@wtfalch/foundry 0.41.2 → 0.43.0

package/dist/plan/login-host.d.ts

@@ -1,4 +1,5 @@
 import { type DeclaredOrg } from '../org.js';
+import { type InAppApp, type SIGN_IN_BASE_PATH } from './sign-in.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -99,7 +100,17 @@ export interface LoginHostBinding {
     host: string;
     organizationId: string;
     clientIds: string[];
+    /** In-app sign-in: which app each client id is, so the login draws that app's room. Absent: the company's own room. */
+    apps?: Record<string, 'agora' | 'boule' | 'archon'>;
+    /** In-app sign-in: the login serves this host under `/sign-in`. Absent: the root. */
+    basePath?: typeof SIGN_IN_BASE_PATH;
 }
+/**
+ * The app hosts that sign in on their own address when the company has `signIn.inApp`: Agora's and
+ * Boule's, each only once its client id is recorded. Empty with the switch off. Archon (owner company
+ * only) is not here: the platform's Archon step owns its host (`sign-in-archon.ts`).
+ */
+export declare function inAppApps(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): InAppApp[];
 /**
  * Host-supplied write access to zitadel-login's own `LOGIN_HOST_BINDINGS`
  * env (`auth/docs/company-login-hosts.md`'s own "Set `LOGIN_HOST_BINDINGS`
@@ -121,6 +132,12 @@ export interface LoginHostBindingsPort {
      * package.
      */
     deleteBinding(host: string): Promise<void>;
+    /**
+     * A port that queues its upserts writes them here, once: one redeploy of the login however many hosts
+     * the step bound. A port without it writes on each call. `deleteBinding` writes at once on either.
+     * The login-host step calls it after all its upserts and before any app is repointed.
+     */
+    flush?(): Promise<void>;
 }
 /**
  * Scope id holding what the binding was last written with
@@ -137,8 +154,12 @@ export declare const LOGIN_BINDING_SCOPE_KEY = "login_host_binding";
  * is no longer declared is not here, so it stays bound as before.
  */
 export declare function customersEntryKeys(org: DeclaredOrg): Set<string>;
-/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
-export declare function loginHostClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string[];
+/**
+ * The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule),
+ * deduplicated and sorted, bar `except`: the login refuses a client id held by two bindings, so the ids of the
+ * app hosts that have their own binding (in-app sign-in) are not in the company's.
+ */
+export declare function loginHostClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, except?: readonly string[]): string[];
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export declare function loginBindingState(host: string, clientIds: readonly string[]): string;
 /**

package/dist/plan/login-host.js

@@ -1,6 +1,7 @@
 import { ownsServices } from '../org.js';
-import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, } from './agora.js';
-import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, agoraHostnameFor, } from './agora.js';
+import { BOULE_CLIENT_ID_SCOPE_KEY, bouleHostnameFor } from './boule.js';
+import { SIGN_IN_IN_APP_SCOPE_KEY, inAppSignIn, inAppStatePairs, } from './sign-in.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -120,7 +121,10 @@ export function loginHostServesAgora(host, org, recorded) {
     if (!bound?.startsWith(`${host} `))
         return false;
     const clientId = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    // Agora's client moves to its own host's binding once that host signs in on the app's address.
+    const movedToAppHost = inAppStatePairs(recorded[SIGN_IN_IN_APP_SCOPE_KEY]).some((pair) => pair.clientId === clientId);
     return (!clientId ||
+        movedToAppHost ||
         bound
             .slice(host.length + 1)
             .split(',')
@@ -132,6 +136,23 @@ export function loginHostServesAgora(host, org, recorded) {
  * instance, so `destroy` must not remove it.
  */
 export const LOGIN_HOST_SHARED_SCOPE_KEY = 'zitadel_login_host_shared';
+/**
+ * The app hosts that sign in on their own address when the company has `signIn.inApp`: Agora's and
+ * Boule's, each only once its client id is recorded. Empty with the switch off. Archon (owner company
+ * only) is not here: the platform's Archon step owns its host (`sign-in-archon.ts`).
+ */
+export function inAppApps(org, recorded) {
+    if (!inAppSignIn(org))
+        return [];
+    const apps = [];
+    const agora = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    if (agora)
+        apps.push({ app: 'agora', host: agoraHostnameFor(org), clientId: agora });
+    const boule = recorded[BOULE_CLIENT_ID_SCOPE_KEY];
+    if (boule)
+        apps.push({ app: 'boule', host: bouleHostnameFor(org), clientId: boule });
+    return apps.sort((a, b) => (a.host < b.host ? -1 : 1));
+}
 /**
  * Scope id holding what the binding was last written with
  * ({@link loginBindingState}). Client ids are not secrets. The planner
@@ -149,8 +170,12 @@ export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
 export function customersEntryKeys(org) {
     return new Set(org.hosting.entries.filter((e) => e.uses?.auth?.users === 'customers').map((e) => e.key));
 }
-/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
-export function loginHostClientIds(org, recorded) {
+/**
+ * The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule),
+ * deduplicated and sorted, bar `except`: the login refuses a client id held by two bindings, so the ids of the
+ * app hosts that have their own binding (in-app sign-in) are not in the company's.
+ */
+export function loginHostClientIds(org, recorded, except = []) {
     const customers = customersEntryKeys(org);
     const ids = [
         recorded[APP_CLIENT_ID_SCOPE_KEY],
@@ -162,7 +187,7 @@ export function loginHostClientIds(org, recorded) {
             !customers.has(key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length)))
             .map(([, id]) => id),
     ].filter((id) => Boolean(id));
-    return [...new Set(ids)].sort();
+    return [...new Set(ids)].filter((id) => !except.includes(id)).sort();
 }
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export function loginBindingState(host, clientIds) {

package/dist/plan/own-diff.js

@@ -13,6 +13,7 @@ import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY,
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
 import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, signinDbCertDue } from './signin-db-tls.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db.js';
@@ -162,6 +163,11 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_SMTP_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
         (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry) &&
+        // In-app sign-in: the second login app is recorded once it is deployed and holds the token, which
+        // needs the login client; until the broker holds an entry that cannot be, so the step waits.
+        (!inAppSignIn(org) ||
+            Boolean(recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY]) ||
+            !brokerHoldsAnEntry) &&
         !signinDbCertDue(recordedIds, options.now ?? Date.now()) &&
         !signinDbBackupMissing(recordedIds) &&
         // ZITADEL was started on the TLS database and never seen healthy there: the step starts it again.

package/dist/plan/plan-apply.d.ts

@@ -2,18 +2,21 @@ import type { DestroyProgress, PlanApply } from '../apply.js';
 import type { DeclaredOrg, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
+import type { ReleaseStore } from '../release/state.js';
 import type { JobRunner } from '../runner/types.js';
 import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
 import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js';
 import { type AgoraHostPort } from './agora.js';
 import { type MoveGatePorts } from './backup-gate.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
     readonly id: string;
@@ -205,6 +208,17 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** Every Coolify server with whether it is usable and reachable; blue/green plans copies on each. Optional: an executor without it plans no blue/green. */
+    blueGreenServers?(): Promise<Array<{
+        uuid: string;
+        usable: boolean;
+        reachable: boolean;
+    }>>;
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`); `null` while its blue
+     * copy is not recorded. Optional: an executor without it runs no release.
+     */
+    releaseHost?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
     /** Whether the executor's held keys can store the sign-in database's CA and certificate (#746). Absent: true. */
     ownSigninDbKeysPuttable?(): boolean;
     /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). Absent: true. */
@@ -325,6 +339,16 @@ export interface PlatformStepExecutor {
      * one), or `null` when nothing changed.
      */
     refreshFilesShare?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<Record<string, string> | null>;
+    /**
+     * The Coolify servers and the reason platform-archon's blue/green cannot run (the executor cannot hold the
+     * health token), for the plan. Optional: an executor without it plans no blue/green for archon.
+     */
+    archonBlueGreen?(): Promise<{
+        servers?: BlueGreenServer[];
+        blocked?: string;
+    }>;
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`); `null` while its app is not recorded. */
+    releaseHost?(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -510,6 +534,11 @@ export interface FoundryPlanApplyOptions {
         step(action: StepAction): boolean;
         blocked(key: string): boolean;
     };
+    /**
+     * The release requests (Archon's promote, roll back, clear held and decide-at-cap clicks), consumed once each by
+     * the release runner. Without it no release runs, in an apply or in {@link FoundryPlanApply.runReleaseTick}.
+     */
+    releaseStore?: ReleaseStore;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -605,6 +634,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly backupGate;
     private readonly platformDeps;
     private readonly runner;
+    private readonly releaseStore;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     /**
@@ -741,6 +771,27 @@ export declare class FoundryPlanApply implements PlanApply {
     private refusePlatform;
     private refuseDestroy;
     private runSteps;
+    /**
+     * ADR 0001: one release run for each blue/green entry whose structure is applied, writing into `context`
+     * (the live ids of the run that holds the lease). A weight the runner changed reaches every server's balancer
+     * before this returns.
+     */
+    private runOrgReleases;
+    /** One release run for platform-archon, on the platform's live ids; see {@link runOrgReleases}. */
+    private runPlatformReleases;
+    private runPlatformReleaseTick;
+    /**
+     * The recurring release run (ADR 0001): for every declared org with a blue/green entry, and the platform's
+     * archon when it declares one, takes the open requests, reads the health signal and moves traffic. Foundry has
+     * no scheduler of its own, so the host calls this every 10 minutes. An org that cannot run (the actor may not
+     * apply it, an apply holds its lease, a provider call fails) is reported by id and does not stop the others.
+     * A refusal is audited; a run that does nothing writes no audit row.
+     */
+    runReleaseTick(): Promise<Array<{
+        target: string;
+        error?: string;
+    }>>;
+    private runOrgReleaseTick;
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     private readSfuPortsOpen;
     private computeFreshPlan;

package/dist/plan/plan-apply.js

@@ -8,6 +8,7 @@ import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { NetworkMoveBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
+import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, entrySubject, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
@@ -25,6 +26,8 @@ import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILE
 import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
+import { runSubjectRelease } from './release-host.js';
+import { remoteDatabaseFactsFrom } from './remote-database.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
@@ -119,6 +122,9 @@ export class PlatformConfirmationRequiredError extends Error {
 /** The steps that read an entry's hostnames: `computeFreshPlan` drops them for an org whose hosting is invalid. */
 const HOSTNAME_STEPS = new Set([
     'coolify:app',
+    'coolify:bluegreen',
+    'coolify:bluegreen-lb',
+    'coolify:bluegreen-connector',
     'coolify:broker-entry',
     'coolify:database',
     'cloudflare:tunnel',
@@ -167,6 +173,7 @@ export class FoundryPlanApply {
     backupGate;
     platformDeps;
     runner;
+    releaseStore;
     constructor(options) {
         this.store = options.store;
         this.readers = options.readers;
@@ -195,6 +202,7 @@ export class FoundryPlanApply {
         this.backupGate = options.backupGate;
         this.platformDeps = options.platform;
         this.runner = options.runner;
+        this.releaseStore = options.releaseStore;
     }
     async plan(id) {
         const { plan } = await this.computeFreshPlan(id);
@@ -953,6 +961,13 @@ export class FoundryPlanApply {
                 }
                 checkpoints.push({ step: planned.step.description, completedAt: this.now().toISOString() });
             }
+            // The steps made the structure; the release runner then moves traffic on it, on the same live ids.
+            await this.runOrgReleases(org, {
+                recordedIds: context.recordedIds,
+                recordScopeId: context.recordScopeId,
+                forgetId: (key) => context.forgetId?.(key),
+                persist: context.persistScopeIds,
+            }, fence);
         }
         catch (e) {
             // #9 (resolved): "it stops at the checkpoint... there is no automatic
@@ -1012,6 +1027,135 @@ export class FoundryPlanApply {
         });
         return applied;
     }
+    /**
+     * ADR 0001: one release run for each blue/green entry whose structure is applied, writing into `context`
+     * (the live ids of the run that holds the lease). A weight the runner changed reaches every server's balancer
+     * before this returns.
+     */
+    async runOrgReleases(org, context, fence) {
+        const store = this.releaseStore;
+        const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
+        if (!store || !this.executor.releaseHost || !primaryUuid)
+            return;
+        for (const entry of org.hosting.entries) {
+            const subject = entrySubject(org, entry, context.recordedIds());
+            if (!subject)
+                continue;
+            const host = this.executor.releaseHost(org, subject, context, () => this.renewLease(fence));
+            if (!host)
+                continue;
+            await runSubjectRelease({
+                store,
+                scopeOwnerId: org.id,
+                subject,
+                host,
+                context,
+                now: this.now(),
+                primaryUuid,
+            });
+        }
+    }
+    /** One release run for platform-archon, on the platform's live ids; see {@link runOrgReleases}. */
+    async runPlatformReleases(platform, context, fence) {
+        const store = this.releaseStore;
+        const executor = this.platformDeps?.executor;
+        const subject = archonSubject(platform, ARCHON_REPO);
+        const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
+        if (!store || !executor?.releaseHost || !subject || !primaryUuid)
+            return;
+        const host = executor.releaseHost(platform, subject, context, () => this.renewLease(fence));
+        if (!host)
+            return;
+        await runSubjectRelease({
+            store,
+            scopeOwnerId: 'platform',
+            subject,
+            host,
+            context,
+            now: this.now(),
+            primaryUuid,
+        });
+    }
+    async runPlatformReleaseTick() {
+        const deps = this.platformDeps;
+        const platform = await deps?.store.get();
+        if (!deps || !platform)
+            return;
+        const empty = { orgId: platform.ownerOrgId, steps: [], unmanaged: [] };
+        if ((await this.authz.canApplyPlatform?.(this.actor)) !== true) {
+            await this.refusePlatform(empty, platform.ownerOrgId, 'not authorized to run the release tick');
+            throw new NotAuthorizedError(this.actor, platform.ownerOrgId);
+        }
+        await this.withMutationLease(PLATFORM_SCOPE, (reason) => this.refusePlatform(empty, platform.ownerOrgId, reason), async (fence) => {
+            const serviceIds = { ...(await deps.store.getServiceIds()) };
+            await this.runPlatformReleases(platform, {
+                recordedIds: () => ({ ...serviceIds }),
+                recordScopeId: (key, value) => {
+                    serviceIds[key] = value;
+                },
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => deps.store.putServiceIds({ ...serviceIds }, fence),
+            }, fence);
+        });
+    }
+    /**
+     * The recurring release run (ADR 0001): for every declared org with a blue/green entry, and the platform's
+     * archon when it declares one, takes the open requests, reads the health signal and moves traffic. Foundry has
+     * no scheduler of its own, so the host calls this every 10 minutes. An org that cannot run (the actor may not
+     * apply it, an apply holds its lease, a provider call fails) is reported by id and does not stop the others.
+     * A refusal is audited; a run that does nothing writes no audit row.
+     */
+    async runReleaseTick() {
+        const results = [];
+        for (const org of await this.store.list()) {
+            if (!org.hosting.entries.some((entry) => entry.blueGreen))
+                continue;
+            try {
+                await this.runOrgReleaseTick(org.id);
+                results.push({ target: org.id });
+            }
+            catch (e) {
+                results.push({ target: org.id, error: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        const platform = await this.platformDeps?.store.get();
+        if (platform?.archon.enabled && platform.archon.blueGreen) {
+            try {
+                await this.runPlatformReleaseTick();
+                results.push({ target: 'platform' });
+            }
+            catch (e) {
+                results.push({ target: 'platform', error: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        return results;
+    }
+    async runOrgReleaseTick(id) {
+        const empty = { orgId: id, steps: [], unmanaged: [] };
+        if (!(await this.authz.canApply(this.actor, id))) {
+            await this.refuse(empty, 'not authorized to run the release tick');
+            throw new NotAuthorizedError(this.actor, id);
+        }
+        await this.withMutationLease(companyScope(id), (reason) => this.refuse(empty, reason), async (fence) => {
+            const org = await this.store.get(id);
+            const previous = await this.store.getAppliedState(id);
+            if (!org || !previous)
+                return;
+            const serviceIds = { ...previous.serviceIds };
+            await this.runOrgReleases(org, {
+                recordedIds: () => ({ ...serviceIds }),
+                recordScopeId: (key, value) => {
+                    serviceIds[key] = value;
+                },
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => this.store.putAppliedState({ ...previous, serviceIds: { ...serviceIds } }, fence),
+            }, fence);
+        });
+    }
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     async readSfuPortsOpen(org) {
         const slot = org.services?.sfuSlot;
@@ -1048,6 +1192,10 @@ export class FoundryPlanApply {
             : false;
         const sfuPortsOpen = await this.readSfuPortsOpen(org);
         const resumable = await this.ownResumableRefs(org);
+        // Read only for an org that declares it; a failed read plans none and says so (`planBlueGreen`).
+        const blueGreenServers = org.hosting.entries.some((e) => e.blueGreen) && this.executor.blueGreenServers
+            ? await this.executor.blueGreenServers().catch(() => undefined)
+            : undefined;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
             loginHostServesDiscovery,
@@ -1066,6 +1214,18 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            ...(blueGreenServers ? { blueGreenServers } : {}),
+            ...(blueGreenServers && org.hosting.entries.some((e) => e.blueGreen && e.database)
+                ? {
+                    remoteDatabase: remoteDatabaseFactsFrom({
+                        org,
+                        servers: blueGreenServers,
+                        recorded,
+                        access: !platformReadiness.dnsBlocked ||
+                            ['dns', 'zones', 'access', 'tunnels'].every((port) => platformReadiness.ownEdgePorts?.[port]),
+                    }),
+                }
+                : {}),
             ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
             ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ...(this.backupGate
@@ -1391,8 +1551,21 @@ export class FoundryPlanApply {
             .map((org) => org.slug);
         const mailRelay = platform.mail.relay === true ? await this.mailRelayInputs() : null;
         const owner = await this.platformOwnerInput(platform);
+        const archonBlueGreen = platform.archon.enabled && platform.archon.blueGreen && executor.archonBlueGreen
+            ? await executor.archonBlueGreen().catch(() => ({ servers: undefined }))
+            : null;
         const detail = computePlatformPlanDetail(platform, live, {
             owner,
+            ...(archonBlueGreen
+                ? {
+                    archonBlueGreen: {
+                        servers: archonBlueGreen.servers,
+                        ...('blocked' in archonBlueGreen && archonBlueGreen.blocked
+                            ? { blocked: archonBlueGreen.blocked }
+                            : {}),
+                    },
+                }
+                : {}),
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
             callsOrgSlugs,
@@ -1515,6 +1688,14 @@ export class FoundryPlanApply {
                     serviceIds[`${system}:${kind}:${key}`] = result.resourceId;
                 }
             }
+            await this.runPlatformReleases(platform, {
+                recordedIds: context.recordedIds,
+                recordScopeId: context.recordScopeId,
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => store.putServiceIds(serviceIds, fence),
+            }, fence);
         }
         catch (e) {
             // Whatever completed stays recorded, as an org's apply does. A lost
@@ -1630,6 +1811,10 @@ function destroyTargets(serviceIds, orgId) {
             }
             continue;
         }
+        // Blue/green: the colors, balancers, stage, database sidecars and extra connectors, by recorded id, before
+        // the main database they connect to. Their keys carry no ':' (scope ids), so no prefix above finds them.
+        if (prefix === 'coolify:database:')
+            targets.push(...blueGreenDestroyTargets(serviceIds));
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix) || !id)
                 continue;
@@ -1745,10 +1930,44 @@ function destroyStepDescriptions(targets) {
         'delete the declared org',
     ];
 }
+/** Scope keys of the Coolify apps blue/green made: `bg.<entry>.app.<server>.<part>`, a database sidecar, a connector on another server. */
+const BLUE_GREEN_APP_KEY = /^(bg\.[^.:]+\.app\.[^.:]+\.[a-z]+|bgdb\.[^.:]+\.sidecar\.[^.:]+|cloudflare_tunnel_connector_app\.[^.:]+)$/;
+const BLUE_GREEN_DATABASE_KEY = /^bg\.[^.:]+\.stagedb$/;
+/** The database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
+const BLUE_GREEN_EDGE_KEYS = [
+    [/^bgdb\.[^.:]+\.access$/, 'bg-access'],
+    [/^bgdb\.[^.:]+\.(token|undelivered)$/, 'bg-token'],
+    [/^bgdb\.[^.:]+\.route$/, 'bg-dns'],
+];
+/** Every recorded blue/green app (then stage's database), in key order. A destroy target's `key` is the scope key itself. */
+function blueGreenDestroyTargets(serviceIds) {
+    const keys = Object.keys(serviceIds).sort();
+    const targets = [];
+    for (const key of keys.filter((k) => BLUE_GREEN_APP_KEY.test(k))) {
+        const id = serviceIds[key];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'bg-app', key, id });
+    }
+    for (const key of keys.filter((k) => BLUE_GREEN_DATABASE_KEY.test(k))) {
+        const id = serviceIds[key];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'bg-database', key, id });
+    }
+    for (const [pattern, kind] of BLUE_GREEN_EDGE_KEYS) {
+        for (const key of keys.filter((k) => pattern.test(k))) {
+            const id = serviceIds[key];
+            if (id)
+                targets.push({ system: 'cloudflare', kind, key, id });
+        }
+    }
+    return targets;
+}
 /** The `AppliedState.serviceIds` key a completed {@link DestroyTarget} should be removed from. */
 function destroyServiceIdKey(target) {
     if (target.kind === 'project' || target.kind === 'org')
         return target.key;
+    if (target.kind.startsWith('bg-'))
+        return target.key;
     if (target.kind === 'own-files-r2' && target.key === 'undelivered') {
         return OWN_FILES_R2_UNDELIVERED_SCOPE_KEY;
     }
@@ -1781,6 +2000,9 @@ const STEP_FIELDS = {
     'ai:key': 'ai',
     'cms:site': 'site',
     'coolify:app': 'hosting.enabled',
+    'coolify:bluegreen': 'hosting.entries.blueGreen',
+    'coolify:bluegreen-lb': 'hosting.entries.blueGreen',
+    'coolify:bluegreen-connector': 'hosting.entries.blueGreen',
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',

package/dist/plan/platform-diff.d.ts

@@ -1,6 +1,7 @@
 import type { DeclaredOrg, EnvSharedSecret, HostingEntry, OrgId } from '../org.js';
 import { type Plan, type PlanNote, type UnmanagedItem, type VersionChangeItem } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
+import { type BlueGreenServer } from './blue-green.js';
 import type { PlannedStep } from './diff.js';
 import type { LiveResource } from './live.js';
 import { type MailRoute, PLATFORM_MAIL_RELAY_KEY } from './mail-relay.js';
@@ -1092,6 +1093,14 @@ export declare function uptimeRecorded(recordedIds: Readonly<Record<string, stri
  * the merge comment that named this shape (#189).
  */
 export interface PlanPlatformOptions {
+    /**
+     * What `platform.archon.blueGreen` needs from the host: every Coolify server (`undefined`: it cannot list them)
+     * and why the executor cannot run it, if it cannot. Absent: nothing is planned for it.
+     */
+    archonBlueGreen?: {
+        servers: readonly BlueGreenServer[] | undefined;
+        blocked?: string;
+    };
     /** Whether the host supplies a Coolify reader for the platform (default `true`). */
     jobsObservable?: boolean;
     /** Why the shared SFU is blocked, or `null` when it is not (default `null`). */

package/dist/plan/platform-diff.js

@@ -3,6 +3,7 @@ import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
 import { heldEnvRef } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
+import { ARCHON_REPO, planArchonBlueGreen } from './blue-green.js';
 import { buildDriftNotes } from './build-record.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
@@ -11,6 +12,7 @@ import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
+import { archonInAppHost } from './sign-in-archon.js';
 import { signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 /**
@@ -1267,7 +1269,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailRoutesBlocked = [], recordedIds = {}, owner, liveBuilds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailRoutesBlocked = [], recordedIds = {}, owner, liveBuilds = {}, blocked = {}, drifted = {}, archonBlueGreen, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1385,6 +1387,27 @@ export function planPlatform(platform, live, options = {}) {
     const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld, blocked.uptimeChat);
     if (uptime.step)
         plannedSteps.push(uptime.step);
+    // Archon's app and tunnel are recorded by an earlier apply, so this runs before a last-placed archon step.
+    const archonBg = archonBlueGreen
+        ? planArchonBlueGreen({
+            platform,
+            repo: ARCHON_REPO,
+            recorded: recordedIds,
+            servers: archonBlueGreen.servers,
+            executorBlocked: archonBlueGreen.blocked,
+        })
+        : { step: null, unmanaged: [] };
+    if (archonBg.step) {
+        plannedSteps.push({
+            action: {
+                system: 'coolify',
+                kind: 'archon-bluegreen',
+                key: archonBg.step.key,
+                desired: archonBg.step.desired,
+            },
+            step: { description: archonBg.step.description, destroys: false, migrates: false },
+        });
+    }
     if (archon.step && blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
     // After Archon's own step: a repair that fails must not hold up the work before it.
@@ -1486,6 +1509,7 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: archonOrg.blocked, key: 'archon-org' });
     if (archon.blocked)
         unmanaged.push({ description: archon.blocked, key: 'archon' });
+    unmanaged.push(...archonBg.unmanaged);
     // #398: the old integrations key stays pinned until Archon holds the new
     // id; name that when Archon is what is stopping it.
     if (archon.blocked &&
@@ -3055,6 +3079,9 @@ function planArchon(platform, recordedIds, executorBlocked, ownerSignIn, ownerFi
         recordedIds[PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY] === ownerSignIn.organisationId &&
         (recordedIds[PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY] ?? '') ===
             archonFirstOwnerLink(recordedIds, ownerSignIn) &&
+        // In-app sign-in: Archon's own address is the sign-in address only once the owner company has the
+        // switch on and its in-app login is applied, and goes back to the company's login host when it does not.
+        archonInAppHost(recordedIds) === (ownerSignIn.signInInApp ? platform.archon.hostname : '') &&
         recordedIds[PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY] === archonOrgId &&
         !recordedIds[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY] &&
         Boolean(recordedIds[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY]) &&