@wtfalch/foundry 0.62.0 → 0.64.0

package/dist/plan/index.d.ts

@@ -49,6 +49,8 @@ export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execR
 export type { Runner, StageCopyPortDeps } from './stage-copy-port.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
+export type { PlatformRegistryDeps, PlatformRegistryRuntime } from './platform-registry.js';
+export { PLATFORM_REGISTRY_PULL_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_USER, platformRegistryPushCredential, } from './platform-registry-keys.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';

package/dist/plan/index.js

@@ -30,6 +30,7 @@ export { STAGE_SINK_APPLIED_SCOPE_KEY, STAGE_SINK_IMAGE_REF, STAGE_SINK_SMTP_POR
 export { STAGE_COPY_EXCLUDED_TABLES, StageCopyFailedError, StageCopyRefusedError, stageCopy, tableExcluded, undoStageCopy, } from './stage-copy.js';
 export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execRunner, } from './stage-copy-port.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
+export { PLATFORM_REGISTRY_PULL_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_USER, platformRegistryPushCredential, } from './platform-registry-keys.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';

package/dist/plan/jobs-scheduler-http.d.ts

@@ -26,4 +26,6 @@ export declare class HttpJobsSchedulerClient implements JobsSchedulerPort {
         secret?: string;
         syncKey?: string;
     }>;
+    /** `DELETE /admin/projects/<name>`. A refusal throws with the status only. */
+    deleteProject(name: string): Promise<void>;
 }

package/dist/plan/jobs-scheduler-http.js

@@ -50,4 +50,15 @@ export class HttpJobsSchedulerClient {
             syncKey: typeof fields.syncKey === 'string' ? fields.syncKey : undefined,
         };
     }
+    /** `DELETE /admin/projects/<name>`. A refusal throws with the status only. */
+    async deleteProject(name) {
+        const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(name)}`, {
+            method: 'DELETE',
+            headers: { authorization: `Bearer ${this.adminToken}` },
+            signal: AbortSignal.timeout(ADMIN_CALL_TIMEOUT_MS),
+        });
+        if (response.status === 200 || response.status === 204)
+            return;
+        throw Object.assign(new Error(`jobs scheduler: DELETE /admin/projects/<name> answered ${response.status}`), { status: response.status });
+    }
 }

package/dist/plan/own-limits.d.ts

@@ -173,6 +173,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly platformRegistry: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly platformMail: {
         memory: string;
         dbMemory: string;

package/dist/plan/own-limits.js

@@ -40,6 +40,7 @@ export const LIMITS = {
     platformFiles: profile('1g'),
     platformEdge: profile('512m'),
     platformHc: profile('512m'),
+    platformRegistry: profile('256m'),
     platformMail: profile('1g'),
     platformAuth: profile('1g'),
     platformJobs: profile('1g'),

package/dist/plan/plan-apply.d.ts

@@ -4,7 +4,7 @@ import { type AuditSealingOptions } from '../audit/tick.js';
 import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
-import type { ReleaseStore } from '../release/state.js';
+import { type ReleaseStore } from '../release/state.js';
 import type { JobRunner } from '../runner/types.js';
 import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
@@ -224,11 +224,21 @@ export interface StepExecutor {
     }>>;
     /** Whether the company's stage mail sink app (by Coolify id) is stopped or gone, read live. Optional: an executor without it reads the sink as up. */
     stageSinkDown?(appId: string): Promise<boolean>;
+    /** Which stage-guard ports the host has; they decide the guard names in the applied structure hash. Optional: neither. */
+    stageGuardPorts?(): {
+        probes: boolean;
+        access: boolean;
+    };
     /**
      * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`); `null` while its blue
      * copy is not recorded. Optional: an executor without it runs no release.
      */
     releaseHost?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /**
+     * One release tick for one subject: the recorded stage gate's list follows the people holding `releases:preview`,
+     * owners staying. Never throws. Optional: an executor without it leaves every gate as it is.
+     */
+    syncStageGateMembers?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext): Promise<void>;
     /** Whether the executor's held keys can store a Worker app database's CA and certificate. Absent: true. */
     workerAppDbKeysPuttable?(): boolean;
     /** Whether the host supplies the backup bucket a Worker app database dumps into. Absent: true. */
@@ -305,6 +315,8 @@ export interface PlatformDriftedSteps {
     authApps?: boolean;
     /** The host sets it. */
     edge?: boolean;
+    /** A usable, reachable Coolify server has no registry login for the current host and passwords. */
+    registryLogins?: boolean;
     /** #380 */
     files?: boolean;
     backupStorage?: boolean;
@@ -340,6 +352,8 @@ export interface PlatformStepExecutor {
         backupExecutorMissing?: boolean;
         /** #540: see `PlanPlatformOptions.blocked.hc` (`platform-diff.ts`). */
         hc?: string;
+        /** See `PlanPlatformOptions.blocked.registry` (`platform-diff.ts`). */
+        registry?: string;
         /** #540: see `PlanPlatformOptions.blocked.heartbeatsExecutorMissing` (`platform-diff.ts`). */
         heartbeatsExecutorMissing?: boolean;
         /** foundry#542: see `PlanPlatformOptions.blocked.uptime` (`platform-diff.ts`). */
@@ -373,8 +387,12 @@ export interface PlatformStepExecutor {
         servers?: BlueGreenServer[];
         blocked?: string;
     }>;
+    /** The stage guards platform-archon can make now, by name; they go into its applied structure hash. */
+    archonStageGuardNames?(platform: DeclaredPlatform, recorded: Readonly<Record<string, string>>, owner: PlatformOwnerInput): string[];
     /** The release runner's outside calls for platform-archon (`plan/release-host.ts`); `null` while its app is not recorded. */
     releaseHost?(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /** As {@link FoundryStepExecutor.syncStageGateMembers}, for platform-archon's own stage gate (orgId `platform`). */
+    syncStageGateMembers?(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext): Promise<void>;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -633,6 +651,14 @@ export interface FoundryPlanApplyOptions {
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
     leaseTtlMs?: number;
+    /**
+     * A stage copy runs without the org's lease and takes it for a moment each time it records something. When an
+     * apply or a tick holds the lease it waits `waitMs` and tries again, up to `tries` times. Defaults to 30 s and 10.
+     */
+    copyLeaseRetry?: {
+        tries: number;
+        waitMs: number;
+    };
     /**
      * #441 (part b): a durable, DB-row-backed record of `apply`, `destroy`,
      * `adopt` and `release` for one org, held under the same mutation lease
@@ -730,6 +756,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly onlySteps;
     private readonly now;
     private readonly leaseTtlMs;
+    private readonly copyLeaseRetry;
     private readonly appliedVersions;
     private readonly backupGate;
     private readonly platformDeps;
@@ -900,6 +927,25 @@ export declare class FoundryPlanApply implements PlanApply {
         target: string;
         error?: string;
     }>>;
+    /**
+     * Phase 2 for one org: takes the copy lock of each stage copy request under the org's lease, then runs the
+     * copies after the lease is released. While a copy runs, every other tick and apply for the org goes on, a
+     * hard-fail rollback included; the copy records through short leases ({@link copyContext}).
+     */
+    private runOrgStageCopies;
+    /** Phase 2 for platform-archon; see {@link runOrgStageCopies}. */
+    private runPlatformStageCopies;
+    /**
+     * Runs one claimed copy with no lease held, then records its outcome and consumes the request. A lost lock
+     * throws (`StaleLeaseError`) and leaves the request open.
+     */
+    private runClaimedCopy;
+    /**
+     * The recorded ids a copy reads and writes, without the org's lease. It reads a snapshot taken when the lock was
+     * claimed; each `persist` takes the lease for a moment, re-reads the stored ids and writes only the keys the
+     * copy changed, so a tick that ran in between loses nothing. The lease may be busy: it waits and tries again.
+     */
+    private copyContext;
     /**
      * The recurring audit sealing run (foundry#929): seals every ledger registered by an `audit:ledger` step with the
      * platform signer and has the timestamp authority stamp the new checkpoints. Foundry has no scheduler, so the host
@@ -907,6 +953,10 @@ export declare class FoundryPlanApply implements PlanApply {
      * log line say what happened and why when nothing did. It writes nothing to the org's records.
      */
     runAuditSealTick(): Promise<SealResult[]>;
+    /**
+     * One org's release run. `defer`: stage copy requests stay open and `deferred` says whether there were any.
+     * `claim`: the copies this run decided on, each with its lock taken, for {@link runClaimedCopy}.
+     */
     private runOrgReleaseTick;
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     private readSfuPortsOpen;