@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/plan/agora.d.ts

@@ -12,6 +12,20 @@ import type { DeclaredOrg, OrgId } from '../org.js';
  * (recorded by `executor.ts`'s `zitadelApp`).
  */
 export declare const ZITADEL_ORG_SCOPE_KEY = "zitadel_org";
+/**
+ * #440: Agora's desktop sign-in backend, a second app that holds the
+ * messaging desktop app's handoff state. The app's id is recorded as soon as
+ * it exists; the deployed marker only once it ran healthy, and it is what
+ * tells `desiredAgoraEnv` to write the upstream, so Agora never proxies to an
+ * address that does not answer.
+ */
+export declare const DESKTOP_AUTH_APP_SCOPE_KEY = "coolify_desktop_auth_app";
+export declare const DESKTOP_AUTH_DEPLOYED_SCOPE_KEY = "coolify_desktop_auth_deployed";
+export declare const DESKTOP_AUTH_PORT = "8080";
+/** The desktop-auth app's fixed internal name; Agora reaches it as `<name>:8080` on the company network. */
+export declare function desktopAuthInternalName(org: Pick<DeclaredOrg, 'slug'>): string;
+/** The value of Agora's `AGORA_DESKTOP_AUTH_UPSTREAM`. */
+export declare function desktopAuthUpstream(org: Pick<DeclaredOrg, 'slug'>): string;
 /**
  * The org's ZITADEL messaging project: the audience chat-service requires in
  * a token's `aud`, and Agora's `messagingProjectId`. `executor.ts`'s

package/dist/plan/agora.js

@@ -14,6 +14,24 @@ import { SIGN_IN_UPSTREAM_ENV, inAppHostApplied, signInUpstream, staleSignInUpst
  * (recorded by `executor.ts`'s `zitadelApp`).
  */
 export const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
+/**
+ * #440: Agora's desktop sign-in backend, a second app that holds the
+ * messaging desktop app's handoff state. The app's id is recorded as soon as
+ * it exists; the deployed marker only once it ran healthy, and it is what
+ * tells `desiredAgoraEnv` to write the upstream, so Agora never proxies to an
+ * address that does not answer.
+ */
+export const DESKTOP_AUTH_APP_SCOPE_KEY = 'coolify_desktop_auth_app';
+export const DESKTOP_AUTH_DEPLOYED_SCOPE_KEY = 'coolify_desktop_auth_deployed';
+export const DESKTOP_AUTH_PORT = '8080';
+/** The desktop-auth app's fixed internal name; Agora reaches it as `<name>:8080` on the company network. */
+export function desktopAuthInternalName(org) {
+    return `${org.slug}-desktop-auth`;
+}
+/** The value of Agora's `AGORA_DESKTOP_AUTH_UPSTREAM`. */
+export function desktopAuthUpstream(org) {
+    return `${desktopAuthInternalName(org)}:${DESKTOP_AUTH_PORT}`;
+}
 /**
  * The org's ZITADEL messaging project: the audience chat-service requires in
  * a token's `aud`, and Agora's `messagingProjectId`. `executor.ts`'s
@@ -294,6 +312,9 @@ export function desiredAgoraEnv(org, recorded, rawHost) {
             ...(inAppHostApplied(org, recorded, agoraHostnameFor(org)) ? { signInInApp: true } : {}),
         });
     }
+    if (recorded[DESKTOP_AUTH_DEPLOYED_SCOPE_KEY]) {
+        env.AGORA_DESKTOP_AUTH_UPSTREAM = desktopAuthUpstream(org);
+    }
     if (org.mail.mode !== 'off' && host.mailUpstream) {
         env.AGORA_MAIL_UPSTREAM = host.mailUpstream;
     }

package/dist/plan/backup-gate.d.ts

@@ -37,6 +37,15 @@ export declare class SigninDbMoveBackupMissingError extends Error {
     readonly reason: 'no-gate' | 'no-backup';
     constructor(reason: 'no-gate' | 'no-backup');
 }
+/**
+ * The migration of a live company's database to its Postgres server (#444) is refused before any step
+ * runs when the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or
+ * the host has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export declare class OrgPostgresMigrationBackupMissingError extends Error {
+    readonly reason: 'no-gate' | 'no-backup';
+    constructor(reason: 'no-gate' | 'no-backup');
+}
 export interface BackupGatePorts {
     /** The company's recorded ids (`AppliedState.serviceIds`): database uuids and `backup_<db>` schedule uuids. */
     recordedIds: Readonly<Record<string, string>>;
@@ -83,6 +92,12 @@ export declare function requireFreshBackupsForUpgrades(plan: {
  * uuid of the execution that passed.
  */
 export declare function requireFreshBackupForSigninMove(ports: BackupGatePorts): Promise<string>;
+/**
+ * The org Postgres migration's gate (#444): the old database of `home` needs a schedule and a `success`
+ * execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions. A schedule
+ * alone proves no dump ran. Returns the uuid of the execution that passed.
+ */
+export declare function requireFreshBackupForOrgPostgresMigration(ports: BackupGatePorts, legacyDatabaseKey: string, backupName: string): Promise<string>;
 export interface MoveGatePorts {
     /** The company's Coolify project (`coolify_project`). */
     projectUuid: string | undefined;

package/dist/plan/backup-gate.js

@@ -59,6 +59,21 @@ export class SigninDbMoveBackupMissingError extends Error {
         this.name = 'SigninDbMoveBackupMissingError';
     }
 }
+/**
+ * The migration of a live company's database to its Postgres server (#444) is refused before any step
+ * runs when the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or
+ * the host has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export class OrgPostgresMigrationBackupMissingError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason === 'no-gate'
+            ? 'org postgres migration refused: this host has no backup gate, so a fresh backup cannot be checked'
+            : `org postgres migration refused: the old database has no finished backup from the last ${BACKUP_MAX_AGE_HOURS} hours, checked in Coolify; take one now and apply again`);
+        this.reason = reason;
+        this.name = 'OrgPostgresMigrationBackupMissingError';
+    }
+}
 async function withinTimeout(call) {
     let timer;
     try {
@@ -224,6 +239,29 @@ export async function requireFreshBackupForSigninMove(ports) {
         throw new SigninDbMoveBackupMissingError('no-backup');
     return fresh.uuid;
 }
+/**
+ * The org Postgres migration's gate (#444): the old database of `home` needs a schedule and a `success`
+ * execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions. A schedule
+ * alone proves no dump ran. Returns the uuid of the execution that passed.
+ */
+export async function requireFreshBackupForOrgPostgresMigration(ports, legacyDatabaseKey, backupName) {
+    const now = (ports.now ?? Date.now)();
+    const databaseUuid = ports.recordedIds[legacyDatabaseKey];
+    const backupUuid = ports.recordedIds[backupScopeKey(backupName)];
+    if (!databaseUuid || !backupUuid)
+        throw new OrgPostgresMigrationBackupMissingError('no-backup');
+    let executions;
+    try {
+        executions = await readExecutions(ports.coolify, databaseUuid, backupUuid);
+    }
+    catch {
+        throw new OrgPostgresMigrationBackupMissingError('no-backup');
+    }
+    const fresh = executions ? freshSuccess(executions, now) : null;
+    if (!fresh)
+        throw new OrgPostgresMigrationBackupMissingError('no-backup');
+    return fresh.uuid;
+}
 /**
  * The gate for a move to the company's own network, which deletes every database of the project. It
  * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.

package/dist/plan/boule-owners-http.d.ts

@@ -0,0 +1,12 @@
+import type { BouleOwnersPort } from './executor.js';
+/** Thrown for any answer or failure of Boule's owner-seeding door. Carries the HTTP status (0 for no answer) and nothing else, so no secret or body can reach a message. */
+export declare class BouleOwnersError extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+/**
+ * The real {@link BouleOwnersPort}: `POST https://<hostname>/v1/organisations/<id>/owners/seed`
+ * with the secret as a bearer token. 10 s per call, no redirect, three tries on a
+ * network error or a 5xx answer. Any other answer ends at once.
+ */
+export declare function httpBouleOwners(fetchImpl?: typeof fetch): BouleOwnersPort;

package/dist/plan/boule-owners-http.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/** Thrown for any answer or failure of Boule's owner-seeding door. Carries the HTTP status (0 for no answer) and nothing else, so no secret or body can reach a message. */
+export class BouleOwnersError extends Error {
+    status;
+    constructor(status) {
+        super(`Boule's owner-seeding door ${status === 0 ? 'did not answer' : `answered ${status}`}`);
+        this.status = status;
+        this.name = 'BouleOwnersError';
+    }
+}
+const resultsSchema = z.object({
+    results: z.array(z.object({
+        subject: z.string(),
+        outcome: z.enum(['created', 'exists', 'refused']),
+        filled: z.array(z.string()),
+        code: z.string().optional(),
+    })),
+});
+const TIMEOUT_MS = 10_000;
+const ATTEMPTS = 3;
+/**
+ * The real {@link BouleOwnersPort}: `POST https://<hostname>/v1/organisations/<id>/owners/seed`
+ * with the secret as a bearer token. 10 s per call, no redirect, three tries on a
+ * network error or a 5xx answer. Any other answer ends at once.
+ */
+export function httpBouleOwners(fetchImpl = fetch) {
+    return {
+        async seed({ hostname, organisationId, secret, owners }) {
+            const url = `https://${hostname}/v1/organisations/${encodeURIComponent(organisationId)}/owners/seed`;
+            let status = 0;
+            for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+                let response;
+                try {
+                    response = await fetchImpl(url, {
+                        method: 'POST',
+                        headers: { authorization: `Bearer ${secret}`, 'content-type': 'application/json' },
+                        body: JSON.stringify({ owners }),
+                        redirect: 'error',
+                        signal: AbortSignal.timeout(TIMEOUT_MS),
+                    });
+                }
+                catch {
+                    status = 0;
+                    continue;
+                }
+                status = response.status;
+                if (status >= 500)
+                    continue;
+                if (status !== 200)
+                    throw new BouleOwnersError(status);
+                const parsed = resultsSchema.safeParse(await response.json().catch(() => undefined));
+                if (!parsed.success)
+                    throw new BouleOwnersError(status);
+                return parsed.data;
+            }
+            throw new BouleOwnersError(status);
+        },
+    };
+}

package/dist/plan/boule.d.ts

@@ -1,4 +1,4 @@
-import { type DeclaredOrg } from '../org.js';
+import { type DeclaredOrg, type OwnerIdentity } from '../org.js';
 import type { BrokerEntryInput, BrokerEntryWant } from './broker-entries.js';
 /**
  * #161 (Boule part): what both the planner (`diff.ts`) and the executor
@@ -77,6 +77,12 @@ export declare const BOULE_PEER_PASSWORD_ENV = "AUTHZ_PEER_PASSWORD_OPERATOR";
  * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
  */
 export declare const BOULE_BRIDGE_SECRET_ENV = "ARCHON_BRIDGE_SECRET";
+/**
+ * The secret foundry sends to Boule's owner-seeding door as a bearer token.
+ * Minted once for every org's Boule and held only in that Boule's env; foundry
+ * reads it back from there when it seeds. Not in {@link desiredBouleEnv}.
+ */
+export declare const BOULE_OWNER_SEED_SECRET_ENV = "OWNER_SEED_SECRET";
 /** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
 export declare const BOULE_PEER_ROLE = "authz_operator_rt";
 /** The org's Archon id and the credential Boule reaches Archon with (C3). The id is the org's own; the credential is a secret. */
@@ -120,7 +126,7 @@ export interface BouleCredentialWants {
     archonRenewDue?: boolean;
 }
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET", "ARCHON_ORG_ID", "ARCHON_CREDENTIAL", "CUSTOMERS_ORGANISATION_ID", "CUSTOMERS_DIRECTORY_CREDENTIAL", "SIGNIN_UPSTREAM"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET", "OWNER_SEED_SECRET", "ARCHON_ORG_ID", "ARCHON_CREDENTIAL", "CUSTOMERS_ORGANISATION_ID", "CUSTOMERS_DIRECTORY_CREDENTIAL", "SIGNIN_UPSTREAM"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a
@@ -169,6 +175,36 @@ export declare function wantedBouleBrokerEntry(org: DeclaredOrg, recorded: Reado
  * except `SIGNIN_UPSTREAM`: the switch turned off must take it away, so a live one that is not desired is drift.
  */
 export declare function bouleEnvDrift(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): string[];
+/** Scope id per owner once Boule answered created or exists: `boule_owner_seeded.<email lowercased>`, value '1'. */
+export declare function bouleOwnerSeededScopeKey(email: string): string;
+/** Scope id per owner Boule refused (`holds_other_role`, `platform_frozen`): the planner reports it blocked and sends nothing more. */
+export declare function bouleOwnerRefusedScopeKey(email: string): string;
+/** The ZITADEL user id foundry recorded for a declared owner, or undefined. */
+export declare function bouleOwnerSubject(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, owner: OwnerIdentity): string | undefined;
+/** Owners still to seed, in declared order: neither seeded nor refused yet. */
+export declare function bouleOwnersToSeed(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): OwnerIdentity[];
+/** One owner as Boule's owner-seeding door takes it. */
+export interface BouleOwnerSeed {
+    subject: string;
+    givenName: string;
+    familyName: string;
+    email: string;
+    mailbox: string | null;
+    roleAtCompany: string | null;
+    phone: string | null;
+}
+/** The body's owners for the unseeded owners that have a recorded ZITADEL user id, in declared order. */
+export declare function bouleOwnerSeeds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): BouleOwnerSeed[];
+/**
+ * The step that seeds a company's declared owners into its Boule, or the lines
+ * for owners that cannot be seeded yet (blocked, not failing). Planned only
+ * once Boule is deployed and holds the seeding secret; before that the Boule
+ * step runs first and the next plan includes this one.
+ */
+export declare function planBouleOwners(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, liveBouleEnv: Readonly<Record<string, string>> | null): {
+    seed: BouleOwnerSeed[];
+    blocked: string[];
+};
 /**
  * The customers env a live Boule still holds after the company switched customers off. A host that merely
  * cannot deliver the credential keeps what it has: only an explicit off removes it.

package/dist/plan/boule.js

@@ -1,4 +1,4 @@
-import { DEFAULT_NO_REPLY_LOCAL_PART } from '../org.js';
+import { DEFAULT_NO_REPLY_LOCAL_PART, ownerMailboxes, } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { SIGN_IN_UPSTREAM_ENV, inAppHostApplied, signInUpstream, staleSignInUpstream, } from './sign-in.js';
 /**
@@ -88,6 +88,12 @@ export const BOULE_PEER_PASSWORD_ENV = 'AUTHZ_PEER_PASSWORD_OPERATOR';
  * env; compared in memory like {@link BOULE_PEER_PASSWORD_ENV}.
  */
 export const BOULE_BRIDGE_SECRET_ENV = 'ARCHON_BRIDGE_SECRET';
+/**
+ * The secret foundry sends to Boule's owner-seeding door as a bearer token.
+ * Minted once for every org's Boule and held only in that Boule's env; foundry
+ * reads it back from there when it seeds. Not in {@link desiredBouleEnv}.
+ */
+export const BOULE_OWNER_SEED_SECRET_ENV = 'OWNER_SEED_SECRET';
 /** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
 export const BOULE_PEER_ROLE = 'authz_operator_rt';
 /** The org's Archon id and the credential Boule reaches Archon with (C3). The id is the org's own; the credential is a secret. */
@@ -136,6 +142,7 @@ export const BOULE_MANAGED_ENV_KEYS = [
     BOULE_MAIL_TOKEN_ENV,
     BOULE_PEER_PASSWORD_ENV,
     BOULE_BRIDGE_SECRET_ENV,
+    BOULE_OWNER_SEED_SECRET_ENV,
     BOULE_ARCHON_ORG_ID_ENV,
     BOULE_ARCHON_CREDENTIAL_ENV,
     BOULE_CUSTOMERS_ORG_ENV,
@@ -261,6 +268,70 @@ export function bouleEnvDrift(desired, live) {
         drift.push(SIGN_IN_UPSTREAM_ENV);
     return drift;
 }
+/** Scope id per owner once Boule answered created or exists: `boule_owner_seeded.<email lowercased>`, value '1'. */
+export function bouleOwnerSeededScopeKey(email) {
+    return `boule_owner_seeded.${email.toLowerCase()}`;
+}
+/** Scope id per owner Boule refused (`holds_other_role`, `platform_frozen`): the planner reports it blocked and sends nothing more. */
+export function bouleOwnerRefusedScopeKey(email) {
+    return `boule_owner_refused.${email.toLowerCase()}`;
+}
+/** The ZITADEL user id foundry recorded for a declared owner, or undefined. */
+export function bouleOwnerSubject(org, recorded, owner) {
+    return recorded[`zitadel:owner:${org.id}:${owner.email.toLowerCase()}`] || undefined;
+}
+/** Owners still to seed, in declared order: neither seeded nor refused yet. */
+export function bouleOwnersToSeed(org, recorded) {
+    return org.owners.filter((owner) => !recorded[bouleOwnerSeededScopeKey(owner.email)] &&
+        !recorded[bouleOwnerRefusedScopeKey(owner.email)]);
+}
+/** The body's owners for the unseeded owners that have a recorded ZITADEL user id, in declared order. */
+export function bouleOwnerSeeds(org, recorded) {
+    const boxes = ownerMailboxes(org);
+    const seeds = [];
+    for (const owner of bouleOwnersToSeed(org, recorded)) {
+        const subject = bouleOwnerSubject(org, recorded, owner);
+        if (!subject)
+            continue;
+        seeds.push({
+            subject,
+            givenName: owner.givenName,
+            familyName: owner.familyName,
+            email: owner.email,
+            mailbox: boxes.find((b) => b.owner === owner)?.address ?? null,
+            roleAtCompany: owner.roleAtCompany ?? null,
+            phone: owner.phone ?? null,
+        });
+    }
+    return seeds;
+}
+/**
+ * The step that seeds a company's declared owners into its Boule, or the lines
+ * for owners that cannot be seeded yet (blocked, not failing). Planned only
+ * once Boule is deployed and holds the seeding secret; before that the Boule
+ * step runs first and the next plan includes this one.
+ */
+export function planBouleOwners(org, recorded, liveBouleEnv) {
+    const none = { seed: [], blocked: [] };
+    if (org.owners.length === 0)
+        return none;
+    if (!recorded[BOULE_DEPLOYED_SCOPE_KEY])
+        return none;
+    if (!liveBouleEnv?.[BOULE_OWNER_SEED_SECRET_ENV])
+        return none;
+    const blocked = [];
+    org.owners.forEach((owner, index) => {
+        const at = `${org.slug}'s Boule owners are blocked, not planned: owner ${index + 1}`;
+        if (recorded[bouleOwnerRefusedScopeKey(owner.email)]) {
+            blocked.push(`${at} was refused by Boule (it holds another role or the platform is frozen)`);
+        }
+        else if (!recorded[bouleOwnerSeededScopeKey(owner.email)] &&
+            !bouleOwnerSubject(org, recorded, owner)) {
+            blocked.push(`${at} has no sign-in account yet`);
+        }
+    });
+    return { seed: bouleOwnerSeeds(org, recorded), blocked };
+}
 /**
  * The customers env a live Boule still holds after the company switched customers off. A host that merely
  * cannot deliver the credential keeps what it has: only an explicit off removes it.

package/dist/plan/company-backups.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredOrg } from '../org.js';
+import { type DeclaredOrg } from '../org.js';
 import type { UnmanagedItem } from '../plan.js';
 import type { DraftStep } from './diff.js';
 /**
@@ -11,6 +11,8 @@ import type { DraftStep } from './diff.js';
  * `app` is the hosting entry's database, recorded as a resource id.
  */
 export declare function companyDatabaseKeys(org: Pick<DeclaredOrg, 'id'>): Readonly<Record<string, string>>;
+/** The {@link companyDatabaseKeys} name of each home's legacy Coolify database, which its backup schedule is recorded under. */
+export declare const LEGACY_BACKUP_NAMES: Readonly<Record<string, string>>;
 /**
  * The database a company backup schedule must name when the Coolify resource
  * is not left to pick its first database. Absent: the resource's first database.
@@ -20,6 +22,10 @@ export declare const COMPANY_BACKUP_DATABASE_NAMES: Readonly<Record<string, stri
 export declare const BACKUP_SCOPE_PREFIX = "backup_";
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
 export declare function backupScopeKey(db: string): string;
+/** The recorded-id key that holds the database list the company server's schedule was last set to. */
+export declare const BACKUP_POSTGRES_DATABASES_SCOPE_KEY = "backup_postgres_databases";
+/** Comma-separated `databases_to_backup` for the server schedule: every home on the server, sorted. */
+export declare function serverBackupDatabases(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): string;
 /** The databases an upgrade of `service` can migrate, by the names in {@link companyDatabaseKeys}. Empty: not coverable here. */
 export declare function databasesForService(service: string): readonly string[] | 'all';
 /**

package/dist/plan/company-backups.js

@@ -1,6 +1,8 @@
+import { ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, orgServiceDatabase, } from '../org.js';
 import { BOULE_DATABASE_SCOPE_KEY } from './boule.js';
 import { CHAT_REKEY_MAS_DB_SCOPE_KEY, CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY } from './executor.js';
 import { MAIL_DATABASE_NAME, MAIL_DATABASE_SCOPE_KEY } from './mail-store.js';
+import { serviceOnServer } from './org-postgres.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db-tls.js';
 /**
@@ -29,8 +31,21 @@ export function companyDatabaseKeys(org) {
         boule: BOULE_DATABASE_SCOPE_KEY,
         chat_rekey_synapse: CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY,
         chat_rekey_mas: CHAT_REKEY_MAS_DB_SCOPE_KEY,
+        postgres: ORG_POSTGRES_SERVER_SCOPE_KEY,
     };
 }
+/** The {@link companyDatabaseKeys} name of each home's legacy Coolify database, which its backup schedule is recorded under. */
+export const LEGACY_BACKUP_NAMES = {
+    app: 'app',
+    cms: 'cms',
+    boule: 'boule',
+    chat_service: 'chat',
+    calls_service: 'calls',
+    chat_synapse: 'chat_synapse',
+    chat_mas: 'chat_mas',
+    calls_synapse: 'synapse',
+    calls_mas: 'mas',
+};
 /**
  * The database a company backup schedule must name when the Coolify resource
  * is not left to pick its first database. Absent: the resource's first database.
@@ -44,6 +59,15 @@ export const BACKUP_SCOPE_PREFIX = 'backup_';
 export function backupScopeKey(db) {
     return `${BACKUP_SCOPE_PREFIX}${db}`;
 }
+/** The recorded-id key that holds the database list the company server's schedule was last set to. */
+export const BACKUP_POSTGRES_DATABASES_SCOPE_KEY = 'backup_postgres_databases';
+/** Comma-separated `databases_to_backup` for the server schedule: every home on the server, sorted. */
+export function serverBackupDatabases(org, recordedIds) {
+    return ORG_SERVICE_SCHEMAS.filter((home) => serviceOnServer(org, home, recordedIds))
+        .map((home) => orgServiceDatabase(org, home).database)
+        .sort()
+        .join(',');
+}
 /** The databases an upgrade of `service` can migrate, by the names in {@link companyDatabaseKeys}. Empty: not coverable here. */
 export function databasesForService(service) {
     switch (service) {
@@ -80,7 +104,18 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
         return { steps, blocked };
     for (const [db, key] of Object.entries(companyDatabaseKeys(org))) {
         const databaseId = recordedIds[key];
-        if (!databaseId || recordedIds[backupScopeKey(db)])
+        if (!databaseId)
+            continue;
+        let databaseNames;
+        if (db === 'postgres') {
+            databaseNames = serverBackupDatabases(org, recordedIds);
+            if (!databaseNames)
+                continue;
+            if (recordedIds[backupScopeKey(db)] &&
+                recordedIds[BACKUP_POSTGRES_DATABASES_SCOPE_KEY] === databaseNames)
+                continue;
+        }
+        else if (recordedIds[backupScopeKey(db)])
             continue;
         if (!storageUuid) {
             blocked.push({
@@ -94,7 +129,12 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
                 system: 'coolify',
                 kind: 'backup',
                 key: `${org.slug}:${db}`,
-                desired: { databaseId, database: db, storageUuid },
+                desired: {
+                    databaseId,
+                    database: db,
+                    storageUuid,
+                    ...(databaseNames ? { databaseNames } : {}),
+                },
             },
             step: {
                 description: `schedule a nightly backup of ${org.slug}'s ${db} database to the platform's backup bucket`,

package/dist/plan/cookie-domain.d.ts

@@ -0,0 +1,41 @@
+import { type DeclaredOrg } from '../org.js';
+/** The auth release that holds both the shared-host organisation check (577) and the session binding (795). */
+export declare const MIN_AUTH_FOR_SESSION_BINDING = "0.28.0";
+export declare const MIN_AUTH_FOR_CLIENT_ORGS = "0.28.0";
+/**
+ * Scope id set to `'1'` once `LOGIN_SESSION_BIND_KEY` is live on the in-app login app (written, and the
+ * app deployed after it). No binding carries a cookie domain before it.
+ */
+export declare const SIGN_IN_BIND_KEY_SCOPE_KEY = "sign_in_bind_key_ready";
+/** The env that holds the key: at least 32 characters, secret, on the in-app login app only. */
+export declare const SIGN_IN_BIND_KEY_ENV = "LOGIN_SESSION_BIND_KEY";
+export declare const SIGN_IN_BIND_KEY_MIN_LENGTH = 32;
+/** The cookie domain the app-host bindings were last written with (`''` for none). */
+export declare const LOGIN_COOKIE_DOMAIN_SCOPE_KEY = "login_cookie_domain";
+/**
+ * True only for a `vX.Y.Z` tag at or above `min`. A branch, a sha or anything else is false, so a
+ * platform on `main` never passes a gate that needs a release.
+ */
+export declare function authAtLeast(gitRef: string, min: string): boolean;
+export type CookieDomainDecision = {
+    domain: string;
+} | {
+    domain: null;
+    reason: string;
+};
+/** Reasons that wait on a release or a key; the planner reports these. The others are the declaration's own shape. */
+export declare const COOKIE_DOMAIN_WAITING_REASONS: Set<string>;
+/**
+ * The company-wide cookie domain for an org's app-host bindings, or why there is none. A domain is
+ * returned only when the sign-in is in-app with app hosts bound, the org has its own domain, nothing
+ * but estate apps is public under it, the login is a release that binds sessions to the host, and the
+ * bind key is live. A company on a shared domain never gets one: a cookie there would span companies.
+ */
+export declare function cookieDomainAllowed(input: {
+    org: DeclaredOrg;
+    recorded: Readonly<Record<string, string>>;
+    authGitRef: string;
+    bindKeyReady: boolean;
+}): CookieDomainDecision;
+/** The fixed line the planner reports while a cookie domain waits on the login. */
+export declare function cookieDomainWaitingLine(slug: string, reason: string): string;

package/dist/plan/cookie-domain.js

@@ -0,0 +1,71 @@
+import { ownsServices } from '../org.js';
+import { inAppApps } from './login-host.js';
+/** The auth release that holds both the shared-host organisation check (577) and the session binding (795). */
+export const MIN_AUTH_FOR_SESSION_BINDING = '0.28.0';
+export const MIN_AUTH_FOR_CLIENT_ORGS = '0.28.0';
+/**
+ * Scope id set to `'1'` once `LOGIN_SESSION_BIND_KEY` is live on the in-app login app (written, and the
+ * app deployed after it). No binding carries a cookie domain before it.
+ */
+export const SIGN_IN_BIND_KEY_SCOPE_KEY = 'sign_in_bind_key_ready';
+/** The env that holds the key: at least 32 characters, secret, on the in-app login app only. */
+export const SIGN_IN_BIND_KEY_ENV = 'LOGIN_SESSION_BIND_KEY';
+export const SIGN_IN_BIND_KEY_MIN_LENGTH = 32;
+/** The cookie domain the app-host bindings were last written with (`''` for none). */
+export const LOGIN_COOKIE_DOMAIN_SCOPE_KEY = 'login_cookie_domain';
+const TAG = /^v(\d+)\.(\d+)\.(\d+)$/;
+/**
+ * True only for a `vX.Y.Z` tag at or above `min`. A branch, a sha or anything else is false, so a
+ * platform on `main` never passes a gate that needs a release.
+ */
+export function authAtLeast(gitRef, min) {
+    const have = TAG.exec(gitRef);
+    const want = /^(\d+)\.(\d+)\.(\d+)$/.exec(min);
+    if (!have || !want)
+        return false;
+    for (let i = 1; i <= 3; i++) {
+        const a = Number(have[i]);
+        const b = Number(want[i]);
+        if (a !== b)
+            return a > b;
+    }
+    return true;
+}
+/** Reasons that wait on a release or a key; the planner reports these. The others are the declaration's own shape. */
+export const COOKIE_DOMAIN_WAITING_REASONS = new Set([
+    'auth below 0.28.0',
+    'the session bind key is not live on the in-app login',
+]);
+/**
+ * The company-wide cookie domain for an org's app-host bindings, or why there is none. A domain is
+ * returned only when the sign-in is in-app with app hosts bound, the org has its own domain, nothing
+ * but estate apps is public under it, the login is a release that binds sessions to the host, and the
+ * bind key is live. A company on a shared domain never gets one: a cookie there would span companies.
+ */
+export function cookieDomainAllowed(input) {
+    const { org, recorded } = input;
+    if (inAppApps(org, recorded).length === 0) {
+        return { domain: null, reason: 'in-app sign-in has no app host bound' };
+    }
+    if (!org.domain)
+        return { domain: null, reason: 'the company has no domain of its own' };
+    // An own org's in-app login app is not given the key by the platform.
+    if (ownsServices(org)) {
+        return { domain: null, reason: 'the company runs its own sign-in' };
+    }
+    const publicApps = org.hosting.entries.some((e) => e.hostnames.length > 0 || e.worker !== undefined || e.workerApp !== undefined);
+    if (publicApps) {
+        return { domain: null, reason: 'a hosted app is public under the company domain' };
+    }
+    if (!authAtLeast(input.authGitRef, MIN_AUTH_FOR_SESSION_BINDING)) {
+        return { domain: null, reason: 'auth below 0.28.0' };
+    }
+    if (!input.bindKeyReady) {
+        return { domain: null, reason: 'the session bind key is not live on the in-app login' };
+    }
+    return { domain: org.domain };
+}
+/** The fixed line the planner reports while a cookie domain waits on the login. */
+export function cookieDomainWaitingLine(slug, reason) {
+    return `${slug}'s company-wide sign-in cookie waits: ${reason}`;
+}

package/dist/plan/desktop-auth.d.ts

@@ -0,0 +1,58 @@
+import { type DeclaredOrg } from '../org.js';
+import { type AgoraHostValues, DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, desktopAuthInternalName, desktopAuthUpstream } from './agora.js';
+import type { DraftStep } from './diff.js';
+export { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, desktopAuthInternalName, desktopAuthUpstream, };
+/**
+ * #440: Agora's desktop sign-in backend (`apps/desktop-auth` of the agora repo), one internal app per
+ * company on its Postgres server's `desktop_auth` home. Agora proxies `/auth/desktop/*` to it. Its own
+ * secrets (cookie, handoff key) live in its env only and are generated once.
+ */
+export declare const DESKTOP_AUTH_DOCKERFILE = "/apps/desktop-auth/Dockerfile";
+export declare const DESKTOP_AUTH_HOME = "desktop_auth";
+/** The digest of the non-secret env last written; a changed hostname, issuer or id plans the step again. */
+export declare const DESKTOP_AUTH_REVISION_SCOPE_KEY = "coolify_desktop_auth_revision";
+/** The Agora origin the app was last written for (CLAUDE.md rule 3: the applied hostname is a scope id). */
+export declare const DESKTOP_AUTH_ORIGIN_SCOPE_KEY = "coolify_desktop_auth_origin";
+/** The callback URI last put on Agora's client, or `unsupported:<uri>` when the providers client cannot. */
+export declare const DESKTOP_AUTH_REDIRECT_SCOPE_KEY = "coolify_desktop_auth_redirect";
+/** Recorded once the readiness probe through Agora answered. */
+export declare const DESKTOP_AUTH_READY_SCOPE_KEY = "coolify_desktop_auth_ready";
+/** `https://<agora host>/auth/desktop/callback`. */
+export declare function desktopAuthCallbackUri(agoraOrigin: string): string;
+export declare const desktopAuthOrigin: (org: DeclaredOrg) => string;
+/** The route desktop-auth answers 200 on without a session; foundry probes it through Agora. */
+export declare const DESKTOP_AUTH_READY_PATH = "/auth/desktop/error";
+export declare const desktopAuthRedirectUnsupported: (uri: string) => string;
+/** The values both the plan and the executor derive the env from. */
+export interface DesktopAuthInputs {
+    origin: string;
+    issuer: string;
+    clientId: string;
+    organisationId: string;
+    projectId: string;
+    mailProjectId: string;
+    filesProjectId: string | null;
+}
+/** The inputs from the host values and recorded ids, and the names of those still missing. */
+export declare function desktopAuthInputs(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, rawHost: AgoraHostValues): {
+    inputs: DesktopAuthInputs | null;
+    missing: string[];
+};
+/** The env that is not a secret and not a connection URL. `APP_URL` is the origin with its slash: the app refuses any other form. */
+export declare function desktopAuthEnv(inputs: DesktopAuthInputs, runtimeRole: string): Record<string, string>;
+export declare function desktopAuthRevision(env: Readonly<Record<string, string>>): string;
+/**
+ * The `coolify:desktop-auth` step. Planned when the app is not recorded, when the env it was written for
+ * differs (a rename moves the origin), when it never ran healthy, when the callback URI is not on Agora's
+ * client, and when Agora carries the upstream but the readiness probe never answered. Not planned while
+ * Agora is blocked (its own line says why) or while the `desktop_auth` home cannot exist yet (blocked).
+ * `homePlanned` is true when the databases step in this plan creates the home.
+ */
+export declare function planDesktopAuth(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, input: {
+    host: AgoraHostValues | null;
+    liveAgoraEnv: Readonly<Record<string, string>> | null;
+    homePlanned: boolean;
+}): {
+    step: DraftStep | null;
+    blocked: string | null;
+};