@wtfalch/foundry 0.48.0 → 0.50.0

package/dist/plan/platform-providers.js

@@ -28,7 +28,7 @@ import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAI
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
 import { LOGIN_HOST_BINDINGS_ENV } from './sign-in-bindings.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
@@ -36,6 +36,7 @@ import { SIGN_IN_BASE_PATH, SIGN_IN_BUILD_ARG_ENV, SIGN_IN_LOGIN_APP_SCOPE_KEY,
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
+import { githubReleaseHookPlanInputs, provisionGithubReleaseHook, } from './github-release-hook.js';
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, waitForSystemApi, } from './zitadel-system-api.js';
@@ -144,6 +145,7 @@ export class FoundryPlatformStepExecutor {
     uptime;
     accessProvider;
     oikosIngress;
+    githubReleaseHook;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
         this.declaredOrgStore = declaredOrgStore;
@@ -164,6 +166,7 @@ export class FoundryPlatformStepExecutor {
         this.uptime = options.uptime;
         this.accessProvider = options.accessProvider;
         this.oikosIngress = options.oikosIngress;
+        this.githubReleaseHook = options.githubReleaseHook;
     }
     platformPorts = new WeakMap();
     /** The port placed on the platform's destination, made once per port so a server is listed once. */
@@ -470,6 +473,15 @@ export class FoundryPlatformStepExecutor {
                 blocked.heartbeatsApiKeyMissing = true;
         }
         await this.uptimeBlocked(platform, recordedIds, blocked, owner);
+        if (this.githubReleaseHook && platform.archon.enabled) {
+            const inputs = await githubReleaseHookPlanInputs(this.githubReleaseHook, platform.archon.hostname, recordedIds);
+            if (inputs.blocked)
+                blocked.githubReleaseHook = inputs.blocked;
+            if (inputs.ready)
+                blocked.githubReleaseHookReady = true;
+            if (inputs.hash)
+                blocked.githubReleaseHookHash = inputs.hash;
+        }
         // #604: only once edge and sign-in are applied (the planner reports
         // that case itself) and no provider is recorded yet.
         if (platform.edge.enabled &&
@@ -693,12 +705,15 @@ export class FoundryPlatformStepExecutor {
             const redeployFailed = this.archon.runsInsideApp === true &&
                 Boolean(deployment) &&
                 (await archonDeploymentState(this.archon.coolify, deployment)) === 'failed';
+            const webhookSecretDrifted = !rollingUpdateDrifted &&
+                (await archonWebhookSecretDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], recordedIds));
             if (accessDrifted ||
                 brokerDrifted ||
                 authOrgDrifted ||
                 authzDrifted ||
                 bridgeDrifted ||
                 rollingUpdateDrifted ||
+                webhookSecretDrifted ||
                 redeployFailed)
                 result.archon = true;
         }
@@ -923,6 +938,28 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformAccessProvider(context, this.accessProvider);
         }
+        if (action.system === 'github' &&
+            action.kind === 'release-hook' &&
+            action.key === PLATFORM_GITHUB_RELEASE_HOOK_KEY) {
+            if (!this.githubReleaseHook) {
+                throw new Error('platform:github-release-hook needs FoundryPlatformStepExecutor to be constructed with its github release hook dependencies');
+            }
+            const hookDeps = this.githubReleaseHook;
+            return provisionGithubReleaseHook(context, hookDeps, async (appId) => {
+                const minted = await ensureGeneratedEnv(hookDeps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, () => randomBytes(32).toString('hex'));
+                if (minted) {
+                    await hookDeps.coolify.bulkUpsertEnvs(appId, [
+                        { key: GITHUB_RELEASE_WEBHOOK_SECRET_ENV, value: minted },
+                    ]);
+                    return minted;
+                }
+                const live = await currentEnvValue(hookDeps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV);
+                if (!live) {
+                    throw new Error(`platform:github-release-hook: Archon lost its ${GITHUB_RELEASE_WEBHOOK_SECRET_ENV} between two reads`);
+                }
+                return live;
+            });
+        }
         if (action.system === 'heartbeats' && action.kind === 'reconcile') {
             if (!this.heartbeats) {
                 throw new Error('heartbeats:reconcile needs FoundryPlatformStepExecutor to be constructed with its heartbeats dependencies (#540)');
@@ -4458,6 +4495,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const cookieSecret = await ensureGeneratedEnv(deps.coolify, appId, 'AUTH_COOKIE_SECRET', () => randomBytes(32).toString('base64'));
     if (cookieSecret)
         envs.push({ key: 'AUTH_COOKIE_SECRET', value: cookieSecret });
+    // The secret of the organisation's release webhook: minted once, never rotated, a hand-set value kept.
+    const webhookSecret = await ensureGeneratedEnv(deps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, () => randomBytes(32).toString('hex'));
+    if (webhookSecret)
+        envs.push({ key: GITHUB_RELEASE_WEBHOOK_SECRET_ENV, value: webhookSecret });
     const runtimeUrl = await ensureArchonRuntimeUrl(deps.coolify, appId, db.internal_db_url);
     if (runtimeUrl)
         envs.push({ key: 'DATABASE_URL', value: runtimeUrl });
@@ -4494,6 +4535,12 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (effectiveCookieSecret) {
         archonEnvHashOverrides.set('AUTH_COOKIE_SECRET', effectiveCookieSecret);
     }
+    const effectiveWebhookSecret = webhookSecret ??
+        (await currentEnvValue(deps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV));
+    if (effectiveWebhookSecret) {
+        archonEnvHashOverrides.set(GITHUB_RELEASE_WEBHOOK_SECRET_ENV, effectiveWebhookSecret);
+        runtime.onSecret?.(effectiveWebhookSecret);
+    }
     const effectiveRuntimeUrl = runtimeUrl ?? (await currentEnvValue(deps.coolify, appId, 'DATABASE_URL'));
     if (effectiveRuntimeUrl) {
         archonEnvHashOverrides.set('DATABASE_URL', effectiveRuntimeUrl);
@@ -4941,6 +4988,9 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // when no deploy was needed this run, left exactly as it already was --
     // `envsHashChanged` false means it already equals `envsHash`).
     await record(PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, envsHash);
+    if (effectiveWebhookSecret) {
+        await record(PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, createHash('sha256').update(effectiveWebhookSecret).digest('hex'));
+    }
     // Last, after every write the applied values depend on, so a run that failed
     // halfway plans again.
     await record(PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
@@ -5726,6 +5776,26 @@ async function authAppsNotRunning(coolify, recordedIds) {
     }
     return false;
 }
+/**
+ * Archon's live release webhook secret is missing, or is not the one its last deploy recorded
+ * (`PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY`): the release hook step wrote it after Archon's
+ * last deploy, so the running Archon does not have it. A Coolify read error counts as not drifted.
+ */
+async function archonWebhookSecretDrifted(coolify, appId, recorded) {
+    if (!appId)
+        return false;
+    try {
+        const live = await currentEnvValue(coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV);
+        if (!live)
+            return true;
+        return (recorded[PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY] !==
+            createHash('sha256').update(live).digest('hex'));
+    }
+    catch (error) {
+        console.error(`platform:archon: could not read Archon's webhook secret from Coolify (${error instanceof Error ? error.name : 'error'})`);
+        return false;
+    }
+}
 async function archonRollingUpdateDrifted(coolify, appId) {
     if (!appId)
         return false;

package/dist/plan/stage-copy-port.d.ts

@@ -0,0 +1,62 @@
+import type { DatabaseDump } from './database-dump.js';
+import { type StageCopyPort } from './stage-copy.js';
+/** Thrown before anything is run or fetched. Fixed text: never the URL it refused. */
+export declare class StageRestoreRefusedError extends Error {
+    constructor(reason: string);
+}
+/** Thrown when a step of the restore failed. Fixed text only: the cause can echo a connection URL. */
+export declare class StageRestoreError extends Error {
+    constructor(step: string);
+}
+export interface RunResult {
+    exitCode: number;
+    stdout: string;
+}
+/** Runs a program with exactly `env` (nothing inherited) and kills it after `timeoutMs`. */
+export type Runner = (command: string, args: readonly string[], options: {
+    env: Readonly<Record<string, string>>;
+    timeoutMs: number;
+    /** Kills the program when aborted. */
+    signal?: AbortSignal;
+}) => Promise<RunResult>;
+/** The default {@link Runner}: `execFile`, stderr dropped, no shell. */
+export declare const execRunner: Runner;
+export interface StageCopyPortTimeouts {
+    /** Saving the dump from the backup bucket. Default 10 minutes. */
+    fetchMs?: number;
+    /** Reading the dump's table of contents. Default 2 minutes. */
+    listMs?: number;
+    /** `pg_restore`. Default 30 minutes. */
+    restoreMs?: number;
+    /** Creating or syncing the runtime role. Default 2 minutes. */
+    roleMs?: number;
+}
+export interface StageCopyPortDeps {
+    /** Every connection URL production's database answers at. A target on the same host, port and database is refused. */
+    productionUrls: () => Promise<readonly string[]>;
+    /** Saves the dump from the backup bucket to a local file; `remove` deletes it. */
+    fetchDump: (location: DatabaseDump['location'], signal?: AbortSignal) => Promise<{
+        path: string;
+        remove: () => Promise<void>;
+    }>;
+    run?: Runner;
+    /** Default: `@wtfalch/db/runtime-role`'s `ensureRuntimeRole`. */
+    ensureRole?: (options: {
+        ownerUrl: string;
+        runtimeUrl: string;
+        log: () => void;
+    }) => Promise<unknown>;
+    timeouts?: StageCopyPortTimeouts;
+}
+/** The table of contents of a dump without the data of the excluded tables. */
+export declare function filterToc(toc: string, patterns: readonly string[]): {
+    list: string;
+    excluded: number;
+};
+/**
+ * The concrete {@link StageCopyPort}. It restores a dump into a stage database and sets up that database's runtime
+ * role, and refuses any target that is not a stage database or that is production's. Connection settings reach
+ * the programs as `PG*` env, never as arguments. Every outside call has a timeout, and an error carries fixed text
+ * only.
+ */
+export declare function createStageCopyPort(deps: StageCopyPortDeps): StageCopyPort;

package/dist/plan/stage-copy-port.js

@@ -0,0 +1,208 @@
+import { execFile } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ensureRuntimeRole } from '@wtfalch/db/runtime-role';
+import { runtimeDatabaseUrl } from './blue-green-apply.js';
+import { withTimeout } from './call-timeout.js';
+import { tableExcluded } from './stage-copy.js';
+/** Thrown before anything is run or fetched. Fixed text: never the URL it refused. */
+export class StageRestoreRefusedError extends Error {
+    constructor(reason) {
+        super(`stage restore refused: ${reason}`);
+        this.name = 'StageRestoreRefusedError';
+    }
+}
+/** Thrown when a step of the restore failed. Fixed text only: the cause can echo a connection URL. */
+export class StageRestoreError extends Error {
+    constructor(step) {
+        super(`stage restore: ${step} failed`);
+        this.name = 'StageRestoreError';
+    }
+}
+/** The default {@link Runner}: `execFile`, stderr dropped, no shell. */
+export const execRunner = (command, args, { env, timeoutMs, signal }) => new Promise((resolve, reject) => {
+    execFile(command, [...args], {
+        env: { ...env },
+        timeout: timeoutMs,
+        maxBuffer: 64 * 1024 * 1024,
+        encoding: 'utf8',
+        ...(signal ? { signal } : {}),
+    }, (error, stdout) => {
+        if (!error)
+            return resolve({ exitCode: 0, stdout });
+        const code = error.code;
+        if (typeof code === 'number')
+            return resolve({ exitCode: code, stdout });
+        reject(new StageRestoreError('the program'));
+    });
+});
+function parseTarget(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new StageRestoreRefusedError('the database URL is not a URL');
+    }
+    if (parsed.protocol !== 'postgres:' && parsed.protocol !== 'postgresql:') {
+        throw new StageRestoreRefusedError('the database URL is not a postgres URL');
+    }
+    const database = decodeURIComponent(parsed.pathname.replace(/^\//, ''));
+    if (!parsed.hostname || !database) {
+        throw new StageRestoreRefusedError('the database URL names no host or database');
+    }
+    return {
+        host: parsed.hostname.toLowerCase(),
+        port: parsed.port || '5432',
+        user: decodeURIComponent(parsed.username),
+        password: decodeURIComponent(parsed.password),
+        database,
+    };
+}
+const sameDatabase = (a, b) => a.host === b.host && a.port === b.port && a.database === b.database;
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+const STAGE_DATABASE = /_stage_db$/;
+const pgEnv = (t) => ({
+    PATH: process.env.PATH ?? '',
+    PGHOST: t.host,
+    PGPORT: t.port,
+    PGUSER: t.user,
+    PGPASSWORD: t.password,
+    PGDATABASE: t.database,
+});
+/** `4213; 0 16405 TABLE DATA public sessions owner` */
+const TABLE_DATA = /^\d+;\s+\d+\s+\d+\s+TABLE DATA\s+\S+\s+(\S+)\s+\S+\s*$/;
+/** Any table data entry, parsed or not. */
+const TABLE_DATA_ENTRY = /^\d+;.*\bTABLE DATA\b/;
+/** The table of contents of a dump without the data of the excluded tables. */
+export function filterToc(toc, patterns) {
+    let excluded = 0;
+    const kept = toc.split('\n').filter((line) => {
+        const table = TABLE_DATA.exec(line)?.[1];
+        // A name the parser cannot read (quoted, with a space) could be an excluded table: refuse the restore.
+        if ((table === undefined && TABLE_DATA_ENTRY.test(line)) || table?.includes('"')) {
+            throw new StageRestoreRefusedError('the dump list has a table entry that cannot be read');
+        }
+        if (table !== undefined && tableExcluded(table, patterns)) {
+            excluded += 1;
+            return false;
+        }
+        return true;
+    });
+    return { list: kept.join('\n'), excluded };
+}
+/**
+ * The concrete {@link StageCopyPort}. It restores a dump into a stage database and sets up that database's runtime
+ * role, and refuses any target that is not a stage database or that is production's. Connection settings reach
+ * the programs as `PG*` env, never as arguments. Every outside call has a timeout, and an error carries fixed text
+ * only.
+ */
+export function createStageCopyPort(deps) {
+    const run = deps.run ?? execRunner;
+    const t = deps.timeouts ?? {};
+    const fetchMs = t.fetchMs ?? 600_000;
+    const listMs = t.listMs ?? 120_000;
+    const restoreMs = t.restoreMs ?? 1_800_000;
+    const roleMs = t.roleMs ?? 120_000;
+    for (const [name, value] of Object.entries({ fetchMs, listMs, restoreMs, roleMs })) {
+        if (!(value > 0))
+            throw new TypeError(`stage copy port: ${name} must be positive`);
+    }
+    /** Parses the target and refuses it unless it is a stage database that production does not answer at. */
+    async function checkTarget(url, role) {
+        const target = parseTarget(url);
+        if (!IDENTIFIER.test(role))
+            throw new StageRestoreRefusedError('the role name is not valid');
+        if (!STAGE_DATABASE.test(target.database)) {
+            throw new StageRestoreRefusedError('the target is not a stage database');
+        }
+        // The pg client reads host, port and options from the query string: only `sslmode` is allowed.
+        for (const key of new URL(url).searchParams.keys()) {
+            if (key !== 'sslmode') {
+                throw new StageRestoreRefusedError('the database URL has query parameters');
+            }
+        }
+        const production = await withTimeout('stage restore: production URLs', roleMs, deps.productionUrls);
+        if (production.length === 0) {
+            throw new StageRestoreRefusedError('production database is not known');
+        }
+        for (const url of production) {
+            if (sameDatabase(target, parseTarget(url))) {
+                throw new StageRestoreRefusedError('the target is the production database');
+            }
+        }
+        return target;
+    }
+    return {
+        async runRestore({ location, targetDatabaseUrl, ownerRole, excludeTableData, signal }) {
+            const target = await checkTarget(targetDatabaseUrl, ownerRole);
+            if (target.database !== ownerRole) {
+                throw new StageRestoreRefusedError('the owner role is not the stage database owner');
+            }
+            const fetching = deps.fetchDump(location, signal);
+            let dump;
+            try {
+                dump = await withTimeout('stage restore: fetch the dump', fetchMs, () => fetching);
+            }
+            catch (error) {
+                // The fetch may still finish later; its file goes as soon as it does.
+                fetching.then((late) => late.remove().catch(() => undefined), () => undefined);
+                throw error;
+            }
+            let dir;
+            try {
+                const env = pgEnv(target);
+                const toc = await withTimeout('stage restore: list the dump', listMs, () => run('pg_restore', ['--list', dump.path], { env, timeoutMs: listMs, signal }));
+                if (toc.exitCode !== 0)
+                    return { exitCode: toc.exitCode };
+                dir = await mkdtemp(join(tmpdir(), 'stage-restore-'));
+                const listFile = join(dir, 'toc.list');
+                await writeFile(listFile, filterToc(toc.stdout, excludeTableData).list, 'utf8');
+                const restored = await withTimeout('stage restore: pg_restore', restoreMs, () => run('pg_restore', [
+                    '--no-owner',
+                    '--no-privileges',
+                    '--exit-on-error',
+                    `--role=${ownerRole}`,
+                    '--use-list',
+                    listFile,
+                    '--dbname',
+                    target.database,
+                    dump.path,
+                ], { env, timeoutMs: restoreMs, signal }));
+                return { exitCode: restored.exitCode };
+            }
+            catch (error) {
+                if (error instanceof StageRestoreRefusedError)
+                    throw error;
+                console.error(`stage restore: failed (${error instanceof Error ? error.name : 'unknown'})`);
+                throw new StageRestoreError('the restore');
+            }
+            finally {
+                await dump.remove().catch(() => {
+                    console.error('stage restore: removing the dump file failed');
+                });
+                if (dir)
+                    await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+            }
+        },
+        async ensureRuntimeRole({ targetDatabaseUrl, runtimeRole, runtimePassword }) {
+            const target = await checkTarget(targetDatabaseUrl, runtimeRole);
+            const runtimeUrl = runtimeDatabaseUrl(targetDatabaseUrl, runtimeRole, runtimePassword);
+            if (!runtimeUrl)
+                throw new StageRestoreRefusedError('the database URL is not a postgres URL');
+            if (!runtimeRole.endsWith('_rt') || runtimeRole === target.user) {
+                throw new StageRestoreRefusedError('the runtime role is not a separate runtime role');
+            }
+            try {
+                const ensure = deps.ensureRole ?? ((options) => ensureRuntimeRole(options));
+                await withTimeout('stage restore: runtime role', roleMs, () => ensure({ ownerUrl: targetDatabaseUrl, runtimeUrl, log: () => undefined }));
+                return { exitCode: 0 };
+            }
+            catch (error) {
+                console.error(`stage restore: runtime role failed (${error instanceof Error ? error.name : 'unknown'})`);
+                return { exitCode: 1 };
+            }
+        },
+    };
+}

package/dist/plan/stage-copy.d.ts

@@ -0,0 +1,140 @@
+import { type BlueGreenSubject } from './blue-green.js';
+import { type DatabaseDump } from './database-dump.js';
+import type { CoolifyPort } from './executor.js';
+/**
+ * Table names whose rows the exact copy leaves out (SQL structure is still restored). `*` matches any run of
+ * characters. Sessions and tokens are dropped so a copied sign-in or API token is useless on stage; the keystore
+ * and held-key tables hold ciphertext that stage must never be able to open (stage gets no production key).
+ */
+export declare const STAGE_COPY_EXCLUDED_TABLES: readonly string[];
+/** Whether `table` is on {@link STAGE_COPY_EXCLUDED_TABLES}. Case-insensitive, like Postgres folds names. */
+export declare function tableExcluded(table: string, patterns?: readonly string[]): boolean;
+export type StageCopyRefusalReason = 'guards' | 'sink' | 'stage-sink-env' | 'stage-isolation' | 'no-production-database' | 'no-stage-database' | 'no-stage-app' | 'no-coolify-project' | 'no-kept-database';
+/** Thrown before anything is touched. Fixed text and names only. */
+export declare class StageCopyRefusedError extends Error {
+    readonly reason: StageCopyRefusalReason;
+    readonly missing: readonly string[];
+    constructor(reason: StageCopyRefusalReason, missing?: readonly string[]);
+}
+export interface StageCopyStepRecord {
+    step: string;
+    outcome: 'ok' | 'failed';
+    /** Fixed text only. */
+    detail?: string;
+}
+/** What a run did. Fixed text, ids and times only: never a URL, a password or a Coolify message. */
+export interface StageCopyRunRecord {
+    requestedBy: string;
+    at: string;
+    /** The Coolify database stage runs on when the call ended. */
+    liveDatabaseId: string;
+    dumpExecutionId?: string;
+    steps: readonly StageCopyStepRecord[];
+}
+/** Thrown once a run started; carries what happened so far. */
+export declare class StageCopyFailedError extends Error {
+    readonly record: StageCopyRunRecord;
+    constructor(message: string, record: StageCopyRunRecord);
+}
+/** The restore and the runtime role, run by the host (`stage-copy-port.ts` is the concrete one). */
+export interface StageCopyPort {
+    /**
+     * Restores the dump at `location` into `targetDatabaseUrl` and nothing else, leaving out the data of every
+     * table matching `excludeTableData` (see {@link tableExcluded}).
+     */
+    runRestore(input: {
+        location: DatabaseDump['location'];
+        targetDatabaseUrl: string;
+        ownerRole: string;
+        excludeTableData: readonly string[];
+        /** Aborted when the caller gives up: the restore must stop writing and remove the dump file. */
+        signal?: AbortSignal;
+    }): Promise<{
+        exitCode: number;
+    }>;
+    /** Creates or syncs `runtimeRole` with `runtimePassword` on the database `targetDatabaseUrl` names. */
+    ensureRuntimeRole(input: {
+        targetDatabaseUrl: string;
+        runtimeRole: string;
+        runtimePassword: string;
+    }): Promise<{
+        exitCode: number;
+    }>;
+}
+export type StageCopyCoolify = Pick<CoolifyPort, 'listDatabases' | 'getDatabase' | 'createPostgresDatabase' | 'deleteDatabase' | 'getApplication' | 'listEnvs' | 'deleteEnv' | 'deployAndWait' | 'bulkUpsertEnvs' | 'findOrCreateEnvironment' | 'listDatabaseBackups' | 'raw'> & Partial<Pick<CoolifyPort, 'listDatabaseBackupExecutions'>>;
+/** Timeouts of every outside call; a run has no call without one. */
+export interface StageCopyTimeouts {
+    /** One Coolify call. Default 30 s. */
+    callMs?: number;
+    /** The dump of production. Default: `dumpNow`'s (10 minutes). */
+    dumpMs?: number;
+    /**
+     * The whole `runRestore` call: the port's fetch (10 minutes), table list (2) and `pg_restore` (30), plus a
+     * margin. Default 44 minutes.
+     */
+    restoreMs?: number;
+    /** Creating or syncing the runtime role. Default 2 minutes. */
+    roleMs?: number;
+    /** Waiting for a new database to start. Default 3 minutes. */
+    databaseStartMs?: number;
+    /** The stage app's new deployment. Default 16 minutes. */
+    deployMs?: number;
+    /** Waiting for the stage app to be healthy after its deployment, and the poll between reads. Default 2 minutes, 2 s. */
+    appRunningMs?: number;
+    appPollMs?: number;
+}
+/** The production database to dump, resolved by the host (it differs by app). `null`: none is recorded. */
+export interface StageCopyProduction {
+    /** The database's name in the backup keys, e.g. `app.shop`. Goes into dump errors. */
+    databaseKey: string;
+    databaseUuid: string;
+    /** The uuid of the schedule that saves it to the backup bucket. */
+    backupUuid: string;
+    storageUuid: string;
+}
+interface StageCopyBase {
+    subject: Pick<BlueGreenSubject, 'id' | 'base' | 'database'>;
+    recorded: () => Readonly<Record<string, string>>;
+    record: (key: string, value: string) => void;
+    persist: () => Promise<void>;
+    coolify: StageCopyCoolify;
+    /** Registers a value for redaction before it is written anywhere. */
+    secret?: (value: string) => void;
+    /** Who asked: a person or operator id. Goes into the run record. */
+    requestedBy: string;
+    now?: () => number;
+    timeouts?: StageCopyTimeouts;
+}
+export interface StageCopyInput extends StageCopyBase {
+    /** The company whose sink the stage mail env must name. */
+    org: {
+        slug: string;
+    };
+    production: StageCopyProduction | null;
+    restore: StageCopyPort;
+    projectUuid: string | undefined;
+    serverUuid: string | undefined;
+}
+export interface UndoStageCopyInput extends StageCopyBase {
+    restore: Pick<StageCopyPort, 'ensureRuntimeRole'>;
+}
+/**
+ * Copies production's database into stage, exact except for {@link STAGE_COPY_EXCLUDED_TABLES}, on request. It
+ * refuses until the stage guards and the sink are in place, dumps production through Coolify (it never holds a
+ * production URL), restores into a new database beside stage's and points stage at it. Stage's database is
+ * recorded only once stage runs on the new one.
+ *
+ * What a failure leaves behind, by point: refusal or dump failure: nothing changed. New database made, restore
+ * or role failed: the new database is deleted, stage untouched. Switch failed: stage is pointed back at its own
+ * database and the new one deleted; if putting it back also failed the run says so (`recovered: false`) and the
+ * new database is left for the next run's sweep. Recording: the three records are written in memory and
+ * persisted once, so a crash leaves either all or none.
+ */
+export declare function stageCopy(input: StageCopyInput): Promise<StageCopyRunRecord>;
+/**
+ * Puts the database stage ran on before the last copy back, and deletes the one the copy made. It mints a new
+ * runtime password for the kept database (the old one is gone from stage's env). A failure leaves stage on the
+ * database it ran on, switched back the same way a failed copy does, and records nothing.
+ */
+export declare function undoStageCopy(input: UndoStageCopyInput): Promise<StageCopyRunRecord>;
+export {};