@wtfalch/foundry 0.6.0 → 0.7.1

package/dist/plan/platform-diff.d.ts

@@ -1,4 +1,4 @@
-import type { OrgId } from '../org.js';
+import type { DeclaredOrg, OrgId } from '../org.js';
 import type { Plan, UnmanagedItem } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { PlannedStep } from './diff.js';
@@ -268,6 +268,28 @@ export declare function platformMailMxHost(apex: string): string;
  */
 export declare const ORG_MAIL_APPLIED_APEX_SCOPE_KEY = "mail_applied_apex";
 export declare const ORG_MAIL_APPLIED_HOST_SCOPE_KEY = "mail_applied_host";
+/**
+ * #243: the org's `hosting.appEnv` values the last `coolify:app` apply pushed,
+ * recorded as one JSON object (env name to value; ids and a domain, never a
+ * secret). `planApp` plans the step again when {@link resolveAppEnv} differs
+ * from it, so a changed map reaches an app that is already live.
+ */
+export declare const APP_ENV_APPLIED_SCOPE_KEY = "app_env_applied";
+/**
+ * #239: set to '1' once an app has been restarted after its database URLs
+ * were pushed. Not a URL. Without it a crash between the push and the restart
+ * would leave a stale container that no plan notices.
+ */
+export declare const DB_ENV_APPLIED_SCOPE_KEY = "db_env_applied";
+/**
+ * The `hosting.appEnv` entries whose source has a recorded value, in env-name
+ * order, and the env names whose source has none yet. Shared by `planApp` and
+ * the executor's `pushAppEnv` so both read the same recorded ids.
+ */
+export declare function resolveAppEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): {
+    values: Record<string, string>;
+    unresolved: Array<[string, string]>;
+};
 /**
  * #172: the resource key `planAi` plans under and `FoundryPlatformStepExecutor`
  * dispatches on, the same `platform:<service>` shape as

package/dist/plan/platform-diff.js

@@ -273,6 +273,41 @@ export function platformMailMxHost(apex) {
  */
 export const ORG_MAIL_APPLIED_APEX_SCOPE_KEY = 'mail_applied_apex';
 export const ORG_MAIL_APPLIED_HOST_SCOPE_KEY = 'mail_applied_host';
+/**
+ * #243: the org's `hosting.appEnv` values the last `coolify:app` apply pushed,
+ * recorded as one JSON object (env name to value; ids and a domain, never a
+ * secret). `planApp` plans the step again when {@link resolveAppEnv} differs
+ * from it, so a changed map reaches an app that is already live.
+ */
+export const APP_ENV_APPLIED_SCOPE_KEY = 'app_env_applied';
+/**
+ * #239: set to '1' once an app has been restarted after its database URLs
+ * were pushed. Not a URL. Without it a crash between the push and the restart
+ * would leave a stale container that no plan notices.
+ */
+export const DB_ENV_APPLIED_SCOPE_KEY = 'db_env_applied';
+/**
+ * The `hosting.appEnv` entries whose source has a recorded value, in env-name
+ * order, and the env names whose source has none yet. Shared by `planApp` and
+ * the executor's `pushAppEnv` so both read the same recorded ids.
+ */
+export function resolveAppEnv(org, recorded) {
+    const sources = {
+        filesOrganisationId: recorded[`files:organisation:${org.id}`],
+        aiOrganisationId: recorded[`ai:organisation:${org.id}`],
+        mailDomain: recorded.mail_domain,
+    };
+    const values = {};
+    const unresolved = [];
+    for (const [name, source] of Object.entries(org.hosting.appEnv).sort(([a], [b]) => a < b ? -1 : 1)) {
+        const value = sources[source];
+        if (value)
+            values[name] = value;
+        else
+            unresolved.push([name, source]);
+    }
+    return { values, unresolved };
+}
 /**
  * #172: the resource key `planAi` plans under and `FoundryPlatformStepExecutor`
  * dispatches on, the same `platform:<service>` shape as

package/dist/plan/platform-providers.d.ts

@@ -291,7 +291,7 @@ export interface PlatformMailRuntime {
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy'>;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord' | 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'deleteAccessApp'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp'>;

package/dist/plan/platform-providers.js

@@ -1,5 +1,6 @@
 import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, randomUUID, sign, } from 'node:crypto';
 import { isIPv4 } from 'node:net';
+import { VERSIONS } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { ACCESS_POLICY_NAME, isNotFoundError, isRunningOrStarting } from './executor.js';
@@ -439,9 +440,9 @@ const PLATFORM_AUTH_BROKER_INTERNAL_NAME = 'platform-auth-broker';
 const PLATFORM_AUTH_TUNNEL_NAME = 'platform-auth-tunnel';
 /** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_AUTH_TUNNEL_NAME}. */
 const PLATFORM_AUTH_CLOUDFLARED_APP_NAME = 'platform-auth-cloudflared';
-/** `wtfalch/auth`'s `docker-compose.yml`: `image: ghcr.io/zitadel/zitadel:${ZITADEL_VERSION:-v4.17.3}`. */
+/** `wtfalch/auth`'s `docker-compose.yml`: `image: ghcr.io/zitadel/zitadel:${ZITADEL_VERSION:-v4.17.3}`. Pinned in `versions.json` (#247). */
 const AUTH_ZITADEL_IMAGE = 'ghcr.io/zitadel/zitadel';
-const AUTH_ZITADEL_IMAGE_TAG = 'v4.17.3';
+const AUTH_ZITADEL_IMAGE_TAG = VERSIONS.zitadel;
 /** `wtfalch/auth`'s own `login/Dockerfile` -- `docs/deploy.md`'s "One compose service, four containers... Two images are built from this repository: the proxy... and the login". */
 const AUTH_REPO = 'wtfalch/auth';
 const AUTH_LOGIN_DOCKERFILE = 'login/Dockerfile';
@@ -1848,19 +1849,32 @@ async function provisionPlatformArchon(context, deps) {
         await record(PLATFORM_ARCHON_PROJECT_SCOPE_KEY, projectUuid);
     }
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
+    // #265: a database already named `platform-archon-db` (the hand-deployed
+    // one) is adopted, never built a second time. One of that name in another
+    // environment is refused: adopting or duplicating it would split the data.
     let dbId = recorded[PLATFORM_ARCHON_DB_SCOPE_KEY];
     if (!dbId) {
-        const server = await resolvePlatformServer(deps.coolify);
-        const created = await deps.coolify.createPostgresDatabase({
-            project_uuid: projectUuid,
-            server_uuid: server.uuid,
-            environment_name: environment.name,
-            environment_uuid: environment.uuid,
-            name: PLATFORM_ARCHON_DB_NAME,
-            postgres_db: ARCHON_POSTGRES_DB,
-            postgres_user: ARCHON_POSTGRES_DB,
-        });
-        dbId = created.uuid;
+        const named = (await deps.coolify.listDatabases()).filter((d) => d.name === PLATFORM_ARCHON_DB_NAME);
+        const found = named.find((d) => d.environment_id === environment.id);
+        if (!found && named.length > 0) {
+            throw new Error(`platform:archon: a database named ${PLATFORM_ARCHON_DB_NAME} exists outside the ${PLATFORM_ARCHON_PROJECT} project's production environment; refusing to adopt or duplicate it. Move or rename it in Coolify and apply again`);
+        }
+        if (found) {
+            dbId = found.uuid;
+        }
+        else {
+            const server = await resolvePlatformServer(deps.coolify);
+            const created = await deps.coolify.createPostgresDatabase({
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                name: PLATFORM_ARCHON_DB_NAME,
+                postgres_db: ARCHON_POSTGRES_DB,
+                postgres_user: ARCHON_POSTGRES_DB,
+            });
+            dbId = created.uuid;
+        }
         await record(PLATFORM_ARCHON_DB_SCOPE_KEY, dbId);
     }
     const db = await deps.coolify.getDatabase(dbId);
@@ -1869,6 +1883,12 @@ async function provisionPlatformArchon(context, deps) {
     }
     // ---- the app ----------------------------------------------------------------
     const app = await findOrCreatePlatformApp(deps.coolify, PLATFORM_ARCHON_APP_NAME, environment, async () => {
+        // #265: the lookup above is scoped to this environment, so a same-named
+        // app elsewhere is invisible to it. Making another one would give two
+        // `platform-archon` apps; refuse instead.
+        if (await deps.coolify.findApplicationByName(PLATFORM_ARCHON_APP_NAME)) {
+            throw new Error(`platform:archon: an application named ${PLATFORM_ARCHON_APP_NAME} exists outside the ${PLATFORM_ARCHON_PROJECT} project's production environment; refusing to create a second one. Move or rename it in Coolify and apply again`);
+        }
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
@@ -1944,9 +1964,20 @@ async function provisionPlatformArchon(context, deps) {
         { key: 'AUTH_ISSUER', value: issuer },
         { key: 'AUTH_ORGANIZATION_ID', value: org.id },
         { key: 'AUTH_CLIENT_ID', value: clientId },
-        { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
-        { key: 'REPORTING_SITE', value: 'archon' },
     ];
+    // #265: an owner URL or reporting site already on the app is kept as it is.
+    // The owner URL must name the adopted database's host, or the app's two
+    // database URLs would point at different databases.
+    const liveOwnerUrl = await currentEnvValue(deps.coolify, appId, 'DATABASE_URL_OWNER');
+    if (liveOwnerUrl) {
+        assertSameDatabaseHost('DATABASE_URL_OWNER', liveOwnerUrl, db.internal_db_url);
+    }
+    else {
+        envs.push({ key: 'DATABASE_URL_OWNER', value: db.internal_db_url });
+    }
+    if (!(await currentEnvValue(deps.coolify, appId, 'REPORTING_SITE'))) {
+        envs.push({ key: 'REPORTING_SITE', value: 'archon' });
+    }
     const cookieSecret = await ensureGeneratedEnv(deps.coolify, appId, 'AUTH_COOKIE_SECRET', () => randomBytes(32).toString('base64'));
     if (cookieSecret)
         envs.push({ key: 'AUTH_COOKIE_SECRET', value: cookieSecret });
@@ -2591,10 +2622,34 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
  * `base64url` fits `db-runtime-role.sh`'s password alphabet
  * (`A-Za-z0-9_.~-`).
  */
+/**
+ * #265: throws when `liveUrl` points at another host than the adopted
+ * database. Names both hosts and nothing else: a URL carries a credential, and
+ * Node's parse error echoes its whole input.
+ */
+function assertSameDatabaseHost(key, liveUrl, dbInternalUrl) {
+    const hostOf = (url) => {
+        try {
+            return new URL(url).host;
+        }
+        catch {
+            return null;
+        }
+    };
+    const liveHost = hostOf(liveUrl);
+    const dbHost = hostOf(dbInternalUrl);
+    if (liveHost !== dbHost) {
+        throw new Error(`platform:archon: ${key} on the app points at host ${liveHost ?? '(unparseable)'}, but the adopted database ${PLATFORM_ARCHON_DB_NAME} is at host ${dbHost ?? '(unparseable)'}; refusing to leave the app's database URLs on different databases`);
+    }
+}
 async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
     const envs = await coolify.listEnvs(appId);
-    if (envs.some((e) => e.key === 'DATABASE_URL' && !e.is_preview))
+    const live = envs.find((e) => e.key === 'DATABASE_URL' && !e.is_preview);
+    if (live) {
+        // #265: kept as it is, but it must name the adopted database's host.
+        assertSameDatabaseHost('DATABASE_URL', live.value, dbInternalUrl);
         return null;
+    }
     let host;
     let pathname;
     let search;

package/dist/plan/providers-readers.js

@@ -130,6 +130,47 @@ async function withLogVolumeConfig(client, resource, recorded) {
         return resource;
     }
 }
+/**
+ * #239: whether a recorded database has an internal connection URL, as
+ * `config.hasInternalUrl` (a boolean, never the URL), so `planApp` can report
+ * a database it cannot push from as blocked. A failed read leaves it absent.
+ */
+async function withDatabaseUrlConfig(client, resource, recorded) {
+    if (resource.kind !== 'database' || !recorded[resource.key]?.startsWith('database:')) {
+        return resource;
+    }
+    try {
+        const db = await client.getDatabase(resource.key);
+        return {
+            ...resource,
+            config: { ...resource.config, hasInternalUrl: Boolean(db.internal_db_url) },
+        };
+    }
+    catch {
+        return resource;
+    }
+}
+/**
+ * #239: the live env var NAMES (never values) of the org's own recorded app,
+ * as `config.envNames`, so `diff.ts`'s `planApp` can notice an app that
+ * lacks `DATABASE_URL_OWNER`. Failure is swallowed like
+ * {@link withLogVolumeConfig}: `envNames` stays absent and the planner reads
+ * that as nothing checked.
+ */
+async function withEnvNamesConfig(client, resource, recorded) {
+    if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('app:')) {
+        return resource;
+    }
+    try {
+        const envNames = (await client.listEnvs(resource.key))
+            .filter((e) => !e.is_preview)
+            .map((e) => e.key);
+        return { ...resource, config: { ...resource.config, envNames } };
+    }
+    catch {
+        return resource;
+    }
+}
 /**
  * #164: the org's own recorded Agora app's live `AGORA_*` env vars, as
  * `config.env`, so `diff.ts`'s `planAgora` can compare them with what
@@ -177,7 +218,9 @@ export class ProvidersCoolifyReader {
             this.resolveRecordedIds(orgId),
         ]);
         const withLogConfig = await Promise.all(toFoundryResources('coolify', resources).map((r) => withLogVolumeConfig(this.client, r, recorded)));
-        const withAgoraConfig = await Promise.all(withLogConfig.map((r) => withAgoraEnvConfig(this.client, r, recorded)));
+        const withEnvNames = await Promise.all(withLogConfig.map((r) => withEnvNamesConfig(this.client, r, recorded)));
+        const withDbUrl = await Promise.all(withEnvNames.map((r) => withDatabaseUrlConfig(this.client, r, recorded)));
+        const withAgoraConfig = await Promise.all(withDbUrl.map((r) => withAgoraEnvConfig(this.client, r, recorded)));
         return applyRecordedIds(withAgoraConfig, recorded);
     }
 }

package/dist/store/audit.d.ts

@@ -1,8 +1,44 @@
 import type { AuditLog } from '../plan/plan-apply.js';
 import type { FoundryStoreDb } from './postgres.js';
 /**
- * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
- * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
- * attached archon reads the same table. It only inserts.
+ * foundry's own {@link AuditLog}, backed by `@wtfalch/audit`'s ledger
+ * (#232) instead of the hand-rolled `foundry_audit_events` table
+ * (`migrations/0012_audit.sql`) this replaces. Every row: `tenantId: null`
+ * (foundry has no tenant of its own -- the org a plan is *for* is the
+ * `target`, not a tenant), `hashChain` on so a changed or deleted row is
+ * detectable (`verifyChain`), through migrations 0024-0028
+ * (`src/migrations/`, copied from `@wtfalch/audit` 0.6.0's own
+ * `migrations/0001-0005`, the same files its own `audit-migrations` CLI
+ * would copy into a host that has a `drizzle/` journal -- foundry does not,
+ * so they are hand-placed at the next free numbers instead).
+ *
+ * The `AuditLog` interface this satisfies is unchanged (`plan-apply.ts`),
+ * so `bootstrap.ts` and `redactingAudit` need no change either.
+ *
+ * Decide (#232, open): whether `foundry_audit_events`' existing rows are
+ * copied into the ledger or left as a closed, separate trail. Left as-is
+ * here -- the simpler default, and the one that forecloses nothing: a
+ * backfill can still be written later, where discarding the old rows
+ * outright could not be undone.
+ *
+ * `checkRuntimeRole` defaults to `false` here, the opposite of
+ * `createLedger`'s own default (#232, needs a human call -- flagged
+ * `ai:needs-human`, not decided here): that check requires the connection
+ * to be a real, restricted `<database>_rt` role, the one 0001's migration
+ * revokes UPDATE/DELETE/TRUNCATE from by name
+ * (`current_database() || '_rt'`). foundry has no such role for its own
+ * database -- `FOUNDRY_DATABASE_URL` is one connection, no owner/runtime
+ * split the way archon's, manage's or lokessmie's own `DATABASE_URL_OWNER`/
+ * `DATABASE_URL` pair is (see #239, the same split for a *hosted* app's
+ * database -- this is foundry's *own*). Leaving the default on would make
+ * every real call throw `UnsafeRuntimeRoleError`, since the revoke in
+ * 0001_audit.sql never ran against whatever role `FOUNDRY_DATABASE_URL`
+ * actually is; the append-only guard and the chain still hold at the
+ * database level regardless (0001's triggers, 0004's hashing), only the
+ * extra fail-closed check on the *connection* is off. Options, not a second
+ * positional argument (`CLAUDE.md` rule 7): a caller -- today only a test
+ * fixture -- can pass `true` once foundry's own database gets that split.
  */
-export declare function createPostgresAuditLog(db: FoundryStoreDb): AuditLog;
+export declare function createPostgresAuditLog(db: FoundryStoreDb, options?: {
+    checkRuntimeRole?: boolean;
+}): AuditLog;

package/dist/store/audit.js

@@ -1,44 +1,129 @@
-import { foundryAuditEvents } from './schema.js';
+import { createLedger, ledgerVocabulary } from '@wtfalch/audit';
 /**
- * foundry's own {@link AuditLog}, one row per plan, apply or destroy in
- * `foundry_audit_events` (#85). The CLI uses it before any archon exists; an
- * attached archon reads the same table. It only inserts.
+ * foundry's own closed vocabulary (#232): one event per `AuditLog` method,
+ * `outcome` carrying how it went rather than the action name repeating it
+ * (the same split `@wtfalch/audit`'s own "service with no tenant database"
+ * example uses: `action: 'plan.applied'`, `outcome: 'refused'`). `actor`
+ * has one class, `'operator'`, because `AuditActor` (`plan-apply.ts`) does
+ * not distinguish a human from a service caller -- nothing here guesses
+ * one. `'recorded'` sorts first so it is the default outcome
+ * `plan.computed` rows get (`recordPlan` has no outcome of its own to pass).
  */
-export function createPostgresAuditLog(db) {
+const FOUNDRY_LEDGER_VOCABULARY = ledgerVocabulary({
+    events: {
+        'plan.computed': { tenantVisible: false },
+        'apply.recorded': { tenantVisible: false },
+        'destroy.recorded': { tenantVisible: false },
+    },
+    actorClasses: ['operator'],
+    contexts: ['operator'],
+    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed'],
+});
+/**
+ * The ledger table's CHECKs (migration 0024): reason <= 512 chars, `after`
+ * <= 65536 bytes as jsonb text, actor_display 1-256 chars. A write that
+ * breaks one throws and would hide the apply error being recorded, so each
+ * value is bounded here. Postgres' jsonb text adds a space after every `:`
+ * and `,`, so the plan is measured against half the limit.
+ */
+const MAX_REASON = 512;
+const MAX_AFTER_BYTES = 32768;
+const MAX_DISPLAY = 256;
+function boundReason(reason) {
+    return reason === undefined ? null : reason.slice(0, MAX_REASON);
+}
+function boundDisplay(actor) {
+    return (actor.display || actor.id).slice(0, MAX_DISPLAY);
+}
+function boundPlan(plan) {
+    return Buffer.byteLength(JSON.stringify(plan)) <= MAX_AFTER_BYTES
+        ? plan
+        : { truncated: true, steps: plan.steps.length, unmanaged: plan.unmanaged.length };
+}
+/**
+ * foundry's own {@link AuditLog}, backed by `@wtfalch/audit`'s ledger
+ * (#232) instead of the hand-rolled `foundry_audit_events` table
+ * (`migrations/0012_audit.sql`) this replaces. Every row: `tenantId: null`
+ * (foundry has no tenant of its own -- the org a plan is *for* is the
+ * `target`, not a tenant), `hashChain` on so a changed or deleted row is
+ * detectable (`verifyChain`), through migrations 0024-0028
+ * (`src/migrations/`, copied from `@wtfalch/audit` 0.6.0's own
+ * `migrations/0001-0005`, the same files its own `audit-migrations` CLI
+ * would copy into a host that has a `drizzle/` journal -- foundry does not,
+ * so they are hand-placed at the next free numbers instead).
+ *
+ * The `AuditLog` interface this satisfies is unchanged (`plan-apply.ts`),
+ * so `bootstrap.ts` and `redactingAudit` need no change either.
+ *
+ * Decide (#232, open): whether `foundry_audit_events`' existing rows are
+ * copied into the ledger or left as a closed, separate trail. Left as-is
+ * here -- the simpler default, and the one that forecloses nothing: a
+ * backfill can still be written later, where discarding the old rows
+ * outright could not be undone.
+ *
+ * `checkRuntimeRole` defaults to `false` here, the opposite of
+ * `createLedger`'s own default (#232, needs a human call -- flagged
+ * `ai:needs-human`, not decided here): that check requires the connection
+ * to be a real, restricted `<database>_rt` role, the one 0001's migration
+ * revokes UPDATE/DELETE/TRUNCATE from by name
+ * (`current_database() || '_rt'`). foundry has no such role for its own
+ * database -- `FOUNDRY_DATABASE_URL` is one connection, no owner/runtime
+ * split the way archon's, manage's or lokessmie's own `DATABASE_URL_OWNER`/
+ * `DATABASE_URL` pair is (see #239, the same split for a *hosted* app's
+ * database -- this is foundry's *own*). Leaving the default on would make
+ * every real call throw `UnsafeRuntimeRoleError`, since the revoke in
+ * 0001_audit.sql never ran against whatever role `FOUNDRY_DATABASE_URL`
+ * actually is; the append-only guard and the chain still hold at the
+ * database level regardless (0001's triggers, 0004's hashing), only the
+ * extra fail-closed check on the *connection* is off. Options, not a second
+ * positional argument (`CLAUDE.md` rule 7): a caller -- today only a test
+ * fixture -- can pass `true` once foundry's own database gets that split.
+ */
+export function createPostgresAuditLog(db, options = {}) {
+    const ledger = createLedger({
+        vocabulary: FOUNDRY_LEDGER_VOCABULARY,
+        hashChain: true,
+        checkRuntimeRole: options.checkRuntimeRole ?? false,
+    });
+    const targetFor = (orgId, target) => ({
+        type: target === 'platform' ? 'platform' : 'org',
+        id: orgId,
+    });
     return {
         async recordPlan({ actor, orgId, plan, target, at }) {
-            await db.insert(foundryAuditEvents).values({
-                at,
-                kind: 'plan',
-                actorId: actor.id,
-                actorDisplay: actor.display,
-                orgId,
-                plan,
-                target: target ?? null,
+            await ledger.sign(db, {
+                action: 'plan.computed',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId, target),
+                after: boundPlan(plan),
+                occurredAt: at,
             });
         },
         async recordApply({ actor, orgId, plan, outcome, reason, target, at }) {
-            await db.insert(foundryAuditEvents).values({
-                at,
-                kind: 'apply',
-                actorId: actor.id,
-                actorDisplay: actor.display,
-                orgId,
+            await ledger.sign(db, {
+                action: 'apply.recorded',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId, target),
                 outcome,
-                reason: reason ?? null,
-                plan,
-                target: target ?? null,
+                reason: boundReason(reason),
+                after: boundPlan(plan),
+                occurredAt: at,
             });
         },
         async recordDestroy({ actor, orgId, outcome, reason, at }) {
-            await db.insert(foundryAuditEvents).values({
-                at,
-                kind: 'destroy',
-                actorId: actor.id,
-                actorDisplay: actor.display,
-                orgId,
+            await ledger.sign(db, {
+                action: 'destroy.recorded',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId),
                 outcome,
-                reason: reason ?? null,
+                reason: boundReason(reason),
+                occurredAt: at,
             });
         },
     };

package/dist/store/postgres.js

@@ -67,7 +67,7 @@ function rowToOrg(row) {
             mailApps: row.mailApps,
             roleMailboxes: row.roleMailboxes,
         },
-        chat: { usesDomain: row.chatUsesDomain },
+        chat: { enabled: row.chatEnabled, usesDomain: row.chatUsesDomain },
         calls: { enabled: row.callsEnabled, usesDomain: row.callsUsesDomain },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
@@ -80,6 +80,7 @@ function rowToOrg(row) {
             buildPack: row.hostingBuildPack,
             issuerApps: row.hostingIssuerApps,
             accessEmails: row.hostingAccessEmails,
+            appEnv: row.hostingAppEnv,
         },
         sso: { enabled: row.ssoEnabled },
         guests: { enabled: row.guestsEnabled },
@@ -107,6 +108,7 @@ function orgToRow(org) {
         noReplyLocalPart: org.mail.noReplyLocalPart ?? DEFAULT_NO_REPLY_LOCAL_PART,
         mailApps: org.mail.mailApps ?? [...DEFAULT_MAIL_APPS],
         roleMailboxes: org.mail.roleMailboxes ?? [],
+        chatEnabled: org.chat.enabled,
         chatUsesDomain: org.chat.usesDomain,
         callsEnabled: org.calls.enabled,
         callsUsesDomain: org.calls.usesDomain,
@@ -121,6 +123,7 @@ function orgToRow(org) {
         hostingBuildPack: org.hosting.buildPack,
         hostingIssuerApps: org.hosting.issuerApps,
         hostingAccessEmails: org.hosting.accessEmails,
+        hostingAppEnv: org.hosting.appEnv ?? {},
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,

package/dist/store/schema.d.ts

@@ -1,4 +1,4 @@
-import type { IssuerApp } from '../org.js';
+import type { AppEnvSource, IssuerApp } from '../org.js';
 import type { Plan } from '../plan.js';
 import type { Checkpoint } from '../state.js';
 /**
@@ -185,6 +185,23 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             $type: string[];
         }>;
+        chatEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "chat_enabled";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         chatUsesDomain: import("drizzle-orm/pg-core").PgColumn<{
             name: "chat_uses_domain";
             tableName: "foundry_declared_orgs";
@@ -427,6 +444,25 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             $type: string[];
         }>;
+        hostingAppEnv: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hosting_app_env";
+            tableName: "foundry_declared_orgs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, AppEnvSource>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, AppEnvSource>;
+        }>;
         ssoEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sso_enabled";
             tableName: "foundry_declared_orgs";

package/dist/store/schema.js

@@ -25,6 +25,7 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     // MailConfig.roleMailboxes (org.ts, #230). Local parts of the role mailboxes
     // pre-created on the org's mail domain; empty by default.
     roleMailboxes: jsonb('role_mailboxes').notNull().default([]).$type(),
+    chatEnabled: boolean('chat_enabled').notNull().default(false),
     chatUsesDomain: boolean('chat_uses_domain').notNull().default(false),
     callsEnabled: boolean('calls_enabled').notNull().default(false),
     callsUsesDomain: boolean('calls_uses_domain').notNull().default(false),
@@ -41,6 +42,12 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     hostingBuildPack: text('hosting_build_pack').notNull().default('nixpacks'),
     hostingIssuerApps: jsonb('hosting_issuer_apps').notNull().default([]).$type(),
     hostingAccessEmails: jsonb('hosting_access_emails').notNull().default([]).$type(),
+    // HostingConfig.appEnv (org.ts, #243). Maps the app's own env var names to
+    // values the plan already mints; empty by default.
+    hostingAppEnv: jsonb('hosting_app_env')
+        .notNull()
+        .default({})
+        .$type(),
     ssoEnabled: boolean('sso_enabled').notNull().default(false),
     guestsEnabled: boolean('guests_enabled').notNull().default(false),
     soloEnabled: boolean('solo_enabled').notNull().default(false),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -9,7 +9,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "files": ["dist"],
+  "files": ["dist", "versions.json"],
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -37,10 +37,12 @@
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
+    "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/email": "0.15.0",
     "@wtfalch/providers": "0.6.0",
-    "ssh2": "1.17.0"
+    "ssh2": "1.17.0",
+    "zod": "4.6.5"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.8",

package/versions.json

@@ -0,0 +1,8 @@
+{
+  "zitadel": "v4.17.3",
+  "synapse": "v1.161.0",
+  "mas": "1.24.0",
+  "livekit": "latest",
+  "cloudflared": "2026.9.3",
+  "stalwart": "v0.16.24"
+}