@wtfalch/foundry 0.41.2 → 0.43.0

package/dist/plan/sign-in.d.ts

@@ -0,0 +1,135 @@
+import { type DeclaredOrg } from '../org.js';
+/**
+ * In-app sign-in (`signIn.inApp`, campaign 2026-10-15): a person signs in to Agora or Boule on that
+ * app's own address, under `/sign-in`, served by the login through the app's own proxy. This file holds
+ * the names the planner, the apps' env builders and the executor agree on. It imports `org.ts` only,
+ * so `agora.ts`, `boule.ts` and `login-host.ts` can all import it.
+ */
+/** The path the apps proxy to the login, and the login binding's `basePath`. */
+export declare const SIGN_IN_BASE_PATH = "/sign-in";
+/** The app env that turns the proxy on: the login's internal URL. Unset leaves the app unchanged. */
+export declare const SIGN_IN_UPSTREAM_ENV = "SIGNIN_UPSTREAM";
+/**
+ * The login image built with base path `/sign-in` (login build arg `NEXT_PUBLIC_BASE_PATH`). A Next.js
+ * base path is fixed at build, so the company login on `/` cannot also serve `/sign-in`: the in-app
+ * hosts are served by a second login app, `platform-auth-login-sign-in`, on the same Coolify network,
+ * with image tag suffix `-sign-in`.
+ */
+export declare const SIGN_IN_LOGIN_INTERNAL_NAME = "platform-auth-login-sign-in";
+export declare const SIGN_IN_LOGIN_PORT = "3000";
+export declare const SIGN_IN_IMAGE_TAG_SUFFIX = "-sign-in";
+/**
+ * Platform scope id the platform's sign-in step (`platform-providers.ts`) records once the second login app
+ * is created, deployed and holds the login token. Until it exists the login-host step plans no in-app host
+ * (a blocked line says so).
+ */
+export declare const SIGN_IN_LOGIN_APP_SCOPE_KEY = "coolify_platform_auth_login_sign_in_app";
+/**
+ * The order that switches a company on, and off again in reverse. Each step leaves people able to sign in on
+ * the old path until the next one is done, except where noted.
+ *
+ * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
+ * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
+ * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
+ *    the app's client id off the company's binding at the same write: that write and the base URI are the only
+ *    moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
+ */
+/**
+ * The app hosts the login-host step has trusted: `<host>=<clientId>` pairs, sorted and comma-joined
+ * ({@link inAppState}). Absent or empty means none. Recorded last, after every write it covers.
+ * A host stays here while its app still holds `SIGNIN_UPSTREAM`, even after the switch is off.
+ */
+export declare const SIGN_IN_TRUSTED_SCOPE_KEY = "login_host_in_app_trusted";
+/**
+ * What the login-host step last bound and pointed at the app's own address (base URI `https://<host>/sign-in/`):
+ * the same pairs, a subset of {@link SIGN_IN_TRUSTED_SCOPE_KEY}. Absent or empty means none. Recorded last,
+ * after every write it covers.
+ */
+export declare const SIGN_IN_IN_APP_SCOPE_KEY = "login_host_in_app";
+/**
+ * Prefix of the scope ids the Agora and Boule steps record after the app has been written, restarted or deployed:
+ * `<prefix>agora` holds the app host while its running env has `SIGNIN_UPSTREAM`, `''` while it has not.
+ */
+export declare const SIGN_IN_ENV_LIVE_SCOPE_PREFIX = "signin_env_live_";
+/** The app hosts whose running env holds `SIGNIN_UPSTREAM`, as the app steps recorded them. */
+export declare function signInEnvLiveHosts(recorded: Readonly<Record<string, string>>): Set<string>;
+/** Recorded `'1'` once the zone's one rate limit rule is the in-app one, `''` once it is the base one again. */
+export declare const SIGN_IN_RATE_LIMIT_SCOPE_KEY = "ratelimit_in_app";
+/**
+ * The `rate limit` rule description for a company with the switch: it also limits `/sign-in/` paths,
+ * except the static assets under `/sign-in/_next/`. Cloudflare Free allows the Path field only (no Method).
+ */
+export declare const SIGN_IN_RATE_LIMIT_DESCRIPTION = "foundry: rate limit sign-in paths (in-app)";
+export declare const SIGN_IN_RATE_LIMIT_EXPRESSION = "(starts_with(http.request.uri.path, \"/auth/\")) or (starts_with(http.request.uri.path, \"/sign-in/\") and not starts_with(http.request.uri.path, \"/sign-in/_next/\"))";
+/**
+ * True when the company has the switch on and it applies: a company domain whose login host is
+ * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
+ * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
+ */
+export declare function inAppSignIn(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): boolean;
+/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+export declare function staleSignInUpstream(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): boolean;
+/** The build argument (a build-time env in Coolify) that fixes the login's base path. */
+export declare const SIGN_IN_BUILD_ARG_ENV = "NEXT_PUBLIC_BASE_PATH";
+/** The Coolify name and internal address of the in-app login app next to a target's login app. */
+export declare function signInLoginNames(target: {
+    names: {
+        authLogin: string;
+    };
+    internal: {
+        authLogin: string;
+    };
+}): {
+    name: string;
+    internal: string;
+};
+/**
+ * True when the company's in-app sign-in goes through the platform's shared login (its sign-in is the
+ * platform's ZITADEL), so the platform needs the in-app login app. A company running its own services
+ * has its own login stack instead.
+ */
+export declare function inAppOnSharedLogin(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): boolean;
+/**
+ * The internal URL every in-app app proxies `/sign-in/*` to: the platform's in-app login, or, for a
+ * company that runs its own services, the one in its own sign-in stack (`<slug>-auth-login-sign-in`).
+ */
+export declare function signInUpstream(org?: Pick<DeclaredOrg, 'slug' | 'services'>): string;
+/** One app host that signs in on its own address. */
+export interface InAppApp {
+    app: 'agora' | 'boule' | 'archon';
+    host: string;
+    clientId: string;
+    /** The ZITADEL organisation the host signs people in to, when it is not the company's own (Archon's). */
+    organisationId?: string;
+}
+/** {@link SIGN_IN_IN_APP_SCOPE_KEY}'s value for these apps. */
+export declare function inAppState(apps: readonly Pick<InAppApp, 'host' | 'clientId'>[]): string;
+/** The `{host, clientId}` pairs a recorded {@link inAppState} names. */
+export declare function inAppStatePairs(state: string | undefined): Array<Pick<InAppApp, 'host' | 'clientId'>>;
+/** The hosts a recorded {@link inAppState} names. */
+export declare function inAppStateHosts(state: string | undefined): string[];
+/** The login binding, ZITADEL org id aside, for one in-app host. */
+export declare function inAppBindingFor(app: InAppApp): {
+    host: string;
+    clientIds: string[];
+    apps: Record<string, 'agora' | 'boule' | 'archon'>;
+    basePath: typeof SIGN_IN_BASE_PATH;
+};
+/**
+ * What the login-host step records for these wanted apps, given what the apps' steps have recorded:
+ * `trusted` is every wanted host plus any host given up whose app still holds `SIGNIN_UPSTREAM` (its trusted
+ * domain stays until the env is gone); `active` is the wanted hosts whose env is live: bound, with the app's own base URI.
+ */
+export declare function inAppTargets(apps: readonly InAppApp[], recorded: Readonly<Record<string, string>>): {
+    trusted: string;
+    active: string;
+};
+/**
+ * True when an app should proxy `/sign-in/*` to the login: its host is trusted there, and the
+ * company still has the switch on or the base URI still points at the app (it is switched off in reverse
+ * order: the base URI goes back before the app stops proxying).
+ */
+export declare function inAppHostApplied(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>, recorded: Readonly<Record<string, string>>, host: string): boolean;

package/dist/plan/sign-in.js

@@ -0,0 +1,172 @@
+import { ownsServices } from '../org.js';
+/**
+ * In-app sign-in (`signIn.inApp`, campaign 2026-10-15): a person signs in to Agora or Boule on that
+ * app's own address, under `/sign-in`, served by the login through the app's own proxy. This file holds
+ * the names the planner, the apps' env builders and the executor agree on. It imports `org.ts` only,
+ * so `agora.ts`, `boule.ts` and `login-host.ts` can all import it.
+ */
+/** The path the apps proxy to the login, and the login binding's `basePath`. */
+export const SIGN_IN_BASE_PATH = '/sign-in';
+/** The app env that turns the proxy on: the login's internal URL. Unset leaves the app unchanged. */
+export const SIGN_IN_UPSTREAM_ENV = 'SIGNIN_UPSTREAM';
+/**
+ * The login image built with base path `/sign-in` (login build arg `NEXT_PUBLIC_BASE_PATH`). A Next.js
+ * base path is fixed at build, so the company login on `/` cannot also serve `/sign-in`: the in-app
+ * hosts are served by a second login app, `platform-auth-login-sign-in`, on the same Coolify network,
+ * with image tag suffix `-sign-in`.
+ */
+export const SIGN_IN_LOGIN_INTERNAL_NAME = 'platform-auth-login-sign-in';
+export const SIGN_IN_LOGIN_PORT = '3000';
+export const SIGN_IN_IMAGE_TAG_SUFFIX = '-sign-in';
+/**
+ * Platform scope id the platform's sign-in step (`platform-providers.ts`) records once the second login app
+ * is created, deployed and holds the login token. Until it exists the login-host step plans no in-app host
+ * (a blocked line says so).
+ */
+export const SIGN_IN_LOGIN_APP_SCOPE_KEY = 'coolify_platform_auth_login_sign_in_app';
+/**
+ * The order that switches a company on, and off again in reverse. Each step leaves people able to sign in on
+ * the old path until the next one is done, except where noted.
+ *
+ * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
+ * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
+ * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
+ *    the app's client id off the company's binding at the same write: that write and the base URI are the only
+ *    moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
+ */
+/**
+ * The app hosts the login-host step has trusted: `<host>=<clientId>` pairs, sorted and comma-joined
+ * ({@link inAppState}). Absent or empty means none. Recorded last, after every write it covers.
+ * A host stays here while its app still holds `SIGNIN_UPSTREAM`, even after the switch is off.
+ */
+export const SIGN_IN_TRUSTED_SCOPE_KEY = 'login_host_in_app_trusted';
+/**
+ * What the login-host step last bound and pointed at the app's own address (base URI `https://<host>/sign-in/`):
+ * the same pairs, a subset of {@link SIGN_IN_TRUSTED_SCOPE_KEY}. Absent or empty means none. Recorded last,
+ * after every write it covers.
+ */
+export const SIGN_IN_IN_APP_SCOPE_KEY = 'login_host_in_app';
+/**
+ * Prefix of the scope ids the Agora and Boule steps record after the app has been written, restarted or deployed:
+ * `<prefix>agora` holds the app host while its running env has `SIGNIN_UPSTREAM`, `''` while it has not.
+ */
+export const SIGN_IN_ENV_LIVE_SCOPE_PREFIX = 'signin_env_live_';
+/** The app hosts whose running env holds `SIGNIN_UPSTREAM`, as the app steps recorded them. */
+export function signInEnvLiveHosts(recorded) {
+    return new Set(Object.entries(recorded)
+        .filter(([key, host]) => key.startsWith(SIGN_IN_ENV_LIVE_SCOPE_PREFIX) && host !== '')
+        .map(([, host]) => host));
+}
+/** Recorded `'1'` once the zone's one rate limit rule is the in-app one, `''` once it is the base one again. */
+export const SIGN_IN_RATE_LIMIT_SCOPE_KEY = 'ratelimit_in_app';
+/**
+ * The `rate limit` rule description for a company with the switch: it also limits `/sign-in/` paths,
+ * except the static assets under `/sign-in/_next/`. Cloudflare Free allows the Path field only (no Method).
+ */
+export const SIGN_IN_RATE_LIMIT_DESCRIPTION = 'foundry: rate limit sign-in paths (in-app)';
+export const SIGN_IN_RATE_LIMIT_EXPRESSION = '(starts_with(http.request.uri.path, "/auth/")) or (starts_with(http.request.uri.path, "/sign-in/") and not starts_with(http.request.uri.path, "/sign-in/_next/"))';
+/**
+ * True when the company has the switch on and it applies: a company domain whose login host is
+ * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
+ * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
+ */
+export function inAppSignIn(org) {
+    return org.signIn?.inApp === true && Boolean(org.domain) && org.issuer.usesDomain;
+}
+/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+export function staleSignInUpstream(desired, live) {
+    const held = live[SIGN_IN_UPSTREAM_ENV];
+    return desired[SIGN_IN_UPSTREAM_ENV] === undefined && held !== undefined && held !== '';
+}
+/** The build argument (a build-time env in Coolify) that fixes the login's base path. */
+export const SIGN_IN_BUILD_ARG_ENV = 'NEXT_PUBLIC_BASE_PATH';
+/** The Coolify name and internal address of the in-app login app next to a target's login app. */
+export function signInLoginNames(target) {
+    return {
+        name: `${target.names.authLogin}${SIGN_IN_IMAGE_TAG_SUFFIX}`,
+        internal: `${target.internal.authLogin}${SIGN_IN_IMAGE_TAG_SUFFIX}`,
+    };
+}
+/**
+ * True when the company's in-app sign-in goes through the platform's shared login (its sign-in is the
+ * platform's ZITADEL), so the platform needs the in-app login app. A company running its own services
+ * has its own login stack instead.
+ */
+export function inAppOnSharedLogin(org) {
+    return inAppSignIn(org) && !ownsServices(org);
+}
+/**
+ * The internal URL every in-app app proxies `/sign-in/*` to: the platform's in-app login, or, for a
+ * company that runs its own services, the one in its own sign-in stack (`<slug>-auth-login-sign-in`).
+ */
+export function signInUpstream(org) {
+    const host = org && ownsServices(org)
+        ? signInLoginNames({
+            names: { authLogin: `${org.slug}-auth-login` },
+            internal: { authLogin: `${org.slug}-auth-login` },
+        }).internal
+        : SIGN_IN_LOGIN_INTERNAL_NAME;
+    return `http://${host}:${SIGN_IN_LOGIN_PORT}`;
+}
+/** {@link SIGN_IN_IN_APP_SCOPE_KEY}'s value for these apps. */
+export function inAppState(apps) {
+    return apps
+        .map((a) => `${a.host}=${a.clientId}`)
+        .sort()
+        .join(',');
+}
+/** The `{host, clientId}` pairs a recorded {@link inAppState} names. */
+export function inAppStatePairs(state) {
+    return (state ?? '')
+        .split(',')
+        .map((pair) => {
+        const at = pair.indexOf('=');
+        return at < 0
+            ? { host: pair, clientId: '' }
+            : { host: pair.slice(0, at), clientId: pair.slice(at + 1) };
+    })
+        .filter((pair) => pair.host.length > 0);
+}
+/** The hosts a recorded {@link inAppState} names. */
+export function inAppStateHosts(state) {
+    return (state ?? '')
+        .split(',')
+        .map((pair) => pair.split('=')[0] ?? '')
+        .filter((host) => host.length > 0);
+}
+/** The login binding, ZITADEL org id aside, for one in-app host. */
+export function inAppBindingFor(app) {
+    return {
+        host: app.host,
+        clientIds: [app.clientId],
+        apps: { [app.clientId]: app.app },
+        basePath: SIGN_IN_BASE_PATH,
+    };
+}
+/**
+ * What the login-host step records for these wanted apps, given what the apps' steps have recorded:
+ * `trusted` is every wanted host plus any host given up whose app still holds `SIGNIN_UPSTREAM` (its trusted
+ * domain stays until the env is gone); `active` is the wanted hosts whose env is live: bound, with the app's own base URI.
+ */
+export function inAppTargets(apps, recorded) {
+    const live = signInEnvLiveHosts(recorded);
+    const wanted = new Set(apps.map((a) => a.host));
+    const kept = inAppStatePairs(recorded[SIGN_IN_TRUSTED_SCOPE_KEY]).filter((pair) => !wanted.has(pair.host) && live.has(pair.host));
+    return {
+        trusted: inAppState([...apps, ...kept]),
+        active: inAppState(apps.filter((a) => live.has(a.host))),
+    };
+}
+/**
+ * True when an app should proxy `/sign-in/*` to the login: its host is trusted there, and the
+ * company still has the switch on or the base URI still points at the app (it is switched off in reverse
+ * order: the base URI goes back before the app stops proxying).
+ */
+export function inAppHostApplied(org, recorded, host) {
+    if (!inAppStateHosts(recorded[SIGN_IN_TRUSTED_SCOPE_KEY]).includes(host))
+        return false;
+    return inAppSignIn(org) || inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY]).includes(host);
+}

package/dist/platform.d.ts

@@ -12,6 +12,16 @@ export interface PlatformService {
     hostname: string;
     gitRef: string;
 }
+/**
+ * `archon`'s own extra field: presence turns blue/green on for platform-archon, through the same code as a hosting
+ * entry (`plan/blue-green.ts`). The tunnel moves to the balancer only once a balancer is recorded.
+ */
+export interface PlatformArchonService extends PlatformService {
+    blueGreen?: {
+        steps?: number[];
+        stepHoldMinutes?: number;
+    };
+}
 /**
  * `sfu`'s own extra field. A host that changes what the SFU VM is reached
  * with (its SSH key, host key or tunnel token) sets a new `connectionRevision`
@@ -97,7 +107,7 @@ export interface DeclaredPlatform {
     ai: PlatformService;
     jobs: PlatformService;
     integrations: PlatformService;
-    archon: PlatformService;
+    archon: PlatformArchonService;
     /** #317 (F7). No deploy step reads this service's own `gitRef` yet -- `N1` is deployed by hand until it exists. */
     edge: PlatformService;
     /**

package/dist/platform.js

@@ -1,5 +1,5 @@
 import { isIPv4 } from 'node:net';
-import { validateDomain } from './org.js';
+import { validateBlueGreen, validateDomain } from './org.js';
 /** Where Archon publishes the Worker script for `tag` (a private repo; the host's `fetchArtifact` fetches it). */
 export function uptimeArtifactUrl(tag) {
     return `https://github.com/wtfalch/archon/releases/download/${tag}/archon-uptime-worker.js`;
@@ -69,6 +69,9 @@ export function validatePlatform(platform) {
             return `${key}.gitRef must not be empty once ${key}.enabled is true`;
         }
     }
+    const blueGreenReason = validateBlueGreen(platform.archon.blueGreen, 'archon');
+    if (blueGreenReason)
+        return blueGreenReason;
     const revision = platform.sfu.connectionRevision;
     if (revision != null && !/^[A-Za-z0-9:.-]{0,64}$/.test(revision)) {
         return 'sfu.connectionRevision must be at most 64 characters of A-Z, a-z, 0-9, ":", "." and "-"';

package/dist/release/decide.d.ts

@@ -0,0 +1,95 @@
+import { type Color, type ReleaseAction, type ReleaseSignal, type WindowState } from './types.js';
+/** ADR 0001 rule 5: the default steps and the least time on each. */
+export declare const DEFAULT_STEPS: readonly number[];
+export declare const DEFAULT_STEP_HOLD_MINUTES = 60;
+/** Rule 7: errors this share of requests, with at least HARD_FAIL_MIN_REQUESTS, roll back at any level. */
+export declare const HARD_FAIL_ERROR_RATE = 0.9;
+export declare const HARD_FAIL_MIN_REQUESTS = 2;
+/** Rule 8: a relative fail needs this many requests and this many failed checks in a row. */
+export declare const RELATIVE_MIN_REQUESTS = 20;
+export declare const RELATIVE_FAILED_CHECKS = 3;
+/** A relative check counts only this long after the last counted one, so runs close together (applies also run releases) are one check. */
+export declare const CHECK_INTERVAL_MINUTES = 10;
+/** The new color matches the baseline while its error rate is at most baseline plus this (absolute). */
+export declare const ERROR_RATE_MARGIN = 0.02;
+/** Rules 12 and 13: the window at 100% closes after this long, and at most this long. */
+export declare const WINDOW_MIN_HOURS = 24;
+export declare const WINDOW_CAP_DAYS = 7;
+/** The new color must be running and answer on its own address within this time of the deploy. */
+export declare const DEPLOY_TIMEOUT_MINUTES = 30;
+export interface ActiveRelease {
+    from: Color;
+    to: Color;
+    digest: string;
+    /** Relative-fail checks in a row. */
+    fails: number;
+    /** When the last counted relative check ran (ISO). Absent: none yet in this step. */
+    checkedAt?: string | undefined;
+}
+export interface Recorded {
+    live: Color;
+    digests: Record<Color, string | null>;
+    stageDigest: string | null;
+    weights: Record<Color, number>;
+    window: WindowState;
+    /** Set while window.kind is step, inconclusive, window or cap. */
+    release: ActiveRelease | null;
+    held: string[];
+}
+export interface ColorCounts {
+    requests: number;
+    errors: number;
+}
+/** The reporting health read (C1), once validated. */
+export interface HealthRead {
+    colors: Record<Color, ColorCounts>;
+    daily: {
+        days: number;
+        requestsPerDay: number;
+        errorsPerDay: number;
+    };
+}
+export interface Observation {
+    /** null when the health read failed: counted as inconclusive, never as a pass. */
+    health: HealthRead | null;
+    /** The new color's Coolify status. */
+    status: 'running' | 'crash_loop' | 'other';
+    /** The new color's own address, checked over HTTP. */
+    address: 'ok' | 'failed' | 'unchecked';
+}
+export type ReleaseEffect = {
+    kind: 'deploy';
+    color: Color;
+    digest: string;
+} | {
+    kind: 'stop';
+    color: Color;
+};
+export interface Decision {
+    recorded: Recorded;
+    signal: ReleaseSignal | null;
+    effects: ReleaseEffect[];
+    /** Blocked items for the operator, fixed text. */
+    blocked: string[];
+    /** Actions that changed nothing, with a fixed reason. */
+    refused: string[];
+}
+export declare function normalizeSteps(steps: readonly number[] | undefined): number[];
+/** The time a health read should cover: from the step or window start to now. */
+export declare function healthRange(r: Recorded, now: Date): {
+    from: string;
+    to: string;
+} | null;
+/**
+ * The whole release decision for one run: from the recorded state, the
+ * actions requested, one observation and the time, the next recorded state.
+ * Pure: it reads nothing and writes nothing (ADR 0001 rules 5, 7-13, 16).
+ */
+export declare function decide(input: {
+    recorded: Recorded;
+    actions: readonly ReleaseAction[];
+    steps?: readonly number[] | undefined;
+    stepHoldMinutes?: number | undefined;
+    now: Date;
+    observation: Observation;
+}): Decision;