@wtfalch/foundry 0.47.0 → 0.48.0

package/dist/plan/executor.d.ts

@@ -19,6 +19,7 @@ import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor }
 import type { EdgePortName } from './platform-org.js';
 import type { RequestHeaderPort } from './platform-providers.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
+import { type StageProbePort } from './stage-guards.js';
 import type { WorkerAppDatabasePort } from './worker-app-database.js';
 import { type KeysCustodyPort, type WorkerAppPort } from './worker-app.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
@@ -1731,6 +1732,11 @@ export interface FoundryStepExecutorPorts {
      * `edge.access` (see {@link EdgePort.access}). Kept for a host or a test that supplies its own.
      */
     access?: AccessPort;
+    /**
+     * The calls that prove a stage credential does not work against production (`plan/stage-guards.ts`). Without
+     * one the probes are reported as not run, and the stage copy stays blocked.
+     */
+    stageProbes?: StageProbePort;
     /**
      * F4.ratelimits: overrides the rate limiting rule calls, which otherwise go through
      * `edge.ratelimits` (see {@link EdgePort.ratelimits}). Kept for a host or a test that supplies its own.
@@ -1909,6 +1915,41 @@ export declare function healthUrls(org: DeclaredOrg): string[];
 export declare const COOLIFY_PROXY_ORIGIN = "http://coolify-proxy:80";
 /** The one Access policy foundry puts on a platform Access app (#84). */
 export declare const ACCESS_POLICY_NAME = "foundry: allowed emails";
+/**
+ * #164: the repo `coolifyAgora` builds the org's Agora from
+ * (https://github.com/wtfalch/agora) -- the issue's own "How" names this
+ * exact Dockerfile, and it is the only build strategy any app this file
+ * provisions ever uses ({@link CMS_APP_DOCKERFILE}/
+ * `CALLS_SERVICE_DOCKERFILE` below are all `dockerfile_location` into a
+ * `createGithubAppApplication` build-from-repo call, never a registry
+ * image): "Coolify builds each org's Agora from the agora repo" is not a
+ * fresh product choice here, it is this file's one established convention,
+ * followed rather than reopened (#164 "Decide" 1). The agora repo's own
+ * Dockerfile (`apps/agora/Dockerfile`) already `EXPOSE`s 8080 and serves
+ * from a build built at the repository root, the same one-repo shape
+ * `CMS_REPO`'s own two apps use. This comment used to claim that needed no
+ * `ports_exposes` of its own, on the theory that Coolify's github-app build
+ * reads a Dockerfile's `EXPOSE` the same way it does for `cmsSite`'s two
+ * apps above -- wrong (#506): Coolify never reads `EXPOSE` for a build it
+ * runs itself, so without an explicit `agora.ts`'s `AGORA_APP_PORTS_EXPOSES`,
+ * Traefik is left routing to a port nothing listens on, and a company's
+ * Agora answers 502 behind the tunnel. Seen live on Company Included,
+ * 2026-10-05.
+ */
+export declare const AGORA_REPO = "wtfalch/agora";
+export declare const AGORA_APP_DOCKERFILE = "/apps/agora/Dockerfile";
+/**
+ * #161 (Boule part): the repo `coolifyBoule` builds the org's Boule from
+ * (https://github.com/wtfalch/boule), by the same convention as
+ * {@link AGORA_REPO}: Coolify's github-app build from the repo, never a
+ * registry image. Boule's own Dockerfile is at the repository root, serves on
+ * 3000 (`EXPOSE 3000`) and runs `scripts/migrate-and-start.sh`, which applies
+ * its migrations as the owner and then serves as the `<database>_rt` role.
+ */
+export declare const BOULE_REPO = "wtfalch/boule";
+export declare const BOULE_APP_DOCKERFILE = "/Dockerfile";
+/** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
+export declare const BOULE_PORT = 3000;
 export declare const LOG_DIR = "/app/logs";
 /** The company's Coolify destination (its Docker network `co-<slug>`), recorded when its first resource is created. */
 export declare const COOLIFY_DESTINATION_SCOPE_KEY = "coolify_destination";
@@ -2342,6 +2383,13 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * a step for it fails, which the next plan reports instead.
      */
     private coolifyBlueGreen;
+    /**
+     * Stage's guards (`plan/stage-guards.ts`): the probe port the host supplied, and the Access gate over the stage
+     * host. The gate is offered only when everything it needs is in hand (a domain, the platform's Access provider,
+     * the company's sign-in organisation, an owner, an Access port) and no `hosting.access` rule names the host: a
+     * bypass or service-token rule there would open stage, so no gate is made and the guard stays unrecorded.
+     */
+    private stageGuards;
     private coolifyApp;
     /**
      * #75: mounts a persistent volume at {@link LOG_DIR} on the app, unless one

package/dist/plan/executor.js

@@ -8,7 +8,7 @@ import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, file
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
-import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
+import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, splitServers, } from './blue-green.js';
 import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
 import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
@@ -53,13 +53,14 @@ import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutAppliedValue, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
-import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { createReleaseHost } from './release-host.js';
 import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
+import { stageGateKey, stageHostname, } from './stage-guards.js';
 import { WORKER_APP_CALL_TIMEOUT_MS, applyWorkerApp, heldBrokerKey, teardownWorkerApp, withCallTimeout, } from './worker-app.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -342,8 +343,8 @@ const CMS_APP_PORT = 3000;
  * Agora answers 502 behind the tunnel. Seen live on Company Included,
  * 2026-10-05.
  */
-const AGORA_REPO = 'wtfalch/agora';
-const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
+export const AGORA_REPO = 'wtfalch/agora';
+export const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
 /**
  * #161 (Boule part): the repo `coolifyBoule` builds the org's Boule from
  * (https://github.com/wtfalch/boule), by the same convention as
@@ -352,10 +353,10 @@ const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
  * 3000 (`EXPOSE 3000`) and runs `scripts/migrate-and-start.sh`, which applies
  * its migrations as the owner and then serves as the `<database>_rt` role.
  */
-const BOULE_REPO = 'wtfalch/boule';
-const BOULE_APP_DOCKERFILE = '/Dockerfile';
+export const BOULE_REPO = 'wtfalch/boule';
+export const BOULE_APP_DOCKERFILE = '/Dockerfile';
 /** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
-const BOULE_PORT = 3000;
+export const BOULE_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -2886,7 +2887,7 @@ export class FoundryStepExecutor {
      */
     releaseHost(org, subject, context, renew) {
         const recorded = context.recordedIds();
-        const primaryBlueAppId = recorded[`coolify:app:${appStepKey(org, subject.id)}`];
+        const primaryBlueAppId = recorded[subject.blueAppKey];
         const primaryUuid = recorded[COOLIFY_SERVER_SCOPE_KEY];
         if (!primaryBlueAppId || !primaryUuid)
             return null;
@@ -2951,23 +2952,23 @@ export class FoundryStepExecutor {
             });
             return undefined;
         }
-        const entry = org.hosting.entries.find((e) => e.key === action.desired.entry);
-        if (!entry || !entrySubject(org, entry)) {
-            throw new Error(`${action.kind} for ${org.slug}: no blue/green entry '${String(action.desired.entry)}'`);
+        const found = blueGreenSubjects(org).find((s) => s.id === action.desired.entry);
+        if (!found) {
+            throw new Error(`${action.kind} for ${org.slug}: no blue/green app '${String(action.desired.entry)}'`);
         }
-        const primaryBlueAppId = recorded()[`coolify:app:${appStepKey(org, entry.key)}`];
+        const primaryBlueAppId = recorded()[found.blueAppKey];
         if (!primaryBlueAppId) {
-            throw new Error(`${action.kind} for ${org.slug}: entry '${entry.key}' has no blue app recorded yet`);
+            throw new Error(`${action.kind} for ${org.slug}: app '${found.id}' has no blue app recorded yet`);
         }
         // The blue app keeps the name it has: an app that ran before blue/green is adopted under its own name.
-        if (!recorded()[bgKey.blueName(entry.key)]) {
+        if (!recorded()[bgKey.blueName(found.id)]) {
             const blue = await this.ports.coolify.getApplication(primaryBlueAppId);
             if (blue.name) {
-                context.recordScopeId(bgKey.blueName(entry.key), blue.name);
+                context.recordScopeId(bgKey.blueName(found.id), blue.name);
                 await context.persistScopeIds();
             }
         }
-        const subject = entrySubject(org, entry, recorded());
+        const subject = blueGreenSubjects(org, recorded()).find((s) => s.id === found.id);
         const runtime = this.ports.runtime ?? {};
         const deps = {
             coolify: this.ports.coolify,
@@ -2980,17 +2981,39 @@ export class FoundryStepExecutor {
                 if (typeof this.ports.heldKeys?.put !== 'function') {
                     throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the health token`);
                 }
-                const token = await this.ensureSharedSecret(org, healthTokenName(entry.key), recorded());
+                const token = await this.ensureSharedSecret(org, healthTokenName(subject.id), recorded());
                 this.handledSecrets.add(token);
                 return token;
             },
+            actionsKey: async () => {
+                const heldKeys = this.ports.heldKeys;
+                if (typeof heldKeys?.put !== 'function') {
+                    throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the server actions key`);
+                }
+                const put = heldKeys.put;
+                const key = await mintActionsKey({
+                    id: subject.id,
+                    ref: sharedSecretRef(org.id, actionsKeyName(subject.id)),
+                    recorded,
+                    record: (k, v) => context.recordScopeId(k, v),
+                    persist: () => context.persistScopeIds(),
+                    heldKeys: {
+                        resolve: async (r) => (await heldKeys.resolve(r)) ?? null,
+                        put: (r, v) => put.call(heldKeys, r, v),
+                    },
+                    generate: () => randomBytes(32).toString('base64'),
+                    secret: (value) => void this.handledSecrets.add(value),
+                });
+                return key;
+            },
             secret: (value) => void this.handledSecrets.add(value),
             runtime,
             sleep: runtime.sleep ?? defaultSleep,
-            label: `${action.system}:${action.kind}:${entry.key}`,
+            label: `${action.system}:${action.kind}:${subject.id}`,
             primaryBlueAppId,
             logDir: LOG_DIR,
             isRunning: isRunningOrStarting,
+            stageGuards: this.stageGuards(org, subject, recorded(), action.desired.accessProviderId),
         };
         if (action.kind === 'bluegreen-lb') {
             await applyBlueGreenWeights(deps, subject, { uuid: serverUuid, primaryUuid });
@@ -3000,6 +3023,38 @@ export class FoundryStepExecutor {
         }
         return undefined;
     }
+    /**
+     * Stage's guards (`plan/stage-guards.ts`): the probe port the host supplied, and the Access gate over the stage
+     * host. The gate is offered only when everything it needs is in hand (a domain, the platform's Access provider,
+     * the company's sign-in organisation, an owner, an Access port) and no `hosting.access` rule names the host: a
+     * bypass or service-token rule there would open stage, so no gate is made and the guard stays unrecorded.
+     */
+    stageGuards(org, subject, recorded, providerId) {
+        const guards = this.ports.stageProbes ? { probes: this.ports.stageProbes } : {};
+        const claimValue = recorded[ZITADEL_ORG_SCOPE_KEY];
+        const emails = org.owners.map((owner) => owner.email);
+        if (!org.domain || typeof providerId !== 'string' || !providerId || !claimValue)
+            return guards;
+        if (emails.length === 0 || !(this.ports.access || this.ports.edge))
+            return guards;
+        const hostname = stageHostname(org.domain, subject.id);
+        if ((org.hosting.access ?? []).some((rule) => rule.hostname === hostname))
+            return guards;
+        guards.gate = {
+            hostname,
+            create: () => this.accessPort().createGate({
+                organisationId: org.id,
+                key: stageGateKey(subject.id),
+                entry: subject.id,
+                hostnames: [hostname],
+                providerId,
+                claimName: GATE_CLAIM_NAME,
+                claimValue,
+                emails,
+            }),
+        };
+        return guards;
+    }
     async coolifyApp(action, org, context) {
         const recordedAppId = context.recordedIds()[`coolify:app:${action.key}`];
         if (action.desired.enabled === false) {
@@ -3128,7 +3183,7 @@ export class FoundryStepExecutor {
                 autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
-                is_auto_deploy_enabled: entry.autoDeploy,
+                is_auto_deploy_enabled: appSettingsOf(entry).autoDeploy,
                 // Also the folder a static entry serves: Coolify's static build
                 // copies `base_directory`, and reads `publish_directory` only for a
                 // built app.
@@ -7452,7 +7507,10 @@ export class FoundryStepExecutor {
         const loginHost = action.desired.loginHost ?? null;
         // A hosting entry's names (and its wildcard) go straight to its container on the company network:
         // the container carries `traefik.enable=false`, so the proxy has no route for it.
-        const entryOrigins = new Map(entryRoutes(org, context.recordedIds()).map((r) => [r.hostname, r.service]));
+        const entryOrigins = new Map([
+            ...entryRoutes(org, context.recordedIds()),
+            ...builtinRoutes(org, context.recordedIds()),
+        ].map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
@@ -9175,6 +9233,7 @@ export class FoundryStepExecutor {
                     await this.accessPort().deleteAccessApp(target.id);
                     return;
                 case 'cloudflare:gate':
+                case 'cloudflare:bg-gate':
                     await this.accessPort().deleteGate(target.id);
                     return;
                 case 'ai:key': {

package/dist/plan/index.d.ts

@@ -39,6 +39,8 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelOrgMetadata } from './zitadel-org-metadata.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
+export { DumpError, dumpNow } from './database-dump.js';
+export type { DatabaseDump } from './database-dump.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';

package/dist/plan/index.js

@@ -22,6 +22,10 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelOrgMetadata } from './zitadel-org-metadata.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
+// #170: the platform's shared calls SFU step -- narrow ports a host (archon)
+// implements over held keys and its own SSH client, the same shape the rest
+// of `platform-providers.ts` uses for Cloudflare.
+export { DumpError, dumpNow } from './database-dump.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';

package/dist/plan/locked-hostnames.d.ts

@@ -20,4 +20,5 @@ export declare function hostingNames(org: DeclaredOrg, platformHostnames: readon
     locked: Set<string>;
     slug: string;
     siteOwnsApex: boolean;
+    builtinBlueGreen: boolean;
 };

package/dist/plan/locked-hostnames.js

@@ -58,5 +58,6 @@ export function hostingNames(org, platformHostnames) {
         locked: lockedHostnames(org, platformHostnames),
         slug: org.slug,
         siteOwnsApex: org.site.enabled && org.site.usesDomain && org.domain !== null,
+        builtinBlueGreen: org.boule?.blueGreen !== undefined || org.agora?.blueGreen !== undefined,
     };
 }

package/dist/plan/plan-apply.js

@@ -9,7 +9,7 @@ import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
-import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, entrySubject, } from './blue-green.js';
+import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, blueGreenSubjects, declaresBlueGreen, lbOrigin, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
 import { LEGACY_BACKUP_NAMES } from './company-backups.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
@@ -1151,10 +1151,13 @@ export class FoundryPlanApply {
         const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
         if (!store || !this.executor.releaseHost || !primaryUuid)
             return;
-        for (const entry of org.hosting.entries) {
-            const subject = entrySubject(org, entry, context.recordedIds());
-            if (!subject)
+        for (const subject of blueGreenSubjects(org, context.recordedIds())) {
+            // A built-in app's names reach its balancer only once the tunnel was last written with it: until then a
+            // pinned check would answer from blue whatever color it names.
+            if (subject.builtin &&
+                !(context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '').includes(`"service":"${lbOrigin(subject)}"`)) {
                 continue;
+            }
             const host = this.executor.releaseHost(org, subject, context, () => this.renewLease(fence));
             if (!host)
                 continue;
@@ -1224,7 +1227,7 @@ export class FoundryPlanApply {
     async runReleaseTick() {
         const results = [];
         for (const org of await this.store.list()) {
-            if (!org.hosting.entries.some((entry) => entry.blueGreen))
+            if (!declaresBlueGreen(org))
                 continue;
             try {
                 await this.runOrgReleaseTick(org.id);
@@ -1307,7 +1310,7 @@ export class FoundryPlanApply {
         const sfuPortsOpen = await this.readSfuPortsOpen(org);
         const resumable = await this.ownResumableRefs(org);
         // Read only for an org that declares it; a failed read plans none and says so (`planBlueGreen`).
-        const blueGreenServers = org.hosting.entries.some((e) => e.blueGreen) && this.executor.blueGreenServers
+        const blueGreenServers = declaresBlueGreen(org) && this.executor.blueGreenServers
             ? await this.executor.blueGreenServers().catch(() => undefined)
             : undefined;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
@@ -2137,11 +2140,12 @@ function destroyStepDescriptions(targets) {
 /** Scope keys of the Coolify apps blue/green made: `bg.<entry>.app.<server>.<part>`, a database sidecar, a connector on another server. */
 const BLUE_GREEN_APP_KEY = /^(bg\.[^.:]+\.app\.[^.:]+\.[a-z]+|bgdb\.[^.:]+\.sidecar\.[^.:]+|cloudflare_tunnel_connector_app\.[^.:]+)$/;
 const BLUE_GREEN_DATABASE_KEY = /^bg\.[^.:]+\.stagedb$/;
-/** The database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
+/** Stage's Access gate (`bg.<entry>.stagegate`), and the database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
 const BLUE_GREEN_EDGE_KEYS = [
     [/^bgdb\.[^.:]+\.access$/, 'bg-access'],
     [/^bgdb\.[^.:]+\.(token|undelivered)$/, 'bg-token'],
     [/^bgdb\.[^.:]+\.route$/, 'bg-dns'],
+    [/^bg\.[^.:]+\.stagegate$/, 'bg-gate'],
 ];
 /** Every recorded blue/green app (then stage's database), in key order. A destroy target's `key` is the scope key itself. */
 function blueGreenDestroyTargets(serviceIds) {
@@ -2221,6 +2225,11 @@ const STEP_FIELDS = {
     'cloudflare:worker-app': 'hosting.entries.workerApp',
 };
 function stepField(action) {
+    if (action.system === 'coolify' &&
+        action.kind.startsWith('bluegreen') &&
+        (action.desired.entry === 'boule' || action.desired.entry === 'agora')) {
+        return `${action.desired.entry}.blueGreen`;
+    }
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.
     if (action.system === 'ai' && action.kind === 'key' && action.key.includes(':')) {
         return 'hosting.entries.uses.ai';

package/dist/plan/platform-diff.js

@@ -730,7 +730,8 @@ export function appSettingsOf(entry) {
     return {
         folder: entry.folder,
         port: entry.port,
-        autoDeploy: entry.autoDeploy,
+        // A blue/green entry deploys only through the release runner.
+        autoDeploy: entry.blueGreen ? false : entry.autoDeploy,
         ...(entry.buildPack === 'static' ? { staticFolderIn: 'base_directory' } : {}),
     };
 }

package/dist/plan/platform-providers.js

@@ -3890,6 +3890,8 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'vipps-agreement', path: '/vipps/agreement' },
     { name: 'usage-tick', path: '/api/usage/tick' },
     { name: 'reporting-collect', path: '/api/reporting/collect' },
+    { name: 'release-health', path: '/api/reporting/release-health' },
+    { name: 'health', path: '/api/health' },
     { name: 'org-changes', path: '/api/orgs/*/changes' },
     { name: 'org-settings', path: '/api/orgs/*/settings' },
     { name: 'org-apps', path: '/api/orgs/*/apps' },

package/dist/plan/proxy-labels.d.ts

@@ -51,7 +51,19 @@ export declare function entryRoutes(org: DeclaredOrg, recorded?: Readonly<Record
     hostname: string;
     service: string;
 }>;
-/** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
+/**
+ * The tunnel routes of the company's Boule and Agora that run behind a balancer: their names go to it once the
+ * structure on the primary is applied. Until then (and for an app that does not declare blue/green) a name keeps
+ * the Coolify proxy origin it had, so none appears here.
+ */
+export declare function builtinRoutes(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): Array<{
+    hostname: string;
+    service: string;
+}>;
+/**
+ * The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}.
+ * A built-in app's balancer route is added only when there is one, so a company without it keeps its marker.
+ */
 export declare function entryRoutesMarker(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): string;
 /**
  * A short digest of the spec; the same spec always gives the same hash. The token is left out: the

package/dist/plan/proxy-labels.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { PRIMARY_SERVER_SCOPE_KEY, balancerApplied, lbAppName, liveAppNameFor, } from './blue-green.js';
+import { BUILTIN_APPS, PRIMARY_SERVER_SCOPE_KEY, balancerApplied, builtinSubject, lbAppName, lbOrigin, liveAppNameFor, } from './blue-green.js';
 import { entryHostnames, wildcardHostname } from './hostnames.js';
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
 import { appNameFor } from './platform-diff.js';
@@ -85,9 +85,32 @@ export function entryRoutes(org, recorded = {}) {
         routes.push(wildcard);
     return routes;
 }
-/** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
+/**
+ * The tunnel routes of the company's Boule and Agora that run behind a balancer: their names go to it once the
+ * structure on the primary is applied. Until then (and for an app that does not declare blue/green) a name keeps
+ * the Coolify proxy origin it had, so none appears here.
+ */
+export function builtinRoutes(org, recorded = {}) {
+    const routes = [];
+    for (const app of BUILTIN_APPS) {
+        const subject = builtinSubject(org, app, recorded);
+        if (!subject || !balancerApplied(subject.id, recorded, recorded[PRIMARY_SERVER_SCOPE_KEY])) {
+            continue;
+        }
+        for (const hostname of subject.hostnames) {
+            routes.push({ hostname, service: lbOrigin(subject) });
+        }
+    }
+    return routes;
+}
+/**
+ * The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}.
+ * A built-in app's balancer route is added only when there is one, so a company without it keeps its marker.
+ */
 export function entryRoutesMarker(org, recorded = {}) {
-    return JSON.stringify(entryRoutes(org, recorded));
+    const builtin = builtinRoutes(org, recorded);
+    const routes = entryRoutes(org, recorded);
+    return JSON.stringify(builtin.length > 0 ? [...routes, ...builtin] : routes);
 }
 /**
  * A short digest of the spec; the same spec always gives the same hash. The token is left out: the

package/dist/plan/release-host.d.ts

@@ -21,7 +21,7 @@ export interface ReleaseHost {
 export interface ReleaseHostInput {
     subject: BlueGreenSubject;
     context: ReleaseContext;
-    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
+    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
         listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
     };
     /** Reads the entry's health token (`sharedSecretRef(org.id, healthTokenName(id))`). Never mints. */

package/dist/plan/release-host.js

@@ -1,6 +1,6 @@
 import { checkColorAddress, readReleaseHealth } from '../release/health.js';
 import { runRelease } from '../release/run.js';
-import { applyBlueGreenWeights } from './blue-green-apply.js';
+import { applyBlueGreenWeights, copiedEnv } from './blue-green-apply.js';
 import { DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, parseWeights, reportingEnv, } from './blue-green.js';
 import { waitForNewDeployment } from './deploy-health.js';
 import { isNotFoundError } from './executor.js';
@@ -19,21 +19,23 @@ export function createReleaseHost(input) {
     const id = subject.id;
     const recorded = () => context.recordedIds();
     /** Every Coolify app of `color`, one per server that has the structure applied. */
-    const colorApps = (color) => {
+    const colorAppsOnServers = (color) => {
         const ids = recorded();
         const apps = [];
         if (color === 'blue')
-            apps.push(input.primaryBlueAppId);
+            apps.push({ appId: input.primaryBlueAppId, server: input.primaryUuid });
         const prefix = `bg.${id}.app.`;
         for (const key of Object.keys(ids).sort()) {
             if (!key.startsWith(prefix) || !key.endsWith(`.${color}`))
                 continue;
             const value = ids[key];
+            const server = key.slice(prefix.length, key.length - color.length - 1);
             if (value)
-                apps.push(value);
+                apps.push({ appId: value, server });
         }
         return apps;
     };
+    const colorApps = (color) => colorAppsOnServers(color).map((a) => a.appId);
     const primaryColorApp = (color) => color === 'blue' ? input.primaryBlueAppId : recorded()[bgKey.app(id, input.primaryUuid, color)];
     /**
      * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
@@ -66,21 +68,39 @@ export function createReleaseHost(input) {
     const deployTo = async (color, digest) => {
         if (!COMMIT.test(digest))
             throw new Error(`${input.label}: the release is not a built commit`);
-        const token = await input.healthToken();
-        if (!token)
-            throw new Error(`${input.label}: the health token is not held`);
-        input.secret(token);
-        const apps = colorApps(color);
+        const token = subject.reporting ? await input.healthToken() : null;
+        if (subject.reporting) {
+            if (!token)
+                throw new Error(`${input.label}: the health token is not held`);
+            input.secret(token);
+        }
+        const apps = colorAppsOnServers(color);
         if (apps.length === 0)
             throw new Error(`${input.label}: ${color} has no app recorded`);
-        for (const appId of apps) {
+        for (const { appId, server } of apps) {
             await input.renew();
             await coolify.updateApplication(appId, { git_commit_sha: digest });
+            // The color takes blue's env as it is now, so a change made after the structure apply (sign-in, mail,
+            // credentials) reaches it before it serves. Blue on the primary is the source itself.
+            let source = [];
+            if (appId !== input.primaryBlueAppId) {
+                try {
+                    source = await coolify.listEnvs(input.primaryBlueAppId);
+                }
+                catch {
+                    throw new Error(`${input.label}: reading the env of the blue app failed`);
+                }
+            }
+            const refreshed = copiedEnv({ label: input.label, secret: input.secret }, subject, source, {
+                uuid: server,
+                primaryUuid: input.primaryUuid,
+            });
+            const reporting = token ? reportingEnv({ color, release: digest, healthToken: token }) : [];
             try {
-                await coolify.bulkUpsertEnvs(appId, reportingEnv({ color, release: digest, healthToken: token }).map((e) => ({
-                    ...e,
-                    literal: true,
-                })));
+                const envs = [...refreshed, ...reporting];
+                if (envs.length > 0) {
+                    await coolify.bulkUpsertEnvs(appId, envs.map((e) => ({ ...e, literal: true })));
+                }
             }
             catch {
                 // A Coolify error can echo the request body, which holds the token.
@@ -128,6 +148,7 @@ export function createReleaseHost(input) {
                 address: await checkColorAddress({
                     ...addressOf(color),
                     healthPath: subject.healthPath,
+                    expectJson: subject.reporting && subject.healthPath === '/api/health',
                     ...(input.fetch ? { fetchImpl: input.fetch } : {}),
                 }),
             };
@@ -221,6 +242,7 @@ export async function runSubjectRelease(input) {
         entry: subject.config,
         now: input.now,
         deps: input.host.deps,
+        ...(subject.reporting ? {} : { hardOnly: true }),
     });
     for (const [key, value] of Object.entries(result.writes)) {
         if (value === null)

package/dist/plan/stage-env.d.ts

@@ -0,0 +1,38 @@
+import { type StageKind } from './stage-isolation.js';
+export interface StageEnvInput {
+    kind: StageKind;
+    /** Where the stage app is reached: its own container address, since stage has no hostname. */
+    appUrl: string;
+    logDir: string;
+    /** The stage database's URLs, already minted for stage. */
+    database: ReadonlyArray<{
+        key: string;
+        value: string;
+    }>;
+    /** The env of the live app. Read for the names it uses, and for the values on `SHARED_WITH_PROD`; nothing else is copied. */
+    prod: ReadonlyArray<{
+        key: string;
+        value?: string;
+        is_preview?: boolean;
+    }>;
+    /** The env stage holds now: a minted secret is kept, so a second apply does not rotate it. */
+    existing: ReadonlyArray<{
+        key: string;
+        value?: string;
+        is_preview?: boolean;
+    }>;
+    mint: () => string;
+}
+export interface StageEnv {
+    env: Array<{
+        key: string;
+        value: string;
+    }>;
+    /** Names the live app uses that stage does not get yet. A service is either in `env` or here. */
+    absent: string[];
+}
+/**
+ * The env of a stage app, built from the kind's allowlist and never from a copy of the live app's env. Every
+ * name is allowed and none is denied, or this throws a fixed text with the name.
+ */
+export declare function buildStageEnv(input: StageEnvInput): StageEnv;