (archon.step && blocked.archonRunsInsideApp)
@@ -1353,6 +1376,9 @@ export function planPlatform(platform, live, options = {}) {
     // read for, is premature, not informational.
     const versionChanges = [];
     for (const change of [
+        mail.blocked || !mail.step?.action.desired.switchMailStore
+            ? null
+            : mailStoreSwitchChange('the platform'),
         mail.blocked
             ? null
             : versionChangeLine('mail', recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY], platform.mail.gitRef, 'image, redeploy'),
@@ -1593,11 +1619,13 @@ export const PLATFORM_BACKUP_DATABASE_SCOPE_KEYS = {
     archon: 'coolify_platform_archon_database',
     ai: 'coolify_platform_ai_database',
     integrations: 'coolify_integrations_database',
+    mail: MAIL_DATABASE_SCOPE_KEY,
 };
 export const PLATFORM_BACKUP_SERVICE_KEYS = [
     'archon',
     'ai',
     'integrations',
+    'mail',
 ];
 /**
  * #257: a nightly backup for each platform database foundry itself creates,
@@ -2047,7 +2075,9 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
     if (!platform.mail.enabled)
         return { step: null, blocked: null };
     const key = resourceKey('coolify', 'app', PLATFORM_MAIL_KEY);
-    if (recordedIds[key] &&
+    const storeSwitch = mailStoreIsLegacy(recordedIds);
+    if (!storeSwitch &&
+        recordedIds[key] &&
         recordedIds[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === platform.mail.hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === platform.mail.gitRef &&
@@ -2083,6 +2113,28 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
             blocked: "the platform's mail server is blocked, not planned: its OIDC directory uses the platform's own sign-in, which is neither applied nor planned",
         };
     }
+    if (storeSwitch) {
+        return {
+            step: {
+                action: {
+                    system: 'coolify',
+                    kind: 'app',
+                    key: PLATFORM_MAIL_KEY,
+                    desired: {
+                        hostname: platform.mail.hostname,
+                        gitRef: platform.mail.gitRef,
+                        switchMailStore: true,
+                    },
+                },
+                step: {
+                    description: mailStoreSwitchDescription('the platform'),
+                    destroys: true,
+                    migrates: false,
+                },
+            },
+            blocked: null,
+        };
+    }
     return {
         step: {
             action: {
@@ -2684,7 +2736,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     token: true,
     access: true,
     vars: '',
-}) {
+}, chat) {
     const { uptime } = platform;
     const deployed = Boolean(recordedIds[resourceKey('cloudflare', 'worker', PLATFORM_UPTIME_KEY)]) &&
         !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
@@ -2733,7 +2785,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     if (executorBlocked)
         return { step: null, blocked: [executorBlocked], notes: [] };
     const notes = [];
-    if (!heldOptional.includes('CHAT_ACCESS_TOKEN')) {
+    if (!chat && !heldOptional.includes('CHAT_ACCESS_TOKEN')) {
         notes.push({
             key: 'uptime:CHAT_ACCESS_TOKEN',
             service: 'uptime',
@@ -2759,9 +2811,12 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
         recordedIds[PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY] === uptime.sha256 &&
         recordedIds[PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
         (recordedIds[PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY] ?? '') === uptimeHeld.vars &&
-        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional);
+        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional) &&
+        !chat?.pending;
+    // Reported beside the step, not instead of it: the Worker deploys without chat alerts meanwhile.
+    const blockedLines = chat?.blocked ? [chat.blocked] : [];
     if (applied)
-        return { step: null, blocked: [], notes };
+        return { step: null, blocked: blockedLines, notes };
     return {
         step: {
             action: action({ hostname, gitRef: uptime.tag, sha256: uptime.sha256 }),
@@ -2771,7 +2826,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
                 migrates: false,
             },
         },
-        blocked: [],
+        blocked: blockedLines,
         notes,
     };
 }