@wtfalch/foundry 0.37.0 → 0.39.0

package/dist/plan/platform-providers.js

@@ -17,11 +17,14 @@ import { LIMITS, limited } from './own-limits.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
+import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAIL_DATABASE_SCOPE_KEY, MAIL_STORE_POSTGRES, MAIL_STORE_SCOPE_KEY, mailStoreIsLegacy, } from './mail-store.js';
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
+import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
+import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
@@ -372,7 +375,7 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
-        await this.uptimeBlocked(platform, recordedIds, blocked);
+        await this.uptimeBlocked(platform, recordedIds, blocked, owner);
         // #604: only once edge and sign-in are applied (the planner reports
         // that case itself) and no provider is recorded yet.
         if (platform.edge.enabled &&
@@ -440,7 +443,7 @@ export class FoundryPlatformStepExecutor {
      * checks the pin and Archon first, so none of the reads here happens before
      * they hold.
      */
-    async uptimeBlocked(platform, recordedIds, blocked) {
+    async uptimeBlocked(platform, recordedIds, blocked, owner = {}) {
         const deployed = Boolean(recordedIds[`cloudflare:worker:${PLATFORM_UPTIME_KEY}`]) &&
             !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
         if (!platform.uptime.enabled && !uptimeRecorded(recordedIds))
@@ -453,15 +456,41 @@ export class FoundryPlatformStepExecutor {
         }
         if (!platform.uptime.enabled)
             return;
-        blocked.uptimeSecretsHeld = Object.keys(await heldUptimeValues(deps));
+        const heldValues = await heldUptimeValues(deps);
+        blocked.uptimeSecretsHeld = Object.keys(heldValues);
         const accessTokenId = recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY];
         const accessHeld = Boolean((await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF)) &&
             (await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF)));
         blocked.uptimeHeld = {
             token: Boolean(await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF)),
             access: accessHeld,
-            vars: uptimeVarsDigest(deps.vars),
+            vars: uptimeVarsDigest(uptimeEffectiveVars(deps.vars, deps.chat && owner.chat && recordedIds[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY]
+                ? {
+                    homeserverUrl: `https://${owner.chat.agoraHost}`,
+                    roomId: recordedIds[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY],
+                }
+                : null)),
         };
+        if (deps.chat && !heldValues.CHAT_ACCESS_TOKEN) {
+            if (!owner.chat) {
+                blocked.uptimeChat = {
+                    pending: false,
+                    blocked: "the uptime Worker's chat alerts are blocked, not planned: the owner company's chat is not applied yet",
+                };
+            }
+            else if (owner.chat.subjects.length === 0) {
+                blocked.uptimeChat = {
+                    pending: false,
+                    blocked: "the uptime Worker's chat alerts are blocked, not planned: the owner company has no owner with a recorded sign-in user to join the alerts room",
+                };
+            }
+            else {
+                blocked.uptimeChat = { pending: true };
+            }
+        }
+        else if (deps.chat) {
+            blocked.uptimeChat = { pending: false };
+        }
         const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
         // A token of the name with no id recorded cannot be minted over, and
         // foundry does not remove what it did not make. With an id recorded the
@@ -667,7 +696,7 @@ export class FoundryPlatformStepExecutor {
             if (!this.mail) {
                 throw new Error('platform:mail needs FoundryPlatformStepExecutor to be constructed with its mail dependencies (#169)');
             }
-            return provisionPlatformMail(context, this.limitedOnPlatform(this.mail, LIMITS.platformMail));
+            return provisionPlatformMail(context, this.limitedOnPlatform(this.mail, LIMITS.platformMail), action.desired.switchMailStore === true);
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -1067,7 +1096,7 @@ export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|sy
  */
 const AUTH_BROKER_PATH_PATTERN = '^/api(/|$)';
 const PLATFORM_AUTH_PROJECT_SCOPE_KEY = 'coolify_project_platform_auth';
-const PLATFORM_AUTH_DB_SCOPE_KEY = 'coolify_platform_auth_database';
+export const PLATFORM_AUTH_DB_SCOPE_KEY = 'coolify_platform_auth_database';
 export const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = 'coolify_platform_auth_zitadel_app';
 export const PLATFORM_AUTH_LOGIN_SCOPE_KEY = 'coolify_platform_auth_login_app';
 const PLATFORM_AUTH_TUNNEL_SCOPE_KEY = 'cloudflare_platform_auth_tunnel';
@@ -1402,33 +1431,70 @@ export async function provisionAuthStack(scope, deps, target, input) {
     const projectUuid = await input.project.ensure(deps.coolify, scope);
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     // ---- database ----------------------------------------------------------
-    let dbId = recorded[PLATFORM_AUTH_DB_SCOPE_KEY];
+    // A company's sign-in database is foundry's own TLS image (#746). A company still on the Coolify
+    // database keeps it until its move step has run (`signin-db-move.ts`); the platform's stays on it.
+    const legacyDbId = recorded[PLATFORM_AUTH_DB_SCOPE_KEY];
+    const tlsDatabase = target.kind === 'org' && Boolean(recorded[SIGNIN_DB_TLS_SCOPE_KEY] || !legacyDbId);
+    let dbId = legacyDbId;
     // A database ZITADEL has already run against may hold data encrypted with a
     // masterkey this run cannot see (see `ensureMasterkey`). A database that
     // exists but was never deployed against (a throw between its create and the
     // first deploy) is still empty, so a retry may generate the key.
-    const databaseInUse = Boolean(dbId && recorded[PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY]);
-    if (!dbId) {
-        const server = await resolvePlatformServer(deps.coolify);
-        const created = await deps.coolify.createPostgresDatabase({
-            project_uuid: projectUuid,
-            server_uuid: server.uuid,
-            environment_name: environment.name,
-            environment_uuid: environment.uuid,
-            name: target.names.authDb,
-            postgres_db: 'zitadel',
-            postgres_user: 'zitadel',
+    const databaseInUse = Boolean((tlsDatabase ? recorded[SIGNIN_DB_APP_SCOPE_KEY] : dbId) &&
+        recorded[PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY]);
+    let databaseUrl;
+    let signinDbCa;
+    if (tlsDatabase) {
+        const provisioned = await provisionSigninDb({
+            coolify: deps.coolify,
+            keys: deps.heldKeys,
+            runtime,
+            name: target.names.signinDb,
+            internalHost: target.internal.signinDb,
+            volumeName: `${target.names.signinDb}-data`,
+            serverCertRef: target.refs.signinDbServer,
+            slug: target.id,
+            backup: deps.signinDbBackup,
+            backupBucket: target.names.signinBackupBucket,
+            recorded,
+            label,
+            environment,
+            record,
+            create: dockerfileAppCreator(deps.coolify, {
+                projectUuid,
+                environment,
+                name: target.names.signinDb,
+                description: `${target.id}'s sign-in database with TLS (#746)`,
+            }),
         });
-        dbId = created.uuid;
-        await record(PLATFORM_AUTH_DB_SCOPE_KEY, dbId);
+        databaseUrl = provisioned.dsn;
+        signinDbCa = provisioned.ca;
+        await record(SIGNIN_DB_TLS_SCOPE_KEY, provisioned.appId);
     }
-    const db = await getDatabaseStarted(deps.coolify, dbId);
-    if (!db.internal_db_url) {
-        // Static config check before either app is touched (`diff.ts`'s
-        // `coolifyCalls` follows the same rule for its own databases): Coolify
-        // can take a moment to report a freshly created database's
-        // `internal_db_url`, so the next apply retries from a clean state.
-        throw new Error(`coolify:app for ${subject} (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+    else {
+        if (!dbId) {
+            const server = await resolvePlatformServer(deps.coolify);
+            const created = await deps.coolify.createPostgresDatabase({
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                name: target.names.authDb,
+                postgres_db: 'zitadel',
+                postgres_user: 'zitadel',
+            });
+            dbId = created.uuid;
+            await record(PLATFORM_AUTH_DB_SCOPE_KEY, dbId);
+        }
+        const db = await getDatabaseStarted(deps.coolify, dbId);
+        if (!db.internal_db_url) {
+            // Static config check before either app is touched (`diff.ts`'s
+            // `coolifyCalls` follows the same rule for its own databases): Coolify
+            // can take a moment to report a freshly created database's
+            // `internal_db_url`, so the next apply retries from a clean state.
+            throw new Error(`coolify:app for ${subject} (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        databaseUrl = db.internal_db_url;
     }
     // ---- the ZITADEL app itself ---------------------------------------------
     const zitadelApp = await findOrCreatePlatformApp(deps.coolify, target.names.authZitadel, environment, async () => {
@@ -1446,6 +1512,8 @@ export async function provisionAuthStack(scope, deps, target, input) {
     });
     const zitadelAppId = zitadelApp.appId;
     await record(PLATFORM_AUTH_ZITADEL_SCOPE_KEY, zitadelAppId);
+    if (signinDbCa)
+        await ensureSigninDbCaFile(deps.coolify, zitadelAppId, signinDbCa, label);
     // Set on every run, not only after a create: a throw right after the
     // create must not leave the app unnamed for good, and the tunnel addresses
     // the app by this name. (The port cannot read the current name back, and
@@ -1548,7 +1616,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         { key: 'ZITADEL_EXTERNALPORT', value: '443' },
         { key: 'ZITADEL_EXTERNALSECURE', value: 'true' },
         { key: 'ZITADEL_TLS_ENABLED', value: 'false' },
-        { key: 'ZITADEL_DATABASE_POSTGRES_DSN', value: db.internal_db_url },
+        { key: 'ZITADEL_DATABASE_POSTGRES_DSN', value: databaseUrl },
         { key: 'ZITADEL_FIRSTINSTANCE_SKIP', value: 'true' },
         { key: 'ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED', value: 'true' },
         // A username is unique per organisation, and the login name is `name@<org domain>`. Without it a
@@ -1638,13 +1706,24 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
     // Deploy an app that was just created, is not running (a throw after the
     // create left it never deployed, or it stopped), or whose envs changed.
-    if (zitadelApp.justCreated || !zitadelApp.running || zitadelEnvsChanged || zitadelRunOptionsNew) {
+    // A move that started ZITADEL on the TLS database and never saw it healthy there (#746): start it
+    // again and wait, so sign-in is not left down by a plan that finds nothing to do.
+    const zitadelUnconfirmed = Boolean(recorded[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY]);
+    if (zitadelApp.justCreated ||
+        !zitadelApp.running ||
+        zitadelEnvsChanged ||
+        zitadelRunOptionsNew ||
+        zitadelUnconfirmed) {
         await deps.coolify.deploy(zitadelAppId);
         await record(PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY, zitadelAppId);
         // Only now: the options are live once the deploy went out. A throw between
         // the PATCH and here leaves the marker unset, so the next run deploys.
         await record(PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, AUTH_ZITADEL_RUN_OPTIONS);
     }
+    if (zitadelUnconfirmed) {
+        await waitHealthy(withCallTimeout(deps.coolify), zitadelAppId, runtime, label, 'ZITADEL');
+        await record(SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, '');
+    }
     if (loginApp.justCreated || !loginApp.running || loginEnvsChanged) {
         await deps.coolify.deploy(loginAppId);
     }
@@ -2361,7 +2440,7 @@ const STALWART_READY_PATH = '/healthz/ready';
 /** Where the server the app was created on is recorded, so the MX record follows the app, not a later pick. */
 export const PLATFORM_MAIL_SERVER_SCOPE_KEY = 'coolify_platform_mail_server';
 const PLATFORM_MAIL_PROJECT_SCOPE_KEY = 'coolify_project_platform_mail';
-const PLATFORM_MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+const PLATFORM_MAIL_APP_SCOPE_KEY = MAIL_APP_SCOPE_KEY;
 const PLATFORM_MAIL_RELAY_APP_SCOPE_KEY = 'coolify_platform_mail_relay_app';
 const PLATFORM_MAIL_TUNNEL_SCOPE_KEY = 'cloudflare_platform_mail_tunnel';
 /**
@@ -2410,7 +2489,7 @@ export function defaultStalwartForInstance(input) {
         user: input.user,
     });
     return {
-        async applySettings({ mailHost, apex, oidc }) {
+        async applySettings({ mailHost, apex, oidc, dataStore }) {
             // A fresh Stalwart (0.16) is in bootstrap mode and refuses every write
             // but the `Bootstrap` object, and loads that object only on its next
             // start, so write it and hand the restart to the caller. A server
@@ -2418,9 +2497,29 @@ export function defaultStalwartForInstance(input) {
             // carries the generated `admin@<apex>` secret: this step signs in with
             // the recovery admin and never needs it.
             if ((await instance.client.probe()) === 'bootstrap') {
+                if (!dataStore.host ||
+                    !dataStore.database ||
+                    !dataStore.user ||
+                    !Number.isInteger(dataStore.port) ||
+                    dataStore.port < 1 ||
+                    dataStore.port > 65535) {
+                    throw new Error('platform:mail: the mail data store is not a usable Postgres address');
+                }
                 await instance.client.update('Bootstrap', 'singleton', {
                     serverHostname: mailHost,
                     defaultDomain: apex,
+                    // The password is read from the app's env, never written into Stalwart's settings.
+                    dataStore: {
+                        '@type': 'PostgreSql',
+                        host: dataStore.host,
+                        port: dataStore.port,
+                        database: dataStore.database,
+                        authUsername: dataStore.user,
+                        authSecret: {
+                            '@type': 'EnvironmentVariable',
+                            variableName: MAIL_DATABASE_PASSWORD_ENV,
+                        },
+                    },
                     // The server sits behind a tunnel; no ACME challenge can reach it.
                     requestTlsCertificate: false,
                 });
@@ -2535,7 +2634,7 @@ export async function provisionMailServer(scope, deps, target, input) {
     const zone = input.zone ?? apex;
     const label = target.kind === 'org' ? `own step coolify:own-mail for ${target.id}` : 'platform:mail';
     const keyDescription = target.kind === 'org' ? `foundry:org:${target.id}:admin` : PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION;
-    const recorded = scope.recordedIds();
+    let recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const record = async (key, id) => {
@@ -2552,6 +2651,15 @@ export async function provisionMailServer(scope, deps, target, input) {
     const imageTagBlocked = mailImageTagBlocked(imageTag);
     if (imageTagBlocked)
         throw new Error(imageTagBlocked);
+    // A server whose data is still on its volume is never provisioned over: the plan's confirmed switch
+    // deletes it first, and without that this step stops before any write.
+    if (mailStoreIsLegacy(recorded)) {
+        if (!input.switchStore) {
+            throw new Error(`${label}: the mail server still stores its data on a volume; confirm the mail-store switch in the plan before applying`);
+        }
+        await switchMailStoreToPostgres(scope, deps.coolify, target, environment.id, label);
+        recorded = scope.recordedIds();
+    }
     // One server for both the app and the MX record: recorded the first time,
     // read back after, so a later run never points `mx.<apex>` somewhere the
     // app is not.
@@ -2562,6 +2670,32 @@ export async function provisionMailServer(scope, deps, target, input) {
     const serverIpBlocked = mxRecord ? mailServerIpBlocked(server.ip, mxRecord.serverIpv4) : null;
     if (serverIpBlocked)
         throw new Error(serverIpBlocked);
+    // ---- the data store: a Postgres, created and recorded before the app ----------
+    // A crash after the create resumes with the recorded id and never makes a second database. A crash
+    // before the app exists leaves only this empty database behind; the next run uses it.
+    let mailDbId = recorded[MAIL_DATABASE_SCOPE_KEY];
+    if (!mailDbId) {
+        const found = (await deps.coolify.listDatabases()).find((d) => d.name === target.names.mailDb && d.environment_id === environment.id);
+        if (found) {
+            mailDbId = found.uuid;
+        }
+        else {
+            const created = await deps.coolify.createPostgresDatabase({
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                name: target.names.mailDb,
+                postgres_db: MAIL_DATABASE_NAME,
+                postgres_user: MAIL_DATABASE_NAME,
+            });
+            mailDbId = created.uuid;
+        }
+        await record(MAIL_DATABASE_SCOPE_KEY, mailDbId);
+    }
+    const mailDb = await getDatabaseStarted(deps.coolify, mailDbId);
+    const dataStore = mailDataStore(mailDb.internal_db_url, label);
+    runtime.onSecret?.(dataStore.password);
     const app = await findOrCreatePlatformApp(deps.coolify, target.names.mailApp, environment, async () => {
         return deps.coolify.createDockerImageApplication({
             project_uuid: projectUuid,
@@ -2621,6 +2755,7 @@ export async function provisionMailServer(scope, deps, target, input) {
     const recoveryGenerated = await ensureGeneratedEnv(deps.coolify, appId, 'STALWART_RECOVERY_ADMIN', () => `${STALWART_RECOVERY_USER}:${randomBytes(18).toString('base64')}`);
     const envs = [
         { key: 'STALWART_PUBLIC_URL', value: `https://${hostname}` },
+        { key: MAIL_DATABASE_PASSWORD_ENV, value: dataStore.password },
     ];
     if (recoveryGenerated)
         envs.push({ key: 'STALWART_RECOVERY_ADMIN', value: recoveryGenerated });
@@ -2810,13 +2945,15 @@ export async function provisionMailServer(scope, deps, target, input) {
                     mailHost: hostname,
                     apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
+                    dataStore: dataStore.address,
                 },
             });
+            await record(MAIL_STORE_SCOPE_KEY, MAIL_STORE_POSTGRES);
             await record(PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, project.id);
             await record(PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED);
         }
         catch (error) {
-            throw redactedMailError(error, [password]);
+            throw redactedMailError(error, [password, dataStore.password]);
         }
     }
     else if (!recordedProjectId) {
@@ -2851,8 +2988,10 @@ export async function provisionMailServer(scope, deps, target, input) {
                     mailHost: hostname,
                     apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
+                    dataStore: dataStore.address,
                 },
             });
+            await record(MAIL_STORE_SCOPE_KEY, MAIL_STORE_POSTGRES);
             await record(PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED);
             // Recorded and persisted before the secret leaves this function: if
             // delivery fails for good, the next plan reports the lost key rather
@@ -2875,7 +3014,7 @@ export async function provisionMailServer(scope, deps, target, input) {
             await record(PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, appId);
         }
         catch (error) {
-            throw redactedMailError(error, [password]);
+            throw redactedMailError(error, [password, dataStore.password]);
         }
     }
     // Last, after every write the applied values depend on, so a run that
@@ -2884,6 +3023,79 @@ export async function provisionMailServer(scope, deps, target, input) {
     await record(PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, imageTag);
     return { resourceId: appId };
 }
+/**
+ * Where Stalwart reaches its database, and the password it reads from its env. Parsed from Coolify's
+ * `internal_db_url` inside a try: Node's parse error carries the whole input, credential included, so it
+ * is replaced with a fixed message.
+ */
+function mailDataStore(internalDbUrl, label) {
+    if (!internalDbUrl) {
+        throw new Error(`${label}: the mail database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+    }
+    try {
+        const url = new URL(internalDbUrl);
+        const address = {
+            host: url.hostname,
+            port: url.port ? Number(url.port) : 5432,
+            database: decodeURIComponent(url.pathname.replace(/^\//, '')),
+            user: decodeURIComponent(url.username),
+        };
+        const password = decodeURIComponent(url.password);
+        if (!address.host ||
+            !address.database ||
+            !address.user ||
+            !password ||
+            !Number.isInteger(address.port)) {
+            throw new Error('incomplete');
+        }
+        return { address, password };
+    }
+    catch {
+        throw new Error(`${label}: the mail database's internal_db_url could not be parsed`);
+    }
+}
+/**
+ * The recorded ids a recreated Stalwart makes stale: the app and what was deployed or applied to it, and the
+ * admin key minted in it (the new server has none, so it is minted and delivered again). Everything else
+ * stays: the project, the server, the tunnel and its connector, the DNS names, the internal address and the
+ * published ports all describe things the new app reuses.
+ */
+// A function, not a constant: `platform-diff.ts` and this file import each other, so its keys are not
+// all initialised yet when this module is evaluated.
+const mailStoreSwitchClearedKeys = () => [
+    PLATFORM_MAIL_APP_SCOPE_KEY,
+    PLATFORM_MAIL_DEPLOYED_SCOPE_KEY,
+    PLATFORM_MAIL_DEPLOYED_HOSTNAME_SCOPE_KEY,
+    PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY,
+    PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY,
+    PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY,
+    PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY,
+    PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY,
+    PLATFORM_MAIL_ROUTE_SCOPE_KEY,
+];
+/**
+ * Deletes the volume-backed Stalwart app (Coolify's delete removes its volumes) and clears the ids above.
+ * The delete comes first: an app left behind after the ids are cleared would be found by name and reused,
+ * still on its volume. A run that dies between the two finds no app by that name on the next run and only
+ * clears. An app of that name whose uuid is not the recorded one is not deleted.
+ */
+async function switchMailStoreToPostgres(scope, coolify, target, environmentId, label) {
+    const recorded = scope.recordedIds();
+    const live = await coolify.findApplicationByName(target.names.mailApp, {
+        environmentIds: [environmentId],
+    });
+    if (live) {
+        if (live.uuid !== recorded[PLATFORM_MAIL_APP_SCOPE_KEY]) {
+            throw new Error(`${label}: the app named ${target.names.mailApp} is not the recorded mail server; not deleting it`);
+        }
+        await coolify.deleteApplication(live.uuid);
+    }
+    for (const key of mailStoreSwitchClearedKeys()) {
+        if (recorded[key])
+            scope.recordScopeId(key, '');
+    }
+    await scope.persist();
+}
 /** The platform's mail project: the shared `platform` project, its id recorded by the mail step under its own key. */
 const platformMailProject = {
     async ensure(coolify) {
@@ -2892,7 +3104,7 @@ const platformMailProject = {
     },
 };
 /** The platform's mail server: {@link provisionMailServer} with {@link platformTarget} and the platform's own inputs. */
-async function provisionPlatformMail(context, deps) {
+async function provisionPlatformMail(context, deps, switchStore = false) {
     const { platform } = context;
     const scope = scopeFromPlatform(context);
     return provisionMailServer(scope, deps, platformTarget(), {
@@ -2900,6 +3112,7 @@ async function provisionPlatformMail(context, deps) {
         apex: platform.apex,
         mailHost: platformMailMxHost(platform.apex),
         imageTag: platform.mail.gitRef,
+        switchStore,
         hostPorts: platformMailHostPorts(platform),
         issuerUrl: `https://${platform.auth.hostname}`,
         mxRecord: { serverIpv4: platform.serverIpv4 },
@@ -6068,7 +6281,7 @@ async function waitForInstance(url, runtime, sleep, label = 'platform:auth') {
         await sleep(interval);
     }
 }
-async function resolvePlatformServer(coolify) {
+export async function resolvePlatformServer(coolify) {
     const servers = await coolify.listServers();
     const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
     if (!server)
@@ -6081,7 +6294,7 @@ async function resolvePlatformServer(coolify) {
  * file holds no instance of that class to call it on. `running` says whether
  * the app was already running or starting; the caller deploys it when not.
  */
-async function findOrCreatePlatformApp(coolify, name, environment, create) {
+export async function findOrCreatePlatformApp(coolify, name, environment, create) {
     const existing = await coolify.findApplicationByName(name, {
         environmentIds: [environment.id],
     });
@@ -6236,7 +6449,7 @@ export function brokerDeployRecordValue(brokerAppId, authAppsRaw) {
     return JSON.stringify(record);
 }
 /** Whether any desired env is missing from the app, or set to another value. */
-async function envsDiffer(coolify, appId, desired) {
+export async function envsDiffer(coolify, appId, desired) {
     const live = new Map((await coolify.listEnvs(appId)).filter((e) => !e.is_preview).map((e) => [e.key, e.value]));
     return desired.some((e) => live.get(e.key) !== e.value);
 }
@@ -8177,11 +8390,12 @@ const PLATFORM_BACKUP_DEFAULT_FREQUENCY = 'daily';
  * The database a service's schedule must name. A schedule that names none
  * dumps the Coolify resource's first database; Archon's is named here anyway,
  * so a resource whose first database is not {@link ARCHON_POSTGRES_DB} is still
- * dumped right. Every other service runs on its resource's first database and
- * needs no entry.
+ * dumped right. Mail names its database the same way. Every other service runs on its
+ * resource's first database and needs no entry.
  */
 const PLATFORM_BACKUP_DATABASE_NAMES = {
     archon: ARCHON_POSTGRES_DB,
+    mail: MAIL_DATABASE_NAME,
 };
 /**
  * The one schedule both the reader and {@link provisionPlatformBackup} treat

package/dist/plan/signin-db-backup.d.ts

@@ -0,0 +1,105 @@
+import type { CoolifyPort } from './executor.js';
+import type { OwnFilesR2Keys } from './own-services.js';
+/**
+ * The nightly backup of a company's sign-in database (#746). Coolify's database backups cover Coolify
+ * databases only, and the TLS database is an application, so the schedule is a Coolify scheduled task of
+ * that application (`POST /applications/{uuid}/scheduled-tasks`, read from Coolify 4.4.2's
+ * `ScheduledTasksController`). Coolify runs the task's command with `docker exec` in the database's
+ * container at the task's frequency. The command dumps with `pg_dump` and puts the file in the company's
+ * own backup bucket, with a storage key that reaches that bucket alone (minted through the same host
+ * ports as the company's files bucket key, `ensureSigninDbBackupTarget`). The platform's backup key never
+ * reaches a company's container. It keeps nothing: Coolify's default of keeping every dump applies.
+ */
+/** Recorded id of the scheduled task (set only after Coolify lists it back as enabled). */
+export declare const SIGNIN_DB_BACKUP_TASK_SCOPE_KEY = "signin_db_backup_task";
+export declare const SIGNIN_DB_BACKUP_TASK_NAME = "signin-db-backup";
+/** Coolify's own name for "once a day", the frequency the platform's database backups use. */
+export declare const SIGNIN_DB_BACKUP_FREQUENCY = "daily";
+/** How long Coolify lets one run take, in seconds. */
+export declare const SIGNIN_DB_BACKUP_TIMEOUT_SECONDS = 3600;
+/** The company's own backup bucket and the storage key scoped to it. The key is a secret. */
+export interface SigninDbBackupTarget {
+    endpoint: string;
+    bucket: string;
+    /** R2 takes `auto`. */
+    region?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+/** The host's bucket and storage key ports, the same ones the company's files bucket uses. */
+export interface SigninDbBackupPort {
+    r2Buckets: {
+        ensureBucket(name: string): Promise<{
+            bucket: string;
+            endpoint: string;
+        }>;
+    };
+    r2Keys: OwnFilesR2Keys;
+}
+/** The token id of the company's sign-in backup key, recorded once it is in the database app's env. */
+export declare const SIGNIN_DB_BACKUP_KEY_SCOPE_KEY = "signin_db_backup_key";
+/** The token id minted and not yet in the env: deleted before any new mint. */
+export declare const SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY = "signin_db_backup_key_undelivered";
+/** How long one call to the bucket or key port may take. */
+export declare const SIGNIN_DB_BACKUP_PORT_TIMEOUT_MS = 30000;
+/**
+ * The company's own bucket and a storage key that names that bucket alone. A key already in the
+ * database app's env whose token id is recorded is kept. Otherwise any earlier token of this company
+ * (recorded, or minted and never confirmed) is deleted first, so there are never two live tokens, then
+ * one is minted, registered as a secret and recorded as undelivered; the caller writes it to the env and
+ * then records it as delivered. A failed bucket or mint throws before the database is deployed or the
+ * move stops anything. Errors name the label only.
+ */
+export declare function ensureSigninDbBackupTarget(port: SigninDbBackupPort, input: {
+    bucketName: string;
+    label: string;
+    recorded: Readonly<Record<string, string>>;
+    /** What the database app's env holds now. */
+    held: {
+        keyId?: string;
+        secret?: string;
+    };
+    record(key: string, id: string): Promise<void>;
+    onSecret?(value: string): void;
+}): Promise<{
+    target: SigninDbBackupTarget;
+    tokenId: string;
+    fresh: boolean;
+}>;
+/** The env of the database app that the backup command reads. The command itself holds no value. */
+export declare const SIGNIN_DB_BACKUP_ENV: {
+    readonly endpoint: "BACKUP_S3_ENDPOINT";
+    readonly bucket: "BACKUP_S3_BUCKET";
+    readonly region: "BACKUP_S3_REGION";
+    readonly keyId: "BACKUP_S3_KEY_ID";
+    readonly secret: "BACKUP_S3_SECRET";
+    readonly prefix: "BACKUP_S3_PREFIX";
+};
+/** Where in the bucket a company's dumps go: `signin-db/<slug>/signin-db-<UTC time>.dump`. */
+export declare function signinDbBackupPrefix(slug: string): string;
+/** The env entries the backup command needs, for the database app. */
+export declare function signinDbBackupEnvs(target: SigninDbBackupTarget, slug: string): Array<{
+    key: string;
+    value: string;
+}>;
+/**
+ * The command Coolify runs in the container. A custom-format dump goes to a temporary file (an upload
+ * needs a length), is signed with SigV4 and put with curl, and the file is removed on every exit. The
+ * credentials reach curl on its standard input as a config, never in an argument. Every failure ends the
+ * run non-zero, and curl's error text names the HTTP status only. No single quote: Coolify wraps the
+ * command in single quotes.
+ */
+export declare function signinDbBackupCommand(user: string, database: string): string;
+/**
+ * Makes sure the database app has its backup task, and returns its uuid. The task is found by name
+ * before it is created, and updated to the full wanted body every time (Coolify hides the stored
+ * command from a token without the sensitive-read ability, so it cannot be compared). The task is then
+ * read back and must be listed enabled with the wanted frequency and timeout, or this throws: a
+ * schedule that cannot be seen is not a backup. The caller records the uuid. Errors name the label only.
+ */
+export declare function ensureSigninDbBackupTask(coolify: Pick<CoolifyPort, 'raw'>, appId: string, label: string, db: {
+    user: string;
+    database: string;
+}): Promise<string>;
+/** A company on the TLS database whose nightly dump is not scheduled yet: the sign-in step plans again to schedule it. */
+export declare function signinDbBackupMissing(recordedIds: Readonly<Record<string, string>>): boolean;