@wtfalch/foundry 0.45.0 → 0.46.0

package/dist/plan/org-postgres-migrate.js

@@ -0,0 +1,466 @@
+import { pinnedRef } from '../bootstrap/versions.js';
+import { ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, orgServiceDatabase, } from '../org.js';
+import { JobFailure, waitForJob } from './job-app.js';
+import { orgPostgresMigratedScopeKey, orgPostgresSecretRef, serviceEndpoint, serviceUrls, } from './org-postgres.js';
+import { boundedCall, waitHealthy, withCallTimeout } from './signin-db.js';
+/** Set only by `confirmOrgPostgresMigration`. Without it no migration step is planned, applied or run. */
+export const ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY = 'org_postgres_migration_confirmed';
+/** The copy job's app id while it exists. */
+export const ORG_POSTGRES_MIGRATE_APP_SCOPE_KEY = 'org_postgres_migrate_app';
+/** Thrown before anything is called when the confirmation is not recorded. */
+export class OrgPostgresMigrationNotConfirmedError extends Error {
+    constructor() {
+        super('org postgres migration refused: no staging confirmation is recorded');
+        this.name = 'OrgPostgresMigrationNotConfirmedError';
+    }
+}
+/** Thrown by `confirmOrgPostgresMigration` for a confirmation that is not valid; nothing is recorded. */
+export class InvalidMigrationConfirmationError extends Error {
+    reason;
+    constructor(reason) {
+        super(`org postgres migration confirmation refused: ${reason}`);
+        this.reason = reason;
+        this.name = 'InvalidMigrationConfirmationError';
+    }
+}
+/** Why a confirmation is not valid, or null. Pure. */
+export function invalidMigrationConfirmation(c) {
+    if (typeof c.stagingCopy !== 'string' || c.stagingCopy.trim().length < 3) {
+        return 'the staging copy id needs 3 to 80 characters';
+    }
+    if (c.stagingCopy.length > 80)
+        return 'the staging copy id needs 3 to 80 characters';
+    if (typeof c.confirmedBy !== 'string' || c.confirmedBy.trim().length === 0) {
+        return 'the confirming person is missing';
+    }
+    if (typeof c.confirmedAt !== 'string' || Number.isNaN(Date.parse(c.confirmedAt))) {
+        return 'the confirmation time is not a time';
+    }
+    return null;
+}
+/** Pure. The recorded confirmation, or null when absent or not valid. */
+export function parseMigrationConfirmation(raw) {
+    if (!raw)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const { stagingCopy, confirmedBy, confirmedAt } = value;
+    if (typeof stagingCopy !== 'string' ||
+        typeof confirmedBy !== 'string' ||
+        typeof confirmedAt !== 'string') {
+        return null;
+    }
+    const confirmation = { stagingCopy, confirmedBy, confirmedAt };
+    return invalidMigrationConfirmation(confirmation) === null ? confirmation : null;
+}
+/** The order homes move in; `desktop_auth` has nothing to move. */
+const MIGRATION_ORDER = [
+    'app',
+    'cms',
+    'boule',
+    'chat_service',
+    'calls_service',
+    'chat_synapse',
+    'chat_mas',
+    'calls_synapse',
+    'calls_mas',
+];
+/** The home a planned `org-postgres-migrate` step names, from its action key `<org.id>:<home>`. */
+export function migrateHomeOf(action) {
+    const home = action.desired.home;
+    if (typeof home !== 'string' || !MIGRATION_ORDER.some((h) => h === home)) {
+        throw new Error('org-postgres-migrate: the plan named no known home');
+    }
+    return home;
+}
+/**
+ * Pure. The migration step for the first home that has a legacy database and is ready, and only once the
+ * confirmation is recorded. `legacy` is the homes {@link planOrgPostgres} reports as unmigrated. A home is
+ * ready when the server and its database are recorded: provisioning goes first. Unconfirmed: no step, one
+ * line. Migrated homes whose old database is still recorded get a line, because the old database is never
+ * deleted here.
+ */
+export function planOrgPostgresMigration(org, recordedIds, legacy) {
+    const steps = [];
+    const unmanaged = [];
+    for (const home of ORG_SERVICE_SCHEMAS) {
+        const key = home.legacyKey(org);
+        if (key && recordedIds[key] && recordedIds[orgPostgresMigratedScopeKey(home.schema)]) {
+            unmanaged.push({
+                description: `${org.slug}'s old ${home.schema} database ${recordedIds[key]} was copied to its Postgres server and is kept; delete it by hand once you no longer need it`,
+                key: `org-postgres-legacy-kept:${org.slug}:${home.schema}`,
+            });
+        }
+    }
+    if (!recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY])
+        return { steps, unmanaged };
+    const ready = MIGRATION_ORDER.flatMap((name) => {
+        const home = legacy.find((h) => h.schema === name);
+        return home && recordedIds[home.scopeKey] ? [home] : [];
+    });
+    if (ready.length === 0)
+        return { steps, unmanaged };
+    if (!parseMigrationConfirmation(recordedIds[ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY])) {
+        unmanaged.push({
+            description: `${org.slug}'s data is still on its own Coolify databases; moving it needs the staging copy confirmed first`,
+            key: `org-postgres-migration-unconfirmed:${org.slug}`,
+        });
+        return { steps, unmanaged };
+    }
+    const first = ready[0];
+    if (first) {
+        steps.push({
+            action: {
+                system: 'coolify',
+                kind: 'org-postgres-migrate',
+                key: `${org.id}:${first.schema}`,
+                desired: { home: first.schema },
+            },
+            step: {
+                description: `copy ${org.slug}'s ${first.schema} database to its Postgres server; the old database is kept`,
+                destroys: false,
+                migrates: true,
+            },
+        });
+    }
+    return { steps, unmanaged };
+}
+export const ORG_POSTGRES_MIGRATE_ENV = {
+    oldUrl: 'OLD_DATABASE_URL',
+    newUrl: 'NEW_DATABASE_URL',
+    newAdminUrl: 'NEW_ADMIN_DATABASE_URL',
+};
+const JOB_DONE_FILE = '/tmp/done';
+const JOB_FAILED_FILE = '/tmp/failed';
+const JOB_DUMP_FILE = '/tmp/dump.fc';
+/** The job app's name in Coolify. */
+export const orgPostgresMigrateJobName = (org) => `${org.slug}-postgres-migrate`;
+/**
+ * The job's script. It reads the old database and writes the new one; the old database is never
+ * written. A new database that holds tables is a stop, never a drop. It prints counts and fixed
+ * messages, never a URL.
+ */
+export function orgPostgresMigrateScript(ownerRole) {
+    if (!/^[a-z][a-z0-9_]{0,62}$/.test(ownerRole)) {
+        throw new Error(`Postgres name is not valid: ${ownerRole}`);
+    }
+    const old = `"$${ORG_POSTGRES_MIGRATE_ENV.oldUrl}"`;
+    const next = `"$${ORG_POSTGRES_MIGRATE_ENV.newUrl}"`;
+    const admin = `"$${ORG_POSTGRES_MIGRATE_ENV.newAdminUrl}"`;
+    const tables = "select quote_ident(schemaname) || '.' || quote_ident(tablename) from pg_tables where schemaname not in ('pg_catalog', 'information_schema') order by 1";
+    const sequences = "select quote_ident(schemaname) || '.' || quote_ident(sequencename) || '=' || coalesce(last_value::text, 'null') from pg_sequences where schemaname not in ('pg_catalog', 'information_schema') order by 1";
+    return [
+        '#!/bin/sh',
+        'set -eu',
+        `trap 'rm -f ${JOB_DUMP_FILE}; [ -f ${JOB_DONE_FILE} ] || touch ${JOB_FAILED_FILE}' EXIT`,
+        "trap 'exit 1' HUP INT TERM",
+        `[ ! -f ${JOB_FAILED_FILE} ] || exit 1`,
+        `rm -f ${JOB_DONE_FILE}`,
+        'fail() { echo "org-postgres-migrate: $1"; exit 1; }',
+        `old_major=$(psql ${old} -Atc "show server_version_num" | cut -c1-2)`,
+        `new_major=$(psql ${admin} -Atc "show server_version_num" | cut -c1-2)`,
+        '[ "$old_major" = "$new_major" ] || fail "the two servers run different Postgres versions"',
+        `existing=$(psql ${next} -Atc "select count(*) from pg_tables where schemaname not in ('pg_catalog', 'information_schema')")`,
+        '[ "$existing" = "0" ] || fail "the new database is not empty"',
+        `pg_dump -Fc --no-owner --no-acl ${old} -f ${JOB_DUMP_FILE} || fail "pg_dump failed"`,
+        `pg_restore --no-owner --no-acl --role=${ownerRole} --exit-on-error -d ${next} ${JOB_DUMP_FILE} || fail "the restore failed"`,
+        `rm -f ${JOB_DUMP_FILE}`,
+        `old_tables=$(psql ${old} -Atc "${tables}")`,
+        `new_tables=$(psql ${next} -Atc "${tables}")`,
+        '[ "$old_tables" = "$new_tables" ] || fail "the two databases hold different tables"',
+        'checked=0',
+        'set -f',
+        'printf "%s\\n" "$old_tables" > /tmp/tables',
+        'while IFS= read -r t; do',
+        '  [ -n "$t" ] || continue',
+        `  a=$(psql ${old} -Atc "select count(*) from $t")`,
+        `  b=$(psql ${next} -Atc "select count(*) from $t")`,
+        '  [ "$a" = "$b" ] || fail "row count differs in $t: old $a, new $b"',
+        '  checked=$((checked + 1))',
+        'done < /tmp/tables',
+        'set +f',
+        '[ "$checked" -gt 0 ] || fail "the old database has no tables"',
+        `old_seq=$(psql ${old} -Atc "${sequences}")`,
+        `new_seq=$(psql ${next} -Atc "${sequences}")`,
+        '[ "$old_seq" = "$new_seq" ] || fail "the sequences differ"',
+        'echo "org-postgres-migrate: $checked tables copied, row counts and sequences equal"',
+        `touch ${JOB_DONE_FILE}`,
+        'exec sleep infinity',
+    ];
+}
+/** The job: the same pinned image as the servers, so `pg_dump` matches their major version. */
+export function orgPostgresMigrateDockerfile(ownerRole) {
+    const encoded = Buffer.from(`${orgPostgresMigrateScript(ownerRole).join('\n')}\n`, 'utf8').toString('base64');
+    return [
+        `FROM postgres:${pinnedRef('postgres')}`,
+        `RUN echo '${encoded}' | base64 -d > /usr/local/bin/org-postgres-migrate && chmod 0755 /usr/local/bin/org-postgres-migrate`,
+        'ENTRYPOINT ["/usr/local/bin/org-postgres-migrate"]',
+        `HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=1 CMD ["test", "-f", "${JOB_DONE_FILE}"]`,
+    ].join('\n');
+}
+class MigrateFailure extends Error {
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function waitStopped(coolify, appId, runtime) {
+    const now = runtime.now ?? Date.now;
+    const sleep = runtime.sleep ?? defaultSleep;
+    const timeout = runtime.signinDbStopTimeoutMs ?? 120_000;
+    const interval = runtime.signinDbMovePollMs ?? 10_000;
+    const deadline = now() + timeout;
+    for (;;) {
+        const { status } = await coolify.getApplication(appId);
+        if (status?.startsWith('exited') || status?.startsWith('stopped'))
+            return;
+        if (now() >= deadline) {
+            throw new MigrateFailure(`an app did not report stopped within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'}), so nothing was copied`);
+        }
+        await sleep(interval);
+    }
+}
+/** Runs `work`; a failure comes back as a note for the error message, never thrown. */
+async function attempt(work, failed) {
+    try {
+        await work();
+        return '';
+    }
+    catch {
+        return ` (${failed})`;
+    }
+}
+/**
+ * Copies one home's data from its legacy Coolify database to the company's Postgres server (#444).
+ *
+ * 1. The recorded confirmation is checked before anything is called.
+ * 2. The consumer apps are stopped, and the step waits until Coolify reports them stopped.
+ * 3. A one-shot job app dumps the old database into the new, empty one and compares the tables, the
+ *    row count of each and the value of each sequence in both.
+ * 4. A template app gets the new `DATABASE_URL_OWNER` and `DATABASE_URL` (the runtime password it has now).
+ * 5. `org_postgres_migrated.<home>` is recorded and persisted BEFORE a consumer starts on the new database.
+ *
+ * The old database is never written to or deleted. A failure before step 4 starts the consumers on the
+ * old database again. A failure around step 4 reads the live env back and acts on what is really set;
+ * when it cannot tell, the consumers stay stopped and the error says so. A rerun that finds the new
+ * URL already set records and starts without copying. A matrix stack is left stopped: its config is
+ * rendered from the server by the next apply, which starts it.
+ */
+export async function migrateOrgPostgresHome(scope, deps, org, homeKey) {
+    const label = `${org.slug}'s ${homeKey} database migration`;
+    if (!parseMigrationConfirmation(scope.recordedIds()[ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY])) {
+        throw new OrgPostgresMigrationNotConfirmedError();
+    }
+    const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === homeKey);
+    if (!home || !MIGRATION_ORDER.some((h) => h === homeKey)) {
+        throw new Error(`${label}: not a home that has data to move`);
+    }
+    const recorded = scope.recordedIds();
+    if (recorded[orgPostgresMigratedScopeKey(homeKey)])
+        return;
+    const legacyId = home.legacyKey(org) ? recorded[home.legacyKey(org)] : undefined;
+    const serverId = recorded[ORG_POSTGRES_SERVER_SCOPE_KEY];
+    if (!legacyId)
+        throw new Error(`${label}: the home has no old database recorded`);
+    if (!serverId || !recorded[home.scopeKey]) {
+        throw new Error(`${label}: the Postgres server or the home's database is not provisioned yet`);
+    }
+    const coolify = withCallTimeout(deps.coolify);
+    const runtime = deps.runtime ?? {};
+    const onSecret = (value) => deps.onSecret?.(value);
+    const old = await boundedCall(deps.readLegacyDatabase(legacyId), 'Coolify getDatabase');
+    if (!old.internal_db_url || !old.status?.startsWith('running')) {
+        throw new Error(`${label}: the old database is not running`);
+    }
+    onSecret(old.internal_db_url);
+    if (URL.canParse(old.internal_db_url)) {
+        const pw = decodeURIComponent(new URL(old.internal_db_url).password);
+        if (pw)
+            onSecret(pw);
+    }
+    const server = await boundedCall(deps.startServer(serverId), 'Coolify startDatabase');
+    const endpoint = server.internal_db_url
+        ? serviceEndpoint(org, home, server.internal_db_url)
+        : null;
+    if (!server.internal_db_url || !endpoint) {
+        throw new Error(`${label}: the Postgres server has no internal URL yet`);
+    }
+    onSecret(server.internal_db_url);
+    if (URL.canParse(server.internal_db_url)) {
+        const pw = decodeURIComponent(new URL(server.internal_db_url).password);
+        if (pw)
+            onSecret(pw);
+    }
+    const ownerPassword = await boundedCall(deps.resolveSecret(orgPostgresSecretRef(org, homeKey, 'owner')), 'resolveSecret');
+    if (!ownerPassword)
+        throw new Error(`${label}: the owner password is not held yet`);
+    onSecret(ownerPassword);
+    const newOwnerUrl = serviceUrls(endpoint, ownerPassword, null).owner;
+    onSecret(newOwnerUrl);
+    const { appIds, template } = await deps.consumers(home);
+    const names = orgServiceDatabase(org, home);
+    const migratedKey = orgPostgresMigratedScopeKey(homeKey);
+    const readEnv = async (appId, key) => (await coolify.listEnvs(appId)).find((e) => e.key === key && !e.is_preview)?.value;
+    const primary = appIds[0];
+    /** Which database a template app's owner URL names right now. */
+    const liveDatabase = async () => {
+        if (!template || !primary)
+            return 'old';
+        try {
+            const url = await readEnv(primary, 'DATABASE_URL_OWNER');
+            if (url === newOwnerUrl)
+                return 'new';
+            return url === old.internal_db_url ? 'old' : 'unknown';
+        }
+        catch {
+            return 'unknown';
+        }
+    };
+    const start = async () => {
+        for (const id of appIds)
+            await coolify.deploy(id);
+        if (!template)
+            return;
+        for (const id of appIds) {
+            await waitHealthy(coolify, id, { ...runtime, signinDbTimeoutMs: runtime.readyTimeoutMs ?? 300_000 }, label, 'the app');
+        }
+    };
+    /** The home is recorded as migrated in one write, then the consumers start on the new database. */
+    const finishOnNew = async () => {
+        scope.recordScopeId(migratedKey, 'done');
+        try {
+            await scope.persist();
+        }
+        catch {
+            throw new MigrateFailure('the apps are stopped and use the new database; the migration could not be recorded, so they were not started; apply again, which records it and starts them');
+        }
+        if (!template)
+            return;
+        try {
+            await start();
+        }
+        catch {
+            throw new MigrateFailure('the migration is recorded and the apps use the new database, but they did not report healthy; check their logs and apply again');
+        }
+    };
+    const finished = (error) => {
+        throw new Error(`${label}: ${error instanceof MigrateFailure ? error.message : 'it could not be finished'}`);
+    };
+    const before = await liveDatabase();
+    if (before === 'new') {
+        await finishOnNew().catch(finished);
+        return;
+    }
+    if (before === 'unknown') {
+        throw new Error(`${label}: the app's database URL names neither database, so nothing is copied; set it to the old database in Coolify, then apply again`);
+    }
+    let envWriteStarted = false;
+    let jobAppId;
+    try {
+        for (const id of appIds)
+            await coolify.raw('POST', `/applications/${id}/stop`);
+        for (const id of appIds)
+            await waitStopped(coolify, id, runtime);
+        const projectUuid = await deps.ensureProject();
+        const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const jobName = orgPostgresMigrateJobName(org);
+        const leftover = await coolify.findApplicationByName(jobName, {
+            environmentIds: [environment.id],
+        });
+        if (leftover)
+            await coolify.raw('DELETE', `/applications/${leftover.uuid}`);
+        const created = await coolify.createDockerfileApplication({
+            project_uuid: projectUuid,
+            server_uuid: await deps.serverUuid(),
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            dockerfile: orgPostgresMigrateDockerfile(names.ownerRole),
+            name: jobName,
+            description: `${org.slug}'s ${homeKey} database copy job`,
+            instant_deploy: false,
+            autogenerate_domain: false,
+        });
+        jobAppId = created.uuid;
+        scope.recordScopeId(ORG_POSTGRES_MIGRATE_APP_SCOPE_KEY, jobAppId);
+        await scope.persist();
+        await coolify.updateApplication(jobAppId, { health_check_enabled: false });
+        await coolify.bulkUpsertEnvs(jobAppId, [
+            { key: ORG_POSTGRES_MIGRATE_ENV.oldUrl, value: old.internal_db_url },
+            { key: ORG_POSTGRES_MIGRATE_ENV.newUrl, value: newOwnerUrl },
+            { key: ORG_POSTGRES_MIGRATE_ENV.newAdminUrl, value: server.internal_db_url },
+        ]);
+        await coolify.deploy(jobAppId, true);
+        try {
+            await waitForJob(coolify, jobAppId, runtime, {
+                job: 'the copy job',
+                stopped: 'the copy job stopped before the row counts matched',
+            });
+        }
+        catch (error) {
+            throw error instanceof JobFailure ? new MigrateFailure(error.message) : error;
+        }
+        await coolify.raw('POST', `/applications/${jobAppId}/stop`);
+        if (template && primary) {
+            const liveRuntime = await readEnv(primary, 'DATABASE_URL');
+            envWriteStarted = true;
+            const envs = [{ key: 'DATABASE_URL_OWNER', value: newOwnerUrl }];
+            if (liveRuntime && URL.canParse(liveRuntime)) {
+                const live = new URL(liveRuntime);
+                const rtPassword = decodeURIComponent(live.password);
+                if (rtPassword)
+                    onSecret(rtPassword);
+                const runtimeUrl = serviceUrls({ ...endpoint, runtimeUser: decodeURIComponent(live.username) }, ownerPassword, rtPassword).runtime;
+                if (runtimeUrl) {
+                    onSecret(runtimeUrl);
+                    envs.push({ key: 'DATABASE_URL', value: runtimeUrl });
+                }
+            }
+            await coolify.bulkUpsertEnvs(primary, envs);
+        }
+    }
+    catch (error) {
+        const reason = error instanceof MigrateFailure
+            ? error.message
+            : 'a Coolify call failed (its message is not repeated)';
+        const timedOut = error instanceof Error && error.message.includes('did not answer within');
+        const live = await liveDatabase();
+        let state;
+        let tail = 'the old database is untouched and the new one is left for inspection';
+        if (live === 'new') {
+            tail = 'the old database is untouched';
+            try {
+                await finishOnNew();
+                state = 'the apps use the NEW database and the migration is recorded';
+            }
+            catch (finishError) {
+                state = `the apps use the NEW database, but ${finishError instanceof MigrateFailure ? finishError.message : 'they could not be started'}`;
+            }
+        }
+        else if (live === 'old' && !(envWriteStarted && timedOut)) {
+            state = `the apps were started again on the old database${await attempt(async () => {
+                for (const id of appIds)
+                    await coolify.deploy(id);
+            }, 'they could not be restarted, start them by hand')}`;
+        }
+        else {
+            state =
+                'the apps are left stopped: the write of the new database URL did not answer and may still land; do not start them by hand; wait until their database URL reads the same twice a minute apart in Coolify, then apply again';
+        }
+        const stoppedJob = jobAppId
+            ? await attempt(() => coolify.raw('POST', `/applications/${jobAppId}/stop`), 'the copy job could not be stopped')
+            : '';
+        throw new Error(`${label} failed: ${reason}. ${state}${stoppedJob}; ${tail}`);
+    }
+    await finishOnNew().catch(finished);
+    try {
+        await coolify.raw('DELETE', `/applications/${jobAppId}`);
+        scope.recordScopeId(ORG_POSTGRES_MIGRATE_APP_SCOPE_KEY, '');
+    }
+    catch {
+        throw new Error(`${label}: the data is migrated, but the copy job ${jobAppId} could not be deleted; delete it in Coolify (it holds the old database URL)`);
+    }
+}

package/dist/plan/org-postgres.d.ts

@@ -0,0 +1,90 @@
+import { type DeclaredOrg, type OrgServiceSchema } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { CoolifyPort } from './executor.js';
+import { type JobRuntime } from './job-app.js';
+import type { StepScope } from './own-services.js';
+/** Recorded once a live company's data for `home` is copied to the org's server (#444). */
+export declare const orgPostgresMigratedScopeKey: (home: string) => string;
+/** Whether `home` still has a legacy Coolify database that has not been moved to the server. */
+export declare function legacyUnmigrated(org: DeclaredOrg, home: OrgServiceSchema, recordedIds: Readonly<Record<string, string>>): boolean;
+/**
+ * Pure. Where a consumer finds its database, from recorded ids alone: on the
+ * server once the home is recorded and either it never had a legacy database
+ * or its migration is recorded. A live company stays on its Coolify database
+ * until then.
+ */
+export declare function serviceOnServer(org: DeclaredOrg, home: OrgServiceSchema, recordedIds: Readonly<Record<string, string>>): boolean;
+/** The parts of a home's connection on the company's server. */
+export interface ServiceDbEndpoint {
+    host: string;
+    port: string;
+    database: string;
+    ownerUser: string;
+    runtimeUser: string;
+}
+/** Pure. The home's endpoint on the server whose Coolify `internal_db_url` is given; null when that URL has no host. */
+export declare function serviceEndpoint(org: DeclaredOrg, home: OrgServiceSchema, serverInternalUrl: string): ServiceDbEndpoint | null;
+/** Pure. The owner URL, and the runtime URL when a runtime password is given. */
+export declare function serviceUrls(endpoint: ServiceDbEndpoint, ownerPassword: string, runtimePassword: string | null): {
+    owner: string;
+    runtime: string | null;
+};
+/** The server's name in Coolify. */
+export declare const orgPostgresServerName: (org: Pick<DeclaredOrg, "slug">) => string;
+/** The job app's name in Coolify. */
+export declare const orgPostgresJobName: (org: Pick<DeclaredOrg, "slug">) => string;
+/** The job app's id while it exists. */
+export declare const ORG_POSTGRES_JOB_APP_SCOPE_KEY = "org_postgres_job_app";
+/** An opaque id, set between a password's mint and its delivery. Never the password. */
+export declare const orgPostgresUndeliveredScopeKey: (home: string) => string;
+/** Where the host holds a home's password, once delivered. */
+export declare const orgPostgresSecretRef: (org: Pick<DeclaredOrg, "slug">, home: string, role: "owner" | "runtime") => string;
+/** How many times each password is handed to `deliverSecret`. */
+export declare const ORG_POSTGRES_DELIVERY_ATTEMPTS = 3;
+/**
+ * The two steps that make the company's Postgres server and its databases true, from recorded ids
+ * alone: the server while it is not recorded, the databases of every enabled home that is not. The
+ * databases step needs no precondition beyond the server step before it in the same plan.
+ */
+export declare function planOrgPostgresSteps(org: Pick<DeclaredOrg, 'id' | 'slug'>, plan: {
+    serverMissing: boolean;
+    missingSchemas: readonly OrgServiceSchema[];
+}): DraftStep[];
+type ServerCoolify = Pick<CoolifyPort, 'listDatabases' | 'createPostgresDatabase' | 'findOrCreateEnvironment' | 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'deploy' | 'raw'>;
+/** Everything the two steps take from the executor. New ones go here, never as positional arguments. */
+export interface OrgPostgresDeps {
+    coolify: ServerCoolify;
+    /** The company's Coolify project uuid, made when absent. */
+    ensureProject(): Promise<string>;
+    /** The Coolify server the company's resources live on. */
+    serverUuid(): Promise<string>;
+    /** Starts the database when it is not running and returns its live record. */
+    startDatabase(uuid: string): Promise<{
+        uuid: string;
+        internal_db_url?: string;
+        status?: string;
+    }>;
+    deliverSecret(ref: string, secret: string): Promise<void>;
+    /** Registers a value for redaction. */
+    onSecret?(value: string): void;
+    /** Test seam: a password. Default: 24 random bytes, base64url. */
+    mintPassword?(): string;
+    /** Test seam: an opaque id. */
+    mintId?(): string;
+    runtime?: JobRuntime;
+}
+/** Creates the company's Postgres server once and starts it. Returns the Coolify uuid. */
+export declare function provisionOrgPostgresServer(scope: StepScope, deps: OrgPostgresDeps, org: DeclaredOrg): Promise<{
+    resourceId: string;
+}>;
+/**
+ * Creates the databases and roles of the homes in `homeKeys` that are not recorded, with one job app
+ * for all of them, then hands each owner password to the host and records the home.
+ *
+ * One mint (CLAUDE.md platform rule 1): each home's password is minted once per attempt, an opaque id
+ * is recorded under `org_postgres_undelivered.<home>` and persisted before the job runs, and the home
+ * is recorded only after the password is delivered. A run that dies between the two finds the id,
+ * and mints again: no consumer has read the old password, and the job sets the new one.
+ */
+export declare function provisionOrgPostgresDatabases(scope: StepScope, deps: OrgPostgresDeps, org: DeclaredOrg, homeKeys: readonly string[]): Promise<void>;
+export {};