@wtfalch/foundry 0.60.0 → 0.62.0

package/dist/release/health.d.ts

@@ -4,6 +4,8 @@ import type { HealthRead } from './decide.js';
 export declare const HEALTH_READ_TIMEOUT_MS = 10000;
 /** The color's own address check has this long to answer. */
 export declare const ADDRESS_CHECK_TIMEOUT_MS = 10000;
+/** A health body larger than this is refused unread (a runaway or hostile response must not fill memory). */
+export declare const HEALTH_BODY_MAX_BYTES: number;
 /** C1's 200 body. */
 export declare const healthBody: z.ZodObject<{
     colors: z.ZodObject<{
@@ -40,14 +42,17 @@ export declare function readReleaseHealth(input: {
     fetchImpl?: typeof fetch;
 }): Promise<HealthRead | null>;
 /**
- * An HTTP check of the color's health path on its own address. A redirect is a failure: it is how a login
- * wall (Cloudflare Access) answers a machine. With `expectJson` the body must also parse as JSON, so a login page served with 200 is not read as a healthy color.
+ * An HTTP check of the color's health path on its own address. A redirect to another origin is a failure: it is
+ * how a login wall (Cloudflare Access) answers a machine. One same-origin redirect (a trailing-slash 308) is
+ * followed and the answer judged; a second redirect fails. The body is read under {@link HEALTH_BODY_MAX_BYTES}.
+ * With `expectJson` it must parse as JSON. Without, it must not be Access's login page (a 200 that
+ * carries `cloudflareaccess.com` or `/cdn-cgi/access/`), so a login wall is never read as a healthy static app.
  */
 export declare function checkColorAddress(input: {
     address: string;
     healthPath: string | null;
     headers?: Record<string, string>;
-    /** True for an app whose health path answers JSON; false for a static app's `/`. */
+    /** True for an app with a server, whose health path answers JSON; false for a static app's `/`. */
     expectJson?: boolean;
     fetchImpl?: typeof fetch;
 }): Promise<'ok' | 'failed'>;

package/dist/release/health.js

@@ -3,6 +3,36 @@ import { z } from 'zod';
 export const HEALTH_READ_TIMEOUT_MS = 10_000;
 /** The color's own address check has this long to answer. */
 export const ADDRESS_CHECK_TIMEOUT_MS = 10_000;
+/** A health body larger than this is refused unread (a runaway or hostile response must not fill memory). */
+export const HEALTH_BODY_MAX_BYTES = 64 * 1024;
+/**
+ * The response body as text, or null when it is larger than {@link HEALTH_BODY_MAX_BYTES}. Reads in chunks and
+ * stops at the cap, so an endless body is never held.
+ */
+async function readCappedText(res) {
+    const declared = Number(res.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > HEALTH_BODY_MAX_BYTES)
+        return null;
+    if (!res.body)
+        return '';
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > HEALTH_BODY_MAX_BYTES) {
+            await reader.cancel().catch(() => undefined);
+            return null;
+        }
+        chunks.push(value);
+    }
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}
+/** What Cloudflare Access's login page carries: its hosted domain and its path prefix. */
+const ACCESS_PAGE_MARKERS = ['cloudflareaccess.com', '/cdn-cgi/access/'];
 const counts = z.object({
     requests: z.number().int().nonnegative(),
     errors: z.number().int().nonnegative(),
@@ -35,7 +65,10 @@ export async function readReleaseHealth(input) {
         });
         if (!res.ok)
             return null;
-        const parsed = healthBody.safeParse(await res.json());
+        const text = await readCappedText(res);
+        if (text === null)
+            return null;
+        const parsed = healthBody.safeParse(JSON.parse(text));
         if (!parsed.success)
             return null;
         return { colors: parsed.data.colors, daily: parsed.data.daily };
@@ -46,20 +79,40 @@ export async function readReleaseHealth(input) {
     }
 }
 /**
- * An HTTP check of the color's health path on its own address. A redirect is a failure: it is how a login
- * wall (Cloudflare Access) answers a machine. With `expectJson` the body must also parse as JSON, so a login page served with 200 is not read as a healthy color.
+ * An HTTP check of the color's health path on its own address. A redirect to another origin is a failure: it is
+ * how a login wall (Cloudflare Access) answers a machine. One same-origin redirect (a trailing-slash 308) is
+ * followed and the answer judged; a second redirect fails. The body is read under {@link HEALTH_BODY_MAX_BYTES}.
+ * With `expectJson` it must parse as JSON. Without, it must not be Access's login page (a 200 that
+ * carries `cloudflareaccess.com` or `/cdn-cgi/access/`), so a login wall is never read as a healthy static app.
  */
 export async function checkColorAddress(input) {
     try {
-        const res = await (input.fetchImpl ?? fetch)(new URL(input.healthPath ?? '/', input.address), {
+        const doFetch = input.fetchImpl ?? fetch;
+        const get = (url) => doFetch(url, {
             ...(input.headers ? { headers: input.headers } : {}),
             redirect: 'manual',
             signal: AbortSignal.timeout(ADDRESS_CHECK_TIMEOUT_MS),
         });
+        const first = new URL(input.healthPath ?? '/', input.address);
+        let res = await get(first);
+        if (res.status >= 300 && res.status < 400) {
+            const location = res.headers.get('location');
+            if (!location)
+                return 'failed';
+            const next = new URL(location, first);
+            if (next.origin !== first.origin)
+                return 'failed';
+            res = await get(next);
+        }
         if (!res.ok)
             return 'failed';
+        const text = await readCappedText(res);
+        if (text === null)
+            return 'failed';
         if (input.expectJson)
-            await res.json();
+            JSON.parse(text);
+        else if (ACCESS_PAGE_MARKERS.some((marker) => text.includes(marker)))
+            return 'failed';
         return 'ok';
     }
     catch {

package/dist/release/migration-compatibility.d.ts

@@ -0,0 +1,66 @@
+import { type WorkerAppConfig } from '../worker-app-config.js';
+/**
+ * Whether a release's database changes may go to idle (foundry#934, estate DECISIONS.md,
+ * 2026-10-21 "Releases and versions"). Idle shares the live database with whatever release is
+ * live, so a release may only add -- never drop, narrow, rename or retype something the live
+ * release still reads or writes, and never delete a Durable Object class the live release still
+ * uses. A removal needs two releases: one that stops using the object, a later one -- once that
+ * first release is no longer on live, idle or draining anywhere -- that removes it.
+ *
+ * Pure: no database connection, no network call, no data read. The caller supplies everything it
+ * already has: what the previous live release applied (`liveMigrationIds`, `liveDoTag`), what
+ * release tags are deployed anywhere right now (`deployedReleases`), and which removals this
+ * release declares as the drained second step of an earlier one (`declaredRemovals`). There is no
+ * override beyond that declaration: a destructive step with no declaration, or whose declared
+ * release has not drained, is refused every time.
+ *
+ * A SQL statement declares its own removal with a `-- removal-since: <release>` comment directly
+ * above it (the same convention `@wtfalch/db`'s migration safety check uses for
+ * `-- destructive: <reason>`); a Durable Object class removal is declared in `declaredRemovals`,
+ * since `deleted_classes` carries no comment of its own.
+ *
+ * The SQL classifier is pattern-based, not a real SQL parser: it is a safety rail against an
+ * accidental incompatible release, not a boundary against someone deliberately hiding a drop
+ * inside a string. A statement it cannot classify is refused rather than guessed as safe.
+ */
+/** A Durable Object class removal this release declares as the drained second step of an earlier one. */
+export interface DeclaredClassRemoval {
+    /** The class name a `deleted_classes` step of this release removes. */
+    className: string;
+    /** The earlier release that stopped using the class. Must have fully drained before this passes. */
+    sinceRelease: string;
+}
+export interface MigrationCompatibilityInput {
+    /** This release's own `migrations.json` (SQL), or `null` for a release with none. */
+    migrationsJson: string | null;
+    /** The SQL migration ids the previous live release already applied, in order. Default: none. */
+    liveMigrationIds?: readonly string[];
+    /** This release's full, declared Durable Object migrations, in order. Default: none. */
+    doMigrations?: WorkerAppConfig['durableObjects']['migrations'];
+    /** The Durable Object migration tag the previous live release holds, if any. */
+    liveDoTag?: string;
+    /** Durable Object class removals this release declares. Default: none. */
+    declaredRemovals?: readonly DeclaredClassRemoval[];
+    /** Release tags that are, right now, on live, idle or draining anywhere for this app. Default: none. */
+    deployedReleases?: readonly string[];
+}
+export interface MigrationCompatibilityProblem {
+    /** The SQL migration id or Durable Object migration tag the statement is in. */
+    migration: string;
+    /** The statement or step that is refused, trimmed to one line. */
+    statement: string;
+    /** Why it is refused, and what to do about it, in plain words. */
+    reason: string;
+}
+export type MigrationCompatibilityResult = {
+    ok: true;
+} | {
+    ok: false;
+    problems: MigrationCompatibilityProblem[];
+};
+/**
+ * Whether a release's migrations (SQL and Durable Object) may go to idle, given what the
+ * previous live release already applied and which releases are deployed anywhere right now. See
+ * the module docstring for the rule and the removal convention.
+ */
+export declare function checkMigrationCompatibility(input: MigrationCompatibilityInput): MigrationCompatibilityResult;

package/dist/release/migration-compatibility.js

@@ -0,0 +1,340 @@
+import { foldMigrationClasses } from '../worker-app-config.js';
+import { parseMigrations, unappliedDatabaseMigrations, } from '../worker-app-migrations.js';
+const REMOVAL_MARKER = /^--\s*removal-since:\s*(\S.*)$/i;
+const STATEMENT_MAX_CHARS = 160;
+/** Collapses whitespace and cuts a statement down to a readable, one-line length for a message. */
+function oneLine(text) {
+    const collapsed = text.replace(/\s+/g, ' ').trim();
+    return collapsed.length > STATEMENT_MAX_CHARS
+        ? `${collapsed.slice(0, STATEMENT_MAX_CHARS - 1)}…`
+        : collapsed;
+}
+/**
+ * Splits `sql` into standalone statements at a semicolon that sits outside a line comment, a
+ * block comment, a single- or double-quoted literal, and a dollar-quoted body (a function's
+ * `$$ ... $$`, which may itself hold semicolons). Each statement keeps any comment lines directly
+ * above it, so a `-- removal-since:` marker travels with the statement it excuses.
+ */
+function splitStatements(sql) {
+    const statements = [];
+    let current = '';
+    let i = 0;
+    const n = sql.length;
+    while (i < n) {
+        const ch = sql[i];
+        if (ch === '-' && sql[i + 1] === '-') {
+            const end = sql.indexOf('\n', i);
+            const end2 = end === -1 ? n : end + 1;
+            current += sql.slice(i, end2);
+            i = end2;
+            continue;
+        }
+        if (ch === '/' && sql[i + 1] === '*') {
+            const end = sql.indexOf('*/', i + 2);
+            const end2 = end === -1 ? n : end + 2;
+            current += sql.slice(i, end2);
+            i = end2;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === ch) {
+                    if (sql[j + 1] === ch) {
+                        j += 2;
+                        continue;
+                    }
+                    j += 1;
+                    break;
+                }
+                j += 1;
+            }
+            current += sql.slice(i, j);
+            i = j;
+            continue;
+        }
+        if (ch === '$') {
+            const tagMatch = /^\$[A-Za-z_][A-Za-z0-9_]*\$|^\$\$/.exec(sql.slice(i));
+            if (tagMatch) {
+                const tag = tagMatch[0];
+                const end = sql.indexOf(tag, i + tag.length);
+                const end2 = end === -1 ? n : end + tag.length;
+                current += sql.slice(i, end2);
+                i = end2;
+                continue;
+            }
+        }
+        if (ch === ';') {
+            statements.push(current);
+            current = '';
+            i += 1;
+            continue;
+        }
+        current += ch;
+        i += 1;
+    }
+    if (current.trim() !== '')
+        statements.push(current);
+    return statements;
+}
+/**
+ * Splits `code` at a top-level comma (outside a quoted literal or parentheses), so each element
+ * of an `ALTER TABLE`'s comma-separated action list -- `ADD COLUMN a text DEFAULT 'x', ADD COLUMN
+ * b integer NOT NULL` -- can be judged on its own. Without this, a `DEFAULT` on one added column
+ * hid a `NOT NULL` with no default on a different one, because the two regexes ran against the
+ * whole statement (foundry#941 review).
+ */
+function splitTopLevelCommas(code) {
+    const parts = [];
+    let current = '';
+    let depth = 0;
+    let i = 0;
+    const n = code.length;
+    while (i < n) {
+        const ch = code[i];
+        if (ch === "'" || ch === '"') {
+            let j = i + 1;
+            while (j < n) {
+                if (code[j] === ch) {
+                    if (code[j + 1] === ch) {
+                        j += 2;
+                        continue;
+                    }
+                    j += 1;
+                    break;
+                }
+                j += 1;
+            }
+            current += code.slice(i, j);
+            i = j;
+            continue;
+        }
+        if (ch === '(') {
+            depth += 1;
+            current += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === ')') {
+            depth = Math.max(0, depth - 1);
+            current += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === ',' && depth === 0) {
+            parts.push(current);
+            current = '';
+            i += 1;
+            continue;
+        }
+        current += ch;
+        i += 1;
+    }
+    parts.push(current);
+    return parts;
+}
+/** The statement with its leading blank and comment lines removed, so classification reads code, not a marker. */
+function withoutLeadingComments(statement) {
+    const lines = statement.split('\n');
+    let i = 0;
+    while (i < lines.length) {
+        const trimmed = lines[i].trim();
+        if (trimmed === '' || trimmed.startsWith('--')) {
+            i += 1;
+            continue;
+        }
+        break;
+    }
+    return lines.slice(i).join('\n').trim();
+}
+/** The release named in a `-- removal-since: <release>` line directly above the statement, or `null`. */
+function declaredSince(statement) {
+    for (const line of statement.split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed === '')
+            continue;
+        const match = REMOVAL_MARKER.exec(trimmed);
+        if (match)
+            return match[1].trim();
+        if (!trimmed.startsWith('--'))
+            break;
+    }
+    return null;
+}
+/**
+ * Classifies one statement's code (comments already stripped) as additive or destructive, or
+ * `null` when it cannot tell: an unrecognised statement is never assumed to be additive.
+ */
+function classifyStatement(code) {
+    if (code === '')
+        return null;
+    if (/^CREATE\s+(OR\s+REPLACE\s+)?(TABLE|SCHEMA|EXTENSION|SEQUENCE|VIEW)\b/i.test(code)) {
+        return { destructive: false, reason: 'creates something new' };
+    }
+    if (/^CREATE\s+(UNIQUE\s+)?INDEX(\s+CONCURRENTLY)?\b/i.test(code)) {
+        return { destructive: false, reason: 'adds an index' };
+    }
+    if (/^CREATE\s+(OR\s+REPLACE\s+)?(FUNCTION|PROCEDURE)\b/i.test(code)) {
+        return { destructive: false, reason: 'adds or replaces a function' };
+    }
+    if (/^CREATE\s+(OR\s+REPLACE\s+)?TRIGGER\b/i.test(code)) {
+        return { destructive: false, reason: 'adds a trigger' };
+    }
+    if (/^(COMMENT\s+ON|GRANT)\b/i.test(code)) {
+        return {
+            destructive: false,
+            reason: 'changes neither data nor structure a running release reads',
+        };
+    }
+    if (/^ALTER\s+TABLE\b/i.test(code)) {
+        if (/\bDROP\s+COLUMN\b/i.test(code))
+            return { destructive: true, reason: 'drops a column' };
+        if (/\bDROP\s+CONSTRAINT\b/i.test(code))
+            return { destructive: true, reason: 'drops a constraint' };
+        if (/\bRENAME\b/i.test(code))
+            return { destructive: true, reason: 'renames a table or column' };
+        if (/\bALTER\s+COLUMN\b[\s\S]*\b(SET\s+DATA\s+)?TYPE\b/i.test(code)) {
+            return { destructive: true, reason: "changes a column's type" };
+        }
+        if (/\bSET\s+NOT\s+NULL\b/i.test(code)) {
+            return { destructive: true, reason: 'adds a NOT NULL constraint to an existing column' };
+        }
+        if (/\bADD\s+COLUMN\b/i.test(code)) {
+            for (const clause of splitTopLevelCommas(code)) {
+                if (!/\bADD\s+COLUMN\b/i.test(clause))
+                    continue;
+                if (/\bNOT\s+NULL\b/i.test(clause) && !/\bDEFAULT\b/i.test(clause)) {
+                    return { destructive: true, reason: 'adds a NOT NULL column with no default' };
+                }
+            }
+            return { destructive: false, reason: 'adds a column' };
+        }
+        if (/\bADD\s+CONSTRAINT\b/i.test(code))
+            return { destructive: false, reason: 'adds a constraint' };
+        return null;
+    }
+    if (/^DROP\s+(TABLE|INDEX|TYPE|SCHEMA|FUNCTION|PROCEDURE|TRIGGER|VIEW|MATERIALIZED\s+VIEW|EXTENSION|SEQUENCE)\b/i.test(code)) {
+        return { destructive: true, reason: 'drops something the live release may still read' };
+    }
+    if (/^(TRUNCATE|DELETE\s+FROM|UPDATE\s+\S+\s+SET)\b/i.test(code)) {
+        return { destructive: true, reason: 'removes or rewrites existing rows' };
+    }
+    if (/^ALTER\s+(INDEX|SEQUENCE|VIEW|TYPE|SCHEMA)\b[\s\S]*\bRENAME\b/i.test(code)) {
+        return { destructive: true, reason: 'renames something' };
+    }
+    return null;
+}
+const splitHelp = (what) => `${what}; split this into two releases: stop using it in one, remove it in a later release once that one is no longer on live, idle or draining`;
+/** A destructive statement or step named `since` is drained once that release deploys nowhere. */
+function hasDrained(since, deployedReleases) {
+    return !deployedReleases.includes(since);
+}
+function sqlProblems(migrationsJson, liveMigrationIds, deployedReleases) {
+    let declared;
+    try {
+        declared = parseMigrations(migrationsJson);
+    }
+    catch (error) {
+        return [{ migration: '', statement: '', reason: error.message }];
+    }
+    let pending;
+    try {
+        pending = unappliedDatabaseMigrations(declared, liveMigrationIds);
+    }
+    catch (error) {
+        return [{ migration: '', statement: '', reason: error.message }];
+    }
+    const problems = [];
+    for (const migration of pending) {
+        for (const statement of splitStatements(migration.sql)) {
+            const code = withoutLeadingComments(statement);
+            const classified = classifyStatement(code);
+            if (classified === null) {
+                problems.push({
+                    migration: migration.id,
+                    statement: oneLine(code),
+                    reason: 'this statement is not one foundry recognises as additive; split it into its own release and ask a person',
+                });
+                continue;
+            }
+            if (!classified.destructive)
+                continue;
+            const since = declaredSince(statement);
+            if (since === null) {
+                problems.push({
+                    migration: migration.id,
+                    statement: oneLine(code),
+                    reason: splitHelp(classified.reason),
+                });
+                continue;
+            }
+            if (!hasDrained(since, deployedReleases)) {
+                problems.push({
+                    migration: migration.id,
+                    statement: oneLine(code),
+                    reason: `${classified.reason}; declared as the second step after release ${since}, but ${since} is still on live, idle or draining -- wait for it to fully drain, then release this one`,
+                });
+            }
+        }
+    }
+    return problems;
+}
+function doProblems(doMigrations, liveDoTag, declaredRemovals, deployedReleases) {
+    if (doMigrations.length === 0)
+        return [];
+    let appliedCount = 0;
+    if (liveDoTag !== undefined) {
+        const index = doMigrations.findIndex((m) => m.tag === liveDoTag);
+        if (index < 0) {
+            return [
+                {
+                    migration: liveDoTag,
+                    statement: '',
+                    reason: "the live release holds a Durable Object migration that is not in this release's declared list; migrations are append-only",
+                },
+            ];
+        }
+        appliedCount = index + 1;
+    }
+    const folded = foldMigrationClasses(doMigrations.slice(0, appliedCount));
+    if ('error' in folded)
+        return [{ migration: '', statement: '', reason: folded.error }];
+    const problems = [];
+    for (const migration of doMigrations.slice(appliedCount)) {
+        for (const className of migration.deletedClasses ?? []) {
+            if (!folded.classes.has(className))
+                continue; // never reached live: nothing running still uses it
+            const removal = declaredRemovals.find((r) => r.className === className);
+            const statement = `deleted_classes: ${className}`;
+            if (!removal) {
+                problems.push({
+                    migration: migration.tag,
+                    statement,
+                    reason: splitHelp(`deletes the Durable Object class '${className}', which the live release still uses`),
+                });
+                continue;
+            }
+            if (!hasDrained(removal.sinceRelease, deployedReleases)) {
+                problems.push({
+                    migration: migration.tag,
+                    statement,
+                    reason: `deletes the Durable Object class '${className}', declared as the second step after release ${removal.sinceRelease}, but ${removal.sinceRelease} is still on live, idle or draining -- wait for it to fully drain, then release this one`,
+                });
+            }
+        }
+    }
+    return problems;
+}
+/**
+ * Whether a release's migrations (SQL and Durable Object) may go to idle, given what the
+ * previous live release already applied and which releases are deployed anywhere right now. See
+ * the module docstring for the rule and the removal convention.
+ */
+export function checkMigrationCompatibility(input) {
+    const deployedReleases = input.deployedReleases ?? [];
+    const problems = [
+        ...sqlProblems(input.migrationsJson, input.liveMigrationIds ?? [], deployedReleases),
+        ...doProblems(input.doMigrations ?? [], input.liveDoTag, input.declaredRemovals ?? [], deployedReleases),
+    ];
+    return problems.length === 0 ? { ok: true } : { ok: false, problems };
+}

package/dist/release/run.d.ts

@@ -1,4 +1,4 @@
-import { type Decision, type Observation, type ReleaseEffect } from './decide.js';
+import { type Decision, type Observation, type ReleaseEffect, type ReleaseEntryConfig } from './decide.js';
 import { type ReleaseStore } from './state.js';
 import type { Color } from './types.js';
 /** What the runner needs from the outside. Each call is bounded by its own timeout. */
@@ -31,10 +31,7 @@ export declare function runRelease(input: {
     store: ReleaseStore;
     orgId: string;
     entryKey: string;
-    entry: {
-        steps?: number[];
-        stepHoldMinutes?: number;
-    };
+    entry: ReleaseEntryConfig;
     now: Date;
     deps: ReleaseDeps;
     /** No reporting health read: only hard fails count (see `decide`). */

package/dist/release/run.js

@@ -25,6 +25,10 @@ export async function runRelease(input) {
         actions,
         steps: input.entry.steps,
         stepHoldMinutes: input.entry.stepHoldMinutes,
+        advance: input.entry.advance,
+        minRequests: input.entry.minRequests,
+        errorMargin: input.entry.errorMargin,
+        staffFirst: input.entry.staffFirst,
         now,
         observation: { health, ...seen },
         ...(input.hardOnly ? { hardOnly: true } : {}),

package/dist/release/state.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { Recorded } from './decide.js';
+import { type Recorded, resolveReleaseConfig } from './decide.js';
 import type { Color, ReleaseAction, ReleaseSignal, ReleaseState, WindowState } from './types.js';
 /**
  * The persistence the release runner and Archon share. `getScopeIds` is the
@@ -52,6 +52,8 @@ export declare function readSignal(ids: Record<string, string>, entryKey: string
 export declare function readReleaseState(store: ReleaseStore, input: {
     orgId: string;
     entryKey: string;
+    /** The entry's `blueGreen` as declared; defaults are resolved into `config`. */
+    entry?: Parameters<typeof resolveReleaseConfig>[0];
 }): Promise<ReleaseState | null>;
 declare const actionSchema: z.ZodType<ReleaseAction>;
 /** C2: ask the runner to apply an action on its next run. Archon audits it. */

package/dist/release/state.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { STAGE_REF_PATTERN, resolveReleaseConfig } from './decide.js';
 /** Scope keys (C3). `entry` is a hosting entry key: never `.` or `:`. */
 export function releaseKeys(entry) {
     if (!/^[a-z0-9][a-z0-9-]*$/.test(entry))
@@ -33,6 +34,7 @@ const storedWindow = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('passed'), at: z.string() }),
     z.object({ kind: z.literal('rolled_back'), at: z.string(), reason: z.string() }),
     z.object({ kind: z.literal('cap'), since: z.string() }),
+    z.object({ kind: z.literal('staff'), since: z.string() }),
 ]);
 const releaseField = z
     .object({
@@ -110,6 +112,7 @@ export async function readReleaseState(store, input) {
         window: r.window,
         signal: readSignal(ids, input.entryKey),
         held: r.held,
+        config: resolveReleaseConfig(input.entry),
     };
 }
 const actionSchema = z.discriminatedUnion('kind', [
@@ -117,6 +120,9 @@ const actionSchema = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('rollback') }),
     z.object({ kind: z.literal('clear_held'), digest: z.string().min(1) }),
     z.object({ kind: z.literal('decide_at_cap'), decision: z.enum(['pass', 'rollback']) }),
+    z.object({ kind: z.literal('approve_step') }),
+    z.object({ kind: z.literal('open') }),
+    z.object({ kind: z.literal('deploy_stage'), ref: z.string().regex(STAGE_REF_PATTERN) }),
 ]);
 /** C2: ask the runner to apply an action on its next run. Archon audits it. */
 export async function requestReleaseAction(store, input) {

package/dist/release/types.d.ts

@@ -22,6 +22,11 @@ export type WindowState = {
 } | {
     kind: 'cap';
     since: string;
+}
+/** Deployed on the idle color at weight 0, waiting for an `open` action (staffFirst). */
+ | {
+    kind: 'staff';
+    since: string;
 };
 export interface ReleaseSignal {
     requests: number;
@@ -29,6 +34,13 @@ export interface ReleaseSignal {
     baselineRate: number | null;
     verdict: 'pass' | 'fail' | 'hard_fail' | 'inconclusive';
 }
+/** The release kind of an entry, defaults resolved. */
+export interface ReleaseConfig {
+    advance: 'time' | 'signal' | 'approval';
+    steps: number[];
+    stepHoldMinutes: number;
+    staffFirst: boolean;
+}
 export interface ReleaseState {
     entryKey: string;
     live: Color;
@@ -38,6 +50,7 @@ export interface ReleaseState {
     window: WindowState;
     signal: ReleaseSignal | null;
     held: string[];
+    config: ReleaseConfig;
 }
 export type ReleaseAction = {
     kind: 'promote';
@@ -49,6 +62,13 @@ export type ReleaseAction = {
 } | {
     kind: 'decide_at_cap';
     decision: 'pass' | 'rollback';
+} | {
+    kind: 'approve_step';
+} | {
+    kind: 'open';
+} | {
+    kind: 'deploy_stage';
+    ref: string;
 };
 export declare const COLORS: readonly Color[];
 export declare function otherColor(color: Color): Color;