@wtfalch/foundry 0.42.1 → 0.44.0

package/dist/bootstrap/versions.d.ts

@@ -18,6 +18,8 @@ export interface PinnedVersions {
     busybox: string;
     /** The sign-in database's image (#746). Its major version is the data directory's format: a bump past 16 needs a dump and restore, not an image change. */
     postgres: string;
+    /** The load balancer of a blue/green app (`plan/blue-green.ts`): Traefik with a file provider. */
+    traefik: string;
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, WorkerAppConfig, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
 export type { PinnedVersions };
 export declare const PINNED_VERSIONS: Readonly<PinnedVersions>;
-export type { RequestableField, CallsChange, StorageLimitChange, AiLimitChange, DomainChange, MailTierChange, RequestedChangeValue, ChangeClassification, RequestedChangeState, RequestedChange, } from './requested-changes.js';
+export type { RequestableField, CallsChange, CustomersChange, StorageLimitChange, AiLimitChange, DomainChange, MailTierChange, RequestedChangeValue, ChangeClassification, RequestedChangeState, RequestedChange, } from './requested-changes.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
@@ -16,8 +16,12 @@ export { StaleLeaseError } from './store.js';
 export type { PlanApply, DestroyProgress } from './apply.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
+export type { Color, ReleaseAction, ReleaseSignal, ReleaseState, WindowState, } from './release/types.js';
+export type { ReleaseStore } from './release/state.js';
+export { readReleaseState, requestReleaseAction } from './release/state.js';
+export { createPostgresReleaseStore } from './store/postgres.js';
 export type { FoundryStoreDb } from './store/postgres.js';
-export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseRequests, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, MailRoute, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSignIn, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateCustomers, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own
@@ -10,7 +10,9 @@ export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export { StaleLeaseError } from './store.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
-export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
+export { readReleaseState, requestReleaseAction } from './release/state.js';
+export { createPostgresReleaseStore } from './store/postgres.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseRequests, foundryRequestedChanges, } from './store/schema.js';
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './plan/index.js';

package/dist/migrations/0055_release_requests.sql

@@ -0,0 +1,20 @@
+-- @wtfalch/foundry: an operator's release action (promote, roll back, clear a
+-- held digest, decide at the cap) waiting for the release runner. The runner
+-- marks a row consumed in one statement, so each request is applied once.
+-- Additive: a new table, no existing row touched. Copies 0036_applied_versions
+-- (an appended table with no foreign key, because `org_id` may be `platform`).
+-- Mirrors src/store/schema.ts's `foundryReleaseRequests`.
+
+create table if not exists foundry_release_requests (
+  id          bigserial primary key,
+  org_id      text not null,
+  entry_key   text not null,
+  action      jsonb not null,
+  actor       text not null,
+  created_at  timestamptz not null default now(),
+  consumed_at timestamptz
+);
+
+create index if not exists foundry_release_requests_open_idx
+  on foundry_release_requests (org_id, entry_key, id)
+  where consumed_at is null;

package/dist/migrations/0056_platform_archon_blue_green.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: `archon_blue_green` is `platform.archon.blueGreen` as JSON ({ steps?, stepHoldMinutes? });
+-- null (the default) keeps platform-archon on one app. Copies 0052_platform_mail_relay.sql: one
+-- nullable column added with `if not exists`, so it is safe to run at container start on live rows.
+-- Mirrors src/store/schema.ts's `foundryDeclaredPlatform` table addition.
+
+alter table foundry_declared_platform
+  add column if not exists archon_blue_green jsonb;

package/dist/migrations/0057_org_customers.sql

@@ -0,0 +1,29 @@
+-- @wtfalch/foundry: a company's customers switch (C3). `customers_enabled` gives the company a
+-- `<slug> customers` sign-in organisation and a read-only directory credential for its Boule;
+-- `customers_sign_up` lets people register themselves in it. Both default off.
+-- Mirrors src/store/schema.ts's `declaredOrgs`.
+
+alter table foundry_declared_orgs
+  add column if not exists customers_enabled boolean not null default false,
+  add column if not exists customers_sign_up boolean not null default false;
+
+-- A company that already signs a hosting entry's users in as customers keeps working. Until now
+-- foundry forced self-registration on for every customers organisation, so those companies carry
+-- both switches on: the live state does not change. A company declared after this migration
+-- starts with sign-up off.
+update foundry_declared_orgs
+   set customers_enabled = true,
+       customers_sign_up = true
+ where jsonb_typeof(hosting_entries) = 'array'
+   and exists (
+     select 1
+       from jsonb_array_elements(hosting_entries) as entry
+      where entry -> 'uses' -> 'auth' ->> 'users' = 'customers'
+   );
+
+-- Requested changes may now name `customers`.
+alter table foundry_requested_changes
+  drop constraint if exists foundry_requested_changes_field_check;
+alter table foundry_requested_changes
+  add constraint foundry_requested_changes_field_check
+    check (field in ('calls', 'customers', 'storageLimit', 'aiLimit', 'domain', 'mailTier'));

package/dist/org.d.ts

@@ -1,3 +1,5 @@
+import { type WorkerAppConfig } from './worker-app-config.js';
+export type { WorkerAppConfig } from './worker-app-config.js';
 /**
  * Opaque, minted by foundry when an org is created. Keys the declared org,
  * the applied state, every estate-wide service's id map, and the chat
@@ -355,6 +357,23 @@ export interface HostingEntry {
      * is the org's own domain.
      */
     worker?: WorkerConfig;
+    /**
+     * A Cloudflare Worker with Durable Objects and Containers, hosted by foundry
+     * as an option any org can declare (ADR 0002). Exclusive with `worker` and a
+     * Coolify `repo`; `validateEntryWorkerApp` states the rest.
+     */
+    workerApp?: WorkerAppConfig;
+    /**
+     * Blue/green releases (docs/adr/0001-blue-green-releases.md). Presence turns it on: foundry runs the app as a
+     * blue and a green copy behind a load balancer on every server it manages, and the tunnel routes to the balancer.
+     */
+    blueGreen?: BlueGreenConfig;
+}
+/** The traffic steps (percent to the new color) and the hold at each step. Both default in `plan/blue-green.ts`. */
+export interface BlueGreenConfig {
+    /** Ascending, each 1..100, ending at 100. */
+    steps?: number[];
+    stepHoldMinutes?: number;
 }
 /** One named volume on a hosting entry's app. */
 export interface EntryVolume {
@@ -430,7 +449,19 @@ export interface EntryAuth {
     users: 'staff' | 'customers';
     registration: 'open' | 'closed';
     replacesBrokerEntry?: string;
+    /**
+     * The entry is an OAuth resource server for MCP clients (auth ADR 0002): the
+     * broker is the authorization server, ZITADEL signs the person in. `path` is
+     * the MCP endpoint on the entry's host; the resource is
+     * `https://<the entry's host><path>`, derived and never declared. Needs
+     * `users: 'customers'` and `registration: 'open'`.
+     */
+    mcp?: {
+        path: string;
+    };
 }
+/** The MCP endpoint path: absolute, plain characters, no dot segments, no query. */
+export declare const MCP_PATH: RegExp;
 /**
  * AI for one entry: a key below the org's own ai key, the `AI_*` env and,
  * with `webhookPath`, the ai webhook. `offerings` is what the app may call,
@@ -551,7 +582,11 @@ export declare const heldEnvRef: (orgId: string, entryKey: string, name: string)
 export declare function validateHosting(hosting: HostingConfig, names?: {
     domain: string | null;
     locked: ReadonlySet<string>;
+    slug?: string;
+    siteOwnsApex?: boolean;
 }): string | null;
+/** `blueGreen`: steps ascending, each a whole number 1..100, the last 100; a hold of 1..1440 minutes. */
+export declare function validateBlueGreen(value: unknown, at: string): string | null;
 export declare function validateDomain(domain: string): string | null;
 /**
  * A broker entry name foundry writes itself: Archon's, and any company's Boule.
@@ -651,6 +686,24 @@ export interface SignInConfig {
  * own sign-in stack gets the second login app.
  */
 export declare function validateSignIn(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): string | null;
+/**
+ * A company's customers: people outside the company who sign in to its apps (C3, campaign
+ * 2026-10-15). `enabled` gives the company a `<slug> customers` ZITADEL organisation and a
+ * read-only directory credential for its Boule. `signUp` lets people register themselves in
+ * that organisation; it needs `enabled` and is off by default. Both are requestable (`customers`).
+ */
+export interface CustomersConfig {
+    enabled: boolean;
+    signUp: boolean;
+}
+/**
+ * `null` when `customers` is valid: both switches are booleans, sign-up needs customers on, and
+ * an entry with `registration: 'open'` needs both, because open registration signs people up into
+ * the customers organisation.
+ */
+export declare function validateCustomers(org: Pick<DeclaredOrg, 'customers'> & {
+    hosting: Pick<HostingConfig, 'entries'>;
+}): string | null;
 /** The only reader of `services.own`. Every company runs its own services, the platform's owner company too; a company without a domain runs them on oikos.host. */
 export declare function ownsServices(org: Pick<DeclaredOrg, 'services'>): boolean;
 /** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
@@ -933,6 +986,8 @@ export interface DeclaredOrg {
     services?: ServicesConfig;
     /** Absent means `{ inApp: false }`. Optional so every existing literal and fixture compiles unchanged. */
     signIn?: SignInConfig;
+    /** Absent means `{ enabled: false, signUp: false }`. Optional so every existing literal and fixture compiles unchanged. */
+    customers?: CustomersConfig;
     /** Parts of this company held on their own version. Absent or null follows the platform. Ignored for the owner company. */
     versionPin?: VersionPin | null;
     sso: SsoConfig;

package/dist/org.js

@@ -1,4 +1,5 @@
 import { floatingRefBlocked, floatingTagBlocked } from './bootstrap/versions.js';
+import { entryHasDatabase, validateArtifact, validateEntryWorkerApp, } from './worker-app-config.js';
 /** {@link MailConfig.mailApps} when the org declares none of its own (#34, decided 2026-09-30). */
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
@@ -10,6 +11,8 @@ export const DEFAULT_GATE_LIMIT = 3;
 export const APP_ENTRY_KEY = 'app';
 /** The most volumes one entry may declare. */
 export const MAX_ENTRY_VOLUMES = 8;
+/** The MCP endpoint path: absolute, plain characters, no dot segments, no query. */
+export const MCP_PATH = /^\/[A-Za-z0-9_~-]+(\/[A-Za-z0-9_~-]+)*$|^\/$/;
 /** What an entry's ai key may hold: the most the org's own key holds. */
 export const AI_ENTRY_PERMISSIONS = ['ai.offerings:invoke', 'ai.runs:create'];
 /** The env names `uses.ai` writes; `env` may not name them. */
@@ -159,6 +162,9 @@ export function validateHosting(hosting, names) {
         const invalidWorker = validateEntryWorker(entry, hosting, names?.domain);
         if (invalidWorker)
             return invalidWorker;
+        const invalidWorkerApp = validateEntryWorkerApp(entry, hosting, names);
+        if (invalidWorkerApp)
+            return invalidWorkerApp;
         const invalidEdgeUse = validateEntryEdge(entry, hosting, names?.domain);
         if (invalidEdgeUse)
             return invalidEdgeUse;
@@ -183,7 +189,7 @@ export function validateHosting(hosting, names) {
     const invalidNames = validateEntryHostnames(hosting, names);
     if (invalidNames)
         return invalidNames;
-    if (hosting.entries.filter((entry) => entry.database).length > 1) {
+    if (hosting.entries.filter(entryHasDatabase).length > 1) {
         return 'at most one hosting entry may set database: the one runtime database role cannot serve two apps';
     }
     const invalidGates = validateGates(hosting, names?.domain, names?.locked);
@@ -308,7 +314,10 @@ function validateEntryHostnames(hosting, names) {
             return `${at} hostnames need hosting.usesDomain: without it only the '${APP_ENTRY_KEY}' entry is served, at its own address`;
         }
         const reads = hosting.usesDomain && names?.domain;
-        if (reads && entry.key === APP_ENTRY_KEY && !entry.hostnames.some((n) => n !== '*')) {
+        if (reads &&
+            entry.key === APP_ENTRY_KEY &&
+            !entry.workerApp &&
+            !entry.hostnames.some((n) => n !== '*')) {
             return `${at} needs a hostname ('@' or a label) while hosting.usesDomain is on: '*' alone names nothing, and the app would fall back to the bare domain`;
         }
         for (const name of entry.hostnames) {
@@ -351,6 +360,8 @@ const VOLUME_MOUNT_PATH_MAX = 255;
 const REPO = /^wtfalch\/[A-Za-z0-9._-]+$/;
 // The env names `pushAppEnv` and `pushDatabaseUrl` set themselves.
 const FOUNDRY_ENV_NAME = /^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$/;
+// Set only on the colors of a blueGreen entry; any other entry may declare them.
+const BLUE_GREEN_ENV_NAME = /^REPORTING_(COLOR|RELEASE|HEALTH_TOKEN)$/;
 const SECRET_ENV_NAME = /_(KEY|SECRET|TOKEN|PASSWORD)$/;
 const HELD_SECRETS = "declare it as { from: 'heldSecret' }, not a plain value";
 /** The rules for one {@link HostingEntry}; `null` when it is valid. */
@@ -392,11 +403,19 @@ function validateHostingEntry(entry, enabled) {
     const invalidVolumes = validateEntryVolumes(entry, at);
     if (invalidVolumes)
         return invalidVolumes;
+    const invalidBlueGreen = validateBlueGreen(entry.blueGreen, at);
+    if (invalidBlueGreen)
+        return invalidBlueGreen;
+    if (entry.blueGreen !== undefined &&
+        entry.key !== APP_ENTRY_KEY &&
+        !entry.hostnames.some((name) => name !== '*')) {
+        return `${at} blueGreen needs a public hostname: the release check reaches each color through it`;
+    }
     for (const [name, value] of Object.entries(entry.env)) {
         if (!name) {
             return `${at} env needs a non-empty env var name`;
         }
-        if (FOUNDRY_ENV_NAME.test(name)) {
+        if (FOUNDRY_ENV_NAME.test(name) || (entry.blueGreen && BLUE_GREEN_ENV_NAME.test(name))) {
             return `${at} env '${name}' is set by foundry and cannot be declared`;
         }
         if (typeof value !== 'string') {
@@ -424,6 +443,33 @@ function validateHostingEntry(entry, enabled) {
     }
     return null;
 }
+/** `blueGreen`: steps ascending, each a whole number 1..100, the last 100; a hold of 1..1440 minutes. */
+export function validateBlueGreen(value, at) {
+    if (value === undefined)
+        return null;
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return `${at} blueGreen must be an object`;
+    }
+    const { steps, stepHoldMinutes } = value;
+    if (steps !== undefined) {
+        if (!Array.isArray(steps) || steps.length === 0 || steps.length > 20) {
+            return `${at} blueGreen steps must be a list of 1 to 20 percentages`;
+        }
+        if (!steps.every((n) => Number.isInteger(n) && n >= 1 && n <= 100)) {
+            return `${at} blueGreen steps must be whole numbers from 1 to 100`;
+        }
+        if (!steps.every((n, i) => i === 0 || n > steps[i - 1])) {
+            return `${at} blueGreen steps must be ascending`;
+        }
+        if (steps[steps.length - 1] !== 100)
+            return `${at} blueGreen steps must end at 100`;
+    }
+    if (stepHoldMinutes !== undefined &&
+        !(Number.isInteger(stepHoldMinutes) && stepHoldMinutes >= 1 && stepHoldMinutes <= 1440)) {
+        return `${at} blueGreen stepHoldMinutes must be a whole number from 1 to 1440`;
+    }
+    return null;
+}
 /** `volumes`: a bounded list of named volumes at distinct absolute paths, none on the log volume's path or name,
  * on `/app` or under a system path. */
 function validateEntryVolumes(entry, at) {
@@ -501,6 +547,16 @@ function validateEntryAuth(entry, hosting, domain) {
     if (!hasExactHostname(entry, hosting, domain)) {
         return `${at} needs an exact hostname to sign in at`;
     }
+    if (auth.mcp !== undefined) {
+        if (auth.users !== 'customers' || auth.registration !== 'open') {
+            return `${at} mcp needs users 'customers' and registration 'open': an MCP client signs the customer in, and only customers register themselves`;
+        }
+        if (typeof auth.mcp?.path !== 'string' ||
+            !MCP_PATH.test(auth.mcp.path) ||
+            auth.mcp.path.length > 200) {
+            return `${at} mcp.path must be an absolute path of letters, digits, '_', '~' and '-' segments, such as '/mcp'`;
+        }
+    }
     if (entry.key === 'agora' ||
         entry.key === 'boule' ||
         entry.key === 'cms' ||
@@ -511,6 +567,8 @@ function validateEntryAuth(entry, hosting, domain) {
 }
 /** With no domain the hostnames are not read (`entryHostnames`). */
 function hasExactHostname(entry, hosting, domain) {
+    if (entry.workerApp)
+        return true; // Its host is workerApp.host, or <slug>[-<key>].oikos.host.
     return hosting.usesDomain && domain !== null
         ? entry.hostnames.some((name) => name !== '*')
         : entry.key === APP_ENTRY_KEY;
@@ -601,7 +659,6 @@ function workerRouteZone(route) {
     return host.startsWith('*.') ? host.slice(2) : host;
 }
 const WORKER_ROUTE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+\/.*$/;
-const WORKER_SHA256 = /^[0-9a-f]{64}$/;
 /**
  * Restated, not shared, from `plan/worker.ts`'s `WORKER_ORG_HASH_LENGTH`/
  * `WORKER_NAME_MAX_LENGTH` -- importing them here would import that
@@ -635,29 +692,9 @@ function validateEntryWorker(entry, hosting, domain) {
     if (entry.key.length > WORKER_NAME_MAX_LENGTH - WORKER_NAME_FIXED_LENGTH) {
         return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "-edge") must fit Cloudflare's ${WORKER_NAME_MAX_LENGTH}-character limit`;
     }
-    let artifactUrl;
-    try {
-        artifactUrl = new URL(worker.artifactUrl);
-    }
-    catch {
-        return `${at} artifactUrl must be an absolute URL, not a bare path or relative file`;
-    }
-    if (artifactUrl.protocol !== 'https:') {
-        return `${at} artifactUrl must be an https:// URL`;
-    }
-    if (artifactUrl.username || artifactUrl.password) {
-        return `${at} artifactUrl must not carry userinfo (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
-    }
-    if (artifactUrl.search) {
-        return `${at} artifactUrl must not carry a query string (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
-    }
-    // `URL.hash` is '' for a bare trailing `#`, so the raw string is checked.
-    if (worker.artifactUrl.includes('#')) {
-        return `${at} artifactUrl must not carry a fragment (refused for the same reason as a query string)`;
-    }
-    if (!WORKER_SHA256.test(worker.artifactSha256)) {
-        return `${at} artifactSha256 must be 64 lowercase hex characters`;
-    }
+    const invalidArtifact = validateArtifact(at, worker.artifactUrl, worker.artifactSha256, entry.repo);
+    if (invalidArtifact)
+        return invalidArtifact;
     if (!WORKER_ROUTE.test(worker.route)) {
         return `${at} route must be a hostname (an optional leading '*.' label, then at least two more labels) and a path, joined by '/'`;
     }
@@ -918,6 +955,32 @@ export function validateSignIn(org) {
     }
     return null;
 }
+/**
+ * `null` when `customers` is valid: both switches are booleans, sign-up needs customers on, and
+ * an entry with `registration: 'open'` needs both, because open registration signs people up into
+ * the customers organisation.
+ */
+export function validateCustomers(org) {
+    const customers = org.customers;
+    if (customers !== undefined) {
+        const value = customers;
+        if (typeof customers !== 'object' ||
+            customers === null ||
+            Array.isArray(customers) ||
+            typeof value?.enabled !== 'boolean' ||
+            typeof value?.signUp !== 'boolean' ||
+            Object.keys(customers).some((key) => key !== 'enabled' && key !== 'signUp')) {
+            return 'customers must be { enabled: boolean, signUp: boolean }';
+        }
+        if (value.signUp && !value.enabled)
+            return 'customers.signUp needs customers.enabled';
+    }
+    const open = org.hosting.entries.find((entry) => entry.uses?.auth?.registration === 'open');
+    if (open && !(org.customers?.enabled && org.customers.signUp)) {
+        return `hosting.entries '${open.key}' uses.auth registration 'open' needs customers.enabled and customers.signUp`;
+    }
+    return null;
+}
 /** The only reader of `services.own`. Every company runs its own services, the platform's owner company too; a company without a domain runs them on oikos.host. */
 export function ownsServices(org) {
     return org.services?.own === true;

package/dist/plan/archon-blue-green.d.ts

@@ -0,0 +1,54 @@
+import { type BlueGreenApplyDeps } from './blue-green-apply.js';
+import { type BlueGreenSubject } from './blue-green.js';
+import type { DeployHealthRuntime } from './deploy-health.js';
+import type { PlatformTunnelPort } from './platform-providers.js';
+export interface ArchonBlueGreenRun {
+    subject: BlueGreenSubject;
+    /** The owner company's id: the health token's held ref is `sharedSecretRef(ownerOrgId, ...)` like an entry's. */
+    ownerOrgId: string;
+    desired: {
+        primary: string;
+    };
+    recorded(): Readonly<Record<string, string>>;
+    record(key: string, value: string): void;
+    persist(): Promise<void>;
+    coolify: BlueGreenApplyDeps['coolify'] & {
+        listServers(): Promise<Array<{
+            uuid: string;
+            is_usable: boolean;
+            is_reachable: boolean;
+        }>>;
+        findOrCreateEnvironment(projectUuid: string, name: string): Promise<{
+            environment: {
+                id: number;
+                name: string;
+                uuid: string;
+            };
+        }>;
+    };
+    heldKeys: {
+        resolve(ref: string): Promise<string | null>;
+        put(ref: string, value: string): Promise<void>;
+    };
+    /** Registers a value for redaction before it is written anywhere. */
+    secret: (value: string) => void;
+    /** Archon's Coolify project, its blue app and its tunnel, all recorded by the archon step. */
+    projectUuid: string;
+    blueAppId: string;
+    tunnelId: string;
+    hostname: string;
+    tunnels: Pick<PlatformTunnelPort, 'putTunnelConfig'>;
+    runtime: DeployHealthRuntime;
+    sleep: (ms: number) => Promise<void>;
+    logDir: string;
+    isRunning: (status: string | undefined) => boolean;
+}
+/**
+ * platform-archon on the blue/green path (`platform.archon.blueGreen`): the archon app keeps its name and is
+ * blue; green, the balancer and stage are new apps beside it on the primary server. The tunnel moves to the
+ * balancer last, only after every part of the structure is applied and running, so a first apply never has the
+ * tunnel point at a balancer that does not answer. A failure halfway leaves the apps already made, recorded by
+ * id; the structure is recorded as applied only after its last part, so the next apply repeats from there and
+ * the tunnel stays on the app until then.
+ */
+export declare function applyArchonBlueGreen(run: ArchonBlueGreenRun): Promise<void>;

package/dist/plan/archon-blue-green.js

@@ -0,0 +1,72 @@
+import { randomBytes } from 'node:crypto';
+import { sharedSecretRef } from '../org.js';
+import { applyBlueGreenServer } from './blue-green-apply.js';
+import { ARCHON_BG_ORIGIN_SCOPE_KEY, DEFAULT_WEIGHTS, PRIMARY_SERVER_SCOPE_KEY, bgKey, healthTokenName, lbOrigin, splitServers, } from './blue-green.js';
+/**
+ * platform-archon on the blue/green path (`platform.archon.blueGreen`): the archon app keeps its name and is
+ * blue; green, the balancer and stage are new apps beside it on the primary server. The tunnel moves to the
+ * balancer last, only after every part of the structure is applied and running, so a first apply never has the
+ * tunnel point at a balancer that does not answer. A failure halfway leaves the apps already made, recorded by
+ * id; the structure is recorded as applied only after its last part, so the next apply repeats from there and
+ * the tunnel stays on the app until then.
+ */
+export async function applyArchonBlueGreen(run) {
+    const { subject } = run;
+    const id = subject.id;
+    const label = `coolify:archon-bluegreen:${id}`;
+    const { up } = splitServers((await run.coolify.listServers()).map((s) => ({
+        uuid: s.uuid,
+        usable: s.is_usable,
+        reachable: s.is_reachable,
+    })));
+    const primary = run.recorded()[PRIMARY_SERVER_SCOPE_KEY] ?? up[0];
+    if (!primary || !up.includes(primary) || primary !== run.desired.primary) {
+        throw new Error(`${label}: the plan's primary server is not the usable recorded one`);
+    }
+    if (!run.recorded()[PRIMARY_SERVER_SCOPE_KEY]) {
+        run.record(PRIMARY_SERVER_SCOPE_KEY, primary);
+        await run.persist();
+    }
+    if (!run.recorded()[bgKey.weights(id)]) {
+        run.record(bgKey.weights(id), DEFAULT_WEIGHTS);
+        await run.persist();
+    }
+    const { environment } = await run.coolify.findOrCreateEnvironment(run.projectUuid, 'production');
+    const ref = sharedSecretRef(run.ownerOrgId, healthTokenName(id));
+    const deps = {
+        coolify: run.coolify,
+        recorded: run.recorded,
+        record: run.record,
+        persist: run.persist,
+        projectUuid: run.projectUuid,
+        environment,
+        healthToken: async () => {
+            const held = await run.heldKeys.resolve(ref);
+            if (held) {
+                run.secret(held);
+                return held;
+            }
+            const minted = randomBytes(32).toString('base64url');
+            run.secret(minted);
+            await run.heldKeys.put(ref, minted);
+            return minted;
+        },
+        secret: run.secret,
+        runtime: run.runtime,
+        sleep: run.sleep,
+        label,
+        primaryBlueAppId: run.blueAppId,
+        logDir: run.logDir,
+        isRunning: run.isRunning,
+    };
+    await applyBlueGreenServer(deps, subject, { uuid: primary, primaryUuid: primary });
+    // The structure is applied and every part ran: now, and only now, the tunnel moves.
+    const origin = lbOrigin(subject);
+    if (run.recorded()[ARCHON_BG_ORIGIN_SCOPE_KEY] !== origin) {
+        await run.tunnels.putTunnelConfig(run.tunnelId, {
+            ingress: [{ hostname: run.hostname, service: origin }, { service: 'http_status:404' }],
+        });
+        run.record(ARCHON_BG_ORIGIN_SCOPE_KEY, origin);
+        await run.persist();
+    }
+}

package/dist/plan/blue-green-apply.d.ts

@@ -0,0 +1,82 @@
+import { type BlueGreenSubject } from './blue-green.js';
+import { ensureConnectorsOnServers } from './cloudflared-connector.js';
+import { type DeployHealthRuntime } from './deploy-health.js';
+import type { TunnelPort } from './edge-tunnels.js';
+import type { CoolifyPort } from './executor.js';
+/** The Coolify calls this module makes. */
+type Coolify = Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy' | 'deployAndWait' | 'listStorages' | 'createPersistentStorage' | 'createFileStorage' | 'updateFileStorage' | 'requireGithubApp' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw'> & {
+    listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
+};
+export interface BlueGreenApplyDeps {
+    coolify: Coolify;
+    /** The ids recorded so far, and how to record one. */
+    recorded: () => Readonly<Record<string, string>>;
+    record: (key: string, value: string) => void;
+    persist: () => Promise<void>;
+    projectUuid: string;
+    environment: {
+        id: number;
+        name: string;
+        uuid: string;
+    };
+    /** The entry's one health token: held once, handed to the env writes below and nowhere else. */
+    healthToken: () => Promise<string>;
+    /** Registers a value for redaction before it is written anywhere. */
+    secret: (value: string) => void;
+    runtime: DeployHealthRuntime;
+    sleep: (ms: number) => Promise<void>;
+    /** The step's name, for errors. */
+    label: string;
+    /** The app id of the blue copy `coolify:app` made on the primary. */
+    primaryBlueAppId: string;
+    logDir: string;
+    isRunning: (status: string | undefined) => boolean;
+}
+/** What writing a balancer's config needs; {@link BlueGreenApplyDeps} and the release runner both have it. */
+export interface LbConfigDeps {
+    coolify: Pick<Coolify, 'listStorages' | 'createFileStorage' | 'updateFileStorage'>;
+    recorded: () => Readonly<Record<string, string>>;
+    record: (key: string, value: string) => void;
+    persist: () => Promise<void>;
+    label: string;
+}
+/** Replaces the host in a connection URL; `null` when it is not one. Never throws a value. */
+export declare function withDatabaseHost(url: string, host: string): string | null;
+/** `postgres://user:password@host/db` for a stage runtime role: the password is minted by the caller. */
+export declare function runtimeDatabaseUrl(ownerUrl: string, role: string, password: string): string | null;
+/**
+ * Applies one server's blue/green structure for `subject`: green (and blue, off the primary) beside the
+ * primary's blue, the balancer with the recorded weights, and on the primary the stage app. Every color
+ * gets the primary blue's env (the database host rewritten off the primary) and its three reporting
+ * values. A failure halfway leaves the apps already made, recorded by id; the next run finds them and
+ * does the rest. Nothing is recorded as applied until every part is done.
+ */
+export declare function applyBlueGreenServer(deps: BlueGreenApplyDeps, subject: BlueGreenSubject, server: {
+    uuid: string;
+    primaryUuid: string;
+}): Promise<void>;
+/** Writes the balancer's config with the recorded weights and records them for this server. */
+export declare function applyBlueGreenWeights(deps: LbConfigDeps, subject: BlueGreenSubject, server: {
+    uuid: string;
+    primaryUuid: string;
+}): Promise<void>;
+/** A connector for the org's tunnel on each given server; the primary's is the existing one. */
+export declare function applyBlueGreenConnectors(input: {
+    coolify: Parameters<typeof ensureConnectorsOnServers>[0]['coolify'];
+    tunnels: Pick<TunnelPort, 'getTunnelToken'>;
+    tunnelId: string;
+    baseAppName: string;
+    baseScopeKey: string;
+    primaryUuid: string;
+    serverUuids: readonly string[];
+    projectUuid: string;
+    environment: {
+        id: number;
+        name: string;
+        uuid: string;
+    };
+    recorded: () => Readonly<Record<string, string>>;
+    record: (key: string, value: string) => void;
+    persist: () => Promise<void>;
+}): Promise<void>;
+export {};