@wtfalch/foundry 0.60.0 → 0.61.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, BlueGreenConfig, OrgBuiltinApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingGithub, BlueGreenConfig, OrgBuiltinApp, BouleApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, EntryWorkspace, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
@@ -53,13 +53,17 @@ export type { FilesHostInput, JobsHostDeps, JobsHostInput, OwnAuthInstance, Plan
 export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
 export type { PlanOwnSfuOptions, SfuAppDeps, SfuAppInput } from './plan/index.js';
 export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuCompose, } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, KeysRegistrarPort, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
-export { NO_DOMAIN_ZONE, ownHostnames } from './plan/index.js';
+export { NO_DOMAIN_ZONE, entryMachinePaths, ownHostnames, privatePageGateKey, workspaceHost, } from './plan/index.js';
+export type { PrivatePageScope } from './plan/index.js';
+export type { HostedLabelRefusal } from './hosted-label.js';
+export { hostedLabelRefusal } from './hosted-label.js';
 export type { OwnHostnames } from './plan/index.js';
 export type { EnsureSignInOrgOptions } from './plan/index.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { httpKeysRegistrar, keysRegistrarFromConfig, KEYS_PLATFORM_TOKEN_ENV, KEYS_SERVICE_URL_ENV, } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './plan/index.js';
@@ -69,8 +73,9 @@ export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
+export type { DeployKeyTarget, GithubDeployKey, GithubDeployKeysPort } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createGithubDeployKeys, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformGithubReleaseHookDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
@@ -32,15 +32,17 @@ export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICE
 export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
 export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuCompose, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
-export { NO_DOMAIN_ZONE, ownHostnames } from './plan/index.js';
+export { NO_DOMAIN_ZONE, entryMachinePaths, ownHostnames, privatePageGateKey, workspaceHost, } from './plan/index.js';
+export { hostedLabelRefusal } from './hosted-label.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { httpKeysRegistrar, keysRegistrarFromConfig, KEYS_PLATFORM_TOKEN_ENV, KEYS_SERVICE_URL_ENV, } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createGithubDeployKeys, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';

package/dist/migrations/0062_hosting_github.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: the company's installation of the platform's GitHub App (`HostingConfig.github`).
+-- Mirrors `src/store/schema.ts`'s `hostingGithub`. Additive and nullable, like 0060_hosting_repos.sql:
+-- a row written before it reads as no installation, and an older reader ignores the column.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_github jsonb;

package/dist/migrations/0063_boule_apps.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: `boule_apps` is `org.boule.apps` (F3, F5, F7): the company's Boule installs and runs apps, so
+-- foundry gives it the managed-apps platform keys (edge, sign-in broker registrar, signed-records registrar).
+-- Default false. Additive like 0059_org_builtin_blue_green.sql: `if not exists`, safe to run at container start on
+-- live rows. Mirrors src/store/schema.ts's `declaredOrgs`.
+
+alter table foundry_declared_orgs
+  add column if not exists boule_apps boolean not null default false;

package/dist/migrations/0064_requested_changes_boule_apps.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: a company's Boule can request `bouleApps` (turn `org.boule.apps` on or off).
+alter table foundry_requested_changes
+  drop constraint if exists foundry_requested_changes_field_check;
+alter table foundry_requested_changes
+  add constraint foundry_requested_changes_field_check
+    check (field in ('calls', 'customers', 'storageLimit', 'aiLimit', 'domain', 'mailTier', 'app', 'build', 'bouleApps'));

package/dist/modules/ai.d.ts

@@ -0,0 +1,3 @@
+import type { AppModule } from './types.js';
+/** `uses.ai`: the app calls the AI tasks set up for the company. */
+export declare const ai: AppModule;

package/dist/modules/ai.js

@@ -0,0 +1,64 @@
+import { AI_ENTRY_PERMISSIONS, AI_WEBHOOK_PATH } from '../entry-rules.js';
+import { list, setUse, text } from './entry-parts.js';
+/** `uses.ai`: the app calls the AI tasks set up for the company. */
+export const ai = {
+    view: {
+        id: 'ai',
+        name: 'AI',
+        line: 'The app uses AI to do work for people, such as writing a summary or reading a document.',
+        category: 'AI',
+        icon: 'sparkles',
+        runtimes: ['server'],
+        requires: [],
+        availability: 'ready',
+        fields: [
+            {
+                key: 'offerings',
+                label: 'AI tasks the app may use',
+                help: 'The names of the AI tasks set up for your company.',
+                kind: 'list',
+                required: true,
+            },
+            {
+                key: 'webhookPath',
+                label: 'Page that receives finished AI work',
+                help: 'A page on your app, such as /api/ai/done. Leave it empty if the app waits for the answer.',
+                kind: 'path',
+                advanced: true,
+                pattern: AI_WEBHOOK_PATH.source,
+            },
+            {
+                key: 'permissions',
+                label: 'What the app may do',
+                help: 'Leave it empty to allow all of them.',
+                kind: 'list',
+                advanced: true,
+                choices: AI_ENTRY_PERMISSIONS.map((value) => ({ value, label: value })),
+            },
+        ],
+        adds: [{ name: 'AI tasks', hint: "Run on your company's own AI account." }],
+    },
+    toEntry(entry, values) {
+        if (values === null)
+            return setUse(entry, 'ai', undefined);
+        const next = { offerings: list(values, 'offerings') ?? [] };
+        const permissions = list(values, 'permissions');
+        const webhookPath = text(values, 'webhookPath');
+        if (permissions)
+            next.permissions = permissions;
+        if (webhookPath !== undefined)
+            next.webhookPath = webhookPath;
+        return setUse(entry, 'ai', next);
+    },
+    fromEntry(entry) {
+        const used = entry.uses?.ai;
+        if (!used)
+            return null;
+        const values = { offerings: [...used.offerings] };
+        if (used.permissions?.length)
+            values.permissions = [...used.permissions];
+        if (used.webhookPath !== undefined)
+            values.webhookPath = used.webhookPath;
+        return values;
+    },
+};

package/dist/modules/assistants.d.ts

@@ -0,0 +1,3 @@
+import type { AppModule } from './types.js';
+/** `uses.auth.mcp`: the app serves AI assistants (MCP clients) that sign the customer in. */
+export declare const assistants: AppModule;

package/dist/modules/assistants.js

@@ -0,0 +1,72 @@
+import { MCP_PATH, isPagePath } from '../entry-rules.js';
+import { problem, setAuthPart, text } from './entry-parts.js';
+/** `uses.auth.mcp`: the app serves AI assistants (MCP clients) that sign the customer in. */
+export const assistants = {
+    view: {
+        id: 'assistants',
+        name: 'Help for AI assistants',
+        line: 'Your customers connect their own AI assistant, such as Claude or ChatGPT, to the app and use it from their chat.',
+        category: 'AI',
+        icon: 'bot',
+        runtimes: ['server', 'worker'],
+        requires: ['sign-in'],
+        availability: 'ready',
+        fields: [
+            {
+                key: 'path',
+                label: 'Where assistants connect',
+                help: 'The address on your app that assistants connect to. Most apps use /mcp.',
+                kind: 'path',
+                required: true,
+                default: '/mcp',
+                pattern: MCP_PATH.source,
+                max: 200,
+            },
+            {
+                key: 'onboardingPath',
+                label: 'Page shown after the first sign-in',
+                help: 'A page on your app that tells a new customer what to do next, such as /onboarding. Leave it empty for none.',
+                kind: 'path',
+                advanced: true,
+            },
+        ],
+        adds: [
+            {
+                name: 'A connection for AI assistants',
+                hint: 'Each customer signs in once from their assistant; the assistant then acts as them.',
+            },
+        ],
+    },
+    check(values, modules) {
+        const signIn = modules['sign-in'];
+        if (signIn?.users !== 'customers' || signIn?.registration !== 'open') {
+            return problem(null, 'Help for AI assistants needs Sign-in for your customers, where anyone can make an account: each customer connects their own assistant. In Sign-in, choose "Your customers" and "Anyone".');
+        }
+        const onboarding = text(values, 'onboardingPath');
+        if (onboarding !== undefined && !isPagePath(onboarding)) {
+            return problem('onboardingPath', 'The page must start with "/", such as /onboarding, with no spaces, "?", "#" or "..".');
+        }
+        return null;
+    },
+    toEntry(entry, values) {
+        if (values === null)
+            return setAuthPart(entry, 'mcp', undefined);
+        if (!entry.uses?.auth) {
+            return problem(null, 'Help for AI assistants needs Sign-in. Turn on Sign-in first.');
+        }
+        const onboardingPath = text(values, 'onboardingPath');
+        return setAuthPart(entry, 'mcp', {
+            path: values.path,
+            ...(onboardingPath !== undefined ? { onboardingPath } : {}),
+        });
+    },
+    fromEntry(entry) {
+        const mcp = entry.uses?.auth?.mcp;
+        if (!mcp)
+            return null;
+        const values = { path: mcp.path };
+        if (mcp.onboardingPath !== undefined)
+            values.onboardingPath = mcp.onboardingPath;
+        return values;
+    },
+};

package/dist/modules/audit-ledger.d.ts

@@ -0,0 +1,29 @@
+import type { WorkerAppConfig } from '../worker-app-config.js';
+/**
+ * What `uses.audit` derives from the pinned `@wtfalch/audit`, so an app never lists it by hand (foundry#929).
+ *
+ * The package is installed under the alias `@wtfalch/audit-sealing` because foundry's own ledger still runs the
+ * 0.6.0 migrations (`@wtfalch/audit`, migrations 0012 and 0024-0028 here); the sealing service needs the
+ * checkpoint, anchor and bundle code that came after. `audit/ledger-set.test.ts` checks every name below against the
+ * installed package's own migrations, so a bump that renames one fails there and not in a company's database.
+ */
+/** The version the lists below were read from. */
+export declare const AUDIT_PACKAGE_VERSION = "0.14.0";
+/** Insert and read only: the runtime role has UPDATE, DELETE and TRUNCATE revoked on each. */
+export declare const AUDIT_APPEND_ONLY_TABLES: readonly string[];
+/**
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
+ * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
+ * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ */
+export declare const AUDIT_APP_GRANTS: readonly string[];
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+export declare const AUDIT_SEALER_GRANTS: readonly string[];
+type Database = NonNullable<WorkerAppConfig['database']>;
+/**
+ * The database part with the derived tables and grants in (`on`) or out (`off`). Hand-listed names are kept, a
+ * name is never listed twice, and turning it off takes out exactly the derived names. Never changes `database`.
+ */
+export declare function withAuditDatabase(database: Database, on: boolean): Database;
+export {};

package/dist/modules/audit-ledger.js

@@ -0,0 +1,49 @@
+/**
+ * What `uses.audit` derives from the pinned `@wtfalch/audit`, so an app never lists it by hand (foundry#929).
+ *
+ * The package is installed under the alias `@wtfalch/audit-sealing` because foundry's own ledger still runs the
+ * 0.6.0 migrations (`@wtfalch/audit`, migrations 0012 and 0024-0028 here); the sealing service needs the
+ * checkpoint, anchor and bundle code that came after. `audit/ledger-set.test.ts` checks every name below against the
+ * installed package's own migrations, so a bump that renames one fails there and not in a company's database.
+ */
+/** The version the lists below were read from. */
+export const AUDIT_PACKAGE_VERSION = '0.14.0';
+/** Insert and read only: the runtime role has UPDATE, DELETE and TRUNCATE revoked on each. */
+export const AUDIT_APPEND_ONLY_TABLES = [
+    'audit_events',
+    'audit_checkpoints',
+    'audit_signing_keys',
+    'audit_anchors',
+];
+/**
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
+ * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
+ * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ */
+export const AUDIT_APP_GRANTS = ['audit_chain_tail()', 'audit_chain_tail_v2()'];
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+export const AUDIT_SEALER_GRANTS = [
+    'audit_chain_leaves(bigint, integer)',
+    'audit_retire_signing_key(text)',
+];
+const without = (list, drop) => (list ?? []).filter((item) => !drop.includes(item));
+/**
+ * The database part with the derived tables and grants in (`on`) or out (`off`). Hand-listed names are kept, a
+ * name is never listed twice, and turning it off takes out exactly the derived names. Never changes `database`.
+ */
+export function withAuditDatabase(database, on) {
+    const { appendOnly: _tables, grants: _grants, ...rest } = database;
+    const next = rest;
+    const appendOnly = on
+        ? [...AUDIT_APPEND_ONLY_TABLES, ...without(database.appendOnly, AUDIT_APPEND_ONLY_TABLES)]
+        : without(database.appendOnly, AUDIT_APPEND_ONLY_TABLES);
+    const grants = on
+        ? [...AUDIT_APP_GRANTS, ...without(database.grants, AUDIT_APP_GRANTS)]
+        : without(database.grants, AUDIT_APP_GRANTS);
+    if (appendOnly.length > 0)
+        next.appendOnly = appendOnly;
+    if (grants.length > 0)
+        next.grants = grants;
+    return next;
+}

package/dist/modules/audit.d.ts

@@ -0,0 +1,7 @@
+import type { AppModule } from './types.js';
+/**
+ * `uses.audit`: the app keeps a tamper-evident audit log. Applied after `database`, which it needs: it adds the
+ * derived append-only tables and chain functions to the Worker app's database part (`modules/audit-ledger.ts`) and
+ * registers the app's ledger for the platform's sealing service. Turning it off takes out only what it added.
+ */
+export declare const audit: AppModule;

package/dist/modules/audit.js

@@ -0,0 +1,44 @@
+import { withAuditDatabase } from './audit-ledger.js';
+import { setUse, withWorkerApp } from './entry-parts.js';
+/**
+ * `uses.audit`: the app keeps a tamper-evident audit log. Applied after `database`, which it needs: it adds the
+ * derived append-only tables and chain functions to the Worker app's database part (`modules/audit-ledger.ts`) and
+ * registers the app's ledger for the platform's sealing service. Turning it off takes out only what it added.
+ */
+export const audit = {
+    view: {
+        id: 'audit',
+        name: 'Audit log',
+        line: 'The app keeps a record of what happened that nobody can quietly change afterwards, not even us or your developers.',
+        category: 'Data',
+        icon: 'shield',
+        runtimes: ['worker'],
+        requires: ['database'],
+        availability: 'ready',
+        fields: [],
+        adds: [
+            {
+                name: 'A tamper-evident log',
+                hint: 'Each entry is chained to the one before it. The app can add and read entries but never change or delete them.',
+            },
+            {
+                name: 'Regular seals and outside time stamps',
+                hint: 'The platform signs the log on a schedule with a key the app never holds, and has an independent time authority stamp each seal.',
+            },
+            {
+                name: 'A proof you can check yourself',
+                hint: 'Download the log with its seals and check it offline, without trusting us.',
+            },
+        ],
+    },
+    toEntry(entry, values) {
+        const on = values !== null;
+        // Off takes out the derived names only when the entry had the module on: an app that still lists the
+        // same tables and grants by hand, and has not switched, keeps them.
+        if (!on && entry.uses?.audit !== true)
+            return setUse(entry, 'audit', undefined);
+        const withUse = setUse(entry, 'audit', on ? true : undefined);
+        return withWorkerApp(withUse, (app) => app.database ? { ...app, database: withAuditDatabase(app.database, on) } : app);
+    },
+    fromEntry: (entry) => (entry.uses?.audit === true ? {} : null),
+};

package/dist/modules/database.d.ts

@@ -0,0 +1,23 @@
+import type { AppModule, ModuleProblem, ModuleValues } from './types.js';
+/** Which copy of a Worker app a database is for. */
+export type DatabaseCopy = 'workspace' | 'live';
+/** One copy's Postgres: migrations run as the owner, the app (through Hyperdrive) as the runtime user. */
+export interface DatabaseAddresses {
+    ownerUrl: string;
+    runtimeUrl: string;
+}
+/**
+ * The owner and runtime addresses of one copy's Postgres, for `applyWorkerAppMigrations` and `deployWorkerApp`
+ * (`database.url = runtimeUrl`). Null when the values give neither address of that copy; a problem, in plain
+ * words that never repeat an address, when one is missing, is not a Postgres address, uses the owner's user,
+ * or reaches another database than the owner.
+ */
+export declare function databaseAddressesOf(values: ModuleValues, copy: DatabaseCopy): DatabaseAddresses | ModuleProblem | null;
+/**
+ * A Postgres database for the app. A server app: `entry.database`. A Worker app: `workerApp.database`, reached
+ * through Hyperdrive, with its append-only tables and function grants. `migrationsSha256` is not a field: it
+ * comes from the build (`build.json`) and is kept as the entry holds it. A Worker app uses the company's own
+ * Postgres: an owner and an app address per copy, `secret` fields the caller holds and delivers itself. They
+ * never go into the entry, so `fromEntry` (and `modulesOf`) never gives them back.
+ */
+export declare const database: AppModule;

package/dist/modules/database.js

@@ -0,0 +1,189 @@
+import { WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_FUNCTION_SIGNATURE, WORKER_APP_GRANTS_MAX, WORKER_APP_TABLE_NAME, } from '../entry-rules.js';
+import { clone, list, omit, problem, withWorkerApp } from './entry-parts.js';
+const ADDRESS_HELP = 'From your Postgres provider. The owner can change tables; the app address is a separate user with less access. Use a different database for the workspace than for live.';
+const ADDRESS_MAX = 2000;
+const COPY_WORDS = { workspace: 'the workspace', live: 'live' };
+const ADDRESS_KEYS = {
+    workspace: { owner: 'workspaceOwnerUrl', app: 'workspaceAppUrl' },
+    live: { owner: 'liveOwnerUrl', app: 'liveAppUrl' },
+};
+const addressLabel = (copy, role) => `Database address for ${COPY_WORDS[copy]} (${role})`;
+const addressField = (copy, role) => ({
+    key: ADDRESS_KEYS[copy][role],
+    label: addressLabel(copy, role),
+    help: ADDRESS_HELP,
+    kind: 'secret',
+    required: true,
+    max: ADDRESS_MAX,
+    runtimes: ['worker'],
+});
+/** The user and the database (host, port, name) of a Postgres address, or null when it is not one. */
+function parseAddress(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'postgres:' && url.protocol !== 'postgresql:')
+        return null;
+    const name = url.pathname.replace(/^\//, '');
+    if (url.username === '' || url.hostname === '' || name === '' || name.includes('/'))
+        return null;
+    let user;
+    try {
+        user = decodeURIComponent(url.username);
+    }
+    catch {
+        return null;
+    }
+    return { user, place: `${url.hostname.toLowerCase()}:${url.port || '5432'}/${name}` };
+}
+/** One copy's addresses read and checked, with the database they reach; null when neither is given. */
+function readCopy(values, copy) {
+    const keys = ADDRESS_KEYS[copy];
+    const owner = values[keys.owner];
+    const app = values[keys.app];
+    const given = (value) => typeof value === 'string' && value !== '';
+    if (!given(owner) && !given(app))
+        return null;
+    if (!given(owner)) {
+        return problem(keys.owner, `"${addressLabel(copy, 'owner')}" is needed with the app address.`);
+    }
+    if (!given(app)) {
+        return problem(keys.app, `"${addressLabel(copy, 'app')}" is needed with the owner address.`);
+    }
+    const shape = (role) => `"${addressLabel(copy, role)}" is not a Postgres address. It starts with postgres:// or postgresql:// and names a user, a server and a database. Copy it again from your Postgres provider.`;
+    const ownerParts = parseAddress(owner);
+    if (!ownerParts)
+        return problem(keys.owner, shape('owner'));
+    const appParts = parseAddress(app);
+    if (!appParts)
+        return problem(keys.app, shape('app'));
+    if (ownerParts.user === appParts.user) {
+        return problem(keys.app, `The owner and app addresses for ${COPY_WORDS[copy]} use the same user. The app needs a separate user with less access.`);
+    }
+    if (ownerParts.place !== appParts.place) {
+        return problem(keys.app, `The app address for ${COPY_WORDS[copy]} reaches another database than the owner address. Both must reach the same database.`);
+    }
+    return { addresses: { ownerUrl: owner, runtimeUrl: app }, place: ownerParts.place };
+}
+/**
+ * The owner and runtime addresses of one copy's Postgres, for `applyWorkerAppMigrations` and `deployWorkerApp`
+ * (`database.url = runtimeUrl`). Null when the values give neither address of that copy; a problem, in plain
+ * words that never repeat an address, when one is missing, is not a Postgres address, uses the owner's user,
+ * or reaches another database than the owner.
+ */
+export function databaseAddressesOf(values, copy) {
+    const read = readCopy(values, copy);
+    if (read === null || 'message' in read)
+        return read;
+    return read.addresses;
+}
+/**
+ * A Postgres database for the app. A server app: `entry.database`. A Worker app: `workerApp.database`, reached
+ * through Hyperdrive, with its append-only tables and function grants. `migrationsSha256` is not a field: it
+ * comes from the build (`build.json`) and is kept as the entry holds it. A Worker app uses the company's own
+ * Postgres: an owner and an app address per copy, `secret` fields the caller holds and delivers itself. They
+ * never go into the entry, so `fromEntry` (and `modulesOf`) never gives them back.
+ */
+export const database = {
+    view: {
+        id: 'database',
+        name: 'Database',
+        line: "A database for the app's own records, kept safe with daily backups.",
+        category: 'Data',
+        icon: 'database',
+        runtimes: ['server', 'worker'],
+        requires: [],
+        availability: 'ready',
+        fields: [
+            addressField('workspace', 'owner'),
+            addressField('workspace', 'app'),
+            addressField('live', 'owner'),
+            addressField('live', 'app'),
+            {
+                key: 'appendOnly',
+                label: 'Tables that keep every row',
+                help: 'The app can add and read rows in these tables but never change or delete them, as for an audit trail. Only for apps that run as a Worker app.',
+                kind: 'list',
+                advanced: true,
+                pattern: WORKER_APP_TABLE_NAME.source,
+                max: WORKER_APP_APPEND_ONLY_MAX,
+            },
+            {
+                key: 'grants',
+                label: 'Database functions the app may run',
+                help: 'Functions your database setup locks down, written as name(type, ...), such as audit_chain_tail(). Only for apps that run as a Worker app.',
+                kind: 'list',
+                advanced: true,
+                pattern: WORKER_APP_FUNCTION_SIGNATURE.source,
+                max: WORKER_APP_GRANTS_MAX,
+            },
+        ],
+        adds: [
+            {
+                name: 'A Postgres database',
+                hint: 'Only this app reaches it. The app gets its address itself.',
+            },
+            { name: 'Backups', hint: 'A copy is made every day.' },
+        ],
+    },
+    check(values, _modules, ctx) {
+        if (ctx.runtime === 'server') {
+            for (const key of ['appendOnly', 'grants']) {
+                if (list(values, key) !== undefined) {
+                    return problem(key, 'Tables that keep every row and database functions can only be set for an app that runs as a Worker app.');
+                }
+            }
+            return null;
+        }
+        const workspace = readCopy(values, 'workspace');
+        if (workspace && 'message' in workspace)
+            return workspace;
+        const live = readCopy(values, 'live');
+        if (live && 'message' in live)
+            return live;
+        if (workspace && live && workspace.place === live.place) {
+            return problem(ADDRESS_KEYS.workspace.owner, 'The workspace and live use the same database. Use a different database for the workspace than for live.');
+        }
+        return null;
+    },
+    toEntry(entry, values, ctx) {
+        if (ctx.runtime === 'server') {
+            const next = clone(entry);
+            next.database = values !== null;
+            return next;
+        }
+        return withWorkerApp(entry, (app) => {
+            if (values === null)
+                return omit(app, 'database');
+            const next = {};
+            const appendOnly = list(values, 'appendOnly');
+            const grants = list(values, 'grants');
+            if (appendOnly)
+                next.appendOnly = appendOnly;
+            if (grants)
+                next.grants = grants;
+            const pinned = app.database?.migrationsSha256;
+            if (pinned !== undefined)
+                next.migrationsSha256 = pinned;
+            return { ...app, database: next };
+        });
+    },
+    fromEntry(entry) {
+        if (entry.workerApp) {
+            const db = entry.workerApp.database;
+            if (!db)
+                return null;
+            const values = {};
+            if (db.appendOnly?.length)
+                values.appendOnly = [...db.appendOnly];
+            if (db.grants?.length)
+                values.grants = [...db.grants];
+            return values;
+        }
+        return entry.database ? {} : null;
+    },
+};

package/dist/modules/email.d.ts

@@ -0,0 +1,3 @@
+import type { AppModule } from './types.js';
+/** `uses.mail`: the app sends mail from the company's mail domain. */
+export declare const email: AppModule;

package/dist/modules/email.js

@@ -0,0 +1,18 @@
+import { setUse } from './entry-parts.js';
+/** `uses.mail`: the app sends mail from the company's mail domain. */
+export const email = {
+    view: {
+        id: 'email',
+        name: 'Email',
+        line: "The app sends email from your company's address, such as receipts and notices.",
+        category: 'Messages',
+        icon: 'mail',
+        runtimes: ['server'],
+        requires: [],
+        availability: 'ready',
+        fields: [],
+        adds: [{ name: 'Sending email', hint: "From your company's own mail address." }],
+    },
+    toEntry: (entry, values) => setUse(entry, 'mail', values === null ? undefined : true),
+    fromEntry: (entry) => (entry.uses?.mail === true ? {} : null),
+};

package/dist/modules/entry-parts.d.ts

@@ -0,0 +1,23 @@
+import type { EntryAuth, HostingEntry, HostingEntryUses } from '../org.js';
+import type { WorkerAppConfig } from '../worker-app-config.js';
+import type { ModuleProblem, ModuleValue, ModuleValues } from './types.js';
+/** Helpers the modules share to change one part of an entry without touching the caller's copy. */
+export declare const clone: <T>(value: T) => T;
+/** A copy of `value` without `keys`. */
+export declare function omit<T extends object, K extends keyof T>(value: T, ...keys: K[]): Omit<T, K>;
+export declare const isProblem: (value: HostingEntry | ModuleProblem) => value is ModuleProblem;
+/** The entry with `uses` replaced; an empty `uses` is left out. */
+export declare function withUses(entry: HostingEntry, uses: HostingEntryUses): HostingEntry;
+/** The entry with `uses[key]` set, or removed when `value` is undefined. */
+export declare function setUse<K extends keyof HostingEntryUses>(entry: HostingEntry, key: K, value: HostingEntryUses[K] | undefined): HostingEntry;
+/** The entry with `uses.auth[key]` changed. Without `uses.auth` the entry comes back unchanged. */
+export declare function setAuthPart<K extends keyof EntryAuth>(entry: HostingEntry, key: K, value: EntryAuth[K] | undefined): HostingEntry;
+/** The entry with its `workerApp` replaced by `change`'s result. Without a `workerApp` the entry comes back unchanged. */
+export declare function withWorkerApp(entry: HostingEntry, change: (app: WorkerAppConfig) => WorkerAppConfig): HostingEntry;
+/** A text value, or undefined for an absent or empty one. */
+export declare function text(values: ModuleValues, key: string): string | undefined;
+/** A list value, or undefined for an absent or empty one. */
+export declare function list(values: ModuleValues, key: string): string[] | undefined;
+/** `values` without the keys whose value is undefined. */
+export declare function defined(values: Record<string, ModuleValue | undefined>): ModuleValues;
+export declare const problem: (field: string | null, message: string) => ModuleProblem;