@wtfalch/foundry 0.43.0 → 0.44.1

package/dist/plan/diff.js

@@ -1,8 +1,9 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, } from '../org.js';
+import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { planBlueGreen } from './blue-green.js';
-import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, desiredBouleEnv, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
 import { planCompanyBackups } from './company-backups.js';
@@ -16,6 +17,7 @@ import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
+import { planMcp } from './mcp.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
 import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, OWN_SIGNIN_DB_MOVE_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, planSigninDbMove, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
@@ -28,6 +30,7 @@ import { planRemoteDatabase } from './remote-database.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_IMAGE_TAG_SUFFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_LOGIN_INTERNAL_NAME, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, inAppSignIn, inAppStatePairs, inAppTargets, } from './sign-in.js';
 import { withStepSystem } from './step-system.js';
+import { brokerKeyDelivered, planWorkerApps } from './worker-app.js';
 import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export function toPlan(detail) {
@@ -408,6 +411,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         if (guarded)
             plannedSteps.push(guarded);
     }
+    // Auth ADR 0002: the MCP project and the JWT app, after the app they change
+    // and before the broker entry and the Worker that read the project id.
+    const mcp = planMcp(org, recordedIds, plannedSteps, options.zitadelMcp ?? false);
+    plannedSteps.push(...mcp.steps);
     // The Access gate before the database, app, tunnel and zone (#84): on a
     // first apply the hostname is gated before anything answers on it.
     // An Access gate that cannot be planned must not leave the hostname it
@@ -534,7 +541,11 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleGuarded = guardApp(bouleClient);
     if (bouleGuarded)
         plannedSteps.push(bouleGuarded);
-    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null, platformReadiness);
+    const bouleCredentials = planBouleCredentials(org, recordedIds, {
+        archon: options.bouleArchonCredential === true,
+        directory: options.customersDirectory === true,
+    }, platformReadiness.canHoldSecrets === true, (options.now ?? Date.now)());
+    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null, platformReadiness, bouleCredentials.wants);
     if (boule.step)
         plannedSteps.push(boule.step);
     // After the apps and Boule -- an edge key needs its app recorded or planned,
@@ -592,6 +603,60 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
             plannedSteps.push(step);
         }
     }
+    // ADR 0002: Worker apps, after the Workers for the same reason: a route, record
+    // or script name that is not ours throws at apply and `runSteps` stops there.
+    const workerApps = planWorkerApps(org, recordedIds, {
+        available: options.workerApps ?? false,
+        ...(options.workerAppKeysUrl !== undefined ? { keysUrl: options.workerAppKeysUrl } : {}),
+        ...(options.workerAppRegistryAccountId !== undefined
+            ? { registryAccountId: options.workerAppRegistryAccountId }
+            : {}),
+        canHoldSecrets: platformReadiness.canHoldSecrets === true,
+        issuer: authIssuer,
+        ...(options.workerAppDatabase
+            ? {
+                database: {
+                    databaseReady: Boolean(recordedIds[`coolify:database:${org.id}`]) ||
+                        plannedSteps.some((s) => s.action.system === 'coolify' && s.action.kind === 'database'),
+                    tunnelReady: Boolean(recordedIds[`cloudflare:tunnel:${org.id}`]) ||
+                        plannedSteps.some((s) => s.action.system === 'cloudflare' && s.action.kind === 'tunnel'),
+                    accessReady: edgeNeeded(platformReadiness, ['access', 'tunnels', 'dns', 'zones']) === null,
+                },
+            }
+            : {}),
+    });
+    for (const step of workerApps.steps) {
+        const stepEntry = step.action.key.slice(org.id.length + 1);
+        const ownZone = org.hosting.usesDomain && Boolean(org.domain);
+        const apply = step.action.desired.mode === 'apply';
+        // Retire never looks a zone up; a deploy needs the org's zone, or the shared oikos.host zone.
+        const hasDatabase = Boolean(org.hosting.entries.find((e) => e.key === stepEntry)?.workerApp?.database);
+        const reason = !apply
+            ? null
+            : hasDatabase
+                ? edgeNeeded(platformReadiness, ['zones', 'dns', 'access', 'tunnels'])
+                : ownZone
+                    ? edgeNeeded(platformReadiness, ['zones', 'dns'])
+                    : edgeNeeded(platformReadiness, ['zones']);
+        if (reason) {
+            dnsBlocked.push(edgeBlockedItem(org, `${stepEntry} Worker app`, step.action.key, reason));
+        }
+        else if (apply && ownZone && zoneWaiting) {
+            zoneBlocked.push({
+                description: `${org.slug}'s ${stepEntry} Worker app is blocked, not planned: the zone for ${org.domain} is not active yet`,
+                key: step.action.key,
+            });
+        }
+        else if (apply && !ownZone && !(options.oikosZoneReady ?? false)) {
+            zoneBlocked.push({
+                description: `${org.slug}'s ${stepEntry} Worker app is blocked, not planned: the shared oikos.host zone is not ready yet`,
+                key: step.action.key,
+            });
+        }
+        else {
+            plannedSteps.push(step);
+        }
+    }
     // Last: a repair that fails must not stop any step after it (`runSteps` stops at the first failure).
     const idTokenUserinfo = planIdTokenUserinfo(org, live, recordedIds, plannedSteps, platformReadiness.authReady, options.zitadelIdTokenUserinfo ?? false);
     if (idTokenUserinfo)
@@ -626,6 +691,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         unmanaged.push({ description: agora.issuerNote, key: 'coolify:agora' });
     if (boule.blocked)
         unmanaged.push({ description: boule.blocked, key: 'coolify:boule' });
+    for (const description of bouleCredentials.blocked) {
+        unmanaged.push({ description, key: 'coolify:boule:credentials' });
+    }
     if (boule.mailBlocked) {
         unmanaged.push({ description: boule.mailBlocked, key: 'coolify:boule:mail' });
     }
@@ -637,6 +705,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...filesKeys.blocked);
     unmanaged.push(...entryAiKeys.blocked);
     unmanaged.push(...edgeWorkers.blocked);
+    unmanaged.push(...workerApps.blocked);
+    unmanaged.push(...mcp.blocked);
     unmanaged.push(...entryEdgeKeys.blocked);
     unmanaged.push(...edgeReservedLabels.blocked);
     if (ownAuth.blocked)
@@ -1302,7 +1372,7 @@ function orgServiceSchemaEnabled(org, schema) {
     if (schema.schema.startsWith('calls_'))
         return org.calls.enabled;
     if (schema.schema === 'app')
-        return org.hosting.entries.some((entry) => entry.database);
+        return org.hosting.entries.some(entryHasDatabase);
     return true;
 }
 /**
@@ -2595,6 +2665,45 @@ function planBouleClient(org, byKey, claimed) {
         },
     };
 }
+/**
+ * C3: which credentials the org's Boule is given, and why one is not. Archon's credential goes to every
+ * Boule the host can mint it for; the customers directory credential only while `customers.enabled`. Each
+ * needs a held-key store that can put. A credential minted and never held (platform rule 1) is never minted
+ * again: it is reported blocked.
+ */
+function planBouleCredentials(org, recordedIds, host, canHoldSecrets, nowMs) {
+    const blocked = [];
+    const at = `${org.slug}'s Boule`;
+    let archonCredential = false;
+    if (host.archon) {
+        if (!canHoldSecrets) {
+            blocked.push(`${at} Archon credential is blocked, not planned: it needs a held-key store that can put, and the host has none`);
+        }
+        else {
+            archonCredential = true;
+        }
+    }
+    let customersDirectory = false;
+    if (org.customers?.enabled) {
+        if (!host.directory) {
+            blocked.push(`${at} customers directory credential is blocked, not planned: the host supplies no ZitadelPort.mintOrgDirectoryReader`);
+        }
+        else if (!canHoldSecrets) {
+            blocked.push(`${at} customers directory credential is blocked, not planned: it needs a held-key store that can put, and the host has none`);
+        }
+        else {
+            customersDirectory = true;
+        }
+    }
+    return {
+        wants: {
+            archonCredential,
+            customersDirectory,
+            archonRenewDue: archonCredential && archonCredentialRenewDue(recordedIds, nowMs),
+        },
+        blocked,
+    };
+}
 /**
  * #161 (Boule part): the org's own Boule, a per-org singleton keyed by the org
  * id under its own `boule` kind, a separate Coolify application from the org's
@@ -2608,7 +2717,7 @@ function planBouleClient(org, byKey, claimed) {
  * address (the one Agora signs in at); without it the Boule is blocked, not
  * planned, so every other step still applies.
  */
-function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonUrl, readiness) {
+function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonUrl, readiness, credentials) {
     const key = resourceKey('coolify', 'boule', org.id);
     const live = byKey.get(key);
     if (live)
@@ -2678,6 +2787,8 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
             mailBlocked: mailBlocked !== null,
             // Only the platform's own org's Boule gets the peer password for Archon.
             platformOwner,
+            archonCredential: credentials.archonCredential === true,
+            customersDirectory: credentials.customersDirectory === true,
         },
     };
     if (!live) {
@@ -2691,8 +2802,22 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         };
     }
     const liveEnv = (live.config.env ?? {});
-    const { env } = desiredBouleEnv(org, recordedIds, issuer, archonUrl, mailOn);
+    const { env } = desiredBouleEnv(org, recordedIds, issuer, archonUrl, mailOn, credentials);
     const drift = bouleEnvDrift(env, liveEnv);
+    // Secrets are compared by presence only. A switched-off customers org takes its env away.
+    if (credentials.archonCredential &&
+        (!liveEnv[BOULE_ARCHON_CREDENTIAL_ENV] || credentials.archonRenewDue)) {
+        drift.push(BOULE_ARCHON_CREDENTIAL_ENV);
+    }
+    if (credentials.customersDirectory &&
+        customersOrgIdOf(org, recordedIds) &&
+        !liveEnv[BOULE_CUSTOMERS_CREDENTIAL_ENV]) {
+        drift.push(BOULE_CUSTOMERS_CREDENTIAL_ENV);
+    }
+    for (const key of staleCustomersEnv(org, liveEnv)) {
+        if (!drift.includes(key))
+            drift.push(key);
+    }
     // The token is compared, never planned with its value.
     if (mailOn &&
         bouleMailTokenDrift(liveEnv[BOULE_MAIL_TOKEN_ENV], live.config.appMailToken)) {
@@ -3183,6 +3308,9 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
             if (!resource || (typeof status === 'string' && /^(exited|stopped)/.test(status)))
                 continue;
         }
+        // A Worker app has no Coolify app: `planWorkerApps` plans it.
+        if (org.hosting.entries.some((e) => e.key === key && e.workerApp))
+            continue;
         const app = planApp(org, key, byKey, claimed, recordedIds, plannedSteps, authIssuer, readiness);
         // The executor pushes the issuer the plan read, the way Agora gets its host values.
         // The same availability the plan's marker used: the executor records its
@@ -3322,7 +3450,7 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
  * {@link planApp}.
  */
 function planDatabase(org, byKey, claimed) {
-    return planHostingToggle('coolify', 'database', org.hosting.entries.some((entry) => entry.database), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
+    return planHostingToggle('coolify', 'database', org.hosting.entries.some(entryHasDatabase), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
 }
 function sortedNames(names) {
     return names.filter(Boolean).sort().join(',');
@@ -3635,6 +3763,15 @@ function planBrokerEntries(org, recordedIds, plannedSteps, brokerWired) {
             });
             continue;
         }
+        // A Worker app has no Coolify app to hold the broker key: its generated AUTH_APP_KEY
+        // is delivered to the Worker first and read back from the held-key store.
+        if (entry.workerApp && !brokerKeyDelivered(recordedIds, entry.key)) {
+            blocked.push({
+                description: `${at} is blocked, not planned: the Worker app's AUTH_APP_KEY is not delivered yet`,
+                key,
+            });
+            continue;
+        }
         const wanted = wantedBrokerEntry(org, entry, recordedIds);
         if ('want' in wanted) {
             if (recordedIds[brokerEntryAppliedScopeKey(entry.key)] === JSON.stringify(wanted.want)) {
@@ -3743,23 +3880,44 @@ function planBouleBrokerEntry(org, recordedIds, plannedSteps, brokerWired) {
  * listed as unmanaged.
  */
 function planCustomers(org, live, claimed, recordedIds) {
-    if (!org.hosting.entries.some((entry) => entry.uses?.auth?.users === 'customers'))
-        return null;
+    const signUp = org.customers?.signUp === true;
+    const wanted = org.customers?.enabled === true ||
+        org.hosting.entries.some((entry) => entry.uses?.auth?.users === 'customers');
     const customersOrgId = recordedIds[resourceKey('zitadel', 'customers', org.id)];
-    if (customersOrgId) {
-        for (const r of live) {
-            if (r.system === 'zitadel' &&
-                r.kind === 'project_grant' &&
-                r.config.grantedOrgId === customersOrgId) {
-                claimed.add(resourceKey(r.system, r.kind, r.key));
-            }
+    if (!customersOrgId) {
+        if (!wanted)
+            return null;
+        return {
+            action: { system: 'zitadel', kind: 'customers', key: org.id, desired: { signUp } },
+            step: {
+                description: `provision a ZITADEL org for ${org.slug}'s customers, with self-registration ${signUp ? 'on' : 'off'}`,
+                destroys: false,
+                migrates: false,
+            },
+        };
+    }
+    for (const r of live) {
+        if (r.system === 'zitadel' &&
+            r.kind === 'project_grant' &&
+            r.config.grantedOrgId === customersOrgId) {
+            claimed.add(resourceKey(r.system, r.kind, r.key));
         }
-        return null;
     }
+    // Before the sign-up switch existed foundry forced self-registration on, so a customers org with no
+    // marker is on. Switching customers off closes it: the declaration says no one signs themselves up.
+    const applied = recordedIds[CUSTOMERS_SIGN_UP_SCOPE_KEY] || '1';
+    const wantedSignUp = wanted && signUp ? '1' : '0';
+    if (applied === wantedSignUp)
+        return null;
     return {
-        action: { system: 'zitadel', kind: 'customers', key: org.id, desired: {} },
+        action: {
+            system: 'zitadel',
+            kind: 'customers',
+            key: org.id,
+            desired: { signUp: wantedSignUp === '1' },
+        },
         step: {
-            description: `provision a self-registration ZITADEL org for ${org.slug}'s customers`,
+            description: `turn self-registration ${wantedSignUp === '1' ? 'on' : 'off'} for ${org.slug}'s customers`,
             destroys: false,
             migrates: false,
         },

package/dist/plan/executor.d.ts

@@ -1,6 +1,6 @@
 import type { OrgMailOptions, OrgMailOrg, OrgMailResult } from '@wtfalch/email/postmaster';
 import { type CallsSfuUrls } from '../calls-sfu.js';
-import type { DeclaredOrg, HostingBuildPack } from '../org.js';
+import type { DeclaredOrg, HostingBuildPack, OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type BrokerPort } from './broker-entries.js';
@@ -18,6 +18,8 @@ import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor }
 import type { EdgePortName } from './platform-org.js';
 import type { RequestHeaderPort } from './platform-providers.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
+import type { WorkerAppDatabasePort } from './worker-app-database.js';
+import { type KeysCustodyPort, type WorkerAppPort } from './worker-app.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
 /**
  * The Coolify calls this executor makes, shaped to match
@@ -835,6 +837,8 @@ export interface ZitadelPort {
         appType: 'web' | 'native';
         redirectUris: string[];
         postLogoutRedirectUris: string[];
+        /** `jwt` for an entry with `uses.auth.mcp` (providers 0.11.0). Omitted: opaque. */
+        accessTokenType?: 'jwt' | 'opaque';
     }): Promise<{
         appId: string;
         clientId: string;
@@ -1120,6 +1124,25 @@ export interface ZitadelPort {
      * reports no longer live is never attempted at all.
      */
     listLoginClientPats(orgId: string, userId: string): Promise<string[]>;
+    /**
+     * C3: mints a read-only directory credential for one ZITADEL organisation (the company's
+     * customers): a machine user with only the read-only organisation role, and a fresh PAT.
+     * Idempotent on the user by `userName`; every PAT the user already holds is revoked before the
+     * new one is minted, so a rerun leaves exactly one live token (like
+     * {@link mintLoginClientMachineUser}). The caller holds the token and writes it to Boule's env;
+     * it never reaches an error, a log or a recorded id. Optional: a host without it gets the
+     * customers directory reported blocked. `zitadel-machine-user.ts` is the real implementation.
+     */
+    mintOrgDirectoryReader?(orgId: string, input: {
+        userName: string;
+        name: string;
+    }): Promise<{
+        userId: string;
+        token: string;
+        patId: string;
+    }>;
+    /** C3: revokes every PAT of the directory reader, so a company that turns customers off leaves no live credential. A PAT already gone is not an error. */
+    revokeOrgDirectoryReader?(orgId: string, userId: string): Promise<void>;
     /**
      * #267: adds the org's own company login host to the ZITADEL instance's
      * trusted domains (`@wtfalch/providers`' `ZitadelClient.ensureTrustedDomain`)
@@ -1177,6 +1200,21 @@ export interface ZitadelPort {
      * `createOidcApp` and `createOidcAppWithSecret` send it on themselves.
      */
     updateOidcAppIdTokenUserinfoAssertion?(orgId: string, projectId: string, appId: string): Promise<boolean>;
+    /**
+     * Auth ADR 0002: an existing sign-in app issues JWT access tokens and holds
+     * every `redirectUris` entry (`@wtfalch/providers` 0.11.0). Resolves `true`
+     * when it wrote, `false` when nothing differed. Optional, with
+     * {@link ZitadelPort.ensureAccessTokenLifetime}: a host whose client lacks
+     * either gets every `uses.auth.mcp` reported blocked
+     * (`FoundryPlanApplyOptions.zitadelMcp`).
+     */
+    ensureOidcAppMcpAccess?(orgId: string, projectId: string, appId: string, want: {
+        redirectUris: string[];
+    }): Promise<boolean>;
+    /** The instance-wide access-token lifetime, in seconds. Resolves `{ changed }`. */
+    ensureAccessTokenLifetime?(seconds: number): Promise<{
+        changed: boolean;
+    }>;
 }
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
@@ -1540,6 +1578,11 @@ export interface PlatformOrgPortSource {
     /** The platform's shared sign-in host, or `null` when none is declared. */
     authHostname?(): Promise<string | null>;
 }
+/**
+ * C3: mints the Archon credential for one org's Boule and returns the secret. Every call rotates the
+ * org's credential (the old secret stays valid one more hour) or issues the first.
+ */
+export type BouleArchonCredentialMinter = (orgId: OrgId) => Promise<string>;
 export interface FoundryStepExecutorPorts {
     coolify: CoolifyPort;
     /**
@@ -1666,6 +1709,29 @@ export interface FoundryStepExecutorPorts {
      * sets `FoundryPlanApplyOptions.edgeWorkers`).
      */
     workers?: WorkersPort;
+    /**
+     * ADR 0002: deploys and routes an entry's `workerApp` -- see
+     * {@link WorkerAppPort}. Optional the same way `workers` is: without it the
+     * plan reports each Worker app blocked (the host also sets
+     * `FoundryPlanApplyOptions.workerApps`).
+     */
+    workerApps?: WorkerAppPort;
+    /** ADR 0002: the keys custody Worker, for a `keysCustody` secret of a Worker app. */
+    workerAppKeys?: KeysCustodyPort;
+    /**
+     * C3: mints the credential an org's Boule reaches Archon with (org-scoped; `orgs:request` and
+     * `orgs:read` for that org). Archon implements it. Every call rotates the credential (the old secret
+     * stays valid one more hour) and credentials expire after 365 days, so foundry calls it only when none
+     * was pushed or the recorded push time is 335 days old. It reaches Boule's env as `ARCHON_CREDENTIAL` and nowhere else. Without it the host
+     * writes no Archon credential and the plan says so.
+     */
+    mintBouleArchonCredential?: BouleArchonCredentialMinter;
+    /**
+     * C2: the Hyperdrive config, the release's `migrations.json` and the SQL runner behind the tunnel,
+     * for a Worker app with `workerApp.database`. Without it the plan reports that entry blocked
+     * (the host also sets `FoundryPlanApplyOptions.workerAppDatabase`).
+     */
+    workerAppDatabase?: WorkerAppDatabasePort;
     /**
      * Hands a just-minted, one-time secret (today: an API app's
      * `clientSecret`) to the host, immediately after the provider returns it
@@ -1847,6 +1913,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private executeScoped;
     /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
     ownMailKeyMintable(): boolean;
+    /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
+    customersDirectoryAvailable(): boolean;
+    /** C3: whether the host supplied `mintBouleArchonCredential`. */
+    bouleArchonCredentialAvailable(): boolean;
     /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
     ownSigninDbKeysPuttable(): boolean;
     /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). */
@@ -1948,6 +2018,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * "Declared changes apply" nothing is marked done until the
      * live state actually matches it.
      */
+    private workerAppDeps;
     private cloudflareWorker;
     /**
      * Makes the no-Worker routes recorded for an entry match `patterns`: deletes
@@ -2007,6 +2078,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * nothing: the next apply finds the account by username and mints a new code.
      */
     private zitadelOwner;
+    /** `plan/mcp.ts`: the entry's MCP audience project. */
+    private zitadelMcpProject;
+    /** `plan/mcp.ts`: JWT access tokens and the broker's callback on the entry's app. */
+    private zitadelMcpAccess;
+    /** `plan/mcp.ts`: the instance access-token lifetime. */
+    private zitadelAccessTokenLifetime;
     /**
      * Switches on "user info inside the ID token" for each live sign-in app
      * the planner named. An app's marker (its ZITADEL app id) is recorded and
@@ -2100,7 +2177,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
-     * self-registration on and a grant to the org's app project. Staff stay in
+     * self-registration as `customers.signUp` says (off by default) and a grant to the org's app project. Staff stay in
      * the org's own invite-only ZITADEL org. The space keeps the name apart from
      * every issuer org, which is named by a slug and a slug has no spaces. Every call here is idempotent, so
      * a re-run after a crash finishes the job.
@@ -2923,6 +3000,27 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * shape {@link coolifyAgora}'s own doc comment explains.
      */
     private coolifyBoule;
+    /**
+     * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
+     * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is
+     * written again unchanged. The secret is held first; the caller records `pushedAt` only after the env write
+     * succeeded, so a failed hold or a failed push is mended by the next apply minting again. Errors name no secret.
+     */
+    private ensureBouleArchonCredential;
+    /**
+     * C3: the read-only credential for the company's customers organisation. Held first. Minting revokes every
+     * earlier token of the machine user, so a hold that failed is repaired by the next apply minting again and
+     * leaves one live token. `null` while the customers organisation is not recorded yet.
+     */
+    private ensureCustomersDirectoryCredential;
+    /** `put`, tried up to {@link BOULE_CREDENTIAL_ATTEMPTS} times; true once one attempt succeeds. The cause is dropped. */
+    private holdWithRetry;
+    /**
+     * C3: customers switched off. Revokes the directory credential's tokens first, then removes the customers
+     * env from Boule, then forgets the held value and the user id. Each step is repeated safely, so a run that
+     * died halfway is finished by the next. Returns true when Boule's env changed.
+     */
+    private dropCustomersCredential;
     /**
      * Gives Boule `LETTERMINT_API_TOKEN`: the platform's held key for an org on
      * the platform's own apex, else the org's `<slug>-app` token through the