@wtfalch/foundry 0.42.1 → 0.44.0

package/dist/plan/hostnames.d.ts

@@ -6,6 +6,13 @@ import type { DeclaredOrg, HostingEntry } from '../org.js';
  * acted on elsewhere.
  */
 export declare function entryHostnames(org: DeclaredOrg, entry: HostingEntry): string[];
+/**
+ * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
+ * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
+ * under `oikos.host`, so the free Universal certificate covers it), and
+ * `<slug>.oikos.host` for the entry keyed `app`.
+ */
+export declare function workerAppHostname(org: DeclaredOrg, entry: HostingEntry): string;
 /**
  * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
  * Like `entryHostnames`, it is read only while hosting is on, `usesDomain` is

package/dist/plan/hostnames.js

@@ -1,4 +1,5 @@
 import { APP_ENTRY_KEY } from '../org.js';
+import { workerAppHostnameOf } from '../worker-app-config.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 /**
@@ -9,11 +10,22 @@ import { bouleHostnameFor } from './boule.js';
  */
 export function entryHostnames(org, entry) {
     const { domain } = org;
+    if (entry.workerApp)
+        return [workerAppHostname(org, entry)];
     if (!org.hosting.usesDomain || !domain) {
         return entry.key === APP_ENTRY_KEY ? [`${org.slug}.oikos.host`] : [];
     }
     return entry.hostnames.flatMap((name) => name === '*' ? [] : name === '@' ? [domain] : [`${name}.${domain}`]);
 }
+/**
+ * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
+ * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
+ * under `oikos.host`, so the free Universal certificate covers it), and
+ * `<slug>.oikos.host` for the entry keyed `app`.
+ */
+export function workerAppHostname(org, entry) {
+    return workerAppHostnameOf({ slug: org.slug, domain: org.domain, usesDomain: org.hosting.usesDomain }, entry.key, entry.workerApp?.host ?? '@');
+}
 /**
  * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
  * Like `entryHostnames`, it is read only while hosting is on, `usesDomain` is
@@ -98,8 +110,11 @@ export function filesShareHostname(org) {
 export function tunnelIngressHostnames(org, loginHost = null) {
     const hostnames = org.site.enabled && org.domain ? [org.domain, `cms.${org.domain}`] : [];
     if (org.hosting.enabled) {
-        for (const entry of org.hosting.entries)
-            hostnames.push(...entryHostnames(org, entry));
+        // A Worker app is reached through its own Worker route, never the tunnel.
+        for (const entry of org.hosting.entries) {
+            if (!entry.workerApp)
+                hostnames.push(...entryHostnames(org, entry));
+        }
     }
     else if (hostnames.length === 0) {
         hostnames.push(legacyAppHostname(org));

package/dist/plan/locked-hostnames.d.ts

@@ -10,3 +10,14 @@ export declare const OWN_SERVICE_LABELS: readonly ["auth", "mail", "files", "sfu
  * oikos.host service names; any other org with no domain holds none.
  */
 export declare function lockedHostnames(org: DeclaredOrg, platformHostnames: readonly string[]): Set<string>;
+/**
+ * What `validateHosting` knows of the org's names: its domain, the names
+ * foundry owns, its slug (for the domain-less `<slug>-<key>.oikos.host`) and
+ * whether its site is served at the apex.
+ */
+export declare function hostingNames(org: DeclaredOrg, platformHostnames: readonly string[]): {
+    domain: string | null;
+    locked: Set<string>;
+    slug: string;
+    siteOwnsApex: boolean;
+};

package/dist/plan/locked-hostnames.js

@@ -47,3 +47,16 @@ export function lockedHostnames(org, platformHostnames) {
     }
     return locked;
 }
+/**
+ * What `validateHosting` knows of the org's names: its domain, the names
+ * foundry owns, its slug (for the domain-less `<slug>-<key>.oikos.host`) and
+ * whether its site is served at the apex.
+ */
+export function hostingNames(org, platformHostnames) {
+    return {
+        domain: org.domain,
+        locked: lockedHostnames(org, platformHostnames),
+        slug: org.slug,
+        siteOwnsApex: org.site.enabled && org.site.usesDomain && org.domain !== null,
+    };
+}

package/dist/plan/mcp.d.ts

@@ -0,0 +1,57 @@
+import type { DeclaredOrg } from '../org.js';
+import type { DraftStep, StepAction } from './diff.js';
+import type { ZitadelPort } from './executor.js';
+import type { StepExecutionContext } from './plan-apply.js';
+/**
+ * Auth ADR 0002, "What foundry declares and applies": the ZITADEL side of
+ * `uses.auth.mcp`. Three steps, all absent for an org that declares no `mcp`:
+ *
+ * - `zitadel:mcp-project` (per entry): an empty project in the customers
+ *   organisation. It holds no app; it exists so its id can be the token's
+ *   audience. The id is recorded once, and `entryMcp` (`broker-entries.ts`) is
+ *   the single reader: the broker entry and the app's `MCP_AUDIENCE` both take
+ *   it from there.
+ * - `zitadel:mcp-access` (per entry): the entry's existing sign-in app issues
+ *   JWT access tokens and accepts `https://<login host>/mcp-oauth/callback`.
+ * - `zitadel:access-token-lifetime` (per org): the instance-wide lifetime goes
+ *   from 12 hours to one. No app of ours keeps an access token, so no other
+ *   app is affected (auth ADR 0002, 4). It is set once any org declares `mcp`
+ *   and is not set back.
+ *
+ * Blocked, not failing (`CLAUDE.md` rule 2), while the executor's ZITADEL
+ * client lacks the calls, or an input is neither recorded nor made by a step in
+ * this plan.
+ */
+type Blocked = Array<{
+    description: string;
+    key: string;
+}>;
+/** A ZITADEL call of the MCP steps that has not answered in this long fails the step; the next apply repeats it. */
+export declare const MCP_CALL_TIMEOUT_MS = 60000;
+/** The want of the access step, recorded when it is done. */
+export declare const mcpAccessWant: (org: DeclaredOrg) => string;
+export declare function planMcp(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], zitadelMcp: boolean): {
+    steps: DraftStep[];
+    blocked: Blocked;
+};
+/**
+ * The empty project in the customers organisation that is an entry's MCP token
+ * audience. Found by name first, so a create whose answer was lost is not made
+ * twice. Its id is recorded under {@link entryMcpProjectScopeKey}, the one
+ * source `entryMcp` reads.
+ */
+export declare function applyMcpProject(zitadel: Pick<ZitadelPort, 'findOrCreateProject'>, org: DeclaredOrg, action: StepAction, context: StepExecutionContext): Promise<{
+    resourceId?: string;
+}>;
+/**
+ * The entry's sign-in app issues JWT access tokens and holds the broker's
+ * callback. Records the want last, so a failed call is planned again.
+ */
+export declare function applyMcpAccess(zitadel: Pick<ZitadelPort, 'ensureOidcAppMcpAccess'>, org: DeclaredOrg, action: StepAction, context: StepExecutionContext): Promise<{
+    resourceId?: string;
+}>;
+/** The instance access-token lifetime, set to one hour. */
+export declare function applyAccessTokenLifetime(zitadel: Pick<ZitadelPort, 'ensureAccessTokenLifetime'>, context: StepExecutionContext): Promise<{
+    resourceId?: string;
+}>;
+export {};

package/dist/plan/mcp.js

@@ -0,0 +1,131 @@
+import { ACCESS_TOKEN_LIFETIME_APPLIED_SCOPE_KEY, MCP_ACCESS_TOKEN_LIFETIME_SECONDS, entryMcpAccessAppliedScopeKey, entryMcpProjectScopeKey, mcpCallbackUri, } from './broker-entries.js';
+import { withCallTimeout } from './worker-app.js';
+/** A ZITADEL call of the MCP steps that has not answered in this long fails the step; the next apply repeats it. */
+export const MCP_CALL_TIMEOUT_MS = 60_000;
+/** The want of the access step, recorded when it is done. */
+export const mcpAccessWant = (org) => JSON.stringify({ accessTokenType: 'jwt', redirectUri: mcpCallbackUri(org) });
+export function planMcp(org, recorded, plannedSteps, zitadelMcp) {
+    const steps = [];
+    const blocked = [];
+    const entries = org.hosting.enabled
+        ? org.hosting.entries.filter((e) => Boolean(e.uses?.auth?.mcp))
+        : [];
+    if (entries.length === 0)
+        return { steps, blocked };
+    const planned = (system, kind, key) => plannedSteps.some((p) => p.action.system === system &&
+        p.action.kind === kind &&
+        (key === undefined || p.action.key === key));
+    for (const entry of entries) {
+        const at = `${org.slug}'s ${entry.key} MCP`;
+        const stepKey = `${org.id}:${entry.key}`;
+        if (!zitadelMcp) {
+            blocked.push({
+                description: `${at} is blocked, not planned: the host's ZITADEL client cannot set JWT access tokens or the access-token lifetime`,
+                key: `zitadel:mcp:${stepKey}`,
+            });
+            continue;
+        }
+        if (!recorded[entryMcpProjectScopeKey(entry.key)]) {
+            if (!recorded[`zitadel:customers:${org.id}`] && !planned('zitadel', 'customers')) {
+                blocked.push({
+                    description: `${at} project is blocked, not planned: the customers organisation id is not recorded yet`,
+                    key: `zitadel:mcp-project:${stepKey}`,
+                });
+            }
+            else {
+                steps.push({
+                    action: { system: 'zitadel', kind: 'mcp-project', key: stepKey, desired: {} },
+                    step: {
+                        description: `make the empty project that is ${org.slug}'s ${entry.key} MCP token audience`,
+                        destroys: false,
+                        migrates: false,
+                    },
+                });
+            }
+        }
+        if (recorded[entryMcpAccessAppliedScopeKey(entry.key)] !== mcpAccessWant(org)) {
+            if (!recorded[`zitadel:app:${entry.key}`] && !planned('zitadel', 'app', entry.key)) {
+                blocked.push({
+                    description: `${at} access is blocked, not planned: the sign-in client is not recorded yet`,
+                    key: `zitadel:mcp-access:${stepKey}`,
+                });
+            }
+            else {
+                steps.push({
+                    action: { system: 'zitadel', kind: 'mcp-access', key: stepKey, desired: {} },
+                    step: {
+                        description: `${org.slug}'s ${entry.key} sign-in client issues JWT access tokens and accepts ${mcpCallbackUri(org)}`,
+                        destroys: false,
+                        migrates: false,
+                    },
+                });
+            }
+        }
+    }
+    if (zitadelMcp &&
+        recorded[ACCESS_TOKEN_LIFETIME_APPLIED_SCOPE_KEY] !== String(MCP_ACCESS_TOKEN_LIFETIME_SECONDS)) {
+        steps.push({
+            action: { system: 'zitadel', kind: 'access-token-lifetime', key: org.id, desired: {} },
+            step: {
+                description: `set the sign-in instance's access-token lifetime to ${MCP_ACCESS_TOKEN_LIFETIME_SECONDS / 3600} hour (MCP access tokens are short-lived; no app of ours keeps one)`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}
+// ---- the apply -------------------------------------------------------------
+/**
+ * The empty project in the customers organisation that is an entry's MCP token
+ * audience. Found by name first, so a create whose answer was lost is not made
+ * twice. Its id is recorded under {@link entryMcpProjectScopeKey}, the one
+ * source `entryMcp` reads.
+ */
+export async function applyMcpProject(zitadel, org, action, context) {
+    const entryKey = action.key.slice(org.id.length + 1);
+    const at = `zitadel:mcp-project for ${org.slug} entry '${entryKey}'`;
+    if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.auth?.mcp)) {
+        throw new Error(`${at}: the entry no longer declares uses.auth.mcp`);
+    }
+    const customersOrgId = context.recordedIds()[`zitadel:customers:${org.id}`];
+    if (!customersOrgId)
+        throw new Error(`${at}: the customers organisation is not recorded yet`);
+    const { project } = await withCallTimeout(MCP_CALL_TIMEOUT_MS, `${at}: find or create the project`, () => zitadel.findOrCreateProject(customersOrgId, `${org.slug}-${entryKey}-mcp`));
+    context.recordScopeId(entryMcpProjectScopeKey(entryKey), project.id);
+    return { resourceId: project.id };
+}
+/**
+ * The entry's sign-in app issues JWT access tokens and holds the broker's
+ * callback. Records the want last, so a failed call is planned again.
+ */
+export async function applyMcpAccess(zitadel, org, action, context) {
+    const entryKey = action.key.slice(org.id.length + 1);
+    const at = `zitadel:mcp-access for ${org.slug} entry '${entryKey}'`;
+    const ensure = zitadel.ensureOidcAppMcpAccess?.bind(zitadel);
+    if (!ensure)
+        throw new Error(`${at}: the ZITADEL client cannot set JWT access tokens`);
+    if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.auth?.mcp)) {
+        throw new Error(`${at}: the entry no longer declares uses.auth.mcp`);
+    }
+    const recorded = context.recordedIds();
+    const zitadelOrgId = recorded.zitadel_org;
+    const projectId = recorded.zitadel_project;
+    const appId = recorded[`zitadel:app:${entryKey}`];
+    if (!zitadelOrgId || !projectId || !appId) {
+        throw new Error(`${at}: the sign-in client is not recorded yet`);
+    }
+    await withCallTimeout(MCP_CALL_TIMEOUT_MS, `${at}: update the app`, () => ensure(zitadelOrgId, projectId, appId, { redirectUris: [mcpCallbackUri(org)] }));
+    context.recordScopeId(entryMcpAccessAppliedScopeKey(entryKey), mcpAccessWant(org));
+    return {};
+}
+/** The instance access-token lifetime, set to one hour. */
+export async function applyAccessTokenLifetime(zitadel, context) {
+    const ensure = zitadel.ensureAccessTokenLifetime?.bind(zitadel);
+    if (!ensure) {
+        throw new Error('zitadel:access-token-lifetime: the ZITADEL client cannot set the lifetime');
+    }
+    await withCallTimeout(MCP_CALL_TIMEOUT_MS, 'zitadel:access-token-lifetime: set the lifetime', () => ensure(MCP_ACCESS_TOKEN_LIFETIME_SECONDS));
+    context.recordScopeId(ACCESS_TOKEN_LIFETIME_APPLIED_SCOPE_KEY, String(MCP_ACCESS_TOKEN_LIFETIME_SECONDS));
+    return {};
+}

package/dist/plan/org-names.d.ts

@@ -12,7 +12,7 @@ export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'cha
  * foundry derives for an org: its own-service names when it owns services,
  * and its hosting-entry and database names.
  */
-export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
     name: string;
     source: OrgNameSource;
 }[];
@@ -26,5 +26,5 @@ export interface NameClash {
     source: OrgNameSource;
 }
 /** Every name `org` derives that another org or the platform also derives. */
-export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
 export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -1,5 +1,7 @@
 import { ownsServices } from '../org.js';
+import { entryHasDatabase } from '../worker-app-config.js';
 import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
+import { workerAppHostname } from './hostnames.js';
 import { orgTarget, platformTarget } from './own-services.js';
 import { appNameFor } from './platform-diff.js';
 /**
@@ -38,7 +40,17 @@ export function orgDerivedNames(org) {
     for (const entry of org.hosting.entries) {
         names.push({ name: appNameFor(org, entry), source: 'hosting' });
     }
-    if (org.hosting.entries.some((entry) => entry.database)) {
+    // A Worker app's public host. The domain-less `<slug>-<key>.oikos.host` of
+    // org `foo` key `x` is the `<slug>.oikos.host` of org `foo-x`, so hosts are
+    // compared across orgs like every other derived name.
+    if (org.hosting.enabled) {
+        for (const entry of org.hosting.entries) {
+            if (entry.workerApp) {
+                names.push({ name: workerAppHostname(org, entry), source: 'hosting' });
+            }
+        }
+    }
+    if (org.hosting.entries.some(entryHasDatabase)) {
         names.push({ name: `${org.slug}-db`, source: 'hosting' });
     }
     return names;
@@ -93,6 +105,9 @@ export function findNameClashes(org, others) {
         if (other.slug === org.slug)
             continue;
         const theirs = new Set(orgDerivedNames(other).map((n) => n.name));
+        // Org `foo-x` without a domain is served at `foo-x.oikos.host`.
+        if (!other.domain)
+            theirs.add(`${other.slug}.oikos.host`);
         for (const { name, source } of mine) {
             if (theirs.has(name))
                 clashes.push({ name, other: other.slug, source });

package/dist/plan/plan-apply.d.ts

@@ -2,18 +2,21 @@ import type { DestroyProgress, PlanApply } from '../apply.js';
 import type { DeclaredOrg, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
+import type { ReleaseStore } from '../release/state.js';
 import type { JobRunner } from '../runner/types.js';
 import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
 import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js';
 import { type AgoraHostPort } from './agora.js';
 import { type MoveGatePorts } from './backup-gate.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
     readonly id: string;
@@ -205,6 +208,21 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
+    customersDirectoryAvailable?(): boolean;
+    /** C3: whether the host supplied `mintBouleArchonCredential`. */
+    bouleArchonCredentialAvailable?(): boolean;
+    /** Every Coolify server with whether it is usable and reachable; blue/green plans copies on each. Optional: an executor without it plans no blue/green. */
+    blueGreenServers?(): Promise<Array<{
+        uuid: string;
+        usable: boolean;
+        reachable: boolean;
+    }>>;
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`); `null` while its blue
+     * copy is not recorded. Optional: an executor without it runs no release.
+     */
+    releaseHost?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
     /** Whether the executor's held keys can store the sign-in database's CA and certificate (#746). Absent: true. */
     ownSigninDbKeysPuttable?(): boolean;
     /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). Absent: true. */
@@ -325,6 +343,16 @@ export interface PlatformStepExecutor {
      * one), or `null` when nothing changed.
      */
     refreshFilesShare?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<Record<string, string> | null>;
+    /**
+     * The Coolify servers and the reason platform-archon's blue/green cannot run (the executor cannot hold the
+     * health token), for the plan. Optional: an executor without it plans no blue/green for archon.
+     */
+    archonBlueGreen?(): Promise<{
+        servers?: BlueGreenServer[];
+        blocked?: string;
+    }>;
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`); `null` while its app is not recorded. */
+    releaseHost?(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -453,6 +481,12 @@ export interface FoundryPlanApplyOptions {
      * token of its existing sign-in apps.
      */
     zitadelIdTokenUserinfo?: boolean;
+    /**
+     * Auth ADR 0002: true when the host's ZITADEL client has `ensureOidcAppMcpAccess`
+     * and `ensureAccessTokenLifetime` (`@wtfalch/providers` 0.11.0). Without it every
+     * `uses.auth.mcp` is reported blocked.
+     */
+    zitadelMcp?: boolean;
     /**
      * F5: true when the host's executor was built with a `broker` port.
      * Optional, and false without it: each entry's broker entry is then
@@ -465,6 +499,17 @@ export interface FoundryPlanApplyOptions {
      * reported blocked instead of planned.
      */
     edgeWorkers?: boolean;
+    /**
+     * ADR 0002: true when the host's executor was built with a `WorkerAppPort`.
+     * Optional, and false without it: each `workerApp` entry is then reported blocked.
+     */
+    workerApps?: boolean;
+    /** ADR 0002: the keys custody Worker address, when the executor has a `KeysCustodyPort`. A `keysCustody` secret is blocked without it. */
+    workerAppKeysUrl?: string;
+    /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
+    workerAppDatabase?: boolean;
+    /** ADR 0002: the platform's Cloudflare account id. A container image outside its registry is blocked. */
+    workerAppRegistryAccountId?: string;
     /**
      * True when the host's executor was built with `ownerInviteMail`. Optional,
      * and false without it: each owner's invite is then reported blocked
@@ -510,6 +555,11 @@ export interface FoundryPlanApplyOptions {
         step(action: StepAction): boolean;
         blocked(key: string): boolean;
     };
+    /**
+     * The release requests (Archon's promote, roll back, clear held and decide-at-cap clicks), consumed once each by
+     * the release runner. Without it no release runs, in an apply or in {@link FoundryPlanApply.runReleaseTick}.
+     */
+    releaseStore?: ReleaseStore;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -590,8 +640,13 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly loginHostBindings;
     private readonly loginHostDiscovery;
     private readonly zitadelIdTokenUserinfo;
+    private readonly zitadelMcp;
     private readonly broker;
     private readonly edgeWorkers;
+    private readonly workerApps;
+    private readonly workerAppKeysUrl;
+    private readonly workerAppDatabase;
+    private readonly workerAppRegistryAccountId;
     private readonly ownerInviteMail;
     private readonly hostFiles;
     private readonly hostAi;
@@ -605,6 +660,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly backupGate;
     private readonly platformDeps;
     private readonly runner;
+    private readonly releaseStore;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     /**
@@ -741,6 +797,27 @@ export declare class FoundryPlanApply implements PlanApply {
     private refusePlatform;
     private refuseDestroy;
     private runSteps;
+    /**
+     * ADR 0001: one release run for each blue/green entry whose structure is applied, writing into `context`
+     * (the live ids of the run that holds the lease). A weight the runner changed reaches every server's balancer
+     * before this returns.
+     */
+    private runOrgReleases;
+    /** One release run for platform-archon, on the platform's live ids; see {@link runOrgReleases}. */
+    private runPlatformReleases;
+    private runPlatformReleaseTick;
+    /**
+     * The recurring release run (ADR 0001): for every declared org with a blue/green entry, and the platform's
+     * archon when it declares one, takes the open requests, reads the health signal and moves traffic. Foundry has
+     * no scheduler of its own, so the host calls this every 10 minutes. An org that cannot run (the actor may not
+     * apply it, an apply holds its lease, a provider call fails) is reported by id and does not stop the others.
+     * A refusal is audited; a run that does nothing writes no audit row.
+     */
+    runReleaseTick(): Promise<Array<{
+        target: string;
+        error?: string;
+    }>>;
+    private runOrgReleaseTick;
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     private readSfuPortsOpen;
     private computeFreshPlan;