@wtfalch/foundry 0.7.1 → 0.9.0

package/dist/bootstrap/bootstrap.d.ts

@@ -1,4 +1,3 @@
-import type { MigrateSql } from '../migrate.js';
 import type { PlatformLiveReaders, PlatformStepExecutor } from '../plan/index.js';
 import type { FoundryPlatformStepExecutorOptions } from '../plan/platform-providers.js';
 import type { FoundryStoreDb } from '../store/postgres.js';
@@ -27,7 +26,7 @@ export interface RootCredentials {
 }
 /** What Archon's onboarding screen shows: one event per phase or round. */
 export interface BootstrapProgress {
-    phase: 'migrate' | 'declare' | 'plan' | 'apply' | 'done';
+    phase: 'declare' | 'plan' | 'apply' | 'done';
     round?: number;
     message: string;
     steps?: string[];
@@ -35,10 +34,8 @@ export interface BootstrapProgress {
 /** Everything foundry's per-step executors take besides the two clients and `deliverSecret`. */
 export type BootstrapExecutorDeps = Omit<FoundryPlatformStepExecutorOptions, 'coolify' | 'deliverSecret'>;
 export interface BootstrapPlatformDeps {
-    /** Foundry's tables live here; the store, the audit log and the plan all use it. */
+    /** Foundry's tables live here, already migrated by the host; the store, the audit log and the plan all use it. */
     db: FoundryStoreDb;
-    /** The same database, for the migration runner. */
-    migrateSql: MigrateSql;
     rootCredentials: () => Promise<RootCredentials>;
     deliverSecret: (ref: string, secret: string) => Promise<void>;
     /**
@@ -52,6 +49,13 @@ export interface BootstrapPlatformDeps {
     };
     /** Per-step dependencies (auth, mail, files, ai, integrations, archon, sfu). A step without its own is reported blocked. */
     executor?: BootstrapExecutorDeps;
+    /**
+     * Passed to `createPostgresAuditLog`. Omit it in a real deployment: `db` is
+     * the runtime role the host made with `ensureRuntimeRole`, and the default
+     * (on) checks that. Only a fixture without that role (PGlite, whose one user
+     * is a superuser) needs `false`.
+     */
+    checkRuntimeRole?: boolean;
     onProgress?: (event: BootstrapProgress) => void;
     /** Rounds before the run gives up. Default 20. */
     maxRounds?: number;
@@ -97,9 +101,9 @@ export declare class Redactor {
 /** Wraps the secret-carrying ports inside one step's deps so what they deliver or resolve is redacted. */
 export declare function guardStepDeps(executor: BootstrapExecutorDeps | undefined, redactor: Redactor, deliverSecret: (ref: string, secret: string) => Promise<void>, heldKeys: BootstrapPlatformDeps['heldKeys']): BootstrapExecutorDeps;
 /**
- * The platform's first apply, run from Archon's onboarding flow: migrates
- * foundry's tables, declares Company Included and the platform (never
- * overwriting a row already there), then plans and applies round by round
+ * The platform's first apply, run from Archon's onboarding flow, against a
+ * database the host has already migrated: declares Company Included and the
+ * platform (never overwriting a row already there), then plans and applies round by round
  * until every step is applied or reported blocked. Reads no env and no file:
  * the database, root credentials, held keys and every per-step dependency
  * come in through `deps`.

package/dist/bootstrap/bootstrap.js

@@ -1,6 +1,5 @@
 import { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { CoolifyClient } from '@wtfalch/providers/coolify';
-import { migrate } from '../migrate.js';
 import { FoundryPlanApply, FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, } from '../plan/index.js';
 import { createPostgresAuditLog } from '../store/audit.js';
 import { createPostgresDeclaredOrgStore, createPostgresPlatformStore } from '../store/postgres.js';
@@ -140,9 +139,9 @@ function archonMasterKeys(guarded, credentials) {
     };
 }
 /**
- * The platform's first apply, run from Archon's onboarding flow: migrates
- * foundry's tables, declares Company Included and the platform (never
- * overwriting a row already there), then plans and applies round by round
+ * The platform's first apply, run from Archon's onboarding flow, against a
+ * database the host has already migrated: declares Company Included and the
+ * platform (never overwriting a row already there), then plans and applies round by round
  * until every step is applied or reported blocked. Reads no env and no file:
  * the database, root credentials, held keys and every per-step dependency
  * come in through `deps`.
@@ -187,13 +186,6 @@ export async function bootstrapPlatform(input, deps) {
                 }
                 : {}),
         };
-        const migrated = await migrate(deps.migrateSql);
-        emit({
-            phase: 'migrate',
-            message: migrated.applied.length === 0
-                ? 'foundry tables already up to date'
-                : `migrated: ${migrated.applied.join(', ')}`,
-        });
         const orgStore = createPostgresDeclaredOrgStore(deps.db);
         const platformStore = createPostgresPlatformStore(deps.db);
         if (await orgStore.get(COMPANY_INCLUDED_ORG_ID)) {
@@ -264,7 +256,7 @@ export async function bootstrapPlatform(input, deps) {
             },
             executor: unusedOrgExecutor,
             destroyer: unusedOrgExecutor,
-            audit: redactingAudit(createPostgresAuditLog(deps.db), redactor),
+            audit: redactingAudit(createPostgresAuditLog(deps.db, { checkRuntimeRole: deps.checkRuntimeRole }), redactor),
             authz: allowPlatformApply,
             actor: { id: 'bootstrap-platform', display: 'bootstrapPlatform' },
             platform: { store: platformStore, readers: runtime.readers, executor },

package/dist/bootstrap/declare.js

@@ -63,15 +63,11 @@ export function declaredCompanyOrg(company, owner) {
         issuer: { usesDomain: false },
         site: { enabled: false, usesDomain: false },
         hosting: {
-            appEnv: {},
             enabled: false,
             usesDomain: false,
-            database: false,
             tunnel: false,
-            gitBranch: DEFAULT_GIT_REF,
-            buildPack: 'nixpacks',
-            accessEmails: [],
             issuerApps: [],
+            entries: [],
         },
         sso: { enabled: false },
         guests: { enabled: false },

package/dist/bootstrap/versions.d.ts

@@ -15,3 +15,11 @@ export interface PinnedVersions {
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;
+/**
+ * Why an image tag cannot be used, or `null`. #248: generalised out of what
+ * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard
+ * `versions.json` had before -- `livekit/livekit-server:latest` was the live
+ * case with none. `label` names the image in the message (`"Stalwart"`,
+ * `"ZITADEL"`, `"LiveKit"`, ...); `example` is a real pinned tag to suggest.
+ */
+export declare function floatingTagBlocked(label: string, tag: string, example: string): string | null;

package/dist/bootstrap/versions.js

@@ -10,3 +10,34 @@ export function loadVersions() {
     return JSON.parse(readFileSync(VERSIONS_PATH, 'utf8'));
 }
 export const VERSIONS = loadVersions();
+/**
+ * Tag spellings that resolve to whatever the registry currently has, not a
+ * fixed image -- a re-apply of the same declaration can silently run a
+ * different version with no diff shown anywhere (#248). `main`/`master` are
+ * default-branch Docker Hub aliases some of these images publish alongside
+ * their release tags, not git refs.
+ */
+const FLOATING_TAGS = new Set([
+    'latest',
+    'main',
+    'master',
+    'stable',
+    'dev',
+    'edge',
+    'nightly',
+    'head',
+]);
+/**
+ * Why an image tag cannot be used, or `null`. #248: generalised out of what
+ * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard
+ * `versions.json` had before -- `livekit/livekit-server:latest` was the live
+ * case with none. `label` names the image in the message (`"Stalwart"`,
+ * `"ZITADEL"`, `"LiveKit"`, ...); `example` is a real pinned tag to suggest.
+ */
+export function floatingTagBlocked(label, tag, example) {
+    const trimmed = tag.trim();
+    if (trimmed === '' || FLOATING_TAGS.has(trimmed.toLowerCase())) {
+        return `the ${label} image tag "${tag}" floats; declare a pinned release (for example ${example})`;
+    }
+    return null;
+}

package/dist/calls-sfu-deploy-support.d.ts

@@ -7,7 +7,7 @@
  * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
  * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
  * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
- * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * as `foundry-db-provision.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):

package/dist/calls-sfu-deploy-support.js

@@ -7,7 +7,7 @@
  * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
  * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
  * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
- * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * as `foundry-db-provision.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):

package/dist/calls-sfu-ssh-adapter.d.ts

@@ -11,7 +11,7 @@
  * host-key refusal and the 0600 file mode without ever opening a socket.
  * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
  * implementation, over `ssh2`, and stays untested for the same reason
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * `foundry-db-provision.mjs` does: real I/O, no
  * branch logic worth a fake session over.
  */
 import { type CallsSfuConfig, type CallsSfuHostPort } from './calls-sfu.js';

package/dist/calls-sfu-ssh-adapter.js

@@ -11,7 +11,7 @@
  * host-key refusal and the 0600 file mode without ever opening a socket.
  * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
  * implementation, over `ssh2`, and stays untested for the same reason
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * `foundry-db-provision.mjs` does: real I/O, no
  * branch logic worth a fake session over.
  */
 import { dirname } from 'node:path';

package/dist/calls-sfu.d.ts

@@ -114,10 +114,11 @@ export declare const LIVEKIT_CONFIG_PATH = "/opt/livekit/livekit.yaml";
 /** Holds `TUNNEL_TOKEN=...` -- the one secret the `cloudflared` compose service reads (`env_file:`, below). */
 export declare const CLOUDFLARED_ENV_PATH = "/opt/livekit/cloudflared.env";
 /**
- * `:latest`, matching this codebase's one other pinned-by-tag-only image
- * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
- * `versions.json` (#247).
+ * Pinned to a release tag (#248) -- `versions.json`'s `livekit` entry ran
+ * `:latest` until then, the one live case `floatingTagBlocked`
+ * (`bootstrap/versions.ts`) exists for: a re-apply of the same declaration
+ * silently running a different version, with no diff shown anywhere.
+ * Pinned in `versions.json` (#247).
  */
 export declare const LIVEKIT_IMAGE_REF: string;
 /** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */

package/dist/calls-sfu.js

@@ -104,10 +104,11 @@ export const LIVEKIT_CONFIG_PATH = '/opt/livekit/livekit.yaml';
 /** Holds `TUNNEL_TOKEN=...` -- the one secret the `cloudflared` compose service reads (`env_file:`, below). */
 export const CLOUDFLARED_ENV_PATH = '/opt/livekit/cloudflared.env';
 /**
- * `:latest`, matching this codebase's one other pinned-by-tag-only image
- * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
- * `versions.json` (#247).
+ * Pinned to a release tag (#248) -- `versions.json`'s `livekit` entry ran
+ * `:latest` until then, the one live case `floatingTagBlocked`
+ * (`bootstrap/versions.ts`) exists for: a re-apply of the same declaration
+ * silently running a different version, with no diff shown anywhere.
+ * Pinned in `versions.json` (#247).
  */
 export const LIVEKIT_IMAGE_REF = `livekit/livekit-server:${VERSIONS.livekit}`;
 /** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, DeclaredOrg, } from './org.js';
-export { DEFAULT_MAIL_APPS, validateBuyerIdentity, validateHosting, validateMail, validateOwner, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, DeclaredOrg, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, appEntry, validateBuyerIdentity, validateHosting, validateMail, validateOwner, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 export type { RequestableField, CallsChange, StorageLimitChange, AiLimitChange, DomainChange, MailTierChange, RequestedChangeValue, ChangeClassification, RequestedChangeState, RequestedChange, } from './requested-changes.js';
@@ -30,7 +30,7 @@ export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
 export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
-export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, } from './plan/index.js';
+export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export type { AiManagementKeyMinter, PlatformAiDeps, PlatformAiRuntime, } from './plan/index.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './plan/index.js';
@@ -43,8 +43,7 @@ export type { LivekitCredentials } from './calls-sfu-keys.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './plan/index.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
-export type { MigrateSql, MigrationResult } from './migrate.js';
-export { MIGRATIONS_DIR, migrate } from './migrate.js';
+export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export type { RunnerDb } from './runner/db.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { DEFAULT_MAIL_APPS, validateBuyerIdentity, validateHosting, validateMail, validateOwner, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, appEntry, validateBuyerIdentity, validateHosting, validateMail, validateOwner, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
@@ -13,14 +13,17 @@ export { HttpJobsSchedulerClient } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, } from './plan/index.js';
+export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './plan/index.js';
 export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export { UnknownCallsSfuHostKeyError, toCallsSfuHostPort, applyCallsSfuOverSession, } from './calls-sfu-ssh-adapter.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
-export { MIGRATIONS_DIR, migrate } from './migrate.js';
+// The shipped migrations' directory; hosts apply them with `@wtfalch/db`'s
+// `runMigrationSources`. Also at `@wtfalch/foundry/migrations-dir`, which
+// imports nothing else.
+export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';

package/dist/migrations/0024_audit_events.sql

@@ -164,7 +164,7 @@ create or replace function audit_erase_person(subject text, pseudonym text, subj
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   touched integer;

package/dist/migrations/0025_audit_display.sql

@@ -102,7 +102,7 @@ create or replace function audit_erase_person(subject text, pseudonym text, subj
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   touched integer;

package/dist/migrations/0026_audit_erase_email_guard.sql

@@ -29,7 +29,7 @@ create or replace function audit_erase_person(subject text, pseudonym text, subj
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   touched integer;

package/dist/migrations/0027_audit_chain.sql

@@ -145,7 +145,7 @@ create or replace function audit_seal_erasure(row_id bigint, erasure_hash_value
 returns void
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 begin
   update audit_events

package/dist/migrations/0028_audit_rls.sql

@@ -74,7 +74,7 @@ returns text
 language sql
 stable
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
   select row_hash from audit_events order by id desc limit 1
 $$;
@@ -88,7 +88,7 @@ returns table (id bigint, row_hash text, erased_at timestamptz)
 language sql
 stable
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
   select e.id, e.row_hash, e.erased_at
     from audit_events e

package/dist/migrations/0029_hosting_entries.sql

@@ -0,0 +1,109 @@
+-- @wtfalch/foundry: an org's hosting as a list of entries, and today's one app
+-- moved onto it as the entry keyed 'app' (org.ts's `HostingConfig.entries`).
+-- Mirrors `src/store/schema.ts`'s `hostingEntries`.
+--
+-- Copies and never drops: hosting_database, hosting_git_branch,
+-- hosting_build_pack, hosting_access_emails, hosting_app_env and
+-- bespoke_app_repo stay for an older reader. Safe to run twice: an org that
+-- already has entries is skipped, and a renamed id key is no longer there to
+-- rename. An org with hosting off but an app id recorded (a parked app) gets
+-- its entry too, so re-enabling it finds its settings.
+--
+-- A row the new validation (org.ts's `validateHostingEntry`) would refuse
+-- makes the migration fail, naming every such org id and column at once, before
+-- anything changes: a row that cannot be saved is worse found weeks later
+-- than as a failed deploy. An empty branch becomes 'main', its default.
+
+do $$
+declare
+  bad text;
+begin
+  select string_agg(format('%s: %s', o.id, c.problem), '; ' order by o.id)
+    into bad
+      from foundry_declared_orgs o
+      cross join lateral (values
+        ('bespoke_app_repo ' || quote_literal(o.bespoke_app_repo) || ' is not a repo under wtfalch',
+         o.bespoke_app_repo is not null and o.bespoke_app_repo !~ '^wtfalch/[A-Za-z0-9._-]+$'),
+        ('hosting_build_pack ' || quote_literal(o.hosting_build_pack) || ' is not available for an entry',
+         o.hosting_build_pack not in ('dockerfile', 'nixpacks', 'static')),
+        ('hosting_database or hosting_access_emails is set while hosting_enabled is off',
+         not o.hosting_enabled and (o.hosting_database or o.hosting_access_emails <> '[]'::jsonb)),
+        ('hosting_access_emails holds an invalid email',
+         exists (select 1 from jsonb_array_elements_text(o.hosting_access_emails) e
+                  where e !~ '^[^@[:space:]]+@[^@[:space:]]+$')),
+        ('hosting_app_env names a variable foundry sets itself, or an unknown source',
+         exists (select 1 from jsonb_each_text(o.hosting_app_env) e
+                  where e.key = ''
+                     or e.key ~ '^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$'
+                     or e.value not in ('filesOrganisationId', 'aiOrganisationId', 'mailDomain')))
+      ) as c(problem, refused)
+     where c.refused
+       -- to_jsonb, because the column does not exist yet on a first run.
+       and coalesce(to_jsonb(o) -> 'hosting_entries', '[]'::jsonb) = '[]'::jsonb
+       and (o.hosting_enabled or exists (
+              select 1 from foundry_applied_state a
+               where (a.service_ids -> ('coolify:app:' || a.org_id)) is not null
+                 and a.org_id = o.id));
+  if bad is not null then
+    raise exception 'migration 0029: cannot move hosting onto an entry, org %', bad;
+  end if;
+end $$;
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_entries jsonb not null default '[]'::jsonb;
+
+update foundry_declared_orgs
+   set hosting_entries = jsonb_build_array(jsonb_build_object(
+         'key', 'app',
+         'repo', bespoke_app_repo,
+         'folder', null,
+         'branch', coalesce(nullif(hosting_git_branch, ''), 'main'),
+         'buildPack', hosting_build_pack,
+         'port', null,
+         'healthPath', null,
+         'database', hosting_database,
+         'autoDeploy', true,
+         'accessEmails', hosting_access_emails,
+         'env', coalesce(
+           (select jsonb_object_agg(e.key, jsonb_build_object('from', e.value))
+              from jsonb_each_text(hosting_app_env) as e),
+           '{}'::jsonb)
+       ))
+ where hosting_entries = '[]'::jsonb
+   and (hosting_enabled or exists (
+          select 1 from foundry_applied_state a
+           where a.org_id = foundry_declared_orgs.id
+             and (a.service_ids -> ('coolify:app:' || a.org_id)) is not null));
+
+-- The recorded ids and applied-env markers are one key per org today; the
+-- entry key joins them so a second app cannot collide with the first. A key
+-- is renamed only when its new form is absent; if both exist the new one
+-- stays and the old one is left as it is. Without
+-- the rename the planner would not find the app it already made and would
+-- plan it again, restarting it. last_applied_at and
+-- last_applied_declared_org_version are not touched.
+update foundry_applied_state
+   set service_ids = service_ids
+         - ('coolify:app:' || org_id)
+         || jsonb_build_object('coolify:app:' || org_id || ':app', service_ids -> ('coolify:app:' || org_id))
+ where (service_ids -> ('coolify:app:' || org_id)) is not null
+   and (service_ids -> ('coolify:app:' || org_id || ':app')) is null;
+
+update foundry_applied_state
+   set service_ids = service_ids
+         - ('cloudflare:access:' || org_id)
+         || jsonb_build_object('cloudflare:access:' || org_id || ':app', service_ids -> ('cloudflare:access:' || org_id))
+ where (service_ids -> ('cloudflare:access:' || org_id)) is not null
+   and (service_ids -> ('cloudflare:access:' || org_id || ':app')) is null;
+
+update foundry_applied_state
+   set service_ids = service_ids - 'app_env_applied'
+         || jsonb_build_object('app_env_applied.app', service_ids -> 'app_env_applied')
+ where (service_ids -> 'app_env_applied') is not null
+   and (service_ids -> 'app_env_applied.app') is null;
+
+update foundry_applied_state
+   set service_ids = service_ids - 'db_env_applied'
+         || jsonb_build_object('db_env_applied.app', service_ids -> 'db_env_applied')
+ where (service_ids -> 'db_env_applied') is not null
+   and (service_ids -> 'db_env_applied.app') is null;

package/dist/migrations-dir.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'foundry', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/foundry/migrations-dir`) and no other imports: a
+ * migration image imports this without the rest of the package.
+ */
+export declare const migrationsDir: string;

package/dist/migrations-dir.js

@@ -0,0 +1,10 @@
+import { fileURLToPath } from 'node:url';
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'foundry', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/foundry/migrations-dir`) and no other imports: a
+ * migration image imports this without the rest of the package.
+ */
+export const migrationsDir = fileURLToPath(new URL('./migrations/', import.meta.url));

package/dist/org.d.ts

@@ -184,54 +184,85 @@ export interface IssuerApp {
  */
 export type HostingBuildPack = 'dockerfile' | 'nixpacks' | 'static' | 'dockercompose';
 /**
- * The org's own hosted app and what runs beside it (#71, part of #14's
+ * The org's hosted apps and what runs beside them (#71, part of #14's
  * adopted/standard/bespoke map) -- distinct from the cms site (`SiteConfig`
  * above), which is `@wtfalch/cms` content, not the org's own application
  * code. `usesDomain` follows the same opt-in-per-service rule as mail, chat,
  * calls, the issuer and the site (#7 amendment 1): setting `DeclaredOrg.domain`
  * alone never moves the app onto it or starts managing its Cloudflare zone.
  *
- * `database` and `tunnel` are each meaningless without the app itself
- * running, so `validateHosting` below requires `enabled` before either can
+ * `enabled`, `usesDomain`, `tunnel` and `issuerApps` are the org's own: one
+ * park switch, one hostname rule, one tunnel and one ZITADEL project for all
+ * its apps. Each app is one of `entries`. `tunnel` is meaningless without the
+ * apps running, so `validateHosting` below requires `enabled` before it can
  * be true.
  *
- * `gitBranch` and `buildPack` were fixed values `executor.ts` hardcoded
- * (`'main'`/`'nixpacks'`) until this campaign's hosting-wiring work made them
- * declarable; those two strings are their defaults now, kept here so an org
- * that never mentions them still gets exactly what shipped before.
+ * Until the planner reads more than one entry, only the entry keyed
+ * {@link APP_ENTRY_KEY} is planned.
  */
 export interface HostingConfig {
-    /** The org's own app runs on Coolify. */
+    /** The org's apps run on Coolify. */
     enabled: boolean;
     /** Served on `DeclaredOrg.domain` (and its Cloudflare zone managed) instead of `<slug>.oikos.host` (`../slug.ts`). */
     usesDomain: boolean;
-    /** A Postgres database beside the app. Requires `enabled`. */
-    database: boolean;
-    /** The app is reached through a Cloudflare tunnel. Requires `enabled`. */
+    /** The apps are reached through a Cloudflare tunnel. Requires `enabled`. */
     tunnel: boolean;
+    /** The org's declared ZITADEL OIDC applications (#71). */
+    issuerApps: IssuerApp[];
+    /** One entry per app the org runs. */
+    entries: HostingEntry[];
+}
+/** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
+export declare const APP_ENTRY_KEY = "app";
+/**
+ * One app the org runs. `database` and `accessEmails` are meaningless
+ * without `HostingConfig.enabled`, so `validateHosting` requires it before
+ * either is set.
+ */
+export interface HostingEntry {
+    /** A DNS label, unique per org. It goes into step ids and scope keys, so it never holds `:` or `.`. */
+    key: string;
+    /** The repo under `wtfalch` the app builds from. `null` is the shared standard app (`executor.ts`'s `DEFAULT_APP_REPO`). */
+    repo: string | null;
+    /** The app's folder in `repo`. `null` is the repo root. */
+    folder: string | null;
     /** The branch `coolify:app` builds and deploys from. Default: `'main'`. */
-    gitBranch: string;
+    branch: string;
     /** The Coolify build strategy `coolify:app` provisions with. Default: `'nixpacks'`. */
     buildPack: HostingBuildPack;
-    /** The org's declared ZITADEL OIDC applications (#71). */
-    issuerApps: IssuerApp[];
+    /** The port the app listens on. `null` is Coolify's default. */
+    port: number | null;
+    /** The path that answers 200 when the app is healthy. `null` is none. */
+    healthPath: string | null;
+    /** A Postgres database beside the app. At most one entry per org. */
+    database: boolean;
+    /** Deploy on every push to `branch`. Default: `true`. */
+    autoDeploy: boolean;
     /**
      * Emails Cloudflare Access lets through to the app's hostname (#84). Empty
-     * means no Access gate. Requires `enabled`.
+     * means no Access gate. Only the entry keyed {@link APP_ENTRY_KEY} may set it.
      */
     accessEmails: string[];
     /**
-     * Maps the app's own env var name to one of `AppEnvSource`'s values --
-     * each a value the plan already mints for this org (Files, AI, mail) but
-     * never used to push an app's own env (#243). Each bespoke app names these
-     * differently (lokessmie uses `STORAGE_*`/`AI_*`); this is how an org
-     * declares its own app's names for them. `{}` means the app names none of
-     * them, so `pushAppEnv` pushes nothing from this map.
+     * The app's own env var names and what they hold (#243). Each bespoke app
+     * names the values the plan mints (Files, AI, mail) differently (lokessmie
+     * uses `STORAGE_*`/`AI_*`); `{ from }` declares its own name for one. `{}`
+     * means the app names none of them, so `pushAppEnv` pushes nothing from
+     * this map.
      */
-    appEnv: Record<string, AppEnvSource>;
+    env: Record<string, EnvValue>;
 }
 /**
- * The closed set of values the plan already mints that `HostingConfig.appEnv`
+ * A plain string is pushed as it is, so `validateHosting` refuses one that
+ * looks like a secret. `{ from }` names a value the plan already mints.
+ */
+export type EnvValue = string | {
+    from: AppEnvSource;
+};
+/** The org's `app` entry: today's one app. */
+export declare function appEntry(hosting: HostingConfig): HostingEntry | undefined;
+/**
+ * The closed set of values the plan already mints that `HostingEntry.env`
  * may map an app's env var name to (#243): the org's own Files organisation
  * id, its AI organisation id, and the mail domain its Lettermint project
  * sends from. Each is read from `StepExecutionContext.recordedIds()` in
@@ -243,12 +274,13 @@ export declare const APP_ENV_SOURCES: ReadonlySet<AppEnvSource>;
  * `null` when `hosting` is valid; otherwise the reason it is not (#71), same
  * shape as `validateBuyerIdentity` below.
  *
- * - `database` and `tunnel` each require `enabled` -- neither means anything
- *   without the app itself running.
- * - `gitBranch` is non-empty and `buildPack` is one of `HostingBuildPack`'s
- *   four values.
+ * - `tunnel` requires `enabled` -- it means nothing without the apps running.
  * - Every `issuerApps[]` entry has a non-empty `name`, unique within the
  *   list, and a `kind` that is one of `IssuerAppKind`'s three values.
+ * - `enabled` requires an entry keyed {@link APP_ENTRY_KEY}.
+ * - Every `entries[]` entry follows {@link validateHostingEntry}; keys are
+ *   unique, and at most one entry has a `database`, because the one
+ *   `<slug>_rt` runtime role cannot serve two apps.
  */
 export declare function validateHosting(hosting: HostingConfig): string | null;
 export declare function validateDomain(domain: string): string | null;