@wtfalch/foundry 0.42.1 → 0.44.0

package/dist/plan/plan-apply.js

@@ -8,6 +8,7 @@ import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { NetworkMoveBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
+import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, entrySubject, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
@@ -15,7 +16,7 @@ import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
-import { lockedHostnames } from './locked-hostnames.js';
+import { hostingNames } from './locked-hostnames.js';
 import { agoraIssuerHostFor, loginHostServesAgora, readLoginHostDiscovery, } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_MAX, OWN_MAIL_SMTP_PORT_SCOPE_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, isOwnMailSmtpPort, mailRelayFingerprint, } from './mail-relay.js';
 import { findNameClashes, nameClashMessage } from './org-names.js';
@@ -25,6 +26,9 @@ import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILE
 import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
+import { runSubjectRelease } from './release-host.js';
+import { remoteDatabaseFactsFrom } from './remote-database.js';
+import { liveWorkerApps, workerAppTraceScopeKeys } from './worker-app.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
@@ -119,6 +123,9 @@ export class PlatformConfirmationRequiredError extends Error {
 /** The steps that read an entry's hostnames: `computeFreshPlan` drops them for an org whose hosting is invalid. */
 const HOSTNAME_STEPS = new Set([
     'coolify:app',
+    'coolify:bluegreen',
+    'coolify:bluegreen-lb',
+    'coolify:bluegreen-connector',
     'coolify:broker-entry',
     'coolify:database',
     'cloudflare:tunnel',
@@ -128,6 +135,8 @@ const HOSTNAME_STEPS = new Set([
     // #318 (F8): the route is itself hostname-shaped, validated against the
     // org's own domain by `validateEntryWorker`.
     'cloudflare:worker',
+    // ADR 0002: its host is hostname-shaped and validated by `validateEntryWorkerApp`.
+    'cloudflare:worker-app',
 ]);
 /**
  * The #19 implementation of {@link PlanApply}: computes a plan against live
@@ -152,8 +161,13 @@ export class FoundryPlanApply {
     loginHostBindings;
     loginHostDiscovery;
     zitadelIdTokenUserinfo;
+    zitadelMcp;
     broker;
     edgeWorkers;
+    workerApps;
+    workerAppKeysUrl;
+    workerAppDatabase;
+    workerAppRegistryAccountId;
     ownerInviteMail;
     hostFiles;
     hostAi;
@@ -167,6 +181,7 @@ export class FoundryPlanApply {
     backupGate;
     platformDeps;
     runner;
+    releaseStore;
     constructor(options) {
         this.store = options.store;
         this.readers = options.readers;
@@ -180,8 +195,13 @@ export class FoundryPlanApply {
         this.loginHostBindings = options.loginHostBindings ?? false;
         this.loginHostDiscovery = options.loginHostDiscovery;
         this.zitadelIdTokenUserinfo = options.zitadelIdTokenUserinfo ?? false;
+        this.zitadelMcp = options.zitadelMcp ?? false;
         this.broker = options.broker ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
+        this.workerApps = options.workerApps ?? false;
+        this.workerAppKeysUrl = options.workerAppKeysUrl;
+        this.workerAppDatabase = options.workerAppDatabase ?? false;
+        this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
         this.ownerInviteMail = options.ownerInviteMail ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
@@ -195,6 +215,7 @@ export class FoundryPlanApply {
         this.backupGate = options.backupGate;
         this.platformDeps = options.platform;
         this.runner = options.runner;
+        this.releaseStore = options.releaseStore;
     }
     async plan(id) {
         const { plan } = await this.computeFreshPlan(id);
@@ -689,6 +710,12 @@ export class FoundryPlanApply {
                                 delete serviceIds[scopeKey];
                             }
                         }
+                        if (target.system === 'cloudflare' && target.kind === 'worker-app') {
+                            const entryKey = target.key.slice(id.length + 1);
+                            for (const scopeKey of workerAppTraceScopeKeys(entryKey)) {
+                                delete serviceIds[scopeKey];
+                            }
+                        }
                         steps[current] = {
                             step: descriptions[current],
                             status: 'finished',
@@ -953,6 +980,13 @@ export class FoundryPlanApply {
                 }
                 checkpoints.push({ step: planned.step.description, completedAt: this.now().toISOString() });
             }
+            // The steps made the structure; the release runner then moves traffic on it, on the same live ids.
+            await this.runOrgReleases(org, {
+                recordedIds: context.recordedIds,
+                recordScopeId: context.recordScopeId,
+                forgetId: (key) => context.forgetId?.(key),
+                persist: context.persistScopeIds,
+            }, fence);
         }
         catch (e) {
             // #9 (resolved): "it stops at the checkpoint... there is no automatic
@@ -1012,6 +1046,135 @@ export class FoundryPlanApply {
         });
         return applied;
     }
+    /**
+     * ADR 0001: one release run for each blue/green entry whose structure is applied, writing into `context`
+     * (the live ids of the run that holds the lease). A weight the runner changed reaches every server's balancer
+     * before this returns.
+     */
+    async runOrgReleases(org, context, fence) {
+        const store = this.releaseStore;
+        const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
+        if (!store || !this.executor.releaseHost || !primaryUuid)
+            return;
+        for (const entry of org.hosting.entries) {
+            const subject = entrySubject(org, entry, context.recordedIds());
+            if (!subject)
+                continue;
+            const host = this.executor.releaseHost(org, subject, context, () => this.renewLease(fence));
+            if (!host)
+                continue;
+            await runSubjectRelease({
+                store,
+                scopeOwnerId: org.id,
+                subject,
+                host,
+                context,
+                now: this.now(),
+                primaryUuid,
+            });
+        }
+    }
+    /** One release run for platform-archon, on the platform's live ids; see {@link runOrgReleases}. */
+    async runPlatformReleases(platform, context, fence) {
+        const store = this.releaseStore;
+        const executor = this.platformDeps?.executor;
+        const subject = archonSubject(platform, ARCHON_REPO);
+        const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
+        if (!store || !executor?.releaseHost || !subject || !primaryUuid)
+            return;
+        const host = executor.releaseHost(platform, subject, context, () => this.renewLease(fence));
+        if (!host)
+            return;
+        await runSubjectRelease({
+            store,
+            scopeOwnerId: 'platform',
+            subject,
+            host,
+            context,
+            now: this.now(),
+            primaryUuid,
+        });
+    }
+    async runPlatformReleaseTick() {
+        const deps = this.platformDeps;
+        const platform = await deps?.store.get();
+        if (!deps || !platform)
+            return;
+        const empty = { orgId: platform.ownerOrgId, steps: [], unmanaged: [] };
+        if ((await this.authz.canApplyPlatform?.(this.actor)) !== true) {
+            await this.refusePlatform(empty, platform.ownerOrgId, 'not authorized to run the release tick');
+            throw new NotAuthorizedError(this.actor, platform.ownerOrgId);
+        }
+        await this.withMutationLease(PLATFORM_SCOPE, (reason) => this.refusePlatform(empty, platform.ownerOrgId, reason), async (fence) => {
+            const serviceIds = { ...(await deps.store.getServiceIds()) };
+            await this.runPlatformReleases(platform, {
+                recordedIds: () => ({ ...serviceIds }),
+                recordScopeId: (key, value) => {
+                    serviceIds[key] = value;
+                },
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => deps.store.putServiceIds({ ...serviceIds }, fence),
+            }, fence);
+        });
+    }
+    /**
+     * The recurring release run (ADR 0001): for every declared org with a blue/green entry, and the platform's
+     * archon when it declares one, takes the open requests, reads the health signal and moves traffic. Foundry has
+     * no scheduler of its own, so the host calls this every 10 minutes. An org that cannot run (the actor may not
+     * apply it, an apply holds its lease, a provider call fails) is reported by id and does not stop the others.
+     * A refusal is audited; a run that does nothing writes no audit row.
+     */
+    async runReleaseTick() {
+        const results = [];
+        for (const org of await this.store.list()) {
+            if (!org.hosting.entries.some((entry) => entry.blueGreen))
+                continue;
+            try {
+                await this.runOrgReleaseTick(org.id);
+                results.push({ target: org.id });
+            }
+            catch (e) {
+                results.push({ target: org.id, error: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        const platform = await this.platformDeps?.store.get();
+        if (platform?.archon.enabled && platform.archon.blueGreen) {
+            try {
+                await this.runPlatformReleaseTick();
+                results.push({ target: 'platform' });
+            }
+            catch (e) {
+                results.push({ target: 'platform', error: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        return results;
+    }
+    async runOrgReleaseTick(id) {
+        const empty = { orgId: id, steps: [], unmanaged: [] };
+        if (!(await this.authz.canApply(this.actor, id))) {
+            await this.refuse(empty, 'not authorized to run the release tick');
+            throw new NotAuthorizedError(this.actor, id);
+        }
+        await this.withMutationLease(companyScope(id), (reason) => this.refuse(empty, reason), async (fence) => {
+            const org = await this.store.get(id);
+            const previous = await this.store.getAppliedState(id);
+            if (!org || !previous)
+                return;
+            const serviceIds = { ...previous.serviceIds };
+            await this.runOrgReleases(org, {
+                recordedIds: () => ({ ...serviceIds }),
+                recordScopeId: (key, value) => {
+                    serviceIds[key] = value;
+                },
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => this.store.putAppliedState({ ...previous, serviceIds: { ...serviceIds } }, fence),
+            }, fence);
+        });
+    }
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     async readSfuPortsOpen(org) {
         const slot = org.services?.sfuSlot;
@@ -1048,14 +1211,23 @@ export class FoundryPlanApply {
             : false;
         const sfuPortsOpen = await this.readSfuPortsOpen(org);
         const resumable = await this.ownResumableRefs(org);
+        // Read only for an org that declares it; a failed read plans none and says so (`planBlueGreen`).
+        const blueGreenServers = org.hosting.entries.some((e) => e.blueGreen) && this.executor.blueGreenServers
+            ? await this.executor.blueGreenServers().catch(() => undefined)
+            : undefined;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
             loginHostServesDiscovery,
             zitadelIdTokenUserinfo: this.zitadelIdTokenUserinfo,
+            zitadelMcp: this.zitadelMcp,
             broker: ownsServices(org) && this.hostOwnServices && this.executor.ownBrokerPort
                 ? await this.executor.ownBrokerPort(org, recorded)
                 : this.broker,
             edgeWorkers: this.edgeWorkers,
+            workerApps: this.workerApps,
+            workerAppKeysUrl: this.workerAppKeysUrl,
+            workerAppDatabase: this.workerAppDatabase,
+            workerAppRegistryAccountId: this.workerAppRegistryAccountId,
             ownerInviteMail: this.ownerInviteMail,
             otherSlugs,
             now: () => this.now().getTime(),
@@ -1066,6 +1238,20 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            customersDirectory: this.executor.customersDirectoryAvailable?.() ?? false,
+            bouleArchonCredential: this.executor.bouleArchonCredentialAvailable?.() ?? false,
+            ...(blueGreenServers ? { blueGreenServers } : {}),
+            ...(blueGreenServers && org.hosting.entries.some((e) => e.blueGreen && e.database)
+                ? {
+                    remoteDatabase: remoteDatabaseFactsFrom({
+                        org,
+                        servers: blueGreenServers,
+                        recorded,
+                        access: !platformReadiness.dnsBlocked ||
+                            ['dns', 'zones', 'access', 'tunnels'].every((port) => platformReadiness.ownEdgePorts?.[port]),
+                    }),
+                }
+                : {}),
             ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
             ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ...(this.backupGate
@@ -1149,10 +1335,7 @@ export class FoundryPlanApply {
      * which only the plan can read.
      */
     async invalidHosting(org) {
-        return validateHosting(org.hosting, {
-            domain: org.domain,
-            locked: lockedHostnames(org, await this.platformServiceHostnames()),
-        });
+        return validateHosting(org.hosting, hostingNames(org, await this.platformServiceHostnames()));
     }
     async platformServiceHostnames() {
         const platform = await this.platformDeps?.store.get();
@@ -1391,8 +1574,21 @@ export class FoundryPlanApply {
             .map((org) => org.slug);
         const mailRelay = platform.mail.relay === true ? await this.mailRelayInputs() : null;
         const owner = await this.platformOwnerInput(platform);
+        const archonBlueGreen = platform.archon.enabled && platform.archon.blueGreen && executor.archonBlueGreen
+            ? await executor.archonBlueGreen().catch(() => ({ servers: undefined }))
+            : null;
         const detail = computePlatformPlanDetail(platform, live, {
             owner,
+            ...(archonBlueGreen
+                ? {
+                    archonBlueGreen: {
+                        servers: archonBlueGreen.servers,
+                        ...('blocked' in archonBlueGreen && archonBlueGreen.blocked
+                            ? { blocked: archonBlueGreen.blocked }
+                            : {}),
+                    },
+                }
+                : {}),
             jobsObservable: readers.coolify !== undefined,
             sfuBlocked,
             callsOrgSlugs,
@@ -1515,6 +1711,14 @@ export class FoundryPlanApply {
                     serviceIds[`${system}:${kind}:${key}`] = result.resourceId;
                 }
             }
+            await this.runPlatformReleases(platform, {
+                recordedIds: context.recordedIds,
+                recordScopeId: context.recordScopeId,
+                forgetId: (key) => {
+                    delete serviceIds[key];
+                },
+                persist: () => store.putServiceIds(serviceIds, fence),
+            }, fence);
         }
         catch (e) {
             // Whatever completed stays recorded, as an org's apply does. A lost
@@ -1600,6 +1804,8 @@ function destroyTargets(serviceIds, orgId) {
         'cloudflare:gate:',
         // #318: an entry's Worker and its route.
         'cloudflare:worker:',
+        // ADR 0002: a Worker app's route, record, containers, keys and script.
+        'cloudflare:worker-app:',
         'coolify:database:',
         'coolify:app:',
         // An own files host's storage key: the token id is the step's recorded resource id.
@@ -1630,6 +1836,21 @@ function destroyTargets(serviceIds, orgId) {
             }
             continue;
         }
+        if (prefix === 'cloudflare:worker-app:') {
+            for (const [entryKey, scriptName] of liveWorkerApps(orgId, serviceIds)) {
+                targets.push({
+                    system: 'cloudflare',
+                    kind: 'worker-app',
+                    key: `${orgId}:${entryKey}`,
+                    id: scriptName,
+                });
+            }
+            continue;
+        }
+        // Blue/green: the colors, balancers, stage, database sidecars and extra connectors, by recorded id, before
+        // the main database they connect to. Their keys carry no ':' (scope ids), so no prefix above finds them.
+        if (prefix === 'coolify:database:')
+            targets.push(...blueGreenDestroyTargets(serviceIds));
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix) || !id)
                 continue;
@@ -1745,10 +1966,44 @@ function destroyStepDescriptions(targets) {
         'delete the declared org',
     ];
 }
+/** Scope keys of the Coolify apps blue/green made: `bg.<entry>.app.<server>.<part>`, a database sidecar, a connector on another server. */
+const BLUE_GREEN_APP_KEY = /^(bg\.[^.:]+\.app\.[^.:]+\.[a-z]+|bgdb\.[^.:]+\.sidecar\.[^.:]+|cloudflare_tunnel_connector_app\.[^.:]+)$/;
+const BLUE_GREEN_DATABASE_KEY = /^bg\.[^.:]+\.stagedb$/;
+/** The database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
+const BLUE_GREEN_EDGE_KEYS = [
+    [/^bgdb\.[^.:]+\.access$/, 'bg-access'],
+    [/^bgdb\.[^.:]+\.(token|undelivered)$/, 'bg-token'],
+    [/^bgdb\.[^.:]+\.route$/, 'bg-dns'],
+];
+/** Every recorded blue/green app (then stage's database), in key order. A destroy target's `key` is the scope key itself. */
+function blueGreenDestroyTargets(serviceIds) {
+    const keys = Object.keys(serviceIds).sort();
+    const targets = [];
+    for (const key of keys.filter((k) => BLUE_GREEN_APP_KEY.test(k))) {
+        const id = serviceIds[key];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'bg-app', key, id });
+    }
+    for (const key of keys.filter((k) => BLUE_GREEN_DATABASE_KEY.test(k))) {
+        const id = serviceIds[key];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'bg-database', key, id });
+    }
+    for (const [pattern, kind] of BLUE_GREEN_EDGE_KEYS) {
+        for (const key of keys.filter((k) => pattern.test(k))) {
+            const id = serviceIds[key];
+            if (id)
+                targets.push({ system: 'cloudflare', kind, key, id });
+        }
+    }
+    return targets;
+}
 /** The `AppliedState.serviceIds` key a completed {@link DestroyTarget} should be removed from. */
 function destroyServiceIdKey(target) {
     if (target.kind === 'project' || target.kind === 'org')
         return target.key;
+    if (target.kind.startsWith('bg-'))
+        return target.key;
     if (target.kind === 'own-files-r2' && target.key === 'undelivered') {
         return OWN_FILES_R2_UNDELIVERED_SCOPE_KEY;
     }
@@ -1764,6 +2019,9 @@ const STEP_FIELDS = {
     'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
     'zitadel:id-token-userinfo': 'hosting.entries.uses.auth',
+    'zitadel:mcp-project': 'hosting.entries.uses.auth.mcp',
+    'zitadel:mcp-access': 'hosting.entries.uses.auth.mcp',
+    'zitadel:access-token-lifetime': 'hosting.entries.uses.auth.mcp',
     'coolify:broker-entry': 'hosting.entries.uses.auth',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
@@ -1781,6 +2039,9 @@ const STEP_FIELDS = {
     'ai:key': 'ai',
     'cms:site': 'site',
     'coolify:app': 'hosting.enabled',
+    'coolify:bluegreen': 'hosting.entries.blueGreen',
+    'coolify:bluegreen-lb': 'hosting.entries.blueGreen',
+    'coolify:bluegreen-connector': 'hosting.entries.blueGreen',
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',
@@ -1788,6 +2049,7 @@ const STEP_FIELDS = {
     'cloudflare:gate': 'hosting.entries.gates',
     'cloudflare:ratelimit': 'hosting.usesDomain',
     'cloudflare:worker': 'hosting.entries.worker',
+    'cloudflare:worker-app': 'hosting.entries.workerApp',
 };
 function stepField(action) {
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.

package/dist/plan/platform-diff.d.ts

@@ -1,6 +1,7 @@
 import type { DeclaredOrg, EnvSharedSecret, HostingEntry, OrgId } from '../org.js';
 import { type Plan, type PlanNote, type UnmanagedItem, type VersionChangeItem } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
+import { type BlueGreenServer } from './blue-green.js';
 import type { PlannedStep } from './diff.js';
 import type { LiveResource } from './live.js';
 import { type MailRoute, PLATFORM_MAIL_RELAY_KEY } from './mail-relay.js';
@@ -1092,6 +1093,14 @@ export declare function uptimeRecorded(recordedIds: Readonly<Record<string, stri
  * the merge comment that named this shape (#189).
  */
 export interface PlanPlatformOptions {
+    /**
+     * What `platform.archon.blueGreen` needs from the host: every Coolify server (`undefined`: it cannot list them)
+     * and why the executor cannot run it, if it cannot. Absent: nothing is planned for it.
+     */
+    archonBlueGreen?: {
+        servers: readonly BlueGreenServer[] | undefined;
+        blocked?: string;
+    };
     /** Whether the host supplies a Coolify reader for the platform (default `true`). */
     jobsObservable?: boolean;
     /** Why the shared SFU is blocked, or `null` when it is not (default `null`). */

package/dist/plan/platform-diff.js

@@ -3,6 +3,7 @@ import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
 import { heldEnvRef } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
+import { ARCHON_REPO, planArchonBlueGreen } from './blue-green.js';
 import { buildDriftNotes } from './build-record.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
@@ -1268,7 +1269,7 @@ export function uptimeRecorded(recordedIds) {
  * unchanged).
  */
 export function planPlatform(platform, live, options = {}) {
-    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailRoutesBlocked = [], recordedIds = {}, owner, liveBuilds = {}, blocked = {}, drifted = {}, } = options;
+    const { jobsObservable = true, sfuBlocked = null, callsOrgSlugs, mailRoutes = [], mailRoutesBlocked = [], recordedIds = {}, owner, liveBuilds = {}, blocked = {}, drifted = {}, archonBlueGreen, } = options;
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
@@ -1386,6 +1387,27 @@ export function planPlatform(platform, live, options = {}) {
     const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld, blocked.uptimeChat);
     if (uptime.step)
         plannedSteps.push(uptime.step);
+    // Archon's app and tunnel are recorded by an earlier apply, so this runs before a last-placed archon step.
+    const archonBg = archonBlueGreen
+        ? planArchonBlueGreen({
+            platform,
+            repo: ARCHON_REPO,
+            recorded: recordedIds,
+            servers: archonBlueGreen.servers,
+            executorBlocked: archonBlueGreen.blocked,
+        })
+        : { step: null, unmanaged: [] };
+    if (archonBg.step) {
+        plannedSteps.push({
+            action: {
+                system: 'coolify',
+                kind: 'archon-bluegreen',
+                key: archonBg.step.key,
+                desired: archonBg.step.desired,
+            },
+            step: { description: archonBg.step.description, destroys: false, migrates: false },
+        });
+    }
     if (archon.step && blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
     // After Archon's own step: a repair that fails must not hold up the work before it.
@@ -1487,6 +1509,7 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: archonOrg.blocked, key: 'archon-org' });
     if (archon.blocked)
         unmanaged.push({ description: archon.blocked, key: 'archon' });
+    unmanaged.push(...archonBg.unmanaged);
     // #398: the old integrations key stays pinned until Archon holds the new
     // id; name that when Archon is what is stopping it.
     if (archon.blocked &&

package/dist/plan/platform-providers.d.ts

@@ -2,6 +2,7 @@ import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { type DeclaredOrg } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { DeclaredOrgStore, PlatformStore } from '../store.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import type { StepAction } from './diff.js';
 import type { AccessPort } from './edge-access.js';
@@ -10,6 +11,7 @@ import type { RateLimitPort } from './edge-ratelimits.js';
 import type { TunnelPort } from './edge-tunnels.js';
 import type { ZonePort } from './edge-zones.js';
 import type { CloudflarePort, CoolifyPort, FoundryStepExecutorPorts, ZitadelPort } from './executor.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } from './live.js';
 import { type OikosIngressPorts } from './oikos-ingress.js';
@@ -349,6 +351,14 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private onPlatform;
     /** `deps` with its Coolify port placed on the platform destination, then limited by `profile`. */
     private limitedOnPlatform;
+    /** Every Coolify server and why platform-archon's blue/green cannot run here, for the planner. */
+    archonBlueGreen(): Promise<{
+        servers?: BlueGreenServer[];
+        blocked?: string;
+    }>;
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`). The token is only read. */
+    releaseHost(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    private archonBlueGreenStep;
     blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>, owner?: PlatformOwnerInput): Promise<{
         auth?: string;
         authExecutorMissing?: boolean;
@@ -896,7 +906,9 @@ export declare function ownerInviteBlockedReason(ownerCompany: DeclaredOrg | nul
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'listEnvironments' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'listEnvironments' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment' | 'listStorages' | 'createPersistentStorage' | 'createFileStorage' | 'updateFileStorage'> & {
+        listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
+    };
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -972,6 +984,8 @@ export interface PlatformArchonRuntime {
     readyTimeoutMs?: number;
     /** Pause between readiness polls (default 5 seconds). */
     readyIntervalMs?: number;
+    /** Called with every secret the blue/green steps read or mint (the health token, copied env), so the host can redact it. */
+    onSecret?: (value: string) => void;
 }
 /**
  * The name of foundry's own Cloudflare Access app in front of Archon. Same