@envsync-cloud/deploy 0.20.11 → 0.21.0

package/dist/cli.js

@@ -37,13 +37,11 @@ var deployConfigSchema = z.object({
   services: z.object({
     stack_name: z.string().default("envsync"),
     api_port: z.number().int().positive().default(4e3),
-    management_api_port: z.number().int().positive().default(4001),
     public_http_port: z.number().int().positive().default(80),
     public_https_port: z.number().int().positive().default(443)
   }).default({}),
   images: z.object({
     api: z.string().default("ghcr.io/envsync-cloud/envsync-api:stable"),
-    management_api: z.string().default("ghcr.io/envsync-cloud/envsync-management-api:stable"),
     web: z.string().default("ghcr.io/envsync-cloud/envsync-web-oss-static:stable"),
     enterprise_web: z.string().default("ghcr.io/envsync-cloud/envsync-web-static:stable"),
     landing: z.string().default("ghcr.io/envsync-cloud/envsync-landing-static:stable"),
@@ -383,7 +381,6 @@ function buildRuntimeEnv2(config, generated, options) {
     ENVSYNC_STACK_NAME: config.services.stack_name,
     DB_AUTO_MIGRATE: "false",
     PORT: `${config.services.api_port}`,
-    MANAGEMENT_API_PORT: `${config.services.management_api_port}`,
     DATABASE_HOST: "postgres",
     DATABASE_PORT: "5432",
     DATABASE_USER: "postgres",
@@ -427,7 +424,13 @@ function buildRuntimeEnv2(config, generated, options) {
     OPENFGA_MODEL_ID: generated.openfga.model_id,
     OPENFGA_DB_PASSWORD: generated.secrets.openfga_db_password,
     API_URL: publicHttpsUrl(config, hosts.api),
+    SAML_SESSION_SECRET: generated.secrets.saml_session_secret,
     MANAGEMENT_API_URL: oss ? "" : publicHttpsUrl(config, hosts.api, "/api/v1/manage"),
+    KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS: "3600",
+    KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS: "604800",
     CLICKSTACK_OPERATOR_EMAIL: generated.clickstack.operator_email,
     CLICKSTACK_OPERATOR_PASSWORD: generated.clickstack.operator_password,
     CLICKSTACK_ACCESS_KEY: generated.clickstack.access_key,
@@ -466,12 +469,22 @@ function renderKeycloakRealm(config, runtimeEnv) {
   const webOrigins = publicHttpsOriginVariants(config, hosts.app);
   const apiRedirectUris = publicHttpsUrlVariants(config, hosts.api, "/api/access/api/callback");
   const apiOrigins = publicHttpsOriginVariants(config, hosts.api);
+  const accessTokenLifespan = Number(runtimeEnv.KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS || "3600");
+  const ssoSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const ssoSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS || "604800");
+  const clientSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const clientSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS || "604800");
   return JSON.stringify(
     {
       realm: config.auth.keycloak_realm,
       enabled: true,
       loginTheme: "envsync",
       emailTheme: "envsync",
+      accessTokenLifespan,
+      ssoSessionIdleTimeout,
+      ssoSessionMaxLifespan,
+      clientSessionIdleTimeout,
+      clientSessionMaxLifespan,
       clients: [
         {
           clientId: config.auth.web_client_id,
@@ -1021,7 +1034,7 @@ ${includeRuntimeInfra ? `
     image: ${config.images.keycloak}
     entrypoint: ["/bin/sh", "-lc"]
     command:
-      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override true && exec /opt/keycloak/bin/kc.sh start --optimized
+      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override false && exec /opt/keycloak/bin/kc.sh start --optimized
     environment:
 ${renderEnvList({
     KC_DB: "postgres",
@@ -1581,8 +1594,6 @@ var DEFAULT_ENTERPRISE_LICENSE_SERVER_URL = "https://license.envsync.cloud";
 var MANAGED_VERSIONED_IMAGE_PREFIXES = {
   api: "ghcr.io/envsync-cloud/envsync-api:",
   api_enterprise: "ghcr.io/envsync-cloud/envsync-api-enterprise:",
-  // Retired second process — kept so old deploy.yaml image strings still parse as "managed".
-  management_api: "ghcr.io/envsync-cloud/envsync-management-api:",
   keycloak: "envsync-keycloak:",
   web: "ghcr.io/envsync-cloud/envsync-web-static:",
   web_oss: "ghcr.io/envsync-cloud/envsync-web-oss-static:",
@@ -2203,7 +2214,6 @@ function buildOperatorOverview() {
   const bootstrapComplete = hasCompleteBootstrapState(generated) && generated.bootstrap.completed_at.length > 0;
   const api = apiHealth(services, config.services.stack_name);
   const web = serviceHealth(services, `${config.services.stack_name}_web_nginx`);
-  const landing = serviceHealth(services, `${config.services.stack_name}_landing_nginx`);
   statusLines.push(`Configured: ${chalk.green("yes")}`);
   statusLines.push(`Pinned release: ${chalk.cyan(config.release.version)}`);
   statusLines.push(`Stack: ${stackRunning ? chalk.green(config.services.stack_name) : chalk.yellow("not running")}`);
@@ -2211,7 +2221,7 @@ function buildOperatorOverview() {
   statusLines.push(`Active API slot: ${chalk.cyan(generated.deployment.active_slot)}`);
   statusLines.push(`API: ${api === "healthy" ? chalk.green(api) : api === "missing" ? chalk.red(api) : chalk.yellow(api)}`);
   statusLines.push(`Web: ${web === "healthy" ? chalk.green(web) : web === "missing" ? chalk.red(web) : chalk.yellow(web)}`);
-  statusLines.push(`Landing: ${landing === "healthy" ? chalk.green(landing) : landing === "missing" ? chalk.red(landing) : chalk.yellow(landing)}`);
+  statusLines.push(`Landing: ${chalk.dim("omitted")}`);
   if (!bootstrapComplete) {
     return {
       statusLines,
@@ -2221,7 +2231,7 @@ function buildOperatorOverview() {
       ]
     };
   }
-  if (api !== "healthy" || web !== "healthy" || landing !== "healthy") {
+  if (api !== "healthy" || web !== "healthy") {
     return {
       statusLines,
       nextSteps: [
@@ -2290,8 +2300,6 @@ function versionedImages(version, edition = "enterprise") {
   const api = edition === "oss" ? `ghcr.io/envsync-cloud/envsync-api:${version}` : `ghcr.io/envsync-cloud/envsync-api-enterprise:${version}`;
   return {
     api,
-    // Deprecated field: kept for older deploy.yaml keys; unused by stack render.
-    management_api: api,
     keycloak: `envsync-keycloak:${version}`,
     web,
     landing: `ghcr.io/envsync-cloud/envsync-landing-static:${version}`
@@ -2377,7 +2385,6 @@ function normalizeConfig(raw) {
     },
     images: {
       api: !raw.images?.api || isManagedVersionedImage(raw.images.api, "api") ? derivedImages.api : raw.images.api,
-      management_api: !raw.images?.management_api || isManagedVersionedImage(raw.images.management_api, "management_api") ? derivedImages.management_api : raw.images.management_api,
       keycloak: !raw.images?.keycloak || isManagedVersionedImage(raw.images.keycloak, "keycloak") ? derivedImages.keycloak : raw.images.keycloak,
       web: !raw.images?.web || isManagedVersionedImage(raw.images.web, "web") ? derivedImages.web : raw.images.web,
       landing: !raw.images?.landing || isManagedVersionedImage(raw.images.landing, "landing") ? derivedImages.landing : raw.images.landing,
@@ -2388,7 +2395,6 @@ function normalizeConfig(raw) {
     services: {
       stack_name: stackName,
       api_port: requireDefined(raw.services?.api_port, "services.api_port"),
-      management_api_port: raw.services?.management_api_port ?? 4001,
       public_http_port: raw.services?.public_http_port ?? 80,
       public_https_port: raw.services?.public_https_port ?? 443,
       clickstack_ui_port: requireDefined(raw.services?.clickstack_ui_port, "services.clickstack_ui_port"),
@@ -2489,7 +2495,8 @@ function emptyGeneratedState() {
       openfga_db_password: "",
       minikms_root_key: "",
       minikms_session_signing_key: "",
-      minikms_db_password: ""
+      minikms_db_password: "",
+      saml_session_secret: ""
     },
     bootstrap: {
       completed_at: ""
@@ -2526,7 +2533,8 @@ function normalizeGeneratedState(raw) {
       openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
       minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
       minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
-      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
+      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password,
+      saml_session_secret: raw?.secrets?.saml_session_secret ?? defaults.secrets.saml_session_secret
     },
     bootstrap: {
       completed_at: raw?.bootstrap?.completed_at ?? defaults.bootstrap.completed_at
@@ -2577,7 +2585,8 @@ function mergeGeneratedState(env, generated) {
       openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
       minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
       minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
-      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
+      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password,
+      saml_session_secret: env.SAML_SESSION_SECRET ?? normalized.secrets.saml_session_secret
     },
     bootstrap: normalized.bootstrap
   });
@@ -2606,7 +2615,8 @@ function ensureGeneratedRuntimeState(config, generated) {
       openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
       minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
       minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
-      minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
+      minikms_db_password: generated.secrets.minikms_db_password || randomSecret(),
+      saml_session_secret: generated.secrets.saml_session_secret || randomBytes2(32).toString("hex")
     },
     bootstrap: generated.bootstrap
   });
@@ -3977,7 +3987,6 @@ async function cmdSetup() {
     domain: { root_domain: rootDomain, acme_email: acmeEmail },
     images: {
       api: releaseImages.api,
-      management_api: releaseImages.management_api,
       keycloak: releaseImages.keycloak,
       web: releaseImages.web,
       landing: releaseImages.landing,
@@ -3988,7 +3997,6 @@ async function cmdSetup() {
     services: {
       stack_name: "envsync",
       api_port: 4e3,
-      management_api_port: 4001,
       public_http_port: 80,
       public_https_port: 443,
       clickstack_ui_port: 8080,
@@ -4387,7 +4395,6 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
     { label: "openfga", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_openfga`) },
     { label: "minikms", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_minikms`) },
     { label: "clickstack", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_clickstack`) },
-    ...isOssConfig2(config) ? [] : [{ label: "landing", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_landing_nginx`) }],
     { label: "web", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_web_nginx`) },
     { label: "api", getHealth: (services) => apiHealth(services, config.services.stack_name) }
   ]);
@@ -4430,7 +4437,7 @@ async function cmdPromote(target) {
     }
   });
   writeDeployArtifacts(config, promotedState);
-  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version)) && exists2(releaseAssetDir("landing", promotedState.deployment.slots[targetSlot].release_version))) {
+  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version))) {
     activateFrontendReleaseForState(config, promotedState);
   } else {
     logWarn(`Missing staged frontend assets for release ${promotedState.deployment.slots[targetSlot].release_version}; leaving current frontend assets unchanged.`);
@@ -4461,7 +4468,7 @@ async function cmdRollback() {
     }
   });
   writeDeployArtifacts(config, rollbackState);
-  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version)) && exists2(releaseAssetDir("landing", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
+  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
     activateFrontendReleaseForState(config, rollbackState);
   } else {
     logWarn(`Missing staged frontend assets for release ${rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version}; leaving current frontend assets unchanged.`);
@@ -4557,7 +4564,7 @@ async function cmdHealth(asJson) {
         }
       },
       web: serviceHealth(services, `${stackName}_web_nginx`),
-      landing: serviceHealth(services, `${stackName}_landing_nginx`)
+      landing: "omitted"
     },
     database: {
       api: databaseHealth

package/dist/index.js

@@ -243,13 +243,11 @@ var init_src = __esm({
       services: z.object({
         stack_name: z.string().default("envsync"),
         api_port: z.number().int().positive().default(4e3),
-        management_api_port: z.number().int().positive().default(4001),
         public_http_port: z.number().int().positive().default(80),
         public_https_port: z.number().int().positive().default(443)
       }).default({}),
       images: z.object({
         api: z.string().default("ghcr.io/envsync-cloud/envsync-api:stable"),
-        management_api: z.string().default("ghcr.io/envsync-cloud/envsync-management-api:stable"),
         web: z.string().default("ghcr.io/envsync-cloud/envsync-web-oss-static:stable"),
         enterprise_web: z.string().default("ghcr.io/envsync-cloud/envsync-web-static:stable"),
         landing: z.string().default("ghcr.io/envsync-cloud/envsync-landing-static:stable"),
@@ -384,7 +382,6 @@ function buildRuntimeEnv2(config, generated, options) {
     ENVSYNC_STACK_NAME: config.services.stack_name,
     DB_AUTO_MIGRATE: "false",
     PORT: `${config.services.api_port}`,
-    MANAGEMENT_API_PORT: `${config.services.management_api_port}`,
     DATABASE_HOST: "postgres",
     DATABASE_PORT: "5432",
     DATABASE_USER: "postgres",
@@ -428,7 +425,13 @@ function buildRuntimeEnv2(config, generated, options) {
     OPENFGA_MODEL_ID: generated.openfga.model_id,
     OPENFGA_DB_PASSWORD: generated.secrets.openfga_db_password,
     API_URL: publicHttpsUrl(config, hosts.api),
+    SAML_SESSION_SECRET: generated.secrets.saml_session_secret,
     MANAGEMENT_API_URL: oss ? "" : publicHttpsUrl(config, hosts.api, "/api/v1/manage"),
+    KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS: "3600",
+    KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS: "604800",
     CLICKSTACK_OPERATOR_EMAIL: generated.clickstack.operator_email,
     CLICKSTACK_OPERATOR_PASSWORD: generated.clickstack.operator_password,
     CLICKSTACK_ACCESS_KEY: generated.clickstack.access_key,
@@ -467,12 +470,22 @@ function renderKeycloakRealm(config, runtimeEnv) {
   const webOrigins = publicHttpsOriginVariants(config, hosts.app);
   const apiRedirectUris = publicHttpsUrlVariants(config, hosts.api, "/api/access/api/callback");
   const apiOrigins = publicHttpsOriginVariants(config, hosts.api);
+  const accessTokenLifespan = Number(runtimeEnv.KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS || "3600");
+  const ssoSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const ssoSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS || "604800");
+  const clientSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const clientSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS || "604800");
   return JSON.stringify(
     {
       realm: config.auth.keycloak_realm,
       enabled: true,
       loginTheme: "envsync",
       emailTheme: "envsync",
+      accessTokenLifespan,
+      ssoSessionIdleTimeout,
+      ssoSessionMaxLifespan,
+      clientSessionIdleTimeout,
+      clientSessionMaxLifespan,
       clients: [
         {
           clientId: config.auth.web_client_id,
@@ -1018,7 +1031,7 @@ ${includeRuntimeInfra ? `
     image: ${config.images.keycloak}
     entrypoint: ["/bin/sh", "-lc"]
     command:
-      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override true && exec /opt/keycloak/bin/kc.sh start --optimized
+      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override false && exec /opt/keycloak/bin/kc.sh start --optimized
     environment:
 ${renderEnvList({
     KC_DB: "postgres",
@@ -2064,7 +2077,6 @@ function buildOperatorOverview() {
   const bootstrapComplete = hasCompleteBootstrapState(generated) && generated.bootstrap.completed_at.length > 0;
   const api = apiHealth(services, config.services.stack_name);
   const web = serviceHealth(services, `${config.services.stack_name}_web_nginx`);
-  const landing = serviceHealth(services, `${config.services.stack_name}_landing_nginx`);
   statusLines.push(`Configured: ${chalk.green("yes")}`);
   statusLines.push(`Pinned release: ${chalk.cyan(config.release.version)}`);
   statusLines.push(`Stack: ${stackRunning ? chalk.green(config.services.stack_name) : chalk.yellow("not running")}`);
@@ -2072,7 +2084,7 @@ function buildOperatorOverview() {
   statusLines.push(`Active API slot: ${chalk.cyan(generated.deployment.active_slot)}`);
   statusLines.push(`API: ${api === "healthy" ? chalk.green(api) : api === "missing" ? chalk.red(api) : chalk.yellow(api)}`);
   statusLines.push(`Web: ${web === "healthy" ? chalk.green(web) : web === "missing" ? chalk.red(web) : chalk.yellow(web)}`);
-  statusLines.push(`Landing: ${landing === "healthy" ? chalk.green(landing) : landing === "missing" ? chalk.red(landing) : chalk.yellow(landing)}`);
+  statusLines.push(`Landing: ${chalk.dim("omitted")}`);
   if (!bootstrapComplete) {
     return {
       statusLines,
@@ -2082,7 +2094,7 @@ function buildOperatorOverview() {
       ]
     };
   }
-  if (api !== "healthy" || web !== "healthy" || landing !== "healthy") {
+  if (api !== "healthy" || web !== "healthy") {
     return {
       statusLines,
       nextSteps: [
@@ -2151,8 +2163,6 @@ function versionedImages(version, edition = "enterprise") {
   const api = edition === "oss" ? `ghcr.io/envsync-cloud/envsync-api:${version}` : `ghcr.io/envsync-cloud/envsync-api-enterprise:${version}`;
   return {
     api,
-    // Deprecated field: kept for older deploy.yaml keys; unused by stack render.
-    management_api: api,
     keycloak: `envsync-keycloak:${version}`,
     web,
     landing: `ghcr.io/envsync-cloud/envsync-landing-static:${version}`
@@ -2238,7 +2248,6 @@ function normalizeConfig(raw) {
     },
     images: {
       api: !raw.images?.api || isManagedVersionedImage(raw.images.api, "api") ? derivedImages.api : raw.images.api,
-      management_api: !raw.images?.management_api || isManagedVersionedImage(raw.images.management_api, "management_api") ? derivedImages.management_api : raw.images.management_api,
       keycloak: !raw.images?.keycloak || isManagedVersionedImage(raw.images.keycloak, "keycloak") ? derivedImages.keycloak : raw.images.keycloak,
       web: !raw.images?.web || isManagedVersionedImage(raw.images.web, "web") ? derivedImages.web : raw.images.web,
       landing: !raw.images?.landing || isManagedVersionedImage(raw.images.landing, "landing") ? derivedImages.landing : raw.images.landing,
@@ -2249,7 +2258,6 @@ function normalizeConfig(raw) {
     services: {
       stack_name: stackName,
       api_port: requireDefined(raw.services?.api_port, "services.api_port"),
-      management_api_port: raw.services?.management_api_port ?? 4001,
       public_http_port: raw.services?.public_http_port ?? 80,
       public_https_port: raw.services?.public_https_port ?? 443,
       clickstack_ui_port: requireDefined(raw.services?.clickstack_ui_port, "services.clickstack_ui_port"),
@@ -2350,7 +2358,8 @@ function emptyGeneratedState() {
       openfga_db_password: "",
       minikms_root_key: "",
       minikms_session_signing_key: "",
-      minikms_db_password: ""
+      minikms_db_password: "",
+      saml_session_secret: ""
     },
     bootstrap: {
       completed_at: ""
@@ -2387,7 +2396,8 @@ function normalizeGeneratedState(raw) {
       openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
       minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
       minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
-      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
+      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password,
+      saml_session_secret: raw?.secrets?.saml_session_secret ?? defaults.secrets.saml_session_secret
     },
     bootstrap: {
       completed_at: raw?.bootstrap?.completed_at ?? defaults.bootstrap.completed_at
@@ -2438,7 +2448,8 @@ function mergeGeneratedState(env, generated) {
       openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
       minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
       minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
-      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
+      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password,
+      saml_session_secret: env.SAML_SESSION_SECRET ?? normalized.secrets.saml_session_secret
     },
     bootstrap: normalized.bootstrap
   });
@@ -2467,7 +2478,8 @@ function ensureGeneratedRuntimeState(config, generated) {
       openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
       minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
       minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
-      minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
+      minikms_db_password: generated.secrets.minikms_db_password || randomSecret(),
+      saml_session_secret: generated.secrets.saml_session_secret || randomBytes2(32).toString("hex")
     },
     bootstrap: generated.bootstrap
   });
@@ -3833,7 +3845,6 @@ async function cmdSetup() {
     domain: { root_domain: rootDomain, acme_email: acmeEmail },
     images: {
       api: releaseImages.api,
-      management_api: releaseImages.management_api,
       keycloak: releaseImages.keycloak,
       web: releaseImages.web,
       landing: releaseImages.landing,
@@ -3844,7 +3855,6 @@ async function cmdSetup() {
     services: {
       stack_name: "envsync",
       api_port: 4e3,
-      management_api_port: 4001,
       public_http_port: 80,
       public_https_port: 443,
       clickstack_ui_port: 8080,
@@ -4243,7 +4253,6 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
     { label: "openfga", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_openfga`) },
     { label: "minikms", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_minikms`) },
     { label: "clickstack", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_clickstack`) },
-    ...isOssConfig2(config) ? [] : [{ label: "landing", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_landing_nginx`) }],
     { label: "web", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_web_nginx`) },
     { label: "api", getHealth: (services) => apiHealth(services, config.services.stack_name) }
   ]);
@@ -4286,7 +4295,7 @@ async function cmdPromote(target) {
     }
   });
   writeDeployArtifacts(config, promotedState);
-  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version)) && exists2(releaseAssetDir("landing", promotedState.deployment.slots[targetSlot].release_version))) {
+  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version))) {
     activateFrontendReleaseForState(config, promotedState);
   } else {
     logWarn(`Missing staged frontend assets for release ${promotedState.deployment.slots[targetSlot].release_version}; leaving current frontend assets unchanged.`);
@@ -4317,7 +4326,7 @@ async function cmdRollback() {
     }
   });
   writeDeployArtifacts(config, rollbackState);
-  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version)) && exists2(releaseAssetDir("landing", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
+  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
     activateFrontendReleaseForState(config, rollbackState);
   } else {
     logWarn(`Missing staged frontend assets for release ${rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version}; leaving current frontend assets unchanged.`);
@@ -4413,7 +4422,7 @@ async function cmdHealth(asJson) {
         }
       },
       web: serviceHealth(services, `${stackName}_web_nginx`),
-      landing: serviceHealth(services, `${stackName}_landing_nginx`)
+      landing: "omitted"
     },
     database: {
       api: databaseHealth
@@ -5338,8 +5347,6 @@ var init_cli = __esm({
     MANAGED_VERSIONED_IMAGE_PREFIXES = {
       api: "ghcr.io/envsync-cloud/envsync-api:",
       api_enterprise: "ghcr.io/envsync-cloud/envsync-api-enterprise:",
-      // Retired second process — kept so old deploy.yaml image strings still parse as "managed".
-      management_api: "ghcr.io/envsync-cloud/envsync-management-api:",
       keycloak: "envsync-keycloak:",
       web: "ghcr.io/envsync-cloud/envsync-web-static:",
       web_oss: "ghcr.io/envsync-cloud/envsync-web-oss-static:",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy",
-  "version": "0.20.11",
+  "version": "0.21.0",
   "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@envsync-cloud/deploy-core": "0.20.11",
+    "@envsync-cloud/deploy-core": "0.21.0",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2"
   },