@wtfalch/foundry 0.6.0 → 0.8.0

package/dist/bootstrap/bootstrap.d.ts

@@ -1,4 +1,3 @@
-import type { MigrateSql } from '../migrate.js';
 import type { PlatformLiveReaders, PlatformStepExecutor } from '../plan/index.js';
 import type { FoundryPlatformStepExecutorOptions } from '../plan/platform-providers.js';
 import type { FoundryStoreDb } from '../store/postgres.js';
@@ -27,7 +26,7 @@ export interface RootCredentials {
 }
 /** What Archon's onboarding screen shows: one event per phase or round. */
 export interface BootstrapProgress {
-    phase: 'migrate' | 'declare' | 'plan' | 'apply' | 'done';
+    phase: 'declare' | 'plan' | 'apply' | 'done';
     round?: number;
     message: string;
     steps?: string[];
@@ -35,10 +34,8 @@ export interface BootstrapProgress {
 /** Everything foundry's per-step executors take besides the two clients and `deliverSecret`. */
 export type BootstrapExecutorDeps = Omit<FoundryPlatformStepExecutorOptions, 'coolify' | 'deliverSecret'>;
 export interface BootstrapPlatformDeps {
-    /** Foundry's tables live here; the store, the audit log and the plan all use it. */
+    /** Foundry's tables live here, already migrated by the host; the store, the audit log and the plan all use it. */
     db: FoundryStoreDb;
-    /** The same database, for the migration runner. */
-    migrateSql: MigrateSql;
     rootCredentials: () => Promise<RootCredentials>;
     deliverSecret: (ref: string, secret: string) => Promise<void>;
     /**
@@ -52,6 +49,13 @@ export interface BootstrapPlatformDeps {
     };
     /** Per-step dependencies (auth, mail, files, ai, integrations, archon, sfu). A step without its own is reported blocked. */
     executor?: BootstrapExecutorDeps;
+    /**
+     * Passed to `createPostgresAuditLog`. Omit it in a real deployment: `db` is
+     * the runtime role the host made with `ensureRuntimeRole`, and the default
+     * (on) checks that. Only a fixture without that role (PGlite, whose one user
+     * is a superuser) needs `false`.
+     */
+    checkRuntimeRole?: boolean;
     onProgress?: (event: BootstrapProgress) => void;
     /** Rounds before the run gives up. Default 20. */
     maxRounds?: number;
@@ -97,9 +101,9 @@ export declare class Redactor {
 /** Wraps the secret-carrying ports inside one step's deps so what they deliver or resolve is redacted. */
 export declare function guardStepDeps(executor: BootstrapExecutorDeps | undefined, redactor: Redactor, deliverSecret: (ref: string, secret: string) => Promise<void>, heldKeys: BootstrapPlatformDeps['heldKeys']): BootstrapExecutorDeps;
 /**
- * The platform's first apply, run from Archon's onboarding flow: migrates
- * foundry's tables, declares Company Included and the platform (never
- * overwriting a row already there), then plans and applies round by round
+ * The platform's first apply, run from Archon's onboarding flow, against a
+ * database the host has already migrated: declares Company Included and the
+ * platform (never overwriting a row already there), then plans and applies round by round
  * until every step is applied or reported blocked. Reads no env and no file:
  * the database, root credentials, held keys and every per-step dependency
  * come in through `deps`.

package/dist/bootstrap/bootstrap.js

@@ -1,6 +1,5 @@
 import { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { CoolifyClient } from '@wtfalch/providers/coolify';
-import { migrate } from '../migrate.js';
 import { FoundryPlanApply, FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, } from '../plan/index.js';
 import { createPostgresAuditLog } from '../store/audit.js';
 import { createPostgresDeclaredOrgStore, createPostgresPlatformStore } from '../store/postgres.js';
@@ -140,9 +139,9 @@ function archonMasterKeys(guarded, credentials) {
     };
 }
 /**
- * The platform's first apply, run from Archon's onboarding flow: migrates
- * foundry's tables, declares Company Included and the platform (never
- * overwriting a row already there), then plans and applies round by round
+ * The platform's first apply, run from Archon's onboarding flow, against a
+ * database the host has already migrated: declares Company Included and the
+ * platform (never overwriting a row already there), then plans and applies round by round
  * until every step is applied or reported blocked. Reads no env and no file:
  * the database, root credentials, held keys and every per-step dependency
  * come in through `deps`.
@@ -187,13 +186,6 @@ export async function bootstrapPlatform(input, deps) {
                 }
                 : {}),
         };
-        const migrated = await migrate(deps.migrateSql);
-        emit({
-            phase: 'migrate',
-            message: migrated.applied.length === 0
-                ? 'foundry tables already up to date'
-                : `migrated: ${migrated.applied.join(', ')}`,
-        });
         const orgStore = createPostgresDeclaredOrgStore(deps.db);
         const platformStore = createPostgresPlatformStore(deps.db);
         if (await orgStore.get(COMPANY_INCLUDED_ORG_ID)) {
@@ -264,7 +256,7 @@ export async function bootstrapPlatform(input, deps) {
             },
             executor: unusedOrgExecutor,
             destroyer: unusedOrgExecutor,
-            audit: redactingAudit(createPostgresAuditLog(deps.db), redactor),
+            audit: redactingAudit(createPostgresAuditLog(deps.db, { checkRuntimeRole: deps.checkRuntimeRole }), redactor),
             authz: allowPlatformApply,
             actor: { id: 'bootstrap-platform', display: 'bootstrapPlatform' },
             platform: { store: platformStore, readers: runtime.readers, executor },

package/dist/bootstrap/declare.d.ts

@@ -7,8 +7,10 @@ export declare const DEFAULT_GIT_REF = "main";
  * The Stalwart image tag the platform's mail step runs. `platform.mail.gitRef`
  * is an image tag, not a git ref, and the planner blocks a floating one
  * (`platform-providers.ts`, `mailImageTagBlocked`), so this is a pinned release.
+ * Pinned in `versions.json` as `stalwart` (#247) -- this is the pattern that
+ * file's loader follows.
  */
-export declare const DEFAULT_MAIL_IMAGE_TAG = "v0.16.24";
+export declare const DEFAULT_MAIL_IMAGE_TAG: string;
 export interface BootstrapCompany {
     name: string;
     slug: string;

package/dist/bootstrap/declare.js

@@ -1,5 +1,6 @@
 import { validateOwner } from '../org.js';
 import { PLATFORM_SERVICE_KEYS, defaultPlatformHostname } from '../platform.js';
+import { VERSIONS } from './versions.js';
 /** Company Included's own org id, the same literal `test/fakes.ts`'s `basePlatform()` uses for `ownerOrgId`. */
 export const COMPANY_INCLUDED_ORG_ID = 'org_company_included';
 export const DEFAULT_GIT_REF = 'main';
@@ -7,8 +8,10 @@ export const DEFAULT_GIT_REF = 'main';
  * The Stalwart image tag the platform's mail step runs. `platform.mail.gitRef`
  * is an image tag, not a git ref, and the planner blocks a floating one
  * (`platform-providers.ts`, `mailImageTagBlocked`), so this is a pinned release.
+ * Pinned in `versions.json` as `stalwart` (#247) -- this is the pattern that
+ * file's loader follows.
  */
-export const DEFAULT_MAIL_IMAGE_TAG = 'v0.16.24';
+export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
 /**
  * Every platform service except `sfu` is enabled, like the other steps: a
  * service whose dependencies the host did not supply is reported blocked, not
@@ -55,11 +58,12 @@ export function declaredCompanyOrg(company, owner) {
             ownerMailboxAddress: null,
             noReplyLocalPart: 'no-reply',
         },
-        chat: { usesDomain: false },
+        chat: { enabled: false, usesDomain: false },
         calls: { enabled: false, usesDomain: false },
         issuer: { usesDomain: false },
         site: { enabled: false, usesDomain: false },
         hosting: {
+            appEnv: {},
             enabled: false,
             usesDomain: false,
             database: false,

package/dist/bootstrap/versions.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The estate's pinned third-party image/release refs for the platform
+ * services foundry provisions (#247). One JSON file, so Renovate can read
+ * and later propose bumps against it, instead of four separate string
+ * constants it cannot see. `postgres` has no entry here: no planner step
+ * pins a postgres image tag today, so there is no ref to record yet.
+ */
+export interface PinnedVersions {
+    zitadel: string;
+    synapse: string;
+    mas: string;
+    livekit: string;
+    cloudflared: string;
+    stalwart: string;
+}
+export declare function loadVersions(): PinnedVersions;
+export declare const VERSIONS: PinnedVersions;
+/**
+ * Why an image tag cannot be used, or `null`. #248: generalised out of what
+ * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard
+ * `versions.json` had before -- `livekit/livekit-server:latest` was the live
+ * case with none. `label` names the image in the message (`"Stalwart"`,
+ * `"ZITADEL"`, `"LiveKit"`, ...); `example` is a real pinned tag to suggest.
+ */
+export declare function floatingTagBlocked(label: string, tag: string, example: string): string | null;

package/dist/bootstrap/versions.js

@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs';
+/**
+ * Read at module load from `versions.json`, which sits beside this
+ * package's `package.json` (not under `src`, so plain JSON import would
+ * fight `tsconfig.build.json`'s `rootDir`) and ships in the published
+ * tarball via `package.json`'s `files`.
+ */
+const VERSIONS_PATH = new URL('../../versions.json', import.meta.url);
+export function loadVersions() {
+    return JSON.parse(readFileSync(VERSIONS_PATH, 'utf8'));
+}
+export const VERSIONS = loadVersions();
+/**
+ * Tag spellings that resolve to whatever the registry currently has, not a
+ * fixed image -- a re-apply of the same declaration can silently run a
+ * different version with no diff shown anywhere (#248). `main`/`master` are
+ * default-branch Docker Hub aliases some of these images publish alongside
+ * their release tags, not git refs.
+ */
+const FLOATING_TAGS = new Set([
+    'latest',
+    'main',
+    'master',
+    'stable',
+    'dev',
+    'edge',
+    'nightly',
+    'head',
+]);
+/**
+ * Why an image tag cannot be used, or `null`. #248: generalised out of what
+ * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard
+ * `versions.json` had before -- `livekit/livekit-server:latest` was the live
+ * case with none. `label` names the image in the message (`"Stalwart"`,
+ * `"ZITADEL"`, `"LiveKit"`, ...); `example` is a real pinned tag to suggest.
+ */
+export function floatingTagBlocked(label, tag, example) {
+    const trimmed = tag.trim();
+    if (trimmed === '' || FLOATING_TAGS.has(trimmed.toLowerCase())) {
+        return `the ${label} image tag "${tag}" floats; declare a pinned release (for example ${example})`;
+    }
+    return null;
+}

package/dist/calls-sfu-deploy-support.d.ts

@@ -7,7 +7,7 @@
  * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
  * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
  * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
- * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * as `foundry-db-provision.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):

package/dist/calls-sfu-deploy-support.js

@@ -7,7 +7,7 @@
  * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
  * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
  * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
- * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * as `foundry-db-provision.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):

package/dist/calls-sfu-ssh-adapter.d.ts

@@ -11,7 +11,7 @@
  * host-key refusal and the 0600 file mode without ever opening a socket.
  * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
  * implementation, over `ssh2`, and stays untested for the same reason
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * `foundry-db-provision.mjs` does: real I/O, no
  * branch logic worth a fake session over.
  */
 import { type CallsSfuConfig, type CallsSfuHostPort } from './calls-sfu.js';

package/dist/calls-sfu-ssh-adapter.js

@@ -11,7 +11,7 @@
  * host-key refusal and the 0600 file mode without ever opening a socket.
  * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
  * implementation, over `ssh2`, and stays untested for the same reason
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * `foundry-db-provision.mjs` does: real I/O, no
  * branch logic worth a fake session over.
  */
 import { dirname } from 'node:path';

package/dist/calls-sfu.d.ts

@@ -114,13 +114,15 @@ export declare const LIVEKIT_CONFIG_PATH = "/opt/livekit/livekit.yaml";
 /** Holds `TUNNEL_TOKEN=...` -- the one secret the `cloudflared` compose service reads (`env_file:`, below). */
 export declare const CLOUDFLARED_ENV_PATH = "/opt/livekit/cloudflared.env";
 /**
- * `:latest`, matching this codebase's one other pinned-by-tag-only image
- * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet.
+ * Pinned to a release tag (#248) -- `versions.json`'s `livekit` entry ran
+ * `:latest` until then, the one live case `floatingTagBlocked`
+ * (`bootstrap/versions.ts`) exists for: a re-apply of the same declaration
+ * silently running a different version, with no diff shown anywhere.
+ * Pinned in `versions.json` (#247).
  */
-export declare const LIVEKIT_IMAGE_REF = "livekit/livekit-server:latest";
-/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export declare const CLOUDFLARED_IMAGE_REF = "cloudflare/cloudflared:2026.9.3";
+export declare const LIVEKIT_IMAGE_REF: string;
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */
+export declare const CLOUDFLARED_IMAGE_REF: string;
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export declare const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */

package/dist/calls-sfu.js

@@ -52,6 +52,7 @@
  * `calls-sfu-deploy-support.ts`'s `fileWriteMode`), never logged, scrubbed
  * from any error `calls-sfu-deploy.mjs` prints.
  */
+import { VERSIONS } from './bootstrap/versions.js';
 // ---------------------------------------------------------------------------
 // The guard
 // ---------------------------------------------------------------------------
@@ -103,13 +104,15 @@ export const LIVEKIT_CONFIG_PATH = '/opt/livekit/livekit.yaml';
 /** Holds `TUNNEL_TOKEN=...` -- the one secret the `cloudflared` compose service reads (`env_file:`, below). */
 export const CLOUDFLARED_ENV_PATH = '/opt/livekit/cloudflared.env';
 /**
- * `:latest`, matching this codebase's one other pinned-by-tag-only image
- * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet.
+ * Pinned to a release tag (#248) -- `versions.json`'s `livekit` entry ran
+ * `:latest` until then, the one live case `floatingTagBlocked`
+ * (`bootstrap/versions.ts`) exists for: a re-apply of the same declaration
+ * silently running a different version, with no diff shown anywhere.
+ * Pinned in `versions.json` (#247).
  */
-export const LIVEKIT_IMAGE_REF = 'livekit/livekit-server:latest';
-/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). */
-export const CLOUDFLARED_IMAGE_REF = 'cloudflare/cloudflared:2026.9.3';
+export const LIVEKIT_IMAGE_REF = `livekit/livekit-server:${VERSIONS.livekit}`;
+/** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */
+export const CLOUDFLARED_IMAGE_REF = `cloudflare/cloudflared:${VERSIONS.cloudflared}`;
 /** LiveKit signalling -- reachable only through the tunnel as of #127 (see {@link CALLS_SFU_PRIVATE_CIDR}). */
 export const LIVEKIT_SIGNALLING_PORT = 7880;
 /** Media fallback for networks that block UDP -- reaches the SFU's own address directly. */

package/dist/index.d.ts

@@ -20,8 +20,8 @@ export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, } from './plan/index.js';
-export { FoundryStepExecutor, NotBuiltError, healthUrls } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
@@ -43,8 +43,7 @@ export type { LivekitCredentials } from './calls-sfu-keys.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './plan/index.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
-export type { MigrateSql, MigrationResult } from './migrate.js';
-export { MIGRATIONS_DIR, migrate } from './migrate.js';
+export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export type { RunnerDb } from './runner/db.js';

package/dist/index.js

@@ -8,7 +8,7 @@ export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredP
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
-export { FoundryStepExecutor, NotBuiltError, healthUrls } from './plan/index.js';
+export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
@@ -20,7 +20,10 @@ export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export { UnknownCallsSfuHostKeyError, toCallsSfuHostPort, applyCallsSfuOverSession, } from './calls-sfu-ssh-adapter.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
-export { MIGRATIONS_DIR, migrate } from './migrate.js';
+// The shipped migrations' directory; hosts apply them with `@wtfalch/db`'s
+// `runMigrationSources`. Also at `@wtfalch/foundry/migrations-dir`, which
+// imports nothing else.
+export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';

package/dist/migrations/0022_chat_enabled.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: chat is not in v1 (decided 2026-10-01). Mirrors
+-- `src/store/schema.ts`'s `chatEnabled`. Defaults false, so every existing org
+-- reads as chat off and `apply` leaves any live chat resource alone.
+
+alter table foundry_declared_orgs
+  add column if not exists chat_enabled boolean not null default false;

package/dist/migrations/0023_hosting_app_env.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: the bespoke app's own env var names for values the plan
+-- already mints (Files, AI, mail), each a key `pushAppEnv` resolves (#243).
+-- Mirrors `src/store/schema.ts`'s `hostingAppEnv`. Defaults to an empty
+-- object so every existing org keeps its current behaviour: no app env
+-- pushed from this map.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_app_env jsonb not null default '{}'::jsonb;

package/dist/migrations/0024_audit_events.sql

@@ -0,0 +1,211 @@
+-- Cutover from foundry_audit_events (0012_audit.sql): it stops receiving writes
+-- from this migration on, and its old rows are left in place.
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: the append-only audit ledger. Mirrors src/tables.ts.
+--
+-- Every statement is idempotent. Applied by the host's own migrate script
+-- after the host copies this file into its drizzle/ directory as the next
+-- number (audit-migrations); never edited there.
+--
+-- What this file enforces is the ledger's SHAPE and its WALLS: bounded
+-- columns, JSON under 64 KB, the pairs that must appear together, the
+-- break-glass rule that a session row carries its session, reason and
+-- reference, and the three triggers plus the runtime-role revoke that make
+-- "append-only" true for a role that is not a superuser. The CLOSED SETS
+-- (which event names, actor classes, contexts, outcomes and reason codes a
+-- host admits) are the host's own vocabulary: enforced in TypeScript by the
+-- ledger at write time, and in the database by the host's own CHECKs when it
+-- has them (wtfalch/app-template's 0003 and 0007 do). A host with only this
+-- file gets the shape and the walls.
+--
+-- Estate-shaped: the DO block assumes a runtime role named <database>_rt that
+-- owns nothing and serves the app. Without it, the tables and the function
+-- exist and no revoke takes effect.
+--
+-- No foreign keys, on purpose: the trail outlives the tenant, the person and
+-- the credential it describes. `tenant_id` is a uuid because the estate's
+-- tenants are; a host with other ids alters the column in its own migration.
+
+create table if not exists audit_events (
+  id              bigint generated always as identity primary key,
+  occurred_at     timestamptz not null default now(),
+  tenant_id       uuid,
+  actor_class     text not null,
+  actor_id        text not null,
+  actor_display   text not null,
+  action          text not null,
+  target_type     text not null,
+  target_id       text not null,
+  outcome         text not null,
+  context         text not null,
+  session_id      text,
+  reason          text,
+  reference       text,
+  request_id      text,
+  ip              text,
+  user_agent      text,
+  tenant_visible  boolean not null,
+  before          jsonb,
+  after           jsonb,
+  -- Set by audit_erase_person. The row and actor_id survive; who that was
+  -- does not, once this is set.
+  erased_at       timestamptz,
+  schema_version  smallint not null default 1,
+  -- The principal the event was ABOUT, when that is not the actor: an
+  -- invitation's invitee, a membership's holder. What lets "events affecting
+  -- me" be answered without guessing from payloads.
+  subject_class   text,
+  subject_id      text,
+  constraint audit_events_actor_class_check check (length(actor_class) between 1 and 64),
+  constraint audit_events_actor_id_check check (length(actor_id) between 1 and 256),
+  constraint audit_events_actor_display_check check (length(actor_display) between 1 and 256),
+  constraint audit_events_action_shape_check check (action ~ '^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$'),
+  constraint audit_events_target_type_check check (length(target_type) between 1 and 64),
+  constraint audit_events_target_id_check check (length(target_id) between 1 and 256),
+  constraint audit_events_outcome_check check (length(outcome) between 1 and 32),
+  constraint audit_events_context_check check (length(context) between 1 and 32),
+  constraint audit_events_session_id_check check (session_id is null or length(session_id) <= 256),
+  constraint audit_events_reason_check check (reason is null or length(reason) <= 512),
+  constraint audit_events_reference_check check (reference is null or length(reference) <= 512),
+  constraint audit_events_request_id_check check (request_id is null or length(request_id) <= 128),
+  constraint audit_events_ip_check check (ip is null or length(ip) <= 64),
+  constraint audit_events_user_agent_check check (user_agent is null or length(user_agent) <= 1024),
+  constraint audit_events_before_check check (before is null or octet_length(before::text) <= 65536),
+  constraint audit_events_after_check check (after is null or octet_length(after::text) <= 65536),
+  -- A support-session row names its session, its reason and its reference.
+  -- Which reasons are admissible is the host's closed set.
+  constraint audit_events_break_glass_shape_check check (
+    context <> 'break_glass'
+    or (session_id is not null and reason is not null and reference is not null)
+  ),
+  constraint audit_events_subject_pair_check check ((subject_id is null) = (subject_class is null)),
+  constraint audit_events_subject_class_check check (subject_class is null or length(subject_class) between 1 and 64),
+  constraint audit_events_subject_id_check check (subject_id is null or length(subject_id) between 1 and 256)
+);
+
+-- (occurred_at, id) is the ordering; every reader pages on it.
+create index if not exists audit_events_tenant_time_idx
+  on audit_events (tenant_id, occurred_at desc, id desc);
+create index if not exists audit_events_actor_time_idx
+  on audit_events (actor_id, occurred_at desc);
+create index if not exists audit_events_action_time_idx
+  on audit_events (action, occurred_at desc);
+create index if not exists audit_events_subject_time_idx
+  on audit_events (subject_class, subject_id, occurred_at desc, id desc) where subject_id is not null;
+create index if not exists audit_events_request_idx
+  on audit_events (request_id, occurred_at desc) where request_id is not null;
+
+-- The second wall. The first is the revoke below, which stops the server; this
+-- stops the owner's own mistakes at a psql prompt. An UPDATE may change only
+-- the four columns erasure touches, and DELETE and TRUNCATE are refused
+-- outright. audit_erase_person passes through this trigger, not around it.
+create or replace function audit_events_guard() returns trigger
+language plpgsql as $$
+begin
+  if tg_op = 'DELETE' then
+    raise exception 'audit_events is append-only: delete refused';
+  elsif tg_op = 'TRUNCATE' then
+    raise exception 'audit_events is append-only: truncate refused';
+  elsif tg_op = 'UPDATE' then
+    if new.id is distinct from old.id
+      or new.occurred_at is distinct from old.occurred_at
+      or new.tenant_id is distinct from old.tenant_id
+      or new.actor_class is distinct from old.actor_class
+      or new.actor_id is distinct from old.actor_id
+      or new.action is distinct from old.action
+      or new.target_type is distinct from old.target_type
+      or new.target_id is distinct from old.target_id
+      or new.outcome is distinct from old.outcome
+      or new.context is distinct from old.context
+      or new.session_id is distinct from old.session_id
+      or new.reason is distinct from old.reason
+      or new.reference is distinct from old.reference
+      or new.request_id is distinct from old.request_id
+      or new.ip is distinct from old.ip
+      or new.user_agent is distinct from old.user_agent
+      or new.tenant_visible is distinct from old.tenant_visible
+      or new.schema_version is distinct from old.schema_version
+      or new.subject_class is distinct from old.subject_class
+      or new.subject_id is distinct from old.subject_id
+    then
+      raise exception 'audit_events is append-only: only actor_display, before, after and erased_at may change';
+    end if;
+  end if;
+  return new;
+end
+$$;
+drop trigger if exists audit_events_guarded_update on audit_events;
+create trigger audit_events_guarded_update
+  before update on audit_events
+  for each row execute function audit_events_guard();
+drop trigger if exists audit_events_no_delete on audit_events;
+create trigger audit_events_no_delete
+  before delete on audit_events
+  for each row execute function audit_events_guard();
+drop trigger if exists audit_events_no_truncate on audit_events;
+create trigger audit_events_no_truncate
+  before truncate on audit_events
+  for each statement execute function audit_events_guard();
+
+-- The one sanctioned write. Rows the person wrote (actor_id), rows written
+-- about them (subject_id), and rows whose payload carries their address:
+-- actor_display becomes the pseudonym on their own rows, before and after
+-- are replaced wholesale on every matched row, erased_at is set. actor_id
+-- and subject_id stay, so "somebody with this id did this" survives and
+-- "who that was" does not. Row counts never change. Ledger-only: a host's
+-- own tables (a profile, an invitation) are the host's to clean, in the same
+-- transaction, and its final `person.erased` row is written after this.
+create or replace function audit_erase_person(subject text, pseudonym text, subject_email text)
+returns integer
+language plpgsql
+security definer
+set search_path from current
+as $$
+declare
+  touched integer;
+begin
+  if subject is null or length(subject) = 0 then
+    raise exception 'audit_erase_person: a subject id is required';
+  end if;
+  if pseudonym is null or length(pseudonym) = 0 or length(pseudonym) > 256 then
+    raise exception 'audit_erase_person: a pseudonym of 1 to 256 characters is required';
+  end if;
+  update audit_events
+     set actor_display = case when actor_id = subject then pseudonym else actor_display end,
+         before = case when before is null then null else '{"erased":true}'::jsonb end,
+         after = case when after is null then null else '{"erased":true}'::jsonb end,
+         erased_at = now()
+   where erased_at is null
+     and (
+       actor_id = subject
+       or subject_id = subject
+       or (
+         subject_email is not null
+         and length(subject_email) > 0
+         and (
+           lower(coalesce(before::text, '')) like '%' || lower(subject_email) || '%'
+           or lower(coalesce(after::text, '')) like '%' || lower(subject_email) || '%'
+         )
+       )
+     );
+  get diagnostics touched = row_count;
+  return touched;
+end
+$$;
+revoke all on function audit_erase_person(text, text, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('revoke update, delete, truncate on audit_events from %I', rt);
+    execute format('grant execute on function audit_erase_person(text, text, text) to %I', rt);
+  end if;
+end
+$$;