@wtfalch/foundry 0.23.0 → 0.25.0

package/dist/plan/uptime-worker.js

@@ -0,0 +1,229 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { EdgeApiError } from '@wtfalch/edge';
+import { uptimeArtifactUrl } from '../platform.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
+/** The Worker's cron trigger, from Archon's `workers/uptime/manifest.json`. */
+const UPTIME_CRONS = ['* * * * *'];
+/** The date Archon's own Worker config used. */
+const UPTIME_COMPATIBILITY_DATE = '2026-09-27';
+/** How many times a delivery or a secrets write is tried before the step fails. */
+const UPTIME_ATTEMPTS = 3;
+/** The optional plain text variables the Worker reads, supplied by the host (not secrets). */
+export const UPTIME_OPTIONAL_VARS = [
+    'CHAT_HOMESERVER_URL',
+    'CHAT_ROOM_ID',
+    'ALERT_EMAIL_FROM',
+    'ALERT_EMAIL_TO',
+];
+/**
+ * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping
+ * URL that works as a capability, so a secret too), name to value. Callers
+ * that report or record take the names only.
+ */
+export async function heldUptimeValues(deps) {
+    const refs = {
+        ...PLATFORM_UPTIME_OPTIONAL_SECRETS,
+        UPTIME_HEARTBEAT_URL: PLATFORM_UPTIME_HEARTBEAT_URL_REF,
+    };
+    const held = {};
+    for (const [name, ref] of Object.entries(refs)) {
+        const value = await deps.heldKeys.resolve(ref);
+        if (value)
+            held[name] = value;
+    }
+    return held;
+}
+/** Retries `task`; the cause is dropped in case it echoes a secret, and the error names `what` only. */
+async function attempt(what, task) {
+    for (let n = 1; n <= UPTIME_ATTEMPTS; n++) {
+        try {
+            await task();
+            return;
+        }
+        catch {
+            // Retried; the error is dropped.
+        }
+    }
+    throw new Error(`platform:uptime: ${what} failed after ${UPTIME_ATTEMPTS} attempts`);
+}
+/** Removes an Access token edge made; one already gone is success. */
+async function removeAccessToken(access, id, what) {
+    try {
+        await access.removeServiceToken(id);
+    }
+    catch (error) {
+        if (error instanceof EdgeApiError && error.code === 'not_found')
+            return;
+        // The cause is dropped; edge's text is not ours to pass on.
+        throw new Error(`platform:uptime: ${what} ${id} could not be removed through edge`);
+    }
+}
+/**
+ * foundry#542: makes the uptime Worker true, in an order where every failure
+ * is repaired by the next apply and none needs a hand edit. Upload the pinned
+ * Archon release (the host fetches and verifies it) and record the script at
+ * once, so a later failure is a half-made Worker foundry owns. Then hold the
+ * Worker token and the Access pair (minted once each, each guard recorded as
+ * soon as its value is held), set every held secret on the Worker, and last
+ * the cron trigger, so the Worker never runs a round without its token. The
+ * applied values are recorded only when all of it succeeded.
+ */
+export async function provisionPlatformUptime(context, deps) {
+    const { platform } = context;
+    const { uptime } = platform;
+    const recorded = context.recordedIds();
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`platform:uptime: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); the Worker is managed through it`);
+    }
+    const workers = await deps.workers(edgeUrl);
+    if (!uptime.enabled) {
+        // Whatever of a (possibly half-made) deploy exists is removed; what does not exist is tolerated.
+        await workers.deleteScript(PLATFORM_UPTIME_SCRIPT_NAME);
+        const accessTokenId = recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY] ||
+            recorded[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY];
+        if (accessTokenId) {
+            await removeAccessToken(await deps.access(edgeUrl), accessTokenId, 'Access token');
+        }
+        for (const ref of [
+            PLATFORM_UPTIME_TOKEN_REF,
+            PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF,
+            PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF,
+        ]) {
+            await attempt('clearing a held uptime value', () => deps.deliverSecret(ref, ''));
+        }
+        for (const key of [
+            PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY,
+            PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY,
+            PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY,
+            PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY,
+        ]) {
+            context.recordScopeId(key, '');
+        }
+        context.recordScopeId(PLATFORM_UPTIME_REMOVED_SCOPE_KEY, '1');
+        return {};
+    }
+    if (!uptime.tag || !uptime.sha256) {
+        throw new Error('platform:uptime: no artifact is pinned (uptime.tag, uptime.sha256)');
+    }
+    const hostname = platform.archon.hostname;
+    const held = await heldUptimeValues(deps);
+    const bindings = [
+        { type: 'kv_namespace', name: 'UPTIME_KV', title: PLATFORM_UPTIME_KV_TITLE },
+        { type: 'plain_text', name: 'ARCHON_BASE_URL', text: `https://${hostname}` },
+        ...UPTIME_OPTIONAL_VARS.flatMap((name) => {
+            const text = deps.vars?.[name];
+            return text ? [{ type: 'plain_text', name, text }] : [];
+        }),
+    ];
+    await workers.uploadScript({
+        name: PLATFORM_UPTIME_SCRIPT_NAME,
+        artifactUrl: uptimeArtifactUrl(uptime.tag),
+        artifactSha256: uptime.sha256,
+        compatibilityDate: UPTIME_COMPATIBILITY_DATE,
+        bindings,
+    });
+    // The script is foundry's from here on. Recorded now, not at the end: after
+    // a later failure the next plan must repair this Worker, not take it for a
+    // foreign one. "Fully applied" is the applied values recorded at the end.
+    context.recordScopeId(`cloudflare:worker:${PLATFORM_UPTIME_KEY}`, PLATFORM_UPTIME_SCRIPT_NAME);
+    context.recordScopeId(PLATFORM_UPTIME_REMOVED_SCOPE_KEY, '');
+    await context.persist?.();
+    // The Worker token. It is generated here and registered nowhere else until
+    // it is held (the Worker and Archon get it from the held value, later), so a
+    // marker without its guard means the value never left this process, and a
+    // guard with nothing held means it is gone: either way a new one is
+    // generated and the old id is dropped. Nothing is blocked and nothing needs
+    // a hand edit.
+    let tokenId = recorded[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY];
+    let token = tokenId ? await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF) : null;
+    if (!token) {
+        const newId = randomUUID();
+        const minted = randomBytes(32).toString('hex');
+        context.recordScopeId(PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, newId);
+        await context.persist?.();
+        await attempt(`holding token ${newId}`, () => deps.deliverSecret(PLATFORM_UPTIME_TOKEN_REF, minted));
+        // Guard as soon as the value is held.
+        context.recordScopeId(PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, newId);
+        context.recordScopeId(PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, '');
+        await context.persist?.();
+        tokenId = newId;
+        token = minted;
+    }
+    // The Access service token pair, minted through edge. The id is recorded
+    // and persisted before the pair is held, the guard once both are held. A
+    // pair that may be lost (marker without guard, or guard with nothing held)
+    // is repaired here: edge made that token, so it is removed through edge and
+    // minted again, never two live tokens. A token of the name with no id
+    // recorded is not ours to remove: edge answers `conflict` and the planner
+    // reports it as blocked; the throw here is only a race with that report.
+    let accessId = recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY];
+    let clientId = accessId
+        ? await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF)
+        : null;
+    let clientSecret = accessId
+        ? await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF)
+        : null;
+    if (!accessId || !clientId || !clientSecret) {
+        const access = await deps.access(edgeUrl);
+        const lost = accessId || recorded[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY];
+        if (lost) {
+            await removeAccessToken(access, lost, 'lost Access token');
+            context.recordScopeId(PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, '');
+            context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, '');
+            await context.persist?.();
+        }
+        let minted;
+        try {
+            minted = await access.createServiceToken(PLATFORM_UPTIME_ACCESS_TOKEN_NAME);
+        }
+        catch (error) {
+            if (error instanceof EdgeApiError && error.code === 'conflict') {
+                throw new Error(`platform:uptime: ${uptimeAccessTokenConflict()}`);
+            }
+            throw error;
+        }
+        context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, minted.id);
+        await context.persist?.();
+        if (!minted.clientId || !minted.clientSecret) {
+            await removeAccessToken(access, minted.id, 'incomplete Access token');
+            context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, '');
+            await context.persist?.();
+            throw new Error(`platform:uptime: edge returned Access token ${minted.id} without a client id or secret; it was removed`);
+        }
+        const newId = minted.id;
+        const idToHold = minted.clientId;
+        const secretToHold = minted.clientSecret;
+        await attempt(`holding Access token ${newId} client id`, () => deps.deliverSecret(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, idToHold));
+        await attempt(`holding Access token ${newId} client secret`, () => deps.deliverSecret(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, secretToHold));
+        context.recordScopeId(PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, newId);
+        context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, '');
+        await context.persist?.();
+        accessId = newId;
+        clientId = idToHold;
+        clientSecret = secretToHold;
+    }
+    // Set on the Worker from the held values, every time this step runs. The
+    // held secrets' version label is the pinned digest, so a new release sets
+    // them again. The held-key reader exposes no per-value id or update time,
+    // so a value rotated at the same pin is not seen; the minted ones carry
+    // their id.
+    const version = `pin-${uptime.sha256.slice(0, 12)}`;
+    const secrets = [
+        { name: 'UPTIME_TOKEN', value: token, version: tokenId },
+        { name: 'CF_ACCESS_CLIENT_ID', value: clientId, version: accessId },
+        { name: 'CF_ACCESS_CLIENT_SECRET', value: clientSecret, version: accessId },
+        // A ping URL works as a capability: a secret, not a plain text binding.
+        ...Object.entries(held).map(([name, value]) => ({ name, value, version })),
+    ];
+    await attempt(`setting the Worker's secrets (${secrets.map((s) => s.name).join(', ')})`, () => workers.setSecrets(PLATFORM_UPTIME_SCRIPT_NAME, secrets));
+    // After the secrets: the Worker never runs a round without its token.
+    await workers.setSchedules(PLATFORM_UPTIME_SCRIPT_NAME, UPTIME_CRONS);
+    // Last, after every write the applied values depend on.
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, uptime.tag);
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, uptime.sha256);
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, uptimeVarsDigest(deps.vars));
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, uptimeSecretNames(Object.keys(held)));
+    return { resourceId: PLATFORM_UPTIME_SCRIPT_NAME };
+}

package/dist/platform.d.ts

@@ -24,6 +24,22 @@ export interface PlatformService {
 export interface PlatformMailService extends PlatformService {
     lettermintProjectId?: string | null;
 }
+/**
+ * The uptime Worker (foundry#542): the outside prober Archon publishes as a
+ * built script with each `v*` release. Foundry deploys the pinned release and
+ * never builds it. `tag` and `sha256` are the pin; both empty means nothing is
+ * pinned yet, and the planner reports that instead of planning the step.
+ * It has no hostname: it answers no request, only probes on a cron trigger.
+ */
+export interface PlatformUptimeWorker {
+    enabled: boolean;
+    /** An Archon release tag, `v1.2.3`. */
+    tag: string;
+    /** Lower-case hex SHA-256 of `archon-uptime-worker.js` at that tag. */
+    sha256: string;
+}
+/** Where Archon publishes the Worker script for `tag` (a private repo; the host's `fetchArtifact` fetches it). */
+export declare function uptimeArtifactUrl(tag: string): string;
 /**
  * The shared services a declared platform names, decided in #165, plus
  * `edge` (#317, F7): the service that mints an entry's own edge key and
@@ -87,6 +103,8 @@ export interface DeclaredPlatform {
      * `gitRef` empty.
      */
     coolify: PlatformService;
+    /** foundry#542: the outside prober Worker; see {@link PlatformUptimeWorker}. */
+    uptime: PlatformUptimeWorker;
 }
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export declare function defaultPlatformHostname(service: PlatformServiceKey, apex: string): string;

package/dist/platform.js

@@ -1,5 +1,9 @@
 import { isIPv4 } from 'node:net';
 import { validateDomain } from './org.js';
+/** Where Archon publishes the Worker script for `tag` (a private repo; the host's `fetchArtifact` fetches it). */
+export function uptimeArtifactUrl(tag) {
+    return `https://github.com/wtfalch/archon/releases/download/${tag}/archon-uptime-worker.js`;
+}
 export const PLATFORM_SERVICE_KEYS = [
     'auth',
     'mail',
@@ -50,6 +54,16 @@ export function validatePlatform(platform) {
             return `${key}.gitRef must not be empty once ${key}.enabled is true`;
         }
     }
+    const { uptime } = platform;
+    if (Boolean(uptime.tag.trim()) !== Boolean(uptime.sha256.trim())) {
+        return 'uptime.tag and uptime.sha256 must be set together: a pin is both';
+    }
+    if (uptime.tag && !/^v[0-9A-Za-z][0-9A-Za-z.+_-]*$/.test(uptime.tag)) {
+        return `uptime.tag '${uptime.tag}' must be a release tag such as v1.2.3`;
+    }
+    if (uptime.sha256 && !/^[0-9a-f]{64}$/.test(uptime.sha256)) {
+        return 'uptime.sha256 must be 64 lower-case hex characters';
+    }
     // #491: declared, never discovered -- a present-but-blank id is refused the
     // same way `serverIpv4`'s blank string is, rather than being read as unset.
     if (platform.mail.lettermintProjectId != null && !platform.mail.lettermintProjectId.trim()) {

package/dist/store/postgres.js

@@ -79,6 +79,30 @@ export class DeclaredOrgError extends Error {
         this.name = 'DeclaredOrgError';
     }
 }
+/**
+ * Reads one stored entry. `hostnames` defaults as migration 0030 set it, and
+ * `gates` to none. An entry stored before gates existed with a non-empty
+ * `accessEmails` was gated: read it as one gate on its first non-'*' hostname
+ * (as stored), or on '*' when that is its only hostname, so the read fails
+ * closed and never drops a declared gate. With no hostname it is not served
+ * and reads no gates. The emails are dropped (people are chosen
+ * elsewhere now), and the next write stores the new shape without them. An
+ * entry that already has `gates` keeps them. A converted company over
+ * `gateLimit` is not an error here; validation reports it on the next validate.
+ */
+function storedEntryToEntry(stored, usesDomain) {
+    const { accessEmails, ...rest } = stored;
+    const hostnames = stored.hostnames ?? (stored.key === APP_ENTRY_KEY && usesDomain ? ['@'] : []);
+    let gates = stored.gates;
+    if (gates === undefined) {
+        const first = hostnames.find((h) => h !== '*') ?? hostnames[0];
+        gates =
+            accessEmails !== undefined && accessEmails.length > 0 && first !== undefined
+                ? [{ key: stored.key, hostnames: [first] }]
+                : [];
+    }
+    return { ...rest, hostnames, gates };
+}
 function rowToOrg(row) {
     return {
         id: row.id,
@@ -117,11 +141,8 @@ function rowToOrg(row) {
             usesDomain: row.hostingUsesDomain,
             tunnel: row.hostingTunnel,
             issuerApps: row.hostingIssuerApps,
-            // Migration 0030's default for an entry stored before `hostnames`.
-            entries: row.hostingEntries.map((entry) => ({
-                ...entry,
-                hostnames: entry.hostnames ?? (entry.key === APP_ENTRY_KEY && row.hostingUsesDomain ? ['@'] : []),
-            })),
+            entries: row.hostingEntries.map((entry) => storedEntryToEntry(entry, row.hostingUsesDomain)),
+            gateLimit: row.hostingGateLimit,
         },
         sso: { enabled: row.ssoEnabled },
         guests: { enabled: row.guestsEnabled },
@@ -163,6 +184,7 @@ function orgToRow(org) {
         hostingTunnel: org.hosting.tunnel,
         hostingIssuerApps: org.hosting.issuerApps,
         hostingEntries: org.hosting.entries,
+        hostingGateLimit: org.hosting.gateLimit,
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,
@@ -613,6 +635,7 @@ function rowToPlatform(row) {
             hostname: row.coolifyHostname,
             gitRef: row.coolifyGitRef,
         },
+        uptime: { enabled: row.uptimeEnabled, tag: row.uptimeTag, sha256: row.uptimeSha256 },
     };
 }
 function platformToRow(platform) {
@@ -655,6 +678,9 @@ function platformToRow(platform) {
         coolifyEnabled: platform.coolify.enabled,
         coolifyHostname: platform.coolify.hostname,
         coolifyGitRef: platform.coolify.gitRef,
+        uptimeEnabled: platform.uptime.enabled,
+        uptimeTag: platform.uptime.tag,
+        uptimeSha256: platform.uptime.sha256,
     };
 }
 /**

package/dist/store/schema.d.ts

@@ -533,6 +533,23 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             $type: HostingEntry[];
         }>;
+        hostingGateLimit: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hosting_gate_limit";
+            tableName: "foundry_declared_orgs";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         ssoEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sso_enabled";
             tableName: "foundry_declared_orgs";
@@ -2034,6 +2051,57 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        uptimeEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uptime_enabled";
+            tableName: "foundry_declared_platform";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        uptimeTag: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uptime_tag";
+            tableName: "foundry_declared_platform";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        uptimeSha256: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uptime_sha256";
+            tableName: "foundry_declared_platform";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         serviceIds: import("drizzle-orm/pg-core").PgColumn<{
             name: "service_ids";
             tableName: "foundry_declared_platform";

package/dist/store/schema.js

@@ -59,6 +59,8 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     // hosting_access_emails and hosting_app_env columns, which stay for an older
     // reader and are no longer written.
     hostingEntries: jsonb('hosting_entries').notNull().default([]).$type(),
+    // HostingConfig.gateLimit (org.ts, #603); migrations/0048. Default 3 is DEFAULT_GATE_LIMIT.
+    hostingGateLimit: integer('hosting_gate_limit').notNull().default(3),
     ssoEnabled: boolean('sso_enabled').notNull().default(false),
     guestsEnabled: boolean('guests_enabled').notNull().default(false),
     soloEnabled: boolean('solo_enabled').notNull().default(false),
@@ -190,6 +192,10 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     coolifyEnabled: boolean('coolify_enabled').notNull().default(false),
     coolifyHostname: text('coolify_hostname').notNull(),
     coolifyGitRef: text('coolify_git_ref').notNull().default(''),
+    /** `migrations/0049_platform_uptime.sql`: the uptime Worker and its artifact pin. */
+    uptimeEnabled: boolean('uptime_enabled').notNull().default(true),
+    uptimeTag: text('uptime_tag').notNull().default(''),
+    uptimeSha256: text('uptime_sha256').notNull().default(''),
     /** `migrations/0018_platform_apply.sql`: the platform's applied state, `system:kind:key` to provider id. */
     serviceIds: jsonb('service_ids').$type().notNull().default({}),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -43,7 +43,7 @@
   "dependencies": {
     "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
-    "@wtfalch/edge": "0.9.0",
+    "@wtfalch/edge": "0.12.0",
     "@wtfalch/email": "^0.17.0",
     "@wtfalch/providers": "0.7.5",
     "ssh2": "1.17.0",