@wtfalch/foundry 0.5.0 → 0.7.1

package/dist/requested-changes.d.ts

@@ -11,7 +11,9 @@ import type { PlanDetail } from './plan/diff.js';
  * and safe; `domain` and `mailTier` are full self-service too, but both are
  * migrating steps (`plan/diff.ts`'s `planMail` moves live mail between
  * modes; a domain move is at least as disruptive) and always need approval,
- * never auto.
+ * never auto. #184 narrows `storageLimit`/`aiLimit`'s "small and safe" to
+ * lowering or leaving a limit unchanged -- raising either one needs
+ * approval too, until a billing field exists to say what the raise costs.
  */
 export type RequestableField = 'calls' | 'storageLimit' | 'aiLimit' | 'domain' | 'mailTier';
 export declare const REQUESTABLE_FIELDS: readonly RequestableField[];
@@ -85,12 +87,20 @@ export declare class RequestedChangeError extends Error {
     constructor(message: string);
 }
 /**
- * `auto` when `change` is small and safe (`calls`, `storageLimit`,
- * `aiLimit`), the plan it causes has no destructive or migrating step, and
- * it causes no price change on `org`'s own billing fields; `approval`
- * otherwise -- every `domain` or `mailTier` change classifies `approval`
- * unconditionally, since #178 "Decide" calls both migrating steps that
- * always need approval, whatever direction the change moves.
+ * `auto` when `change` is small and safe (`calls`, and `storageLimit`/
+ * `aiLimit` in the lowering or unchanged direction), the plan it causes has
+ * no destructive or migrating step, and it causes no price change on
+ * `org`'s own billing fields; `approval` otherwise -- every `domain` or
+ * `mailTier` change classifies `approval` unconditionally, since #178
+ * "Decide" calls both migrating steps that always need approval, whatever
+ * direction the change moves.
+ *
+ * A `storageLimit` or `aiLimit` change that *raises* either limit
+ * ({@link isLimitRaise} against `org`'s current value) classifies
+ * `approval`, decided in #184: "a raise of the storage or AI limit
+ * classifies `approval` until billing fields exist. A lowering stays
+ * `auto`." `storageLimit` carries two independent limits (`limitBytes`,
+ * `limitMicros`); a raise on either one is enough.
  *
  * `plan` is the {@link PlanDetail} `change` causes -- the caller's own diff
  * against live reality, from the same `computePlanDetail` (`plan/diff.ts`)

package/dist/requested-changes.js

@@ -53,12 +53,37 @@ function priceChanges(_before, _after) {
     return false;
 }
 /**
- * `auto` when `change` is small and safe (`calls`, `storageLimit`,
- * `aiLimit`), the plan it causes has no destructive or migrating step, and
- * it causes no price change on `org`'s own billing fields; `approval`
- * otherwise -- every `domain` or `mailTier` change classifies `approval`
- * unconditionally, since #178 "Decide" calls both migrating steps that
- * always need approval, whatever direction the change moves.
+ * Whether a `StorageConfig`/`AiConfig` limit field moved up from `before` to
+ * `after` -- both are `null`-or-bigint-string, `null` meaning uncapped
+ * (`org.ts`'s `StorageConfig`/`AiConfig` doc). `null` is the largest
+ * possible limit, so moving a capped `before` to an uncapped `after` is a
+ * raise; moving an already-uncapped `before` anywhere is never a raise
+ * (there is nothing higher to move to); two finite values compare as
+ * bigints, never as numbers, the same bigint-safety `org.ts` requires of
+ * these fields. Equal values are not a raise.
+ */
+function isLimitRaise(before, after) {
+    if (before === null)
+        return false;
+    if (after === null)
+        return true;
+    return BigInt(after) > BigInt(before);
+}
+/**
+ * `auto` when `change` is small and safe (`calls`, and `storageLimit`/
+ * `aiLimit` in the lowering or unchanged direction), the plan it causes has
+ * no destructive or migrating step, and it causes no price change on
+ * `org`'s own billing fields; `approval` otherwise -- every `domain` or
+ * `mailTier` change classifies `approval` unconditionally, since #178
+ * "Decide" calls both migrating steps that always need approval, whatever
+ * direction the change moves.
+ *
+ * A `storageLimit` or `aiLimit` change that *raises* either limit
+ * ({@link isLimitRaise} against `org`'s current value) classifies
+ * `approval`, decided in #184: "a raise of the storage or AI limit
+ * classifies `approval` until billing fields exist. A lowering stays
+ * `auto`." `storageLimit` carries two independent limits (`limitBytes`,
+ * `limitMicros`); a raise on either one is enough.
  *
  * `plan` is the {@link PlanDetail} `change` causes -- the caller's own diff
  * against live reality, from the same `computePlanDetail` (`plan/diff.ts`)
@@ -85,9 +110,14 @@ export function classifyChange(org, change, plan) {
         return 'approval';
     switch (change.field) {
         case 'calls':
+            return 'auto';
         case 'storageLimit':
+            return isLimitRaise(org.storage.limitBytes, change.limitBytes) ||
+                isLimitRaise(org.storage.limitMicros, change.limitMicros)
+                ? 'approval'
+                : 'auto';
         case 'aiLimit':
-            return 'auto';
+            return isLimitRaise(org.ai.limitMicros, change.limitMicros) ? 'approval' : 'auto';
         case 'domain':
         case 'mailTier':
             return 'approval';

package/dist/store/audit.d.ts

@@ -1,8 +1,44 @@
 import type { AuditLog } from '../plan/plan-apply.js';
 import type { FoundryStoreDb } from './postgres.js';
 /**
- * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
- * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
- * attached archon reads the same table. It only inserts.
+ * foundry's own {@link AuditLog}, backed by `@wtfalch/audit`'s ledger
+ * (#232) instead of the hand-rolled `foundry_audit_events` table
+ * (`migrations/0012_audit.sql`) this replaces. Every row: `tenantId: null`
+ * (foundry has no tenant of its own -- the org a plan is *for* is the
+ * `target`, not a tenant), `hashChain` on so a changed or deleted row is
+ * detectable (`verifyChain`), through migrations 0024-0028
+ * (`src/migrations/`, copied from `@wtfalch/audit` 0.6.0's own
+ * `migrations/0001-0005`, the same files its own `audit-migrations` CLI
+ * would copy into a host that has a `drizzle/` journal -- foundry does not,
+ * so they are hand-placed at the next free numbers instead).
+ *
+ * The `AuditLog` interface this satisfies is unchanged (`plan-apply.ts`),
+ * so `bootstrap.ts` and `redactingAudit` need no change either.
+ *
+ * Decide (#232, open): whether `foundry_audit_events`' existing rows are
+ * copied into the ledger or left as a closed, separate trail. Left as-is
+ * here -- the simpler default, and the one that forecloses nothing: a
+ * backfill can still be written later, where discarding the old rows
+ * outright could not be undone.
+ *
+ * `checkRuntimeRole` defaults to `false` here, the opposite of
+ * `createLedger`'s own default (#232, needs a human call -- flagged
+ * `ai:needs-human`, not decided here): that check requires the connection
+ * to be a real, restricted `<database>_rt` role, the one 0001's migration
+ * revokes UPDATE/DELETE/TRUNCATE from by name
+ * (`current_database() || '_rt'`). foundry has no such role for its own
+ * database -- `FOUNDRY_DATABASE_URL` is one connection, no owner/runtime
+ * split the way archon's, manage's or lokessmie's own `DATABASE_URL_OWNER`/
+ * `DATABASE_URL` pair is (see #239, the same split for a *hosted* app's
+ * database -- this is foundry's *own*). Leaving the default on would make
+ * every real call throw `UnsafeRuntimeRoleError`, since the revoke in
+ * 0001_audit.sql never ran against whatever role `FOUNDRY_DATABASE_URL`
+ * actually is; the append-only guard and the chain still hold at the
+ * database level regardless (0001's triggers, 0004's hashing), only the
+ * extra fail-closed check on the *connection* is off. Options, not a second
+ * positional argument (`CLAUDE.md` rule 7): a caller -- today only a test
+ * fixture -- can pass `true` once foundry's own database gets that split.
  */
-export declare function createPostgresAuditLog(db: FoundryStoreDb): AuditLog;
+export declare function createPostgresAuditLog(db: FoundryStoreDb, options?: {
+    checkRuntimeRole?: boolean;
+}): AuditLog;

package/dist/store/audit.js

@@ -1,44 +1,129 @@
-import { foundryAuditEvents } from './schema.js';
+import { createLedger, ledgerVocabulary } from '@wtfalch/audit';
 /**
- * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
- * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
- * attached archon reads the same table. It only inserts.
+ * foundry's own closed vocabulary (#232): one event per `AuditLog` method,
+ * `outcome` carrying how it went rather than the action name repeating it
+ * (the same split `@wtfalch/audit`'s own "service with no tenant database"
+ * example uses: `action: 'plan.applied'`, `outcome: 'refused'`). `actor`
+ * has one class, `'operator'`, because `AuditActor` (`plan-apply.ts`) does
+ * not distinguish a human from a service caller -- nothing here guesses
+ * one. `'recorded'` sorts first so it is the default outcome
+ * `plan.computed` rows get (`recordPlan` has no outcome of its own to pass).
  */
-export function createPostgresAuditLog(db) {
+const FOUNDRY_LEDGER_VOCABULARY = ledgerVocabulary({
+    events: {
+        'plan.computed': { tenantVisible: false },
+        'apply.recorded': { tenantVisible: false },
+        'destroy.recorded': { tenantVisible: false },
+    },
+    actorClasses: ['operator'],
+    contexts: ['operator'],
+    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed'],
+});
+/**
+ * The ledger table's CHECKs (migration 0024): reason <= 512 chars, `after`
+ * <= 65536 bytes as jsonb text, actor_display 1-256 chars. A write that
+ * breaks one throws and would hide the apply error being recorded, so each
+ * value is bounded here. Postgres' jsonb text adds a space after every `:`
+ * and `,`, so the plan is measured against half the limit.
+ */
+const MAX_REASON = 512;
+const MAX_AFTER_BYTES = 32768;
+const MAX_DISPLAY = 256;
+function boundReason(reason) {
+    return reason === undefined ? null : reason.slice(0, MAX_REASON);
+}
+function boundDisplay(actor) {
+    return (actor.display || actor.id).slice(0, MAX_DISPLAY);
+}
+function boundPlan(plan) {
+    return Buffer.byteLength(JSON.stringify(plan)) <= MAX_AFTER_BYTES
+        ? plan
+        : { truncated: true, steps: plan.steps.length, unmanaged: plan.unmanaged.length };
+}
+/**
+ * foundry's own {@link AuditLog}, backed by `@wtfalch/audit`'s ledger
+ * (#232) instead of the hand-rolled `foundry_audit_events` table
+ * (`migrations/0012_audit.sql`) this replaces. Every row: `tenantId: null`
+ * (foundry has no tenant of its own -- the org a plan is *for* is the
+ * `target`, not a tenant), `hashChain` on so a changed or deleted row is
+ * detectable (`verifyChain`), through migrations 0024-0028
+ * (`src/migrations/`, copied from `@wtfalch/audit` 0.6.0's own
+ * `migrations/0001-0005`, the same files its own `audit-migrations` CLI
+ * would copy into a host that has a `drizzle/` journal -- foundry does not,
+ * so they are hand-placed at the next free numbers instead).
+ *
+ * The `AuditLog` interface this satisfies is unchanged (`plan-apply.ts`),
+ * so `bootstrap.ts` and `redactingAudit` need no change either.
+ *
+ * Decide (#232, open): whether `foundry_audit_events`' existing rows are
+ * copied into the ledger or left as a closed, separate trail. Left as-is
+ * here -- the simpler default, and the one that forecloses nothing: a
+ * backfill can still be written later, where discarding the old rows
+ * outright could not be undone.
+ *
+ * `checkRuntimeRole` defaults to `false` here, the opposite of
+ * `createLedger`'s own default (#232, needs a human call -- flagged
+ * `ai:needs-human`, not decided here): that check requires the connection
+ * to be a real, restricted `<database>_rt` role, the one 0001's migration
+ * revokes UPDATE/DELETE/TRUNCATE from by name
+ * (`current_database() || '_rt'`). foundry has no such role for its own
+ * database -- `FOUNDRY_DATABASE_URL` is one connection, no owner/runtime
+ * split the way archon's, manage's or lokessmie's own `DATABASE_URL_OWNER`/
+ * `DATABASE_URL` pair is (see #239, the same split for a *hosted* app's
+ * database -- this is foundry's *own*). Leaving the default on would make
+ * every real call throw `UnsafeRuntimeRoleError`, since the revoke in
+ * 0001_audit.sql never ran against whatever role `FOUNDRY_DATABASE_URL`
+ * actually is; the append-only guard and the chain still hold at the
+ * database level regardless (0001's triggers, 0004's hashing), only the
+ * extra fail-closed check on the *connection* is off. Options, not a second
+ * positional argument (`CLAUDE.md` rule 7): a caller -- today only a test
+ * fixture -- can pass `true` once foundry's own database gets that split.
+ */
+export function createPostgresAuditLog(db, options = {}) {
+    const ledger = createLedger({
+        vocabulary: FOUNDRY_LEDGER_VOCABULARY,
+        hashChain: true,
+        checkRuntimeRole: options.checkRuntimeRole ?? false,
+    });
+    const targetFor = (orgId, target) => ({
+        type: target === 'platform' ? 'platform' : 'org',
+        id: orgId,
+    });
     return {
         async recordPlan({ actor, orgId, plan, target, at }) {
-            await db.insert(foundryAuditEvents).values({
-                at,
-                kind: 'plan',
-                actorId: actor.id,
-                actorDisplay: actor.display,
-                orgId,
-                plan,
-                target: target ?? null,
+            await ledger.sign(db, {
+                action: 'plan.computed',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId, target),
+                after: boundPlan(plan),
+                occurredAt: at,
             });
         },
         async recordApply({ actor, orgId, plan, outcome, reason, target, at }) {
-            await db.insert(foundryAuditEvents).values({
-                at,
-                kind: 'apply',
-                actorId: actor.id,
-                actorDisplay: actor.display,
-                orgId,
+            await ledger.sign(db, {
+                action: 'apply.recorded',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId, target),
                 outcome,
-                reason: reason ?? null,
-                plan,
-                target: target ?? null,
+                reason: boundReason(reason),
+                after: boundPlan(plan),
+                occurredAt: at,
             });
         },
         async recordDestroy({ actor, orgId, outcome, reason, at }) {
-            await db.insert(foundryAuditEvents).values({
-                at,
-                kind: 'destroy',
-                actorId: actor.id,
-                actorDisplay: actor.display,
-                orgId,
+            await ledger.sign(db, {
+                action: 'destroy.recorded',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId),
                 outcome,
-                reason: reason ?? null,
+                reason: boundReason(reason),
+                occurredAt: at,
             });
         },
     };

package/dist/store/postgres.js

@@ -1,5 +1,5 @@
 import { asc, eq, sql } from 'drizzle-orm';
-import { validateBuyerIdentity, validateDomain, validateHosting, validateOwner, validateSite, } from '../org.js';
+import { DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateDomain, validateHosting, validateMail, validateOwner, validateSite, } from '../org.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
@@ -59,8 +59,15 @@ function rowToOrg(row) {
         slug: row.slug,
         displayName: row.displayName,
         domain: row.domain,
-        mail: { mode: row.mailMode, usesDomain: row.mailUsesDomain },
-        chat: { usesDomain: row.chatUsesDomain },
+        mail: {
+            mode: row.mailMode,
+            usesDomain: row.mailUsesDomain,
+            ownerMailboxAddress: row.ownerMailboxAddress,
+            noReplyLocalPart: row.noReplyLocalPart,
+            mailApps: row.mailApps,
+            roleMailboxes: row.roleMailboxes,
+        },
+        chat: { enabled: row.chatEnabled, usesDomain: row.chatUsesDomain },
         calls: { enabled: row.callsEnabled, usesDomain: row.callsUsesDomain },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
@@ -73,6 +80,7 @@ function rowToOrg(row) {
             buildPack: row.hostingBuildPack,
             issuerApps: row.hostingIssuerApps,
             accessEmails: row.hostingAccessEmails,
+            appEnv: row.hostingAppEnv,
         },
         sso: { enabled: row.ssoEnabled },
         guests: { enabled: row.guestsEnabled },
@@ -96,6 +104,11 @@ function orgToRow(org) {
         domain: org.domain,
         mailMode: org.mail.mode,
         mailUsesDomain: org.mail.usesDomain,
+        ownerMailboxAddress: org.mail.ownerMailboxAddress ?? null,
+        noReplyLocalPart: org.mail.noReplyLocalPart ?? DEFAULT_NO_REPLY_LOCAL_PART,
+        mailApps: org.mail.mailApps ?? [...DEFAULT_MAIL_APPS],
+        roleMailboxes: org.mail.roleMailboxes ?? [],
+        chatEnabled: org.chat.enabled,
         chatUsesDomain: org.chat.usesDomain,
         callsEnabled: org.calls.enabled,
         callsUsesDomain: org.calls.usesDomain,
@@ -110,6 +123,7 @@ function orgToRow(org) {
         hostingBuildPack: org.hosting.buildPack,
         hostingIssuerApps: org.hosting.issuerApps,
         hostingAccessEmails: org.hosting.accessEmails,
+        hostingAppEnv: org.hosting.appEnv ?? {},
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,
@@ -256,6 +270,16 @@ export function createPostgresDeclaredOrgStore(db) {
         if (reason)
             throw new DeclaredOrgError(`owner invalid: ${reason}`);
     }
+    // #162: same place `requireValidOwner` checks the owner, on both `create`
+    // and the merged result of `update`. Deliberately does not require
+    // `mail.ownerMailboxAddress` just because mail is on -- `validateMail`'s
+    // own doc comment says why. Also covers #34's `mailApps` check, folded
+    // into the same `validateMail`.
+    function requireValidMail(org) {
+        const reason = validateMail(org);
+        if (reason)
+            throw new DeclaredOrgError(`mail invalid: ${reason} (#162)`);
+    }
     return {
         async create(org) {
             requireValidSlug(org.slug);
@@ -265,6 +289,7 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidHosting(org);
             requireValidSite(org);
             requireValidOwner(org);
+            requireValidMail(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
@@ -289,6 +314,12 @@ export function createPostgresDeclaredOrgStore(db) {
             const [row] = await db.select().from(declaredOrgs).where(eq(declaredOrgs.id, id)).limit(1);
             return row ? rowToOrg(row) : null;
         },
+        // #133: ordered by display name, the same `asc(...)` shape
+        // `createPostgresRequestedChangeStore.listForOrg` already uses below.
+        async list() {
+            const rows = await db.select().from(declaredOrgs).orderBy(asc(declaredOrgs.displayName));
+            return rows.map(rowToOrg);
+        },
         async slugTaken(slug) {
             const [row] = await db
                 .select({ id: declaredOrgs.id })
@@ -338,6 +369,7 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidHosting(next);
             requireValidSite(next);
             requireValidOwner(next);
+            requireValidMail(next);
             try {
                 await db
                     .update(declaredOrgs)

package/dist/store/schema.d.ts

@@ -1,4 +1,4 @@
-import type { IssuerApp } from '../org.js';
+import type { AppEnvSource, IssuerApp } from '../org.js';
 import type { Plan } from '../plan.js';
 import type { Checkpoint } from '../state.js';
 /**
@@ -113,6 +113,95 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        ownerMailboxAddress: import("drizzle-orm/pg-core").PgColumn<{
+            name: "owner_mailbox_address";
+            tableName: "foundry_declared_orgs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        noReplyLocalPart: import("drizzle-orm/pg-core").PgColumn<{
+            name: "no_reply_local_part";
+            tableName: "foundry_declared_orgs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        mailApps: import("drizzle-orm/pg-core").PgColumn<{
+            name: "mail_apps";
+            tableName: "foundry_declared_orgs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        roleMailboxes: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_mailboxes";
+            tableName: "foundry_declared_orgs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        chatEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "chat_enabled";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         chatUsesDomain: import("drizzle-orm/pg-core").PgColumn<{
             name: "chat_uses_domain";
             tableName: "foundry_declared_orgs";
@@ -355,6 +444,25 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             $type: string[];
         }>;
+        hostingAppEnv: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hosting_app_env";
+            tableName: "foundry_declared_orgs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, AppEnvSource>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, AppEnvSource>;
+        }>;
         ssoEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sso_enabled";
             tableName: "foundry_declared_orgs";

package/dist/store/schema.js

@@ -12,6 +12,20 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     domain: text('domain'),
     mailMode: text('mail_mode').notNull().default('off'),
     mailUsesDomain: boolean('mail_uses_domain').notNull().default(false),
+    // MailConfig (org.ts, #162). null until an operator declares one -- the
+    // mailbox itself is blocked, not guessed, until it is.
+    ownerMailboxAddress: text('owner_mailbox_address'),
+    // Defaults to 'no-reply', the same literal `0019_mail_owner_mailbox.sql`
+    // and org.ts's `DEFAULT_NO_REPLY_LOCAL_PART` use.
+    noReplyLocalPart: text('no_reply_local_part').notNull().default('no-reply'),
+    // MailConfig.mailApps (org.ts, #34). Which ZITADEL apps in the org's
+    // audience project may read a person's mail; defaults to DEFAULT_MAIL_APPS
+    // ('agora', 'webmail') so every existing org keeps its current behaviour.
+    mailApps: jsonb('mail_apps').notNull().default(['agora', 'webmail']).$type(),
+    // MailConfig.roleMailboxes (org.ts, #230). Local parts of the role mailboxes
+    // pre-created on the org's mail domain; empty by default.
+    roleMailboxes: jsonb('role_mailboxes').notNull().default([]).$type(),
+    chatEnabled: boolean('chat_enabled').notNull().default(false),
     chatUsesDomain: boolean('chat_uses_domain').notNull().default(false),
     callsEnabled: boolean('calls_enabled').notNull().default(false),
     callsUsesDomain: boolean('calls_uses_domain').notNull().default(false),
@@ -28,6 +42,12 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     hostingBuildPack: text('hosting_build_pack').notNull().default('nixpacks'),
     hostingIssuerApps: jsonb('hosting_issuer_apps').notNull().default([]).$type(),
     hostingAccessEmails: jsonb('hosting_access_emails').notNull().default([]).$type(),
+    // HostingConfig.appEnv (org.ts, #243). Maps the app's own env var names to
+    // values the plan already mints; empty by default.
+    hostingAppEnv: jsonb('hosting_app_env')
+        .notNull()
+        .default({})
+        .$type(),
     ssoEnabled: boolean('sso_enabled').notNull().default(false),
     guestsEnabled: boolean('guests_enabled').notNull().default(false),
     soloEnabled: boolean('solo_enabled').notNull().default(false),

package/dist/store.d.ts

@@ -14,6 +14,13 @@ import type { AppliedState } from './state.js';
 export interface DeclaredOrgStore {
     create(org: DeclaredOrg): Promise<void>;
     get(id: OrgId): Promise<DeclaredOrg | null>;
+    /**
+     * Every declared org, ordered by display name (#133). The read path a
+     * billing admin area (or anything else that just wants the roster) uses
+     * instead of reading the store's own table by hand -- Archon's
+     * `listCustomers` was doing exactly that before this existed.
+     */
+    list(): Promise<DeclaredOrg[]>;
     /** Whether any org already holds this slug. `slugFromName` asks it. */
     slugTaken(slug: string): Promise<boolean>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.5.0",
+  "version": "0.7.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -9,7 +9,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "files": ["dist"],
+  "files": ["dist", "versions.json"],
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -37,10 +37,12 @@
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
+    "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/email": "0.15.0",
     "@wtfalch/providers": "0.6.0",
-    "ssh2": "1.17.0"
+    "ssh2": "1.17.0",
+    "zod": "4.6.5"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.8",

package/versions.json

@@ -0,0 +1,8 @@
+{
+  "zitadel": "v4.17.3",
+  "synapse": "v1.161.0",
+  "mas": "1.24.0",
+  "livekit": "latest",
+  "cloudflared": "2026.9.3",
+  "stalwart": "v0.16.24"
+}