@wtfalch/foundry 0.45.1 → 0.46.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
@@ -25,6 +25,8 @@ export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAudit
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, MailRoute, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
+export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationBackupMissingError, OrgPostgresMigrationNotConfirmedError, } from './plan/index.js';
+export type { OrgPostgresMigrationConfirmation } from './plan/index.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
 export type { BackupGatePorts } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
@@ -15,6 +15,7 @@ export { createPostgresReleaseStore } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseRequests, foundryRequestedChanges, } from './store/schema.js';
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
+export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationBackupMissingError, OrgPostgresMigrationNotConfirmedError, } from './plan/index.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';

package/dist/org.d.ts

@@ -857,7 +857,19 @@ export interface OwnerIdentity {
     givenName: string;
     familyName: string;
     mailboxAddress?: string;
+    /** Their position in the company, free text such as "CEO". Seeded into Boule once; Boule owns it afterwards. */
+    roleAtCompany?: string;
+    /** Free text, seeded into Boule once. */
+    phone?: string;
 }
+/**
+ * `null` when the owner's sign-in name (the part of the work address before the
+ * `@`) and display names may be used; otherwise a fixed sentence. The sign-in
+ * name gets the broker's whole check, reserved names included. The given and
+ * family names are free text and only refuse a slur. The sentence never holds
+ * the value.
+ */
+export declare function ownerNameProblem(mailboxAddress: string | null | undefined, givenName: string, familyName: string): string | null;
 /**
  * `null` when `owners` is valid; otherwise the reason it is not, same shape as
  * {@link validateBuyerIdentity} and `../slug.ts`'s `validateSlug`. An empty
@@ -1086,6 +1098,10 @@ export interface OrgServiceSchema {
     runtimeRole: string;
     /** Where this schema's existence is recorded, once provisioned. */
     scopeKey: string;
+    /** False for the four matrix homes: one login role is owner and runtime, because Synapse and MAS run their own migrations. */
+    split: boolean;
+    /** The recorded-id key of this home's Coolify database today, or null when the home has none (desktop-auth, or a company with no app database yet). A live company stays on that database until its migration records the home as moved. */
+    legacyKey: (org: DeclaredOrg) => string | null;
 }
 /**
  * The full, fixed schema topology every org's shared Postgres server
@@ -1119,3 +1135,24 @@ export interface OrgServiceSchema {
  * create.
  */
 export declare const ORG_SERVICE_SCHEMAS: readonly OrgServiceSchema[];
+/** One service's home on the org's Postgres server, with the names it is created under (#444). */
+export interface OrgServiceDatabase {
+    /** The {@link ORG_SERVICE_SCHEMAS} key. */
+    schema: string;
+    database: string;
+    ownerRole: string;
+    /** Equals {@link ownerRole} when {@link split} is false. */
+    runtimeRole: string;
+    split: boolean;
+    /** Synapse only: created from template0 with LC_COLLATE and LC_CTYPE 'C'. */
+    collateC: boolean;
+}
+/**
+ * Pure. The names a home is created under on the org's server. A role name is
+ * cluster-wide, so the live runtime role names are kept: where a service's
+ * runtime role is `<database>_rt` today, the database keeps its live name.
+ * A new and a migrated company use the same names.
+ */
+export declare function orgServiceDatabase(org: DeclaredOrg, home: OrgServiceSchema): OrgServiceDatabase;
+/** Every home's names for `org`. Throws when two homes would share a database or a role (a slug such as `chat` collides with chat's own service). */
+export declare function orgServiceDatabases(org: DeclaredOrg): OrgServiceDatabase[];

package/dist/org.js

@@ -1,3 +1,4 @@
+import { DEFAULT_RULES, checkName, explain } from '@wtfalch/auth/names';
 import { floatingRefBlocked, floatingTagBlocked } from './bootstrap/versions.js';
 import { entryHasDatabase, validateArtifact, validateEntryWorkerApp, } from './worker-app-config.js';
 /** {@link MailConfig.mailApps} when the org declares none of its own (#34, decided 2026-09-30). */
@@ -1055,8 +1056,49 @@ export function validateBuyerIdentity(buyer) {
     }
     return null;
 }
+/** Longest `roleAtCompany` and `phone`: the limits Boule's owner-seeding door enforces. */
+const OWNER_ROLE_MAX = 100;
+const OWNER_PHONE_MAX = 40;
+// biome-ignore lint/suspicious/noControlCharactersInRegex: the point is to refuse them
+const CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
+/** A fixed sentence when an optional owner text field is not usable, `null` when absent or fine. The value is never in it. */
+function ownerTextProblem(owner, field, max) {
+    const value = owner[field];
+    if (value === undefined)
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > max || CONTROL_CHARACTER.test(value)) {
+        return `owner ${owner.email} ${field} must be 1 to ${max} characters with no control character`;
+    }
+    return null;
+}
 /** A deliberately loose email shape check -- foundry never sends mail itself, ZITADEL does; this only catches an obviously malformed address before it reaches the invite call. */
 const OWNER_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const ANY_TEXT = { minLength: 0, maxLength: Number.MAX_SAFE_INTEGER, pattern: /^/ };
+/**
+ * `null` when the owner's sign-in name (the part of the work address before the
+ * `@`) and display names may be used; otherwise a fixed sentence. The sign-in
+ * name gets the broker's whole check, reserved names included. The given and
+ * family names are free text and only refuse a slur. The sentence never holds
+ * the value.
+ */
+export function ownerNameProblem(mailboxAddress, givenName, familyName) {
+    if (mailboxAddress) {
+        const local = mailboxAddress.slice(0, mailboxAddress.lastIndexOf('@'));
+        const verdict = checkName(local, DEFAULT_RULES);
+        if (!verdict.ok)
+            return `the work address name before the @ is refused: ${explain(verdict.reason)}`;
+    }
+    for (const [label, value] of [
+        ['givenName', givenName],
+        ['familyName', familyName],
+    ]) {
+        const verdict = checkName(value, ANY_TEXT);
+        if (!verdict.ok && verdict.reason === 'disallowed')
+            return `${label} is not allowed`;
+    }
+    return null;
+}
 /**
  * `null` when `owners` is valid; otherwise the reason it is not, same shape as
  * {@link validateBuyerIdentity} and `../slug.ts`'s `validateSlug`. An empty
@@ -1078,6 +1120,13 @@ export function validateOwners(owners) {
         if (owner.mailboxAddress !== undefined && !OWNER_EMAIL_PATTERN.test(owner.mailboxAddress)) {
             return `owner ${owner.email} mailboxAddress '${owner.mailboxAddress}' is not a valid email address`;
         }
+        const problem = ownerNameProblem(owner.mailboxAddress, owner.givenName, owner.familyName);
+        if (problem)
+            return `owner ${owner.email}: ${problem}`;
+        const textProblem = ownerTextProblem(owner, 'roleAtCompany', OWNER_ROLE_MAX) ??
+            ownerTextProblem(owner, 'phone', OWNER_PHONE_MAX);
+        if (textProblem)
+            return textProblem;
         if (owner.mailboxAddress !== undefined) {
             const box = owner.mailboxAddress.toLowerCase();
             if (boxes.has(box))
@@ -1283,13 +1332,15 @@ export function validateMail(org, opts) {
  */
 export const ORG_POSTGRES_SERVER_SCOPE_KEY = 'org_postgres_server';
 /** Builds one {@link OrgServiceSchema}: its owner role, runtime role and scope key all follow from {@link schema} alone, so every caller gets the same shape. */
-function orgServiceSchema(service, schema) {
+function orgServiceSchema(service, schema, legacyKey, split = true) {
     return {
         service,
         schema,
         ownerRole: `${schema}_owner`,
         runtimeRole: `${schema}_rt`,
         scopeKey: `org_postgres_schema.${schema}`,
+        split,
+        legacyKey,
     };
 }
 /**
@@ -1324,13 +1375,87 @@ function orgServiceSchema(service, schema) {
  * create.
  */
 export const ORG_SERVICE_SCHEMAS = [
-    orgServiceSchema('Boule', 'boule'),
-    orgServiceSchema('CMS', 'cms'),
-    orgServiceSchema("chat's Synapse homeserver", 'chat_synapse'),
-    orgServiceSchema("chat's matrix-authentication-service", 'chat_mas'),
-    orgServiceSchema("chat's own service", 'chat_service'),
-    orgServiceSchema("calls' Synapse homeserver", 'calls_synapse'),
-    orgServiceSchema("calls' matrix-authentication-service", 'calls_mas'),
-    orgServiceSchema("calls' own service", 'calls_service'),
-    orgServiceSchema("the org's own app", 'app'),
+    orgServiceSchema('Boule', 'boule', () => 'coolify_boule_database'),
+    orgServiceSchema('CMS', 'cms', () => 'coolify_cms_database'),
+    orgServiceSchema("chat's Synapse homeserver", 'chat_synapse', () => 'coolify_chat_synapse_database', false),
+    orgServiceSchema("chat's matrix-authentication-service", 'chat_mas', () => 'coolify_chat_mas_database', false),
+    orgServiceSchema("chat's own service", 'chat_service', () => 'coolify_chat_service_database'),
+    orgServiceSchema("calls' Synapse homeserver", 'calls_synapse', () => 'coolify_calls_synapse_database', false),
+    orgServiceSchema("calls' matrix-authentication-service", 'calls_mas', () => 'coolify_calls_mas_database', false),
+    orgServiceSchema("calls' own service", 'calls_service', () => 'coolify_calls_service_database'),
+    orgServiceSchema("the org's own app", 'app', (org) => `coolify:database:${org.id}`),
+    orgServiceSchema('desktop-auth', 'desktop_auth', () => null),
 ];
+const POSTGRES_NAME = /^[a-z][a-z0-9_]{0,62}$/;
+function postgresName(name) {
+    if (!POSTGRES_NAME.test(name))
+        throw new Error(`Postgres name is not valid: ${name}`);
+    return name;
+}
+/**
+ * Pure. The names a home is created under on the org's server. A role name is
+ * cluster-wide, so the live runtime role names are kept: where a service's
+ * runtime role is `<database>_rt` today, the database keeps its live name.
+ * A new and a migrated company use the same names.
+ */
+export function orgServiceDatabase(org, home) {
+    const underscored = (name) => name.replace(/-/g, '_');
+    let database;
+    let runtimeRole = null;
+    switch (home.schema) {
+        case 'boule':
+            database = underscored(`${org.slug}-boule-db`);
+            break;
+        case 'cms':
+            database = underscored(`${org.slug}-cms-db`);
+            runtimeRole = 'cms_rt';
+            break;
+        case 'chat_service':
+            database = 'chat';
+            break;
+        case 'calls_service':
+            database = underscored(`${org.slug}-calls-db`);
+            break;
+        case 'app':
+            database = underscored(org.slug);
+            break;
+        default:
+            database = home.schema;
+    }
+    postgresName(database);
+    if (!home.split) {
+        return {
+            schema: home.schema,
+            database,
+            ownerRole: postgresName(`${database}_owner`),
+            runtimeRole: postgresName(`${database}_owner`),
+            split: false,
+            collateC: home.schema.endsWith('_synapse'),
+        };
+    }
+    return {
+        schema: home.schema,
+        database,
+        ownerRole: postgresName(`${database}_owner`),
+        runtimeRole: postgresName(runtimeRole ?? `${database}_rt`),
+        split: true,
+        collateC: false,
+    };
+}
+/** Every home's names for `org`. Throws when two homes would share a database or a role (a slug such as `chat` collides with chat's own service). */
+export function orgServiceDatabases(org) {
+    const all = ORG_SERVICE_SCHEMAS.map((home) => orgServiceDatabase(org, home));
+    const databases = new Set();
+    const roles = new Set();
+    for (const entry of all) {
+        if (databases.has(entry.database))
+            throw new Error(`Postgres database is used by two homes: ${entry.database}`);
+        databases.add(entry.database);
+        for (const role of new Set([entry.ownerRole, entry.runtimeRole])) {
+            if (roles.has(role))
+                throw new Error(`Postgres role is used by two homes: ${role}`);
+            roles.add(role);
+        }
+    }
+    return all;
+}

package/dist/plan/agora.d.ts

@@ -12,6 +12,20 @@ import type { DeclaredOrg, OrgId } from '../org.js';
  * (recorded by `executor.ts`'s `zitadelApp`).
  */
 export declare const ZITADEL_ORG_SCOPE_KEY = "zitadel_org";
+/**
+ * #440: Agora's desktop sign-in backend, a second app that holds the
+ * messaging desktop app's handoff state. The app's id is recorded as soon as
+ * it exists; the deployed marker only once it ran healthy, and it is what
+ * tells `desiredAgoraEnv` to write the upstream, so Agora never proxies to an
+ * address that does not answer.
+ */
+export declare const DESKTOP_AUTH_APP_SCOPE_KEY = "coolify_desktop_auth_app";
+export declare const DESKTOP_AUTH_DEPLOYED_SCOPE_KEY = "coolify_desktop_auth_deployed";
+export declare const DESKTOP_AUTH_PORT = "8080";
+/** The desktop-auth app's fixed internal name; Agora reaches it as `<name>:8080` on the company network. */
+export declare function desktopAuthInternalName(org: Pick<DeclaredOrg, 'slug'>): string;
+/** The value of Agora's `AGORA_DESKTOP_AUTH_UPSTREAM`. */
+export declare function desktopAuthUpstream(org: Pick<DeclaredOrg, 'slug'>): string;
 /**
  * The org's ZITADEL messaging project: the audience chat-service requires in
  * a token's `aud`, and Agora's `messagingProjectId`. `executor.ts`'s

package/dist/plan/agora.js

@@ -14,6 +14,24 @@ import { SIGN_IN_UPSTREAM_ENV, inAppHostApplied, signInUpstream, staleSignInUpst
  * (recorded by `executor.ts`'s `zitadelApp`).
  */
 export const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
+/**
+ * #440: Agora's desktop sign-in backend, a second app that holds the
+ * messaging desktop app's handoff state. The app's id is recorded as soon as
+ * it exists; the deployed marker only once it ran healthy, and it is what
+ * tells `desiredAgoraEnv` to write the upstream, so Agora never proxies to an
+ * address that does not answer.
+ */
+export const DESKTOP_AUTH_APP_SCOPE_KEY = 'coolify_desktop_auth_app';
+export const DESKTOP_AUTH_DEPLOYED_SCOPE_KEY = 'coolify_desktop_auth_deployed';
+export const DESKTOP_AUTH_PORT = '8080';
+/** The desktop-auth app's fixed internal name; Agora reaches it as `<name>:8080` on the company network. */
+export function desktopAuthInternalName(org) {
+    return `${org.slug}-desktop-auth`;
+}
+/** The value of Agora's `AGORA_DESKTOP_AUTH_UPSTREAM`. */
+export function desktopAuthUpstream(org) {
+    return `${desktopAuthInternalName(org)}:${DESKTOP_AUTH_PORT}`;
+}
 /**
  * The org's ZITADEL messaging project: the audience chat-service requires in
  * a token's `aud`, and Agora's `messagingProjectId`. `executor.ts`'s
@@ -294,6 +312,9 @@ export function desiredAgoraEnv(org, recorded, rawHost) {
             ...(inAppHostApplied(org, recorded, agoraHostnameFor(org)) ? { signInInApp: true } : {}),
         });
     }
+    if (recorded[DESKTOP_AUTH_DEPLOYED_SCOPE_KEY]) {
+        env.AGORA_DESKTOP_AUTH_UPSTREAM = desktopAuthUpstream(org);
+    }
     if (org.mail.mode !== 'off' && host.mailUpstream) {
         env.AGORA_MAIL_UPSTREAM = host.mailUpstream;
     }

package/dist/plan/backup-gate.d.ts

@@ -37,6 +37,15 @@ export declare class SigninDbMoveBackupMissingError extends Error {
     readonly reason: 'no-gate' | 'no-backup';
     constructor(reason: 'no-gate' | 'no-backup');
 }
+/**
+ * The migration of a live company's database to its Postgres server (#444) is refused before any step
+ * runs when the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or
+ * the host has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export declare class OrgPostgresMigrationBackupMissingError extends Error {
+    readonly reason: 'no-gate' | 'no-backup';
+    constructor(reason: 'no-gate' | 'no-backup');
+}
 export interface BackupGatePorts {
     /** The company's recorded ids (`AppliedState.serviceIds`): database uuids and `backup_<db>` schedule uuids. */
     recordedIds: Readonly<Record<string, string>>;
@@ -83,6 +92,12 @@ export declare function requireFreshBackupsForUpgrades(plan: {
  * uuid of the execution that passed.
  */
 export declare function requireFreshBackupForSigninMove(ports: BackupGatePorts): Promise<string>;
+/**
+ * The org Postgres migration's gate (#444): the old database of `home` needs a schedule and a `success`
+ * execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions. A schedule
+ * alone proves no dump ran. Returns the uuid of the execution that passed.
+ */
+export declare function requireFreshBackupForOrgPostgresMigration(ports: BackupGatePorts, legacyDatabaseKey: string, backupName: string): Promise<string>;
 export interface MoveGatePorts {
     /** The company's Coolify project (`coolify_project`). */
     projectUuid: string | undefined;

package/dist/plan/backup-gate.js

@@ -59,6 +59,21 @@ export class SigninDbMoveBackupMissingError extends Error {
         this.name = 'SigninDbMoveBackupMissingError';
     }
 }
+/**
+ * The migration of a live company's database to its Postgres server (#444) is refused before any step
+ * runs when the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or
+ * the host has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export class OrgPostgresMigrationBackupMissingError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason === 'no-gate'
+            ? 'org postgres migration refused: this host has no backup gate, so a fresh backup cannot be checked'
+            : `org postgres migration refused: the old database has no finished backup from the last ${BACKUP_MAX_AGE_HOURS} hours, checked in Coolify; take one now and apply again`);
+        this.reason = reason;
+        this.name = 'OrgPostgresMigrationBackupMissingError';
+    }
+}
 async function withinTimeout(call) {
     let timer;
     try {
@@ -224,6 +239,29 @@ export async function requireFreshBackupForSigninMove(ports) {
         throw new SigninDbMoveBackupMissingError('no-backup');
     return fresh.uuid;
 }
+/**
+ * The org Postgres migration's gate (#444): the old database of `home` needs a schedule and a `success`
+ * execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions. A schedule
+ * alone proves no dump ran. Returns the uuid of the execution that passed.
+ */
+export async function requireFreshBackupForOrgPostgresMigration(ports, legacyDatabaseKey, backupName) {
+    const now = (ports.now ?? Date.now)();
+    const databaseUuid = ports.recordedIds[legacyDatabaseKey];
+    const backupUuid = ports.recordedIds[backupScopeKey(backupName)];
+    if (!databaseUuid || !backupUuid)
+        throw new OrgPostgresMigrationBackupMissingError('no-backup');
+    let executions;
+    try {
+        executions = await readExecutions(ports.coolify, databaseUuid, backupUuid);
+    }
+    catch {
+        throw new OrgPostgresMigrationBackupMissingError('no-backup');
+    }
+    const fresh = executions ? freshSuccess(executions, now) : null;
+    if (!fresh)
+        throw new OrgPostgresMigrationBackupMissingError('no-backup');
+    return fresh.uuid;
+}
 /**
  * The gate for a move to the company's own network, which deletes every database of the project. It
  * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.

package/dist/plan/boule-owners-http.d.ts

@@ -0,0 +1,12 @@
+import type { BouleOwnersPort } from './executor.js';
+/** Thrown for any answer or failure of Boule's owner-seeding door. Carries the HTTP status (0 for no answer) and nothing else, so no secret or body can reach a message. */
+export declare class BouleOwnersError extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+/**
+ * The real {@link BouleOwnersPort}: `POST https://<hostname>/v1/organisations/<id>/owners/seed`
+ * with the secret as a bearer token. 10 s per call, no redirect, three tries on a
+ * network error or a 5xx answer. Any other answer ends at once.
+ */
+export declare function httpBouleOwners(fetchImpl?: typeof fetch): BouleOwnersPort;

package/dist/plan/boule-owners-http.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/** Thrown for any answer or failure of Boule's owner-seeding door. Carries the HTTP status (0 for no answer) and nothing else, so no secret or body can reach a message. */
+export class BouleOwnersError extends Error {
+    status;
+    constructor(status) {
+        super(`Boule's owner-seeding door ${status === 0 ? 'did not answer' : `answered ${status}`}`);
+        this.status = status;
+        this.name = 'BouleOwnersError';
+    }
+}
+const resultsSchema = z.object({
+    results: z.array(z.object({
+        subject: z.string(),
+        outcome: z.enum(['created', 'exists', 'refused']),
+        filled: z.array(z.string()),
+        code: z.string().optional(),
+    })),
+});
+const TIMEOUT_MS = 10_000;
+const ATTEMPTS = 3;
+/**
+ * The real {@link BouleOwnersPort}: `POST https://<hostname>/v1/organisations/<id>/owners/seed`
+ * with the secret as a bearer token. 10 s per call, no redirect, three tries on a
+ * network error or a 5xx answer. Any other answer ends at once.
+ */
+export function httpBouleOwners(fetchImpl = fetch) {
+    return {
+        async seed({ hostname, organisationId, secret, owners }) {
+            const url = `https://${hostname}/v1/organisations/${encodeURIComponent(organisationId)}/owners/seed`;
+            let status = 0;
+            for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+                let response;
+                try {
+                    response = await fetchImpl(url, {
+                        method: 'POST',
+                        headers: { authorization: `Bearer ${secret}`, 'content-type': 'application/json' },
+                        body: JSON.stringify({ owners }),
+                        redirect: 'error',
+                        signal: AbortSignal.timeout(TIMEOUT_MS),
+                    });
+                }
+                catch {
+                    status = 0;
+                    continue;
+                }
+                status = response.status;
+                if (status >= 500)
+                    continue;
+                if (status !== 200)
+                    throw new BouleOwnersError(status);
+                const parsed = resultsSchema.safeParse(await response.json().catch(() => undefined));
+                if (!parsed.success)
+                    throw new BouleOwnersError(status);
+                return parsed.data;
+            }
+            throw new BouleOwnersError(status);
+        },
+    };
+}

package/dist/plan/boule.d.ts

@@ -1,4 +1,4 @@
-import { type DeclaredOrg } from '../org.js';
+import { type DeclaredOrg, type OwnerIdentity } from '../org.js';
 import type { BrokerEntryInput, BrokerEntryWant } from './broker-entries.js';
 /**
  * #161 (Boule part): what both the planner (`diff.ts`) and the executor
@@ -77,6 +77,12 @@ export declare const BOULE_PEER_PASSWORD_ENV = "AUTHZ_PEER_PASSWORD_OPERATOR";
  * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
  */
 export declare const BOULE_BRIDGE_SECRET_ENV = "ARCHON_BRIDGE_SECRET";
+/**
+ * The secret foundry sends to Boule's owner-seeding door as a bearer token.
+ * Minted once for every org's Boule and held only in that Boule's env; foundry
+ * reads it back from there when it seeds. Not in {@link desiredBouleEnv}.
+ */
+export declare const BOULE_OWNER_SEED_SECRET_ENV = "OWNER_SEED_SECRET";
 /** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
 export declare const BOULE_PEER_ROLE = "authz_operator_rt";
 /** The org's Archon id and the credential Boule reaches Archon with (C3). The id is the org's own; the credential is a secret. */
@@ -120,7 +126,7 @@ export interface BouleCredentialWants {
     archonRenewDue?: boolean;
 }
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET", "ARCHON_ORG_ID", "ARCHON_CREDENTIAL", "CUSTOMERS_ORGANISATION_ID", "CUSTOMERS_DIRECTORY_CREDENTIAL", "SIGNIN_UPSTREAM"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET", "OWNER_SEED_SECRET", "ARCHON_ORG_ID", "ARCHON_CREDENTIAL", "CUSTOMERS_ORGANISATION_ID", "CUSTOMERS_DIRECTORY_CREDENTIAL", "SIGNIN_UPSTREAM"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a
@@ -169,6 +175,36 @@ export declare function wantedBouleBrokerEntry(org: DeclaredOrg, recorded: Reado
  * except `SIGNIN_UPSTREAM`: the switch turned off must take it away, so a live one that is not desired is drift.
  */
 export declare function bouleEnvDrift(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): string[];
+/** Scope id per owner once Boule answered created or exists: `boule_owner_seeded.<email lowercased>`, value '1'. */
+export declare function bouleOwnerSeededScopeKey(email: string): string;
+/** Scope id per owner Boule refused (`holds_other_role`, `platform_frozen`): the planner reports it blocked and sends nothing more. */
+export declare function bouleOwnerRefusedScopeKey(email: string): string;
+/** The ZITADEL user id foundry recorded for a declared owner, or undefined. */
+export declare function bouleOwnerSubject(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, owner: OwnerIdentity): string | undefined;
+/** Owners still to seed, in declared order: neither seeded nor refused yet. */
+export declare function bouleOwnersToSeed(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): OwnerIdentity[];
+/** One owner as Boule's owner-seeding door takes it. */
+export interface BouleOwnerSeed {
+    subject: string;
+    givenName: string;
+    familyName: string;
+    email: string;
+    mailbox: string | null;
+    roleAtCompany: string | null;
+    phone: string | null;
+}
+/** The body's owners for the unseeded owners that have a recorded ZITADEL user id, in declared order. */
+export declare function bouleOwnerSeeds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): BouleOwnerSeed[];
+/**
+ * The step that seeds a company's declared owners into its Boule, or the lines
+ * for owners that cannot be seeded yet (blocked, not failing). Planned only
+ * once Boule is deployed and holds the seeding secret; before that the Boule
+ * step runs first and the next plan includes this one.
+ */
+export declare function planBouleOwners(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, liveBouleEnv: Readonly<Record<string, string>> | null): {
+    seed: BouleOwnerSeed[];
+    blocked: string[];
+};
 /**
  * The customers env a live Boule still holds after the company switched customers off. A host that merely
  * cannot deliver the credential keeps what it has: only an explicit off removes it.

package/dist/plan/boule.js

@@ -1,4 +1,4 @@
-import { DEFAULT_NO_REPLY_LOCAL_PART } from '../org.js';
+import { DEFAULT_NO_REPLY_LOCAL_PART, ownerMailboxes, } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { SIGN_IN_UPSTREAM_ENV, inAppHostApplied, signInUpstream, staleSignInUpstream, } from './sign-in.js';
 /**
@@ -88,6 +88,12 @@ export const BOULE_PEER_PASSWORD_ENV = 'AUTHZ_PEER_PASSWORD_OPERATOR';
  * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
  */
 export const BOULE_BRIDGE_SECRET_ENV = 'ARCHON_BRIDGE_SECRET';
+/**
+ * The secret foundry sends to Boule's owner-seeding door as a bearer token.
+ * Minted once for every org's Boule and held only in that Boule's env; foundry
+ * reads it back from there when it seeds. Not in {@link desiredBouleEnv}.
+ */
+export const BOULE_OWNER_SEED_SECRET_ENV = 'OWNER_SEED_SECRET';
 /** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
 export const BOULE_PEER_ROLE = 'authz_operator_rt';
 /** The org's Archon id and the credential Boule reaches Archon with (C3). The id is the org's own; the credential is a secret. */
@@ -136,6 +142,7 @@ export const BOULE_MANAGED_ENV_KEYS = [
     BOULE_MAIL_TOKEN_ENV,
     BOULE_PEER_PASSWORD_ENV,
     BOULE_BRIDGE_SECRET_ENV,
+    BOULE_OWNER_SEED_SECRET_ENV,
     BOULE_ARCHON_ORG_ID_ENV,
     BOULE_ARCHON_CREDENTIAL_ENV,
     BOULE_CUSTOMERS_ORG_ENV,
@@ -261,6 +268,70 @@ export function bouleEnvDrift(desired, live) {
         drift.push(SIGN_IN_UPSTREAM_ENV);
     return drift;
 }
+/** Scope id per owner once Boule answered created or exists: `boule_owner_seeded.<email lowercased>`, value '1'. */
+export function bouleOwnerSeededScopeKey(email) {
+    return `boule_owner_seeded.${email.toLowerCase()}`;
+}
+/** Scope id per owner Boule refused (`holds_other_role`, `platform_frozen`): the planner reports it blocked and sends nothing more. */
+export function bouleOwnerRefusedScopeKey(email) {
+    return `boule_owner_refused.${email.toLowerCase()}`;
+}
+/** The ZITADEL user id foundry recorded for a declared owner, or undefined. */
+export function bouleOwnerSubject(org, recorded, owner) {
+    return recorded[`zitadel:owner:${org.id}:${owner.email.toLowerCase()}`] || undefined;
+}
+/** Owners still to seed, in declared order: neither seeded nor refused yet. */
+export function bouleOwnersToSeed(org, recorded) {
+    return org.owners.filter((owner) => !recorded[bouleOwnerSeededScopeKey(owner.email)] &&
+        !recorded[bouleOwnerRefusedScopeKey(owner.email)]);
+}
+/** The body's owners for the unseeded owners that have a recorded ZITADEL user id, in declared order. */
+export function bouleOwnerSeeds(org, recorded) {
+    const boxes = ownerMailboxes(org);
+    const seeds = [];
+    for (const owner of bouleOwnersToSeed(org, recorded)) {
+        const subject = bouleOwnerSubject(org, recorded, owner);
+        if (!subject)
+            continue;
+        seeds.push({
+            subject,
+            givenName: owner.givenName,
+            familyName: owner.familyName,
+            email: owner.email,
+            mailbox: boxes.find((b) => b.owner === owner)?.address ?? null,
+            roleAtCompany: owner.roleAtCompany ?? null,
+            phone: owner.phone ?? null,
+        });
+    }
+    return seeds;
+}
+/**
+ * The step that seeds a company's declared owners into its Boule, or the lines
+ * for owners that cannot be seeded yet (blocked, not failing). Planned only
+ * once Boule is deployed and holds the seeding secret; before that the Boule
+ * step runs first and the next plan includes this one.
+ */
+export function planBouleOwners(org, recorded, liveBouleEnv) {
+    const none = { seed: [], blocked: [] };
+    if (org.owners.length === 0)
+        return none;
+    if (!recorded[BOULE_DEPLOYED_SCOPE_KEY])
+        return none;
+    if (!liveBouleEnv?.[BOULE_OWNER_SEED_SECRET_ENV])
+        return none;
+    const blocked = [];
+    org.owners.forEach((owner, index) => {
+        const at = `${org.slug}'s Boule owners are blocked, not planned: owner ${index + 1}`;
+        if (recorded[bouleOwnerRefusedScopeKey(owner.email)]) {
+            blocked.push(`${at} was refused by Boule (it holds another role or the platform is frozen)`);
+        }
+        else if (!recorded[bouleOwnerSeededScopeKey(owner.email)] &&
+            !bouleOwnerSubject(org, recorded, owner)) {
+            blocked.push(`${at} has no sign-in account yet`);
+        }
+    });
+    return { seed: bouleOwnerSeeds(org, recorded), blocked };
+}
 /**
  * The customers env a live Boule still holds after the company switched customers off. A host that merely
  * cannot deliver the credential keeps what it has: only an explicit off removes it.