@wtfalch/foundry 0.42.1 → 0.43.0

package/dist/plan/executor.d.ts

@@ -2,6 +2,7 @@ import type { OrgMailOptions, OrgMailOrg, OrgMailResult } from '@wtfalch/email/p
 import { type CallsSfuUrls } from '../calls-sfu.js';
 import type { DeclaredOrg, HostingBuildPack } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type BrokerPort } from './broker-entries.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import { type StepAction } from './diff.js';
@@ -16,6 +17,7 @@ import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
 import type { RequestHeaderPort } from './platform-providers.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
 /**
  * The Coolify calls this executor makes, shaped to match
@@ -103,6 +105,8 @@ export interface CoolifyPort {
      */
     getApplication(uuid: string): Promise<{
         uuid: string;
+        /** Coolify's name for the app; a blue/green entry's recorded app is its blue copy only when this is the blue name. */
+        name?: string;
         status?: string;
         custom_labels?: string | null;
         settings?: {
@@ -2141,6 +2145,34 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * actually be created on.
      */
     private resolveServer;
+    /**
+     * Contract C3: every usable, reachable Coolify server, the org's primary first. The primary is
+     * {@link resolveServer}'s (databases and single-copy services stay on it, unchanged). A server that is
+     * down is named in `down` and left out of `servers`; it is not an error.
+     */
+    resolveServers(org: DeclaredOrg, context: StepExecutionContext): Promise<{
+        primary: {
+            uuid: string;
+        };
+        servers: Array<{
+            uuid: string;
+        }>;
+        down: string[];
+    }>;
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`), or `null` while its
+     * blue copy is not recorded. The health token is only read here, never minted.
+     */
+    releaseHost(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
+    blueGreenServers(): Promise<BlueGreenServer[]>;
+    /**
+     * The blue/green steps (`plan/blue-green.ts`): `bluegreen` makes the apps and the balancer on one server,
+     * `bluegreen-lb` only writes the balancer's weights, `bluegreen-connector` runs the tunnel's connector on a
+     * server. A server that went down since the plan is skipped by `bluegreen-connector`'s caller, not here:
+     * a step for it fails, which the next plan reports instead.
+     */
+    private coolifyBlueGreen;
     private coolifyApp;
     /**
      * #75: mounts a persistent volume at {@link LOG_DIR} on the app, unless one
@@ -3009,6 +3041,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private ownSfu;
     private jobsRegistration;
+    /** The blue/green database route (`plan/remote-database.ts`). */
+    private remoteDatabaseRoute;
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     private deliverWithRetry;
     private cloudflareTunnel;

package/dist/plan/executor.js

@@ -7,6 +7,8 @@ import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
+import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { recordBuiltCommit } from './build-record.js';
@@ -44,6 +46,8 @@ import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { createReleaseHost } from './release-host.js';
+import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
@@ -883,7 +887,11 @@ function limitProfileOf(action) {
         case 'coolify:boule':
         case 'coolify:boule-broker-entry':
             return LIMITS.boule;
+        case 'coolify:bluegreen':
+        case 'coolify:bluegreen-lb':
+            return LIMITS.companyApp;
         case 'cloudflare:tunnel':
+        case 'coolify:bluegreen-connector':
             return LIMITS.connector;
         default:
             return action.system === 'coolify' ? LIMITS.companyOther : undefined;
@@ -1109,6 +1117,10 @@ export class FoundryStepExecutor {
                 return this.coolifyApp(action, org, context);
             case 'coolify:network':
                 return this.coolifyNetwork(action, org, context);
+            case 'coolify:bluegreen':
+            case 'coolify:bluegreen-lb':
+            case 'coolify:bluegreen-connector':
+                return this.coolifyBlueGreen(action, org, context);
             case 'coolify:broker-entry':
                 return this.coolifyBrokerEntry(action, org, context);
             case 'coolify:database':
@@ -1169,6 +1181,8 @@ export class FoundryStepExecutor {
                 return this.bouleBrokerEntry(org, context);
             case 'jobs:registration':
                 return this.jobsRegistration(action, org, context);
+            case 'cloudflare:db-route':
+                return this.remoteDatabaseRoute(action, org, context);
             case 'coolify:own-auth':
                 return this.ownAuth(action, org, context);
             case 'coolify:own-auth-db-move':
@@ -2501,6 +2515,140 @@ export class FoundryStepExecutor {
         context.recordScopeId(COOLIFY_SERVER_SCOPE_KEY, server.uuid);
         return server;
     }
+    /**
+     * Contract C3: every usable, reachable Coolify server, the org's primary first. The primary is
+     * {@link resolveServer}'s (databases and single-copy services stay on it, unchanged). A server that is
+     * down is named in `down` and left out of `servers`; it is not an error.
+     */
+    async resolveServers(org, context) {
+        const primary = await this.resolveServer(org, context);
+        const { up, down } = splitServers(await this.blueGreenServers());
+        return {
+            primary,
+            servers: [primary, ...up.filter((uuid) => uuid !== primary.uuid).map((uuid) => ({ uuid }))],
+            down,
+        };
+    }
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`), or `null` while its
+     * blue copy is not recorded. The health token is only read here, never minted.
+     */
+    releaseHost(org, subject, context, renew) {
+        const recorded = context.recordedIds();
+        const primaryBlueAppId = recorded[`coolify:app:${appStepKey(org, subject.id)}`];
+        const primaryUuid = recorded[COOLIFY_SERVER_SCOPE_KEY];
+        if (!primaryBlueAppId || !primaryUuid)
+            return null;
+        return createReleaseHost({
+            subject,
+            context,
+            coolify: this.ports.coolify,
+            healthToken: async () => (await this.ports.heldKeys?.resolve(sharedSecretRef(org.id, healthTokenName(subject.id)))) ?? null,
+            secret: (value) => void this.handledSecrets.add(value),
+            primaryUuid,
+            primaryBlueAppId,
+            runtime: this.ports.runtime ?? {},
+            ...(this.ports.runtime?.fetch ? { fetch: this.ports.runtime.fetch } : {}),
+            renew,
+            label: `coolify:release:${subject.id}`,
+        });
+    }
+    /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
+    async blueGreenServers() {
+        return (await this.ports.coolify.listServers()).map((s) => ({
+            uuid: s.uuid,
+            usable: s.is_usable,
+            reachable: s.is_reachable,
+        }));
+    }
+    /**
+     * The blue/green steps (`plan/blue-green.ts`): `bluegreen` makes the apps and the balancer on one server,
+     * `bluegreen-lb` only writes the balancer's weights, `bluegreen-connector` runs the tunnel's connector on a
+     * server. A server that went down since the plan is skipped by `bluegreen-connector`'s caller, not here:
+     * a step for it fails, which the next plan reports instead.
+     */
+    async coolifyBlueGreen(action, org, context) {
+        const recorded = () => context.recordedIds();
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const serverUuid = String(action.desired.server ?? '');
+        const primaryUuid = String(action.desired.primary ?? '');
+        const live = await this.resolveServers(org, context);
+        if (!live.servers.some((s) => s.uuid === serverUuid)) {
+            throw new Error(`${action.kind} for ${org.slug}: Coolify server ${serverUuid} is not usable and reachable`);
+        }
+        if (live.primary.uuid !== primaryUuid) {
+            throw new Error(`${action.kind} for ${org.slug}: the plan's primary server is not the recorded one`);
+        }
+        if (action.kind === 'bluegreen-connector') {
+            const tunnelId = recorded()[`cloudflare:tunnel:${org.id}`];
+            if (!tunnelId)
+                throw new Error(`bluegreen-connector for ${org.slug}: the tunnel is not recorded yet`);
+            await applyBlueGreenConnectors({
+                coolify: this.ports.coolify,
+                tunnels: this.tunnelPort(),
+                tunnelId,
+                baseAppName: `${org.slug}-cloudflared`,
+                baseScopeKey: CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY,
+                primaryUuid,
+                serverUuids: [serverUuid],
+                projectUuid,
+                environment,
+                recorded,
+                record: (key, id) => context.recordScopeId(key, id),
+                persist: () => context.persistScopeIds(),
+            });
+            return undefined;
+        }
+        const entry = org.hosting.entries.find((e) => e.key === action.desired.entry);
+        if (!entry || !entrySubject(org, entry)) {
+            throw new Error(`${action.kind} for ${org.slug}: no blue/green entry '${String(action.desired.entry)}'`);
+        }
+        const primaryBlueAppId = recorded()[`coolify:app:${appStepKey(org, entry.key)}`];
+        if (!primaryBlueAppId) {
+            throw new Error(`${action.kind} for ${org.slug}: entry '${entry.key}' has no blue app recorded yet`);
+        }
+        // The blue app keeps the name it has: an app that ran before blue/green is adopted under its own name.
+        if (!recorded()[bgKey.blueName(entry.key)]) {
+            const blue = await this.ports.coolify.getApplication(primaryBlueAppId);
+            if (blue.name) {
+                context.recordScopeId(bgKey.blueName(entry.key), blue.name);
+                await context.persistScopeIds();
+            }
+        }
+        const subject = entrySubject(org, entry, recorded());
+        const runtime = this.ports.runtime ?? {};
+        const deps = {
+            coolify: this.ports.coolify,
+            recorded,
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+            projectUuid,
+            environment,
+            healthToken: async () => {
+                if (typeof this.ports.heldKeys?.put !== 'function') {
+                    throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the health token`);
+                }
+                const token = await this.ensureSharedSecret(org, healthTokenName(entry.key), recorded());
+                this.handledSecrets.add(token);
+                return token;
+            },
+            secret: (value) => void this.handledSecrets.add(value),
+            runtime,
+            sleep: runtime.sleep ?? defaultSleep,
+            label: `${action.system}:${action.kind}:${entry.key}`,
+            primaryBlueAppId,
+            logDir: LOG_DIR,
+            isRunning: isRunningOrStarting,
+        };
+        if (action.kind === 'bluegreen-lb') {
+            await applyBlueGreenWeights(deps, subject, { uuid: serverUuid, primaryUuid });
+        }
+        else {
+            await applyBlueGreenServer(deps, subject, { uuid: serverUuid, primaryUuid });
+        }
+        return undefined;
+    }
     async coolifyApp(action, org, context) {
         const recordedAppId = context.recordedIds()[`coolify:app:${action.key}`];
         if (action.desired.enabled === false) {
@@ -2538,6 +2686,11 @@ export class FoundryStepExecutor {
         }
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        // A blue/green entry's app is its blue copy. An app that ran before blue/green keeps its own name and is
+        // adopted as blue; an entry with no app yet gets `<base>-blue`. The name is recorded once decided.
+        const blueNameKey = bgKey.blueName(entry.key);
+        const blueNameRecorded = Boolean(context.recordedIds()[blueNameKey]);
+        let appName = liveAppNameFor(org, entry, context.recordedIds());
         // The recorded id first; the name when nothing is recorded, or when the
         // recorded app is gone.
         let existing = null;
@@ -2546,17 +2699,35 @@ export class FoundryStepExecutor {
             try {
                 live = await this.ports.coolify.getApplication(recordedAppId);
                 existing = { uuid: recordedAppId };
+                if (entry.blueGreen &&
+                    !blueNameRecorded &&
+                    live.name === colorAppName(appNameFor(org, entry), 'blue')) {
+                    appName = live.name;
+                }
             }
             catch (error) {
                 if (!isNotFoundError(error))
                     throw error;
             }
         }
+        if (!existing && entry.blueGreen && !blueNameRecorded) {
+            const own = await this.ports.coolify.findApplicationByName(appNameFor(org, entry), {
+                environmentIds: [environment.id],
+            });
+            if (own) {
+                existing = own;
+                appName = appNameFor(org, entry);
+            }
+        }
         if (!existing) {
-            existing = await this.ports.coolify.findApplicationByName(appNameFor(org, entry), {
+            existing = await this.ports.coolify.findApplicationByName(appName, {
                 environmentIds: [environment.id],
             });
         }
+        if (entry.blueGreen && !blueNameRecorded) {
+            context.recordScopeId(blueNameKey, appName);
+            await context.persistScopeIds();
+        }
         // No entry gets Coolify `domains`: Coolify would add a Traefik router for them. The company's
         // tunnel routes an entry's names straight to its container (also `<slug>.oikos.host`, through a
         // record in the platform's oikos.host zone), which every entry reaches as `<slug>-<key>` (its
@@ -2602,7 +2773,7 @@ export class FoundryStepExecutor {
                 git_repository: appRepo,
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
-                name: appNameFor(org, entry),
+                name: appName,
                 autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
@@ -2655,7 +2826,7 @@ export class FoundryStepExecutor {
             patch.domains = '';
         }
         if (!existing || patch.domains !== undefined) {
-            patch.custom_internal_name = appNameFor(org, entry);
+            patch.custom_internal_name = appName;
         }
         // A `*` entry's proxy labels: Coolify takes `custom_labels` base64 encoded
         // and uses them instead of the labels it generates from `domains`. Rule 4:
@@ -2709,8 +2880,8 @@ export class FoundryStepExecutor {
         // `ensureLogVolume` whether this app was already running before this
         // call -- see its own doc comment for why that decides whether to
         // restart it.
-        await this.ensureLogVolume(appId, org, Boolean(existing), appNameFor(org, entry));
-        await this.ensureEntryVolumes(appId, entry, Boolean(existing), appNameFor(org, entry));
+        await this.ensureLogVolume(appId, org, Boolean(existing), appName);
+        await this.ensureEntryVolumes(appId, entry, Boolean(existing), appName);
         // The app receives whatever it needs to sign in (gap P2). Unconditional,
         // unlike the database push above: every app has a hostname, and an
         // upsert of the same value on a later apply is a no-op, not a change.
@@ -2741,8 +2912,10 @@ export class FoundryStepExecutor {
             // The public name answers from the container only once the tunnel step has written the
             // direct route; before that (a first apply, or the one that moves it) the deployment is the check.
             hostname &&
+                // The public name goes through the balancer, which may answer from the other color.
+                !entry.blueGreen &&
                 (context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') ===
-                    entryRoutesMarker(org)
+                    entryRoutesMarker(org, context.recordedIds())
                 ? publicHealthCheck(org, context.recordedIds(), hostname, healthPath)
                 : { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, `coolify:app:${entry.key}`, `${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} stays at its previous deploy`);
             await recordBuiltCommit(this.ports.coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: entry.key }, (key, value) => context.recordScopeId(key, value));
@@ -6258,6 +6431,42 @@ export class FoundryStepExecutor {
         }
         return { resourceId: registered.id };
     }
+    /** The blue/green database route (`plan/remote-database.ts`). */
+    async remoteDatabaseRoute(action, org, context) {
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const desired = action.desired;
+        // The tunnel's TCP rule names the database by the host the apps' own `DATABASE_URL` uses.
+        const db = await this.ports.coolify.getDatabase(desired.database);
+        if (db.internal_db_url)
+            this.handledSecrets.add(db.internal_db_url);
+        let databaseHost = '';
+        try {
+            databaseHost = new URL(db.internal_db_url ?? '').hostname;
+        }
+        catch {
+            // Fixed text below: the URL holds the database password.
+        }
+        if (!databaseHost) {
+            throw new Error(`cloudflare:db-route for ${org.slug}: the database reports no usable address`);
+        }
+        await applyRemoteDatabase({
+            tunnels: this.tunnelPort(),
+            access: this.accessPort(),
+            dns: this.dnsPort(),
+            zones: this.zonePort(),
+            coolify: this.ports.coolify,
+            secret: (value) => void this.handledSecrets.add(value),
+        }, {
+            org,
+            desired,
+            databaseHost,
+            projectUuid,
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+        });
+        return {};
+    }
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     async deliverWithRetry(ref, value) {
         for (let attempt = 1; attempt <= JOBS_DELIVERY_ATTEMPTS; attempt++) {
@@ -6337,17 +6546,19 @@ export class FoundryStepExecutor {
         const loginHost = action.desired.loginHost ?? null;
         // A hosting entry's names (and its wildcard) go straight to its container on the company network:
         // the container carries `traefik.enable=false`, so the proxy has no route for it.
-        const entryOrigins = new Map(entryRoutes(org).map((r) => [r.hostname, r.service]));
+        const entryOrigins = new Map(entryRoutes(org, context.recordedIds()).map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
                 ? `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`
                 : (entryOrigins.get(hostname) ?? COOLIFY_PROXY_ORIGIN),
         }));
+        const httpIngress = [...ingress, { service: 'http_status:404' }];
         await this.tunnelPort().putTunnelConfig(tunnel.id, {
-            ingress: [...ingress, { service: 'http_status:404' }],
+            ingress: mergeTcpIngress(httpIngress, recordedTcpRoutes(context.recordedIds())),
         });
-        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org));
+        context.recordScopeId(TUNNEL_HTTP_INGRESS_SCOPE_KEY, JSON.stringify(httpIngress));
+        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org, context.recordedIds()));
         // #235: a connector for this org's own tunnel, the same call every
         // platform tunnel step already makes (Decided, William, 2026-10-01:
         // one connector per org tunnel, never a shared tunnel with appended
@@ -8114,8 +8325,32 @@ export class FoundryStepExecutor {
                     return;
                 }
                 case 'coolify:app':
+                case 'coolify:bg-app':
                     await this.ports.coolify.deleteApplication(target.id);
                     return;
+                case 'cloudflare:bg-access':
+                    await this.accessPort().deleteAccessApp(target.id);
+                    return;
+                case 'cloudflare:bg-token':
+                    await this.accessPort().removeServiceToken(target.id);
+                    return;
+                case 'cloudflare:bg-dns': {
+                    // `target.id` is the recorded route ({ hostname, service }); its name lives in the org's zone.
+                    const hostname = JSON.parse(target.id).hostname;
+                    const zone = org.domain ? await this.zonePort().findZoneByApex(org.domain) : undefined;
+                    if (typeof hostname !== 'string' || !zone)
+                        return;
+                    const dns = this.dnsPort();
+                    for (const record of await dns.findDnsRecord(zone.name, hostname, 'CNAME')) {
+                        if (record.content.endsWith('.cfargotunnel.com')) {
+                            await dns.deleteDnsRecord(zone.name, record.id);
+                        }
+                    }
+                    return;
+                }
+                case 'coolify:bg-database':
+                    await this.ports.coolify.deleteDatabase(target.id);
+                    return;
                 case 'coolify:database':
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;

package/dist/plan/plan-apply.d.ts

@@ -2,18 +2,21 @@ import type { DestroyProgress, PlanApply } from '../apply.js';
 import type { DeclaredOrg, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
+import type { ReleaseStore } from '../release/state.js';
 import type { JobRunner } from '../runner/types.js';
 import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
 import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js';
 import { type AgoraHostPort } from './agora.js';
 import { type MoveGatePorts } from './backup-gate.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
     readonly id: string;
@@ -205,6 +208,17 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** Every Coolify server with whether it is usable and reachable; blue/green plans copies on each. Optional: an executor without it plans no blue/green. */
+    blueGreenServers?(): Promise<Array<{
+        uuid: string;
+        usable: boolean;
+        reachable: boolean;
+    }>>;
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`); `null` while its blue
+     * copy is not recorded. Optional: an executor without it runs no release.
+     */
+    releaseHost?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
     /** Whether the executor's held keys can store the sign-in database's CA and certificate (#746). Absent: true. */
     ownSigninDbKeysPuttable?(): boolean;
     /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). Absent: true. */
@@ -325,6 +339,16 @@ export interface PlatformStepExecutor {
      * one), or `null` when nothing changed.
      */
     refreshFilesShare?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<Record<string, string> | null>;
+    /**
+     * The Coolify servers and the reason platform-archon's blue/green cannot run (the executor cannot hold the
+     * health token), for the plan. Optional: an executor without it plans no blue/green for archon.
+     */
+    archonBlueGreen?(): Promise<{
+        servers?: BlueGreenServer[];
+        blocked?: string;
+    }>;
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`); `null` while its app is not recorded. */
+    releaseHost?(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -510,6 +534,11 @@ export interface FoundryPlanApplyOptions {
         step(action: StepAction): boolean;
         blocked(key: string): boolean;
     };
+    /**
+     * The release requests (Archon's promote, roll back, clear held and decide-at-cap clicks), consumed once each by
+     * the release runner. Without it no release runs, in an apply or in {@link FoundryPlanApply.runReleaseTick}.
+     */
+    releaseStore?: ReleaseStore;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -605,6 +634,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly backupGate;
     private readonly platformDeps;
     private readonly runner;
+    private readonly releaseStore;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     /**
@@ -741,6 +771,27 @@ export declare class FoundryPlanApply implements PlanApply {
     private refusePlatform;
     private refuseDestroy;
     private runSteps;
+    /**
+     * ADR 0001: one release run for each blue/green entry whose structure is applied, writing into `context`
+     * (the live ids of the run that holds the lease). A weight the runner changed reaches every server's balancer
+     * before this returns.
+     */
+    private runOrgReleases;
+    /** One release run for platform-archon, on the platform's live ids; see {@link runOrgReleases}. */
+    private runPlatformReleases;
+    private runPlatformReleaseTick;
+    /**
+     * The recurring release run (ADR 0001): for every declared org with a blue/green entry, and the platform's
+     * archon when it declares one, takes the open requests, reads the health signal and moves traffic. Foundry has
+     * no scheduler of its own, so the host calls this every 10 minutes. An org that cannot run (the actor may not
+     * apply it, an apply holds its lease, a provider call fails) is reported by id and does not stop the others.
+     * A refusal is audited; a run that does nothing writes no audit row.
+     */
+    runReleaseTick(): Promise<Array<{
+        target: string;
+        error?: string;
+    }>>;
+    private runOrgReleaseTick;
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     private readSfuPortsOpen;
     private computeFreshPlan;