@wtfalch/foundry 0.6.0 → 0.7.1

package/dist/bootstrap/declare.d.ts

@@ -7,8 +7,10 @@ export declare const DEFAULT_GIT_REF = "main";
  * The Stalwart image tag the platform's mail step runs. `platform.mail.gitRef`
  * is an image tag, not a git ref, and the planner blocks a floating one
  * (`platform-providers.ts`, `mailImageTagBlocked`), so this is a pinned release.
+ * Pinned in `versions.json` as `stalwart` (#247) -- this is the pattern that
+ * file's loader follows.
  */
-export declare const DEFAULT_MAIL_IMAGE_TAG = "v0.16.24";
+export declare const DEFAULT_MAIL_IMAGE_TAG: string;
 export interface BootstrapCompany {
     name: string;
     slug: string;

package/dist/bootstrap/declare.js

@@ -1,5 +1,6 @@
 import { validateOwner } from '../org.js';
 import { PLATFORM_SERVICE_KEYS, defaultPlatformHostname } from '../platform.js';
+import { VERSIONS } from './versions.js';
 /** Company Included's own org id, the same literal `test/fakes.ts`'s `basePlatform()` uses for `ownerOrgId`. */
 export const COMPANY_INCLUDED_ORG_ID = 'org_company_included';
 export const DEFAULT_GIT_REF = 'main';
@@ -7,8 +8,10 @@ export const DEFAULT_GIT_REF = 'main';
  * The Stalwart image tag the platform's mail step runs. `platform.mail.gitRef`
  * is an image tag, not a git ref, and the planner blocks a floating one
  * (`platform-providers.ts`, `mailImageTagBlocked`), so this is a pinned release.
+ * Pinned in `versions.json` as `stalwart` (#247) -- this is the pattern that
+ * file's loader follows.
  */
-export const DEFAULT_MAIL_IMAGE_TAG = 'v0.16.24';
+export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
 /**
  * Every platform service except `sfu` is enabled, like the other steps: a
  * service whose dependencies the host did not supply is reported blocked, not
@@ -55,11 +58,12 @@ export function declaredCompanyOrg(company, owner) {
             ownerMailboxAddress: null,
             noReplyLocalPart: 'no-reply',
         },
-        chat: { usesDomain: false },
+        chat: { enabled: false, usesDomain: false },
         calls: { enabled: false, usesDomain: false },
         issuer: { usesDomain: false },
         site: { enabled: false, usesDomain: false },
         hosting: {
+            appEnv: {},
             enabled: false,
             usesDomain: false,
             database: false,

package/dist/bootstrap/versions.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The estate's pinned third-party image/release refs for the platform
+ * services foundry provisions (#247). One JSON file, so Renovate can read
+ * and later propose bumps against it, instead of four separate string
+ * constants it cannot see. `postgres` has no entry here: no planner step
+ * pins a postgres image tag today, so there is no ref to record yet.
+ */
+export interface PinnedVersions {
+    zitadel: string;
+    synapse: string;
+    mas: string;
+    livekit: string;
+    cloudflared: string;
+    stalwart: string;
+}
+export declare function loadVersions(): PinnedVersions;
+export declare const VERSIONS: PinnedVersions;

package/dist/bootstrap/versions.js

@@ -0,0 +1,12 @@
+import { readFileSync } from 'node:fs';
+/**
+ * Read at module load from `versions.json`, which sits beside this
+ * package's `package.json` (not under `src`, so plain JSON import would
+ * fight `tsconfig.build.json`'s `rootDir`) and ships in the published
+ * tarball via `package.json`'s `files`.
+ */
+const VERSIONS_PATH = new URL('../../versions.json', import.meta.url);
+export function loadVersions() {
+    return JSON.parse(readFileSync(VERSIONS_PATH, 'utf8'));
+}
+export const VERSIONS = loadVersions();

package/dist/calls-sfu.d.ts

@@ -116,11 +116,12 @@ export declare const CLOUDFLARED_ENV_PATH = "/opt/livekit/cloudflared.env";
 /**
  * `:latest`, matching this codebase's one other pinned-by-tag-only image
  * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet.
+ * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
+ * `versions.json` (#247).
  */
-export declare const LIVEKIT_IMAGE_REF = "livekit/livekit-server:latest";
-/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export declare const CLOUDFLARED_IMAGE_REF = "cloudflare/cloudflared:2026.9.3";
+export declare const LIVEKIT_IMAGE_REF: string;
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */
+export declare const CLOUDFLARED_IMAGE_REF: string;
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export declare const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */

package/dist/calls-sfu.js

@@ -52,6 +52,7 @@
  * `calls-sfu-deploy-support.ts`'s `fileWriteMode`), never logged, scrubbed
  * from any error `calls-sfu-deploy.mjs` prints.
  */
+import { VERSIONS } from './bootstrap/versions.js';
 // ---------------------------------------------------------------------------
 // The guard
 // ---------------------------------------------------------------------------
@@ -105,11 +106,12 @@ export const CLOUDFLARED_ENV_PATH = '/opt/livekit/cloudflared.env';
 /**
  * `:latest`, matching this codebase's one other pinned-by-tag-only image
  * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet.
+ * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
+ * `versions.json` (#247).
  */
-export const LIVEKIT_IMAGE_REF = 'livekit/livekit-server:latest';
-/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export const CLOUDFLARED_IMAGE_REF = 'cloudflare/cloudflared:2026.9.3';
+export const LIVEKIT_IMAGE_REF = `livekit/livekit-server:${VERSIONS.livekit}`;
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */
+export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */

package/dist/index.d.ts

@@ -20,8 +20,8 @@ export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, } from './plan/index.js';
-export { FoundryStepExecutor, NotBuiltError, healthUrls } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';

package/dist/index.js

@@ -8,7 +8,7 @@ export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredP
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export { FoundryStepExecutor, NotBuiltError, healthUrls } from './plan/index.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';

package/dist/migrations/0022_chat_enabled.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: chat is not in v1 (decided 2026-10-01). Mirrors
+-- `src/store/schema.ts`'s `chatEnabled`. Defaults false, so every existing org
+-- reads as chat off and `apply` leaves any live chat resource alone.
+
+alter table foundry_declared_orgs
+  add column if not exists chat_enabled boolean not null default false;

package/dist/migrations/0023_hosting_app_env.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: the bespoke app's own env var names for values the plan
+-- already mints (Files, AI, mail), each a key `pushAppEnv` resolves (#243).
+-- Mirrors `src/store/schema.ts`'s `hostingAppEnv`. Defaults to an empty
+-- object so every existing org keeps its current behaviour: no app env
+-- pushed from this map.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_app_env jsonb not null default '{}'::jsonb;

package/dist/migrations/0024_audit_events.sql

@@ -0,0 +1,211 @@
+-- Cutover from foundry_audit_events (0012_audit.sql): it stops receiving writes
+-- from this migration on, and its old rows are left in place.
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: the append-only audit ledger. Mirrors src/tables.ts.
+--
+-- Every statement is idempotent. Applied by the host's own migrate script
+-- after the host copies this file into its drizzle/ directory as the next
+-- number (audit-migrations); never edited there.
+--
+-- What this file enforces is the ledger's SHAPE and its WALLS: bounded
+-- columns, JSON under 64 KB, the pairs that must appear together, the
+-- break-glass rule that a session row carries its session, reason and
+-- reference, and the three triggers plus the runtime-role revoke that make
+-- "append-only" true for a role that is not a superuser. The CLOSED SETS
+-- (which event names, actor classes, contexts, outcomes and reason codes a
+-- host admits) are the host's own vocabulary: enforced in TypeScript by the
+-- ledger at write time, and in the database by the host's own CHECKs when it
+-- has them (wtfalch/app-template's 0003 and 0007 do). A host with only this
+-- file gets the shape and the walls.
+--
+-- Estate-shaped: the DO block assumes a runtime role named <database>_rt that
+-- owns nothing and serves the app. Without it, the tables and the function
+-- exist and no revoke takes effect.
+--
+-- No foreign keys, on purpose: the trail outlives the tenant, the person and
+-- the credential it describes. `tenant_id` is a uuid because the estate's
+-- tenants are; a host with other ids alters the column in its own migration.
+
+create table if not exists audit_events (
+  id              bigint generated always as identity primary key,
+  occurred_at     timestamptz not null default now(),
+  tenant_id       uuid,
+  actor_class     text not null,
+  actor_id        text not null,
+  actor_display   text not null,
+  action          text not null,
+  target_type     text not null,
+  target_id       text not null,
+  outcome         text not null,
+  context         text not null,
+  session_id      text,
+  reason          text,
+  reference       text,
+  request_id      text,
+  ip              text,
+  user_agent      text,
+  tenant_visible  boolean not null,
+  before          jsonb,
+  after           jsonb,
+  -- Set by audit_erase_person. The row and actor_id survive; who that was
+  -- does not, once this is set.
+  erased_at       timestamptz,
+  schema_version  smallint not null default 1,
+  -- The principal the event was ABOUT, when that is not the actor: an
+  -- invitation's invitee, a membership's holder. What lets "events affecting
+  -- me" be answered without guessing from payloads.
+  subject_class   text,
+  subject_id      text,
+  constraint audit_events_actor_class_check check (length(actor_class) between 1 and 64),
+  constraint audit_events_actor_id_check check (length(actor_id) between 1 and 256),
+  constraint audit_events_actor_display_check check (length(actor_display) between 1 and 256),
+  constraint audit_events_action_shape_check check (action ~ '^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$'),
+  constraint audit_events_target_type_check check (length(target_type) between 1 and 64),
+  constraint audit_events_target_id_check check (length(target_id) between 1 and 256),
+  constraint audit_events_outcome_check check (length(outcome) between 1 and 32),
+  constraint audit_events_context_check check (length(context) between 1 and 32),
+  constraint audit_events_session_id_check check (session_id is null or length(session_id) <= 256),
+  constraint audit_events_reason_check check (reason is null or length(reason) <= 512),
+  constraint audit_events_reference_check check (reference is null or length(reference) <= 512),
+  constraint audit_events_request_id_check check (request_id is null or length(request_id) <= 128),
+  constraint audit_events_ip_check check (ip is null or length(ip) <= 64),
+  constraint audit_events_user_agent_check check (user_agent is null or length(user_agent) <= 1024),
+  constraint audit_events_before_check check (before is null or octet_length(before::text) <= 65536),
+  constraint audit_events_after_check check (after is null or octet_length(after::text) <= 65536),
+  -- A support-session row names its session, its reason and its reference.
+  -- Which reasons are admissible is the host's closed set.
+  constraint audit_events_break_glass_shape_check check (
+    context <> 'break_glass'
+    or (session_id is not null and reason is not null and reference is not null)
+  ),
+  constraint audit_events_subject_pair_check check ((subject_id is null) = (subject_class is null)),
+  constraint audit_events_subject_class_check check (subject_class is null or length(subject_class) between 1 and 64),
+  constraint audit_events_subject_id_check check (subject_id is null or length(subject_id) between 1 and 256)
+);
+
+-- (occurred_at, id) is the ordering; every reader pages on it.
+create index if not exists audit_events_tenant_time_idx
+  on audit_events (tenant_id, occurred_at desc, id desc);
+create index if not exists audit_events_actor_time_idx
+  on audit_events (actor_id, occurred_at desc);
+create index if not exists audit_events_action_time_idx
+  on audit_events (action, occurred_at desc);
+create index if not exists audit_events_subject_time_idx
+  on audit_events (subject_class, subject_id, occurred_at desc, id desc) where subject_id is not null;
+create index if not exists audit_events_request_idx
+  on audit_events (request_id, occurred_at desc) where request_id is not null;
+
+-- The second wall. The first is the revoke below, which stops the server; this
+-- stops the owner's own mistakes at a psql prompt. An UPDATE may change only
+-- the four columns erasure touches, and DELETE and TRUNCATE are refused
+-- outright. audit_erase_person passes through this trigger, not around it.
+create or replace function audit_events_guard() returns trigger
+language plpgsql as $$
+begin
+  if tg_op = 'DELETE' then
+    raise exception 'audit_events is append-only: delete refused';
+  elsif tg_op = 'TRUNCATE' then
+    raise exception 'audit_events is append-only: truncate refused';
+  elsif tg_op = 'UPDATE' then
+    if new.id is distinct from old.id
+      or new.occurred_at is distinct from old.occurred_at
+      or new.tenant_id is distinct from old.tenant_id
+      or new.actor_class is distinct from old.actor_class
+      or new.actor_id is distinct from old.actor_id
+      or new.action is distinct from old.action
+      or new.target_type is distinct from old.target_type
+      or new.target_id is distinct from old.target_id
+      or new.outcome is distinct from old.outcome
+      or new.context is distinct from old.context
+      or new.session_id is distinct from old.session_id
+      or new.reason is distinct from old.reason
+      or new.reference is distinct from old.reference
+      or new.request_id is distinct from old.request_id
+      or new.ip is distinct from old.ip
+      or new.user_agent is distinct from old.user_agent
+      or new.tenant_visible is distinct from old.tenant_visible
+      or new.schema_version is distinct from old.schema_version
+      or new.subject_class is distinct from old.subject_class
+      or new.subject_id is distinct from old.subject_id
+    then
+      raise exception 'audit_events is append-only: only actor_display, before, after and erased_at may change';
+    end if;
+  end if;
+  return new;
+end
+$$;
+drop trigger if exists audit_events_guarded_update on audit_events;
+create trigger audit_events_guarded_update
+  before update on audit_events
+  for each row execute function audit_events_guard();
+drop trigger if exists audit_events_no_delete on audit_events;
+create trigger audit_events_no_delete
+  before delete on audit_events
+  for each row execute function audit_events_guard();
+drop trigger if exists audit_events_no_truncate on audit_events;
+create trigger audit_events_no_truncate
+  before truncate on audit_events
+  for each statement execute function audit_events_guard();
+
+-- The one sanctioned write. Rows the person wrote (actor_id), rows written
+-- about them (subject_id), and rows whose payload carries their address:
+-- actor_display becomes the pseudonym on their own rows, before and after
+-- are replaced wholesale on every matched row, erased_at is set. actor_id
+-- and subject_id stay, so "somebody with this id did this" survives and
+-- "who that was" does not. Row counts never change. Ledger-only: a host's
+-- own tables (a profile, an invitation) are the host's to clean, in the same
+-- transaction, and its final `person.erased` row is written after this.
+create or replace function audit_erase_person(subject text, pseudonym text, subject_email text)
+returns integer
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+declare
+  touched integer;
+begin
+  if subject is null or length(subject) = 0 then
+    raise exception 'audit_erase_person: a subject id is required';
+  end if;
+  if pseudonym is null or length(pseudonym) = 0 or length(pseudonym) > 256 then
+    raise exception 'audit_erase_person: a pseudonym of 1 to 256 characters is required';
+  end if;
+  update audit_events
+     set actor_display = case when actor_id = subject then pseudonym else actor_display end,
+         before = case when before is null then null else '{"erased":true}'::jsonb end,
+         after = case when after is null then null else '{"erased":true}'::jsonb end,
+         erased_at = now()
+   where erased_at is null
+     and (
+       actor_id = subject
+       or subject_id = subject
+       or (
+         subject_email is not null
+         and length(subject_email) > 0
+         and (
+           lower(coalesce(before::text, '')) like '%' || lower(subject_email) || '%'
+           or lower(coalesce(after::text, '')) like '%' || lower(subject_email) || '%'
+         )
+       )
+     );
+  get diagnostics touched = row_count;
+  return touched;
+end
+$$;
+revoke all on function audit_erase_person(text, text, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('revoke update, delete, truncate on audit_events from %I', rt);
+    execute format('grant execute on function audit_erase_person(text, text, text) to %I', rt);
+  end if;
+end
+$$;

package/dist/migrations/0025_audit_display.sql

@@ -0,0 +1,147 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit 0.4.0: what the target and the tenant were CALLED.
+--
+-- Mirrors src/tables.ts. Every statement is idempotent. Applied by the host's
+-- own migrate script after the host copies this file into its drizzle/
+-- directory as the next number (audit-migrations); never edited there.
+--
+-- WHY THE NAME LIVES ON THE ROW
+-- -----------------------------
+-- A reader of the trail wants to know what happened to WHAT. Looking the name
+-- up when the page renders answers that exactly until it matters: the file was
+-- deleted, the organisation was closed, the key was revoked -- and those are
+-- the rows a trail exists for. So the name is written with the row and never
+-- read from anywhere else afterwards.
+--
+-- Both columns are nullable and stay nullable: every row written before this
+-- migration has no name, and a writer that holds only an id is not made to
+-- invent one. A reader shows the id when the name is null.
+--
+-- These are NOT a rename of target_id or tenant_id. The ids stay the identity;
+-- the names are what they were called at the time, and a later rename does not
+-- reach back.
+--
+-- ERASURE
+-- -------
+-- A target can be a person: an invitation's invitee, a membership's holder.
+-- Its name is then personal data sitting in a row that outlives the account,
+-- so audit_erase_person pseudonymises target_display exactly as it already
+-- pseudonymises actor_display: on the rows it already erases, and only where
+-- target_id is the subject. Which rows those are is unchanged on purpose. A
+-- row whose target is a person is expected to carry subject_id, which is what
+-- the match already looks at; a row that sets neither subject_id nor an email
+-- in its payload was already outside erasure's reach before this file, and
+-- widening the match here would erase rows 0001 deliberately did not.
+-- tenant_display names an organisation, not a person, and is left alone; it is
+-- therefore added to the guard's immutable list, so nothing can edit it after
+-- the fact the way a correction would.
+
+alter table audit_events add column if not exists target_display text;
+alter table audit_events add column if not exists tenant_display text;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_target_display_check
+    check (target_display is null or length(target_display) between 1 and 256);
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_tenant_display_check
+    check (tenant_display is null or length(tenant_display) between 1 and 256);
+exception when duplicate_object then null; end $$;
+
+-- 0001's guard, with tenant_display added to the columns an update may not
+-- change. target_display is absent from the list for the same reason
+-- actor_display is: erasure rewrites it.
+create or replace function audit_events_guard() returns trigger
+language plpgsql as $$
+begin
+  if tg_op = 'DELETE' then
+    raise exception 'audit_events is append-only: delete refused';
+  elsif tg_op = 'TRUNCATE' then
+    raise exception 'audit_events is append-only: truncate refused';
+  elsif tg_op = 'UPDATE' then
+    if new.id is distinct from old.id
+      or new.occurred_at is distinct from old.occurred_at
+      or new.tenant_id is distinct from old.tenant_id
+      or new.tenant_display is distinct from old.tenant_display
+      or new.actor_class is distinct from old.actor_class
+      or new.actor_id is distinct from old.actor_id
+      or new.action is distinct from old.action
+      or new.target_type is distinct from old.target_type
+      or new.target_id is distinct from old.target_id
+      or new.outcome is distinct from old.outcome
+      or new.context is distinct from old.context
+      or new.session_id is distinct from old.session_id
+      or new.reason is distinct from old.reason
+      or new.reference is distinct from old.reference
+      or new.request_id is distinct from old.request_id
+      or new.ip is distinct from old.ip
+      or new.user_agent is distinct from old.user_agent
+      or new.tenant_visible is distinct from old.tenant_visible
+      or new.schema_version is distinct from old.schema_version
+      or new.subject_class is distinct from old.subject_class
+      or new.subject_id is distinct from old.subject_id
+    then
+      raise exception 'audit_events is append-only: only actor_display, target_display, before, after and erased_at may change';
+    end if;
+  end if;
+  return new;
+end
+$$;
+
+-- 0001's erasure function, extended to the target's name. Everything else is
+-- unchanged: same subject match, same pseudonym bounds, same return.
+create or replace function audit_erase_person(subject text, pseudonym text, subject_email text)
+returns integer
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+declare
+  touched integer;
+begin
+  if subject is null or length(subject) = 0 then
+    raise exception 'audit_erase_person: a subject id is required';
+  end if;
+  if pseudonym is null or length(pseudonym) = 0 or length(pseudonym) > 256 then
+    raise exception 'audit_erase_person: a pseudonym of 1 to 256 characters is required';
+  end if;
+  update audit_events
+     set actor_display = case when actor_id = subject then pseudonym else actor_display end,
+         target_display = case when target_id = subject then pseudonym else target_display end,
+         before = case when before is null then null else '{"erased":true}'::jsonb end,
+         after = case when after is null then null else '{"erased":true}'::jsonb end,
+         erased_at = now()
+   where erased_at is null
+     and (
+       actor_id = subject
+       or subject_id = subject
+       or (
+         subject_email is not null
+         and (before::text like '%' || subject_email || '%' or after::text like '%' || subject_email || '%')
+       )
+     );
+  get diagnostics touched = row_count;
+  return touched;
+end
+$$;
+
+revoke all on function audit_erase_person(text, text, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('revoke update, delete, truncate on audit_events from %I', rt);
+    execute format('grant execute on function audit_erase_person(text, text, text) to %I', rt);
+  end if;
+end
+$$;

package/dist/migrations/0026_audit_erase_email_guard.sql

@@ -0,0 +1,78 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: restore audit_erase_person's empty-email guard.
+--
+-- Mirrors src/ledger.ts's erase(). Every statement is idempotent. Applied by
+-- the host's own migrate script after the host copies this file into its
+-- drizzle/ directory as the next number (audit-migrations); never edited
+-- there.
+--
+-- REGRESSION
+-- ----------
+-- 0002_display.sql's audit_erase_person dropped two things 0001_audit.sql
+-- had: the `length(subject_email) > 0` guard and the lower() case-fold on
+-- both the column and the match value. Without the length guard, an empty
+-- string reaches the SQL LIKE match as `like '%%'`, which matches every
+-- row's before/after text -- on every tenant, not just the subject's. This
+-- file cannot edit 0002 (shipped migrations don't change); it re-defines
+-- the function, which `create or replace` makes safe to apply on top.
+--
+-- Everything else about the function is unchanged from 0002: same subject
+-- and subject_id match, same pseudonym bounds, same target_display and
+-- actor_display pseudonymisation, same return.
+
+create or replace function audit_erase_person(subject text, pseudonym text, subject_email text)
+returns integer
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+declare
+  touched integer;
+begin
+  if subject is null or length(subject) = 0 then
+    raise exception 'audit_erase_person: a subject id is required';
+  end if;
+  if pseudonym is null or length(pseudonym) = 0 or length(pseudonym) > 256 then
+    raise exception 'audit_erase_person: a pseudonym of 1 to 256 characters is required';
+  end if;
+  update audit_events
+     set actor_display = case when actor_id = subject then pseudonym else actor_display end,
+         target_display = case when target_id = subject then pseudonym else target_display end,
+         before = case when before is null then null else '{"erased":true}'::jsonb end,
+         after = case when after is null then null else '{"erased":true}'::jsonb end,
+         erased_at = now()
+   where erased_at is null
+     and (
+       actor_id = subject
+       or subject_id = subject
+       or (
+         subject_email is not null
+         and length(subject_email) > 0
+         and (
+           lower(coalesce(before::text, '')) like '%' || lower(subject_email) || '%'
+           or lower(coalesce(after::text, '')) like '%' || lower(subject_email) || '%'
+         )
+       )
+     );
+  get diagnostics touched = row_count;
+  return touched;
+end
+$$;
+
+revoke all on function audit_erase_person(text, text, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('revoke update, delete, truncate on audit_events from %I', rt);
+    execute format('grant execute on function audit_erase_person(text, text, text) to %I', rt);
+  end if;
+end
+$$;