@wtfalch/foundry 0.2.0 → 0.4.0

package/dist/store/audit.js

@@ -0,0 +1,43 @@
+import { foundryAuditEvents } from './schema.js';
+/**
+ * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
+ * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
+ * attached archon reads the same table. It only inserts.
+ */
+export function createPostgresAuditLog(db) {
+    return {
+        async recordPlan({ actor, orgId, plan, at }) {
+            await db.insert(foundryAuditEvents).values({
+                at,
+                kind: 'plan',
+                actorId: actor.id,
+                actorDisplay: actor.display,
+                orgId,
+                plan,
+            });
+        },
+        async recordApply({ actor, orgId, plan, outcome, reason, at }) {
+            await db.insert(foundryAuditEvents).values({
+                at,
+                kind: 'apply',
+                actorId: actor.id,
+                actorDisplay: actor.display,
+                orgId,
+                outcome,
+                reason: reason ?? null,
+                plan,
+            });
+        },
+        async recordDestroy({ actor, orgId, outcome, reason, at }) {
+            await db.insert(foundryAuditEvents).values({
+                at,
+                kind: 'destroy',
+                actorId: actor.id,
+                actorDisplay: actor.display,
+                orgId,
+                outcome,
+                reason: reason ?? null,
+            });
+        },
+    };
+}

package/dist/store/postgres.d.ts

@@ -14,7 +14,10 @@ export type FoundryStoreDb = PgDatabase<PgQueryResultHKT, any, any>;
  * environment-suffix shape), a slug already taken by another org (#28:
  * checked by the unique index `0004_slug_unique.sql` adds, whether caught
  * ahead of time by a pre-check or by a race this store maps back to the
- * same error) or — the one impossible combination #18 implements — a slug
+ * same error), a domain that fails `../org.js`'s `validateDomain` or is
+ * already taken by another org (#131, the same shape as the slug: format
+ * checked ahead of time, uniqueness checked by `0015_domain_unique.sql`'s
+ * index) or — the one impossible combination #18 implements — a slug
  * change once the org has mail. `store.ts`'s `update` doc requires a caller
  * to be "ready for this to throw rather than silently drop a field"; this
  * is that throw.
@@ -36,10 +39,12 @@ export declare class DeclaredOrgError extends Error {
  * (or `null` for uncapped), checked the same way on both `create` and the
  * merged result of `update`. #67 adds a fourth (`org.ts`'s
  * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
- * checked the same way. The broader "combinations foundry knows are
- * impossible are rejected with a reason" line needs a ruleset (domain
- * requirements per service, `adoptedApp.form`, mail-level transitions…)
- * that later tickets, not #18, #27 or #28, decide; `update` still merges and
- * stores any other patch as given.
+ * checked the same way. #131 adds a sixth, in the same shape as the slug: the
+ * domain, when set, is a validated (`org.ts`'s `validateDomain`), globally
+ * unique DNS name, checked on both `create` and `update`. The broader
+ * "combinations foundry knows are impossible are rejected with a reason"
+ * line needs a ruleset (domain requirements per service, `adoptedApp.form`,
+ * mail-level transitions…) that later tickets, not #18, #27, #28 or #131,
+ * decide; `update` still merges and stores any other patch as given.
  */
 export declare function createPostgresDeclaredOrgStore(db: FoundryStoreDb): DeclaredOrgStore;

package/dist/store/postgres.js

@@ -1,25 +1,34 @@
 import { eq, sql } from 'drizzle-orm';
-import { validateBuyerIdentity, validateHosting, validateOwner } from '../org.js';
+import { validateBuyerIdentity, validateDomain, validateHosting, validateOwner, validateSite, } from '../org.js';
 import { validateSlug } from '../slug.js';
 import { declaredOrgs, foundryAppliedState, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
+/** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
+const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
+const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
 /** #27: a bigint-safe decimal string of a non-negative integer -- no sign, no decimal point, no leading zeros (so "010" never diffs against a live "10"). */
 const NON_NEGATIVE_INTEGER = /^(0|[1-9]\d*)$/;
 /**
- * True for a Postgres unique-violation, however the driver hands it back --
- * directly (PGlite in this package's own tests) or wrapped in drizzle-orm's
- * own `DrizzleQueryError`, whose `cause` carries the raw driver error
- * (postgres-js in a host). Checked by Postgres error code, never by message
- * text, since message text is not a contract. Same pattern as
+ * The Postgres unique-violation constraint name, however the driver hands the
+ * error back -- directly (PGlite in this package's own tests) or wrapped in
+ * drizzle-orm's own `DrizzleQueryError`, whose `cause` carries the raw driver
+ * error (postgres-js in a host) -- or `undefined` when this is not a unique
+ * violation. Checked by Postgres error code, never by message text, since
+ * message text is not a contract. Same code-check pattern as
  * `../runner/runner.ts`'s own `isUniqueViolation` -- kept as a local copy
- * here rather than shared, since neither module depends on the other.
+ * here rather than shared, since neither module depends on the other; this
+ * one additionally reads `constraint` so `create`/`update` can tell a slug
+ * collision from a domain collision (#131) rather than reporting both the
+ * same way.
  */
-function isUniqueViolation(error) {
-    const code = error?.code;
-    if (code === UNIQUE_VIOLATION)
-        return true;
+function uniqueViolationConstraint(error) {
+    const direct = error;
+    if (direct?.code === UNIQUE_VIOLATION)
+        return direct.constraint;
     const cause = error?.cause;
-    return cause?.code === UNIQUE_VIOLATION;
+    if (cause?.code === UNIQUE_VIOLATION)
+        return cause.constraint;
+    return undefined;
 }
 /**
  * Thrown by `create` and `update` when the store refuses a write: an id
@@ -28,7 +37,10 @@ function isUniqueViolation(error) {
  * environment-suffix shape), a slug already taken by another org (#28:
  * checked by the unique index `0004_slug_unique.sql` adds, whether caught
  * ahead of time by a pre-check or by a race this store maps back to the
- * same error) or — the one impossible combination #18 implements — a slug
+ * same error), a domain that fails `../org.js`'s `validateDomain` or is
+ * already taken by another org (#131, the same shape as the slug: format
+ * checked ahead of time, uniqueness checked by `0015_domain_unique.sql`'s
+ * index) or — the one impossible combination #18 implements — a slug
  * change once the org has mail. `store.ts`'s `update` doc requires a caller
  * to be "ready for this to throw rather than silently drop a field"; this
  * is that throw.
@@ -47,7 +59,7 @@ function rowToOrg(row) {
         domain: row.domain,
         mail: { mode: row.mailMode, usesDomain: row.mailUsesDomain },
         chat: { usesDomain: row.chatUsesDomain },
-        calls: { usesDomain: row.callsUsesDomain },
+        calls: { enabled: row.callsEnabled, usesDomain: row.callsUsesDomain },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
@@ -58,6 +70,7 @@ function rowToOrg(row) {
             gitBranch: row.hostingGitBranch,
             buildPack: row.hostingBuildPack,
             issuerApps: row.hostingIssuerApps,
+            accessEmails: row.hostingAccessEmails,
         },
         sso: { enabled: row.ssoEnabled },
         guests: { enabled: row.guestsEnabled },
@@ -82,6 +95,7 @@ function orgToRow(org) {
         mailMode: org.mail.mode,
         mailUsesDomain: org.mail.usesDomain,
         chatUsesDomain: org.chat.usesDomain,
+        callsEnabled: org.calls.enabled,
         callsUsesDomain: org.calls.usesDomain,
         issuerUsesDomain: org.issuer.usesDomain,
         siteEnabled: org.site.enabled,
@@ -93,6 +107,7 @@ function orgToRow(org) {
         hostingGitBranch: org.hosting.gitBranch,
         hostingBuildPack: org.hosting.buildPack,
         hostingIssuerApps: org.hosting.issuerApps,
+        hostingAccessEmails: org.hosting.accessEmails,
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,
@@ -164,11 +179,13 @@ function rowToOwner(row) {
  * (or `null` for uncapped), checked the same way on both `create` and the
  * merged result of `update`. #67 adds a fourth (`org.ts`'s
  * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
- * checked the same way. The broader "combinations foundry knows are
- * impossible are rejected with a reason" line needs a ruleset (domain
- * requirements per service, `adoptedApp.form`, mail-level transitions…)
- * that later tickets, not #18, #27 or #28, decide; `update` still merges and
- * stores any other patch as given.
+ * checked the same way. #131 adds a sixth, in the same shape as the slug: the
+ * domain, when set, is a validated (`org.ts`'s `validateDomain`), globally
+ * unique DNS name, checked on both `create` and `update`. The broader
+ * "combinations foundry knows are impossible are rejected with a reason"
+ * line needs a ruleset (domain requirements per service, `adoptedApp.form`,
+ * mail-level transitions…) that later tickets, not #18, #27, #28 or #131,
+ * decide; `update` still merges and stores any other patch as given.
  */
 export function createPostgresDeclaredOrgStore(db) {
     async function requireRow(id) {
@@ -182,6 +199,18 @@ export function createPostgresDeclaredOrgStore(db) {
         if (rejection)
             throw new DeclaredOrgError(rejection.message);
     }
+    // #131: same place `requireValidSlug` checks the slug's format (#28) --
+    // `domain` is nullable (a brand new org has none), so this is only called
+    // once it is set. Uniqueness itself is not pre-checked here, the same
+    // choice `requireValidSlug` makes for the slug: the unique index
+    // `0015_domain_unique.sql` adds is the source of truth, caught below.
+    function requireValidDomain(domain) {
+        if (domain === null)
+            return;
+        const reason = validateDomain(domain);
+        if (reason)
+            throw new DeclaredOrgError(`domain invalid: ${reason} (#131)`);
+    }
     function requireValidLimit(fieldName, value) {
         if (value !== null && !NON_NEGATIVE_INTEGER.test(value)) {
             throw new DeclaredOrgError(`${fieldName} '${value}' must be a bigint-safe decimal string of a non-negative integer, or null for uncapped (#27)`);
@@ -211,6 +240,13 @@ export function createPostgresDeclaredOrgStore(db) {
         if (reason)
             throw new DeclaredOrgError(`hosting invalid: ${reason} (#71)`);
     }
+    // #101: same place `requireValidHosting` checks hosting, on both `create`
+    // and the merged result of `update`.
+    function requireValidSite(org) {
+        const reason = validateSite(org);
+        if (reason)
+            throw new DeclaredOrgError(`site invalid: ${reason} (#101)`);
+    }
     // Same place `requireValidHosting` checks hosting, on both `create` and
     // the merged result of `update`.
     function requireValidOwner(org) {
@@ -221,21 +257,29 @@ export function createPostgresDeclaredOrgStore(db) {
     return {
         async create(org) {
             requireValidSlug(org.slug);
+            requireValidDomain(org.domain);
             requireValidLimits(org);
             requireValidBuyer(org);
             requireValidHosting(org);
+            requireValidSite(org);
             requireValidOwner(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
             catch (error) {
-                // The pre-check above already refuses a slug this process knows is
-                // taken (nothing does, on a fresh insert) -- this catches the race
-                // the pre-check cannot: two concurrent creates for the same slug,
-                // caught by `0004_slug_unique.sql`'s unique index and reported
-                // through the same error a pre-check would have thrown (#28).
-                if (isUniqueViolation(error))
+                // The pre-checks above already refuse a slug or domain this process
+                // knows is taken (nothing does, on a fresh insert) -- this catches
+                // the race they cannot: two concurrent creates for the same slug or
+                // domain, caught by `0004_slug_unique.sql`/`0015_domain_unique.sql`'s
+                // unique indexes and reported through the same error a pre-check
+                // would have thrown (#28, #131).
+                const constraint = uniqueViolationConstraint(error);
+                if (constraint === DOMAIN_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`domain '${org.domain}' is already taken by another org (#131)`);
+                }
+                if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${org.slug}' is already taken by another org`);
+                }
                 throw error;
             }
         },
@@ -243,6 +287,31 @@ export function createPostgresDeclaredOrgStore(db) {
             const [row] = await db.select().from(declaredOrgs).where(eq(declaredOrgs.id, id)).limit(1);
             return row ? rowToOrg(row) : null;
         },
+        async slugTaken(slug) {
+            const [row] = await db
+                .select({ id: declaredOrgs.id })
+                .from(declaredOrgs)
+                .where(eq(declaredOrgs.slug, slug))
+                .limit(1);
+            return row !== undefined;
+        },
+        // #131: a plain scan, not an indexed lookup -- `serviceIds` is jsonb
+        // keyed by resource, not by provider id, and foundry's own org count is
+        // small enough that this never needs to be more than that (same
+        // reasoning `getAppliedState`/`putAppliedState` already lean on: one row
+        // per org).
+        async findOrgIdForZone(zoneId) {
+            const rows = await db
+                .select({ orgId: foundryAppliedState.orgId, serviceIds: foundryAppliedState.serviceIds })
+                .from(foundryAppliedState);
+            for (const row of rows) {
+                for (const [key, id] of Object.entries(row.serviceIds)) {
+                    if (id === zoneId && key.startsWith('cloudflare:zone:'))
+                        return row.orgId;
+                }
+            }
+            return null;
+        },
         async update(id, patch) {
             const current = rowToOrg(await requireRow(id));
             // The slug freeze (#7 corrections 3): once mail exists, the mail
@@ -261,9 +330,11 @@ export function createPostgresDeclaredOrgStore(db) {
             if (patch.slug !== undefined && patch.slug !== current.slug)
                 requireValidSlug(patch.slug);
             const next = { ...current, ...patch, id: current.id };
+            requireValidDomain(next.domain);
             requireValidLimits(next);
             requireValidBuyer(next);
             requireValidHosting(next);
+            requireValidSite(next);
             requireValidOwner(next);
             try {
                 await db
@@ -273,9 +344,15 @@ export function createPostgresDeclaredOrgStore(db) {
             }
             catch (error) {
                 // Same race as `create`: another org's concurrent write took this
-                // slug between the pre-check above and this statement (#28).
-                if (isUniqueViolation(error))
+                // slug or domain between the pre-check above and this statement
+                // (#28, #131).
+                const constraint = uniqueViolationConstraint(error);
+                if (constraint === DOMAIN_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`domain '${next.domain}' is already taken by another org (#131)`);
+                }
+                if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${next.slug}' is already taken by another org`);
+                }
                 throw error;
             }
             return next;

package/dist/store/schema.d.ts

@@ -1,4 +1,5 @@
 import type { IssuerApp } from '../org.js';
+import type { Plan } from '../plan.js';
 import type { Checkpoint } from '../state.js';
 /**
  * Mirrors `migrations/0001_declared_org.sql`, which is the source of truth:
@@ -129,6 +130,23 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        callsEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "calls_enabled";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         callsUsesDomain: import("drizzle-orm/pg-core").PgColumn<{
             name: "calls_uses_domain";
             tableName: "foundry_declared_orgs";
@@ -318,6 +336,25 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             $type: IssuerApp[];
         }>;
+        hostingAccessEmails: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hosting_access_emails";
+            tableName: "foundry_declared_orgs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
         ssoEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sso_enabled";
             tableName: "foundry_declared_orgs";
@@ -799,7 +836,175 @@ export declare const foundryAppliedState: import("drizzle-orm/pg-core").PgTableW
     };
     dialect: "pg";
 }>;
+/** Mirrors `migrations/0012_audit.sql`, the source of truth (#85). */
+export declare const foundryAuditEvents: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "foundry_audit_events";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "foundry_audit_events";
+            dataType: "number";
+            columnType: "PgBigSerial53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "at";
+            tableName: "foundry_audit_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "foundry_audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: "plan" | "apply" | "destroy";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "plan" | "apply" | "destroy";
+        }>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "foundry_audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorDisplay: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_display";
+            tableName: "foundry_audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        orgId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "org_id";
+            tableName: "foundry_audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        outcome: import("drizzle-orm/pg-core").PgColumn<{
+            name: "outcome";
+            tableName: "foundry_audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: "applied" | "refused" | "failed" | "destroyed";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "applied" | "refused" | "failed" | "destroyed";
+        }>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "foundry_audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        plan: import("drizzle-orm/pg-core").PgColumn<{
+            name: "plan";
+            tableName: "foundry_audit_events";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Plan;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Plan;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export type DeclaredOrgRow = typeof declaredOrgs.$inferSelect;
 export type NewDeclaredOrgRow = typeof declaredOrgs.$inferInsert;
 export type AppliedStateRow = typeof foundryAppliedState.$inferSelect;
 export type NewAppliedStateRow = typeof foundryAppliedState.$inferInsert;
+export type AuditEventRow = typeof foundryAuditEvents.$inferSelect;

package/dist/store/schema.js

@@ -1,4 +1,4 @@
-import { boolean, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
+import { bigserial, boolean, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
 /**
  * Mirrors `migrations/0001_declared_org.sql`, which is the source of truth:
  * the SQL carries the CHECKs drizzle-kit does not generate here (this
@@ -13,6 +13,7 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     mailMode: text('mail_mode').notNull().default('off'),
     mailUsesDomain: boolean('mail_uses_domain').notNull().default(false),
     chatUsesDomain: boolean('chat_uses_domain').notNull().default(false),
+    callsEnabled: boolean('calls_enabled').notNull().default(false),
     callsUsesDomain: boolean('calls_uses_domain').notNull().default(false),
     issuerUsesDomain: boolean('issuer_uses_domain').notNull().default(false),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.
@@ -26,6 +27,7 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     hostingGitBranch: text('hosting_git_branch').notNull().default('main'),
     hostingBuildPack: text('hosting_build_pack').notNull().default('nixpacks'),
     hostingIssuerApps: jsonb('hosting_issuer_apps').notNull().default([]).$type(),
+    hostingAccessEmails: jsonb('hosting_access_emails').notNull().default([]).$type(),
     ssoEnabled: boolean('sso_enabled').notNull().default(false),
     guestsEnabled: boolean('guests_enabled').notNull().default(false),
     soloEnabled: boolean('solo_enabled').notNull().default(false),
@@ -75,3 +77,15 @@ export const foundryAppliedState = pgTable('foundry_applied_state', {
     lastAppliedAt: timestamp('last_applied_at', { withTimezone: true }),
     lastAppliedDeclaredOrgVersion: text('last_applied_declared_org_version'),
 });
+/** Mirrors `migrations/0012_audit.sql`, the source of truth (#85). */
+export const foundryAuditEvents = pgTable('foundry_audit_events', {
+    id: bigserial('id', { mode: 'number' }).primaryKey(),
+    at: timestamp('at', { withTimezone: true }).notNull(),
+    kind: text('kind').notNull().$type(),
+    actorId: text('actor_id').notNull(),
+    actorDisplay: text('actor_display').notNull(),
+    orgId: text('org_id').notNull(),
+    outcome: text('outcome').$type(),
+    reason: text('reason'),
+    plan: jsonb('plan').$type(),
+});

package/dist/store.d.ts

@@ -12,6 +12,18 @@ import type { AppliedState } from './state.js';
 export interface DeclaredOrgStore {
     create(org: DeclaredOrg): Promise<void>;
     get(id: OrgId): Promise<DeclaredOrg | null>;
+    /** Whether any org already holds this slug. `slugFromName` asks it. */
+    slugTaken(slug: string): Promise<boolean>;
+    /**
+     * The org id, if any, whose applied state already records `zoneId` under a
+     * `cloudflare:zone:*` key (#131). `plan/executor.ts`'s `cloudflareZone`
+     * asks this before adopting a zone `findZoneByApex` finds, the same
+     * foreign-resource refusal `cloudflareAccess` makes by reading Cloudflare's
+     * own Access-app name -- a Cloudflare zone carries no org-identifying
+     * field of its own for that live check, so this asks the store's own
+     * record instead.
+     */
+    findOrgIdForZone(zoneId: string): Promise<OrgId | null>;
     /**
      * Combinations foundry knows are impossible are rejected with a reason
      * (#18 "Done when"), so a caller must be ready for this to throw rather

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -28,13 +28,19 @@
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && mkdir -p dist/migrations && find src/migrations -maxdepth 1 -name '*.sql' -exec cp {} dist/migrations/ \\;",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "db:provision": "node scripts/foundry-db-provision.mjs",
+    "db:migrate": "node scripts/foundry-db-migrate.mjs",
+    "calls-sfu:deploy": "node scripts/calls-sfu-deploy.mjs"
   },
   "peerDependencies": {
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
-    "@wtfalch/providers": "0.5.0"
+    "@wtfalch/auth": "0.16.0",
+    "@wtfalch/email": "0.15.0",
+    "@wtfalch/providers": "0.6.0",
+    "ssh2": "1.17.0"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.8",