Facilities

Facilities are how a host provides capabilities to a bolt. Workspace code reaches the database, storage, models and external accounts only through host ports — never direct credentials.

Facility ports

The engine takes one configuration of host ports. database, files and deadlines are required; every other port is optional:

Port	Provides
database	the tenant Postgres database — required by every workspace
files	object storage behind file() columns: read, write, delete, list
deadlines	one next-due instant per environment, held by the host, so a run wakes without polling
secrets	the tenant’s sealed +secrets.ts values
ai	the model catalogue, one model turn, and embeddings — which back /semantic and embedding columns
speech	transcription and speech synthesis
convert	document conversion behind ctx.convert.document
geocoder	address search and reverse geocoding
web	public web reads
push	web push for in-app notices
links	the integration instances’ links: messages sent, requests made and driver feeds read, with credentials sealed host-side
metering	usage records for billing, keyed so a replay is one charge
tenancy	the environment a request’s host name addresses
membership	the membership projection a host keeps of each person

Notifications are not a port: they are sys_notification rows in the tenant database, delivered in the app, by push or through a conversation connection.

Required and optional ports

A workspace declares no facility list. A call through an optional port the host does not bind answers unavailable, and the build never demands one. A host refuses at activation an artifact whose contract it does not implement.

Host bindings

Bindings are methods only — no data fields, no secrets. The rules:

• Workspace source declares requirements, never secret values.
• Client code cannot access private runtime facilities.
• A missing required port fails at boot; a missing optional one answers unavailable at the call.

Colony as a host

Colony binds Postgres pools, object storage, deadlines, sealed secrets, model APIs, speech, document conversion, geocoding, web reads, push, Stripe metering, the membership projection behind the organization selector and the integration instances’ links over bolt-server’s drivers; it addresses a tenant by the first path segment, so it needs no tenancy port. See Colony platform for how the managed host wires them.