@wtfalch/foundry 0.45.0 → 0.46.0

package/dist/plan/health-gaps.js

@@ -32,6 +32,11 @@ export const EXIT_JOBS = [
 export const REPO_DOCKERFILE_CHECKED = [
     { repo: 'wtfalch/auth', dockerfile: '/login/Dockerfile', seen: 'login image, docker inspect' },
     { repo: 'wtfalch/auth', dockerfile: '/broker/Dockerfile', seen: 'broker image, docker inspect' },
+    {
+        repo: 'wtfalch/agora',
+        dockerfile: '/apps/desktop-auth/Dockerfile',
+        seen: 'apps/desktop-auth/Dockerfile HEALTHCHECK line (calls /health)',
+    },
     { repo: 'wtfalch/ai', target: 'worker', seen: 'ai-worker image, docker inspect' },
     { repo: 'wtfalch/integrations', target: 'runner', seen: 'integrations/Dockerfile line 49' },
     {

package/dist/plan/index.d.ts

@@ -20,6 +20,9 @@ export type { PlatformOrgClientFactories } from './platform-org-ports.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export type { AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot } from './adopt.js';
 export { AdoptRefusedError } from './adopt.js';
+export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, } from './org-postgres-migrate.js';
+export type { OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
+export { OrgPostgresMigrationBackupMissingError } from './backup-gate.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';

package/dist/plan/index.js

@@ -9,6 +9,8 @@ export { provisionSfuApp, sfuCompose, sfuConfig } from './own-sfu.js';
 export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformNetwork, platformTarget, scopeFromOrg, scopeFromPlatform, } from './own-services.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
+export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, } from './org-postgres-migrate.js';
+export { OrgPostgresMigrationBackupMissingError } from './backup-gate.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';

package/dist/plan/job-app.d.ts

@@ -0,0 +1,23 @@
+import type { PlatformAuthDeps } from './platform-providers.js';
+/** A failure a job step words itself. Anything else that goes wrong is reported without its cause, which could carry a URL. */
+export declare class JobFailure extends Error {
+}
+export interface JobRuntime {
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    /** How long the job may run (default 30 minutes). */
+    signinDbMoveTimeoutMs?: number;
+    /** Pause between polls of the job (default 10 seconds). */
+    signinDbMovePollMs?: number;
+}
+/**
+ * Waits for a one-shot job app to report healthy, which it does only when its work is verified. The
+ * job never exits on success, so any exit is final: `restarting` at once, `exited` once the job was
+ * seen running or stayed exited for {@link JOB_EXITED_POLLS} polls. It has failed too at the deadline.
+ * A healthy status read before any other could be the container before the stop, so it counts only
+ * after a different status was seen.
+ */
+export declare function waitForJob(coolify: Pick<PlatformAuthDeps['coolify'], 'getApplication'>, appId: string, runtime: JobRuntime, words: {
+    job: string;
+    stopped: string;
+}): Promise<void>;

package/dist/plan/job-app.js

@@ -0,0 +1,41 @@
+/** A failure a job step words itself. Anything else that goes wrong is reported without its cause, which could carry a URL. */
+export class JobFailure extends Error {
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Polls of an `exited` job with no `running` seen before it counts as a stop (an `exited` read can be the container before the deploy). */
+const JOB_EXITED_POLLS = 6;
+/**
+ * Waits for a one-shot job app to report healthy, which it does only when its work is verified. The
+ * job never exits on success, so any exit is final: `restarting` at once, `exited` once the job was
+ * seen running or stayed exited for {@link JOB_EXITED_POLLS} polls. It has failed too at the deadline.
+ * A healthy status read before any other could be the container before the stop, so it counts only
+ * after a different status was seen.
+ */
+export async function waitForJob(coolify, appId, runtime, words) {
+    const now = runtime.now ?? Date.now;
+    const sleep = runtime.sleep ?? defaultSleep;
+    const timeout = runtime.signinDbMoveTimeoutMs ?? 1_800_000;
+    const interval = runtime.signinDbMovePollMs ?? 10_000;
+    const deadline = now() + timeout;
+    let left = false;
+    let running = false;
+    let exitedPolls = 0;
+    for (;;) {
+        const { status } = await coolify.getApplication(appId);
+        if (status === 'running:healthy' && left)
+            return;
+        if (status !== 'running:healthy')
+            left = true;
+        if (status?.startsWith('running'))
+            running = true;
+        exitedPolls = status?.startsWith('exited') ? exitedPolls + 1 : 0;
+        if (status?.startsWith('restarting') ||
+            (status?.startsWith('exited') && (running || exitedPolls >= JOB_EXITED_POLLS))) {
+            throw new JobFailure(words.stopped);
+        }
+        if (now() >= deadline) {
+            throw new JobFailure(`${words.job} did not finish within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'})`);
+        }
+        await sleep(interval);
+    }
+}

package/dist/plan/live.d.ts

@@ -57,6 +57,12 @@ export interface LiveResource {
  * clients for `FilesReader`/`AiReader` (and every other reader here) is #20,
  * a non-goal of #27.
  */
+/**
+ * The `zitadel` live resource kind a reader emits, keyed by the app's name,
+ * when a recorded app is missing from the listing and a direct read by app id
+ * answered not-found (#557). The planner offers the replacement only for it.
+ */
+export declare const APP_GONE_KIND = "app-gone";
 export interface ZitadelReader {
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }

package/dist/plan/live.js

@@ -1,6 +1,22 @@
 import { ownsServices } from '../org.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
+/**
+ * One narrow interface per system (#19 "Done when"): a single read, scoped
+ * to one org, returning everything foundry can see there. Real
+ * implementations follow `bootstrap/coolify-api.ts`'s pattern in
+ * `wtfalch/app-template` — a token read from the environment or the secrets
+ * file, never the command line, never logged. Nothing here calls anything
+ * real; `plan-apply.test.ts` and `diff.test.ts` use fakes. Wiring real
+ * clients for `FilesReader`/`AiReader` (and every other reader here) is #20,
+ * a non-goal of #27.
+ */
+/**
+ * The `zitadel` live resource kind a reader emits, keyed by the app's name,
+ * when a recorded app is missing from the listing and a direct read by app id
+ * answered not-found (#557). The planner offers the replacement only for it.
+ */
+export const APP_GONE_KIND = 'app-gone';
 /** Every live resource foundry can see for `orgId`, across all six systems. */
 export async function readLiveResources(orgId, readers, org, orgRecordedIds) {
     const [zitadel, coolify, cloudflare, files, ai, cms] = await Promise.all([

package/dist/plan/login-host.d.ts

@@ -104,6 +104,11 @@ export interface LoginHostBinding {
     apps?: Record<string, 'agora' | 'boule' | 'archon'>;
     /** In-app sign-in: the login serves this host under `/sign-in`. Absent: the root. */
     basePath?: typeof SIGN_IN_BASE_PATH;
+    /**
+     * The domain this host's company-wide cookies use: a bare lower-case name that the host equals or sits
+     * under. Absent: host-only cookies. An older login ignores the field.
+     */
+    cookieDomain?: string;
 }
 /**
  * The app hosts that sign in on their own address when the company has `signIn.inApp`: Agora's and
@@ -138,6 +143,14 @@ export interface LoginHostBindingsPort {
      * The login-host step calls it after all its upserts and before any app is repointed.
      */
     flush?(): Promise<void>;
+    /**
+     * Adds or replaces `clientId -> organisation id` entries in the document's `clientOrganizations`, the
+     * map the shared login host checks a customers client's organisation scope against. Merged by key.
+     * Optional: a port without it cannot write the map, and the plan says so in one fixed line.
+     */
+    upsertClientOrganizations?(entries: Readonly<Record<string, string>>): Promise<void>;
+    /** Removes those client ids from the map. An id that is absent is done. */
+    deleteClientOrganizations?(clientIds: readonly string[]): Promise<void>;
 }
 /**
  * Scope id holding what the binding was last written with
@@ -160,6 +173,21 @@ export declare function customersEntryKeys(org: DeclaredOrg): Set<string>;
  * app hosts that have their own binding (in-app sign-in) are not in the company's.
  */
 export declare function loginHostClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, except?: readonly string[]): string[];
+/**
+ * Scope id holding the map last written to `clientOrganizations`: sorted `clientId=organisationId` pairs
+ * joined by `,` ({@link clientOrganizationsState}). Absent or empty means none.
+ */
+export declare const LOGIN_CLIENT_ORGS_SCOPE_KEY = "login_client_orgs";
+/**
+ * The customers clients of the org and the customers organisation each signs in to, for the shared login
+ * host to check: every customers entry whose client id and the org's `zitadel:customers:<org.id>` are both
+ * recorded. Staff clients are not here.
+ */
+export declare function customersClientOrganizations(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): Record<string, string>;
+/** {@link LOGIN_CLIENT_ORGS_SCOPE_KEY}'s value for a map. */
+export declare function clientOrganizationsState(map: Readonly<Record<string, string>>): string;
+/** The client ids a recorded {@link LOGIN_CLIENT_ORGS_SCOPE_KEY} value holds. */
+export declare function clientOrganizationIds(state: string | undefined): string[];
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export declare function loginBindingState(host: string, clientIds: readonly string[]): string;
 /**

package/dist/plan/login-host.js

@@ -189,6 +189,42 @@ export function loginHostClientIds(org, recorded, except = []) {
     ].filter((id) => Boolean(id));
     return [...new Set(ids)].filter((id) => !except.includes(id)).sort();
 }
+/**
+ * Scope id holding the map last written to `clientOrganizations`: sorted `clientId=organisationId` pairs
+ * joined by `,` ({@link clientOrganizationsState}). Absent or empty means none.
+ */
+export const LOGIN_CLIENT_ORGS_SCOPE_KEY = 'login_client_orgs';
+/**
+ * The customers clients of the org and the customers organisation each signs in to, for the shared login
+ * host to check: every customers entry whose client id and the org's `zitadel:customers:<org.id>` are both
+ * recorded. Staff clients are not here.
+ */
+export function customersClientOrganizations(org, recorded) {
+    const customersOrgId = recorded[`zitadel:customers:${org.id}`];
+    if (!customersOrgId)
+        return {};
+    const map = {};
+    for (const key of customersEntryKeys(org)) {
+        const clientId = recorded[ENTRY_CLIENT_ID_SCOPE_PREFIX + key];
+        if (clientId)
+            map[clientId] = customersOrgId;
+    }
+    return map;
+}
+/** {@link LOGIN_CLIENT_ORGS_SCOPE_KEY}'s value for a map. */
+export function clientOrganizationsState(map) {
+    return Object.entries(map)
+        .map(([clientId, orgId]) => `${clientId}=${orgId}`)
+        .sort()
+        .join(',');
+}
+/** The client ids a recorded {@link LOGIN_CLIENT_ORGS_SCOPE_KEY} value holds. */
+export function clientOrganizationIds(state) {
+    return (state ?? '')
+        .split(',')
+        .map((pair) => pair.split('=')[0] ?? '')
+        .filter((id) => id.length > 0);
+}
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export function loginBindingState(host, clientIds) {
     return `${host} ${clientIds.join(',')}`;

package/dist/plan/org-names.js

@@ -11,7 +11,15 @@ import { appNameFor } from './platform-diff.js';
  */
 export function companyServiceNames(org) {
     const s = org.slug;
-    const names = [`${s}-agora`, `${s}-boule`, `${s}-boule-db`, `${s}-tunnel`, `${s}-cloudflared`];
+    const names = [
+        `${s}-agora`,
+        `${s}-boule`,
+        `${s}-boule-db`,
+        `${s}-postgres`,
+        `${s}-postgres-job`,
+        `${s}-tunnel`,
+        `${s}-cloudflared`,
+    ];
     if (org.chat?.enabled) {
         names.push(...Object.values(chatInternalNames(s)), ...Object.values(chatRekeyedInternalNames(s)));
     }

package/dist/plan/org-postgres-job.d.ts

@@ -0,0 +1,22 @@
+import type { OrgServiceDatabase } from '../org.js';
+/** Env of the job app: the server's admin URL, and one password per home that is not recorded yet. */
+export declare const ORG_POSTGRES_JOB_ADMIN_ENV = "ADMIN_DATABASE_URL";
+/** Env name of a home's owner password: `PW_<HOME>`. */
+export declare function orgPostgresPasswordEnv(schema: string): string;
+/** Env name of the runtime role's password, set for desktop-auth only (its migrate has no role step). */
+export declare function orgPostgresRuntimePasswordEnv(schema: string): string;
+/** Only the home that has no app of its own to create its runtime role gets one from the job. */
+export declare function jobCreatesRuntimeRole(home: OrgServiceDatabase): boolean;
+/**
+ * The job's script (D-F). CONNECT stays with PUBLIC, the Postgres default: the template apps create
+ * their own runtime role on first boot and none of them grants it CONNECT, so a revoke would lock
+ * out the service (found by the T-PROVISION test against Boule's own boot script). What keeps a
+ * home closed is the schema: `public` is revoked from PUBLIC and owned by the home's owner.
+ * Idempotent per home: a role or database that exists is kept, and an owner
+ * password is set only for a home the caller passes, which is a home not yet recorded. Roles are made
+ * by `format('%I')` and passwords by `format('%L')`, so no value is spliced into SQL by the shell.
+ * It never prints a URL or a password: psql's output is discarded and an error line names the home.
+ */
+export declare function orgPostgresProvisionScript(homes: readonly OrgServiceDatabase[]): string[];
+/** The job: the same pinned image as the legacy databases, so `psql` matches the server's major version. */
+export declare function orgPostgresProvisionDockerfile(homes: readonly OrgServiceDatabase[]): string;

package/dist/plan/org-postgres-job.js

@@ -0,0 +1,91 @@
+import { pinnedRef } from '../bootstrap/versions.js';
+/** Env of the job app: the server's admin URL, and one password per home that is not recorded yet. */
+export const ORG_POSTGRES_JOB_ADMIN_ENV = 'ADMIN_DATABASE_URL';
+const JOB_DONE_FILE = '/tmp/done';
+/** Left by a run that did not finish: a restart of the same container then stops at once instead of running again. */
+const JOB_FAILED_FILE = '/tmp/failed';
+const NAME = /^[a-z][a-z0-9_]{0,62}$/;
+/** Env name of a home's owner password: `PW_<HOME>`. */
+export function orgPostgresPasswordEnv(schema) {
+    return `PW_${schema.toUpperCase()}`;
+}
+/** Env name of the runtime role's password, set for desktop-auth only (its migrate has no role step). */
+export function orgPostgresRuntimePasswordEnv(schema) {
+    return `${orgPostgresPasswordEnv(schema)}_RT`;
+}
+/** Only the home that has no app of its own to create its runtime role gets one from the job. */
+export function jobCreatesRuntimeRole(home) {
+    return home.schema === 'desktop_auth';
+}
+function checked(name) {
+    if (!NAME.test(name))
+        throw new Error(`Postgres name is not valid: ${name}`);
+    return name;
+}
+function homeBlock(home) {
+    const owner = checked(home.ownerRole);
+    const db = checked(home.database);
+    const pw = orgPostgresPasswordEnv(home.schema);
+    const rtCreated = jobCreatesRuntimeRole(home);
+    const rtPw = orgPostgresRuntimePasswordEnv(home.schema);
+    const attributes = home.split ? 'LOGIN CREATEROLE' : 'LOGIN';
+    const collation = home.collateC ? " LC_COLLATE ''C'' LC_CTYPE ''C''" : '';
+    const lines = [
+        `[ -n "\${${pw}:-}" ] || fail "${home.schema}"`,
+        ...(rtCreated ? [`[ -n "\${${rtPw}:-}" ] || fail "${home.schema}"`] : []),
+        `psql "$${ORG_POSTGRES_JOB_ADMIN_ENV}" -X -q -v ON_ERROR_STOP=1 > /dev/null 2>&1 <<'SQL' || fail "${home.schema}"`,
+        `\\set owner '${owner}'`,
+        `\\set db '${db}'`,
+        `\\getenv pw ${pw}`,
+        `SELECT format('CREATE ROLE %I ${attributes}', :'owner') WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'owner') \\gexec`,
+        `SELECT format('ALTER ROLE %I PASSWORD %L', :'owner', :'pw') \\gexec`,
+        `SELECT format('CREATE DATABASE %I OWNER %I TEMPLATE template0 ENCODING ''UTF8''${collation}', :'db', :'owner') WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'db') \\gexec`,
+    ];
+    if (rtCreated) {
+        const rt = checked(home.runtimeRole);
+        lines.push(`\\set rt '${rt}'`, `\\getenv pwrt ${rtPw}`, "SELECT format('CREATE ROLE %I LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS NOREPLICATION', :'rt') WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'rt') \\gexec", "SELECT format('ALTER ROLE %I PASSWORD %L', :'rt', :'pwrt') \\gexec", 'GRANT CONNECT ON DATABASE :"db" TO :"rt";');
+    }
+    lines.push('\\connect :"db"', 'REVOKE ALL ON SCHEMA public FROM PUBLIC;', 'ALTER SCHEMA public OWNER TO :"owner";');
+    if (rtCreated) {
+        lines.push('GRANT USAGE ON SCHEMA public TO :"rt";', 'ALTER DEFAULT PRIVILEGES FOR ROLE :"owner" IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"rt";', 'ALTER DEFAULT PRIVILEGES FOR ROLE :"owner" IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO :"rt";');
+    }
+    lines.push('SQL', `echo "org-postgres: ${home.schema} ready"`);
+    return lines;
+}
+/**
+ * The job's script (D-F). CONNECT stays with PUBLIC, the Postgres default: the template apps create
+ * their own runtime role on first boot and none of them grants it CONNECT, so a revoke would lock
+ * out the service (found by the T-PROVISION test against Boule's own boot script). What keeps a
+ * home closed is the schema: `public` is revoked from PUBLIC and owned by the home's owner.
+ * Idempotent per home: a role or database that exists is kept, and an owner
+ * password is set only for a home the caller passes, which is a home not yet recorded. Roles are made
+ * by `format('%I')` and passwords by `format('%L')`, so no value is spliced into SQL by the shell.
+ * It never prints a URL or a password: psql's output is discarded and an error line names the home.
+ */
+export function orgPostgresProvisionScript(homes) {
+    if (homes.length === 0)
+        throw new Error('org-postgres job: no homes');
+    return [
+        '#!/bin/sh',
+        'set -eu',
+        `trap '[ -f ${JOB_DONE_FILE} ] || touch ${JOB_FAILED_FILE}' EXIT`,
+        "trap 'exit 1' HUP INT TERM",
+        `[ ! -f ${JOB_FAILED_FILE} ] || exit 1`,
+        `rm -f ${JOB_DONE_FILE}`,
+        'fail() { echo "org-postgres: $1 failed"; exit 1; }',
+        ...homes.flatMap(homeBlock),
+        `echo "org-postgres: ${homes.length} homes ready"`,
+        `touch ${JOB_DONE_FILE}`,
+        'exec sleep infinity',
+    ];
+}
+/** The job: the same pinned image as the legacy databases, so `psql` matches the server's major version. */
+export function orgPostgresProvisionDockerfile(homes) {
+    const encoded = Buffer.from(`${orgPostgresProvisionScript(homes).join('\n')}\n`, 'utf8').toString('base64');
+    return [
+        `FROM postgres:${pinnedRef('postgres')}`,
+        `RUN echo '${encoded}' | base64 -d > /usr/local/bin/org-postgres && chmod 0755 /usr/local/bin/org-postgres`,
+        'ENTRYPOINT ["/usr/local/bin/org-postgres"]',
+        `HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=1 CMD ["test", "-f", "${JOB_DONE_FILE}"]`,
+    ].join('\n');
+}

package/dist/plan/org-postgres-migrate.d.ts

@@ -0,0 +1,115 @@
+import { type DeclaredOrg, type OrgServiceSchema } from '../org.js';
+import type { UnmanagedItem } from '../plan.js';
+import type { DraftStep } from './diff.js';
+import type { CoolifyPort } from './executor.js';
+import { type JobRuntime } from './job-app.js';
+import type { StepScope } from './own-services.js';
+/** Set only by `confirmOrgPostgresMigration`. Without it no migration step is planned, applied or run. */
+export declare const ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY = "org_postgres_migration_confirmed";
+/** The copy job's app id while it exists. */
+export declare const ORG_POSTGRES_MIGRATE_APP_SCOPE_KEY = "org_postgres_migrate_app";
+export interface OrgPostgresMigrationConfirmation {
+    /** Id of the staging copy the operator ran this on first, for example `staging-2026-10-20`. 3-80 characters. */
+    stagingCopy: string;
+    /** Who confirmed. */
+    confirmedBy: string;
+    /** ISO time. */
+    confirmedAt: string;
+}
+/** Thrown before anything is called when the confirmation is not recorded. */
+export declare class OrgPostgresMigrationNotConfirmedError extends Error {
+    constructor();
+}
+/** Thrown by `confirmOrgPostgresMigration` for a confirmation that is not valid; nothing is recorded. */
+export declare class InvalidMigrationConfirmationError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+/** Why a confirmation is not valid, or null. Pure. */
+export declare function invalidMigrationConfirmation(c: OrgPostgresMigrationConfirmation): string | null;
+/** Pure. The recorded confirmation, or null when absent or not valid. */
+export declare function parseMigrationConfirmation(raw: string | undefined): OrgPostgresMigrationConfirmation | null;
+/** The home a planned `org-postgres-migrate` step names, from its action key `<org.id>:<home>`. */
+export declare function migrateHomeOf(action: {
+    key: string;
+    desired: Record<string, unknown>;
+}): string;
+export interface OrgPostgresMigrationPlan {
+    steps: DraftStep[];
+    unmanaged: UnmanagedItem[];
+}
+/**
+ * Pure. The migration step for the first home that has a legacy database and is ready, and only once the
+ * confirmation is recorded. `legacy` is the homes {@link planOrgPostgres} reports as unmigrated. A home is
+ * ready when the server and its database are recorded: provisioning goes first. Unconfirmed: no step, one
+ * line. Migrated homes whose old database is still recorded get a line, because the old database is never
+ * deleted here.
+ */
+export declare function planOrgPostgresMigration(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, legacy: readonly OrgServiceSchema[]): OrgPostgresMigrationPlan;
+export declare const ORG_POSTGRES_MIGRATE_ENV: {
+    readonly oldUrl: "OLD_DATABASE_URL";
+    readonly newUrl: "NEW_DATABASE_URL";
+    readonly newAdminUrl: "NEW_ADMIN_DATABASE_URL";
+};
+/** The job app's name in Coolify. */
+export declare const orgPostgresMigrateJobName: (org: Pick<DeclaredOrg, "slug">) => string;
+/**
+ * The job's script. It reads the old database and writes the new one; the old database is never
+ * written. A new database that holds tables is a stop, never a drop. It prints counts and fixed
+ * messages, never a URL.
+ */
+export declare function orgPostgresMigrateScript(ownerRole: string): string[];
+/** The job: the same pinned image as the servers, so `pg_dump` matches their major version. */
+export declare function orgPostgresMigrateDockerfile(ownerRole: string): string;
+type MigrateCoolify = Pick<CoolifyPort, 'findOrCreateEnvironment' | 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy' | 'raw'>;
+/** The apps that use a home's database. */
+export interface MigrationConsumers {
+    appIds: readonly string[];
+    /** A template app takes `DATABASE_URL_OWNER` and `DATABASE_URL`; a matrix stack renders its config from the server on the next apply. */
+    template: boolean;
+}
+export interface OrgPostgresMigrateRuntime extends JobRuntime {
+    /** How long a consumer may take to report stopped (default 2 minutes). */
+    signinDbStopTimeoutMs?: number;
+    /** How long a consumer may take to report healthy on the new database (default 5 minutes). */
+    readyTimeoutMs?: number;
+}
+/** Everything the step takes from the executor. New ones go here, never as positional arguments. */
+export interface OrgPostgresMigrateDeps {
+    coolify: MigrateCoolify;
+    ensureProject(): Promise<string>;
+    serverUuid(): Promise<string>;
+    /** Starts the company's Postgres server when it is not running and returns its live record. */
+    startServer(uuid: string): Promise<{
+        internal_db_url?: string;
+        status?: string;
+    }>;
+    /** Reads an old Coolify database as it is. Never starts, writes or deletes it. */
+    readLegacyDatabase(uuid: string): Promise<{
+        internal_db_url?: string;
+        status?: string;
+    }>;
+    /** The password the host holds under a ref, or undefined. */
+    resolveSecret(ref: string): Promise<string | undefined>;
+    consumers(home: OrgServiceSchema): Promise<MigrationConsumers>;
+    onSecret?(value: string): void;
+    runtime?: OrgPostgresMigrateRuntime;
+}
+/**
+ * Copies one home's data from its legacy Coolify database to the company's Postgres server (#444).
+ *
+ * 1. The recorded confirmation is checked before anything is called.
+ * 2. The consumer apps are stopped, and the step waits until Coolify reports them stopped.
+ * 3. A one-shot job app dumps the old database into the new, empty one and compares the tables, the
+ *    row count of each and the value of each sequence in both.
+ * 4. A template app gets the new `DATABASE_URL_OWNER` and `DATABASE_URL` (the runtime password it has now).
+ * 5. `org_postgres_migrated.<home>` is recorded and persisted BEFORE a consumer starts on the new database.
+ *
+ * The old database is never written to or deleted. A failure before step 4 starts the consumers on the
+ * old database again. A failure around step 4 reads the live env back and acts on what is really set;
+ * when it cannot tell, the consumers stay stopped and the error says so. A rerun that finds the new
+ * URL already set records and starts without copying. A matrix stack is left stopped: its config is
+ * rendered from the server by the next apply, which starts it.
+ */
+export declare function migrateOrgPostgresHome(scope: StepScope, deps: OrgPostgresMigrateDeps, org: DeclaredOrg, homeKey: string): Promise<void>;
+export {};