@wtfalch/foundry 0.60.0 → 0.62.0

package/dist/plan/own-diff.js

@@ -8,6 +8,7 @@ import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-hos
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
 import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
 import { ownHostnames } from './own-hostnames.js';
+import { JOBS_PUBLIC_URL_SCOPE_KEY, OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY } from './own-jobs-route.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
 import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
@@ -67,6 +68,58 @@ export function planOwnJobs(options) {
         },
     };
 }
+/** `unmanaged` key of the one line `planOwnJobsRoute` reports. */
+export const OWN_JOBS_ROUTE_BLOCKED_KEY = 'own-jobs-route';
+/**
+ * The public route of an own org's jobs scheduler: `jobs.<domain>`, serving only what an app calls. The
+ * owner company always publishes its scheduler, since every company on shared services registers there; any
+ * other own org publishes its own only while an entry declares `uses.jobs`. Planned again when the hostname
+ * moved. Every blocked line is fixed text: it is part of the stale-plan comparison.
+ */
+export function planOwnJobsRoute(options) {
+    const { org, recordedIds, readiness, ownServices } = options;
+    if (!ownsServices(org))
+        return { step: null, blocked: null };
+    const owner = readiness.platformOwnerOrgId === org.id;
+    if (!owner && !org.hosting.entries.some((e) => e.uses?.jobs)) {
+        return { step: null, blocked: null };
+    }
+    const hostname = ownHostnames(org).jobs;
+    const schedulerApplied = Boolean(recordedIds[`coolify:own-jobs:${org.id}`]) &&
+        Boolean(recordedIds[JOBS_INTERNAL_URL_SCOPE_KEY]);
+    if (!schedulerApplied && !options.schedulerPlanned)
+        return { step: null, blocked: null };
+    if (recordedIds[JOBS_PUBLIC_URL_SCOPE_KEY] === `https://${hostname}` &&
+        recordedIds[OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY]) {
+        return { step: null, blocked: null };
+    }
+    const waiting = (reason) => ({
+        step: null,
+        blocked: `${org.slug}'s own jobs scheduler route is blocked, not planned: ${reason}`,
+    });
+    if (!ownServices)
+        return waiting('the host supplies no ownServices port');
+    if (!options.zoneActive)
+        return waiting(`the zone for ${ownHostnames(org).zone} is not active yet`);
+    const ownEdge = readiness.ownEdgePorts;
+    if (readiness.dnsBlocked && !(ownEdge?.dns && ownEdge.tunnels)) {
+        return waiting(readiness.dnsBlocked);
+    }
+    if (!ownEdge?.tunnels && !readiness.edgeReady) {
+        return waiting('the host supplies no tunnel port and edge is not ready');
+    }
+    return {
+        blocked: null,
+        step: {
+            action: { system: 'coolify', kind: 'own-jobs-route', key: org.id, desired: { hostname } },
+            step: {
+                description: `publish ${org.slug}'s own jobs scheduler at ${hostname}: its tunnel and connector and a proxied CNAME`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
 const BROKER_ENTRY_APPLIED_PREFIX = brokerEntryAppliedScopeKey('');
 /** `unmanaged` key of the one line `planOwnAuth` reports. */
 export const OWN_AUTH_BLOCKED_KEY = 'own-auth';

package/dist/plan/own-hostnames.d.ts

@@ -13,6 +13,8 @@ export interface OwnHostnames {
     files: string;
     /** `sfu.<domain>`, or `<slug>-sfu.oikos.host`. */
     sfu: string;
+    /** `jobs.<domain>`, or `<slug>-jobs.oikos.host`. */
+    jobs: string;
     /** `https://<auth>`. */
     issuerUrl: string;
     /** The mail domain: `<domain>`, or `<slug>.oikos.host` (names are `name@<slug>.oikos.host`). */

package/dist/plan/own-hostnames.js

@@ -18,6 +18,7 @@ export function ownHostnames(org) {
         mail: mailOnDomain ? `mail.${domain}` : `${slug}-mail.${NO_DOMAIN_ZONE}`,
         files: name('files'),
         sfu: name('sfu'),
+        jobs: name('jobs'),
         issuerUrl: `https://${auth}`,
         mailDomain: mailOnDomain && domain ? domain : `${slug}.${NO_DOMAIN_ZONE}`,
     };

package/dist/plan/own-jobs-route.d.ts

@@ -0,0 +1,47 @@
+import type { CoolifyPort } from './executor.js';
+import type { ServiceNetwork, ServiceTarget, StepScope } from './own-services.js';
+/**
+ * A company's jobs scheduler on a public hostname: a tunnel that dials the scheduler by its internal address,
+ * a connector app, and a proxied CNAME for `jobs.<domain>`. An entry runs on its own company's network and
+ * cannot dial the scheduler's container name, so `uses.jobs` gives it `https://<hostname>` once this is
+ * recorded. The owner company (hq) runs the scheduler every shared-services company registers on; a company
+ * that runs its own services publishes its own the same way. No Coolify domain and no Access app: the
+ * scheduler authenticates every caller itself (a project's sync key, the admin token), and a gate in front
+ * would stop the apps.
+ *
+ * One `coolify:own-jobs-route` step. It records {@link JOBS_PUBLIC_URL_SCOPE_KEY} last, so a run that fails
+ * halfway is planned again, finds the tunnel and connector by name, and no entry is given a dead URL.
+ */
+export declare const JOBS_PUBLIC_URL_SCOPE_KEY = "jobs_public_url";
+export declare const OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY = "cloudflare_own_jobs_tunnel";
+export declare const OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY = "coolify_own_jobs_connector_app";
+/**
+ * The only paths the public route serves: what a project's app calls (`/sync`, `/timers`, `/timers/<name>`,
+ * `/deliveries`). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
+ */
+export declare const JOBS_ENTRY_PATH_PATTERN = "^/(sync$|timers(/|$)|deliveries$)";
+export declare const JOBS_ROUTE_CALL_TIMEOUT_MS = 60000;
+/** The tunnel's name and the connector app's, one pair per company. */
+export declare const jobsRouteNames: (target: Pick<ServiceTarget, "id">) => {
+    tunnel: string;
+    connector: string;
+};
+export interface JobsRoutePorts {
+    coolify: Pick<CoolifyPort, 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy'>;
+    network: ServiceNetwork;
+    /** One outside call's limit in milliseconds; the connector step gets five times it. */
+    callTimeoutMs?: number;
+}
+/**
+ * Makes the route in this order: tunnel, its ingress, the connector app, the CNAME, then the recorded URL.
+ * Each is found by name or content first, so a second run makes nothing twice. A failure leaves what was made
+ * (found again on the next run) and no recorded URL. Errors carry the call's label only.
+ */
+export declare function provisionJobsRoute(scope: StepScope, ports: JobsRoutePorts, target: ServiceTarget, input: {
+    hostname: string;
+    apex: string;
+    internalUrl: string;
+    projectUuid: string;
+}): Promise<{
+    resourceId: string;
+}>;

package/dist/plan/own-jobs-route.js

@@ -0,0 +1,91 @@
+import { withTimeout } from './call-timeout.js';
+import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { recordOwnDnsHostname } from './own-dns.js';
+/**
+ * A company's jobs scheduler on a public hostname: a tunnel that dials the scheduler by its internal address,
+ * a connector app, and a proxied CNAME for `jobs.<domain>`. An entry runs on its own company's network and
+ * cannot dial the scheduler's container name, so `uses.jobs` gives it `https://<hostname>` once this is
+ * recorded. The owner company (hq) runs the scheduler every shared-services company registers on; a company
+ * that runs its own services publishes its own the same way. No Coolify domain and no Access app: the
+ * scheduler authenticates every caller itself (a project's sync key, the admin token), and a gate in front
+ * would stop the apps.
+ *
+ * One `coolify:own-jobs-route` step. It records {@link JOBS_PUBLIC_URL_SCOPE_KEY} last, so a run that fails
+ * halfway is planned again, finds the tunnel and connector by name, and no entry is given a dead URL.
+ */
+export const JOBS_PUBLIC_URL_SCOPE_KEY = 'jobs_public_url';
+export const OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY = 'cloudflare_own_jobs_tunnel';
+export const OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY = 'coolify_own_jobs_connector_app';
+/**
+ * The only paths the public route serves: what a project's app calls (`/sync`, `/timers`, `/timers/<name>`,
+ * `/deliveries`). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
+ */
+export const JOBS_ENTRY_PATH_PATTERN = '^/(sync$|timers(/|$)|deliveries$)';
+export const JOBS_ROUTE_CALL_TIMEOUT_MS = 60_000;
+/** The tunnel's name and the connector app's, one pair per company. */
+export const jobsRouteNames = (target) => ({
+    tunnel: `${target.id}-jobs-tunnel`,
+    connector: `${target.id}-jobs-cloudflared`,
+});
+/**
+ * Makes the route in this order: tunnel, its ingress, the connector app, the CNAME, then the recorded URL.
+ * Each is found by name or content first, so a second run makes nothing twice. A failure leaves what was made
+ * (found again on the next run) and no recorded URL. Errors carry the call's label only.
+ */
+export async function provisionJobsRoute(scope, ports, target, input) {
+    const ms = ports.callTimeoutMs ?? JOBS_ROUTE_CALL_TIMEOUT_MS;
+    const at = `own step coolify:own-jobs-route for ${target.id}`;
+    const names = jobsRouteNames(target);
+    const record = async (key, id) => {
+        scope.recordScopeId(key, id);
+        await scope.persist();
+    };
+    const zoneId = await withTimeout(`${at}: zone lookup`, ms, () => ports.network.zoneId(input.apex));
+    if (!zoneId)
+        throw new Error(`${at}: no Cloudflare zone for ${input.apex}`);
+    const tunnels = await ports.network.tunnels();
+    const dns = await ports.network.dns();
+    const { environment } = await withTimeout(`${at}: environment`, ms, () => ports.coolify.findOrCreateEnvironment(input.projectUuid, 'production'));
+    const tunnel = (await withTimeout(`${at}: tunnel lookup`, ms, () => tunnels.findTunnelByName(names.tunnel))) ??
+        (await withTimeout(`${at}: tunnel create`, ms, () => tunnels.createTunnel(names.tunnel)));
+    await record(OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY, tunnel.id);
+    await withTimeout(`${at}: tunnel ingress`, ms, () => tunnels.putTunnelConfig(tunnel.id, {
+        ingress: [
+            { hostname: input.hostname, path: JOBS_ENTRY_PATH_PATTERN, service: input.internalUrl },
+            { service: 'http_status:404' },
+        ],
+    }));
+    await withTimeout(`${at}: connector app`, ms * 5, () => ensureCloudflaredConnector({
+        coolify: ports.coolify,
+        tunnels,
+        tunnelId: tunnel.id,
+        appName: names.connector,
+        projectUuid: input.projectUuid,
+        environment,
+        resolveServer: async () => {
+            const servers = await ports.coolify.listServers();
+            const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
+            if (!server)
+                throw new Error('no usable Coolify server is registered');
+            return server;
+        },
+        recordedConnectorAppId: scope.recordedIds()[OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (appId) => record(OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY, appId),
+    }));
+    const wanted = {
+        type: 'CNAME',
+        name: input.hostname,
+        content: `${tunnel.id}.cfargotunnel.com`,
+        proxied: true,
+    };
+    const [live] = await withTimeout(`${at}: dns lookup`, ms, () => dns.findDnsRecord(input.apex, input.hostname, 'CNAME'));
+    if (!live) {
+        await withTimeout(`${at}: dns create`, ms, () => dns.createDnsRecord(input.apex, wanted));
+    }
+    else if (live.content !== wanted.content) {
+        await withTimeout(`${at}: dns update`, ms, () => dns.updateDnsRecord(input.apex, live.id, wanted));
+    }
+    await recordOwnDnsHostname(scope, input.hostname);
+    await record(JOBS_PUBLIC_URL_SCOPE_KEY, `https://${input.hostname}`);
+    return { resourceId: tunnel.id };
+}

package/dist/plan/own-limits.d.ts

@@ -107,6 +107,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly kosmos: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly companyOther: {
         memory: string;
         dbMemory: string;

package/dist/plan/own-limits.js

@@ -29,6 +29,7 @@ export const LIMITS = {
     calls: profile('1g', '512m'),
     agora: profile('1g', '512m'),
     boule: profile('512m'),
+    kosmos: profile('512m'),
     companyOther: profile('1g', '512m'),
     platformArchon: profile('1g'),
     platformAi: profile('1g'),

package/dist/plan/own-services.d.ts

@@ -27,6 +27,8 @@ export interface ServiceTarget {
         authZitadel: string;
         authLogin: string;
         authBroker: string;
+        /** The Coolify Postgres database of the broker's customer workspaces. */
+        workspacesDb: string;
         authTunnel: string;
         authCloudflared: string;
         mailApp: string;
@@ -61,6 +63,8 @@ export interface ServiceTarget {
         instanceBearer: string;
         authAdmin: string;
         brokerMailKey: string;
+        /** The connection string of the database for the broker's customer workspaces: foundry holds it after making the database, or the operator holds one first. */
+        brokerWorkspacesDatabase: string;
         mailAdminKey: string;
         filesManagement: string;
         filesIntrospection: string;

package/dist/plan/own-services.js

@@ -16,6 +16,7 @@ export function platformTarget() {
             authZitadel: 'platform-auth-zitadel',
             authLogin: 'platform-auth-login',
             authBroker: 'platform-auth-broker',
+            workspacesDb: 'platform-workspaces-db',
             authTunnel: 'platform-auth-tunnel',
             authCloudflared: 'platform-auth-cloudflared',
             mailApp: 'platform-mail-stalwart',
@@ -47,6 +48,7 @@ export function platformTarget() {
             instanceBearer: 'zitadel:platform:instanceBearer',
             authAdmin: 'zitadel:platform:admin',
             brokerMailKey: 'lettermint:platform:apiToken',
+            brokerWorkspacesDatabase: 'auth:platform:workspacesDatabaseUrl',
             mailAdminKey: 'stalwart:platform:admin',
             filesManagement: 'files:platform:managementKey',
             filesIntrospection: 'zitadel:platform:files:introspection',
@@ -71,6 +73,7 @@ export function orgTarget(org) {
             authZitadel: `${s}-auth-zitadel`,
             authLogin: `${s}-auth-login`,
             authBroker: `${s}-auth-broker`,
+            workspacesDb: `${s}-workspaces-db`,
             authTunnel: `${s}-auth-tunnel`,
             authCloudflared: `${s}-auth-cloudflared`,
             mailApp: `${s}-mail-stalwart`,
@@ -102,6 +105,7 @@ export function orgTarget(org) {
             instanceBearer: `zitadel:org:${s}:instanceBearer`,
             authAdmin: `zitadel:org:${s}:admin`,
             brokerMailKey: `lettermint:org:${s}:apiToken`,
+            brokerWorkspacesDatabase: `auth:org:${s}:workspacesDatabaseUrl`,
             mailAdminKey: `stalwart:org:${s}:admin`,
             filesManagement: `files:org:${s}:managementKey`,
             filesIntrospection: `zitadel:org:${s}:files:introspection`,

package/dist/plan/plan-apply.d.ts

@@ -1,4 +1,6 @@
 import type { DestroyProgress, PlanApply } from '../apply.js';
+import type { SealResult } from '../audit/seal.js';
+import { type AuditSealingOptions } from '../audit/tick.js';
 import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
@@ -12,6 +14,7 @@ import { type MoveGatePorts } from './backup-gate.js';
 import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
+import type { GithubDeployKeysPort } from './github-deploy-keys.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
@@ -249,6 +252,14 @@ export interface StepExecutor {
      * without it leaves the option as the answer.
      */
     ownBrokerPort?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /**
+     * Whether the host can make the broker's workspaces database: it can hold the URL and the broker and the held keys
+     * were just read and have none. Read only for an org whose entry declares workspaces and only while
+     * {@link brokerHasWorkspacesDatabase} is false. Optional: without it the plan only reports the entry blocked.
+     */
+    canProvisionWorkspacesDatabase?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /** Whether the broker this org's entries are written to has `WORKSPACES_DATABASE_URL`. Read only for an org whose entry declares workspaces. */
+    brokerHasWorkspacesDatabase?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
     /**
      * Every secret this executor minted or read so far (peer password, bridge
      * secret, invite code and link). The host's run adds them to its redactor
@@ -462,6 +473,8 @@ export interface FoundryApplyOptions {
         typed: string;
         /** The removed entry's gate keys, read by the caller from the company before the change. */
         gates?: readonly string[];
+        /** The paths the entry's private pages had before the change, for an entry that still exists: their `pp-`/`wp-` gate deletes pass with its confirmation. */
+        privatePages?: readonly string[];
     };
 }
 export interface FoundryPlanApplyOptions {
@@ -550,6 +563,8 @@ export interface FoundryPlanApplyOptions {
     workerApps?: boolean;
     /** ADR 0002: the keys custody Worker address, when the executor has a `KeysCustodyPort`. A `keysCustody` secret is blocked without it. */
     workerAppKeysUrl?: string;
+    /** F7: the keys service's registrar address, when the executor has a `KeysRegistrarPort`. */
+    keysRegistrarUrl?: string;
     /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
     workerAppDatabase?: boolean;
     /** ADR 0002: the platform's Cloudflare account id. A container image outside its registry is blocked. */
@@ -604,6 +619,16 @@ export interface FoundryPlanApplyOptions {
      * the release runner. Without it no release runs, in an apply or in {@link FoundryPlanApply.runReleaseTick}.
      */
     releaseStore?: ReleaseStore;
+    /**
+     * F12: the GitHub deploy-key client (`createGithubDeployKeys`), to ask which deploy keys an entry's repo has.
+     * Without it an entry with `uses.repo` is reported blocked and nothing else changes.
+     */
+    githubDeployKeys?: GithubDeployKeysPort;
+    /**
+     * `uses.audit` (foundry#929): what {@link FoundryPlanApply.runAuditSealTick} seals with. Without it the tick
+     * seals nothing and logs that it was not given.
+     */
+    auditSealing?: AuditSealingOptions;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -693,6 +718,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly edgeWorkers;
     private readonly workerApps;
     private readonly workerAppKeysUrl;
+    private readonly keysRegistrarUrl;
     private readonly workerAppDatabase;
     private readonly workerAppRegistryAccountId;
     private readonly ownerInviteMail;
@@ -709,6 +735,8 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly platformDeps;
     private readonly runner;
     private readonly releaseStore;
+    private readonly githubDeployKeys;
+    private readonly auditSealing;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     /**
@@ -872,6 +900,13 @@ export declare class FoundryPlanApply implements PlanApply {
         target: string;
         error?: string;
     }>>;
+    /**
+     * The recurring audit sealing run (foundry#929): seals every ledger registered by an `audit:ledger` step with the
+     * platform signer and has the timestamp authority stamp the new checkpoints. Foundry has no scheduler, so the host
+     * calls this every `AUDIT_SEAL_EVERY_MINUTES` (15). One ledger failing never stops the others; each result and a
+     * log line say what happened and why when nothing did. It writes nothing to the org's records.
+     */
+    runAuditSealTick(): Promise<SealResult[]>;
     private runOrgReleaseTick;
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     private readSfuPortsOpen;
@@ -891,6 +926,10 @@ export declare class FoundryPlanApply implements PlanApply {
      * org step that needs one is blocked.
      */
     private orgPlatformReadiness;
+    /** F12: asks GitHub about the repo of each entry with a deploy key to make, check or remove. Never throws; a failure is a plain line. */
+    private repoKeysReadiness;
+    /** Which refs of the platform GitHub App hold no value now. A resolver that throws counts as not held; only refs are kept. */
+    private githubAppKeysReadiness;
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as