@wtfalch/foundry 0.48.0 → 0.50.0

package/dist/bootstrap/declare.js

@@ -121,6 +121,7 @@ export function declaredCompanyOrg(company, owner) {
             issuerApps: [],
             entries: [],
             gateLimit: DEFAULT_GATE_LIMIT,
+            repos: [],
         },
         sso: { enabled: false },
         guests: { enabled: false },

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, BlueGreenConfig, OrgBuiltinApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
@@ -31,13 +31,18 @@ export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINAT
 export { AdoptRefusedError } from './plan/index.js';
 export { DumpError, dumpNow } from './plan/index.js';
 export type { DatabaseDump } from './plan/index.js';
+export { STAGE_SINK_APPLIED_SCOPE_KEY, STAGE_SINK_IMAGE_REF, stageMailEnv, stageSinkAppName, } from './plan/index.js';
+export { STAGE_COPY_EXCLUDED_TABLES, StageCopyFailedError, StageCopyRefusedError, stageCopy, tableExcluded, undoStageCopy, } from './plan/index.js';
+export type { StageCopyInput, StageCopyPort, StageCopyProduction, StageCopyRunRecord, UndoStageCopyInput, } from './plan/index.js';
+export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execRunner, } from './plan/index.js';
+export type { Runner, StageCopyPortDeps } from './plan/index.js';
 export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationBackupMissingError, OrgPostgresMigrationNotConfirmedError, } from './plan/index.js';
 export type { OrgPostgresMigrationConfirmation } from './plan/index.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
 export type { BackupGatePorts } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, GITHUB_RELEASE_HOOK_ORG, GITHUB_RELEASE_HOOK_PATH, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
@@ -66,7 +71,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformGithubReleaseHookDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
@@ -19,10 +19,13 @@ export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAudit
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { DumpError, dumpNow } from './plan/index.js';
+export { STAGE_SINK_APPLIED_SCOPE_KEY, STAGE_SINK_IMAGE_REF, stageMailEnv, stageSinkAppName, } from './plan/index.js';
+export { STAGE_COPY_EXCLUDED_TABLES, StageCopyFailedError, StageCopyRefusedError, stageCopy, tableExcluded, undoStageCopy, } from './plan/index.js';
+export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execRunner, } from './plan/index.js';
 export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationBackupMissingError, OrgPostgresMigrationNotConfirmedError, } from './plan/index.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';
 export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, GITHUB_RELEASE_HOOK_ORG, GITHUB_RELEASE_HOOK_PATH, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgTarget, } from './plan/index.js';

package/dist/migrations/0060_hosting_repos.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: the repos a company's apps may be built from (`HostingConfig.repos`), persisted.
+-- Mirrors `src/store/schema.ts`'s `hostingRepos`. Additive, like 0048_hosting_gate_limit.sql: a new
+-- column with a default, so a row written before it reads `[]` and an older reader ignores it. Safe
+-- on live rows when the container starts.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_repos jsonb not null default '[]'::jsonb;

package/dist/org.d.ts

@@ -253,6 +253,12 @@ export interface HostingConfig {
     access?: AccessRule[];
     /** How many gates the org may declare across all its entries. Only the platform operator sets it. Default: `3`. */
     gateLimit: number;
+    /**
+     * The repos under `wtfalch` the org's apps may be built from, each `wtfalch/<name>`. Stored lowercase and
+     * unique ({@link normalizeHostingRepos}). Only a person who declares the company sets it; the planner
+     * and the diff ignore it. Default: `[]`.
+     */
+    repos: string[];
 }
 /** The two Cloudflare Access rule kinds {@link HostingConfig.access} supports (#246). */
 export type AccessRuleKind = 'bypass' | 'service-token';
@@ -283,7 +289,7 @@ export type AccessRule = {
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /** Why a validator refused. `code` is stable and never reworded; `message` is for people. */
-export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'auth_sign_in_invalid' | 'email_code_needs_customers' | 'client_name_taken' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
+export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'hosting_repo_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'auth_sign_in_invalid' | 'email_code_needs_customers' | 'client_name_taken' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
 /**
  * One refusal: a stable `code`, the dotted `path` into {@link DeclaredOrg} it is about
  * (`hosting.entries.terminal.uses.auth.registration`) and the sentence for people.
@@ -626,6 +632,8 @@ export interface HostingNames {
     /** Boule or Agora declares `blueGreen`: the blue/green key names are reserved for the entries too. */
     builtinBlueGreen?: boolean;
 }
+/** `repos` as the store keeps them: lowercase, in the order given. Absent reads as none. */
+export declare function normalizeHostingRepos(repos: readonly string[] | undefined): string[];
 /** {@link validateHosting} with the code and path of the first refusal. */
 export declare function refuseHosting(hosting: HostingConfig, names?: HostingNames): OrgRefusal | null;
 /** `blueGreen`: steps ascending, each a whole number 1..100, the last 100; a hold of 1..1440 minutes. */

package/dist/org.js

@@ -123,8 +123,34 @@ const HOSTING_BUILD_PACKS = new Set([
 export function validateHosting(hosting, names) {
     return refuseHosting(hosting, names)?.message ?? null;
 }
+/** `repos` as the store keeps them: lowercase, in the order given. Absent reads as none. */
+export function normalizeHostingRepos(repos) {
+    return (repos ?? []).map((repo) => repo.toLowerCase());
+}
+/** The rules for `hosting.repos`: a list of `wtfalch/<name>` (name 1-100 of letters, digits, `.`, `_`, `-`), unique ignoring case. */
+function refuseHostingRepos(repos) {
+    const invalid = (message) => refusal('hosting_repo_invalid', 'hosting.repos', message);
+    if (repos === undefined)
+        return null;
+    if (!Array.isArray(repos))
+        return invalid('hosting.repos must be a list');
+    const seen = new Set();
+    for (const repo of repos) {
+        if (typeof repo !== 'string' || !HOSTING_REPO.test(repo)) {
+            return invalid('hosting.repos must each be wtfalch/<name>, the name 1-100 letters, digits, dots, underscores or hyphens');
+        }
+        const lower = repo.toLowerCase();
+        if (seen.has(lower))
+            return invalid(`hosting.repos names ${lower} twice`);
+        seen.add(lower);
+    }
+    return null;
+}
 /** {@link validateHosting} with the code and path of the first refusal. */
 export function refuseHosting(hosting, names) {
+    const badRepos = refuseHostingRepos(hosting.repos);
+    if (badRepos)
+        return badRepos;
     if (hosting.tunnel && !hosting.enabled) {
         return refusal('hosting_tunnel_needs_hosting', 'hosting.tunnel', 'hosting.tunnel requires hosting.enabled');
     }
@@ -381,6 +407,7 @@ const VOLUME_FORBIDDEN_ROOTS = [
 ];
 const VOLUME_MOUNT_PATH_MAX = 255;
 const REPO = /^wtfalch\/[A-Za-z0-9._-]+$/;
+const HOSTING_REPO = /^wtfalch\/[A-Za-z0-9._-]{1,100}$/;
 // The env names `pushAppEnv` and `pushDatabaseUrl` set themselves.
 const FOUNDRY_ENV_NAME = /^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$/;
 // Set only on the colors of a blueGreen entry; any other entry may declare them.

package/dist/plan/archon-blue-green.js

@@ -59,6 +59,7 @@ export async function applyArchonBlueGreen(run) {
         logDir: run.logDir,
         isRunning: run.isRunning,
         adoptRunningBlue: true,
+        stageSink: { slug: 'platform' },
         actionsKey: async () => {
             const key = await mintActionsKey({
                 id,

package/dist/plan/blue-green-apply.d.ts

@@ -7,6 +7,8 @@ import { type StageGuardDeps } from './stage-guards.js';
 /** The Coolify calls this module makes. */
 type Coolify = Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy' | 'deployAndWait' | 'listStorages' | 'createPersistentStorage' | 'createFileStorage' | 'updateFileStorage' | 'requireGithubApp' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw'> & {
     listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
+    /** Needed by the stage mail sink; a host without it gets no sink, so no stage mail env. */
+    createDockerImageApplication?: CoolifyPort['createDockerImageApplication'];
 };
 export interface BlueGreenApplyDeps {
     coolify: Coolify;
@@ -47,6 +49,13 @@ export interface BlueGreenApplyDeps {
      * guard unrecorded ("not run", never passed), so `stageGuardsReady` stays false and the copy does not start.
      */
     stageGuards?: StageGuardDeps;
+    /**
+     * The company the stage mail sink belongs to (its name is `<slug>-stage-sink`). Absent: no sink is made and
+     * stage holds no mail env at all, so the copy stays refused.
+     */
+    stageSink?: {
+        slug: string;
+    };
 }
 /** What writing a balancer's config needs; {@link BlueGreenApplyDeps} and the release runner both have it. */
 export interface LbConfigDeps {

package/dist/plan/blue-green-apply.js

@@ -1,13 +1,18 @@
 import { randomBytes } from 'node:crypto';
 import { ACTIONS_KEY_ENV, COLORS, LB_CONFIG_PATH, bgKey, colorAppName, colorBackend, formatWeights, lbAppName, lbDockerfile, parseWeights, prodResources, renderLbConfig, reportingEnv, stageAppName, stageAppUrl, stageKindOf, stageResources, structureHash, } from './blue-green.js';
 import { recordBuiltCommit } from './build-record.js';
+import { withTimeout } from './call-timeout.js';
 import { ensureConnectorsOnServers } from './cloudflared-connector.js';
 import { waitForNewDeployment } from './deploy-health.js';
+import { commandHealthCheckSettings, wgetProbe } from './health-check-settings.js';
 import { ENTRY_CONTAINER_LABELS } from './proxy-labels.js';
 import { remoteDatabaseAddress, remoteDatabaseHost } from './remote-database.js';
 import { buildStageEnv } from './stage-env.js';
 import { buildStageProbes, runStageProbes, stageProbesRecord, } from './stage-guards.js';
 import { assertStageIsolated, envClass, stageIsolationHash, } from './stage-isolation.js';
+import { STAGE_SINK_APPLIED_SCOPE_KEY, STAGE_SINK_APP_SCOPE_KEY, STAGE_SINK_HTTP_PORT, STAGE_SINK_IMAGE_TAG, STAGE_SINK_REPOSITORY, stageMailEnv, stageSinkAppName, } from './stage-sink.js';
+/** How long one Coolify call of the sink may take. */
+const SINK_CALL_TIMEOUT_MS = 30_000;
 /** Env names whose value is a credential: registered before they are copied. */
 const SECRETISH = /(KEY|SECRET|TOKEN|PASSWORD|DATABASE_URL)/;
 /** The env names that name the database. */
@@ -80,8 +85,15 @@ export async function applyBlueGreenServer(deps, subject, server) {
     const lbName = lbAppName(subject.base);
     const lbId = await ensureLoadBalancer(deps, subject, server.uuid, lbName, isPrimary);
     await writeLbConfig(deps, subject, { uuid: server.uuid, isPrimary }, lbId, weights);
-    if (isPrimary)
+    if (isPrimary) {
+        const sinkReady = await ensureStageSink(deps, subject, server.uuid);
         await ensureStage(deps, subject, server.uuid);
+        if (!sinkReady) {
+            // The planner plans this step again while the state is `blocked:`; ensureStage may have written `ok`.
+            deps.record(bgKey.stageState(id), 'blocked:sink');
+            await deps.persist();
+        }
+    }
     deps.record(bgKey.applied(id, server.uuid), structureHash(subject, { primary: isPrimary }));
     await deps.persist();
 }
@@ -301,6 +313,69 @@ async function ensureLoadBalancer(deps, subject, serverUuid, name, isPrimary) {
     }
     return lbId;
 }
+/**
+ * One Mailpit app per company beside stage, shared by every stage of the company. It is checked against the live
+ * app on every run: one that is stopped or gone is deployed again. `stage_sink_applied` is recorded only after
+ * the sink deploys; a failure clears it, logs fixed text and the error name, and returns false. Production's
+ * structure goes on (stage then holds no mail env and the copy stays refused).
+ */
+async function ensureStageSink(deps, subject, serverUuid) {
+    const org = deps.stageSink;
+    if (!org)
+        return true;
+    const { coolify } = deps;
+    const name = stageSinkAppName(org);
+    try {
+        let appId = deps.recorded()[STAGE_SINK_APP_SCOPE_KEY];
+        let created = false;
+        if (!appId) {
+            appId = (await withTimeout('stage sink: find the app', SINK_CALL_TIMEOUT_MS, () => coolify.findApplicationByName(name, { environmentIds: [deps.environment.id] })))?.uuid;
+        }
+        if (!appId) {
+            const createImageApp = coolify.createDockerImageApplication;
+            if (!createImageApp)
+                throw new Error('the host cannot create an image app');
+            appId = (await withTimeout('stage sink: create the app', SINK_CALL_TIMEOUT_MS, () => createImageApp.call(coolify, {
+                project_uuid: deps.projectUuid,
+                server_uuid: serverUuid,
+                environment_name: deps.environment.name,
+                environment_uuid: deps.environment.uuid,
+                docker_registry_image_name: STAGE_SINK_REPOSITORY,
+                docker_registry_image_tag: STAGE_SINK_IMAGE_TAG,
+                ports_exposes: String(STAGE_SINK_HTTP_PORT),
+                name,
+                description: `mail sink for ${subject.base}'s stage`,
+                instant_deploy: false,
+            }))).uuid;
+            created = true;
+        }
+        // Recorded before anything else is written, so a later failure never leaves an app nothing points at.
+        if (deps.recorded()[STAGE_SINK_APP_SCOPE_KEY] !== appId) {
+            deps.record(STAGE_SINK_APP_SCOPE_KEY, appId);
+            await deps.persist();
+        }
+        if (created) {
+            await withTimeout('stage sink: set the app up', SINK_CALL_TIMEOUT_MS, () => coolify.updateApplication(appId, {
+                custom_internal_name: name,
+                ...commandHealthCheckSettings(wgetProbe(STAGE_SINK_HTTP_PORT, '/livez')),
+            }));
+        }
+        await ensureDeployed(deps, appId, name);
+    }
+    catch (error) {
+        console.error(`${deps.label}: the stage mail sink failed (${error instanceof Error ? error.name : 'unknown'}); stage gets no mail env`);
+        if (deps.recorded()[STAGE_SINK_APPLIED_SCOPE_KEY]) {
+            deps.record(STAGE_SINK_APPLIED_SCOPE_KEY, '');
+            await deps.persist();
+        }
+        return false;
+    }
+    if (!deps.recorded()[STAGE_SINK_APPLIED_SCOPE_KEY]) {
+        deps.record(STAGE_SINK_APPLIED_SCOPE_KEY, '1');
+        await deps.persist();
+    }
+    return true;
+}
 /** The stage app and its own empty database, on the primary. Its env comes from the allowlist, never from a copy of the live app's. */
 async function ensureStage(deps, subject, serverUuid) {
     const { coolify } = deps;
@@ -368,6 +443,12 @@ async function ensureStage(deps, subject, serverUuid) {
         deps.secret(key);
         stageEnv.push({ key: ACTIONS_KEY_ENV, value: key, buildTime: true });
     }
+    // The sink's mail env, only once the sink app is deployed. Before that stage holds no mail env at all.
+    const sinkApplied = deps.stageSink && deps.recorded()[STAGE_SINK_APPLIED_SCOPE_KEY];
+    const mail = deps.stageSink && sinkApplied ? stageMailEnv(deps.stageSink) : [];
+    const stageHas = new Map((await coolify.listEnvs(appId)).filter((e) => !e.is_preview).map((e) => [e.key, e.value]));
+    const mailChanged = mail.some((e) => stageHas.get(e.key) !== e.value);
+    stageEnv.push(...mail);
     const stageSurface = {
         env: stageEnv.map((e) => ({ name: e.key, class: envClass(e.key), value: e.value })),
         resources: stageResources(subject),
@@ -382,6 +463,7 @@ async function ensureStage(deps, subject, serverUuid) {
             internalHosts: Object.values(prodResources(subject)),
         },
         stage: stageSurface,
+        sinkMail: Object.fromEntries(mail.map((e) => [e.key, e.value])),
     });
     if (violations.length > 0) {
         // Stage fails closed for itself: nothing is written to it, production's structure goes on.
@@ -423,11 +505,13 @@ async function ensureStage(deps, subject, serverUuid) {
         return;
     }
     await upsertEnv(deps, appId, stageEnv);
+    if (mail.length > 0)
+        deps.record(bgKey.stageSink(subject.id), 'applied');
     deps.record(bgKey.stageIsolation(subject.id), isolationHash);
     deps.record(bgKey.stageProbes(subject.id), probes.value);
     await deps.persist();
     const live = await coolify.getApplication(appId);
-    if (live.status === undefined || !deps.isRunning(live.status)) {
+    if (mailChanged || live.status === undefined || !deps.isRunning(live.status)) {
         // Stage is a test copy: a failed build or health check must not fail production's structure apply.
         // The next apply retries it (the plan keeps the step while the state is `unhealthy`).
         let built;

package/dist/plan/blue-green.d.ts

@@ -54,6 +54,12 @@ export declare const bgKey: {
     stageGate: (id: string) => string;
     /** `ok:<hash>` once every apply-time probe was rejected; `notrun:<names>` or `failed:<names>` otherwise. */
     stageProbes: (id: string) => string;
+    /** `applied` once the stage app holds the sink's mail env. The copy refuses without it. */
+    stageSink: (id: string) => string;
+    /** `<ISO time>|<dump execution id>|ok`, written by a finished copy of production into stage. */
+    stageCopy: (id: string) => string;
+    /** The Coolify database stage ran on before the last copy, kept for `undoStageCopy` until the next copy. */
+    stageKept: (id: string) => string;
 };
 /** The three env names the reporting health read uses (contract C1). */
 export declare const REPORTING_ENV: {
@@ -263,6 +269,8 @@ export interface PlanBlueGreenInput {
     appPlanned: (entryKey: string) => boolean;
     /** The platform's recorded Access provider, which the stage gate requires. Absent: no gate is made. */
     accessProviderId?: string | null;
+    /** The company's stage mail sink is recorded and its live app is stopped or gone (read from Coolify at plan time). */
+    stageSinkDown?: boolean;
 }
 /**
  * Plans the blue/green parts of an org: per usable server, one structure step (the apps, the balancer, the

package/dist/plan/blue-green.js

@@ -8,6 +8,7 @@ import { appNameFor, appStepKey } from './platform-diff.js';
 import { remoteDatabaseAppliedFor } from './remote-database.js';
 import { buildStageEnv } from './stage-env.js';
 import { assertStageIsolated, envClass } from './stage-isolation.js';
+import { STAGE_SINK_VERSION } from './stage-sink.js';
 export const COLORS = ['blue', 'green'];
 /** The name of `base`'s copy in `color`: `<base>-blue`. */
 export function colorAppName(base, color) {
@@ -62,6 +63,12 @@ export const bgKey = {
     stageGate: (id) => `bg.${id}.stagegate`,
     /** `ok:<hash>` once every apply-time probe was rejected; `notrun:<names>` or `failed:<names>` otherwise. */
     stageProbes: (id) => `bg.${id}.stageprobes`,
+    /** `applied` once the stage app holds the sink's mail env. The copy refuses without it. */
+    stageSink: (id) => `bg.${id}.stagesink`,
+    /** `<ISO time>|<dump execution id>|ok`, written by a finished copy of production into stage. */
+    stageCopy: (id) => `bg.${id}.stagecopy`,
+    /** The Coolify database stage ran on before the last copy, kept for `undoStageCopy` until the next copy. */
+    stageKept: (id) => `bg.${id}.stagekept`,
 };
 /** The three env names the reporting health read uses (contract C1). */
 export const REPORTING_ENV = {
@@ -324,6 +331,7 @@ export function structureHash(subject, input) {
         database: subject.database,
         primary: input.primary,
         lb: VERSIONS.traefik,
+        ...(input.primary ? { stageSink: STAGE_SINK_VERSION } : {}),
     }))
         .digest('hex')
         .slice(0, 16);
@@ -498,6 +506,12 @@ export function planBlueGreen(input) {
                 key: `bg:${id}:stage`,
             });
         }
+        else if (stageState === 'blocked:sink' || input.stageSinkDown === true) {
+            unmanaged.push({
+                description: `${org.slug}'s ${id} app: the stage mail sink is not running; stage gets no mail env and the copy is refused`,
+                key: `bg:${id}:stage`,
+            });
+        }
         else if (stageState?.startsWith('blocked:')) {
             unmanaged.push({
                 description: `${org.slug}'s ${id} app: stage is blocked and was not written to (${stageState.slice('blocked:'.length)})`,
@@ -516,7 +530,10 @@ export function planBlueGreen(input) {
                 continue;
             }
             // A stage that was not healthy is retried by running the structure again.
-            const stageRetry = isPrimary && (stageState === 'unhealthy' || stageState?.startsWith('blocked:') === true);
+            const stageRetry = isPrimary &&
+                (stageState === 'unhealthy' ||
+                    stageState?.startsWith('blocked:') === true ||
+                    input.stageSinkDown === true);
             if (recordedIds[bgKey.applied(id, server)] !== hash || stageRetry) {
                 steps.push({
                     kind: 'bluegreen',

package/dist/plan/call-timeout.d.ts

@@ -0,0 +1,6 @@
+/** A failed outside call: fixed text and the label, never the cause (it can echo a credential). */
+export declare class CallError extends Error {
+    constructor(message: string);
+}
+/** Runs one outside call under a timeout. Any failure becomes a {@link CallError} with fixed text. */
+export declare function withTimeout<T>(label: string, timeoutMs: number, call: () => Promise<T>): Promise<T>;

package/dist/plan/call-timeout.js

@@ -0,0 +1,27 @@
+/** A failed outside call: fixed text and the label, never the cause (it can echo a credential). */
+export class CallError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CallError';
+    }
+}
+/** Runs one outside call under a timeout. Any failure becomes a {@link CallError} with fixed text. */
+export async function withTimeout(label, timeoutMs, call) {
+    let timer;
+    try {
+        return await Promise.race([
+            call(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new CallError(`${label}: no answer within ${timeoutMs / 1000} seconds`)), timeoutMs);
+            }),
+        ]);
+    }
+    catch (error) {
+        if (error instanceof CallError)
+            throw error;
+        throw new CallError(`${label}: the call failed`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/plan/diff.d.ts

@@ -136,6 +136,8 @@ export interface PlanOrgOptions {
     backupStorageUuid?: string | null;
     /** Every Coolify server the host lists, for blue/green (`plan/blue-green.ts`). Absent: the host cannot list them. */
     blueGreenServers?: readonly BlueGreenServer[];
+    /** The company's stage mail sink is recorded and its live app is stopped or gone. */
+    stageSinkDown?: boolean;
 }
 export interface PlanDetail {
     orgId: OrgId;

package/dist/plan/diff.js

@@ -491,6 +491,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         servers: options.blueGreenServers,
         canHoldSecrets: platformReadiness.canHoldSecrets === true,
         accessProviderId: platformReadiness.accessProviderId ?? null,
+        ...(options.stageSinkDown ? { stageSinkDown: true } : {}),
         appPlanned: (entryKey) => plannedSteps.some((p) => p.action.system === 'coolify' &&
             p.action.kind === 'app' &&
             p.action.key === appStepKey(org, entryKey)),

package/dist/plan/executor.d.ts

@@ -2374,6 +2374,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * blue copy is not recorded. The health token is only read here, never minted.
      */
     releaseHost(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /** Whether the stage mail sink app is stopped or gone, read live. A failed read throws; the caller reads that as up. */
+    stageSinkDown(appId: string): Promise<boolean>;
     /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
     blueGreenServers(): Promise<BlueGreenServer[]>;
     /**

package/dist/plan/executor.js

@@ -2905,6 +2905,17 @@ export class FoundryStepExecutor {
             label: `coolify:release:${subject.id}`,
         });
     }
+    /** Whether the stage mail sink app is stopped or gone, read live. A failed read throws; the caller reads that as up. */
+    async stageSinkDown(appId) {
+        try {
+            return !isRunningOrStarting((await this.ports.coolify.getApplication(appId)).status);
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return true;
+            throw error;
+        }
+    }
     /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
     async blueGreenServers() {
         return (await this.ports.coolify.listServers()).map((s) => ({
@@ -3014,6 +3025,7 @@ export class FoundryStepExecutor {
             logDir: LOG_DIR,
             isRunning: isRunningOrStarting,
             stageGuards: this.stageGuards(org, subject, recorded(), action.desired.accessProviderId),
+            stageSink: { slug: org.slug },
         };
         if (action.kind === 'bluegreen-lb') {
             await applyBlueGreenWeights(deps, subject, { uuid: serverUuid, primaryUuid });
@@ -9324,9 +9336,21 @@ export class FoundryStepExecutor {
                     }
                     return;
                 }
-                case 'coolify:bg-database':
+                case 'coolify:bg-database': {
+                    // Copies of production (`<base>-stage-db-copy-*`) are never all recorded; they go with the org.
+                    const all = await this.ports.coolify.listDatabases();
+                    const name = all.find((d) => d.uuid === target.id)?.name;
+                    const base = name ? /^(.+)-stage-db(?:-copy-.+)?$/.exec(name)?.[1] : undefined;
+                    if (base) {
+                        for (const d of all) {
+                            if (d.uuid !== target.id && d.name.startsWith(`${base}-stage-db-copy-`)) {
+                                await this.ports.coolify.deleteDatabase(d.uuid);
+                            }
+                        }
+                    }
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;
+                }
                 case 'coolify:database':
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;

package/dist/plan/github-release-hook.d.ts

@@ -0,0 +1,81 @@
+import type { CoolifyPort } from './executor.js';
+/** Every GitHub call is cut off after this long. */
+export declare const GITHUB_API_TIMEOUT_MS = 20000;
+/** A GitHub call that failed. The text is fixed: it never holds the token, the secret or a response body. */
+export declare class GithubApiError extends Error {
+    readonly operation: string;
+    readonly status: number | null;
+    constructor(operation: string, status: number | null);
+}
+/** The shape of an organisation hook foundry reads. */
+export interface GithubOrgHook {
+    id: number;
+    active: boolean;
+    events: string[];
+    config: {
+        url?: string;
+        content_type?: string;
+    };
+}
+export interface GithubReleaseHookBody {
+    name: 'web';
+    active: true;
+    events: ['release'];
+    config: {
+        url: string;
+        content_type: 'json';
+        secret: string;
+        insecure_ssl: '0';
+    };
+}
+export interface GithubHooksClient {
+    list(org: string): Promise<GithubOrgHook[]>;
+    create(org: string, body: GithubReleaseHookBody): Promise<GithubOrgHook>;
+    update(org: string, id: number, body: GithubReleaseHookBody): Promise<GithubOrgHook>;
+}
+/** The GitHub REST organisation-hooks calls, over `fetchImpl` (global fetch by default) with a timeout on each. */
+export declare function createGithubHooksClient(options: {
+    token: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): GithubHooksClient;
+export interface PlatformGithubReleaseHookDeps {
+    coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs'>;
+    heldKeys: {
+        resolve(ref: string): Promise<string | null>;
+    };
+    /** Global fetch by default; tests give their own. */
+    fetchImpl?: typeof fetch;
+    /** Told of the token and the secret, so the host can scrub them from logs and audit rows. */
+    onSecret?: (value: string) => void;
+}
+/**
+ * What the planner needs: why the step is blocked (the token is not held), or `ready` (the token is
+ * held) with the hash of the hook's url and Archon's live secret when Archon already holds one. With no
+ * secret yet the step still plans: `platform:archon` mints it earlier in the same apply.
+ */
+export declare function githubReleaseHookPlanInputs(deps: PlatformGithubReleaseHookDeps, hostname: string, recorded: Readonly<Record<string, string>>): Promise<{
+    blocked?: string;
+    ready?: true;
+    hash?: string;
+}>;
+/**
+ * Makes the organisation's release webhook. Adopts the hook whose url is Archon's, else creates one;
+ * an adopted hook is always written again, because GitHub never returns its secret.
+ *
+ * The secret is made here when Archon's app does not hold one yet (`ensureSecret`, which keeps a live
+ * value), so the step can run before `platform:archon`; that step then keeps the same value.
+ *
+ * A failure halfway: a hook made and not recorded is adopted by its url on the next run; a hook
+ * written and not recorded is written again. The id and the hash are recorded together, after the write.
+ */
+export declare function provisionGithubReleaseHook(context: {
+    platform: {
+        archon: {
+            hostname: string;
+        };
+    };
+    recordedIds(): Record<string, string>;
+    recordScopeId(key: string, id: string): void;
+    persist?(): Promise<void>;
+}, deps: PlatformGithubReleaseHookDeps, ensureSecret: (appId: string) => Promise<string>): Promise<undefined>;