@wtfalch/foundry 0.60.0 → 0.62.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, BlueGreenConfig, OrgBuiltinApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingGithub, BlueGreenConfig, OrgBuiltinApp, BouleApp, KosmosApp, OrgRefusal, OrgRefusalCode, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryAuthRoom, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceDatabase, OrgServiceSchema, EntryWorkspace, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
@@ -15,6 +15,8 @@ export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export type { Checkpoint, LastApplied, AppliedState, DestroyRecord, DestroyStepRecord, } from './state.js';
 export type { PlanStep, UnmanagedItem, PlanNote, Plan, VersionChangeItem } from './plan.js';
+export type { NativeBuildDispatchDeps, NativeBuildKeyEnvPort, } from './native-build.js';
+export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_REF, NATIVE_BUILD_DISPATCH_TIMEOUT_MS, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, NativeBuildDispatchError, dispatchNativeBuild, mintNativeBuildKey, } from './native-build.js';
 export type { AppliedVersion, AppliedVersionsStore, DeclaredOrgStore, HeldLease, MutationLease, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
 export { StaleLeaseError } from './store.js';
 export type { PlanApply, DestroyProgress } from './apply.js';
@@ -23,6 +25,8 @@ export { createPostgresAuditLog } from './store/audit.js';
 export type { Color, ReleaseAction, ReleaseSignal, ReleaseState, WindowState, } from './release/types.js';
 export type { ReleaseStore } from './release/state.js';
 export { readReleaseState, requestReleaseAction } from './release/state.js';
+export type { DeclaredClassRemoval, MigrationCompatibilityInput, MigrationCompatibilityProblem, MigrationCompatibilityResult, } from './release/migration-compatibility.js';
+export { checkMigrationCompatibility } from './release/migration-compatibility.js';
 export { createPostgresReleaseStore } from './store/postgres.js';
 export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseRequests, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
@@ -53,13 +57,17 @@ export type { FilesHostInput, JobsHostDeps, JobsHostInput, OwnAuthInstance, Plan
 export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
 export type { PlanOwnSfuOptions, SfuAppDeps, SfuAppInput } from './plan/index.js';
 export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuCompose, } from './plan/index.js';
-export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, KeysRegistrarPort, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, LoginHostDiscoveryPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
-export { NO_DOMAIN_ZONE, ownHostnames } from './plan/index.js';
+export { NO_DOMAIN_ZONE, entryMachinePaths, ownHostnames, privatePageGateKey, workspaceHost, } from './plan/index.js';
+export type { PrivatePageScope } from './plan/index.js';
+export type { HostedLabelRefusal } from './hosted-label.js';
+export { hostedLabelRefusal } from './hosted-label.js';
 export type { OwnHostnames } from './plan/index.js';
 export type { EnsureSignInOrgOptions } from './plan/index.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { httpKeysRegistrar, keysRegistrarFromConfig, KEYS_PLATFORM_TOKEN_ENV, KEYS_SERVICE_URL_ENV, } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './plan/index.js';
@@ -69,8 +77,9 @@ export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
+export type { DeployKeyTarget, GithubDeployKey, GithubDeployKeysPort } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createGithubDeployKeys, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformGithubReleaseHookDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, APPS_DOMAIN, DEFAULT_GATE_LIMIT, MAX_WORKSPACE_TESTERS, isLiveEntry, normalizeTesters, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, orgServiceDatabase, orgServiceDatabases, SFU_SLOT_MAX, VERSION_PIN_PARTS, isMainEntry, mainEntry, companyGithubFor, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, normalizeHostingRepos, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { refuseOrg } from './refuse-org.js';
 export { workerAppHasBuild } from './worker-app-config.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
@@ -10,10 +10,12 @@ export const PINNED_VERSIONS = VERSIONS;
 export { buildJsonSchema, parseBuildJson, BuildJsonError } from './build-json.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
+export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_REF, NATIVE_BUILD_DISPATCH_TIMEOUT_MS, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, NativeBuildDispatchError, dispatchNativeBuild, mintNativeBuildKey, } from './native-build.js';
 export { StaleLeaseError } from './store.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
 export { readReleaseState, requestReleaseAction } from './release/state.js';
+export { checkMigrationCompatibility } from './release/migration-compatibility.js';
 export { createPostgresReleaseStore } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseRequests, foundryRequestedChanges, } from './store/schema.js';
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
@@ -32,15 +34,17 @@ export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICE
 export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './plan/index.js';
 export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu, provisionSfuApp, sfuConfig, sfuCompose, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
-export { NO_DOMAIN_ZONE, ownHostnames } from './plan/index.js';
+export { NO_DOMAIN_ZONE, entryMachinePaths, ownHostnames, privatePageGateKey, workspaceHost, } from './plan/index.js';
+export { hostedLabelRefusal } from './hosted-label.js';
 export { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ensureSignInOrg, registerSignInDomain, signInOrgDomain, } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { httpKeysRegistrar, keysRegistrarFromConfig, KEYS_PLATFORM_TOKEN_ENV, KEYS_SERVICE_URL_ENV, } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
-export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
+export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createGithubDeployKeys, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelOrgMetadata, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './plan/index.js';

package/dist/migrations/0062_hosting_github.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: the company's installation of the platform's GitHub App (`HostingConfig.github`).
+-- Mirrors `src/store/schema.ts`'s `hostingGithub`. Additive and nullable, like 0060_hosting_repos.sql:
+-- a row written before it reads as no installation, and an older reader ignores the column.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_github jsonb;

package/dist/migrations/0063_boule_apps.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: `boule_apps` is `org.boule.apps` (F3, F5, F7): the company's Boule installs and runs apps, so
+-- foundry gives it the managed-apps platform keys (edge, sign-in broker registrar, signed-records registrar).
+-- Default false. Additive like 0059_org_builtin_blue_green.sql: `if not exists`, safe to run at container start on
+-- live rows. Mirrors src/store/schema.ts's `declaredOrgs`.
+
+alter table foundry_declared_orgs
+  add column if not exists boule_apps boolean not null default false;

package/dist/migrations/0064_requested_changes_boule_apps.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: a company's Boule can request `bouleApps` (turn `org.boule.apps` on or off).
+alter table foundry_requested_changes
+  drop constraint if exists foundry_requested_changes_field_check;
+alter table foundry_requested_changes
+  add constraint foundry_requested_changes_field_check
+    check (field in ('calls', 'customers', 'storageLimit', 'aiLimit', 'domain', 'mailTier', 'app', 'build', 'bouleApps'));

package/dist/migrations/0065_native_build_runs.sql

@@ -0,0 +1,32 @@
+-- @wtfalch/foundry: a company's native app settings and its native build runs (foundry#948, estate
+-- `.plans/2026-10-22-app-shells.md`). Additive, like 0060_hosting_repos.sql and
+-- 0055_release_requests.sql: a column with a default plus a new table, so a row written before this
+-- reads back `[]` and an older reader ignores both. Safe on live rows when the container starts.
+--
+-- foundry#951: Boule owns the native settings, build runs and store keys now (estate#262) -- the
+-- column and the table below are unused by this package's code from here on, but foundry#951 also
+-- establishes that a migration only adds in a release where idle and live share a database, so
+-- neither is dropped here. A later release drops both.
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_native_apps jsonb not null default '[]'::jsonb;
+
+create table if not exists foundry_native_build_runs (
+  id          bigserial primary key,
+  org_id      text not null,
+  app         text not null,
+  state       text not null default 'queued',
+  log         text,
+  created_at  timestamptz not null default now(),
+  updated_at  timestamptz not null default now()
+);
+
+alter table foundry_native_build_runs
+  drop constraint if exists foundry_native_build_runs_state_check;
+alter table foundry_native_build_runs
+  add constraint foundry_native_build_runs_state_check
+    check (state in ('queued', 'building', 'uploaded', 'failed'));
+
+-- Listing one app's runs, and (while foundry still checked it, before foundry#951) the `uploaded` look-up.
+create index if not exists foundry_native_build_runs_app_idx
+  on foundry_native_build_runs (org_id, app, id desc);

package/dist/migrations/0066_org_kosmos.sql

@@ -0,0 +1,10 @@
+-- @wtfalch/foundry: `kosmos_enabled` is `org.kosmos.enabled` (foundry#949): the company's own kosmos is set up
+-- only when it asks. `kosmos_blue_green` is `org.kosmos.blueGreen` ({ steps?, stepHoldMinutes? }, as the other
+-- two built-ins' own columns hold it) -- kept even though kosmos always runs blue/green once enabled, so tuning
+-- its steps needs no new column later. Both default to off. Additive like 0059_org_builtin_blue_green.sql and
+-- 0063_boule_apps.sql: `if not exists`, safe to run at container start on live rows.
+-- Mirrors src/store/schema.ts's `declaredOrgs`.
+
+alter table foundry_declared_orgs
+  add column if not exists kosmos_enabled boolean not null default false,
+  add column if not exists kosmos_blue_green jsonb;

package/dist/modules/ai.d.ts

@@ -0,0 +1,3 @@
+import type { AppModule } from './types.js';
+/** `uses.ai`: the app calls the AI tasks set up for the company. */
+export declare const ai: AppModule;

package/dist/modules/ai.js

@@ -0,0 +1,64 @@
+import { AI_ENTRY_PERMISSIONS, AI_WEBHOOK_PATH } from '../entry-rules.js';
+import { list, setUse, text } from './entry-parts.js';
+/** `uses.ai`: the app calls the AI tasks set up for the company. */
+export const ai = {
+    view: {
+        id: 'ai',
+        name: 'AI',
+        line: 'The app uses AI to do work for people, such as writing a summary or reading a document.',
+        category: 'AI',
+        icon: 'sparkles',
+        runtimes: ['server'],
+        requires: [],
+        availability: 'ready',
+        fields: [
+            {
+                key: 'offerings',
+                label: 'AI tasks the app may use',
+                help: 'The names of the AI tasks set up for your company.',
+                kind: 'list',
+                required: true,
+            },
+            {
+                key: 'webhookPath',
+                label: 'Page that receives finished AI work',
+                help: 'A page on your app, such as /api/ai/done. Leave it empty if the app waits for the answer.',
+                kind: 'path',
+                advanced: true,
+                pattern: AI_WEBHOOK_PATH.source,
+            },
+            {
+                key: 'permissions',
+                label: 'What the app may do',
+                help: 'Leave it empty to allow all of them.',
+                kind: 'list',
+                advanced: true,
+                choices: AI_ENTRY_PERMISSIONS.map((value) => ({ value, label: value })),
+            },
+        ],
+        adds: [{ name: 'AI tasks', hint: "Run on your company's own AI account." }],
+    },
+    toEntry(entry, values) {
+        if (values === null)
+            return setUse(entry, 'ai', undefined);
+        const next = { offerings: list(values, 'offerings') ?? [] };
+        const permissions = list(values, 'permissions');
+        const webhookPath = text(values, 'webhookPath');
+        if (permissions)
+            next.permissions = permissions;
+        if (webhookPath !== undefined)
+            next.webhookPath = webhookPath;
+        return setUse(entry, 'ai', next);
+    },
+    fromEntry(entry) {
+        const used = entry.uses?.ai;
+        if (!used)
+            return null;
+        const values = { offerings: [...used.offerings] };
+        if (used.permissions?.length)
+            values.permissions = [...used.permissions];
+        if (used.webhookPath !== undefined)
+            values.webhookPath = used.webhookPath;
+        return values;
+    },
+};

package/dist/modules/assistants.d.ts

@@ -0,0 +1,3 @@
+import type { AppModule } from './types.js';
+/** `uses.auth.mcp`: the app serves AI assistants (MCP clients) that sign the customer in. */
+export declare const assistants: AppModule;

package/dist/modules/assistants.js

@@ -0,0 +1,72 @@
+import { MCP_PATH, isPagePath } from '../entry-rules.js';
+import { problem, setAuthPart, text } from './entry-parts.js';
+/** `uses.auth.mcp`: the app serves AI assistants (MCP clients) that sign the customer in. */
+export const assistants = {
+    view: {
+        id: 'assistants',
+        name: 'Help for AI assistants',
+        line: 'Your customers connect their own AI assistant, such as Claude or ChatGPT, to the app and use it from their chat.',
+        category: 'AI',
+        icon: 'bot',
+        runtimes: ['server', 'worker'],
+        requires: ['sign-in'],
+        availability: 'ready',
+        fields: [
+            {
+                key: 'path',
+                label: 'Where assistants connect',
+                help: 'The address on your app that assistants connect to. Most apps use /mcp.',
+                kind: 'path',
+                required: true,
+                default: '/mcp',
+                pattern: MCP_PATH.source,
+                max: 200,
+            },
+            {
+                key: 'onboardingPath',
+                label: 'Page shown after the first sign-in',
+                help: 'A page on your app that tells a new customer what to do next, such as /onboarding. Leave it empty for none.',
+                kind: 'path',
+                advanced: true,
+            },
+        ],
+        adds: [
+            {
+                name: 'A connection for AI assistants',
+                hint: 'Each customer signs in once from their assistant; the assistant then acts as them.',
+            },
+        ],
+    },
+    check(values, modules) {
+        const signIn = modules['sign-in'];
+        if (signIn?.users !== 'customers' || signIn?.registration !== 'open') {
+            return problem(null, 'Help for AI assistants needs Sign-in for your customers, where anyone can make an account: each customer connects their own assistant. In Sign-in, choose "Your customers" and "Anyone".');
+        }
+        const onboarding = text(values, 'onboardingPath');
+        if (onboarding !== undefined && !isPagePath(onboarding)) {
+            return problem('onboardingPath', 'The page must start with "/", such as /onboarding, with no spaces, "?", "#" or "..".');
+        }
+        return null;
+    },
+    toEntry(entry, values) {
+        if (values === null)
+            return setAuthPart(entry, 'mcp', undefined);
+        if (!entry.uses?.auth) {
+            return problem(null, 'Help for AI assistants needs Sign-in. Turn on Sign-in first.');
+        }
+        const onboardingPath = text(values, 'onboardingPath');
+        return setAuthPart(entry, 'mcp', {
+            path: values.path,
+            ...(onboardingPath !== undefined ? { onboardingPath } : {}),
+        });
+    },
+    fromEntry(entry) {
+        const mcp = entry.uses?.auth?.mcp;
+        if (!mcp)
+            return null;
+        const values = { path: mcp.path };
+        if (mcp.onboardingPath !== undefined)
+            values.onboardingPath = mcp.onboardingPath;
+        return values;
+    },
+};

package/dist/modules/audit-ledger.d.ts

@@ -0,0 +1,29 @@
+import type { WorkerAppConfig } from '../worker-app-config.js';
+/**
+ * What `uses.audit` derives from the pinned `@wtfalch/audit`, so an app never lists it by hand (foundry#929).
+ *
+ * The package is installed under the alias `@wtfalch/audit-sealing` because foundry's own ledger still runs the
+ * 0.6.0 migrations (`@wtfalch/audit`, migrations 0012 and 0024-0028 here); the sealing service needs the
+ * checkpoint, anchor and bundle code that came after. `audit/ledger-set.test.ts` checks every name below against the
+ * installed package's own migrations, so a bump that renames one fails there and not in a company's database.
+ */
+/** The version the lists below were read from. */
+export declare const AUDIT_PACKAGE_VERSION = "0.14.0";
+/** Insert and read only: the runtime role has UPDATE, DELETE and TRUNCATE revoked on each. */
+export declare const AUDIT_APPEND_ONLY_TABLES: readonly string[];
+/**
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
+ * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
+ * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ */
+export declare const AUDIT_APP_GRANTS: readonly string[];
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+export declare const AUDIT_SEALER_GRANTS: readonly string[];
+type Database = NonNullable<WorkerAppConfig['database']>;
+/**
+ * The database part with the derived tables and grants in (`on`) or out (`off`). Hand-listed names are kept, a
+ * name is never listed twice, and turning it off takes out exactly the derived names. Never changes `database`.
+ */
+export declare function withAuditDatabase(database: Database, on: boolean): Database;
+export {};

package/dist/modules/audit-ledger.js

@@ -0,0 +1,49 @@
+/**
+ * What `uses.audit` derives from the pinned `@wtfalch/audit`, so an app never lists it by hand (foundry#929).
+ *
+ * The package is installed under the alias `@wtfalch/audit-sealing` because foundry's own ledger still runs the
+ * 0.6.0 migrations (`@wtfalch/audit`, migrations 0012 and 0024-0028 here); the sealing service needs the
+ * checkpoint, anchor and bundle code that came after. `audit/ledger-set.test.ts` checks every name below against the
+ * installed package's own migrations, so a bump that renames one fails there and not in a company's database.
+ */
+/** The version the lists below were read from. */
+export const AUDIT_PACKAGE_VERSION = '0.14.0';
+/** Insert and read only: the runtime role has UPDATE, DELETE and TRUNCATE revoked on each. */
+export const AUDIT_APPEND_ONLY_TABLES = [
+    'audit_events',
+    'audit_checkpoints',
+    'audit_signing_keys',
+    'audit_anchors',
+];
+/**
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
+ * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
+ * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ */
+export const AUDIT_APP_GRANTS = ['audit_chain_tail()', 'audit_chain_tail_v2()'];
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+export const AUDIT_SEALER_GRANTS = [
+    'audit_chain_leaves(bigint, integer)',
+    'audit_retire_signing_key(text)',
+];
+const without = (list, drop) => (list ?? []).filter((item) => !drop.includes(item));
+/**
+ * The database part with the derived tables and grants in (`on`) or out (`off`). Hand-listed names are kept, a
+ * name is never listed twice, and turning it off takes out exactly the derived names. Never changes `database`.
+ */
+export function withAuditDatabase(database, on) {
+    const { appendOnly: _tables, grants: _grants, ...rest } = database;
+    const next = rest;
+    const appendOnly = on
+        ? [...AUDIT_APPEND_ONLY_TABLES, ...without(database.appendOnly, AUDIT_APPEND_ONLY_TABLES)]
+        : without(database.appendOnly, AUDIT_APPEND_ONLY_TABLES);
+    const grants = on
+        ? [...AUDIT_APP_GRANTS, ...without(database.grants, AUDIT_APP_GRANTS)]
+        : without(database.grants, AUDIT_APP_GRANTS);
+    if (appendOnly.length > 0)
+        next.appendOnly = appendOnly;
+    if (grants.length > 0)
+        next.grants = grants;
+    return next;
+}

package/dist/modules/audit.d.ts

@@ -0,0 +1,7 @@
+import type { AppModule } from './types.js';
+/**
+ * `uses.audit`: the app keeps a tamper-evident audit log. Applied after `database`, which it needs: it adds the
+ * derived append-only tables and chain functions to the Worker app's database part (`modules/audit-ledger.ts`) and
+ * registers the app's ledger for the platform's sealing service. Turning it off takes out only what it added.
+ */
+export declare const audit: AppModule;

package/dist/modules/audit.js

@@ -0,0 +1,44 @@
+import { withAuditDatabase } from './audit-ledger.js';
+import { setUse, withWorkerApp } from './entry-parts.js';
+/**
+ * `uses.audit`: the app keeps a tamper-evident audit log. Applied after `database`, which it needs: it adds the
+ * derived append-only tables and chain functions to the Worker app's database part (`modules/audit-ledger.ts`) and
+ * registers the app's ledger for the platform's sealing service. Turning it off takes out only what it added.
+ */
+export const audit = {
+    view: {
+        id: 'audit',
+        name: 'Audit log',
+        line: 'The app keeps a record of what happened that nobody can quietly change afterwards, not even us or your developers.',
+        category: 'Data',
+        icon: 'shield',
+        runtimes: ['worker'],
+        requires: ['database'],
+        availability: 'ready',
+        fields: [],
+        adds: [
+            {
+                name: 'A tamper-evident log',
+                hint: 'Each entry is chained to the one before it. The app can add and read entries but never change or delete them.',
+            },
+            {
+                name: 'Regular seals and outside time stamps',
+                hint: 'The platform signs the log on a schedule with a key the app never holds, and has an independent time authority stamp each seal.',
+            },
+            {
+                name: 'A proof you can check yourself',
+                hint: 'Download the log with its seals and check it offline, without trusting us.',
+            },
+        ],
+    },
+    toEntry(entry, values) {
+        const on = values !== null;
+        // Off takes out the derived names only when the entry had the module on: an app that still lists the
+        // same tables and grants by hand, and has not switched, keeps them.
+        if (!on && entry.uses?.audit !== true)
+            return setUse(entry, 'audit', undefined);
+        const withUse = setUse(entry, 'audit', on ? true : undefined);
+        return withWorkerApp(withUse, (app) => app.database ? { ...app, database: withAuditDatabase(app.database, on) } : app);
+    },
+    fromEntry: (entry) => (entry.uses?.audit === true ? {} : null),
+};

package/dist/modules/database.d.ts

@@ -0,0 +1,23 @@
+import type { AppModule, ModuleProblem, ModuleValues } from './types.js';
+/** Which copy of a Worker app a database is for. */
+export type DatabaseCopy = 'workspace' | 'live';
+/** One copy's Postgres: migrations run as the owner, the app (through Hyperdrive) as the runtime user. */
+export interface DatabaseAddresses {
+    ownerUrl: string;
+    runtimeUrl: string;
+}
+/**
+ * The owner and runtime addresses of one copy's Postgres, for `applyWorkerAppMigrations` and `deployWorkerApp`
+ * (`database.url = runtimeUrl`). Null when the values give neither address of that copy; a problem, in plain
+ * words that never repeat an address, when one is missing, is not a Postgres address, uses the owner's user,
+ * or reaches another database than the owner.
+ */
+export declare function databaseAddressesOf(values: ModuleValues, copy: DatabaseCopy): DatabaseAddresses | ModuleProblem | null;
+/**
+ * A Postgres database for the app. A server app: `entry.database`. A Worker app: `workerApp.database`, reached
+ * through Hyperdrive, with its append-only tables and function grants. `migrationsSha256` is not a field: it
+ * comes from the build (`build.json`) and is kept as the entry holds it. A Worker app uses the company's own
+ * Postgres: an owner and an app address per copy, `secret` fields the caller holds and delivers itself. They
+ * never go into the entry, so `fromEntry` (and `modulesOf`) never gives them back.
+ */
+export declare const database: AppModule;