@wtfalch/foundry 0.43.0 → 0.44.1

package/dist/plan/mcp.js

@@ -0,0 +1,131 @@
+import { ACCESS_TOKEN_LIFETIME_APPLIED_SCOPE_KEY, MCP_ACCESS_TOKEN_LIFETIME_SECONDS, entryMcpAccessAppliedScopeKey, entryMcpProjectScopeKey, mcpCallbackUri, } from './broker-entries.js';
+import { withCallTimeout } from './worker-app.js';
+/** A ZITADEL call of the MCP steps that has not answered in this long fails the step; the next apply repeats it. */
+export const MCP_CALL_TIMEOUT_MS = 60_000;
+/** The want of the access step, recorded when it is done. */
+export const mcpAccessWant = (org) => JSON.stringify({ accessTokenType: 'jwt', redirectUri: mcpCallbackUri(org) });
+export function planMcp(org, recorded, plannedSteps, zitadelMcp) {
+    const steps = [];
+    const blocked = [];
+    const entries = org.hosting.enabled
+        ? org.hosting.entries.filter((e) => Boolean(e.uses?.auth?.mcp))
+        : [];
+    if (entries.length === 0)
+        return { steps, blocked };
+    const planned = (system, kind, key) => plannedSteps.some((p) => p.action.system === system &&
+        p.action.kind === kind &&
+        (key === undefined || p.action.key === key));
+    for (const entry of entries) {
+        const at = `${org.slug}'s ${entry.key} MCP`;
+        const stepKey = `${org.id}:${entry.key}`;
+        if (!zitadelMcp) {
+            blocked.push({
+                description: `${at} is blocked, not planned: the host's ZITADEL client cannot set JWT access tokens or the access-token lifetime`,
+                key: `zitadel:mcp:${stepKey}`,
+            });
+            continue;
+        }
+        if (!recorded[entryMcpProjectScopeKey(entry.key)]) {
+            if (!recorded[`zitadel:customers:${org.id}`] && !planned('zitadel', 'customers')) {
+                blocked.push({
+                    description: `${at} project is blocked, not planned: the customers organisation id is not recorded yet`,
+                    key: `zitadel:mcp-project:${stepKey}`,
+                });
+            }
+            else {
+                steps.push({
+                    action: { system: 'zitadel', kind: 'mcp-project', key: stepKey, desired: {} },
+                    step: {
+                        description: `make the empty project that is ${org.slug}'s ${entry.key} MCP token audience`,
+                        destroys: false,
+                        migrates: false,
+                    },
+                });
+            }
+        }
+        if (recorded[entryMcpAccessAppliedScopeKey(entry.key)] !== mcpAccessWant(org)) {
+            if (!recorded[`zitadel:app:${entry.key}`] && !planned('zitadel', 'app', entry.key)) {
+                blocked.push({
+                    description: `${at} access is blocked, not planned: the sign-in client is not recorded yet`,
+                    key: `zitadel:mcp-access:${stepKey}`,
+                });
+            }
+            else {
+                steps.push({
+                    action: { system: 'zitadel', kind: 'mcp-access', key: stepKey, desired: {} },
+                    step: {
+                        description: `${org.slug}'s ${entry.key} sign-in client issues JWT access tokens and accepts ${mcpCallbackUri(org)}`,
+                        destroys: false,
+                        migrates: false,
+                    },
+                });
+            }
+        }
+    }
+    if (zitadelMcp &&
+        recorded[ACCESS_TOKEN_LIFETIME_APPLIED_SCOPE_KEY] !== String(MCP_ACCESS_TOKEN_LIFETIME_SECONDS)) {
+        steps.push({
+            action: { system: 'zitadel', kind: 'access-token-lifetime', key: org.id, desired: {} },
+            step: {
+                description: `set the sign-in instance's access-token lifetime to ${MCP_ACCESS_TOKEN_LIFETIME_SECONDS / 3600} hour (MCP access tokens are short-lived; no app of ours keeps one)`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}
+// ---- the apply -------------------------------------------------------------
+/**
+ * The empty project in the customers organisation that is an entry's MCP token
+ * audience. Found by name first, so a create whose answer was lost is not made
+ * twice. Its id is recorded under {@link entryMcpProjectScopeKey}, the one
+ * source `entryMcp` reads.
+ */
+export async function applyMcpProject(zitadel, org, action, context) {
+    const entryKey = action.key.slice(org.id.length + 1);
+    const at = `zitadel:mcp-project for ${org.slug} entry '${entryKey}'`;
+    if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.auth?.mcp)) {
+        throw new Error(`${at}: the entry no longer declares uses.auth.mcp`);
+    }
+    const customersOrgId = context.recordedIds()[`zitadel:customers:${org.id}`];
+    if (!customersOrgId)
+        throw new Error(`${at}: the customers organisation is not recorded yet`);
+    const { project } = await withCallTimeout(MCP_CALL_TIMEOUT_MS, `${at}: find or create the project`, () => zitadel.findOrCreateProject(customersOrgId, `${org.slug}-${entryKey}-mcp`));
+    context.recordScopeId(entryMcpProjectScopeKey(entryKey), project.id);
+    return { resourceId: project.id };
+}
+/**
+ * The entry's sign-in app issues JWT access tokens and holds the broker's
+ * callback. Records the want last, so a failed call is planned again.
+ */
+export async function applyMcpAccess(zitadel, org, action, context) {
+    const entryKey = action.key.slice(org.id.length + 1);
+    const at = `zitadel:mcp-access for ${org.slug} entry '${entryKey}'`;
+    const ensure = zitadel.ensureOidcAppMcpAccess?.bind(zitadel);
+    if (!ensure)
+        throw new Error(`${at}: the ZITADEL client cannot set JWT access tokens`);
+    if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.auth?.mcp)) {
+        throw new Error(`${at}: the entry no longer declares uses.auth.mcp`);
+    }
+    const recorded = context.recordedIds();
+    const zitadelOrgId = recorded.zitadel_org;
+    const projectId = recorded.zitadel_project;
+    const appId = recorded[`zitadel:app:${entryKey}`];
+    if (!zitadelOrgId || !projectId || !appId) {
+        throw new Error(`${at}: the sign-in client is not recorded yet`);
+    }
+    await withCallTimeout(MCP_CALL_TIMEOUT_MS, `${at}: update the app`, () => ensure(zitadelOrgId, projectId, appId, { redirectUris: [mcpCallbackUri(org)] }));
+    context.recordScopeId(entryMcpAccessAppliedScopeKey(entryKey), mcpAccessWant(org));
+    return {};
+}
+/** The instance access-token lifetime, set to one hour. */
+export async function applyAccessTokenLifetime(zitadel, context) {
+    const ensure = zitadel.ensureAccessTokenLifetime?.bind(zitadel);
+    if (!ensure) {
+        throw new Error('zitadel:access-token-lifetime: the ZITADEL client cannot set the lifetime');
+    }
+    await withCallTimeout(MCP_CALL_TIMEOUT_MS, 'zitadel:access-token-lifetime: set the lifetime', () => ensure(MCP_ACCESS_TOKEN_LIFETIME_SECONDS));
+    context.recordScopeId(ACCESS_TOKEN_LIFETIME_APPLIED_SCOPE_KEY, String(MCP_ACCESS_TOKEN_LIFETIME_SECONDS));
+    return {};
+}

package/dist/plan/org-names.d.ts

@@ -12,7 +12,7 @@ export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'cha
  * foundry derives for an org: its own-service names when it owns services,
  * and its hosting-entry and database names.
  */
-export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
     name: string;
     source: OrgNameSource;
 }[];
@@ -26,5 +26,5 @@ export interface NameClash {
     source: OrgNameSource;
 }
 /** Every name `org` derives that another org or the platform also derives. */
-export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
 export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -1,5 +1,7 @@
 import { ownsServices } from '../org.js';
+import { entryHasDatabase } from '../worker-app-config.js';
 import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
+import { workerAppHostname } from './hostnames.js';
 import { orgTarget, platformTarget } from './own-services.js';
 import { appNameFor } from './platform-diff.js';
 /**
@@ -38,7 +40,17 @@ export function orgDerivedNames(org) {
     for (const entry of org.hosting.entries) {
         names.push({ name: appNameFor(org, entry), source: 'hosting' });
     }
-    if (org.hosting.entries.some((entry) => entry.database)) {
+    // A Worker app's public host. The domain-less `<slug>-<key>.oikos.host` of
+    // org `foo` key `x` is the `<slug>.oikos.host` of org `foo-x`, so hosts are
+    // compared across orgs like every other derived name.
+    if (org.hosting.enabled) {
+        for (const entry of org.hosting.entries) {
+            if (entry.workerApp) {
+                names.push({ name: workerAppHostname(org, entry), source: 'hosting' });
+            }
+        }
+    }
+    if (org.hosting.entries.some(entryHasDatabase)) {
         names.push({ name: `${org.slug}-db`, source: 'hosting' });
     }
     return names;
@@ -93,6 +105,9 @@ export function findNameClashes(org, others) {
         if (other.slug === org.slug)
             continue;
         const theirs = new Set(orgDerivedNames(other).map((n) => n.name));
+        // Org `foo-x` without a domain is served at `foo-x.oikos.host`.
+        if (!other.domain)
+            theirs.add(`${other.slug}.oikos.host`);
         for (const { name, source } of mine) {
             if (theirs.has(name))
                 clashes.push({ name, other: other.slug, source });

package/dist/plan/plan-apply.d.ts

@@ -208,6 +208,10 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
+    customersDirectoryAvailable?(): boolean;
+    /** C3: whether the host supplied `mintBouleArchonCredential`. */
+    bouleArchonCredentialAvailable?(): boolean;
     /** Every Coolify server with whether it is usable and reachable; blue/green plans copies on each. Optional: an executor without it plans no blue/green. */
     blueGreenServers?(): Promise<Array<{
         uuid: string;
@@ -477,6 +481,12 @@ export interface FoundryPlanApplyOptions {
      * token of its existing sign-in apps.
      */
     zitadelIdTokenUserinfo?: boolean;
+    /**
+     * Auth ADR 0002: true when the host's ZITADEL client has `ensureOidcAppMcpAccess`
+     * and `ensureAccessTokenLifetime` (`@wtfalch/providers` 0.11.0). Without it every
+     * `uses.auth.mcp` is reported blocked.
+     */
+    zitadelMcp?: boolean;
     /**
      * F5: true when the host's executor was built with a `broker` port.
      * Optional, and false without it: each entry's broker entry is then
@@ -489,6 +499,17 @@ export interface FoundryPlanApplyOptions {
      * reported blocked instead of planned.
      */
     edgeWorkers?: boolean;
+    /**
+     * ADR 0002: true when the host's executor was built with a `WorkerAppPort`.
+     * Optional, and false without it: each `workerApp` entry is then reported blocked.
+     */
+    workerApps?: boolean;
+    /** ADR 0002: the keys custody Worker address, when the executor has a `KeysCustodyPort`. A `keysCustody` secret is blocked without it. */
+    workerAppKeysUrl?: string;
+    /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
+    workerAppDatabase?: boolean;
+    /** ADR 0002: the platform's Cloudflare account id. A container image outside its registry is blocked. */
+    workerAppRegistryAccountId?: string;
     /**
      * True when the host's executor was built with `ownerInviteMail`. Optional,
      * and false without it: each owner's invite is then reported blocked
@@ -619,8 +640,13 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly loginHostBindings;
     private readonly loginHostDiscovery;
     private readonly zitadelIdTokenUserinfo;
+    private readonly zitadelMcp;
     private readonly broker;
     private readonly edgeWorkers;
+    private readonly workerApps;
+    private readonly workerAppKeysUrl;
+    private readonly workerAppDatabase;
+    private readonly workerAppRegistryAccountId;
     private readonly ownerInviteMail;
     private readonly hostFiles;
     private readonly hostAi;

package/dist/plan/plan-apply.js

@@ -16,7 +16,7 @@ import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
-import { lockedHostnames } from './locked-hostnames.js';
+import { hostingNames } from './locked-hostnames.js';
 import { agoraIssuerHostFor, loginHostServesAgora, readLoginHostDiscovery, } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_MAX, OWN_MAIL_SMTP_PORT_SCOPE_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, isOwnMailSmtpPort, mailRelayFingerprint, } from './mail-relay.js';
 import { findNameClashes, nameClashMessage } from './org-names.js';
@@ -28,6 +28,7 @@ import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { runSubjectRelease } from './release-host.js';
 import { remoteDatabaseFactsFrom } from './remote-database.js';
+import { liveWorkerApps, workerAppTraceScopeKeys } from './worker-app.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
@@ -134,6 +135,8 @@ const HOSTNAME_STEPS = new Set([
     // #318 (F8): the route is itself hostname-shaped, validated against the
     // org's own domain by `validateEntryWorker`.
     'cloudflare:worker',
+    // ADR 0002: its host is hostname-shaped and validated by `validateEntryWorkerApp`.
+    'cloudflare:worker-app',
 ]);
 /**
  * The #19 implementation of {@link PlanApply}: computes a plan against live
@@ -158,8 +161,13 @@ export class FoundryPlanApply {
     loginHostBindings;
     loginHostDiscovery;
     zitadelIdTokenUserinfo;
+    zitadelMcp;
     broker;
     edgeWorkers;
+    workerApps;
+    workerAppKeysUrl;
+    workerAppDatabase;
+    workerAppRegistryAccountId;
     ownerInviteMail;
     hostFiles;
     hostAi;
@@ -187,8 +195,13 @@ export class FoundryPlanApply {
         this.loginHostBindings = options.loginHostBindings ?? false;
         this.loginHostDiscovery = options.loginHostDiscovery;
         this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
+        this.zitadelMcp = options.zitadelMcp ?? false;
         this.broker = options.broker ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
+        this.workerApps = options.workerApps ?? false;
+        this.workerAppKeysUrl = options.workerAppKeysUrl;
+        this.workerAppDatabase = options.workerAppDatabase ?? false;
+        this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
         this.ownerInviteMail = options.ownerInviteMail ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
@@ -697,6 +710,12 @@ export class FoundryPlanApply {
                                 delete serviceIds[scopeKey];
                             }
                         }
+                        if (target.system === 'cloudflare' && target.kind === 'worker-app') {
+                            const entryKey = target.key.slice(id.length + 1);
+                            for (const scopeKey of workerAppTraceScopeKeys(entryKey)) {
+                                delete serviceIds[scopeKey];
+                            }
+                        }
                         steps[current] = {
                             step: descriptions[current],
                             status: 'finished',
@@ -1200,10 +1219,15 @@ export class FoundryPlanApply {
             loginHostBindings: this.loginHostBindings,
             loginHostServesDiscovery,
             zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
+            zitadelMcp: this.zitadelMcp,
             broker: ownsServices(org) && this.hostOwnServices && this.executor.ownBrokerPort
                 ? await this.executor.ownBrokerPort(org, recorded)
                 : this.broker,
             edgeWorkers: this.edgeWorkers,
+            workerApps: this.workerApps,
+            workerAppKeysUrl: this.workerAppKeysUrl,
+            workerAppDatabase: this.workerAppDatabase,
+            workerAppRegistryAccountId: this.workerAppRegistryAccountId,
             ownerInviteMail: this.ownerInviteMail,
             otherSlugs,
             now: () => this.now().getTime(),
@@ -1214,6 +1238,8 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            customersDirectory: this.executor.customersDirectoryAvailable?.() ?? false,
+            bouleArchonCredential: this.executor.bouleArchonCredentialAvailable?.() ?? false,
             ...(blueGreenServers ? { blueGreenServers } : {}),
             ...(blueGreenServers && org.hosting.entries.some((e) => e.blueGreen && e.database)
                 ? {
@@ -1309,10 +1335,7 @@ export class FoundryPlanApply {
      * which only the plan can read.
      */
     async invalidHosting(org) {
-        return validateHosting(org.hosting, {
-            domain: org.domain,
-            locked: lockedHostnames(org, await this.platformServiceHostnames()),
-        });
+        return validateHosting(org.hosting, hostingNames(org, await this.platformServiceHostnames()));
     }
     async platformServiceHostnames() {
         const platform = await this.platformDeps?.store.get();
@@ -1781,6 +1804,8 @@ function destroyTargets(serviceIds, orgId) {
         'cloudflare:gate:',
         // #318: an entry's Worker and its route.
         'cloudflare:worker:',
+        // ADR 0002: a Worker app's route, record, containers, keys and script.
+        'cloudflare:worker-app:',
         'coolify:database:',
         'coolify:app:',
         // An own files host's storage key: the token id is the step's recorded resource id.
@@ -1811,6 +1836,17 @@ function destroyTargets(serviceIds, orgId) {
             }
             continue;
         }
+        if (prefix === 'cloudflare:worker-app:') {
+            for (const [entryKey, scriptName] of liveWorkerApps(orgId, serviceIds)) {
+                targets.push({
+                    system: 'cloudflare',
+                    kind: 'worker-app',
+                    key: `${orgId}:${entryKey}`,
+                    id: scriptName,
+                });
+            }
+            continue;
+        }
         // Blue/green: the colors, balancers, stage, database sidecars and extra connectors, by recorded id, before
         // the main database they connect to. Their keys carry no ':' (scope ids), so no prefix above finds them.
         if (prefix === 'coolify:database:')
@@ -1983,6 +2019,9 @@ const STEP_FIELDS = {
     'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
     'zitadel:id-token-userinfo': 'hosting.entries.uses.auth',
+    'zitadel:mcp-project': 'hosting.entries.uses.auth.mcp',
+    'zitadel:mcp-access': 'hosting.entries.uses.auth.mcp',
+    'zitadel:access-token-lifetime': 'hosting.entries.uses.auth.mcp',
     'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
@@ -2010,6 +2049,7 @@ const STEP_FIELDS = {
     'cloudflare:gate': 'hosting.entries.gates',
     'cloudflare:ratelimit': 'hosting.usesDomain',
     'cloudflare:worker': 'hosting.entries.worker',
+    'cloudflare:worker-app': 'hosting.entries.workerApp',
 };
 function stepField(action) {
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.

package/dist/plan/platform-providers.d.ts

@@ -995,7 +995,7 @@ export interface PlatformArchonRuntime {
 export declare const PLATFORM_ARCHON_ACCESS_APP_NAME = "foundry:platform:archon";
 /**
  * Archon paths a machine calls and Archon authenticates itself (its `proxy.ts`:
- * `PUBLIC_EXACT` and `ORG_CHANGES_PATH_RE`). Each gets its own Access app with
+ * `PUBLIC_ROUTES` and the org route pattern in `src/lib/public-routes.ts`). Each gets its own Access app with
  * one bypass policy, because the hostname app would otherwise ask a machine for
  * an emailed code. `/api/uptime/targets` and `/api/uptime/results` are left out
  * on purpose: they pass the hostname app through the uptime service-token

package/dist/plan/platform-providers.js

@@ -3722,7 +3722,7 @@ const PLATFORM_ARCHON_TUNNEL_SCOPE_KEY = 'cloudflare_platform_archon_tunnel';
 const PLATFORM_ARCHON_ACCESS_SCOPE_KEY = 'cloudflare_platform_archon_access_app';
 /**
  * Archon paths a machine calls and Archon authenticates itself (its `proxy.ts`:
- * `PUBLIC_EXACT` and `ORG_CHANGES_PATH_RE`). Each gets its own Access app with
+ * `PUBLIC_ROUTES` and the org route pattern in `src/lib/public-routes.ts`). Each gets its own Access app with
  * one bypass policy, because the hostname app would otherwise ask a machine for
  * an emailed code. `/api/uptime/targets` and `/api/uptime/results` are left out
  * on purpose: they pass the hostname app through the uptime service-token
@@ -3736,6 +3736,7 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'usage-tick', path: '/api/usage/tick' },
     { name: 'reporting-collect', path: '/api/reporting/collect' },
     { name: 'org-changes', path: '/api/orgs/*/changes' },
+    { name: 'org-settings', path: '/api/orgs/*/settings' },
 ];
 const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
 const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;

package/dist/plan/proxy-labels.js

@@ -63,6 +63,8 @@ export function entryRoutes(org, recorded = {}) {
     const routes = [];
     let wildcard;
     for (const entry of org.hosting.entries) {
+        if (entry.workerApp)
+            continue; // Served by its Worker route, not the tunnel.
         // A blue/green entry is reached through its balancer, which each server's connector finds on its own
         // network, once the balancer exists on the primary. Until then it keeps the origin it had.
         const target = !entry.blueGreen

package/dist/plan/worker-app-database.d.ts

@@ -0,0 +1,148 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+import type { AccessPort } from './edge-access.js';
+import type { DnsPort } from './edge-dns.js';
+import type { TunnelPort } from './edge-tunnels.js';
+import type { ZonePort } from './edge-zones.js';
+import type { StepExecutionContext } from './plan-apply.js';
+/**
+ * C2 (campaign 2026-10-15): a Worker app with `workerApp.database` reaches the org's Coolify
+ * Postgres through a Hyperdrive config. The database host is Docker-internal, so Hyperdrive
+ * connects over the org's Cloudflare tunnel (a `tcp://<db container>:5432` rule on an internal
+ * hostname) behind an Access service token, the route `plan/remote-database.ts` already uses
+ * between servers.
+ *
+ * Order on apply, inside the `cloudflare:worker-app` step and before the upload, so a failure at
+ * any point leaves a state the next apply repairs and the Worker is never deployed against a
+ * database it cannot use:
+ * Access app and service token -> tunnel rule and DNS -> `<db>_rt` password -> release
+ * `migrations.json` (its sha256 checked against `database.migrationsSha256`) applied with the owner credentials -> runtime role (UPDATE, DELETE and
+ * TRUNCATE revoked on `appendOnly`) -> Hyperdrive config with the runtime credentials.
+ * A failed migration throws, so the Worker is not uploaded.
+ */
+/** Everything needed to open a connection to the org's database over the tunnel. */
+export interface HyperdriveOrigin {
+    /** The tunnel hostname that fronts the database (Access protected). */
+    host: string;
+    database: string;
+    user: string;
+    password: string;
+    accessClientId: string;
+    accessClientSecret: string;
+}
+/** One migration of a release's `migrations.json`. */
+export interface DatabaseMigration {
+    id: string;
+    sql: string;
+}
+/**
+ * The calls a Worker app database needs beyond Cloudflare's Access, tunnel and DNS. Edge's
+ * Hyperdrive SDK (`client.platform.hyperdrive`) and the SQL runner behind the tunnel
+ * (`@wtfalch/db`'s migrate and `ensureRuntimeRole`) are the host's to implement; foundry only
+ * calls this port. Every method is idempotent.
+ */
+export interface WorkerAppDatabasePort {
+    /** Creates or updates the Hyperdrive config `name`; returns its id. */
+    upsertHyperdrive(input: {
+        name: string;
+        origin: HyperdriveOrigin;
+    }): Promise<{
+        id: string;
+    }>;
+    /** A no-op when the config is gone. */
+    deleteHyperdrive(name: string): Promise<void>;
+    /** The text of a release asset of a wtfalch repo, or `null` when the release has no such asset. */
+    fetchReleaseAsset(url: string): Promise<string | null>;
+    /** The migration ids the database's ledger holds, in the order applied. */
+    appliedMigrationIds(owner: HyperdriveOrigin): Promise<string[]>;
+    /** Runs `migration.sql` and records `migration.id` in the ledger in one transaction. */
+    applyMigration(owner: HyperdriveOrigin, migration: DatabaseMigration): Promise<void>;
+    /**
+     * Creates or updates the `runtime.user` role with `runtime.password`, grants it DML on the
+     * tables and revokes UPDATE, DELETE and TRUNCATE from it on each `appendOnly` table.
+     */
+    ensureRuntimeRole(input: {
+        owner: HyperdriveOrigin;
+        runtime: {
+            user: string;
+            password: string;
+        };
+        appendOnly: string[];
+    }): Promise<void>;
+}
+export declare const WORKER_APP_MIGRATION_TIMEOUT_MS = 300000;
+export declare const MIGRATIONS_ASSET_NAME = "migrations.json";
+/** The Hyperdrive config, `{name, id}` as JSON. No secret. */
+export declare const workerAppHyperdriveScopeKey: (entryKey: string) => string;
+/** The migration ids applied, a JSON list, for the plan and the operator. The database's ledger is the fact. */
+export declare const workerAppMigrationsScopeKey: (entryKey: string) => string;
+/** The applied route marker (`{hostname, database}`). */
+export declare const workerAppDbRouteMarkerScopeKey: (entryKey: string) => string;
+/** The Hyperdrive config name of an entry: the Worker's script name plus `-db`. */
+export declare const hyperdriveName: (scriptName: string) => string;
+/** The tunnel hostname of an entry's database route: `<8 hex of org id>-<key>-hd.<zone>`. */
+export declare const hyperdriveHostname: (org: DeclaredOrg, entryKey: string, zone: string) => string;
+/**
+ * Reads a release's `migrations.json`. `null` text is an absent file: no migrations. A file that is
+ * not a list of `{id, sql}` with unique ids is refused, naming no SQL.
+ */
+export declare function parseMigrations(text: string | null): DatabaseMigration[];
+/**
+ * A present `migrations.json` runs as the database owner, so its bytes must be the ones the
+ * declaration pinned. No file needs no digest; a file with no declared digest, or a different
+ * one, is refused before it is parsed. The message names neither the SQL nor the wanted digest.
+ */
+export declare function verifyMigrationsDigest(text: string | null, declared: string | undefined): void;
+/** The URL of `migrations.json` beside the module: the same release, another file. */
+export declare const migrationsUrl: (artifactUrl: string) => string;
+/**
+ * The migrations the database does not hold, in order. The applied ledger must be the first
+ * migrations of the file: a missing or reordered one is refused (migrations are append-only).
+ */
+export declare function unappliedDatabaseMigrations(all: readonly DatabaseMigration[], applied: readonly string[]): DatabaseMigration[];
+export interface WorkerAppDatabaseDeps {
+    port: WorkerAppDatabasePort;
+    tunnels: Pick<TunnelPort, 'putTunnelConfig'>;
+    access: Pick<AccessPort, 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'findServiceTokenByName' | 'createServiceToken' | 'deleteAccessApp' | 'removeServiceToken'>;
+    dns: Pick<DnsPort, 'findDnsRecord' | 'createDnsRecord' | 'deleteDnsRecord'>;
+    zones: Pick<ZonePort, 'findZoneByApex'>;
+    /** The owner connection string of the org's database, as Coolify reports it. Registered for redaction by the host. */
+    ownerUrl(databaseId: string): Promise<string>;
+    /** Registers a value for redaction before it is written anywhere. */
+    secret(value: string): void;
+    heldKeys?: {
+        resolve(ref: string): Promise<string | null | undefined>;
+        put?(ref: string, value: string): Promise<void>;
+    };
+    /** Test hook: the timeout of a call, in ms. */
+    timeoutMs?: number;
+    /** Test hook: the timeout of one migration, in ms. */
+    migrationTimeoutMs?: number;
+}
+type Call = <T>(label: string, task: () => Promise<T>, ms?: number) => Promise<T>;
+/**
+ * Makes the database true and returns the Hyperdrive config id for the `HYPERDRIVE` binding.
+ * Secrets (the owner and runtime passwords, the Access service token) go only to the port and the
+ * held-key store, never into an error, a recorded id or a return value. Each outside call is
+ * bounded by a timeout; the error names the call, never the cause.
+ */
+export declare function applyWorkerAppDatabase(deps: WorkerAppDatabaseDeps, org: DeclaredOrg, entry: HostingEntry, scriptName: string, want: {
+    artifactUrl: string;
+    database: {
+        appendOnly: string[];
+        migrationsSha256?: string;
+    };
+}, context: StepExecutionContext, zoneApex: string): Promise<{
+    hyperdriveId: string;
+}>;
+/** Deletes the entry's Hyperdrive config, found by the recorded name, and clears the record. */
+export declare function deleteWorkerAppHyperdrive(port: Pick<WorkerAppDatabasePort, 'deleteHyperdrive'> | undefined, entryKey: string, recorded: Readonly<Record<string, string>>, context: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null, call: Call): Promise<void>;
+/**
+ * Removes the Cloudflare state the database route made, in the order that never leaves a name
+ * pointing at nothing: the DNS record, the tunnel rule (the tunnel config is rewritten without
+ * it), the Access app, the service token (also one minted and never delivered), then the held
+ * token and runtime password and the recorded ids. Each step tolerates "already gone", and the
+ * ids are cleared last, so a failed run is repeated by the next one. With `context` null (org
+ * destroy) the ids are not cleared: destroy drops them with the org.
+ */
+export declare function deleteWorkerAppDatabaseRoute(database: WorkerAppDatabaseDeps | undefined, heldKeys: Pick<NonNullable<WorkerAppDatabaseDeps['heldKeys']>, 'put'> | undefined, orgId: string, entryKey: string, recorded: Readonly<Record<string, string>>, context: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null, call: Call): Promise<void>;
+export {};