@wtfalch/foundry 0.3.0 → 0.5.0

package/dist/requested-changes.js

@@ -0,0 +1,95 @@
+export const REQUESTABLE_FIELDS = [
+    'calls',
+    'storageLimit',
+    'aiLimit',
+    'domain',
+    'mailTier',
+];
+/**
+ * Thrown by {@link classifyChange} (and by the requested-change store's
+ * `create`, which calls it) for a `change.field` outside
+ * {@link REQUESTABLE_FIELDS} -- same "throw with a reason" shape
+ * `store/postgres.ts`'s `DeclaredOrgError` and `PlatformError` use.
+ */
+export class RequestedChangeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RequestedChangeError';
+    }
+}
+/**
+ * `org` patched by `change`, scoped to exactly the one field it names --
+ * the same `{ ...current, ...patch }` shape `store/postgres.ts`'s `update`
+ * uses for a `DeclaredOrg` patch, narrowed to a single field here since a
+ * requested change only ever touches one.
+ */
+function applyRequestedChange(org, change) {
+    switch (change.field) {
+        case 'calls':
+            return { ...org, calls: { ...org.calls, enabled: change.enabled } };
+        case 'storageLimit':
+            return {
+                ...org,
+                storage: { limitBytes: change.limitBytes, limitMicros: change.limitMicros },
+            };
+        case 'aiLimit':
+            return { ...org, ai: { limitMicros: change.limitMicros } };
+        case 'domain':
+            return { ...org, domain: change.domain };
+        case 'mailTier':
+            return { ...org, mail: { ...org.mail, mode: change.mode } };
+    }
+}
+/**
+ * Whether `before` and `after` differ on the org's own billing fields --
+ * "take price changes from the org's billing fields" (#178 "How").
+ * `DeclaredOrg` carries no price field yet (billing itself is
+ * `@wtfalch/billing`, a separate package this one does not depend on), so
+ * this always returns `false` today. It exists as the one place
+ * `classifyChange` asks the question, so a later billing field lands here
+ * rather than reshaping `classifyChange`'s own contract.
+ */
+function priceChanges(_before, _after) {
+    return false;
+}
+/**
+ * `auto` when `change` is small and safe (`calls`, `storageLimit`,
+ * `aiLimit`), the plan it causes has no destructive or migrating step, and
+ * it causes no price change on `org`'s own billing fields; `approval`
+ * otherwise -- every `domain` or `mailTier` change classifies `approval`
+ * unconditionally, since #178 "Decide" calls both migrating steps that
+ * always need approval, whatever direction the change moves.
+ *
+ * `plan` is the {@link PlanDetail} `change` causes -- the caller's own diff
+ * against live reality, from the same `computePlanDetail` (`plan/diff.ts`)
+ * every other apply goes through. Any `plannedSteps` entry marked
+ * `destroys` or `migrates` classifies `approval`, whatever `change.field`
+ * says: a field-name rule only ever knows what a change usually does, not
+ * what it does to this org's actual live state today (#184 "Why"). `plan`
+ * is optional because not every caller has live state to diff against yet
+ * (`store/postgres.ts`'s `create` classifies from `org` alone); omitting it
+ * falls back to the field-name rule below, unchanged from #178.
+ *
+ * Throws {@link RequestedChangeError} for a `change.field` outside
+ * {@link REQUESTABLE_FIELDS} -- "everything else is refused" (#178 "How").
+ */
+export function classifyChange(org, change, plan) {
+    if (!REQUESTABLE_FIELDS.includes(change.field)) {
+        throw new RequestedChangeError(`'${change.field}' is not a requestable field`);
+    }
+    if (plan?.plannedSteps.some((planned) => planned.step.destroys || planned.step.migrates)) {
+        return 'approval';
+    }
+    const next = applyRequestedChange(org, change);
+    if (priceChanges(org, next))
+        return 'approval';
+    switch (change.field) {
+        case 'calls':
+        case 'storageLimit':
+        case 'aiLimit':
+            return 'auto';
+        case 'domain':
+        case 'mailTier':
+            return 'approval';
+    }
+}

package/dist/slug.js

@@ -32,11 +32,15 @@ const RESERVED_ESTATE_SERVICES = [
     'keys',
     'chat',
     'calls',
+    'calls-sfu',
     'calendar',
     'threads',
     'audit',
     'authz',
+    // Manage was renamed Boule on every surface (#147); 'manage' stays
+    // reserved so no org can take it while the old hostname still redirects.
     'manage',
+    'boule',
     'operator',
     'mailbox',
     'oikos',
@@ -112,6 +116,18 @@ const DNS_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
 const PR_SUFFIX = /-pr-\d+$/;
 /** `<something>-stage` — the stage-hostname shape (#28). */
 const STAGE_SUFFIX = /-stage$/;
+/** `<something>-calls` — a level-1 org's own calls service hostname (foundry#145's "Decided", 2026-09-27). */
+const CALLS_SUFFIX = /-calls$/;
+/**
+ * `<something>-agora` — a level-1 org's own Agora hostname
+ * (`<slug>-agora.oikos.host`, foundry#164, the 2026-09-24 layout,
+ * foundry#14). Every org's Agora is always on (#164 "How": no new field on
+ * `DeclaredOrg` to opt out of it), so this is not an opt-in reservation the
+ * way `CALLS_SUFFIX` guards a feature an org can decline -- any slug ending
+ * `-agora` collides with *every* org's own Agora hostname the moment it is
+ * taken, not just one that turns a feature on.
+ */
+const AGORA_SUFFIX = /-agora$/;
 /**
  * Validates a candidate org slug against every rule #28 decided. Returns
  * `null` when the slug is acceptable, or a {@link SlugRejection} naming
@@ -132,10 +148,13 @@ export function validateSlug(slug) {
             message: `slug '${slug}' is reserved by the estate (#28) and cannot be taken by an org`,
         };
     }
-    if (STAGE_SUFFIX.test(slug) || PR_SUFFIX.test(slug)) {
+    if (STAGE_SUFFIX.test(slug) ||
+        PR_SUFFIX.test(slug) ||
+        CALLS_SUFFIX.test(slug) ||
+        AGORA_SUFFIX.test(slug)) {
         return {
             reason: 'environment-suffix',
-            message: `slug '${slug}' ends with an environment suffix ('-stage' or '-pr-<digits>') reserved for another org's own hostname (#28) — 'acme-stage' is only legal as acme's stage hostname, never as an org slug in its own right`,
+            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls' or '-agora') reserved for another org's own hostname (#28, #145, #164) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, never as an org slug in its own right`,
         };
     }
     return null;

package/dist/store/audit.js

@@ -6,7 +6,7 @@ import { foundryAuditEvents } from './schema.js';
  */
 export function createPostgresAuditLog(db) {
     return {
-        async recordPlan({ actor, orgId, plan, at }) {
+        async recordPlan({ actor, orgId, plan, target, at }) {
             await db.insert(foundryAuditEvents).values({
                 at,
                 kind: 'plan',
@@ -14,9 +14,10 @@ export function createPostgresAuditLog(db) {
                 actorDisplay: actor.display,
                 orgId,
                 plan,
+                target: target ?? null,
             });
         },
-        async recordApply({ actor, orgId, plan, outcome, reason, at }) {
+        async recordApply({ actor, orgId, plan, outcome, reason, target, at }) {
             await db.insert(foundryAuditEvents).values({
                 at,
                 kind: 'apply',
@@ -26,6 +27,7 @@ export function createPostgresAuditLog(db) {
                 outcome,
                 reason: reason ?? null,
                 plan,
+                target: target ?? null,
             });
         },
         async recordDestroy({ actor, orgId, outcome, reason, at }) {

package/dist/store/postgres.d.ts

@@ -1,5 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-import type { DeclaredOrgStore } from '../store.js';
+import type { DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
 /**
  * The host's own drizzle handle or a transaction open on it, same shape
  * `@wtfalch/keys`'s `HeldKeysDb` uses: postgres-js in a real host, PGlite in
@@ -14,7 +14,10 @@ export type FoundryStoreDb = PgDatabase<PgQueryResultHKT, any, any>;
  * environment-suffix shape), a slug already taken by another org (#28:
  * checked by the unique index `0004_slug_unique.sql` adds, whether caught
  * ahead of time by a pre-check or by a race this store maps back to the
- * same error) or — the one impossible combination #18 implements — a slug
+ * same error), a domain that fails `../org.js`'s `validateDomain` or is
+ * already taken by another org (#131, the same shape as the slug: format
+ * checked ahead of time, uniqueness checked by `0015_domain_unique.sql`'s
+ * index) or — the one impossible combination #18 implements — a slug
  * change once the org has mail. `store.ts`'s `update` doc requires a caller
  * to be "ready for this to throw rather than silently drop a field"; this
  * is that throw.
@@ -36,10 +39,40 @@ export declare class DeclaredOrgError extends Error {
  * (or `null` for uncapped), checked the same way on both `create` and the
  * merged result of `update`. #67 adds a fourth (`org.ts`'s
  * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
- * checked the same way. The broader "combinations foundry knows are
- * impossible are rejected with a reason" line needs a ruleset (domain
- * requirements per service, `adoptedApp.form`, mail-level transitions…)
- * that later tickets, not #18, #27 or #28, decide; `update` still merges and
- * stores any other patch as given.
+ * checked the same way. #131 adds a sixth, in the same shape as the slug: the
+ * domain, when set, is a validated (`org.ts`'s `validateDomain`), globally
+ * unique DNS name, checked on both `create` and `update`. The broader
+ * "combinations foundry knows are impossible are rejected with a reason"
+ * line needs a ruleset (domain requirements per service, `adoptedApp.form`,
+ * mail-level transitions…) that later tickets, not #18, #27, #28 or #131,
+ * decide; `update` still merges and stores any other patch as given.
  */
 export declare function createPostgresDeclaredOrgStore(db: FoundryStoreDb): DeclaredOrgStore;
+/**
+ * Thrown by `put` when `validatePlatform` (`../platform.js`) refuses the
+ * platform given to it -- same "throw with a reason" shape
+ * {@link DeclaredOrgError} gives `create`/`update`.
+ */
+export declare class PlatformError extends Error {
+    constructor(message: string);
+}
+/**
+ * `PlatformStore` (`../store.ts`) on Postgres, for #166: get and put the one
+ * {@link DeclaredPlatform}, beside `createPostgresDeclaredOrgStore` above.
+ * `put` validates with `../platform.js`'s `validatePlatform` and then
+ * upserts onto the fixed singleton row `migrations/0016_platform.sql`
+ * declares -- the first call creates it, every later call replaces it, and
+ * the table's own `check (id)` constraint is what actually refuses a second
+ * row, not this function.
+ */
+export declare function createPostgresPlatformStore(db: FoundryStoreDb): PlatformStore;
+/**
+ * `RequestedChangeStore` (`../store.ts`) on Postgres, for #178: classify and
+ * store a company's own requested setting change on its declared org, beside
+ * `createPostgresDeclaredOrgStore` and `createPostgresPlatformStore` above.
+ * `create` classifies with `../requested-changes.js`'s `classifyChange`
+ * against the `org` given to it -- this store never loads the org itself,
+ * the same "caller already has it" choice `PlatformStore.put`'s `platform`
+ * argument makes -- and stores the result as the request's initial `state`.
+ */
+export declare function createPostgresRequestedChangeStore(db: FoundryStoreDb): RequestedChangeStore;

package/dist/store/postgres.js

@@ -1,25 +1,36 @@
-import { eq, sql } from 'drizzle-orm';
-import { validateBuyerIdentity, validateHosting, validateOwner, validateSite } from '../org.js';
+import { asc, eq, sql } from 'drizzle-orm';
+import { validateBuyerIdentity, validateDomain, validateHosting, validateOwner, validateSite, } from '../org.js';
+import { validatePlatform } from '../platform.js';
+import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
-import { declaredOrgs, foundryAppliedState, } from './schema.js';
+import { declaredOrgs, foundryAppliedState, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
+/** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
+const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
+const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
 /** #27: a bigint-safe decimal string of a non-negative integer -- no sign, no decimal point, no leading zeros (so "010" never diffs against a live "10"). */
 const NON_NEGATIVE_INTEGER = /^(0|[1-9]\d*)$/;
 /**
- * True for a Postgres unique-violation, however the driver hands it back --
- * directly (PGlite in this package's own tests) or wrapped in drizzle-orm's
- * own `DrizzleQueryError`, whose `cause` carries the raw driver error
- * (postgres-js in a host). Checked by Postgres error code, never by message
- * text, since message text is not a contract. Same pattern as
+ * The Postgres unique-violation constraint name, however the driver hands the
+ * error back -- directly (PGlite in this package's own tests) or wrapped in
+ * drizzle-orm's own `DrizzleQueryError`, whose `cause` carries the raw driver
+ * error (postgres-js in a host) -- or `undefined` when this is not a unique
+ * violation. Checked by Postgres error code, never by message text, since
+ * message text is not a contract. Same code-check pattern as
  * `../runner/runner.ts`'s own `isUniqueViolation` -- kept as a local copy
- * here rather than shared, since neither module depends on the other.
+ * here rather than shared, since neither module depends on the other; this
+ * one additionally reads `constraint` so `create`/`update` can tell a slug
+ * collision from a domain collision (#131) rather than reporting both the
+ * same way.
  */
-function isUniqueViolation(error) {
-    const code = error?.code;
-    if (code === UNIQUE_VIOLATION)
-        return true;
+function uniqueViolationConstraint(error) {
+    const direct = error;
+    if (direct?.code === UNIQUE_VIOLATION)
+        return direct.constraint;
     const cause = error?.cause;
-    return cause?.code === UNIQUE_VIOLATION;
+    if (cause?.code === UNIQUE_VIOLATION)
+        return cause.constraint;
+    return undefined;
 }
 /**
  * Thrown by `create` and `update` when the store refuses a write: an id
@@ -28,7 +39,10 @@ function isUniqueViolation(error) {
  * environment-suffix shape), a slug already taken by another org (#28:
  * checked by the unique index `0004_slug_unique.sql` adds, whether caught
  * ahead of time by a pre-check or by a race this store maps back to the
- * same error) or — the one impossible combination #18 implements — a slug
+ * same error), a domain that fails `../org.js`'s `validateDomain` or is
+ * already taken by another org (#131, the same shape as the slug: format
+ * checked ahead of time, uniqueness checked by `0015_domain_unique.sql`'s
+ * index) or — the one impossible combination #18 implements — a slug
  * change once the org has mail. `store.ts`'s `update` doc requires a caller
  * to be "ready for this to throw rather than silently drop a field"; this
  * is that throw.
@@ -47,7 +61,7 @@ function rowToOrg(row) {
         domain: row.domain,
         mail: { mode: row.mailMode, usesDomain: row.mailUsesDomain },
         chat: { usesDomain: row.chatUsesDomain },
-        calls: { usesDomain: row.callsUsesDomain },
+        calls: { enabled: row.callsEnabled, usesDomain: row.callsUsesDomain },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
@@ -83,6 +97,7 @@ function orgToRow(org) {
         mailMode: org.mail.mode,
         mailUsesDomain: org.mail.usesDomain,
         chatUsesDomain: org.chat.usesDomain,
+        callsEnabled: org.calls.enabled,
         callsUsesDomain: org.calls.usesDomain,
         issuerUsesDomain: org.issuer.usesDomain,
         siteEnabled: org.site.enabled,
@@ -166,11 +181,13 @@ function rowToOwner(row) {
  * (or `null` for uncapped), checked the same way on both `create` and the
  * merged result of `update`. #67 adds a fourth (`org.ts`'s
  * `validateBuyerIdentity`) and #71 a fifth (`org.ts`'s `validateHosting`),
- * checked the same way. The broader "combinations foundry knows are
- * impossible are rejected with a reason" line needs a ruleset (domain
- * requirements per service, `adoptedApp.form`, mail-level transitions…)
- * that later tickets, not #18, #27 or #28, decide; `update` still merges and
- * stores any other patch as given.
+ * checked the same way. #131 adds a sixth, in the same shape as the slug: the
+ * domain, when set, is a validated (`org.ts`'s `validateDomain`), globally
+ * unique DNS name, checked on both `create` and `update`. The broader
+ * "combinations foundry knows are impossible are rejected with a reason"
+ * line needs a ruleset (domain requirements per service, `adoptedApp.form`,
+ * mail-level transitions…) that later tickets, not #18, #27, #28 or #131,
+ * decide; `update` still merges and stores any other patch as given.
  */
 export function createPostgresDeclaredOrgStore(db) {
     async function requireRow(id) {
@@ -184,6 +201,18 @@ export function createPostgresDeclaredOrgStore(db) {
         if (rejection)
             throw new DeclaredOrgError(rejection.message);
     }
+    // #131: same place `requireValidSlug` checks the slug's format (#28) --
+    // `domain` is nullable (a brand new org has none), so this is only called
+    // once it is set. Uniqueness itself is not pre-checked here, the same
+    // choice `requireValidSlug` makes for the slug: the unique index
+    // `0015_domain_unique.sql` adds is the source of truth, caught below.
+    function requireValidDomain(domain) {
+        if (domain === null)
+            return;
+        const reason = validateDomain(domain);
+        if (reason)
+            throw new DeclaredOrgError(`domain invalid: ${reason} (#131)`);
+    }
     function requireValidLimit(fieldName, value) {
         if (value !== null && !NON_NEGATIVE_INTEGER.test(value)) {
             throw new DeclaredOrgError(`${fieldName} '${value}' must be a bigint-safe decimal string of a non-negative integer, or null for uncapped (#27)`);
@@ -230,6 +259,7 @@ export function createPostgresDeclaredOrgStore(db) {
     return {
         async create(org) {
             requireValidSlug(org.slug);
+            requireValidDomain(org.domain);
             requireValidLimits(org);
             requireValidBuyer(org);
             requireValidHosting(org);
@@ -239,13 +269,19 @@ export function createPostgresDeclaredOrgStore(db) {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
             catch (error) {
-                // The pre-check above already refuses a slug this process knows is
-                // taken (nothing does, on a fresh insert) -- this catches the race
-                // the pre-check cannot: two concurrent creates for the same slug,
-                // caught by `0004_slug_unique.sql`'s unique index and reported
-                // through the same error a pre-check would have thrown (#28).
-                if (isUniqueViolation(error))
+                // The pre-checks above already refuse a slug or domain this process
+                // knows is taken (nothing does, on a fresh insert) -- this catches
+                // the race they cannot: two concurrent creates for the same slug or
+                // domain, caught by `0004_slug_unique.sql`/`0015_domain_unique.sql`'s
+                // unique indexes and reported through the same error a pre-check
+                // would have thrown (#28, #131).
+                const constraint = uniqueViolationConstraint(error);
+                if (constraint === DOMAIN_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`domain '${org.domain}' is already taken by another org (#131)`);
+                }
+                if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${org.slug}' is already taken by another org`);
+                }
                 throw error;
             }
         },
@@ -261,6 +297,23 @@ export function createPostgresDeclaredOrgStore(db) {
                 .limit(1);
             return row !== undefined;
         },
+        // #131: a plain scan, not an indexed lookup -- `serviceIds` is jsonb
+        // keyed by resource, not by provider id, and foundry's own org count is
+        // small enough that this never needs to be more than that (same
+        // reasoning `getAppliedState`/`putAppliedState` already lean on: one row
+        // per org).
+        async findOrgIdForZone(zoneId) {
+            const rows = await db
+                .select({ orgId: foundryAppliedState.orgId, serviceIds: foundryAppliedState.serviceIds })
+                .from(foundryAppliedState);
+            for (const row of rows) {
+                for (const [key, id] of Object.entries(row.serviceIds)) {
+                    if (id === zoneId && key.startsWith('cloudflare:zone:'))
+                        return row.orgId;
+                }
+            }
+            return null;
+        },
         async update(id, patch) {
             const current = rowToOrg(await requireRow(id));
             // The slug freeze (#7 corrections 3): once mail exists, the mail
@@ -279,6 +332,7 @@ export function createPostgresDeclaredOrgStore(db) {
             if (patch.slug !== undefined && patch.slug !== current.slug)
                 requireValidSlug(patch.slug);
             const next = { ...current, ...patch, id: current.id };
+            requireValidDomain(next.domain);
             requireValidLimits(next);
             requireValidBuyer(next);
             requireValidHosting(next);
@@ -292,9 +346,15 @@ export function createPostgresDeclaredOrgStore(db) {
             }
             catch (error) {
                 // Same race as `create`: another org's concurrent write took this
-                // slug between the pre-check above and this statement (#28).
-                if (isUniqueViolation(error))
+                // slug or domain between the pre-check above and this statement
+                // (#28, #131).
+                const constraint = uniqueViolationConstraint(error);
+                if (constraint === DOMAIN_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`domain '${next.domain}' is already taken by another org (#131)`);
+                }
+                if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${next.slug}' is already taken by another org`);
+                }
                 throw error;
             }
             return next;
@@ -347,3 +407,171 @@ export function createPostgresDeclaredOrgStore(db) {
         },
     };
 }
+/**
+ * Thrown by `put` when `validatePlatform` (`../platform.js`) refuses the
+ * platform given to it -- same "throw with a reason" shape
+ * {@link DeclaredOrgError} gives `create`/`update`.
+ */
+export class PlatformError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PlatformError';
+    }
+}
+/** `migrations/0016_platform.sql`'s singleton row -- `id` is always `true`, the only value its `check (id)` constraint allows. */
+const PLATFORM_ROW_ID = true;
+function rowToPlatform(row) {
+    return {
+        ownerOrgId: row.ownerOrgId,
+        apex: row.apex,
+        auth: { enabled: row.authEnabled, hostname: row.authHostname, gitRef: row.authGitRef },
+        mail: { enabled: row.mailEnabled, hostname: row.mailHostname, gitRef: row.mailGitRef },
+        sfu: { enabled: row.sfuEnabled, hostname: row.sfuHostname, gitRef: row.sfuGitRef },
+        files: { enabled: row.filesEnabled, hostname: row.filesHostname, gitRef: row.filesGitRef },
+        ai: { enabled: row.aiEnabled, hostname: row.aiHostname, gitRef: row.aiGitRef },
+        jobs: { enabled: row.jobsEnabled, hostname: row.jobsHostname, gitRef: row.jobsGitRef },
+        integrations: {
+            enabled: row.integrationsEnabled,
+            hostname: row.integrationsHostname,
+            gitRef: row.integrationsGitRef,
+        },
+        archon: {
+            enabled: row.archonEnabled,
+            hostname: row.archonHostname,
+            gitRef: row.archonGitRef,
+        },
+    };
+}
+function platformToRow(platform) {
+    return {
+        id: PLATFORM_ROW_ID,
+        ownerOrgId: platform.ownerOrgId,
+        apex: platform.apex,
+        authEnabled: platform.auth.enabled,
+        authHostname: platform.auth.hostname,
+        authGitRef: platform.auth.gitRef,
+        mailEnabled: platform.mail.enabled,
+        mailHostname: platform.mail.hostname,
+        mailGitRef: platform.mail.gitRef,
+        sfuEnabled: platform.sfu.enabled,
+        sfuHostname: platform.sfu.hostname,
+        sfuGitRef: platform.sfu.gitRef,
+        filesEnabled: platform.files.enabled,
+        filesHostname: platform.files.hostname,
+        filesGitRef: platform.files.gitRef,
+        aiEnabled: platform.ai.enabled,
+        aiHostname: platform.ai.hostname,
+        aiGitRef: platform.ai.gitRef,
+        jobsEnabled: platform.jobs.enabled,
+        jobsHostname: platform.jobs.hostname,
+        jobsGitRef: platform.jobs.gitRef,
+        integrationsEnabled: platform.integrations.enabled,
+        integrationsHostname: platform.integrations.hostname,
+        integrationsGitRef: platform.integrations.gitRef,
+        archonEnabled: platform.archon.enabled,
+        archonHostname: platform.archon.hostname,
+        archonGitRef: platform.archon.gitRef,
+    };
+}
+/**
+ * `PlatformStore` (`../store.ts`) on Postgres, for #166: get and put the one
+ * {@link DeclaredPlatform}, beside `createPostgresDeclaredOrgStore` above.
+ * `put` validates with `../platform.js`'s `validatePlatform` and then
+ * upserts onto the fixed singleton row `migrations/0016_platform.sql`
+ * declares -- the first call creates it, every later call replaces it, and
+ * the table's own `check (id)` constraint is what actually refuses a second
+ * row, not this function.
+ */
+export function createPostgresPlatformStore(db) {
+    return {
+        async get() {
+            const [row] = await db.select().from(foundryDeclaredPlatform).limit(1);
+            return row ? rowToPlatform(row) : null;
+        },
+        async put(platform) {
+            const reason = validatePlatform(platform);
+            if (reason)
+                throw new PlatformError(reason);
+            const row = platformToRow(platform);
+            await db
+                .insert(foundryDeclaredPlatform)
+                .values(row)
+                .onConflictDoUpdate({ target: foundryDeclaredPlatform.id, set: row });
+        },
+        async getServiceIds() {
+            const [row] = await db
+                .select({ serviceIds: foundryDeclaredPlatform.serviceIds })
+                .from(foundryDeclaredPlatform)
+                .limit(1);
+            return row?.serviceIds ?? {};
+        },
+        async putServiceIds(serviceIds) {
+            await db.update(foundryDeclaredPlatform).set({ serviceIds });
+        },
+    };
+}
+/**
+ * `value`'s own field-specific payload, stripped of its `field` -- that is
+ * a column of its own (`foundryRequestedChanges.field`), not repeated
+ * inside the jsonb.
+ */
+function requestedChangePayload(value) {
+    const { field, ...payload } = value;
+    return payload;
+}
+function rowToRequestedChange(row) {
+    return {
+        id: row.id,
+        orgId: row.orgId,
+        value: { field: row.field, ...row.value },
+        requestedBy: row.requestedBy,
+        createdAt: row.createdAt.toISOString(),
+        state: row.state,
+    };
+}
+/**
+ * `RequestedChangeStore` (`../store.ts`) on Postgres, for #178: classify and
+ * store a company's own requested setting change on its declared org, beside
+ * `createPostgresDeclaredOrgStore` and `createPostgresPlatformStore` above.
+ * `create` classifies with `../requested-changes.js`'s `classifyChange`
+ * against the `org` given to it -- this store never loads the org itself,
+ * the same "caller already has it" choice `PlatformStore.put`'s `platform`
+ * argument makes -- and stores the result as the request's initial `state`.
+ */
+export function createPostgresRequestedChangeStore(db) {
+    return {
+        async create({ orgId, org, value, requestedBy }) {
+            const classification = classifyChange(org, value);
+            const state = classification === 'auto' ? 'auto' : 'needs_approval';
+            const [row] = await db
+                .insert(foundryRequestedChanges)
+                .values({
+                orgId,
+                field: value.field,
+                value: requestedChangePayload(value),
+                requestedBy,
+                state,
+            })
+                .returning();
+            if (!row)
+                throw new RequestedChangeError('insert returned no row');
+            return rowToRequestedChange(row);
+        },
+        async get(id) {
+            const [row] = await db
+                .select()
+                .from(foundryRequestedChanges)
+                .where(eq(foundryRequestedChanges.id, id))
+                .limit(1);
+            return row ? rowToRequestedChange(row) : null;
+        },
+        async listForOrg(orgId) {
+            const rows = await db
+                .select()
+                .from(foundryRequestedChanges)
+                .where(eq(foundryRequestedChanges.orgId, orgId))
+                .orderBy(asc(foundryRequestedChanges.createdAt));
+            return rows.map(rowToRequestedChange);
+        },
+    };
+}