@wtfalch/foundry 0.42.1 → 0.44.0

package/dist/plan/executor.js

@@ -7,8 +7,10 @@ import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
-import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
+import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
+import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -34,6 +36,7 @@ import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
+import { applyAccessTokenLifetime, applyMcpAccess, applyMcpProject } from './mcp.js';
 import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
 import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
 import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
@@ -44,10 +47,13 @@ import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { createReleaseHost } from './release-host.js';
+import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
+import { WORKER_APP_CALL_TIMEOUT_MS, applyWorkerApp, heldBrokerKey, teardownWorkerApp, withCallTimeout, } from './worker-app.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
@@ -98,6 +104,11 @@ export function adaptZitadelListApps(client) {
         complete: true,
     });
 }
+/** An outside call for Boule's credentials that has not answered in this long fails the step; the next apply repairs it. */
+const BOULE_CREDENTIAL_TIMEOUT_MS = 60_000;
+const BOULE_CREDENTIAL_ATTEMPTS = 3;
+/** The ZITADEL machine user that reads one company's customers organisation. */
+const CUSTOMERS_DIRECTORY_USER_NAME = 'foundry-customers-directory';
 // ---------------------------------------------------------------------------
 // Errors
 // ---------------------------------------------------------------------------
@@ -883,7 +894,11 @@ function limitProfileOf(action) {
         case 'coolify:boule':
         case 'coolify:boule-broker-entry':
             return LIMITS.boule;
+        case 'coolify:bluegreen':
+        case 'coolify:bluegreen-lb':
+            return LIMITS.companyApp;
         case 'cloudflare:tunnel':
+        case 'coolify:bluegreen-connector':
             return LIMITS.connector;
         default:
             return action.system === 'coolify' ? LIMITS.companyOther : undefined;
@@ -970,6 +985,15 @@ export class FoundryStepExecutor {
     ownMailKeyMintable() {
         return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
     }
+    /** C3: whether the ZITADEL port can mint and revoke a customers directory credential. */
+    customersDirectoryAvailable() {
+        return (typeof this.ports.zitadel.mintOrgDirectoryReader === 'function' &&
+            typeof this.ports.zitadel.revokeOrgDirectoryReader === 'function');
+    }
+    /** C3: whether the host supplied `mintBouleArchonCredential`. */
+    bouleArchonCredentialAvailable() {
+        return typeof this.ports.mintBouleArchonCredential === 'function';
+    }
     /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
     ownSigninDbKeysPuttable() {
         return Boolean(this.ports.ownServices?.provision.auth.heldKeys?.put);
@@ -1104,11 +1128,21 @@ export class FoundryStepExecutor {
             case 'zitadel:id-token-userinfo':
                 return this.zitadelIdTokenUserinfo(action, org, context);
             case 'zitadel:customers':
-                return this.zitadelCustomers(org, context);
+                return this.zitadelCustomers(action, org, context);
+            case 'zitadel:mcp-project':
+                return this.zitadelMcpProject(action, org, context);
+            case 'zitadel:mcp-access':
+                return this.zitadelMcpAccess(action, org, context);
+            case 'zitadel:access-token-lifetime':
+                return this.zitadelAccessTokenLifetime(context);
             case 'coolify:app':
                 return this.coolifyApp(action, org, context);
             case 'coolify:network':
                 return this.coolifyNetwork(action, org, context);
+            case 'coolify:bluegreen':
+            case 'coolify:bluegreen-lb':
+            case 'coolify:bluegreen-connector':
+                return this.coolifyBlueGreen(action, org, context);
             case 'coolify:broker-entry':
                 return this.coolifyBrokerEntry(action, org, context);
             case 'coolify:database':
@@ -1133,6 +1167,13 @@ export class FoundryStepExecutor {
                 return this.cloudflareRateLimit(org, context);
             case 'cloudflare:worker':
                 return this.cloudflareWorker(action, org, context);
+            case 'cloudflare:worker-app': {
+                const workers = this.ports.workerApps;
+                if (!workers) {
+                    throw new Error(`cloudflare:worker-app for ${org.slug}: this executor was built without a WorkerAppPort`);
+                }
+                return applyWorkerApp(this.workerAppDeps(workers), org, action, context);
+            }
             case 'files:organisation':
                 return this.filesOrganisation(action, org, context);
             case 'files:key':
@@ -1169,6 +1210,8 @@ export class FoundryStepExecutor {
                 return this.bouleBrokerEntry(org, context);
             case 'jobs:registration':
                 return this.jobsRegistration(action, org, context);
+            case 'cloudflare:db-route':
+                return this.remoteDatabaseRoute(action, org, context);
             case 'coolify:own-auth':
                 return this.ownAuth(action, org, context);
             case 'coolify:own-auth-db-move':
@@ -1415,6 +1458,35 @@ export class FoundryStepExecutor {
      * "Declared changes apply" nothing is marked done until the
      * live state actually matches it.
      */
+    workerAppDeps(workers) {
+        return {
+            workers,
+            ...(this.ports.workerAppKeys ? { keys: this.ports.workerAppKeys } : {}),
+            ...(this.ports.workerAppDatabase
+                ? {
+                    database: {
+                        port: this.ports.workerAppDatabase,
+                        tunnels: this.tunnelPort(),
+                        access: this.accessPort(),
+                        dns: this.dnsPort(),
+                        zones: this.zonePort(),
+                        ownerUrl: async (databaseId) => {
+                            const db = await getDatabaseStarted(this.ports.coolify, databaseId);
+                            if (!db.internal_db_url) {
+                                throw new Error('the database reports no internal connection URL yet');
+                            }
+                            this.handledSecrets.add(db.internal_db_url);
+                            return db.internal_db_url;
+                        },
+                        secret: (value) => void this.handledSecrets.add(value),
+                    },
+                }
+                : {}),
+            zones: this.zonePort(),
+            dns: this.dnsPort(),
+            ...(this.ports.heldKeys ? { heldKeys: this.ports.heldKeys } : {}),
+        };
+    }
     async cloudflareWorker(action, org, context) {
         const entryKey = action.key.slice(org.id.length + 1);
         const at = `cloudflare:worker for ${org.slug} entry '${entryKey}'`;
@@ -1752,6 +1824,18 @@ export class FoundryStepExecutor {
         }
         return { resourceId: userId };
     }
+    /** `plan/mcp.ts`: the entry's MCP audience project. */
+    zitadelMcpProject(action, org, context) {
+        return applyMcpProject(this.ports.zitadel, org, action, context);
+    }
+    /** `plan/mcp.ts`: JWT access tokens and the broker's callback on the entry's app. */
+    zitadelMcpAccess(action, org, context) {
+        return applyMcpAccess(this.ports.zitadel, org, action, context);
+    }
+    /** `plan/mcp.ts`: the instance access-token lifetime. */
+    zitadelAccessTokenLifetime(context) {
+        return applyAccessTokenLifetime(this.ports.zitadel, context);
+    }
     /**
      * Switches on "user info inside the ID token" for each live sign-in app
      * the planner named. An app's marker (its ZITADEL app id) is recorded and
@@ -2131,20 +2215,27 @@ export class FoundryStepExecutor {
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
-     * self-registration on and a grant to the org's app project. Staff stay in
+     * self-registration as `customers.signUp` says (off by default) and a grant to the org's app project. Staff stay in
      * the org's own invite-only ZITADEL org. The space keeps the name apart from
      * every issuer org, which is named by a slug and a slug has no spaces. Every call here is idempotent, so
      * a re-run after a crash finishes the job.
      */
-    async zitadelCustomers(org, context) {
+    async zitadelCustomers(action, org, context) {
         const zitadelOrgId = context.recordedIds().zitadel_org;
         if (!zitadelOrgId) {
             throw new Error(`zitadel:customers for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
         }
         const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
         const { org: customers } = await this.ports.zitadel.findOrCreateOrg(`${org.slug} customers`);
-        await this.ports.zitadel.allowSelfRegistration(customers.id);
+        // Self-registration follows `customers.signUp` (off by default). The marker is written last, so a
+        // run that failed before here is planned again.
+        const signUp = action.desired.signUp === true;
+        if (signUp)
+            await this.ports.zitadel.allowSelfRegistration(customers.id);
+        else
+            await this.ports.zitadel.closeSelfRegistration(customers.id);
         await this.ports.zitadel.findOrCreateProjectGrant(zitadelOrgId, projectId, customers.id);
+        context.recordScopeId(CUSTOMERS_SIGN_UP_SCOPE_KEY, signUp ? '1' : '0');
         return { resourceId: customers.id };
     }
     async zitadelApp(action, org, context) {
@@ -2302,13 +2393,17 @@ export class FoundryStepExecutor {
             redirectUris: appType === 'native'
                 ? []
                 : hosts
-                    ? hosts.map((host) => `https://${host}/auth/callback`)
+                    ? [
+                        ...hosts.map((host) => `https://${host}/auth/callback`),
+                        ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : []),
+                    ]
                     : [redirectUri],
             postLogoutRedirectUris: appType === 'native'
                 ? []
                 : hosts
                     ? hosts.map((host) => `https://${host}/`)
                     : [`https://${hostname}/`],
+            ...(authEntry?.uses?.auth?.mcp ? { accessTokenType: 'jwt' } : {}),
         });
         if (appType === 'web') {
             // `coolifyApp`'s own `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` to
@@ -2501,6 +2596,140 @@ export class FoundryStepExecutor {
         context.recordScopeId(COOLIFY_SERVER_SCOPE_KEY, server.uuid);
         return server;
     }
+    /**
+     * Contract C3: every usable, reachable Coolify server, the org's primary first. The primary is
+     * {@link resolveServer}'s (databases and single-copy services stay on it, unchanged). A server that is
+     * down is named in `down` and left out of `servers`; it is not an error.
+     */
+    async resolveServers(org, context) {
+        const primary = await this.resolveServer(org, context);
+        const { up, down } = splitServers(await this.blueGreenServers());
+        return {
+            primary,
+            servers: [primary, ...up.filter((uuid) => uuid !== primary.uuid).map((uuid) => ({ uuid }))],
+            down,
+        };
+    }
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`), or `null` while its
+     * blue copy is not recorded. The health token is only read here, never minted.
+     */
+    releaseHost(org, subject, context, renew) {
+        const recorded = context.recordedIds();
+        const primaryBlueAppId = recorded[`coolify:app:${appStepKey(org, subject.id)}`];
+        const primaryUuid = recorded[COOLIFY_SERVER_SCOPE_KEY];
+        if (!primaryBlueAppId || !primaryUuid)
+            return null;
+        return createReleaseHost({
+            subject,
+            context,
+            coolify: this.ports.coolify,
+            healthToken: async () => (await this.ports.heldKeys?.resolve(sharedSecretRef(org.id, healthTokenName(subject.id)))) ?? null,
+            secret: (value) => void this.handledSecrets.add(value),
+            primaryUuid,
+            primaryBlueAppId,
+            runtime: this.ports.runtime ?? {},
+            ...(this.ports.runtime?.fetch ? { fetch: this.ports.runtime.fetch } : {}),
+            renew,
+            label: `coolify:release:${subject.id}`,
+        });
+    }
+    /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
+    async blueGreenServers() {
+        return (await this.ports.coolify.listServers()).map((s) => ({
+            uuid: s.uuid,
+            usable: s.is_usable,
+            reachable: s.is_reachable,
+        }));
+    }
+    /**
+     * The blue/green steps (`plan/blue-green.ts`): `bluegreen` makes the apps and the balancer on one server,
+     * `bluegreen-lb` only writes the balancer's weights, `bluegreen-connector` runs the tunnel's connector on a
+     * server. A server that went down since the plan is skipped by `bluegreen-connector`'s caller, not here:
+     * a step for it fails, which the next plan reports instead.
+     */
+    async coolifyBlueGreen(action, org, context) {
+        const recorded = () => context.recordedIds();
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const serverUuid = String(action.desired.server ?? '');
+        const primaryUuid = String(action.desired.primary ?? '');
+        const live = await this.resolveServers(org, context);
+        if (!live.servers.some((s) => s.uuid === serverUuid)) {
+            throw new Error(`${action.kind} for ${org.slug}: Coolify server ${serverUuid} is not usable and reachable`);
+        }
+        if (live.primary.uuid !== primaryUuid) {
+            throw new Error(`${action.kind} for ${org.slug}: the plan's primary server is not the recorded one`);
+        }
+        if (action.kind === 'bluegreen-connector') {
+            const tunnelId = recorded()[`cloudflare:tunnel:${org.id}`];
+            if (!tunnelId)
+                throw new Error(`bluegreen-connector for ${org.slug}: the tunnel is not recorded yet`);
+            await applyBlueGreenConnectors({
+                coolify: this.ports.coolify,
+                tunnels: this.tunnelPort(),
+                tunnelId,
+                baseAppName: `${org.slug}-cloudflared`,
+                baseScopeKey: CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY,
+                primaryUuid,
+                serverUuids: [serverUuid],
+                projectUuid,
+                environment,
+                recorded,
+                record: (key, id) => context.recordScopeId(key, id),
+                persist: () => context.persistScopeIds(),
+            });
+            return undefined;
+        }
+        const entry = org.hosting.entries.find((e) => e.key === action.desired.entry);
+        if (!entry || !entrySubject(org, entry)) {
+            throw new Error(`${action.kind} for ${org.slug}: no blue/green entry '${String(action.desired.entry)}'`);
+        }
+        const primaryBlueAppId = recorded()[`coolify:app:${appStepKey(org, entry.key)}`];
+        if (!primaryBlueAppId) {
+            throw new Error(`${action.kind} for ${org.slug}: entry '${entry.key}' has no blue app recorded yet`);
+        }
+        // The blue app keeps the name it has: an app that ran before blue/green is adopted under its own name.
+        if (!recorded()[bgKey.blueName(entry.key)]) {
+            const blue = await this.ports.coolify.getApplication(primaryBlueAppId);
+            if (blue.name) {
+                context.recordScopeId(bgKey.blueName(entry.key), blue.name);
+                await context.persistScopeIds();
+            }
+        }
+        const subject = entrySubject(org, entry, recorded());
+        const runtime = this.ports.runtime ?? {};
+        const deps = {
+            coolify: this.ports.coolify,
+            recorded,
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+            projectUuid,
+            environment,
+            healthToken: async () => {
+                if (typeof this.ports.heldKeys?.put !== 'function') {
+                    throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the health token`);
+                }
+                const token = await this.ensureSharedSecret(org, healthTokenName(entry.key), recorded());
+                this.handledSecrets.add(token);
+                return token;
+            },
+            secret: (value) => void this.handledSecrets.add(value),
+            runtime,
+            sleep: runtime.sleep ?? defaultSleep,
+            label: `${action.system}:${action.kind}:${entry.key}`,
+            primaryBlueAppId,
+            logDir: LOG_DIR,
+            isRunning: isRunningOrStarting,
+        };
+        if (action.kind === 'bluegreen-lb') {
+            await applyBlueGreenWeights(deps, subject, { uuid: serverUuid, primaryUuid });
+        }
+        else {
+            await applyBlueGreenServer(deps, subject, { uuid: serverUuid, primaryUuid });
+        }
+        return undefined;
+    }
     async coolifyApp(action, org, context) {
         const recordedAppId = context.recordedIds()[`coolify:app:${action.key}`];
         if (action.desired.enabled === false) {
@@ -2538,6 +2767,11 @@ export class FoundryStepExecutor {
         }
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        // A blue/green entry's app is its blue copy. An app that ran before blue/green keeps its own name and is
+        // adopted as blue; an entry with no app yet gets `<base>-blue`. The name is recorded once decided.
+        const blueNameKey = bgKey.blueName(entry.key);
+        const blueNameRecorded = Boolean(context.recordedIds()[blueNameKey]);
+        let appName = liveAppNameFor(org, entry, context.recordedIds());
         // The recorded id first; the name when nothing is recorded, or when the
         // recorded app is gone.
         let existing = null;
@@ -2546,17 +2780,35 @@ export class FoundryStepExecutor {
             try {
                 live = await this.ports.coolify.getApplication(recordedAppId);
                 existing = { uuid: recordedAppId };
+                if (entry.blueGreen &&
+                    !blueNameRecorded &&
+                    live.name === colorAppName(appNameFor(org, entry), 'blue')) {
+                    appName = live.name;
+                }
             }
             catch (error) {
                 if (!isNotFoundError(error))
                     throw error;
             }
         }
+        if (!existing && entry.blueGreen && !blueNameRecorded) {
+            const own = await this.ports.coolify.findApplicationByName(appNameFor(org, entry), {
+                environmentIds: [environment.id],
+            });
+            if (own) {
+                existing = own;
+                appName = appNameFor(org, entry);
+            }
+        }
         if (!existing) {
-            existing = await this.ports.coolify.findApplicationByName(appNameFor(org, entry), {
+            existing = await this.ports.coolify.findApplicationByName(appName, {
                 environmentIds: [environment.id],
             });
         }
+        if (entry.blueGreen && !blueNameRecorded) {
+            context.recordScopeId(blueNameKey, appName);
+            await context.persistScopeIds();
+        }
         // No entry gets Coolify `domains`: Coolify would add a Traefik router for them. The company's
         // tunnel routes an entry's names straight to its container (also `<slug>.oikos.host`, through a
         // record in the platform's oikos.host zone), which every entry reaches as `<slug>-<key>` (its
@@ -2602,7 +2854,7 @@ export class FoundryStepExecutor {
                 git_repository: appRepo,
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
-                name: appNameFor(org, entry),
+                name: appName,
                 autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
@@ -2655,7 +2907,7 @@ export class FoundryStepExecutor {
             patch.domains = '';
         }
         if (!existing || patch.domains !== undefined) {
-            patch.custom_internal_name = appNameFor(org, entry);
+            patch.custom_internal_name = appName;
         }
         // A `*` entry's proxy labels: Coolify takes `custom_labels` base64 encoded
         // and uses them instead of the labels it generates from `domains`. Rule 4:
@@ -2709,8 +2961,8 @@ export class FoundryStepExecutor {
         // `ensureLogVolume` whether this app was already running before this
         // call -- see its own doc comment for why that decides whether to
         // restart it.
-        await this.ensureLogVolume(appId, org, Boolean(existing), appNameFor(org, entry));
-        await this.ensureEntryVolumes(appId, entry, Boolean(existing), appNameFor(org, entry));
+        await this.ensureLogVolume(appId, org, Boolean(existing), appName);
+        await this.ensureEntryVolumes(appId, entry, Boolean(existing), appName);
         // The app receives whatever it needs to sign in (gap P2). Unconditional,
         // unlike the database push above: every app has a hostname, and an
         // upsert of the same value on a later apply is a no-op, not a change.
@@ -2741,8 +2993,10 @@ export class FoundryStepExecutor {
             // The public name answers from the container only once the tunnel step has written the
             // direct route; before that (a first apply, or the one that moves it) the deployment is the check.
             hostname &&
+                // The public name goes through the balancer, which may answer from the other color.
+                !entry.blueGreen &&
                 (context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') ===
-                    entryRoutesMarker(org)
+                    entryRoutesMarker(org, context.recordedIds())
                 ? publicHealthCheck(org, context.recordedIds(), hostname, healthPath)
                 : { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, `coolify:app:${entry.key}`, `${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} stays at its previous deploy`);
             await recordBuiltCommit(this.ports.coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: entry.key }, (key, value) => context.recordScopeId(key, value));
@@ -3216,11 +3470,21 @@ export class FoundryStepExecutor {
         if ('missing' in wanted) {
             throw new Error(`coolify:broker-entry for ${org.slug}: ${wanted.missing.map((m) => m.what).join(', ')} not recorded yet`);
         }
+        if (entry.workerApp) {
+            // No Coolify app: the key is the held AUTH_APP_KEY the Worker app was given.
+            const heldKey = await heldBrokerKey(this.ports.heldKeys, org, entry.key);
+            await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, heldKey, context);
+            return {};
+        }
         const appId = recorded[`coolify:app:${action.key}`];
         if (!appId) {
             throw new Error(`coolify:broker-entry for ${org.slug}: app ${action.key} is not recorded yet`);
         }
-        await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, appId, context);
+        const appKey = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === 'AUTH_APP_KEY' && !e.is_preview)?.value;
+        if (!appKey || appKey.length < 32) {
+            throw new Error(`coolify:broker-entry for ${org.slug}: app ${appId} has no AUTH_APP_KEY yet`);
+        }
+        await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, appKey, context);
         return {};
     }
     /**
@@ -3242,15 +3506,15 @@ export class FoundryStepExecutor {
         if (!appId) {
             throw new Error(`coolify:boule-broker-entry for ${org.slug}: the Boule app is not recorded yet`);
         }
-        await this.writeAppBrokerEntry(org, broker, BOULE_BROKER_ENTRY_KEY, wanted.want, appId, context);
-        return {};
-    }
-    /** The shared tail of both broker-entry steps: read the app's key, write the entry, record what was written. */
-    async writeAppBrokerEntry(org, broker, entryKey, want, appId, context) {
         const appKey = (await this.ports.coolify.listEnvs(appId)).find((e) => e.key === 'AUTH_APP_KEY' && !e.is_preview)?.value;
         if (!appKey || appKey.length < 32) {
             throw new Error(`coolify:broker-entry for ${org.slug}: app ${appId} has no AUTH_APP_KEY yet`);
         }
+        await this.writeAppBrokerEntry(org, broker, BOULE_BROKER_ENTRY_KEY, wanted.want, appKey, context);
+        return {};
+    }
+    /** The shared tail of both broker-entry steps: read the app's key, write the entry, record what was written. */
+    async writeAppBrokerEntry(_org, broker, entryKey, want, appKey, context) {
         const previousRaw = context.recordedIds()[brokerEntryAppliedScopeKey(entryKey)];
         const result = await writeBrokerEntry(broker, {
             want,
@@ -5540,7 +5804,12 @@ export class FoundryStepExecutor {
         if (mailWanted && !('platformApex' in action.desired)) {
             throw new Error(`coolify:boule for ${org.slug}: this step's plan carries no platformApex; plan this org's Boule again`);
         }
-        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl, mailWanted);
+        // What the plan decided Boule is given beyond its sign-in env (C3).
+        const credentialWants = {
+            archonCredential: action.desired.archonCredential === true,
+            customersDirectory: action.desired.customersDirectory === true,
+        };
+        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl, mailWanted, credentialWants);
         if (missing.length > 0) {
             throw new Error(`Boule for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
         }
@@ -5577,8 +5846,11 @@ export class FoundryStepExecutor {
         });
         const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
         const liveEnv = new Map(liveRows.map((e) => [e.key, e.value]));
-        const envChanged = bouleEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
+        let envChanged = bouleEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
         await this.dropStaleSignInUpstream(app.appId, env, liveRows);
+        // Customers switched off: revoke the directory credential and take the env away (C3).
+        if (await this.dropCustomersCredential(app.appId, org, context, liveRows))
+            envChanged = true;
         const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
         const cookieSecret = await this.ensureAuthCookieSecret(app.appId);
         if (cookieSecret)
@@ -5602,11 +5874,39 @@ export class FoundryStepExecutor {
             this.handledSecrets.add(bridgeSecret);
             envs.push({ key: BOULE_BRIDGE_SECRET_ENV, value: bridgeSecret });
         }
+        // Held, minted once (C3). Compared with the live value so a changed one restarts the app.
+        const credentialEnvs = [];
+        let archonPushedAt = null;
+        if (credentialWants.archonCredential) {
+            const archon = await this.ensureBouleArchonCredential(org, context);
+            archonPushedAt = archon.pushedAt;
+            credentialEnvs.push({ key: BOULE_ARCHON_CREDENTIAL_ENV, value: archon.value });
+        }
+        if (credentialWants.customersDirectory) {
+            const directory = await this.ensureCustomersDirectoryCredential(org, context);
+            if (directory)
+                credentialEnvs.push({ key: BOULE_CUSTOMERS_CREDENTIAL_ENV, value: directory });
+        }
+        for (const credential of credentialEnvs) {
+            this.handledSecrets.add(credential.value);
+            envs.push(credential);
+            if (liveEnv.get(credential.key) !== credential.value)
+                envChanged = true;
+        }
         try {
             await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+            // Only a push that reached Boule's env counts: a failed one is minted and pushed again next apply.
+            if (archonPushedAt) {
+                context.recordScopeId(BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, archonPushedAt);
+                await context.persistScopeIds();
+            }
         }
         catch (error) {
-            const minted = [peerPassword, bridgeSecret].filter((v) => v !== null);
+            const minted = [
+                peerPassword,
+                bridgeSecret,
+                ...credentialEnvs.map((credential) => credential.value),
+            ].filter((v) => v !== null);
             if (minted.length === 0)
                 throw error;
             throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), minted));
@@ -5656,6 +5956,125 @@ export class FoundryStepExecutor {
         this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
+    /**
+     * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
+     * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is
+     * written again unchanged. The secret is held first; the caller records `pushedAt` only after the env write
+     * succeeded, so a failed hold or a failed push is mended by the next apply minting again. Errors name no secret.
+     */
+    async ensureBouleArchonCredential(org, context) {
+        const at = `coolify:boule for ${org.slug}`;
+        const mint = this.ports.mintBouleArchonCredential;
+        const heldKeys = this.ports.heldKeys;
+        if (!mint)
+            throw new Error(`${at}: this executor was built without mintBouleArchonCredential`);
+        if (!heldKeys?.put) {
+            throw new Error(`${at}: the Archon credential needs a held-key store that can put`);
+        }
+        const put = heldKeys.put;
+        const ref = bouleArchonCredentialRef(org.id);
+        const held = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: read the held Archon credential`, () => heldKeys.resolve(ref));
+        const nowMs = context.now?.() ?? Date.now();
+        if (held && !archonCredentialRenewDue(context.recordedIds(), nowMs)) {
+            return { value: held, pushedAt: null };
+        }
+        const secret = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: mint the Archon credential`, () => mint(org.id));
+        this.handledSecrets.add(secret);
+        if (!(await this.holdWithRetry(ref, secret, put, `${at}: hold the Archon credential`))) {
+            throw new Error(`${at}: the Archon credential could not be held after ${BOULE_CREDENTIAL_ATTEMPTS} attempts; the next apply mints it again`);
+        }
+        return { value: secret, pushedAt: new Date(nowMs).toISOString() };
+    }
+    /**
+     * C3: the read-only credential for the company's customers organisation. Held first. Minting revokes every
+     * earlier token of the machine user, so a hold that failed is repaired by the next apply minting again and
+     * leaves one live token. `null` while the customers organisation is not recorded yet.
+     */
+    async ensureCustomersDirectoryCredential(org, context) {
+        const at = `coolify:boule for ${org.slug}`;
+        const customersOrgId = customersOrgIdOf(org, context.recordedIds());
+        if (!customersOrgId)
+            return null;
+        const zitadel = this.ports.zitadel;
+        const heldKeys = this.ports.heldKeys;
+        if (!zitadel.mintOrgDirectoryReader) {
+            throw new Error(`${at}: this executor's ZITADEL port cannot mint a customers directory credential`);
+        }
+        if (!heldKeys?.put) {
+            throw new Error(`${at}: the customers directory credential needs a held-key store that can put`);
+        }
+        const put = heldKeys.put;
+        const ref = customersDirectoryRef(org.id);
+        const held = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: read the held directory credential`, () => heldKeys.resolve(ref));
+        if (held)
+            return held;
+        const minted = await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: mint the directory credential`, () => zitadel.mintOrgDirectoryReader(customersOrgId, {
+            userName: CUSTOMERS_DIRECTORY_USER_NAME,
+            name: 'Foundry customers directory (read-only)',
+        }));
+        this.handledSecrets.add(minted.token);
+        context.recordScopeId(CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, minted.userId);
+        await context.persistScopeIds();
+        if (!(await this.holdWithRetry(ref, minted.token, put, `${at}: hold the directory credential`))) {
+            throw new Error(`${at}: the directory credential of ZITADEL user ${minted.userId} could not be held after ${BOULE_CREDENTIAL_ATTEMPTS} attempts; the next apply mints it again and revokes this one`);
+        }
+        return minted.token;
+    }
+    /** `put`, tried up to {@link BOULE_CREDENTIAL_ATTEMPTS} times; true once one attempt succeeds. The cause is dropped. */
+    async holdWithRetry(ref, value, put, label) {
+        for (let attempt = 1; attempt <= BOULE_CREDENTIAL_ATTEMPTS; attempt++) {
+            try {
+                await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, label, () => put(ref, value));
+                return true;
+            }
+            catch {
+                // Retried; the cause may echo the value.
+            }
+        }
+        return false;
+    }
+    /**
+     * C3: customers switched off. Revokes the directory credential's tokens first, then removes the customers
+     * env from Boule, then forgets the held value and the user id. Each step is repeated safely, so a run that
+     * died halfway is finished by the next. Returns true when Boule's env changed.
+     */
+    async dropCustomersCredential(appId, org, context, liveRows) {
+        if (org.customers?.enabled)
+            return false;
+        const at = `coolify:boule for ${org.slug}`;
+        const recorded = context.recordedIds();
+        const userId = recorded[CUSTOMERS_DIRECTORY_USER_SCOPE_KEY];
+        const customersOrgId = customersOrgIdOf(org, recorded);
+        const zitadel = this.ports.zitadel;
+        if (userId && customersOrgId && zitadel.revokeOrgDirectoryReader) {
+            await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: revoke the directory credential`, () => zitadel.revokeOrgDirectoryReader(customersOrgId, userId));
+        }
+        let changed = false;
+        for (const row of liveRows) {
+            if (row.key !== BOULE_CUSTOMERS_ORG_ENV && row.key !== BOULE_CUSTOMERS_CREDENTIAL_ENV)
+                continue;
+            if (!row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+                changed = true;
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        if (userId && (!customersOrgId || zitadel.revokeOrgDirectoryReader)) {
+            const heldKeys = this.ports.heldKeys;
+            if (heldKeys?.put) {
+                const put = heldKeys.put;
+                const ref = customersDirectoryRef(org.id);
+                await withCallTimeout(BOULE_CREDENTIAL_TIMEOUT_MS, `${at}: forget the directory credential`, () => put(ref, ''));
+            }
+            context.recordScopeId(CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, '');
+        }
+        return changed;
+    }
     /**
      * Gives Boule `LETTERMINT_API_TOKEN`: the platform's held key for an org on
      * the platform's own apex, else the org's `<slug>-app` token through the
@@ -6258,6 +6677,42 @@ export class FoundryStepExecutor {
         }
         return { resourceId: registered.id };
     }
+    /** The blue/green database route (`plan/remote-database.ts`). */
+    async remoteDatabaseRoute(action, org, context) {
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const desired = action.desired;
+        // The tunnel's TCP rule names the database by the host the apps' own `DATABASE_URL` uses.
+        const db = await this.ports.coolify.getDatabase(desired.database);
+        if (db.internal_db_url)
+            this.handledSecrets.add(db.internal_db_url);
+        let databaseHost = '';
+        try {
+            databaseHost = new URL(db.internal_db_url ?? '').hostname;
+        }
+        catch {
+            // Fixed text below: the URL holds the database password.
+        }
+        if (!databaseHost) {
+            throw new Error(`cloudflare:db-route for ${org.slug}: the database reports no usable address`);
+        }
+        await applyRemoteDatabase({
+            tunnels: this.tunnelPort(),
+            access: this.accessPort(),
+            dns: this.dnsPort(),
+            zones: this.zonePort(),
+            coolify: this.ports.coolify,
+            secret: (value) => void this.handledSecrets.add(value),
+        }, {
+            org,
+            desired,
+            databaseHost,
+            projectUuid,
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+        });
+        return {};
+    }
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     async deliverWithRetry(ref, value) {
         for (let attempt = 1; attempt <= JOBS_DELIVERY_ATTEMPTS; attempt++) {
@@ -6337,17 +6792,19 @@ export class FoundryStepExecutor {
         const loginHost = action.desired.loginHost ?? null;
         // A hosting entry's names (and its wildcard) go straight to its container on the company network:
         // the container carries `traefik.enable=false`, so the proxy has no route for it.
-        const entryOrigins = new Map(entryRoutes(org).map((r) => [r.hostname, r.service]));
+        const entryOrigins = new Map(entryRoutes(org, context.recordedIds()).map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
                 ? `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`
                 : (entryOrigins.get(hostname) ?? COOLIFY_PROXY_ORIGIN),
         }));
+        const httpIngress = [...ingress, { service: 'http_status:404' }];
         await this.tunnelPort().putTunnelConfig(tunnel.id, {
-            ingress: [...ingress, { service: 'http_status:404' }],
+            ingress: mergeTcpIngress(httpIngress, recordedTcpRoutes(context.recordedIds())),
         });
-        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org));
+        context.recordScopeId(TUNNEL_HTTP_INGRESS_SCOPE_KEY, JSON.stringify(httpIngress));
+        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org, context.recordedIds()));
         // #235: a connector for this org's own tunnel, the same call every
         // platform tunnel step already makes (Decided, William, 2026-10-01:
         // one connector per org tunnel, never a shared tunnel with appended
@@ -8091,6 +8548,17 @@ export class FoundryStepExecutor {
                     await this.teardownWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
                     return;
                 }
+                case 'cloudflare:worker-app': {
+                    // ADR 0002: route, record, containers and script of a Worker app.
+                    const workers = this.ports.workerApps;
+                    if (!workers) {
+                        throw new Error(`cloudflare:worker-app '${target.key}' for ${org.slug}: this executor was built without a WorkerAppPort; cannot delete it`);
+                    }
+                    const entryKey = target.key.slice(org.id.length + 1);
+                    const at = `cloudflare:worker-app '${target.key}' for ${org.slug}`;
+                    await teardownWorkerApp(this.workerAppDeps(workers), entryKey, target.id || undefined, recordedIds, (label, task) => withCallTimeout(WORKER_APP_CALL_TIMEOUT_MS, `${at}: ${label}`, task), org.id);
+                    return;
+                }
                 case 'edge:key': {
                     // F7 (#317): an entry's key (`<orgId>:<entry>`); edge has no org-root key.
                     // No port means no way to revoke it -- thrown, not silently
@@ -8114,8 +8582,32 @@ export class FoundryStepExecutor {
                     return;
                 }
                 case 'coolify:app':
+                case 'coolify:bg-app':
                     await this.ports.coolify.deleteApplication(target.id);
                     return;
+                case 'cloudflare:bg-access':
+                    await this.accessPort().deleteAccessApp(target.id);
+                    return;
+                case 'cloudflare:bg-token':
+                    await this.accessPort().removeServiceToken(target.id);
+                    return;
+                case 'cloudflare:bg-dns': {
+                    // `target.id` is the recorded route ({ hostname, service }); its name lives in the org's zone.
+                    const hostname = JSON.parse(target.id).hostname;
+                    const zone = org.domain ? await this.zonePort().findZoneByApex(org.domain) : undefined;
+                    if (typeof hostname !== 'string' || !zone)
+                        return;
+                    const dns = this.dnsPort();
+                    for (const record of await dns.findDnsRecord(zone.name, hostname, 'CNAME')) {
+                        if (record.content.endsWith('.cfargotunnel.com')) {
+                            await dns.deleteDnsRecord(zone.name, record.id);
+                        }
+                    }
+                    return;
+                }
+                case 'coolify:bg-database':
+                    await this.ports.coolify.deleteDatabase(target.id);
+                    return;
                 case 'coolify:database':
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;