@wtfalch/foundry 0.4.0 → 0.5.0

package/dist/requested-changes.js

@@ -0,0 +1,95 @@
+export const REQUESTABLE_FIELDS = [
+    'calls',
+    'storageLimit',
+    'aiLimit',
+    'domain',
+    'mailTier',
+];
+/**
+ * Thrown by {@link classifyChange} (and by the requested-change store's
+ * `create`, which calls it) for a `change.field` outside
+ * {@link REQUESTABLE_FIELDS} -- same "throw with a reason" shape
+ * `store/postgres.ts`'s `DeclaredOrgError` and `PlatformError` use.
+ */
+export class RequestedChangeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RequestedChangeError';
+    }
+}
+/**
+ * `org` patched by `change`, scoped to exactly the one field it names --
+ * the same `{ ...current, ...patch }` shape `store/postgres.ts`'s `update`
+ * uses for a `DeclaredOrg` patch, narrowed to a single field here since a
+ * requested change only ever touches one.
+ */
+function applyRequestedChange(org, change) {
+    switch (change.field) {
+        case 'calls':
+            return { ...org, calls: { ...org.calls, enabled: change.enabled } };
+        case 'storageLimit':
+            return {
+                ...org,
+                storage: { limitBytes: change.limitBytes, limitMicros: change.limitMicros },
+            };
+        case 'aiLimit':
+            return { ...org, ai: { limitMicros: change.limitMicros } };
+        case 'domain':
+            return { ...org, domain: change.domain };
+        case 'mailTier':
+            return { ...org, mail: { ...org.mail, mode: change.mode } };
+    }
+}
+/**
+ * Whether `before` and `after` differ on the org's own billing fields --
+ * "take price changes from the org's billing fields" (#178 "How").
+ * `DeclaredOrg` carries no price field yet (billing itself is
+ * `@wtfalch/billing`, a separate package this one does not depend on), so
+ * this always returns `false` today. It exists as the one place
+ * `classifyChange` asks the question, so a later billing field lands here
+ * rather than reshaping `classifyChange`'s own contract.
+ */
+function priceChanges(_before, _after) {
+    return false;
+}
+/**
+ * `auto` when `change` is small and safe (`calls`, `storageLimit`,
+ * `aiLimit`), the plan it causes has no destructive or migrating step, and
+ * it causes no price change on `org`'s own billing fields; `approval`
+ * otherwise -- every `domain` or `mailTier` change classifies `approval`
+ * unconditionally, since #178 "Decide" calls both migrating steps that
+ * always need approval, whatever direction the change moves.
+ *
+ * `plan` is the {@link PlanDetail} `change` causes -- the caller's own diff
+ * against live reality, from the same `computePlanDetail` (`plan/diff.ts`)
+ * every other apply goes through. Any `plannedSteps` entry marked
+ * `destroys` or `migrates` classifies `approval`, whatever `change.field`
+ * says: a field-name rule only ever knows what a change usually does, not
+ * what it does to this org's actual live state today (#184 "Why"). `plan`
+ * is optional because not every caller has live state to diff against yet
+ * (`store/postgres.ts`'s `create` classifies from `org` alone); omitting it
+ * falls back to the field-name rule below, unchanged from #178.
+ *
+ * Throws {@link RequestedChangeError} for a `change.field` outside
+ * {@link REQUESTABLE_FIELDS} -- "everything else is refused" (#178 "How").
+ */
+export function classifyChange(org, change, plan) {
+    if (!REQUESTABLE_FIELDS.includes(change.field)) {
+        throw new RequestedChangeError(`'${change.field}' is not a requestable field`);
+    }
+    if (plan?.plannedSteps.some((planned) => planned.step.destroys || planned.step.migrates)) {
+        return 'approval';
+    }
+    const next = applyRequestedChange(org, change);
+    if (priceChanges(org, next))
+        return 'approval';
+    switch (change.field) {
+        case 'calls':
+        case 'storageLimit':
+        case 'aiLimit':
+            return 'auto';
+        case 'domain':
+        case 'mailTier':
+            return 'approval';
+    }
+}

package/dist/slug.js

@@ -118,6 +118,16 @@ const PR_SUFFIX = /-pr-\d+$/;
 const STAGE_SUFFIX = /-stage$/;
 /** `<something>-calls` — a level-1 org's own calls service hostname (foundry#145's "Decided", 2026-09-27). */
 const CALLS_SUFFIX = /-calls$/;
+/**
+ * `<something>-agora` — a level-1 org's own Agora hostname
+ * (`<slug>-agora.oikos.host`, foundry#164, the 2026-09-24 layout,
+ * foundry#14). Every org's Agora is always on (#164 "How": no new field on
+ * `DeclaredOrg` to opt out of it), so this is not an opt-in reservation the
+ * way `CALLS_SUFFIX` guards a feature an org can decline -- any slug ending
+ * `-agora` collides with *every* org's own Agora hostname the moment it is
+ * taken, not just one that turns a feature on.
+ */
+const AGORA_SUFFIX = /-agora$/;
 /**
  * Validates a candidate org slug against every rule #28 decided. Returns
  * `null` when the slug is acceptable, or a {@link SlugRejection} naming
@@ -138,10 +148,13 @@ export function validateSlug(slug) {
             message: `slug '${slug}' is reserved by the estate (#28) and cannot be taken by an org`,
         };
     }
-    if (STAGE_SUFFIX.test(slug) || PR_SUFFIX.test(slug) || CALLS_SUFFIX.test(slug)) {
+    if (STAGE_SUFFIX.test(slug) ||
+        PR_SUFFIX.test(slug) ||
+        CALLS_SUFFIX.test(slug) ||
+        AGORA_SUFFIX.test(slug)) {
         return {
             reason: 'environment-suffix',
-            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>' or '-calls') reserved for another org's own hostname (#28, #145) — 'acme-calls' is only legal as acme's calls hostname, never as an org slug in its own right`,
+            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls' or '-agora') reserved for another org's own hostname (#28, #145, #164) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, never as an org slug in its own right`,
         };
     }
     return null;

package/dist/store/audit.js

@@ -6,7 +6,7 @@ import { foundryAuditEvents } from './schema.js';
  */
 export function createPostgresAuditLog(db) {
     return {
-        async recordPlan({ actor, orgId, plan, at }) {
+        async recordPlan({ actor, orgId, plan, target, at }) {
             await db.insert(foundryAuditEvents).values({
                 at,
                 kind: 'plan',
@@ -14,9 +14,10 @@ export function createPostgresAuditLog(db) {
                 actorDisplay: actor.display,
                 orgId,
                 plan,
+                target: target ?? null,
             });
         },
-        async recordApply({ actor, orgId, plan, outcome, reason, at }) {
+        async recordApply({ actor, orgId, plan, outcome, reason, target, at }) {
             await db.insert(foundryAuditEvents).values({
                 at,
                 kind: 'apply',
@@ -26,6 +27,7 @@ export function createPostgresAuditLog(db) {
                 outcome,
                 reason: reason ?? null,
                 plan,
+                target: target ?? null,
             });
         },
         async recordDestroy({ actor, orgId, outcome, reason, at }) {

package/dist/store/postgres.d.ts

@@ -1,5 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-import type { DeclaredOrgStore } from '../store.js';
+import type { DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
 /**
  * The host's own drizzle handle or a transaction open on it, same shape
  * `@wtfalch/keys`'s `HeldKeysDb` uses: postgres-js in a real host, PGlite in
@@ -48,3 +48,31 @@ export declare class DeclaredOrgError extends Error {
  * decide; `update` still merges and stores any other patch as given.
  */
 export declare function createPostgresDeclaredOrgStore(db: FoundryStoreDb): DeclaredOrgStore;
+/**
+ * Thrown by `put` when `validatePlatform` (`../platform.js`) refuses the
+ * platform given to it -- same "throw with a reason" shape
+ * {@link DeclaredOrgError} gives `create`/`update`.
+ */
+export declare class PlatformError extends Error {
+    constructor(message: string);
+}
+/**
+ * `PlatformStore` (`../store.ts`) on Postgres, for #166: get and put the one
+ * {@link DeclaredPlatform}, beside `createPostgresDeclaredOrgStore` above.
+ * `put` validates with `../platform.js`'s `validatePlatform` and then
+ * upserts onto the fixed singleton row `migrations/0016_platform.sql`
+ * declares -- the first call creates it, every later call replaces it, and
+ * the table's own `check (id)` constraint is what actually refuses a second
+ * row, not this function.
+ */
+export declare function createPostgresPlatformStore(db: FoundryStoreDb): PlatformStore;
+/**
+ * `RequestedChangeStore` (`../store.ts`) on Postgres, for #178: classify and
+ * store a company's own requested setting change on its declared org, beside
+ * `createPostgresDeclaredOrgStore` and `createPostgresPlatformStore` above.
+ * `create` classifies with `../requested-changes.js`'s `classifyChange`
+ * against the `org` given to it -- this store never loads the org itself,
+ * the same "caller already has it" choice `PlatformStore.put`'s `platform`
+ * argument makes -- and stores the result as the request's initial `state`.
+ */
+export declare function createPostgresRequestedChangeStore(db: FoundryStoreDb): RequestedChangeStore;

package/dist/store/postgres.js

@@ -1,7 +1,9 @@
-import { eq, sql } from 'drizzle-orm';
+import { asc, eq, sql } from 'drizzle-orm';
 import { validateBuyerIdentity, validateDomain, validateHosting, validateOwner, validateSite, } from '../org.js';
+import { validatePlatform } from '../platform.js';
+import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
-import { declaredOrgs, foundryAppliedState, } from './schema.js';
+import { declaredOrgs, foundryAppliedState, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
@@ -405,3 +407,171 @@ export function createPostgresDeclaredOrgStore(db) {
         },
     };
 }
+/**
+ * Thrown by `put` when `validatePlatform` (`../platform.js`) refuses the
+ * platform given to it -- same "throw with a reason" shape
+ * {@link DeclaredOrgError} gives `create`/`update`.
+ */
+export class PlatformError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PlatformError';
+    }
+}
+/** `migrations/0016_platform.sql`'s singleton row -- `id` is always `true`, the only value its `check (id)` constraint allows. */
+const PLATFORM_ROW_ID = true;
+function rowToPlatform(row) {
+    return {
+        ownerOrgId: row.ownerOrgId,
+        apex: row.apex,
+        auth: { enabled: row.authEnabled, hostname: row.authHostname, gitRef: row.authGitRef },
+        mail: { enabled: row.mailEnabled, hostname: row.mailHostname, gitRef: row.mailGitRef },
+        sfu: { enabled: row.sfuEnabled, hostname: row.sfuHostname, gitRef: row.sfuGitRef },
+        files: { enabled: row.filesEnabled, hostname: row.filesHostname, gitRef: row.filesGitRef },
+        ai: { enabled: row.aiEnabled, hostname: row.aiHostname, gitRef: row.aiGitRef },
+        jobs: { enabled: row.jobsEnabled, hostname: row.jobsHostname, gitRef: row.jobsGitRef },
+        integrations: {
+            enabled: row.integrationsEnabled,
+            hostname: row.integrationsHostname,
+            gitRef: row.integrationsGitRef,
+        },
+        archon: {
+            enabled: row.archonEnabled,
+            hostname: row.archonHostname,
+            gitRef: row.archonGitRef,
+        },
+    };
+}
+function platformToRow(platform) {
+    return {
+        id: PLATFORM_ROW_ID,
+        ownerOrgId: platform.ownerOrgId,
+        apex: platform.apex,
+        authEnabled: platform.auth.enabled,
+        authHostname: platform.auth.hostname,
+        authGitRef: platform.auth.gitRef,
+        mailEnabled: platform.mail.enabled,
+        mailHostname: platform.mail.hostname,
+        mailGitRef: platform.mail.gitRef,
+        sfuEnabled: platform.sfu.enabled,
+        sfuHostname: platform.sfu.hostname,
+        sfuGitRef: platform.sfu.gitRef,
+        filesEnabled: platform.files.enabled,
+        filesHostname: platform.files.hostname,
+        filesGitRef: platform.files.gitRef,
+        aiEnabled: platform.ai.enabled,
+        aiHostname: platform.ai.hostname,
+        aiGitRef: platform.ai.gitRef,
+        jobsEnabled: platform.jobs.enabled,
+        jobsHostname: platform.jobs.hostname,
+        jobsGitRef: platform.jobs.gitRef,
+        integrationsEnabled: platform.integrations.enabled,
+        integrationsHostname: platform.integrations.hostname,
+        integrationsGitRef: platform.integrations.gitRef,
+        archonEnabled: platform.archon.enabled,
+        archonHostname: platform.archon.hostname,
+        archonGitRef: platform.archon.gitRef,
+    };
+}
+/**
+ * `PlatformStore` (`../store.ts`) on Postgres, for #166: get and put the one
+ * {@link DeclaredPlatform}, beside `createPostgresDeclaredOrgStore` above.
+ * `put` validates with `../platform.js`'s `validatePlatform` and then
+ * upserts onto the fixed singleton row `migrations/0016_platform.sql`
+ * declares -- the first call creates it, every later call replaces it, and
+ * the table's own `check (id)` constraint is what actually refuses a second
+ * row, not this function.
+ */
+export function createPostgresPlatformStore(db) {
+    return {
+        async get() {
+            const [row] = await db.select().from(foundryDeclaredPlatform).limit(1);
+            return row ? rowToPlatform(row) : null;
+        },
+        async put(platform) {
+            const reason = validatePlatform(platform);
+            if (reason)
+                throw new PlatformError(reason);
+            const row = platformToRow(platform);
+            await db
+                .insert(foundryDeclaredPlatform)
+                .values(row)
+                .onConflictDoUpdate({ target: foundryDeclaredPlatform.id, set: row });
+        },
+        async getServiceIds() {
+            const [row] = await db
+                .select({ serviceIds: foundryDeclaredPlatform.serviceIds })
+                .from(foundryDeclaredPlatform)
+                .limit(1);
+            return row?.serviceIds ?? {};
+        },
+        async putServiceIds(serviceIds) {
+            await db.update(foundryDeclaredPlatform).set({ serviceIds });
+        },
+    };
+}
+/**
+ * `value`'s own field-specific payload, stripped of its `field` -- that is
+ * a column of its own (`foundryRequestedChanges.field`), not repeated
+ * inside the jsonb.
+ */
+function requestedChangePayload(value) {
+    const { field, ...payload } = value;
+    return payload;
+}
+function rowToRequestedChange(row) {
+    return {
+        id: row.id,
+        orgId: row.orgId,
+        value: { field: row.field, ...row.value },
+        requestedBy: row.requestedBy,
+        createdAt: row.createdAt.toISOString(),
+        state: row.state,
+    };
+}
+/**
+ * `RequestedChangeStore` (`../store.ts`) on Postgres, for #178: classify and
+ * store a company's own requested setting change on its declared org, beside
+ * `createPostgresDeclaredOrgStore` and `createPostgresPlatformStore` above.
+ * `create` classifies with `../requested-changes.js`'s `classifyChange`
+ * against the `org` given to it -- this store never loads the org itself,
+ * the same "caller already has it" choice `PlatformStore.put`'s `platform`
+ * argument makes -- and stores the result as the request's initial `state`.
+ */
+export function createPostgresRequestedChangeStore(db) {
+    return {
+        async create({ orgId, org, value, requestedBy }) {
+            const classification = classifyChange(org, value);
+            const state = classification === 'auto' ? 'auto' : 'needs_approval';
+            const [row] = await db
+                .insert(foundryRequestedChanges)
+                .values({
+                orgId,
+                field: value.field,
+                value: requestedChangePayload(value),
+                requestedBy,
+                state,
+            })
+                .returning();
+            if (!row)
+                throw new RequestedChangeError('insert returned no row');
+            return rowToRequestedChange(row);
+        },
+        async get(id) {
+            const [row] = await db
+                .select()
+                .from(foundryRequestedChanges)
+                .where(eq(foundryRequestedChanges.id, id))
+                .limit(1);
+            return row ? rowToRequestedChange(row) : null;
+        },
+        async listForOrg(orgId) {
+            const rows = await db
+                .select()
+                .from(foundryRequestedChanges)
+                .where(eq(foundryRequestedChanges.orgId, orgId))
+                .orderBy(asc(foundryRequestedChanges.createdAt));
+            return rows.map(rowToRequestedChange);
+        },
+    };
+}