@wtfalch/foundry 0.47.0 → 0.49.0

package/dist/plan/executor.js

@@ -8,7 +8,7 @@ import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, file
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
-import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
+import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, splitServers, } from './blue-green.js';
 import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
 import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
@@ -53,13 +53,14 @@ import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutAppliedValue, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
-import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { createReleaseHost } from './release-host.js';
 import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
+import { stageGateKey, stageHostname, } from './stage-guards.js';
 import { WORKER_APP_CALL_TIMEOUT_MS, applyWorkerApp, heldBrokerKey, teardownWorkerApp, withCallTimeout, } from './worker-app.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -342,8 +343,8 @@ const CMS_APP_PORT = 3000;
  * Agora answers 502 behind the tunnel. Seen live on Company Included,
  * 2026-10-05.
  */
-const AGORA_REPO = 'wtfalch/agora';
-const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
+export const AGORA_REPO = 'wtfalch/agora';
+export const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
 /**
  * #161 (Boule part): the repo `coolifyBoule` builds the org's Boule from
  * (https://github.com/wtfalch/boule), by the same convention as
@@ -352,10 +353,10 @@ const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
  * 3000 (`EXPOSE 3000`) and runs `scripts/migrate-and-start.sh`, which applies
  * its migrations as the owner and then serves as the `<database>_rt` role.
  */
-const BOULE_REPO = 'wtfalch/boule';
-const BOULE_APP_DOCKERFILE = '/Dockerfile';
+export const BOULE_REPO = 'wtfalch/boule';
+export const BOULE_APP_DOCKERFILE = '/Dockerfile';
 /** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
-const BOULE_PORT = 3000;
+export const BOULE_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -2886,7 +2887,7 @@ export class FoundryStepExecutor {
      */
     releaseHost(org, subject, context, renew) {
         const recorded = context.recordedIds();
-        const primaryBlueAppId = recorded[`coolify:app:${appStepKey(org, subject.id)}`];
+        const primaryBlueAppId = recorded[subject.blueAppKey];
         const primaryUuid = recorded[COOLIFY_SERVER_SCOPE_KEY];
         if (!primaryBlueAppId || !primaryUuid)
             return null;
@@ -2951,23 +2952,23 @@ export class FoundryStepExecutor {
             });
             return undefined;
         }
-        const entry = org.hosting.entries.find((e) => e.key === action.desired.entry);
-        if (!entry || !entrySubject(org, entry)) {
-            throw new Error(`${action.kind} for ${org.slug}: no blue/green entry '${String(action.desired.entry)}'`);
+        const found = blueGreenSubjects(org).find((s) => s.id === action.desired.entry);
+        if (!found) {
+            throw new Error(`${action.kind} for ${org.slug}: no blue/green app '${String(action.desired.entry)}'`);
         }
-        const primaryBlueAppId = recorded()[`coolify:app:${appStepKey(org, entry.key)}`];
+        const primaryBlueAppId = recorded()[found.blueAppKey];
         if (!primaryBlueAppId) {
-            throw new Error(`${action.kind} for ${org.slug}: entry '${entry.key}' has no blue app recorded yet`);
+            throw new Error(`${action.kind} for ${org.slug}: app '${found.id}' has no blue app recorded yet`);
         }
         // The blue app keeps the name it has: an app that ran before blue/green is adopted under its own name.
-        if (!recorded()[bgKey.blueName(entry.key)]) {
+        if (!recorded()[bgKey.blueName(found.id)]) {
             const blue = await this.ports.coolify.getApplication(primaryBlueAppId);
             if (blue.name) {
-                context.recordScopeId(bgKey.blueName(entry.key), blue.name);
+                context.recordScopeId(bgKey.blueName(found.id), blue.name);
                 await context.persistScopeIds();
             }
         }
-        const subject = entrySubject(org, entry, recorded());
+        const subject = blueGreenSubjects(org, recorded()).find((s) => s.id === found.id);
         const runtime = this.ports.runtime ?? {};
         const deps = {
             coolify: this.ports.coolify,
@@ -2980,17 +2981,39 @@ export class FoundryStepExecutor {
                 if (typeof this.ports.heldKeys?.put !== 'function') {
                     throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the health token`);
                 }
-                const token = await this.ensureSharedSecret(org, healthTokenName(entry.key), recorded());
+                const token = await this.ensureSharedSecret(org, healthTokenName(subject.id), recorded());
                 this.handledSecrets.add(token);
                 return token;
             },
+            actionsKey: async () => {
+                const heldKeys = this.ports.heldKeys;
+                if (typeof heldKeys?.put !== 'function') {
+                    throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the server actions key`);
+                }
+                const put = heldKeys.put;
+                const key = await mintActionsKey({
+                    id: subject.id,
+                    ref: sharedSecretRef(org.id, actionsKeyName(subject.id)),
+                    recorded,
+                    record: (k, v) => context.recordScopeId(k, v),
+                    persist: () => context.persistScopeIds(),
+                    heldKeys: {
+                        resolve: async (r) => (await heldKeys.resolve(r)) ?? null,
+                        put: (r, v) => put.call(heldKeys, r, v),
+                    },
+                    generate: () => randomBytes(32).toString('base64'),
+                    secret: (value) => void this.handledSecrets.add(value),
+                });
+                return key;
+            },
             secret: (value) => void this.handledSecrets.add(value),
             runtime,
             sleep: runtime.sleep ?? defaultSleep,
-            label: `${action.system}:${action.kind}:${entry.key}`,
+            label: `${action.system}:${action.kind}:${subject.id}`,
             primaryBlueAppId,
             logDir: LOG_DIR,
             isRunning: isRunningOrStarting,
+            stageGuards: this.stageGuards(org, subject, recorded(), action.desired.accessProviderId),
         };
         if (action.kind === 'bluegreen-lb') {
             await applyBlueGreenWeights(deps, subject, { uuid: serverUuid, primaryUuid });
@@ -3000,6 +3023,38 @@ export class FoundryStepExecutor {
         }
         return undefined;
     }
+    /**
+     * Stage's guards (`plan/stage-guards.ts`): the probe port the host supplied, and the Access gate over the stage
+     * host. The gate is offered only when everything it needs is in hand (a domain, the platform's Access provider,
+     * the company's sign-in organisation, an owner, an Access port) and no `hosting.access` rule names the host: a
+     * bypass or service-token rule there would open stage, so no gate is made and the guard stays unrecorded.
+     */
+    stageGuards(org, subject, recorded, providerId) {
+        const guards = this.ports.stageProbes ? { probes: this.ports.stageProbes } : {};
+        const claimValue = recorded[ZITADEL_ORG_SCOPE_KEY];
+        const emails = org.owners.map((owner) => owner.email);
+        if (!org.domain || typeof providerId !== 'string' || !providerId || !claimValue)
+            return guards;
+        if (emails.length === 0 || !(this.ports.access || this.ports.edge))
+            return guards;
+        const hostname = stageHostname(org.domain, subject.id);
+        if ((org.hosting.access ?? []).some((rule) => rule.hostname === hostname))
+            return guards;
+        guards.gate = {
+            hostname,
+            create: () => this.accessPort().createGate({
+                organisationId: org.id,
+                key: stageGateKey(subject.id),
+                entry: subject.id,
+                hostnames: [hostname],
+                providerId,
+                claimName: GATE_CLAIM_NAME,
+                claimValue,
+                emails,
+            }),
+        };
+        return guards;
+    }
     async coolifyApp(action, org, context) {
         const recordedAppId = context.recordedIds()[`coolify:app:${action.key}`];
         if (action.desired.enabled === false) {
@@ -3128,7 +3183,7 @@ export class FoundryStepExecutor {
                 autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
-                is_auto_deploy_enabled: entry.autoDeploy,
+                is_auto_deploy_enabled: appSettingsOf(entry).autoDeploy,
                 // Also the folder a static entry serves: Coolify's static build
                 // copies `base_directory`, and reads `publish_directory` only for a
                 // built app.
@@ -7452,7 +7507,10 @@ export class FoundryStepExecutor {
         const loginHost = action.desired.loginHost ?? null;
         // A hosting entry's names (and its wildcard) go straight to its container on the company network:
         // the container carries `traefik.enable=false`, so the proxy has no route for it.
-        const entryOrigins = new Map(entryRoutes(org, context.recordedIds()).map((r) => [r.hostname, r.service]));
+        const entryOrigins = new Map([
+            ...entryRoutes(org, context.recordedIds()),
+            ...builtinRoutes(org, context.recordedIds()),
+        ].map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
@@ -9175,6 +9233,7 @@ export class FoundryStepExecutor {
                     await this.accessPort().deleteAccessApp(target.id);
                     return;
                 case 'cloudflare:gate':
+                case 'cloudflare:bg-gate':
                     await this.accessPort().deleteGate(target.id);
                     return;
                 case 'ai:key': {

package/dist/plan/github-release-hook.d.ts

@@ -0,0 +1,81 @@
+import type { CoolifyPort } from './executor.js';
+/** Every GitHub call is cut off after this long. */
+export declare const GITHUB_API_TIMEOUT_MS = 20000;
+/** A GitHub call that failed. The text is fixed: it never holds the token, the secret or a response body. */
+export declare class GithubApiError extends Error {
+    readonly operation: string;
+    readonly status: number | null;
+    constructor(operation: string, status: number | null);
+}
+/** The shape of an organisation hook foundry reads. */
+export interface GithubOrgHook {
+    id: number;
+    active: boolean;
+    events: string[];
+    config: {
+        url?: string;
+        content_type?: string;
+    };
+}
+export interface GithubReleaseHookBody {
+    name: 'web';
+    active: true;
+    events: ['release'];
+    config: {
+        url: string;
+        content_type: 'json';
+        secret: string;
+        insecure_ssl: '0';
+    };
+}
+export interface GithubHooksClient {
+    list(org: string): Promise<GithubOrgHook[]>;
+    create(org: string, body: GithubReleaseHookBody): Promise<GithubOrgHook>;
+    update(org: string, id: number, body: GithubReleaseHookBody): Promise<GithubOrgHook>;
+}
+/** The GitHub REST organisation-hooks calls, over `fetchImpl` (global fetch by default) with a timeout on each. */
+export declare function createGithubHooksClient(options: {
+    token: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): GithubHooksClient;
+export interface PlatformGithubReleaseHookDeps {
+    coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs'>;
+    heldKeys: {
+        resolve(ref: string): Promise<string | null>;
+    };
+    /** Global fetch by default; tests give their own. */
+    fetchImpl?: typeof fetch;
+    /** Told of the token and the secret, so the host can scrub them from logs and audit rows. */
+    onSecret?: (value: string) => void;
+}
+/**
+ * What the planner needs: why the step is blocked (the token is not held), or `ready` (the token is
+ * held) with the hash of the hook's url and Archon's live secret when Archon already holds one. With no
+ * secret yet the step still plans: `platform:archon` mints it earlier in the same apply.
+ */
+export declare function githubReleaseHookPlanInputs(deps: PlatformGithubReleaseHookDeps, hostname: string, recorded: Readonly<Record<string, string>>): Promise<{
+    blocked?: string;
+    ready?: true;
+    hash?: string;
+}>;
+/**
+ * Makes the organisation's release webhook. Adopts the hook whose url is Archon's, else creates one;
+ * an adopted hook is always written again, because GitHub never returns its secret.
+ *
+ * The secret is made here when Archon's app does not hold one yet (`ensureSecret`, which keeps a live
+ * value), so the step can run before `platform:archon`; that step then keeps the same value.
+ *
+ * A failure halfway: a hook made and not recorded is adopted by its url on the next run; a hook
+ * written and not recorded is written again. The id and the hash are recorded together, after the write.
+ */
+export declare function provisionGithubReleaseHook(context: {
+    platform: {
+        archon: {
+            hostname: string;
+        };
+    };
+    recordedIds(): Record<string, string>;
+    recordScopeId(key: string, id: string): void;
+    persist?(): Promise<void>;
+}, deps: PlatformGithubReleaseHookDeps, ensureSecret: (appId: string) => Promise<string>): Promise<undefined>;

package/dist/plan/github-release-hook.js

@@ -0,0 +1,159 @@
+import { GITHUB_RELEASE_HOOK_COOLIFY_READ_FAILED, GITHUB_RELEASE_HOOK_ORG, GITHUB_RELEASE_HOOK_TOKEN_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, PLATFORM_ARCHON_KEY, PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF, PLATFORM_GITHUB_RELEASE_HOOK_HASH_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_ID_SCOPE_KEY, githubReleaseHookHash, githubReleaseHookUrl, } from './platform-diff.js';
+/** Every GitHub call is cut off after this long. */
+export const GITHUB_API_TIMEOUT_MS = 20_000;
+const GITHUB_API = 'https://api.github.com';
+const PAGE_SIZE = 100;
+const MAX_PAGES = 20;
+/** A GitHub call that failed. The text is fixed: it never holds the token, the secret or a response body. */
+export class GithubApiError extends Error {
+    operation;
+    status;
+    constructor(operation, status) {
+        super(status === null
+            ? `GitHub API ${operation} did not answer`
+            : `GitHub API ${operation} failed with status ${status}`);
+        this.operation = operation;
+        this.status = status;
+        this.name = 'GithubApiError';
+    }
+}
+/** The GitHub REST organisation-hooks calls, over `fetchImpl` (global fetch by default) with a timeout on each. */
+export function createGithubHooksClient(options) {
+    const doFetch = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? GITHUB_API_TIMEOUT_MS;
+    const call = async (operation, method, path, body) => {
+        let response;
+        try {
+            response = await doFetch(`${GITHUB_API}${path}`, {
+                method,
+                headers: {
+                    Authorization: `Bearer ${options.token}`,
+                    Accept: 'application/vnd.github+json',
+                    'X-GitHub-Api-Version': '2022-11-28',
+                    ...(body ? { 'Content-Type': 'application/json' } : {}),
+                },
+                ...(body ? { body: JSON.stringify(body) } : {}),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch (error) {
+            console.error(`github release hook: ${operation} did not answer (${error instanceof Error ? error.name : 'error'})`);
+            throw new GithubApiError(operation, null);
+        }
+        if (!response.ok)
+            throw new GithubApiError(operation, response.status);
+        try {
+            return await response.json();
+        }
+        catch (error) {
+            console.error(`github release hook: ${operation} answered with unreadable JSON (${error instanceof Error ? error.name : 'error'})`);
+            throw new GithubApiError(operation, response.status);
+        }
+    };
+    const asHook = (operation, value) => {
+        const hook = value;
+        if (!hook || typeof hook.id !== 'number')
+            throw new GithubApiError(operation, 200);
+        return {
+            id: hook.id,
+            active: hook.active === true,
+            events: Array.isArray(hook.events) ? hook.events.map(String) : [],
+            config: {
+                ...(typeof hook.config?.url === 'string' ? { url: hook.config.url } : {}),
+                ...(typeof hook.config?.content_type === 'string'
+                    ? { content_type: hook.config.content_type }
+                    : {}),
+            },
+        };
+    };
+    return {
+        async list(org) {
+            const hooks = [];
+            for (let page = 1; page <= MAX_PAGES; page++) {
+                const value = await call('list hooks', 'GET', `/orgs/${org}/hooks?per_page=${PAGE_SIZE}&page=${page}`);
+                if (!Array.isArray(value))
+                    throw new GithubApiError('list hooks', 200);
+                hooks.push(...value.map((v) => asHook('list hooks', v)));
+                if (value.length < PAGE_SIZE)
+                    return hooks;
+            }
+            return hooks;
+        },
+        async create(org, body) {
+            return asHook('create hook', await call('create hook', 'POST', `/orgs/${org}/hooks`, body));
+        },
+        async update(org, id, body) {
+            return asHook('update hook', await call('update hook', 'PATCH', `/orgs/${org}/hooks/${id}`, body));
+        },
+    };
+}
+async function liveWebhookSecret(deps, recorded) {
+    const appId = recorded[`coolify:app:${PLATFORM_ARCHON_KEY}`];
+    if (!appId)
+        return undefined;
+    const envs = await deps.coolify.listEnvs(appId);
+    const value = envs.find((e) => e.key === GITHUB_RELEASE_WEBHOOK_SECRET_ENV && !e.is_preview)?.value;
+    return value || undefined;
+}
+/**
+ * What the planner needs: why the step is blocked (the token is not held), or `ready` (the token is
+ * held) with the hash of the hook's url and Archon's live secret when Archon already holds one. With no
+ * secret yet the step still plans: `platform:archon` mints it earlier in the same apply.
+ */
+export async function githubReleaseHookPlanInputs(deps, hostname, recorded) {
+    const token = await deps.heldKeys.resolve(PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF);
+    if (!token)
+        return { blocked: GITHUB_RELEASE_HOOK_TOKEN_MISSING };
+    let secret;
+    try {
+        secret = await liveWebhookSecret(deps, recorded);
+    }
+    catch (error) {
+        console.error(`github release hook: could not read Archon's env from Coolify (${error instanceof Error ? error.name : 'error'})`);
+        return { blocked: GITHUB_RELEASE_HOOK_COOLIFY_READ_FAILED };
+    }
+    return secret
+        ? { ready: true, hash: githubReleaseHookHash(githubReleaseHookUrl(hostname), secret) }
+        : { ready: true };
+}
+/**
+ * Makes the organisation's release webhook. Adopts the hook whose url is Archon's, else creates one;
+ * an adopted hook is always written again, because GitHub never returns its secret.
+ *
+ * The secret is made here when Archon's app does not hold one yet (`ensureSecret`, which keeps a live
+ * value), so the step can run before `platform:archon`; that step then keeps the same value.
+ *
+ * A failure halfway: a hook made and not recorded is adopted by its url on the next run; a hook
+ * written and not recorded is written again. The id and the hash are recorded together, after the write.
+ */
+export async function provisionGithubReleaseHook(context, deps, ensureSecret) {
+    const appId = context.recordedIds()[`coolify:app:${PLATFORM_ARCHON_KEY}`];
+    if (!appId) {
+        throw new Error("platform:github-release-hook: Archon's app is not recorded yet; platform:archon runs first");
+    }
+    const token = await deps.heldKeys.resolve(PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF);
+    if (!token)
+        throw new Error(`platform:github-release-hook: ${GITHUB_RELEASE_HOOK_TOKEN_MISSING}`);
+    const secret = await ensureSecret(appId);
+    deps.onSecret?.(secret);
+    deps.onSecret?.(token);
+    const url = githubReleaseHookUrl(context.platform.archon.hostname);
+    const body = {
+        name: 'web',
+        active: true,
+        events: ['release'],
+        config: { url, content_type: 'json', secret, insecure_ssl: '0' },
+    };
+    const client = createGithubHooksClient({
+        token,
+        ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+    });
+    const existing = (await client.list(GITHUB_RELEASE_HOOK_ORG)).find((h) => h.config.url === url);
+    const hook = existing
+        ? await client.update(GITHUB_RELEASE_HOOK_ORG, existing.id, body)
+        : await client.create(GITHUB_RELEASE_HOOK_ORG, body);
+    context.recordScopeId(PLATFORM_GITHUB_RELEASE_HOOK_ID_SCOPE_KEY, String(hook.id));
+    context.recordScopeId(PLATFORM_GITHUB_RELEASE_HOOK_HASH_SCOPE_KEY, githubReleaseHookHash(url, secret));
+    await context.persist?.();
+    return undefined;
+}

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail, MailRoute } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, GITHUB_RELEASE_HOOK_ORG, GITHUB_RELEASE_HOOK_PATH, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlanOwnAuthOptions, PlanOwnFilesOptions, PlanOwnFilesR2Options, PlanOwnJobsOptions, } from './own-diff.js';
@@ -39,6 +39,8 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelOrgMetadata } from './zitadel-org-metadata.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
+export { DumpError, dumpNow } from './database-dump.js';
+export type { DatabaseDump } from './database-dump.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
@@ -68,6 +70,7 @@ export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
 export type { EdgePlatformWorkers, EdgeWorkersOptions, PlatformWorkersPort, } from './edge-workers.js';
+export type { PlatformGithubReleaseHookDeps } from './github-release-hook.js';
 export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';
 export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, GITHUB_RELEASE_HOOK_ORG, GITHUB_RELEASE_HOOK_PATH, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF, PLATFORM_SFU_APPLIED_SCOPE_KEY, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, } from './platform-org.js';
 export { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, } from './own-diff.js';
 export { OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnSfu } from './own-diff.js';
@@ -22,6 +22,10 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelLoginPolicy } from './zitadel-login-policy.js';
 export { createZitadelOrgMetadata } from './zitadel-org-metadata.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
+// #170: the platform's shared calls SFU step -- narrow ports a host (archon)
+// implements over held keys and its own SSH client, the same shape the rest
+// of `platform-providers.ts` uses for Cloudflare.
+export { DumpError, dumpNow } from './database-dump.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';

package/dist/plan/live.d.ts

@@ -42,7 +42,7 @@ export interface LiveResource {
      * see that function's own doc comment for why "always planned" broke
      * `bootstrapPlatform`.
      */
-    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats';
+    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats' | 'github';
     kind: string;
     key: string;
     config: Record<string, unknown>;

package/dist/plan/locked-hostnames.d.ts

@@ -20,4 +20,5 @@ export declare function hostingNames(org: DeclaredOrg, platformHostnames: readon
     locked: Set<string>;
     slug: string;
     siteOwnsApex: boolean;
+    builtinBlueGreen: boolean;
 };

package/dist/plan/locked-hostnames.js

@@ -58,5 +58,6 @@ export function hostingNames(org, platformHostnames) {
         locked: lockedHostnames(org, platformHostnames),
         slug: org.slug,
         siteOwnsApex: org.site.enabled && org.site.usesDomain && org.domain !== null,
+        builtinBlueGreen: org.boule?.blueGreen !== undefined || org.agora?.blueGreen !== undefined,
     };
 }

package/dist/plan/plan-apply.js

@@ -9,7 +9,7 @@ import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
-import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, entrySubject, } from './blue-green.js';
+import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, blueGreenSubjects, declaresBlueGreen, lbOrigin, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
 import { LEGACY_BACKUP_NAMES } from './company-backups.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
@@ -1151,10 +1151,13 @@ export class FoundryPlanApply {
         const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
         if (!store || !this.executor.releaseHost || !primaryUuid)
             return;
-        for (const entry of org.hosting.entries) {
-            const subject = entrySubject(org, entry, context.recordedIds());
-            if (!subject)
+        for (const subject of blueGreenSubjects(org, context.recordedIds())) {
+            // A built-in app's names reach its balancer only once the tunnel was last written with it: until then a
+            // pinned check would answer from blue whatever color it names.
+            if (subject.builtin &&
+                !(context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '').includes(`"service":"${lbOrigin(subject)}"`)) {
                 continue;
+            }
             const host = this.executor.releaseHost(org, subject, context, () => this.renewLease(fence));
             if (!host)
                 continue;
@@ -1224,7 +1227,7 @@ export class FoundryPlanApply {
     async runReleaseTick() {
         const results = [];
         for (const org of await this.store.list()) {
-            if (!org.hosting.entries.some((entry) => entry.blueGreen))
+            if (!declaresBlueGreen(org))
                 continue;
             try {
                 await this.runOrgReleaseTick(org.id);
@@ -1307,7 +1310,7 @@ export class FoundryPlanApply {
         const sfuPortsOpen = await this.readSfuPortsOpen(org);
         const resumable = await this.ownResumableRefs(org);
         // Read only for an org that declares it; a failed read plans none and says so (`planBlueGreen`).
-        const blueGreenServers = org.hosting.entries.some((e) => e.blueGreen) && this.executor.blueGreenServers
+        const blueGreenServers = declaresBlueGreen(org) && this.executor.blueGreenServers
             ? await this.executor.blueGreenServers().catch(() => undefined)
             : undefined;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
@@ -2137,11 +2140,12 @@ function destroyStepDescriptions(targets) {
 /** Scope keys of the Coolify apps blue/green made: `bg.<entry>.app.<server>.<part>`, a database sidecar, a connector on another server. */
 const BLUE_GREEN_APP_KEY = /^(bg\.[^.:]+\.app\.[^.:]+\.[a-z]+|bgdb\.[^.:]+\.sidecar\.[^.:]+|cloudflare_tunnel_connector_app\.[^.:]+)$/;
 const BLUE_GREEN_DATABASE_KEY = /^bg\.[^.:]+\.stagedb$/;
-/** The database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
+/** Stage's Access gate (`bg.<entry>.stagegate`), and the database route's Cloudflare parts: its Access app, its service token (also one minted and never delivered) and its DNS record (recorded as the route). */
 const BLUE_GREEN_EDGE_KEYS = [
     [/^bgdb\.[^.:]+\.access$/, 'bg-access'],
     [/^bgdb\.[^.:]+\.(token|undelivered)$/, 'bg-token'],
     [/^bgdb\.[^.:]+\.route$/, 'bg-dns'],
+    [/^bg\.[^.:]+\.stagegate$/, 'bg-gate'],
 ];
 /** Every recorded blue/green app (then stage's database), in key order. A destroy target's `key` is the scope key itself. */
 function blueGreenDestroyTargets(serviceIds) {
@@ -2221,6 +2225,11 @@ const STEP_FIELDS = {
     'cloudflare:worker-app': 'hosting.entries.workerApp',
 };
 function stepField(action) {
+    if (action.system === 'coolify' &&
+        action.kind.startsWith('bluegreen') &&
+        (action.desired.entry === 'boule' || action.desired.entry === 'agora')) {
+        return `${action.desired.entry}.blueGreen`;
+    }
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.
     if (action.system === 'ai' && action.kind === 'key' && action.key.includes(':')) {
         return 'hosting.entries.uses.ai';