@wtfalch/foundry 0.61.0 → 0.62.0

package/dist/plan/providers-readers.js

@@ -2,6 +2,7 @@ import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { APP_ENTRY_KEY } from '../org.js';
 import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 import { previewsOn } from './coolify-previews.js';
+import { KOSMOS_MANAGED_ENV_KEYS } from './kosmos.js';
 import { APP_GONE_KIND, } from './live.js';
 import { SIGN_IN_UPSTREAM_ENV } from './sign-in.js';
 /**
@@ -302,6 +303,23 @@ async function withBouleEnvConfig(client, resource, recorded, liveKeys) {
         config: { ...resource.config, env, ...(appToken ? { appMailToken: appToken } : {}) },
     };
 }
+/**
+ * The org's own recorded kosmos app's live sign-in env vars, as `config.env`, so `diff.ts`'s `planKosmos`
+ * can compare them with what `executor.ts` would write. Gated and failing exactly like
+ * {@link withAgoraEnvConfig}.
+ */
+async function withKosmosEnvConfig(client, resource, recorded) {
+    if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('kosmos:')) {
+        return resource;
+    }
+    const managed = KOSMOS_MANAGED_ENV_KEYS;
+    const env = {};
+    for (const e of await client.listEnvs(resource.key)) {
+        if (!e.is_preview && managed.includes(e.key))
+            env[e.key] = e.value;
+    }
+    return { ...resource, config: { ...resource.config, env } };
+}
 /** `@wtfalch/providers`' own `LiveResource` (`resource.ts`) has no `system` field — foundry's adds it at this boundary. */
 function toFoundryResources(system, resources) {
     return resources.map((r) => ({ system, kind: r.kind, key: r.key, config: r.config }));
@@ -335,7 +353,8 @@ export class ProvidersCoolifyReader {
         const withAgoraConfig = await Promise.all(withDbUrl.map((r) => withAgoraEnvConfig(this.client, r, recorded)));
         const liveKeys = new Set(withAgoraConfig.map((r) => r.key));
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded, liveKeys)));
-        return applyRecordedIds(withBouleConfig, recorded);
+        const withKosmosConfig = await Promise.all(withBouleConfig.map((r) => withKosmosEnvConfig(this.client, r, recorded)));
+        return applyRecordedIds(withKosmosConfig, recorded);
     }
     async liveEnvEquals(orgId, appKey, name, value) {
         const recorded = await this.resolveRecordedIds(orgId);

package/dist/release/migration-compatibility.d.ts

@@ -0,0 +1,66 @@
+import { type WorkerAppConfig } from '../worker-app-config.js';
+/**
+ * Whether a release's database changes may go to idle (foundry#934, estate DECISIONS.md,
+ * 2026-10-21 "Releases and versions"). Idle shares the live database with whatever release is
+ * live, so a release may only add -- never drop, narrow, rename or retype something the live
+ * release still reads or writes, and never delete a Durable Object class the live release still
+ * uses. A removal needs two releases: one that stops using the object, a later one -- once that
+ * first release is no longer on live, idle or draining anywhere -- that removes it.
+ *
+ * Pure: no database connection, no network call, no data read. The caller supplies everything it
+ * already has: what the previous live release applied (`liveMigrationIds`, `liveDoTag`), what
+ * release tags are deployed anywhere right now (`deployedReleases`), and which removals this
+ * release declares as the drained second step of an earlier one (`declaredRemovals`). There is no
+ * override beyond that declaration: a destructive step with no declaration, or whose declared
+ * release has not drained, is refused every time.
+ *
+ * A SQL statement declares its own removal with a `-- removal-since: <release>` comment directly
+ * above it (the same convention `@wtfalch/db`'s migration safety check uses for
+ * `-- destructive: <reason>`); a Durable Object class removal is declared in `declaredRemovals`,
+ * since `deleted_classes` carries no comment of its own.
+ *
+ * The SQL classifier is pattern-based, not a real SQL parser: it is a safety rail against an
+ * accidental incompatible release, not a boundary against someone deliberately hiding a drop
+ * inside a string. A statement it cannot classify is refused rather than guessed as safe.
+ */
+/** A Durable Object class removal this release declares as the drained second step of an earlier one. */
+export interface DeclaredClassRemoval {
+    /** The class name a `deleted_classes` step of this release removes. */
+    className: string;
+    /** The earlier release that stopped using the class. Must have fully drained before this passes. */
+    sinceRelease: string;
+}
+export interface MigrationCompatibilityInput {
+    /** This release's own `migrations.json` (SQL), or `null` for a release with none. */
+    migrationsJson: string | null;
+    /** The SQL migration ids the previous live release already applied, in order. Default: none. */
+    liveMigrationIds?: readonly string[];
+    /** This release's full, declared Durable Object migrations, in order. Default: none. */
+    doMigrations?: WorkerAppConfig['durableObjects']['migrations'];
+    /** The Durable Object migration tag the previous live release holds, if any. */
+    liveDoTag?: string;
+    /** Durable Object class removals this release declares. Default: none. */
+    declaredRemovals?: readonly DeclaredClassRemoval[];
+    /** Release tags that are, right now, on live, idle or draining anywhere for this app. Default: none. */
+    deployedReleases?: readonly string[];
+}
+export interface MigrationCompatibilityProblem {
+    /** The SQL migration id or Durable Object migration tag the statement is in. */
+    migration: string;
+    /** The statement or step that is refused, trimmed to one line. */
+    statement: string;
+    /** Why it is refused, and what to do about it, in plain words. */
+    reason: string;
+}
+export type MigrationCompatibilityResult = {
+    ok: true;
+} | {
+    ok: false;
+    problems: MigrationCompatibilityProblem[];
+};
+/**
+ * Whether a release's migrations (SQL and Durable Object) may go to idle, given what the
+ * previous live release already applied and which releases are deployed anywhere right now. See
+ * the module docstring for the rule and the removal convention.
+ */
+export declare function checkMigrationCompatibility(input: MigrationCompatibilityInput): MigrationCompatibilityResult;

package/dist/release/migration-compatibility.js

@@ -0,0 +1,340 @@
+import { foldMigrationClasses } from '../worker-app-config.js';
+import { parseMigrations, unappliedDatabaseMigrations, } from '../worker-app-migrations.js';
+const REMOVAL_MARKER = /^--\s*removal-since:\s*(\S.*)$/i;
+const STATEMENT_MAX_CHARS = 160;
+/** Collapses whitespace and cuts a statement down to a readable, one-line length for a message. */
+function oneLine(text) {
+    const collapsed = text.replace(/\s+/g, ' ').trim();
+    return collapsed.length > STATEMENT_MAX_CHARS
+        ? `${collapsed.slice(0, STATEMENT_MAX_CHARS - 1)}…`
+        : collapsed;
+}
+/**
+ * Splits `sql` into standalone statements at a semicolon that sits outside a line comment, a
+ * block comment, a single- or double-quoted literal, and a dollar-quoted body (a function's
+ * `$$ ... $$`, which may itself hold semicolons). Each statement keeps any comment lines directly
+ * above it, so a `-- removal-since:` marker travels with the statement it excuses.
+ */
+function splitStatements(sql) {
+    const statements = [];
+    let current = '';
+    let i = 0;
+    const n = sql.length;
+    while (i < n) {
+        const ch = sql[i];
+        if (ch === '-' && sql[i + 1] === '-') {
+            const end = sql.indexOf('\n', i);
+            const end2 = end === -1 ? n : end + 1;
+            current += sql.slice(i, end2);
+            i = end2;
+            continue;
+        }
+        if (ch === '/' && sql[i + 1] === '*') {
+            const end = sql.indexOf('*/', i + 2);
+            const end2 = end === -1 ? n : end + 2;
+            current += sql.slice(i, end2);
+            i = end2;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === ch) {
+                    if (sql[j + 1] === ch) {
+                        j += 2;
+                        continue;
+                    }
+                    j += 1;
+                    break;
+                }
+                j += 1;
+            }
+            current += sql.slice(i, j);
+            i = j;
+            continue;
+        }
+        if (ch === '$') {
+            const tagMatch = /^\$[A-Za-z_][A-Za-z0-9_]*\$|^\$\$/.exec(sql.slice(i));
+            if (tagMatch) {
+                const tag = tagMatch[0];
+                const end = sql.indexOf(tag, i + tag.length);
+                const end2 = end === -1 ? n : end + tag.length;
+                current += sql.slice(i, end2);
+                i = end2;
+                continue;
+            }
+        }
+        if (ch === ';') {
+            statements.push(current);
+            current = '';
+            i += 1;
+            continue;
+        }
+        current += ch;
+        i += 1;
+    }
+    if (current.trim() !== '')
+        statements.push(current);
+    return statements;
+}
+/**
+ * Splits `code` at a top-level comma (outside a quoted literal or parentheses), so each element
+ * of an `ALTER TABLE`'s comma-separated action list -- `ADD COLUMN a text DEFAULT 'x', ADD COLUMN
+ * b integer NOT NULL` -- can be judged on its own. Without this, a `DEFAULT` on one added column
+ * hid a `NOT NULL` with no default on a different one, because the two regexes ran against the
+ * whole statement (foundry#941 review).
+ */
+function splitTopLevelCommas(code) {
+    const parts = [];
+    let current = '';
+    let depth = 0;
+    let i = 0;
+    const n = code.length;
+    while (i < n) {
+        const ch = code[i];
+        if (ch === "'" || ch === '"') {
+            let j = i + 1;
+            while (j < n) {
+                if (code[j] === ch) {
+                    if (code[j + 1] === ch) {
+                        j += 2;
+                        continue;
+                    }
+                    j += 1;
+                    break;
+                }
+                j += 1;
+            }
+            current += code.slice(i, j);
+            i = j;
+            continue;
+        }
+        if (ch === '(') {
+            depth += 1;
+            current += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === ')') {
+            depth = Math.max(0, depth - 1);
+            current += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === ',' && depth === 0) {
+            parts.push(current);
+            current = '';
+            i += 1;
+            continue;
+        }
+        current += ch;
+        i += 1;
+    }
+    parts.push(current);
+    return parts;
+}
+/** The statement with its leading blank and comment lines removed, so classification reads code, not a marker. */
+function withoutLeadingComments(statement) {
+    const lines = statement.split('\n');
+    let i = 0;
+    while (i < lines.length) {
+        const trimmed = lines[i].trim();
+        if (trimmed === '' || trimmed.startsWith('--')) {
+            i += 1;
+            continue;
+        }
+        break;
+    }
+    return lines.slice(i).join('\n').trim();
+}
+/** The release named in a `-- removal-since: <release>` line directly above the statement, or `null`. */
+function declaredSince(statement) {
+    for (const line of statement.split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed === '')
+            continue;
+        const match = REMOVAL_MARKER.exec(trimmed);
+        if (match)
+            return match[1].trim();
+        if (!trimmed.startsWith('--'))
+            break;
+    }
+    return null;
+}
+/**
+ * Classifies one statement's code (comments already stripped) as additive or destructive, or
+ * `null` when it cannot tell: an unrecognised statement is never assumed to be additive.
+ */
+function classifyStatement(code) {
+    if (code === '')
+        return null;
+    if (/^CREATE\s+(OR\s+REPLACE\s+)?(TABLE|SCHEMA|EXTENSION|SEQUENCE|VIEW)\b/i.test(code)) {
+        return { destructive: false, reason: 'creates something new' };
+    }
+    if (/^CREATE\s+(UNIQUE\s+)?INDEX(\s+CONCURRENTLY)?\b/i.test(code)) {
+        return { destructive: false, reason: 'adds an index' };
+    }
+    if (/^CREATE\s+(OR\s+REPLACE\s+)?(FUNCTION|PROCEDURE)\b/i.test(code)) {
+        return { destructive: false, reason: 'adds or replaces a function' };
+    }
+    if (/^CREATE\s+(OR\s+REPLACE\s+)?TRIGGER\b/i.test(code)) {
+        return { destructive: false, reason: 'adds a trigger' };
+    }
+    if (/^(COMMENT\s+ON|GRANT)\b/i.test(code)) {
+        return {
+            destructive: false,
+            reason: 'changes neither data nor structure a running release reads',
+        };
+    }
+    if (/^ALTER\s+TABLE\b/i.test(code)) {
+        if (/\bDROP\s+COLUMN\b/i.test(code))
+            return { destructive: true, reason: 'drops a column' };
+        if (/\bDROP\s+CONSTRAINT\b/i.test(code))
+            return { destructive: true, reason: 'drops a constraint' };
+        if (/\bRENAME\b/i.test(code))
+            return { destructive: true, reason: 'renames a table or column' };
+        if (/\bALTER\s+COLUMN\b[\s\S]*\b(SET\s+DATA\s+)?TYPE\b/i.test(code)) {
+            return { destructive: true, reason: "changes a column's type" };
+        }
+        if (/\bSET\s+NOT\s+NULL\b/i.test(code)) {
+            return { destructive: true, reason: 'adds a NOT NULL constraint to an existing column' };
+        }
+        if (/\bADD\s+COLUMN\b/i.test(code)) {
+            for (const clause of splitTopLevelCommas(code)) {
+                if (!/\bADD\s+COLUMN\b/i.test(clause))
+                    continue;
+                if (/\bNOT\s+NULL\b/i.test(clause) && !/\bDEFAULT\b/i.test(clause)) {
+                    return { destructive: true, reason: 'adds a NOT NULL column with no default' };
+                }
+            }
+            return { destructive: false, reason: 'adds a column' };
+        }
+        if (/\bADD\s+CONSTRAINT\b/i.test(code))
+            return { destructive: false, reason: 'adds a constraint' };
+        return null;
+    }
+    if (/^DROP\s+(TABLE|INDEX|TYPE|SCHEMA|FUNCTION|PROCEDURE|TRIGGER|VIEW|MATERIALIZED\s+VIEW|EXTENSION|SEQUENCE)\b/i.test(code)) {
+        return { destructive: true, reason: 'drops something the live release may still read' };
+    }
+    if (/^(TRUNCATE|DELETE\s+FROM|UPDATE\s+\S+\s+SET)\b/i.test(code)) {
+        return { destructive: true, reason: 'removes or rewrites existing rows' };
+    }
+    if (/^ALTER\s+(INDEX|SEQUENCE|VIEW|TYPE|SCHEMA)\b[\s\S]*\bRENAME\b/i.test(code)) {
+        return { destructive: true, reason: 'renames something' };
+    }
+    return null;
+}
+const splitHelp = (what) => `${what}; split this into two releases: stop using it in one, remove it in a later release once that one is no longer on live, idle or draining`;
+/** A destructive statement or step named `since` is drained once that release deploys nowhere. */
+function hasDrained(since, deployedReleases) {
+    return !deployedReleases.includes(since);
+}
+function sqlProblems(migrationsJson, liveMigrationIds, deployedReleases) {
+    let declared;
+    try {
+        declared = parseMigrations(migrationsJson);
+    }
+    catch (error) {
+        return [{ migration: '', statement: '', reason: error.message }];
+    }
+    let pending;
+    try {
+        pending = unappliedDatabaseMigrations(declared, liveMigrationIds);
+    }
+    catch (error) {
+        return [{ migration: '', statement: '', reason: error.message }];
+    }
+    const problems = [];
+    for (const migration of pending) {
+        for (const statement of splitStatements(migration.sql)) {
+            const code = withoutLeadingComments(statement);
+            const classified = classifyStatement(code);
+            if (classified === null) {
+                problems.push({
+                    migration: migration.id,
+                    statement: oneLine(code),
+                    reason: 'this statement is not one foundry recognises as additive; split it into its own release and ask a person',
+                });
+                continue;
+            }
+            if (!classified.destructive)
+                continue;
+            const since = declaredSince(statement);
+            if (since === null) {
+                problems.push({
+                    migration: migration.id,
+                    statement: oneLine(code),
+                    reason: splitHelp(classified.reason),
+                });
+                continue;
+            }
+            if (!hasDrained(since, deployedReleases)) {
+                problems.push({
+                    migration: migration.id,
+                    statement: oneLine(code),
+                    reason: `${classified.reason}; declared as the second step after release ${since}, but ${since} is still on live, idle or draining -- wait for it to fully drain, then release this one`,
+                });
+            }
+        }
+    }
+    return problems;
+}
+function doProblems(doMigrations, liveDoTag, declaredRemovals, deployedReleases) {
+    if (doMigrations.length === 0)
+        return [];
+    let appliedCount = 0;
+    if (liveDoTag !== undefined) {
+        const index = doMigrations.findIndex((m) => m.tag === liveDoTag);
+        if (index < 0) {
+            return [
+                {
+                    migration: liveDoTag,
+                    statement: '',
+                    reason: "the live release holds a Durable Object migration that is not in this release's declared list; migrations are append-only",
+                },
+            ];
+        }
+        appliedCount = index + 1;
+    }
+    const folded = foldMigrationClasses(doMigrations.slice(0, appliedCount));
+    if ('error' in folded)
+        return [{ migration: '', statement: '', reason: folded.error }];
+    const problems = [];
+    for (const migration of doMigrations.slice(appliedCount)) {
+        for (const className of migration.deletedClasses ?? []) {
+            if (!folded.classes.has(className))
+                continue; // never reached live: nothing running still uses it
+            const removal = declaredRemovals.find((r) => r.className === className);
+            const statement = `deleted_classes: ${className}`;
+            if (!removal) {
+                problems.push({
+                    migration: migration.tag,
+                    statement,
+                    reason: splitHelp(`deletes the Durable Object class '${className}', which the live release still uses`),
+                });
+                continue;
+            }
+            if (!hasDrained(removal.sinceRelease, deployedReleases)) {
+                problems.push({
+                    migration: migration.tag,
+                    statement,
+                    reason: `deletes the Durable Object class '${className}', declared as the second step after release ${removal.sinceRelease}, but ${removal.sinceRelease} is still on live, idle or draining -- wait for it to fully drain, then release this one`,
+                });
+            }
+        }
+    }
+    return problems;
+}
+/**
+ * Whether a release's migrations (SQL and Durable Object) may go to idle, given what the
+ * previous live release already applied and which releases are deployed anywhere right now. See
+ * the module docstring for the rule and the removal convention.
+ */
+export function checkMigrationCompatibility(input) {
+    const deployedReleases = input.deployedReleases ?? [];
+    const problems = [
+        ...sqlProblems(input.migrationsJson, input.liveMigrationIds ?? [], deployedReleases),
+        ...doProblems(input.doMigrations ?? [], input.liveDoTag, input.declaredRemovals ?? [], deployedReleases),
+    ];
+    return problems.length === 0 ? { ok: true } : { ok: false, problems };
+}

package/dist/requested-changes.js

@@ -124,8 +124,9 @@ export function classifyChange(org, change, plan) {
         throw new RequestedChangeError(`'${change.field}' is not a requestable field`);
     }
     // Archon validates the whole company for these; nothing waits for approval.
-    if (change.field === 'app' || change.field === 'build')
+    if (change.field === 'app' || change.field === 'build') {
         return 'auto';
+    }
     if (change.field === 'bouleApps') {
         if (typeof change.enabled !== 'boolean') {
             throw new RequestedChangeError('bouleApps needs enabled, true or false');

package/dist/slug.d.ts

@@ -2,7 +2,7 @@
 export declare const RESERVED_SLUGS: ReadonlySet<string>;
 /** Every platform app, tunnel, project and database name starts `platform-`, so no company slug may. */
 export declare const RESERVED_SLUG_PREFIX = "platform-";
-/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
+/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-kosmos`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
 export declare function hasBarredSlugSuffix(label: string): boolean;
 /**
  * Why {@link validateSlug} refused a candidate slug, by name so a caller —

package/dist/slug.js

@@ -138,6 +138,14 @@ const AGORA_SUFFIX = /-agora$/;
  * one that opts in.
  */
 const BOULE_SUFFIX = /-boule$/;
+/**
+ * `<something>-kosmos` — a level-1 org's own kosmos hostname
+ * (`<slug>-kosmos.oikos.host`, foundry#949). Kosmos is opt-in, the same way
+ * {@link CALLS_SUFFIX} guards a feature an org can decline: a slug ending
+ * `-kosmos` is only barred because it collides with that one org's own
+ * hostname once kosmos is on, not because every org gets one.
+ */
+const KOSMOS_SUFFIX = /-kosmos$/;
 /** `<something>-auth|-mail|-files|-sfu|-cms` — an own company's service hostnames on oikos.host (`plan/own-hostnames.ts`). */
 const OWN_SERVICE_SUFFIX = /-(auth|mail|files|sfu|cms)$/;
 /**
@@ -151,13 +159,14 @@ const OWN_SERVICE_SUFFIX = /-(auth|mail|files|sfu|cms)$/;
  * `names-`.
  */
 const NAMES_PREFIX = /^names(-|$)/;
-/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
+/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-kosmos`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
 export function hasBarredSlugSuffix(label) {
     return (STAGE_SUFFIX.test(label) ||
         PR_SUFFIX.test(label) ||
         CALLS_SUFFIX.test(label) ||
         AGORA_SUFFIX.test(label) ||
         BOULE_SUFFIX.test(label) ||
+        KOSMOS_SUFFIX.test(label) ||
         OWN_SERVICE_SUFFIX.test(label));
 }
 /**
@@ -189,7 +198,7 @@ export function validateSlug(slug) {
     if (hasBarredSlugSuffix(slug)) {
         return {
             reason: 'environment-suffix',
-            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls', '-agora', '-boule', '-auth', '-mail', '-files', '-sfu' or '-cms') reserved for another org's own hostname (#28, #145, #164, #161) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, 'acme-boule' only as acme's Boule hostname, never as an org slug in its own right`,
+            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls', '-agora', '-boule', '-kosmos', '-auth', '-mail', '-files', '-sfu' or '-cms') reserved for another org's own hostname (#28, #145, #164, #161, #949) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, 'acme-boule' only as acme's Boule hostname, 'acme-kosmos' only as acme's kosmos hostname, never as an org slug in its own right`,
         };
     }
     return null;

package/dist/store/postgres.js

@@ -174,6 +174,17 @@ function rowToOrg(row) {
         ...(row.agoraBlueGreen
             ? { agora: { blueGreen: readBlueGreen(row.agoraBlueGreen, 'agora') } }
             : {}),
+        // Omitted while unset, as `boule`/`agora` are. Validated on read, the same way.
+        ...(row.kosmosBlueGreen || row.kosmosEnabled
+            ? {
+                kosmos: {
+                    ...(row.kosmosBlueGreen
+                        ? { blueGreen: readBlueGreen(row.kosmosBlueGreen, 'kosmos') }
+                        : {}),
+                    ...(row.kosmosEnabled ? { enabled: true } : {}),
+                },
+            }
+            : {}),
         ...(row.versionPin ? { versionPin: readVersionPin(row) } : {}),
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
@@ -240,6 +251,8 @@ function orgToRow(org) {
         bouleBlueGreen: org.boule?.blueGreen ?? null,
         bouleApps: org.boule?.apps ?? false,
         agoraBlueGreen: org.agora?.blueGreen ?? null,
+        kosmosEnabled: org.kosmos?.enabled ?? false,
+        kosmosBlueGreen: org.kosmos?.blueGreen ?? null,
         servicesOwn: org.services?.own ?? false,
         servicesSfuSlot: org.services?.sfuSlot ?? null,
         versionPin: org.versionPin && Object.keys(org.versionPin).length > 0 ? org.versionPin : null,

package/dist/store/schema.d.ts

@@ -461,6 +461,42 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        kosmosEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kosmos_enabled";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kosmosBlueGreen: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kosmos_blue_green";
+            tableName: "foundry_declared_orgs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: BlueGreenConfig | null;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: BlueGreenConfig | null;
+        }>;
         versionPin: import("drizzle-orm/pg-core").PgColumn<{
             name: "version_pin";
             tableName: "foundry_declared_orgs";

package/dist/store/schema.js

@@ -48,6 +48,9 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     agoraBlueGreen: jsonb('agora_blue_green').$type(),
     // BouleApp.apps (org.ts): Boule runs apps for the company; `migrations/0063_boule_apps.sql`.
     bouleApps: boolean('boule_apps').notNull().default(false),
+    // KosmosApp (org.ts, foundry#949): the company's own kosmos, set up only when asked; `migrations/0066_org_kosmos.sql`.
+    kosmosEnabled: boolean('kosmos_enabled').notNull().default(false),
+    kosmosBlueGreen: jsonb('kosmos_blue_green').$type(),
     // VersionPin (org.ts): null follows the platform. `migrations/0053_org_version_pin.sql`.
     versionPin: jsonb('version_pin').$type(),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.
@@ -80,6 +83,9 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     hostingRepos: jsonb('hosting_repos').notNull().default([]).$type(),
     // HostingConfig.github (org.ts); migrations/0062. Null: the company has no GitHub App installation.
     hostingGithub: jsonb('hosting_github').$type(),
+    // migrations/0065 added `hosting_native_apps` for foundry#948; foundry#951 dropped the column from
+    // use (Boule owns native settings now, estate#262) but not from the database -- a migration only
+    // adds in this release, since idle and live share one database. The column stays, unread.
     ssoEnabled: boolean('sso_enabled').notNull().default(false),
     guestsEnabled: boolean('guests_enabled').notNull().default(false),
     soloEnabled: boolean('solo_enabled').notNull().default(false),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.61.0",
+  "version": "0.62.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -61,7 +61,7 @@
     "@wtfalch/audit": "0.6.0",
     "@wtfalch/audit-sealing": "npm:@wtfalch/audit@0.14.0",
     "@wtfalch/auth": "^0.26.0",
-    "@wtfalch/edge": "0.15.1",
+    "@wtfalch/edge": "0.21.0",
     "@wtfalch/email": "^0.20.0",
     "@wtfalch/providers": "0.12.0",
     "ssh2": "1.17.0",