@wtfalch/foundry 0.42.1 → 0.43.0

package/dist/plan/plan-apply.js

@@ -8,6 +8,7 @@ import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { NetworkMoveBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
+import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, entrySubject, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
@@ -25,6 +26,8 @@ import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILE
 import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
+import { runSubjectRelease } from './release-host.js';
+import { remoteDatabaseFactsFrom } from './remote-database.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
@@ -119,6 +122,9 @@ export class PlatformConfirmationRequiredError extends Error {
 /** The steps that read an entry's hostnames: `computeFreshPlan` drops them for an org whose hosting is invalid. */
 const HOSTNAME_STEPS = new Set([
     'coolify:app',
+    'coolify:bluegreen',
+    'coolify:bluegreen-lb',
+    'coolify:bluegreen-connector',
     'coolify:broker-entry',
     'coolify:database',
     'cloudflare:tunnel',
@@ -167,6 +173,7 @@ export class FoundryPlanApply {
     backupGate;
     platformDeps;
     runner;
+    releaseStore;
     constructor(options) {
         this.store = options.store;
         this.readers = options.readers;
@@ -195,6 +202,7 @@ export class FoundryPlanApply {
         this.backupGate = options.backupGate;
         this.platformDeps = options.platform;
         this.runner = options.runner;
+        this.releaseStore = options.releaseStore;
     }
     async plan(id) {
         const { plan } = await this.computeFreshPlan(id);
@@ -953,6 +961,13 @@ export class FoundryPlanApply {
                 }
                 checkpoints.push({ step: planned.step.description, completedAt: this.now().toISOString() });
             }
+            // The steps made the structure; the release runner then moves traffic on it, on the same live ids.
+            await this.runOrgReleases(org, {
+                recordedIds: context.recordedIds,
+                recordScopeId: context.recordScopeId,
+                forgetId: (key) => context.forgetId?.(key),
+                persist: context.persistScopeIds,
+            }, fence);
         }
         catch (e) {
             // #9 (resolved): "it stops at the checkpoint... there is no automatic
@@ -1012,6 +1027,135 @@ export class FoundryPlanApply {
         });
         return applied;
     }
+    /**
+     * ADR 0001: one release run for each blue/green entry whose structure is applied, writing into `context`
+     * (the live ids of the run that holds the lease). A weight the runner changed reaches every server's balancer
+     * before this returns.
+     */
+    async runOrgReleases(org, context, fence) {
+        const store = this.releaseStore;
+        const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
+        if (!store || !this.executor.releaseHost || !primaryUuid)
+            return;
+        for (const entry of org.hosting.entries) {
+            const subject = entrySubject(org, entry, context.recordedIds());
+            if (!subject)
+                continue;
+            const host = this.executor.releaseHost(org, subject, context, () => this.renewLease(fence));
+            if (!host)
+                continue;
+            await runSubjectRelease({
+                store,
+                scopeOwnerId: org.id,
+                subject,
+                host,
+                context,
+                now: this.now(),
+                primaryUuid,
+            });
+        }
+    }
+    /** One release run for platform-archon, on the platform's live ids; see {@link runOrgReleases}. */
+    async runPlatformReleases(platform, context, fence) {
+        const store = this.releaseStore;
+        const executor = this.platformDeps?.executor;
+        const subject = archonSubject(platform, ARCHON_REPO);
+        const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
+        if (!store || !executor?.releaseHost || !subject || !primaryUuid)
+            return;
+        const host = executor.releaseHost(platform, subject, context, () => this.renewLease(fence));
+        if (!host)
+            return;
+        await runSubjectRelease({
+            store,
+            scopeOwnerId: 'platform',
+            subject,
+            host,
+            context,
+            now: this.now(),
+            primaryUuid,
+        });
+    }
+    async runPlatformReleaseTick() {
+        const deps = this.platformDeps;
+        const platform = await deps?.store.get();
+        if (!deps || !platform)
+            return;
+        const empty = { orgId: platform.ownerOrgId, steps: [], unmanaged: [] };
+        if ((await this.authz.canApplyPlatform?.(this.actor)) !== true) {
+            await this.refusePlatform(empty, platform.ownerOrgId, 'not authorized to run the release tick');
+            throw new NotAuthorizedError(this.actor, platform.ownerOrgId);
+        }
+        await this.withMutationLease(PLATFORM_SCOPE, (reason) => this.refusePlatform(empty, platform.ownerOrgId, reason), async (fence) => {
+            const serviceIds = { ...(await deps.store.getServiceIds()) };
+            await this.runPlatformReleases(platform, {
+                recordedIds: () => ({ ...serviceIds }),
+                recordScopeId: (key, value) => {
+                    serviceIds[key] = value;
+                },
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => deps.store.putServiceIds({ ...serviceIds }, fence),
+            }, fence);
+        });
+    }
+    /**
+     * The recurring release run (ADR 0001): for every declared org with a blue/green entry, and the platform's
+     * archon when it declares one, takes the open requests, reads the health signal and moves traffic. Foundry has
+     * no scheduler of its own, so the host calls this every 10 minutes. An org that cannot run (the actor may not
+     * apply it, an apply holds its lease, a provider call fails) is reported by id and does not stop the others.
+     * A refusal is audited; a run that does nothing writes no audit row.
+     */
+    async runReleaseTick() {
+        const results = [];
+        for (const org of await this.store.list()) {
+            if (!org.hosting.entries.some((entry) => entry.blueGreen))
+                continue;
+            try {
+                await this.runOrgReleaseTick(org.id);
+                results.push({ target: org.id });
+            }
+            catch (e) {
+                results.push({ target: org.id, error: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        const platform = await this.platformDeps?.store.get();
+        if (platform?.archon.enabled && platform.archon.blueGreen) {
+            try {
+                await this.runPlatformReleaseTick();
+                results.push({ target: 'platform' });
+            }
+            catch (e) {
+                results.push({ target: 'platform', error: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        return results;
+    }
+    async runOrgReleaseTick(id) {
+        const empty = { orgId: id, steps: [], unmanaged: [] };
+        if (!(await this.authz.canApply(this.actor, id))) {
+            await this.refuse(empty, 'not authorized to run the release tick');
+            throw new NotAuthorizedError(this.actor, id);
+        }
+        await this.withMutationLease(companyScope(id), (reason) => this.refuse(empty, reason), async (fence) => {
+            const org = await this.store.get(id);
+            const previous = await this.store.getAppliedState(id);
+            if (!org || !previous)
+                return;
+            const serviceIds = { ...previous.serviceIds };
+            await this.runOrgReleases(org, {
+                recordedIds: () => ({ ...serviceIds }),
+                recordScopeId: (key, value) => {
+                    serviceIds[key] = value;
+                },
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => this.store.putAppliedState({ ...previous, serviceIds: { ...serviceIds } }, fence),
+            }, fence);
+        });
+    }
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     async readSfuPortsOpen(org) {
         const slot = org.services?.sfuSlot;
@@ -1048,6 +1192,10 @@ export class FoundryPlanApply {
             : false;
         const sfuPortsOpen = await this.readSfuPortsOpen(org);
         const resumable = await this.ownResumableRefs(org);
+        // Read only for an org that declares it; a failed read plans none and says so (`planBlueGreen`).
+        const blueGreenServers = org.hosting.entries.some((e) => e.blueGreen) && this.executor.blueGreenServers
+            ? await this.executor.blueGreenServers().catch(() => undefined)
+            : undefined;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
             loginHostServesDiscovery,
@@ -1066,6 +1214,18 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            ...(blueGreenServers ? { blueGreenServers } : {}),
+            ...(blueGreenServers && org.hosting.entries.some((e) => e.blueGreen && e.database)
+                ? {
+                    remoteDatabase: remoteDatabaseFactsFrom({
+                        org,
+                        servers: blueGreenServers,
+                        recorded,
+                        access: !platformReadiness.dnsBlocked ||
+                            ['dns', 'zones', 'access', 'tunnels'].every((port) => platformReadiness.ownEdgePorts?.[port]),
+                    }),
+                }
+                : {}),
             ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
             ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ...(this.backupGate
@@ -1391,8 +1551,21 @@ export class FoundryPlanApply {
             .map((org) => org.slug);
         const mailRelay = platform.mail.relay === true ? await this.mailRelayInputs() : null;
         const owner = await this.platformOwnerInput(platform);
+        const archonBlueGreen = platform.archon.enabled && platform.archon.blueGreen && executor.archonBlueGreen
+            ? await executor.archonBlueGreen().catch(() => ({ servers: undefined }))
+            : null;
         const detail = computePlatformPlanDetail(platform, live, {
             owner,
+            ...(archonBlueGreen
+                ? {
+                    archonBlueGreen: {
+                        servers: archonBlueGreen.servers,
+                        ...('blocked' in archonBlueGreen && archonBlueGreen.blocked
+                            ? { blocked: archonBlueGreen.blocked }
+                            : {}),
+                    },
+                }
+                : {}),
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
             callsOrgSlugs,
@@ -1515,6 +1688,14 @@ export class FoundryPlanApply {
                     serviceIds[`${system}:${kind}:${key}`] = result.resourceId;
                 }
             }
+            await this.runPlatformReleases(platform, {
+                recordedIds: context.recordedIds,
+                recordScopeId: context.recordScopeId,
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => store.putServiceIds(serviceIds, fence),
+            }, fence);
         }
         catch (e) {
             // Whatever completed stays recorded, as an org's apply does. A lost
@@ -1630,6 +1811,10 @@ function destroyTargets(serviceIds, orgId) {
             }
             continue;
         }
+        // Blue/green: the colors, balancers, stage, database sidecars and extra connectors, by recorded id, before
+        // the main database they connect to. Their keys carry no ':' (scope ids), so no prefix above finds them.
+        if (prefix === 'coolify:database:')
+            targets.push(...blueGreenDestroyTargets(serviceIds));
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix) || !id)
                 continue;
@@ -1745,10 +1930,44 @@ function destroyStepDescriptions(targets) {
         'delete the declared org',
     ];
 }
+/** Scope keys of the Coolify apps blue/green made: `bg.<entry>.app.<server>.<part>`, a database sidecar, a connector on another server. */
+const BLUE_GREEN_APP_KEY = /^(bg\.[^.:]+\.app\.[^.:]+\.[a-z]+|bgdb\.[^.:]+\.sidecar\.[^.:]+|cloudflare_tunnel_connector_app\.[^.:]+)$/;
+const BLUE_GREEN_DATABASE_KEY = /^bg\.[^.:]+\.stagedb$/;
+/** The database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
+const BLUE_GREEN_EDGE_KEYS = [
+    [/^bgdb\.[^.:]+\.access$/, 'bg-access'],
+    [/^bgdb\.[^.:]+\.(token|undelivered)$/, 'bg-token'],
+    [/^bgdb\.[^.:]+\.route$/, 'bg-dns'],
+];
+/** Every recorded blue/green app (then stage's database), in key order. A destroy target's `key` is the scope key itself. */
+function blueGreenDestroyTargets(serviceIds) {
+    const keys = Object.keys(serviceIds).sort();
+    const targets = [];
+    for (const key of keys.filter((k) => BLUE_GREEN_APP_KEY.test(k))) {
+        const id = serviceIds[key];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'bg-app', key, id });
+    }
+    for (const key of keys.filter((k) => BLUE_GREEN_DATABASE_KEY.test(k))) {
+        const id = serviceIds[key];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'bg-database', key, id });
+    }
+    for (const [pattern, kind] of BLUE_GREEN_EDGE_KEYS) {
+        for (const key of keys.filter((k) => pattern.test(k))) {
+            const id = serviceIds[key];
+            if (id)
+                targets.push({ system: 'cloudflare', kind, key, id });
+        }
+    }
+    return targets;
+}
 /** The `AppliedState.serviceIds` key a completed {@link DestroyTarget} should be removed from. */
 function destroyServiceIdKey(target) {
     if (target.kind === 'project' || target.kind === 'org')
         return target.key;
+    if (target.kind.startsWith('bg-'))
+        return target.key;
     if (target.kind === 'own-files-r2' && target.key === 'undelivered') {
         return OWN_FILES_R2_UNDELIVERED_SCOPE_KEY;
     }
@@ -1781,6 +2000,9 @@ const STEP_FIELDS = {
     'ai:key': 'ai',
     'cms:site': 'site',
     'coolify:app': 'hosting.enabled',
+    'coolify:bluegreen': 'hosting.entries.blueGreen',
+    'coolify:bluegreen-lb': 'hosting.entries.blueGreen',
+    'coolify:bluegreen-connector': 'hosting.entries.blueGreen',
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',

package/dist/plan/platform-diff.d.ts

@@ -1,6 +1,7 @@
 import type { DeclaredOrg, EnvSharedSecret, HostingEntry, OrgId } from '../org.js';
 import { type Plan, type PlanNote, type UnmanagedItem, type VersionChangeItem } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
+import { type BlueGreenServer } from './blue-green.js';
 import type { PlannedStep } from './diff.js';
 import type { LiveResource } from './live.js';
 import { type MailRoute, PLATFORM_MAIL_RELAY_KEY } from './mail-relay.js';
@@ -1092,6 +1093,14 @@ export declare function uptimeRecorded(recordedIds: Readonly<Record<string, stri
  * the merge comment that named this shape (#189).
  */
 export interface PlanPlatformOptions {
+    /**
+     * What `platform.archon.blueGreen` needs from the host: every Coolify server (`undefined`: it cannot list them)
+     * and why the executor cannot run it, if it cannot. Absent: nothing is planned for it.
+     */
+    archonBlueGreen?: {
+        servers: readonly BlueGreenServer[] | undefined;
+        blocked?: string;
+    };
     /** Whether the host supplies a Coolify reader for the platform (default `true`). */
     jobsObservable?: boolean;
     /** Why the shared SFU is blocked, or `null` when it is not (default `null`). */

package/dist/plan/platform-diff.js

@@ -3,6 +3,7 @@ import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
 import { heldEnvRef } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
+import { ARCHON_REPO, planArchonBlueGreen } from './blue-green.js';
 import { buildDriftNotes } from './build-record.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
@@ -1268,7 +1269,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailRoutesBlocked = [], recordedIds = {}, owner, liveBuilds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailRoutesBlocked = [], recordedIds = {}, owner, liveBuilds = {}, blocked = {}, drifted = {}, archonBlueGreen, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1386,6 +1387,27 @@ export function planPlatform(platform, live, options = {}) {
     const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld, blocked.uptimeChat);
     if (uptime.step)
         plannedSteps.push(uptime.step);
+    // Archon's app and tunnel are recorded by an earlier apply, so this runs before a last-placed archon step.
+    const archonBg = archonBlueGreen
+        ? planArchonBlueGreen({
+            platform,
+            repo: ARCHON_REPO,
+            recorded: recordedIds,
+            servers: archonBlueGreen.servers,
+            executorBlocked: archonBlueGreen.blocked,
+        })
+        : { step: null, unmanaged: [] };
+    if (archonBg.step) {
+        plannedSteps.push({
+            action: {
+                system: 'coolify',
+                kind: 'archon-bluegreen',
+                key: archonBg.step.key,
+                desired: archonBg.step.desired,
+            },
+            step: { description: archonBg.step.description, destroys: false, migrates: false },
+        });
+    }
     if (archon.step && blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
     // After Archon's own step: a repair that fails must not hold up the work before it.
@@ -1487,6 +1509,7 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: archonOrg.blocked, key: 'archon-org' });
     if (archon.blocked)
         unmanaged.push({ description: archon.blocked, key: 'archon' });
+    unmanaged.push(...archonBg.unmanaged);
     // #398: the old integrations key stays pinned until Archon holds the new
     // id; name that when Archon is what is stopping it.
     if (archon.blocked &&

package/dist/plan/platform-providers.d.ts

@@ -2,6 +2,7 @@ import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { type DeclaredOrg } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { DeclaredOrgStore, PlatformStore } from '../store.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import type { StepAction } from './diff.js';
 import type { AccessPort } from './edge-access.js';
@@ -10,6 +11,7 @@ import type { RateLimitPort } from './edge-ratelimits.js';
 import type { TunnelPort } from './edge-tunnels.js';
 import type { ZonePort } from './edge-zones.js';
 import type { CloudflarePort, CoolifyPort, FoundryStepExecutorPorts, ZitadelPort } from './executor.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } from './live.js';
 import { type OikosIngressPorts } from './oikos-ingress.js';
@@ -349,6 +351,14 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private onPlatform;
     /** `deps` with its Coolify port placed on the platform destination, then limited by `profile`. */
     private limitedOnPlatform;
+    /** Every Coolify server and why platform-archon's blue/green cannot run here, for the planner. */
+    archonBlueGreen(): Promise<{
+        servers?: BlueGreenServer[];
+        blocked?: string;
+    }>;
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`). The token is only read. */
+    releaseHost(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    private archonBlueGreenStep;
     blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<{
         auth?: string;
         authExecutorMissing?: boolean;
@@ -896,7 +906,9 @@ export declare function ownerInviteBlockedReason(ownerCompany: DeclaredOrg | nul
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'listEnvironments' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'listEnvironments' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment' | 'listStorages' | 'createPersistentStorage' | 'createFileStorage' | 'updateFileStorage'> & {
+        listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
+    };
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -972,6 +984,8 @@ export interface PlatformArchonRuntime {
     readyTimeoutMs?: number;
     /** Pause between readiness polls (default 5 seconds). */
     readyIntervalMs?: number;
+    /** Called with every secret the blue/green steps read or mint (the health token, copied env), so the host can redact it. */
+    onSecret?: (value: string) => void;
 }
 /**
  * The name of foundry's own Cloudflare Access app in front of Archon. Same

package/dist/plan/platform-providers.js

@@ -3,18 +3,21 @@ import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
 import { VERSIONS, coolifyImageFor, floatingTagBlocked, pinnedRef } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
-import { ownerMailboxes } from '../org.js';
+import { ownerMailboxes, sharedSecretRef, } from '../org.js';
+import { applyArchonBlueGreen } from './archon-blue-green.js';
+import { ARCHON_REPO, archonSubject, healthTokenName, tunnelOriginFor, } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
 import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { previewsOn } from './coolify-previews.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { placedOnPlatform } from './destinations.js';
-import { ACCESS_POLICY_NAME, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { LIMITS, limited } from './own-limits.js';
+import { createReleaseHost } from './release-host.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
@@ -173,6 +176,86 @@ export class FoundryPlatformStepExecutor {
     limitedOnPlatform(deps, profile) {
         return { ...deps, coolify: limited(this.onPlatform(deps.coolify), profile) };
     }
+    /** Every Coolify server and why platform-archon's blue/green cannot run here, for the planner. */
+    async archonBlueGreen() {
+        const archon = this.archon;
+        if (!archon)
+            return { blocked: 'the host built the platform executor without archon dependencies' };
+        if (typeof archon.heldKeys?.put !== 'function') {
+            return { blocked: 'the host cannot hold the health token (its held keys cannot put)' };
+        }
+        const servers = await archon.coolify.listServers();
+        return {
+            servers: servers.map((s) => ({
+                uuid: s.uuid,
+                usable: s.is_usable,
+                reachable: s.is_reachable,
+            })),
+        };
+    }
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`). The token is only read. */
+    releaseHost(platform, subject, context, renew) {
+        const archon = this.archon;
+        const recorded = context.recordedIds();
+        const primaryBlueAppId = recorded[`coolify:app:${PLATFORM_ARCHON_KEY}`];
+        const primaryUuid = recorded.coolify_server;
+        if (!archon || !primaryBlueAppId || !primaryUuid)
+            return null;
+        return createReleaseHost({
+            subject,
+            context,
+            coolify: archon.coolify,
+            healthToken: async () => (await archon.heldKeys?.resolve(sharedSecretRef(platform.ownerOrgId, healthTokenName(subject.id)))) ?? null,
+            secret: (value) => archon.runtime?.onSecret?.(value),
+            primaryUuid,
+            primaryBlueAppId,
+            runtime: this.runtime,
+            ...(archon.runtime?.fetch ? { fetch: archon.runtime.fetch } : {}),
+            renew,
+            label: `coolify:release:${subject.id}`,
+        });
+    }
+    async archonBlueGreenStep(action, context) {
+        if (!this.archon) {
+            throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
+        }
+        const deps = this.limitedOnPlatform(this.archon, LIMITS.platformArchon);
+        const platform = context.platform;
+        const subject = archonSubject(platform, ARCHON_REPO);
+        const recorded = context.recordedIds();
+        const blueAppId = recorded[`coolify:app:${PLATFORM_ARCHON_KEY}`];
+        const projectUuid = recorded[PLATFORM_ARCHON_PROJECT_SCOPE_KEY];
+        const tunnelId = recorded[PLATFORM_ARCHON_TUNNEL_SCOPE_KEY];
+        if (!subject || !blueAppId || !projectUuid || !tunnelId) {
+            throw new Error('coolify:archon-bluegreen: platform-archon is not applied yet');
+        }
+        if (typeof deps.heldKeys?.put !== 'function') {
+            throw new Error('coolify:archon-bluegreen: the host cannot hold the health token');
+        }
+        await applyArchonBlueGreen({
+            subject,
+            ownerOrgId: platform.ownerOrgId,
+            desired: { primary: String(action.desired.primary ?? '') },
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: async () => {
+                await context.persist?.();
+            },
+            coolify: deps.coolify,
+            heldKeys: { resolve: deps.heldKeys.resolve, put: deps.heldKeys.put },
+            secret: (value) => deps.runtime?.onSecret?.(value),
+            projectUuid,
+            blueAppId,
+            tunnelId,
+            hostname: platform.archon.hostname,
+            tunnels: await platformTunnels(deps, context.recordedIds(), 'coolify:archon-bluegreen'),
+            runtime: deps.runtime ?? {},
+            sleep: deps.runtime?.sleep ?? defaultSleep,
+            logDir: LOG_DIR,
+            isRunning: isRunningOrStarting,
+        });
+        return undefined;
+    }
     async blockedSteps(platform, recordedIds = {}, owner = {}) {
         const blocked = {};
         if (platform.auth.enabled && !this.auth) {
@@ -724,6 +807,9 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformEdge(context, this.limitedOnPlatform(this.edge, LIMITS.platformEdge));
         }
+        if (action.system === 'coolify' && action.kind === 'archon-bluegreen') {
+            return this.archonBlueGreenStep(action, context);
+        }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
             action.key === PLATFORM_ARCHON_KEY) {
@@ -3602,8 +3688,6 @@ const PLATFORM_ARCHON_INTERNAL_NAME = 'platform-archon';
 const PLATFORM_ARCHON_TUNNEL_NAME = 'platform-archon-tunnel';
 /** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_ARCHON_TUNNEL_NAME}. */
 const PLATFORM_ARCHON_CLOUDFLARED_APP_NAME = 'platform-archon-cloudflared';
-/** https://github.com/wtfalch/archon: one Dockerfile at its root, `runner` stage on port 3000. */
-const ARCHON_REPO = 'wtfalch/archon';
 const ARCHON_PORT = '3000';
 /**
  * #480: Archon's own health route (`@wtfalch/reporting`'s `healthHandler`,
@@ -4506,7 +4590,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         ingress: [
             {
                 hostname,
-                service: `http://${PLATFORM_ARCHON_INTERNAL_NAME}:${ARCHON_PORT}`,
+                // Through the balancer once platform-archon runs blue/green and its balancer is written.
+                service: tunnelOriginFor(archonSubject(platform, ARCHON_REPO), recorded, recorded.coolify_server, `http://${PLATFORM_ARCHON_INTERNAL_NAME}:${ARCHON_PORT}`),
             },
             { service: 'http_status:404' },
         ],

package/dist/plan/proxy-labels.d.ts

@@ -47,12 +47,12 @@ export declare function entryLabelSpec(org: DeclaredOrg, entry: HostingEntry): E
  * without a domain too: its `<slug>.oikos.host` name is routed by the company's own tunnel
  * ({@link entryOikosHostnames}), not by the platform's shared ingress.
  */
-export declare function entryRoutes(org: DeclaredOrg): Array<{
+export declare function entryRoutes(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): Array<{
     hostname: string;
     service: string;
 }>;
 /** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
-export declare function entryRoutesMarker(org: DeclaredOrg): string;
+export declare function entryRoutesMarker(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): string;
 /**
  * A short digest of the spec; the same spec always gives the same hash. The token is left out: the
  * planner has none, and a changed token reaches a live app through the comparison of its live labels.

package/dist/plan/proxy-labels.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { PRIMARY_SERVER_SCOPE_KEY, balancerApplied, lbAppName, liveAppNameFor, } from './blue-green.js';
 import { entryHostnames, wildcardHostname } from './hostnames.js';
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
 import { appNameFor } from './platform-diff.js';
@@ -56,13 +57,20 @@ export function entryLabelSpec(org, entry) {
  * without a domain too: its `<slug>.oikos.host` name is routed by the company's own tunnel
  * ({@link entryOikosHostnames}), not by the platform's shared ingress.
  */
-export function entryRoutes(org) {
+export function entryRoutes(org, recorded = {}) {
     if (!org.hosting.enabled)
         return [];
     const routes = [];
     let wildcard;
     for (const entry of org.hosting.entries) {
-        const service = `http://${appNameFor(org, entry)}:${entryLabelSpec(org, entry).port}`;
+        // A blue/green entry is reached through its balancer, which each server's connector finds on its own
+        // network, once the balancer exists on the primary. Until then it keeps the origin it had.
+        const target = !entry.blueGreen
+            ? appNameFor(org, entry)
+            : balancerApplied(entry.key, recorded, recorded[PRIMARY_SERVER_SCOPE_KEY])
+                ? lbAppName(appNameFor(org, entry))
+                : liveAppNameFor(org, entry, recorded);
+        const service = `http://${target}:${entryLabelSpec(org, entry).port}`;
         for (const hostname of entryHostnames(org, entry)) {
             if (!routes.some((r) => r.hostname === hostname))
                 routes.push({ hostname, service });
@@ -76,8 +84,8 @@ export function entryRoutes(org) {
     return routes;
 }
 /** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
-export function entryRoutesMarker(org) {
-    return JSON.stringify(entryRoutes(org));
+export function entryRoutesMarker(org, recorded = {}) {
+    return JSON.stringify(entryRoutes(org, recorded));
 }
 /**
  * A short digest of the spec; the same spec always gives the same hash. The token is left out: the