@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/platform.d.ts

@@ -31,6 +31,14 @@ export interface PlatformSfuService extends PlatformService {
  */
 export interface PlatformMailService extends PlatformService {
     lettermintProjectId?: string | null;
+    /**
+     * true: one shared relay container owns host port 25 and routes each
+     * message by recipient domain to a company's own mail server or to the
+     * platform's; the platform Stalwart then stops publishing port 25.
+     * false or unset (the default): the platform Stalwart binds host port 25
+     * directly, as it always has.
+     */
+    relay?: boolean;
 }
 /**
  * The uptime Worker (foundry#542): the outside prober Archon publishes as a
@@ -113,13 +121,44 @@ export interface DeclaredPlatform {
     coolify: PlatformService;
     /** foundry#542: the outside prober Worker; see {@link PlatformUptimeWorker}. */
     uptime: PlatformUptimeWorker;
+    /**
+     * foundry#544: which Healthchecks instance manages the heartbeat checks
+     * for every piece of scheduled work foundry sets up (the uptime Worker,
+     * each platform database backup), decoupled from whether foundry also
+     * deploys the self-hosted server ({@link hc} above). `'self-hosted'`
+     * (the default, and today's only behaviour before #544) still requires
+     * `hc.enabled` and reads the project API key under
+     * `PLATFORM_HC_API_KEY_REF`. `'hosted'` needs no self-hosted server at
+     * all -- not `hc.enabled`, not `hc` applied -- and reads its own API key
+     * under `PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF` instead; the host's own
+     * `HeartbeatsPort` implementation is what actually points at the outside
+     * service (healthchecks.io or otherwise) or the self-hosted instance --
+     * this field only says which one foundry expects behind it. Changing it
+     * re-plans `heartbeats:reconcile`, which creates every desired check
+     * fresh on the newly-chosen provider and delivers its ping URLs; a check
+     * left behind on the provider no longer chosen is not deleted (foundry
+     * never had it in view the moment the switch is declared) -- see
+     * issue #544's own "Human steps". Which to use at all, and whether the
+     * self-hosted server stays as a standing option, are both still open
+     * "Decide" items on issue #544's own thread, not settled by this field.
+     */
+    heartbeatsProvider: HeartbeatsProvider;
 }
+/**
+ * foundry#544: see {@link DeclaredPlatform.heartbeatsProvider}'s own doc
+ * comment.
+ */
+export type HeartbeatsProvider = 'self-hosted' | 'hosted';
+/** The only values {@link DeclaredPlatform.heartbeatsProvider} may hold. */
+export declare const HEARTBEATS_PROVIDERS: ReadonlySet<HeartbeatsProvider>;
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export declare function defaultPlatformHostname(service: PlatformServiceKey, apex: string): string;
 /**
  * `null` when `platform` is valid; otherwise the reason it is not, same
  * shape as `org.ts`'s `validateBuyerIdentity`.
  *
+ * - `auth`, `mail`, `files`, `jobs` and `sfu` are not `enabled`: the owner company
+ *   runs them as its own services.
  * - `apex` is a valid domain (`org.ts`'s `validateDomain`).
  * - `serverIpv4`, when declared, is a dotted-quad IPv4 address.
  * - Every service's `hostname` is the apex itself or a subdomain of it -- a
@@ -129,4 +168,5 @@ export declare function defaultPlatformHostname(service: PlatformServiceKey, ape
  * - Every service's `gitRef` is non-empty once that service is `enabled` --
  *   an enabled service with nothing to deploy is not yet declared.
  */
+export declare const OWNER_RUNS_OWN_SERVICES_REASON = "auth, mail, files, jobs and sfu cannot be enabled on the platform: the owner company runs these as its own services";
 export declare function validatePlatform(platform: DeclaredPlatform): string | null;

package/dist/platform.js

@@ -17,6 +17,11 @@ export const PLATFORM_SERVICE_KEYS = [
     'hc',
     'coolify',
 ];
+/** The only values {@link DeclaredPlatform.heartbeatsProvider} may hold. */
+export const HEARTBEATS_PROVIDERS = new Set([
+    'self-hosted',
+    'hosted',
+]);
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export function defaultPlatformHostname(service, apex) {
     return `${service}.${apex}`;
@@ -28,6 +33,8 @@ function serviceOf(platform, key) {
  * `null` when `platform` is valid; otherwise the reason it is not, same
  * shape as `org.ts`'s `validateBuyerIdentity`.
  *
+ * - `auth`, `mail`, `files`, `jobs` and `sfu` are not `enabled`: the owner company
+ *   runs them as its own services.
  * - `apex` is a valid domain (`org.ts`'s `validateDomain`).
  * - `serverIpv4`, when declared, is a dotted-quad IPv4 address.
  * - Every service's `hostname` is the apex itself or a subdomain of it -- a
@@ -37,7 +44,13 @@ function serviceOf(platform, key) {
  * - Every service's `gitRef` is non-empty once that service is `enabled` --
  *   an enabled service with nothing to deploy is not yet declared.
  */
+export const OWNER_RUNS_OWN_SERVICES_REASON = 'auth, mail, files, jobs and sfu cannot be enabled on the platform: the owner company runs these as its own services';
+/** The platform services the owner company runs as its own, which the platform keeps off. */
+const OWNER_RUN_SERVICE_KEYS = ['auth', 'mail', 'files', 'jobs', 'sfu'];
 export function validatePlatform(platform) {
+    if (OWNER_RUN_SERVICE_KEYS.some((key) => platform[key].enabled)) {
+        return OWNER_RUNS_OWN_SERVICES_REASON;
+    }
     const apexReason = validateDomain(platform.apex);
     if (apexReason)
         return `apex invalid: ${apexReason}`;
@@ -75,5 +88,8 @@ export function validatePlatform(platform) {
     if (platform.mail.lettermintProjectId != null && !platform.mail.lettermintProjectId.trim()) {
         return 'mail.lettermintProjectId must not be empty when set';
     }
+    if (!HEARTBEATS_PROVIDERS.has(platform.heartbeatsProvider)) {
+        return `heartbeatsProvider '${platform.heartbeatsProvider}' must be one of ${[...HEARTBEATS_PROVIDERS].join(', ')}`;
+    }
     return null;
 }

package/dist/provision.d.ts

@@ -10,6 +10,8 @@ export declare const DATABASE_NAME = "foundry";
  * still satisfied with no adapter.
  */
 export interface ProvisionCoolifyPort extends Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'listDatabases' | 'createPostgresDatabase'> {
+    /** With `raw`, the database is created on the platform destination (`plan/destinations.ts`). */
+    raw?: CoolifyPort['raw'];
     listEnvironments(projectUuid: string): Promise<Array<{
         id: number;
         uuid: string;

package/dist/provision.js

@@ -1,3 +1,4 @@
+import { placedOnPlatform } from './plan/destinations.js';
 // #R2 (map gap: foundry's own Postgres, two commands): find-or-create the
 // Postgres database `scripts/foundry-db-provision.mjs` migrates into.
 // Project, environment and database names are fixed here rather than taken
@@ -56,7 +57,8 @@ export async function applyProvision(coolify, plan) {
     // `createPostgresDatabase` also returns `internal_db_url` -- a live
     // credential -- which is deliberately never read off this result: only
     // `uuid` (and the `name` we already know) leaves this function.
-    const created = await coolify.createPostgresDatabase({
+    const creator = placedOnPlatform(coolify);
+    const created = await creator.createPostgresDatabase({
         project_uuid: project.uuid,
         server_uuid: server.uuid,
         environment_name: environment.name,

package/dist/slug.d.ts

@@ -1,11 +1,13 @@
 /** The flattened set {@link validateSlug} checks a candidate slug against. */
 export declare const RESERVED_SLUGS: ReadonlySet<string>;
+/** Every platform app, tunnel, project and database name starts `platform-`, so no company slug may. */
+export declare const RESERVED_SLUG_PREFIX = "platform-";
 /**
  * Why {@link validateSlug} refused a candidate slug, by name so a caller —
  * `store/postgres.ts`'s `DeclaredOrgError`, eventually the operator page —
  * can report it without parsing `message` text.
  */
-export type SlugRejectionReason = 'invalid-label' | 'reserved' | 'environment-suffix';
+export type SlugRejectionReason = 'invalid-label' | 'reserved' | 'environment-suffix' | 'reserved-prefix';
 export interface SlugRejection {
     reason: SlugRejectionReason;
     message: string;

package/dist/slug.js

@@ -42,6 +42,7 @@ const RESERVED_ESTATE_SERVICES = [
     'manage',
     'boule',
     'operator',
+    'platform',
     'mailbox',
     'oikos',
     'cms',
@@ -104,6 +105,8 @@ export const RESERVED_SLUGS = new Set([
     ...RESERVED_INFRASTRUCTURE_AND_MAIL,
     ...RESERVED_AUTH_AND_ENVIRONMENTS,
 ]);
+/** Every platform app, tunnel, project and database name starts `platform-`, so no company slug may. */
+export const RESERVED_SLUG_PREFIX = 'platform-';
 /**
  * A DNS label: 1-63 characters, lowercase `a-z`, `0-9` and hyphen, no
  * leading or trailing hyphen. Consecutive hyphens are legal DNS (RFC 1035
@@ -135,6 +138,19 @@ const AGORA_SUFFIX = /-agora$/;
  * one that opts in.
  */
 const BOULE_SUFFIX = /-boule$/;
+/** `<something>-auth|-mail|-files|-sfu|-cms` — an own company's service hostnames on oikos.host (`plan/own-hostnames.ts`). */
+const OWN_SERVICE_SUFFIX = /-(auth|mail|files|sfu|cms)$/;
+/**
+ * `names` itself, or `names-<anything>` — foundry names the company tunnel
+ * `${slug}-tunnel` (`plan/executor.ts`), so a slug of `names` or starting
+ * `names-` produces a tunnel name starting `names-`. Edge refuses to create
+ * a platform tunnel whose name starts with `names-` and reads a live
+ * `names-*` tunnel as its own, not a company's (foundry#535; `edge`'s
+ * `packages/service/src/platform-tunnels.ts`). `namesake` is not a near
+ * miss: its tunnel name is `namesake-tunnel`, which does not start with
+ * `names-`.
+ */
+const NAMES_PREFIX = /^names(-|$)/;
 /**
  * Validates a candidate org slug against every rule #28 decided. Returns
  * `null` when the slug is acceptable, or a {@link SlugRejection} naming
@@ -149,20 +165,27 @@ export function validateSlug(slug) {
             message: `slug '${slug}' is not a valid DNS label: must be 1-63 characters, lowercase a-z, 0-9 and hyphen, and may not start or end with a hyphen`,
         };
     }
-    if (RESERVED_SLUGS.has(slug)) {
+    if (RESERVED_SLUGS.has(slug) || slug.startsWith(RESERVED_SLUG_PREFIX)) {
         return {
             reason: 'reserved',
             message: `slug '${slug}' is reserved by the estate (#28) and cannot be taken by an org`,
         };
     }
+    if (NAMES_PREFIX.test(slug)) {
+        return {
+            reason: 'reserved-prefix',
+            message: `slug '${slug}' is 'names' or starts with 'names-', a prefix edge reserves for its own platform tunnels and refuses to create a company tunnel under (#535)`,
+        };
+    }
     if (STAGE_SUFFIX.test(slug) ||
         PR_SUFFIX.test(slug) ||
         CALLS_SUFFIX.test(slug) ||
         AGORA_SUFFIX.test(slug) ||
-        BOULE_SUFFIX.test(slug)) {
+        BOULE_SUFFIX.test(slug) ||
+        OWN_SERVICE_SUFFIX.test(slug)) {
         return {
             reason: 'environment-suffix',
-            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls', '-agora' or '-boule') reserved for another org's own hostname (#28, #145, #164, #161) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, 'acme-boule' only as acme's Boule hostname, never as an org slug in its own right`,
+            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls', '-agora', '-boule', '-auth', '-mail', '-files', '-sfu' or '-cms') reserved for another org's own hostname (#28, #145, #164, #161) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, 'acme-boule' only as acme's Boule hostname, never as an org slug in its own right`,
         };
     }
     return null;

package/dist/store/postgres.js

@@ -1,6 +1,7 @@
-import { and, asc, desc, eq, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
+import { and, asc, desc, eq, ne, sql } from 'drizzle-orm';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateDomainClaim, validateHosting, validateMail, validateOwners, validateServices, validateSite, validateVersionPin, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
+import { findNameClashes, nameClashMessage } from '../plan/org-names.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
@@ -29,6 +30,7 @@ async function writeFenced(db, fence, write) {
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
 const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
+const SFU_SLOT_UNIQUE_INDEX = 'foundry_declared_orgs_sfu_slot_idx';
 /** #27: a bigint-safe decimal string of a non-negative integer -- no sign, no decimal point, no leading zeros (so "010" never diffs against a live "10"). */
 const NON_NEGATIVE_INTEGER = /^(0|[1-9]\d*)$/;
 /**
@@ -135,6 +137,17 @@ function rowToOrg(row) {
                 : {}),
         },
         issuer: { usesDomain: row.issuerUsesDomain },
+        // Omitted while shared, as `calls.versionPin` is.
+        ...(row.servicesOwn || row.servicesSfuSlot !== null
+            ? {
+                services: {
+                    own: row.servicesOwn,
+                    ...(row.servicesSfuSlot !== null ? { sfuSlot: row.servicesSfuSlot } : {}),
+                },
+            }
+            : {}),
+        // Omitted while unset. Validated on read: a stored value is not trusted.
+        ...(row.versionPin ? { versionPin: readVersionPin(row) } : {}),
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
             enabled: row.hostingEnabled,
@@ -158,6 +171,14 @@ function rowToOrg(row) {
         test: row.isTest,
     };
 }
+function readVersionPin(row) {
+    const pin = row.versionPin;
+    const reason = validateVersionPin({ versionPin: pin });
+    if (reason) {
+        throw new DeclaredOrgError(`stored org ${row.slug} has an invalid versionPin: ${reason}`);
+    }
+    return pin;
+}
 function orgToRow(org) {
     return {
         id: org.id,
@@ -177,6 +198,9 @@ function orgToRow(org) {
         callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
         callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
+        servicesOwn: org.services?.own ?? false,
+        servicesSfuSlot: org.services?.sfuSlot ?? null,
+        versionPin: org.versionPin && Object.keys(org.versionPin).length > 0 ? org.versionPin : null,
         siteEnabled: org.site.enabled,
         siteUsesDomain: org.site.usesDomain,
         hostingEnabled: org.hosting.enabled,
@@ -275,6 +299,29 @@ export function createPostgresDeclaredOrgStore(db) {
         if (reason)
             throw new DeclaredOrgError(`domain invalid: ${reason} (#131)`);
     }
+    // The platform's apex and every other company's domain are read here, so a claim is checked against what is declared now.
+    async function requireDomainClaim(org) {
+        if (org.domain === null)
+            return;
+        const [platformRow] = await db
+            .select({
+            apex: foundryDeclaredPlatform.apex,
+            ownerOrgId: foundryDeclaredPlatform.ownerOrgId,
+        })
+            .from(foundryDeclaredPlatform)
+            .limit(1);
+        const others = await db
+            .select({ id: declaredOrgs.id, domain: declaredOrgs.domain })
+            .from(declaredOrgs)
+            .where(ne(declaredOrgs.id, org.id));
+        const reason = validateDomainClaim(org.domain, {
+            orgId: org.id,
+            platform: platformRow ?? null,
+            others,
+        });
+        if (reason)
+            throw new DeclaredOrgError(`domain invalid: ${reason}`);
+    }
     function requireValidLimit(fieldName, value) {
         if (value !== null && !NON_NEGATIVE_INTEGER.test(value)) {
             throw new DeclaredOrgError(`${fieldName} '${value}' must be a bigint-safe decimal string of a non-negative integer, or null for uncapped (#27)`);
@@ -344,6 +391,33 @@ export function createPostgresDeclaredOrgStore(db) {
         const reason = validateCalls(org);
         if (reason)
             throw new DeclaredOrgError(`calls invalid: ${reason} (#259)`);
+        const pinReason = validateVersionPin(org);
+        if (pinReason)
+            throw new DeclaredOrgError(`versionPin invalid: ${pinReason}`);
+    }
+    // Own-service rules, on `create` and on the merged result of `update`; no
+    // two orgs share an `sfuSlot` (the unique index catches the race this misses).
+    async function requireValidServices(org) {
+        const reason = validateServices(org);
+        if (reason)
+            throw new DeclaredOrgError(`services invalid: ${reason}`);
+        const slot = org.services?.sfuSlot ?? null;
+        if (slot === null)
+            return;
+        const [taken] = await db
+            .select({ id: declaredOrgs.id })
+            .from(declaredOrgs)
+            .where(and(eq(declaredOrgs.servicesSfuSlot, slot), ne(declaredOrgs.id, org.id)))
+            .limit(1);
+        if (taken)
+            throw new DeclaredOrgError(`services invalid: sfuSlot ${slot} is already taken by another org`);
+    }
+    // No name foundry derives for this org may be one another org or the platform derives.
+    async function requireNoNameClash(org) {
+        const rows = await db.select().from(declaredOrgs).where(ne(declaredOrgs.id, org.id));
+        const [clash] = findNameClashes(org, rows.map(rowToOrg));
+        if (clash)
+            throw new DeclaredOrgError(nameClashMessage(org.slug, clash));
     }
     // `as`: `update` is overloaded in the interface (#351), which one object-literal method cannot express.
     return {
@@ -357,6 +431,9 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidOwner(org);
             requireValidMail(org);
             requireValidCalls(org);
+            await requireValidServices(org);
+            await requireNoNameClash(org);
+            await requireDomainClaim(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
@@ -371,6 +448,9 @@ export function createPostgresDeclaredOrgStore(db) {
                 if (constraint === DOMAIN_UNIQUE_INDEX) {
                     throw new DeclaredOrgError(`domain '${org.domain}' is already taken by another org (#131)`);
                 }
+                if (constraint === SFU_SLOT_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`services invalid: sfuSlot ${org.services?.sfuSlot} is already taken by another org`);
+                }
                 if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${org.slug}' is already taken by another org`);
                 }
@@ -461,6 +541,10 @@ export function createPostgresDeclaredOrgStore(db) {
             const wasTier2 = current.domain !== null && current.mail.mode === 'received';
             requireValidMail(next, { allowExistingTier2: wasTier2 });
             requireValidCalls(next);
+            await requireValidServices(next);
+            await requireNoNameClash(next);
+            if (next.domain !== current.domain)
+                await requireDomainClaim(next);
             try {
                 // #351: with `expectedVersion` the version check is part of this one
                 // statement, so an edit that lands after the read above makes it match
@@ -489,6 +573,9 @@ export function createPostgresDeclaredOrgStore(db) {
                 if (constraint === DOMAIN_UNIQUE_INDEX) {
                     throw new DeclaredOrgError(`domain '${next.domain}' is already taken by another org (#131)`);
                 }
+                if (constraint === SFU_SLOT_UNIQUE_INDEX) {
+                    throw new DeclaredOrgError(`services invalid: sfuSlot ${next.services?.sfuSlot} is already taken by another org`);
+                }
                 if (constraint === SLUG_UNIQUE_INDEX || constraint !== undefined) {
                     throw new DeclaredOrgError(`slug '${next.slug}' is already taken by another org`);
                 }
@@ -605,6 +692,7 @@ function rowToPlatform(row) {
             hostname: row.mailHostname,
             gitRef: row.mailGitRef,
             ...(row.mailLettermintProjectId ? { lettermintProjectId: row.mailLettermintProjectId } : {}),
+            ...(row.mailRelay ? { relay: true } : {}),
         },
         sfu: {
             enabled: row.sfuEnabled,
@@ -641,6 +729,7 @@ function rowToPlatform(row) {
             gitRef: row.coolifyGitRef,
         },
         uptime: { enabled: row.uptimeEnabled, tag: row.uptimeTag, sha256: row.uptimeSha256 },
+        heartbeatsProvider: row.heartbeatsProvider,
     };
 }
 function platformToRow(platform) {
@@ -656,6 +745,7 @@ function platformToRow(platform) {
         mailHostname: platform.mail.hostname,
         mailGitRef: platform.mail.gitRef,
         mailLettermintProjectId: platform.mail.lettermintProjectId ?? null,
+        mailRelay: platform.mail.relay === true,
         sfuEnabled: platform.sfu.enabled,
         sfuHostname: platform.sfu.hostname,
         sfuGitRef: platform.sfu.gitRef,
@@ -687,6 +777,7 @@ function platformToRow(platform) {
         uptimeEnabled: platform.uptime.enabled,
         uptimeTag: platform.uptime.tag,
         uptimeSha256: platform.uptime.sha256,
+        heartbeatsProvider: platform.heartbeatsProvider,
     };
 }
 /**

package/dist/store/schema.d.ts

@@ -321,6 +321,59 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        servicesOwn: import("drizzle-orm/pg-core").PgColumn<{
+            name: "services_own";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        servicesSfuSlot: import("drizzle-orm/pg-core").PgColumn<{
+            name: "services_sfu_slot";
+            tableName: "foundry_declared_orgs";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        versionPin: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version_pin";
+            tableName: "foundry_declared_orgs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, string>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, string>;
+        }>;
         siteEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "site_enabled";
             tableName: "foundry_declared_orgs";
@@ -1592,6 +1645,23 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        mailRelay: import("drizzle-orm/pg-core").PgColumn<{
+            name: "mail_relay";
+            tableName: "foundry_declared_platform";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         sfuEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sfu_enabled";
             tableName: "foundry_declared_platform";
@@ -2119,6 +2189,23 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        heartbeatsProvider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "heartbeats_provider";
+            tableName: "foundry_declared_platform";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         serviceIds: import("drizzle-orm/pg-core").PgColumn<{
             name: "service_ids";
             tableName: "foundry_declared_platform";

package/dist/store/schema.js

@@ -35,6 +35,11 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     callsVersionPinSynapse: text('calls_version_pin_synapse'),
     callsVersionPinMas: text('calls_version_pin_mas'),
     issuerUsesDomain: boolean('issuer_uses_domain').notNull().default(false),
+    // ServicesConfig (org.ts): false and null are the platform's shared services.
+    servicesOwn: boolean('services_own').notNull().default(false),
+    servicesSfuSlot: integer('services_sfu_slot'),
+    // VersionPin (org.ts): null follows the platform. `migrations/0053_org_version_pin.sql`.
+    versionPin: jsonb('version_pin').$type(),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.
     siteEnabled: boolean('site_enabled').notNull().default(false),
     siteUsesDomain: boolean('site_uses_domain').notNull().default(false),
@@ -162,6 +167,8 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     mailGitRef: text('mail_git_ref').notNull().default(''),
     /** #491, `migrations/0044_platform_mail_lettermint_project.sql`. Declared, never discovered. */
     mailLettermintProjectId: text('mail_lettermint_project_id'),
+    /** `migrations/0052_platform_mail_relay.sql`. */
+    mailRelay: boolean('mail_relay').notNull().default(false),
     sfuEnabled: boolean('sfu_enabled').notNull().default(false),
     sfuHostname: text('sfu_hostname').notNull(),
     sfuGitRef: text('sfu_git_ref').notNull().default(''),
@@ -198,6 +205,8 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     uptimeEnabled: boolean('uptime_enabled').notNull().default(true),
     uptimeTag: text('uptime_tag').notNull().default(''),
     uptimeSha256: text('uptime_sha256').notNull().default(''),
+    /** foundry#544, `migrations/0053_heartbeats_provider.sql`: which Healthchecks instance manages the heartbeat checks, decoupled from `hcEnabled` above. */
+    heartbeatsProvider: text('heartbeats_provider').notNull().default('self-hosted'),
     /** `migrations/0018_platform_apply.sql`: the platform's applied state, `system:kind:key` to provider id. */
     serviceIds: jsonb('service_ids').$type().notNull().default({}),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.33.1",
+  "version": "0.35.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -9,7 +9,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "files": ["dist", "versions.json"],
+  "files": ["dist", "versions.json", "versions.digests.json"],
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -44,7 +44,7 @@
   "dependencies": {
     "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
-    "@wtfalch/edge": "0.12.0",
+    "@wtfalch/edge": "0.13.0",
     "@wtfalch/email": "^0.20.0",
     "@wtfalch/providers": "0.7.5",
     "ssh2": "1.17.0",

package/versions.digests.json

@@ -0,0 +1,11 @@
+{
+  "zitadel": "sha256:2ec2a42551862ca59dc752c321c7041358dea8b33b63ea5e021ec499ad5e2d9f",
+  "synapse": "sha256:6b95dd129e35e97e8032cb759e5db4a516a5f7ef6c98d34d716fea1ae239b62a",
+  "mas": "sha256:52c18ffcc940220a3b6aa5985b7e09d24ac27f5ed10a4d660c312e48f73ff105",
+  "livekit": "sha256:6fd3b7088874c4d119160dd688798dfec852bc014786d392caad15f6f63912a3",
+  "cloudflared": "sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c",
+  "stalwart": "sha256:ec011be228596e37e65f41aab17deed573859614430472f7eeb42178c50d87b7",
+  "hc": "sha256:aa08a61b0dcfd83f1332eab195d5cec1b595ae076eb8388cadf8a3d597114f9b",
+  "alpine": "sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1",
+  "busybox": "sha256:5cec3fc171c87218698e85a52af7087de727372aae264a787b8112901a5b0092"
+}

package/versions.json

@@ -5,5 +5,7 @@
   "livekit": "v1.13.7",
   "cloudflared": "2026.9.3",
   "stalwart": "v0.16.24",
-  "hc": "v4.4"
+  "hc": "v4.4",
+  "alpine": "3.22.1",
+  "busybox": "1.37.0-musl"
 }