@wtfalch/foundry 0.46.0 → 0.48.0

package/dist/plan/executor.js

@@ -4,11 +4,11 @@ import { URL } from 'node:url';
 import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appEntry, filesCollectionEnvName, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, filesCollectionEnvName, heldEnvRef, isMainEntry, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
-import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
+import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, splitServers, } from './blue-green.js';
 import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
 import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
@@ -53,13 +53,14 @@ import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutAppliedValue, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
-import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { createReleaseHost } from './release-host.js';
 import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
+import { stageGateKey, stageHostname, } from './stage-guards.js';
 import { WORKER_APP_CALL_TIMEOUT_MS, applyWorkerApp, heldBrokerKey, teardownWorkerApp, withCallTimeout, } from './worker-app.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -211,7 +212,7 @@ export function callsHostnameFor(org) {
  */
 export function healthUrls(org) {
     // One URL per entry that has a public name; an internal entry has none.
-    if (org.hosting.enabled && appEntry(org.hosting)) {
+    if (org.hosting.enabled && org.hosting.entries.length > 0) {
         return org.hosting.entries.flatMap((entry) => {
             const [hostname] = entryHostnames(org, entry);
             if (!hostname)
@@ -342,8 +343,8 @@ const CMS_APP_PORT = 3000;
  * Agora answers 502 behind the tunnel. Seen live on Company Included,
  * 2026-10-05.
  */
-const AGORA_REPO = 'wtfalch/agora';
-const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
+export const AGORA_REPO = 'wtfalch/agora';
+export const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
 /**
  * #161 (Boule part): the repo `coolifyBoule` builds the org's Boule from
  * (https://github.com/wtfalch/boule), by the same convention as
@@ -352,10 +353,10 @@ const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
  * 3000 (`EXPOSE 3000`) and runs `scripts/migrate-and-start.sh`, which applies
  * its migrations as the owner and then serves as the `<database>_rt` role.
  */
-const BOULE_REPO = 'wtfalch/boule';
-const BOULE_APP_DOCKERFILE = '/Dockerfile';
+export const BOULE_REPO = 'wtfalch/boule';
+export const BOULE_APP_DOCKERFILE = '/Dockerfile';
 /** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
-const BOULE_PORT = 3000;
+export const BOULE_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -2886,7 +2887,7 @@ export class FoundryStepExecutor {
      */
     releaseHost(org, subject, context, renew) {
         const recorded = context.recordedIds();
-        const primaryBlueAppId = recorded[`coolify:app:${appStepKey(org, subject.id)}`];
+        const primaryBlueAppId = recorded[subject.blueAppKey];
         const primaryUuid = recorded[COOLIFY_SERVER_SCOPE_KEY];
         if (!primaryBlueAppId || !primaryUuid)
             return null;
@@ -2951,23 +2952,23 @@ export class FoundryStepExecutor {
             });
             return undefined;
         }
-        const entry = org.hosting.entries.find((e) => e.key === action.desired.entry);
-        if (!entry || !entrySubject(org, entry)) {
-            throw new Error(`${action.kind} for ${org.slug}: no blue/green entry '${String(action.desired.entry)}'`);
+        const found = blueGreenSubjects(org).find((s) => s.id === action.desired.entry);
+        if (!found) {
+            throw new Error(`${action.kind} for ${org.slug}: no blue/green app '${String(action.desired.entry)}'`);
         }
-        const primaryBlueAppId = recorded()[`coolify:app:${appStepKey(org, entry.key)}`];
+        const primaryBlueAppId = recorded()[found.blueAppKey];
         if (!primaryBlueAppId) {
-            throw new Error(`${action.kind} for ${org.slug}: entry '${entry.key}' has no blue app recorded yet`);
+            throw new Error(`${action.kind} for ${org.slug}: app '${found.id}' has no blue app recorded yet`);
         }
         // The blue app keeps the name it has: an app that ran before blue/green is adopted under its own name.
-        if (!recorded()[bgKey.blueName(entry.key)]) {
+        if (!recorded()[bgKey.blueName(found.id)]) {
             const blue = await this.ports.coolify.getApplication(primaryBlueAppId);
             if (blue.name) {
-                context.recordScopeId(bgKey.blueName(entry.key), blue.name);
+                context.recordScopeId(bgKey.blueName(found.id), blue.name);
                 await context.persistScopeIds();
             }
         }
-        const subject = entrySubject(org, entry, recorded());
+        const subject = blueGreenSubjects(org, recorded()).find((s) => s.id === found.id);
         const runtime = this.ports.runtime ?? {};
         const deps = {
             coolify: this.ports.coolify,
@@ -2980,17 +2981,39 @@ export class FoundryStepExecutor {
                 if (typeof this.ports.heldKeys?.put !== 'function') {
                     throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the health token`);
                 }
-                const token = await this.ensureSharedSecret(org, healthTokenName(entry.key), recorded());
+                const token = await this.ensureSharedSecret(org, healthTokenName(subject.id), recorded());
                 this.handledSecrets.add(token);
                 return token;
             },
+            actionsKey: async () => {
+                const heldKeys = this.ports.heldKeys;
+                if (typeof heldKeys?.put !== 'function') {
+                    throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the server actions key`);
+                }
+                const put = heldKeys.put;
+                const key = await mintActionsKey({
+                    id: subject.id,
+                    ref: sharedSecretRef(org.id, actionsKeyName(subject.id)),
+                    recorded,
+                    record: (k, v) => context.recordScopeId(k, v),
+                    persist: () => context.persistScopeIds(),
+                    heldKeys: {
+                        resolve: async (r) => (await heldKeys.resolve(r)) ?? null,
+                        put: (r, v) => put.call(heldKeys, r, v),
+                    },
+                    generate: () => randomBytes(32).toString('base64'),
+                    secret: (value) => void this.handledSecrets.add(value),
+                });
+                return key;
+            },
             secret: (value) => void this.handledSecrets.add(value),
             runtime,
             sleep: runtime.sleep ?? defaultSleep,
-            label: `${action.system}:${action.kind}:${entry.key}`,
+            label: `${action.system}:${action.kind}:${subject.id}`,
             primaryBlueAppId,
             logDir: LOG_DIR,
             isRunning: isRunningOrStarting,
+            stageGuards: this.stageGuards(org, subject, recorded(), action.desired.accessProviderId),
         };
         if (action.kind === 'bluegreen-lb') {
             await applyBlueGreenWeights(deps, subject, { uuid: serverUuid, primaryUuid });
@@ -3000,6 +3023,38 @@ export class FoundryStepExecutor {
         }
         return undefined;
     }
+    /**
+     * Stage's guards (`plan/stage-guards.ts`): the probe port the host supplied, and the Access gate over the stage
+     * host. The gate is offered only when everything it needs is in hand (a domain, the platform's Access provider,
+     * the company's sign-in organisation, an owner, an Access port) and no `hosting.access` rule names the host: a
+     * bypass or service-token rule there would open stage, so no gate is made and the guard stays unrecorded.
+     */
+    stageGuards(org, subject, recorded, providerId) {
+        const guards = this.ports.stageProbes ? { probes: this.ports.stageProbes } : {};
+        const claimValue = recorded[ZITADEL_ORG_SCOPE_KEY];
+        const emails = org.owners.map((owner) => owner.email);
+        if (!org.domain || typeof providerId !== 'string' || !providerId || !claimValue)
+            return guards;
+        if (emails.length === 0 || !(this.ports.access || this.ports.edge))
+            return guards;
+        const hostname = stageHostname(org.domain, subject.id);
+        if ((org.hosting.access ?? []).some((rule) => rule.hostname === hostname))
+            return guards;
+        guards.gate = {
+            hostname,
+            create: () => this.accessPort().createGate({
+                organisationId: org.id,
+                key: stageGateKey(subject.id),
+                entry: subject.id,
+                hostnames: [hostname],
+                providerId,
+                claimName: GATE_CLAIM_NAME,
+                claimValue,
+                emails,
+            }),
+        };
+        return guards;
+    }
     async coolifyApp(action, org, context) {
         const recordedAppId = context.recordedIds()[`coolify:app:${action.key}`];
         if (action.desired.enabled === false) {
@@ -3128,7 +3183,7 @@ export class FoundryStepExecutor {
                 autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
-                is_auto_deploy_enabled: entry.autoDeploy,
+                is_auto_deploy_enabled: appSettingsOf(entry).autoDeploy,
                 // Also the folder a static entry serves: Coolify's static build
                 // copies `base_directory`, and reads `publish_directory` only for a
                 // built app.
@@ -3298,7 +3353,7 @@ export class FoundryStepExecutor {
         // actually resolved a mail domain for this org.
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
-        if (entry.key === APP_ENTRY_KEY) {
+        if (isMainEntry(entry)) {
             await this.ensureAppLettermintMail(appId, org, context, 
             // Deployed or started above on every path, a created app included
             // (#566), so it has read its env before the mail env is written.
@@ -3718,10 +3773,8 @@ export class FoundryStepExecutor {
     async pushAppEnv(appId, org, entry, context, authIssuer, secretSources) {
         const recorded = context.recordedIds();
         const envs = [
-            // Only the `app` entry has a public name; the others are internal.
-            ...(entry.key === APP_ENTRY_KEY
-                ? [{ key: 'APP_URL', value: `https://${appHostname(org)}` }]
-                : []),
+            // Only the main entry has a public name; the others are internal.
+            ...(isMainEntry(entry) ? [{ key: 'APP_URL', value: `https://${appHostname(org)}` }] : []),
             // #75: read back by the package-side pino sink (not this repo's job,
             // #75 "What belongs where") once `ensureLogVolume` has mounted the
             // matching volume.
@@ -4203,7 +4256,9 @@ export class FoundryStepExecutor {
         const { org, context, mailDomain, self, mailFrom } = args;
         const appName = `${org.slug}-app`;
         const recorded = context.recordedIds();
-        const appId = self.role === 'app' ? self.id : recorded[`coolify:app:${appStepKey(org)}`];
+        const appId = self.role === 'app'
+            ? self.id
+            : recorded[`coolify:app:${appStepKey(org, mainEntry(org.hosting)?.key)}`];
         const bouleId = self.role === 'boule' ? self.id : recorded[`coolify:boule:${org.id}`];
         const peerListEnvs = (id) => !id || id === self.id
             ? Promise.resolve(null)
@@ -7452,7 +7507,10 @@ export class FoundryStepExecutor {
         const loginHost = action.desired.loginHost ?? null;
         // A hosting entry's names (and its wildcard) go straight to its container on the company network:
         // the container carries `traefik.enable=false`, so the proxy has no route for it.
-        const entryOrigins = new Map(entryRoutes(org, context.recordedIds()).map((r) => [r.hostname, r.service]));
+        const entryOrigins = new Map([
+            ...entryRoutes(org, context.recordedIds()),
+            ...builtinRoutes(org, context.recordedIds()),
+        ].map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
@@ -9175,6 +9233,7 @@ export class FoundryStepExecutor {
                     await this.accessPort().deleteAccessApp(target.id);
                     return;
                 case 'cloudflare:gate':
+                case 'cloudflare:bg-gate':
                     await this.accessPort().deleteGate(target.id);
                     return;
                 case 'ai:key': {

package/dist/plan/health-targets.js

@@ -1,4 +1,3 @@
-import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
@@ -187,7 +186,7 @@ function hostingEntryTarget(org, entry) {
  * differently-written version of the same choice.
  */
 function appTargets(org) {
-    if (org.hosting.enabled && appEntry(org.hosting)) {
+    if (org.hosting.enabled && org.hosting.entries.length > 0) {
         return org.hosting.entries.map((entry) => hostingEntryTarget(org, entry));
     }
     if (org.site.enabled) {

package/dist/plan/hostnames.d.ts

@@ -1,7 +1,7 @@
 import type { DeclaredOrg, HostingEntry } from '../org.js';
 /**
  * The full names an entry is served at. With `hosting.usesDomain` off, or no
- * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * domain, `hostnames` is not read: the main entry is at `<slug>.oikos.host`
  * and every other entry is internal. `'*'` names nothing here; the wildcard is
  * acted on elsewhere.
  */
@@ -10,7 +10,7 @@ export declare function entryHostnames(org: DeclaredOrg, entry: HostingEntry): s
  * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
  * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
  * under `oikos.host`, so the free Universal certificate covers it), and
- * `<slug>.oikos.host` for the entry keyed `app`.
+ * `<slug>.oikos.host` for the main entry.
  */
 export declare function workerAppHostname(org: DeclaredOrg, entry: HostingEntry): string;
 /**

package/dist/plan/hostnames.js

@@ -1,10 +1,10 @@
-import { APP_ENTRY_KEY } from '../org.js';
+import { isMainEntry, mainEntry } from '../org.js';
 import { workerAppHostnameOf } from '../worker-app-config.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 /**
  * The full names an entry is served at. With `hosting.usesDomain` off, or no
- * domain, `hostnames` is not read: the `app` entry is at `<slug>.oikos.host`
+ * domain, `hostnames` is not read: the main entry is at `<slug>.oikos.host`
  * and every other entry is internal. `'*'` names nothing here; the wildcard is
  * acted on elsewhere.
  */
@@ -13,7 +13,7 @@ export function entryHostnames(org, entry) {
     if (entry.workerApp)
         return [workerAppHostname(org, entry)];
     if (!org.hosting.usesDomain || !domain) {
-        return entry.key === APP_ENTRY_KEY ? [`${org.slug}.oikos.host`] : [];
+        return isMainEntry(entry) ? [`${org.slug}.oikos.host`] : [];
     }
     return entry.hostnames.flatMap((name) => name === '*' ? [] : name === '@' ? [domain] : [`${name}.${domain}`]);
 }
@@ -21,10 +21,10 @@ export function entryHostnames(org, entry) {
  * The one exact name a Worker app is served at (ADR 0002): `<host>.<domain>` or
  * the apex on the org's own domain, else `<slug>-<key>.oikos.host` (one label
  * under `oikos.host`, so the free Universal certificate covers it), and
- * `<slug>.oikos.host` for the entry keyed `app`.
+ * `<slug>.oikos.host` for the main entry.
  */
 export function workerAppHostname(org, entry) {
-    return workerAppHostnameOf({ slug: org.slug, domain: org.domain, usesDomain: org.hosting.usesDomain }, entry.key, entry.workerApp?.host ?? '@');
+    return workerAppHostnameOf({ slug: org.slug, domain: org.domain, usesDomain: org.hosting.usesDomain }, entry, entry.workerApp?.host ?? '@');
 }
 /**
  * The wildcard name (`*.<domain>`) when an entry declares `'*'`, else `null`.
@@ -43,7 +43,7 @@ export function wildcardHostname(org) {
  * and the jobs registration read it.
  */
 export function appHostname(org) {
-    const entry = org.hosting.entries.find((e) => e.key === APP_ENTRY_KEY);
+    const entry = mainEntry(org.hosting);
     const first = entry ? entryHostnames(org, entry)[0] : undefined;
     return first ?? legacyAppHostname(org);
 }

package/dist/plan/index.d.ts

@@ -24,7 +24,7 @@ export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCO
 export type { OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
 export { OrgPostgresMigrationBackupMissingError } from './backup-gate.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
 export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
@@ -39,6 +39,8 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelOrgMetadata } from './zitadel-org-metadata.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
+export { DumpError, dumpNow } from './database-dump.js';
+export type { DatabaseDump } from './database-dump.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';

package/dist/plan/index.js

@@ -11,7 +11,7 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.
 export { AdoptRefusedError } from './adopt.js';
 export { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, } from './org-postgres-migrate.js';
 export { OrgPostgresMigrationBackupMissingError } from './backup-gate.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, stepEntryKey, } from './plan-apply.js';
 export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
@@ -22,6 +22,10 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelOrgMetadata } from './zitadel-org-metadata.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
+// #170: the platform's shared calls SFU step -- narrow ports a host (archon)
+// implements over held keys and its own SSH client, the same shape the rest
+// of `platform-providers.ts` uses for Cloudflare.
+export { DumpError, dumpNow } from './database-dump.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';

package/dist/plan/locked-hostnames.d.ts

@@ -20,4 +20,5 @@ export declare function hostingNames(org: DeclaredOrg, platformHostnames: readon
     locked: Set<string>;
     slug: string;
     siteOwnsApex: boolean;
+    builtinBlueGreen: boolean;
 };

package/dist/plan/locked-hostnames.js

@@ -58,5 +58,6 @@ export function hostingNames(org, platformHostnames) {
         locked: lockedHostnames(org, platformHostnames),
         slug: org.slug,
         siteOwnsApex: org.site.enabled && org.site.usesDomain && org.domain !== null,
+        builtinBlueGreen: org.boule?.blueGreen !== undefined || org.agora?.blueGreen !== undefined,
     };
 }

package/dist/plan/plan-apply.d.ts

@@ -1,5 +1,5 @@
 import type { DestroyProgress, PlanApply } from '../apply.js';
-import type { DeclaredOrg, OrgId } from '../org.js';
+import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { ReleaseStore } from '../release/state.js';
@@ -443,6 +443,18 @@ export declare class PlatformConfirmationRequiredError extends Error {
 export interface FoundryApplyOptions {
     /** Service names (`VersionChangeItem.service`), matched exactly, whose version change the operator confirmed. */
     confirmUpgrade?: readonly string[];
+    /**
+     * A company's own confirmation for one of its apps, in place of the org's name. `apply` passes a
+     * destroying or migrating step only when {@link stepEntryKey} says it belongs to `entryKey` and
+     * `typed` equals `entryKey` exactly. Every other such step still needs the org's name, as does
+     * the whole plan when `typed` differs. It never passes a platform step.
+     */
+    entryConfirmation?: {
+        entryKey: string;
+        typed: string;
+        /** The removed entry's gate keys, read by the caller from the company before the change. */
+        gates?: readonly string[];
+    };
 }
 export interface FoundryPlanApplyOptions {
     store: DeclaredOrgStore;
@@ -947,3 +959,20 @@ export declare class FoundryPlanApply implements PlanApply {
  * than a second copy that could drift from it.
  */
 export declare function planNeedsConfirmation(steps: readonly PlanStep[]): boolean;
+/**
+ * The key of the hosting entry a step belongs to, or `null` for a step of the org or the platform.
+ * An entry's own steps are keyed `<orgId>:<entry key>` (its Coolify app, Worker, Worker app, and
+ * ai, edge and files keys); with `orgId` the prefix must be exactly that id. With `entries` (the
+ * declared ones) two more are known: the ZITADEL sign-in client named like an entry that declares
+ * `uses.auth`, and a gate named in an entry's `gates`. The org database, the org-wide files key,
+ * the customers organisation and the issuer belong to no entry. (`apply` lets an entry's
+ * confirmation pass the park of the org database once no declared entry uses a database.)
+ */
+export declare function stepEntryKey(step: {
+    action: Pick<StepAction, 'system' | 'kind' | 'key'>;
+}, orgId?: string, entries?: readonly Pick<HostingEntry, 'key' | 'uses' | 'gates'>[]): string | null;
+/** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
+export declare function entryConfirms(confirmation: FoundryApplyOptions['entryConfirmation'], steps: readonly {
+    step: PlanStep;
+    action: StepAction;
+}[], orgId: string, entries: readonly HostingEntry[]): boolean;

package/dist/plan/plan-apply.js

@@ -5,10 +5,11 @@ import { ORG_SERVICE_SCHEMAS, heldEnvRef, ownsServices, validateHosting } from '
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
 import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
+import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
-import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, entrySubject, } from './blue-green.js';
+import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, blueGreenSubjects, declaresBlueGreen, lbOrigin, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
 import { LEGACY_BACKUP_NAMES } from './company-backups.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
@@ -577,7 +578,8 @@ export class FoundryPlanApply {
                 }
             }
             if (planNeedsConfirmation(plan.steps) &&
-                confirmedOrgName.trim() !== org.displayName.trim()) {
+                confirmedOrgName.trim() !== org.displayName.trim() &&
+                !entryConfirms(options.entryConfirmation, detail.plannedSteps, org.id, org.hosting.entries)) {
                 await this.refuse(plan, "destructive or migrating step without the org's name typed correctly");
                 throw new ConfirmationRequiredError(orgId);
             }
@@ -1149,10 +1151,13 @@ export class FoundryPlanApply {
         const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
         if (!store || !this.executor.releaseHost || !primaryUuid)
             return;
-        for (const entry of org.hosting.entries) {
-            const subject = entrySubject(org, entry, context.recordedIds());
-            if (!subject)
+        for (const subject of blueGreenSubjects(org, context.recordedIds())) {
+            // A built-in app's names reach its balancer only once the tunnel was last written with it: until then a
+            // pinned check would answer from blue whatever color it names.
+            if (subject.builtin &&
+                !(context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '').includes(`"service":"${lbOrigin(subject)}"`)) {
                 continue;
+            }
             const host = this.executor.releaseHost(org, subject, context, () => this.renewLease(fence));
             if (!host)
                 continue;
@@ -1222,7 +1227,7 @@ export class FoundryPlanApply {
     async runReleaseTick() {
         const results = [];
         for (const org of await this.store.list()) {
-            if (!org.hosting.entries.some((entry) => entry.blueGreen))
+            if (!declaresBlueGreen(org))
                 continue;
             try {
                 await this.runOrgReleaseTick(org.id);
@@ -1305,7 +1310,7 @@ export class FoundryPlanApply {
         const sfuPortsOpen = await this.readSfuPortsOpen(org);
         const resumable = await this.ownResumableRefs(org);
         // Read only for an org that declares it; a failed read plans none and says so (`planBlueGreen`).
-        const blueGreenServers = org.hosting.entries.some((e) => e.blueGreen) && this.executor.blueGreenServers
+        const blueGreenServers = declaresBlueGreen(org) && this.executor.blueGreenServers
             ? await this.executor.blueGreenServers().catch(() => undefined)
             : undefined;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
@@ -1859,6 +1864,73 @@ export class FoundryPlanApply {
 export function planNeedsConfirmation(steps) {
     return steps.some((step) => step.destroys || step.migrates);
 }
+/**
+ * The key of the hosting entry a step belongs to, or `null` for a step of the org or the platform.
+ * An entry's own steps are keyed `<orgId>:<entry key>` (its Coolify app, Worker, Worker app, and
+ * ai, edge and files keys); with `orgId` the prefix must be exactly that id. With `entries` (the
+ * declared ones) two more are known: the ZITADEL sign-in client named like an entry that declares
+ * `uses.auth`, and a gate named in an entry's `gates`. The org database, the org-wide files key,
+ * the customers organisation and the issuer belong to no entry. (`apply` lets an entry's
+ * confirmation pass the park of the org database once no declared entry uses a database.)
+ */
+export function stepEntryKey(step, orgId, entries = []) {
+    const { system, kind, key } = step.action;
+    if (system === 'zitadel' && kind === 'app') {
+        return entries.find((e) => e.key === key && e.uses?.auth)?.key ?? null;
+    }
+    const entryOwned = (system === 'coolify' && kind === 'app') ||
+        (system === 'cloudflare' && (kind === 'worker' || kind === 'worker-app' || kind === 'gate')) ||
+        (kind === 'key' && (system === 'ai' || system === 'edge' || system === 'files'));
+    if (!entryOwned)
+        return null;
+    const colon = key.indexOf(':');
+    if (colon < 1)
+        return null;
+    const prefix = key.slice(0, colon);
+    if (orgId === undefined ? prefix === 'platform' : prefix !== orgId)
+        return null;
+    const rest = key.slice(colon + 1);
+    if (rest === '' || rest.includes(':'))
+        return null;
+    if (kind === 'gate')
+        return entries.find((e) => e.gates?.some((g) => g.key === rest))?.key ?? null;
+    return rest;
+}
+/**
+ * The step that parks the org's one database. It belongs to the org, not to an entry, but the
+ * entry that removes the last use of it may confirm it (see `entryConfirms`).
+ */
+function isOrgDatabasePark(step, orgId) {
+    const { system, kind, key } = step.action;
+    return system === 'coolify' && kind === 'database' && key === orgId && step.step.destroys;
+}
+/**
+ * The delete of one of the org's gates that no entry declares any more. The step names only the
+ * gate, so the caller names the removed entry's gates (`entryConfirmation.gates`) and only those pass.
+ */
+function isUndeclaredGateDelete(step, orgId) {
+    const { system, kind, key, desired } = step.action;
+    return (system === 'cloudflare' &&
+        kind === 'gate' &&
+        key.startsWith(`${orgId}:`) &&
+        desired?.mode === 'delete');
+}
+/** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
+export function entryConfirms(confirmation, steps, orgId, entries) {
+    if (!confirmation ||
+        confirmation.entryKey === '' ||
+        confirmation.typed !== confirmation.entryKey) {
+        return false;
+    }
+    return steps
+        .filter(({ step }) => step.destroys || step.migrates)
+        .every((planned) => stepEntryKey(planned, orgId, entries) === confirmation.entryKey ||
+        (isOrgDatabasePark(planned, orgId) && !entries.some(entryHasDatabase)) ||
+        (isUndeclaredGateDelete(planned, orgId) &&
+            !planned.step.migrates &&
+            (confirmation.gates ?? []).includes(planned.action.key.slice(orgId.length + 1)) &&
+            !entries.some((e) => e.key === confirmation.entryKey)));
+}
 /** `AppliedState.serviceIds`' two flat ZITADEL scope keys (`executor.ts`'s `ensureZitadelProject`/`zitadelIssuer`) -- no `:`, unlike a resource key. */
 const ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_project';
 const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
@@ -2068,11 +2140,12 @@ function destroyStepDescriptions(targets) {
 /** Scope keys of the Coolify apps blue/green made: `bg.<entry>.app.<server>.<part>`, a database sidecar, a connector on another server. */
 const BLUE_GREEN_APP_KEY = /^(bg\.[^.:]+\.app\.[^.:]+\.[a-z]+|bgdb\.[^.:]+\.sidecar\.[^.:]+|cloudflare_tunnel_connector_app\.[^.:]+)$/;
 const BLUE_GREEN_DATABASE_KEY = /^bg\.[^.:]+\.stagedb$/;
-/** The database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
+/** Stage's Access gate (`bg.<entry>.stagegate`), and the database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
 const BLUE_GREEN_EDGE_KEYS = [
     [/^bgdb\.[^.:]+\.access$/, 'bg-access'],
     [/^bgdb\.[^.:]+\.(token|undelivered)$/, 'bg-token'],
     [/^bgdb\.[^.:]+\.route$/, 'bg-dns'],
+    [/^bg\.[^.:]+\.stagegate$/, 'bg-gate'],
 ];
 /** Every recorded blue/green app (then stage's database), in key order. A destroy target's `key` is the scope key itself. */
 function blueGreenDestroyTargets(serviceIds) {
@@ -2152,6 +2225,11 @@ const STEP_FIELDS = {
     'cloudflare:worker-app': 'hosting.entries.workerApp',
 };
 function stepField(action) {
+    if (action.system === 'coolify' &&
+        action.kind.startsWith('bluegreen') &&
+        (action.desired.entry === 'boule' || action.desired.entry === 'agora')) {
+        return `${action.desired.entry}.blueGreen`;
+    }
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.
     if (action.system === 'ai' && action.kind === 'key' && action.key.includes(':')) {
         return 'hosting.entries.uses.ai';

package/dist/plan/platform-diff.js

@@ -730,7 +730,8 @@ export function appSettingsOf(entry) {
     return {
         folder: entry.folder,
         port: entry.port,
-        autoDeploy: entry.autoDeploy,
+        // A blue/green entry deploys only through the release runner.
+        autoDeploy: entry.blueGreen ? false : entry.autoDeploy,
         ...(entry.buildPack === 'static' ? { staticFolderIn: 'base_directory' } : {}),
     };
 }

package/dist/plan/platform-providers.js

@@ -3890,8 +3890,13 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'vipps-agreement', path: '/vipps/agreement' },
     { name: 'usage-tick', path: '/api/usage/tick' },
     { name: 'reporting-collect', path: '/api/reporting/collect' },
+    { name: 'release-health', path: '/api/reporting/release-health' },
+    { name: 'health', path: '/api/health' },
     { name: 'org-changes', path: '/api/orgs/*/changes' },
     { name: 'org-settings', path: '/api/orgs/*/settings' },
+    { name: 'org-apps', path: '/api/orgs/*/apps' },
+    { name: 'org-requests', path: '/api/orgs/*/requests' },
+    { name: 'github-releases', path: '/api/github/releases' },
 ];
 const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
 const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;