@envsync-cloud/deploy 0.20.12 → 0.21.2

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
+import { createHash as createHash3, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
 import { spawnSync } from "child_process";
-import fs4 from "fs";
+import fs5 from "fs";
 import path4 from "path";
 import readline2 from "readline";
 import chalk from "chalk";
@@ -37,13 +37,11 @@ var deployConfigSchema = z.object({
   services: z.object({
     stack_name: z.string().default("envsync"),
     api_port: z.number().int().positive().default(4e3),
-    management_api_port: z.number().int().positive().default(4001),
     public_http_port: z.number().int().positive().default(80),
     public_https_port: z.number().int().positive().default(443)
   }).default({}),
   images: z.object({
     api: z.string().default("ghcr.io/envsync-cloud/envsync-api:stable"),
-    management_api: z.string().default("ghcr.io/envsync-cloud/envsync-management-api:stable"),
     web: z.string().default("ghcr.io/envsync-cloud/envsync-web-oss-static:stable"),
     enterprise_web: z.string().default("ghcr.io/envsync-cloud/envsync-web-static:stable"),
     landing: z.string().default("ghcr.io/envsync-cloud/envsync-landing-static:stable"),
@@ -286,6 +284,16 @@ function formatDeploymentPlan(plan, format = "yaml") {
 }
 
 // src/render.ts
+import { createHash } from "crypto";
+import fs2 from "fs";
+function swarmConfigObjectName(stackName, logical, filePath, fallbackVersion) {
+  let token = fallbackVersion.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_|_$/g, "") || "v";
+  try {
+    token = createHash("sha256").update(fs2.readFileSync(filePath)).digest("hex").slice(0, 12);
+  } catch {
+  }
+  return `${stackName}_${logical}_${token}`;
+}
 function domainMap(rootDomain) {
   return {
     landing: rootDomain,
@@ -383,7 +391,6 @@ function buildRuntimeEnv2(config, generated, options) {
     ENVSYNC_STACK_NAME: config.services.stack_name,
     DB_AUTO_MIGRATE: "false",
     PORT: `${config.services.api_port}`,
-    MANAGEMENT_API_PORT: `${config.services.management_api_port}`,
     DATABASE_HOST: "postgres",
     DATABASE_PORT: "5432",
     DATABASE_USER: "postgres",
@@ -427,7 +434,13 @@ function buildRuntimeEnv2(config, generated, options) {
     OPENFGA_MODEL_ID: generated.openfga.model_id,
     OPENFGA_DB_PASSWORD: generated.secrets.openfga_db_password,
     API_URL: publicHttpsUrl(config, hosts.api),
+    SAML_SESSION_SECRET: generated.secrets.saml_session_secret,
     MANAGEMENT_API_URL: oss ? "" : publicHttpsUrl(config, hosts.api, "/api/v1/manage"),
+    KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS: "3600",
+    KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS: "604800",
     CLICKSTACK_OPERATOR_EMAIL: generated.clickstack.operator_email,
     CLICKSTACK_OPERATOR_PASSWORD: generated.clickstack.operator_password,
     CLICKSTACK_ACCESS_KEY: generated.clickstack.access_key,
@@ -466,12 +479,22 @@ function renderKeycloakRealm(config, runtimeEnv) {
   const webOrigins = publicHttpsOriginVariants(config, hosts.app);
   const apiRedirectUris = publicHttpsUrlVariants(config, hosts.api, "/api/access/api/callback");
   const apiOrigins = publicHttpsOriginVariants(config, hosts.api);
+  const accessTokenLifespan = Number(runtimeEnv.KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS || "3600");
+  const ssoSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const ssoSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS || "604800");
+  const clientSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const clientSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS || "604800");
   return JSON.stringify(
     {
       realm: config.auth.keycloak_realm,
       enabled: true,
       loginTheme: "envsync",
       emailTheme: "envsync",
+      accessTokenLifespan,
+      ssoSessionIdleTimeout,
+      ssoSessionMaxLifespan,
+      clientSessionIdleTimeout,
+      clientSessionMaxLifespan,
       clients: [
         {
           clientId: config.auth.web_client_id,
@@ -524,7 +547,7 @@ function renderTraefikDynamicConfig(config, generated) {
   const landingEnabled = false;
   const managementEnabled = !isOssConfig(config);
   const otelAllowedOrigins = [
-    ...landingEnabled ? publicHttpsOriginVariants(config, hosts.landing) : [],
+    ...publicHttpsOriginVariants(config, hosts.landing),
     ...publicHttpsOriginVariants(config, hosts.app)
   ];
   return [
@@ -912,6 +935,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const apiLicenseVolume = managementEnabled ? "\n    volumes:\n      - /etc/envsync/license:/etc/envsync/license:ro" : "";
   const deployment = createSteadyApiDeploymentState(config, generated);
   const stackName = config.services.stack_name;
+  const configName = (logical, filePath) => swarmConfigObjectName(stackName, logical, filePath, config.release.version);
   const s3RouterName = `${stackName}-s3-router`;
   const s3ServiceName = `${stackName}-s3-service`;
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
@@ -1021,7 +1045,7 @@ ${includeRuntimeInfra ? `
     image: ${config.images.keycloak}
     entrypoint: ["/bin/sh", "-lc"]
     command:
-      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override true && exec /opt/keycloak/bin/kc.sh start --optimized
+      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override false && exec /opt/keycloak/bin/kc.sh start --optimized
     environment:
 ${renderEnvList({
     KC_DB: "postgres",
@@ -1203,56 +1227,62 @@ volumes:
 
 configs:
   keycloak_realm:
+    name: ${configName("keycloak_realm", paths.keycloakRealmFile)}
     file: ${paths.keycloakRealmFile}
   clickstack_clickhouse_conf:
+    name: ${configName("clickstack_clickhouse_conf", paths.clickstackClickhouseConf)}
     file: ${paths.clickstackClickhouseConf}
   otel_agent_conf:
+    name: ${configName("otel_agent_conf", paths.otelAgentConf)}
     file: ${paths.otelAgentConf}
 ${landingEnabled ? `  nginx_landing_conf:
+    name: ${configName("nginx_landing_conf", paths.nginxLandingConf)}
     file: ${paths.nginxLandingConf}
 ` : ""}
   nginx_web_conf:
+    name: ${configName("nginx_web_conf", paths.nginxWebConf)}
     file: ${paths.nginxWebConf}
   nginx_api_maintenance_conf:
+    name: ${configName("nginx_api_maintenance_conf", paths.nginxApiMaintenanceConf)}
     file: ${paths.nginxApiMaintenanceConf}
 `.trimStart();
 }
 
 // src/static-bundle.ts
-import fs2 from "fs";
+import fs3 from "fs";
 import path2 from "path";
 function exists(target) {
-  return fs2.existsSync(target);
+  return fs3.existsSync(target);
 }
 function normalizeExtractedStaticBundle(kind, targetDir) {
   const directIndex = path2.join(targetDir, "index.html");
   if (exists(directIndex)) {
     return;
   }
-  const childDirs = fs2.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
+  const childDirs = fs3.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
   const candidateRoots = childDirs.filter((dir) => exists(path2.join(dir, "index.html")));
   if (candidateRoots.length !== 1) {
     return;
   }
   const nestedRoot = candidateRoots[0];
-  for (const entry of fs2.readdirSync(nestedRoot)) {
-    fs2.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
+  for (const entry of fs3.readdirSync(nestedRoot)) {
+    fs3.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
   }
-  fs2.rmSync(nestedRoot, { recursive: true, force: true });
+  fs3.rmSync(nestedRoot, { recursive: true, force: true });
 }
 function validateStaticBundle(kind, targetDir) {
   if (exists(path2.join(targetDir, "index.html"))) {
     return;
   }
-  const entries = exists(targetDir) ? fs2.readdirSync(targetDir).slice(0, 20).join(", ") : "";
+  const entries = exists(targetDir) ? fs3.readdirSync(targetDir).slice(0, 20).join(", ") : "";
   throw new Error(
     `Invalid ${kind} static bundle at ${targetDir}: missing index.html${entries ? `. Found: ${entries}` : ""}`
   );
 }
 
 // src/org-setup.ts
-import { createHash, randomBytes } from "crypto";
-import fs3 from "fs";
+import { createHash as createHash2, randomBytes } from "crypto";
+import fs4 from "fs";
 import path3 from "path";
 import readline from "readline";
 var SETUP_TOKEN_HEADER = "X-EnvSync-Setup-Token";
@@ -1262,33 +1292,33 @@ function generateSetupToken() {
 function ensureSetupTokenFile(tokenFile, existingToken) {
   if (existingToken?.trim()) {
     const dir2 = path3.dirname(tokenFile);
-    fs3.mkdirSync(dir2, { recursive: true, mode: 448 });
-    fs3.writeFileSync(tokenFile, `${existingToken.trim()}
+    fs4.mkdirSync(dir2, { recursive: true, mode: 448 });
+    fs4.writeFileSync(tokenFile, `${existingToken.trim()}
 `, { mode: 384 });
     return existingToken.trim();
   }
-  if (fs3.existsSync(tokenFile)) {
-    const fromFile = fs3.readFileSync(tokenFile, "utf8").trim();
+  if (fs4.existsSync(tokenFile)) {
+    const fromFile = fs4.readFileSync(tokenFile, "utf8").trim();
     if (fromFile.length >= 16) {
       return fromFile;
     }
   }
   const token = generateSetupToken();
   const dir = path3.dirname(tokenFile);
-  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs3.writeFileSync(tokenFile, `${token}
+  fs4.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs4.writeFileSync(tokenFile, `${token}
 `, { mode: 384 });
   return token;
 }
 function readSetupTokenFile(tokenFile) {
-  if (!fs3.existsSync(tokenFile)) {
+  if (!fs4.existsSync(tokenFile)) {
     return null;
   }
-  const token = fs3.readFileSync(tokenFile, "utf8").trim();
+  const token = fs4.readFileSync(tokenFile, "utf8").trim();
   return token.length >= 16 ? token : null;
 }
 function setupTokenFingerprint(token) {
-  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+  return createHash2("sha256").update(token).digest("hex").slice(0, 12);
 }
 async function fetchSetupStatus(apiBaseUrl, setupToken) {
   const base = apiBaseUrl.replace(/\/$/, "");
@@ -1581,8 +1611,6 @@ var DEFAULT_ENTERPRISE_LICENSE_SERVER_URL = "https://license.envsync.cloud";
 var MANAGED_VERSIONED_IMAGE_PREFIXES = {
   api: "ghcr.io/envsync-cloud/envsync-api:",
   api_enterprise: "ghcr.io/envsync-cloud/envsync-api-enterprise:",
-  // Retired second process — kept so old deploy.yaml image strings still parse as "managed".
-  management_api: "ghcr.io/envsync-cloud/envsync-management-api:",
   keycloak: "envsync-keycloak:",
   web: "ghcr.io/envsync-cloud/envsync-web-static:",
   web_oss: "ghcr.io/envsync-cloud/envsync-web-oss-static:",
@@ -1777,12 +1805,12 @@ ${typeof result.stderr === "string" ? result.stderr : ""}`.toLowerCase();
 ${stderr}` : ""}`);
 }
 function ensureDir(dir) {
-  fs4.mkdirSync(dir, { recursive: true });
+  fs5.mkdirSync(dir, { recursive: true });
 }
 function writeFile(target, content, mode) {
   ensureDir(path4.dirname(target));
-  fs4.writeFileSync(target, content, "utf8");
-  if (mode != null) fs4.chmodSync(target, mode);
+  fs5.writeFileSync(target, content, "utf8");
+  if (mode != null) fs5.chmodSync(target, mode);
 }
 function writeFileMaybe(target, content, mode) {
   if (currentOptions.dryRun) {
@@ -1794,7 +1822,7 @@ function writeFileMaybe(target, content, mode) {
 function ensureEnterpriseLicenseFilesReadable() {
   if (exists2(LICENSE_ROOT)) {
     try {
-      fs4.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
+      fs5.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
     } catch {
       throw new Error(
         `Cannot update directory mode for ${LICENSE_ROOT}. Fix by running: chmod ${LICENSE_DIR_MODE.toString(8)} ${LICENSE_ROOT}`
@@ -1804,7 +1832,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   for (const filePath of [LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE]) {
     if (!exists2(filePath)) continue;
     try {
-      fs4.chmodSync(filePath, LICENSE_FILE_MODE);
+      fs5.chmodSync(filePath, LICENSE_FILE_MODE);
     } catch {
       throw new Error(
         `Cannot update file mode for ${filePath}. Fix by running: chmod ${LICENSE_FILE_MODE.toString(8)} ${filePath}`
@@ -1813,7 +1841,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   }
 }
 function exists2(target) {
-  return fs4.existsSync(target);
+  return fs5.existsSync(target);
 }
 function randomSecret(bytes = 24) {
   return randomBytes2(bytes).toString("hex");
@@ -1823,7 +1851,7 @@ function generateMinikmsSessionSigningKey() {
   return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
 }
 function deterministicInstallFingerprint(rootDomain, stackName) {
-  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
+  return `envsync-${createHash3("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
 }
 function randomStrongPassword() {
   return `EnvSync!${randomBytes2(8).toString("hex")}Aa1`;
@@ -1927,7 +1955,7 @@ function normalizeNetutilsForwards(raw, stackName, enabled) {
 }
 function loadWireguardState() {
   if (!exists2(WIREGUARD_STATE_FILE)) return null;
-  const raw = JSON.parse(fs4.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
   return {
     private_key: raw.private_key,
     public_key: raw.public_key,
@@ -2111,7 +2139,7 @@ function publicHttpsUrl2(config, host, path5 = "") {
 function getDeployCliVersion() {
   try {
     const packageJsonPath = new URL("../package.json", import.meta.url);
-    const raw = fs4.readFileSync(packageJsonPath, "utf8");
+    const raw = fs5.readFileSync(packageJsonPath, "utf8");
     return JSON.parse(raw).version ?? "0.0.0";
   } catch {
     return process.env.npm_package_version ?? "0.0.0";
@@ -2203,7 +2231,6 @@ function buildOperatorOverview() {
   const bootstrapComplete = hasCompleteBootstrapState(generated) && generated.bootstrap.completed_at.length > 0;
   const api = apiHealth(services, config.services.stack_name);
   const web = serviceHealth(services, `${config.services.stack_name}_web_nginx`);
-  const landing = serviceHealth(services, `${config.services.stack_name}_landing_nginx`);
   statusLines.push(`Configured: ${chalk.green("yes")}`);
   statusLines.push(`Pinned release: ${chalk.cyan(config.release.version)}`);
   statusLines.push(`Stack: ${stackRunning ? chalk.green(config.services.stack_name) : chalk.yellow("not running")}`);
@@ -2211,7 +2238,7 @@ function buildOperatorOverview() {
   statusLines.push(`Active API slot: ${chalk.cyan(generated.deployment.active_slot)}`);
   statusLines.push(`API: ${api === "healthy" ? chalk.green(api) : api === "missing" ? chalk.red(api) : chalk.yellow(api)}`);
   statusLines.push(`Web: ${web === "healthy" ? chalk.green(web) : web === "missing" ? chalk.red(web) : chalk.yellow(web)}`);
-  statusLines.push(`Landing: ${landing === "healthy" ? chalk.green(landing) : landing === "missing" ? chalk.red(landing) : chalk.yellow(landing)}`);
+  statusLines.push(`Landing: ${chalk.dim("omitted")}`);
   if (!bootstrapComplete) {
     return {
       statusLines,
@@ -2221,7 +2248,7 @@ function buildOperatorOverview() {
       ]
     };
   }
-  if (api !== "healthy" || web !== "healthy" || landing !== "healthy") {
+  if (api !== "healthy" || web !== "healthy") {
     return {
       statusLines,
       nextSteps: [
@@ -2290,8 +2317,6 @@ function versionedImages(version, edition = "enterprise") {
   const api = edition === "oss" ? `ghcr.io/envsync-cloud/envsync-api:${version}` : `ghcr.io/envsync-cloud/envsync-api-enterprise:${version}`;
   return {
     api,
-    // Deprecated field: kept for older deploy.yaml keys; unused by stack render.
-    management_api: api,
     keycloak: `envsync-keycloak:${version}`,
     web,
     landing: `ghcr.io/envsync-cloud/envsync-landing-static:${version}`
@@ -2377,7 +2402,6 @@ function normalizeConfig(raw) {
     },
     images: {
       api: !raw.images?.api || isManagedVersionedImage(raw.images.api, "api") ? derivedImages.api : raw.images.api,
-      management_api: !raw.images?.management_api || isManagedVersionedImage(raw.images.management_api, "management_api") ? derivedImages.management_api : raw.images.management_api,
       keycloak: !raw.images?.keycloak || isManagedVersionedImage(raw.images.keycloak, "keycloak") ? derivedImages.keycloak : raw.images.keycloak,
       web: !raw.images?.web || isManagedVersionedImage(raw.images.web, "web") ? derivedImages.web : raw.images.web,
       landing: !raw.images?.landing || isManagedVersionedImage(raw.images.landing, "landing") ? derivedImages.landing : raw.images.landing,
@@ -2388,7 +2412,6 @@ function normalizeConfig(raw) {
     services: {
       stack_name: stackName,
       api_port: requireDefined(raw.services?.api_port, "services.api_port"),
-      management_api_port: raw.services?.management_api_port ?? 4001,
       public_http_port: raw.services?.public_http_port ?? 80,
       public_https_port: raw.services?.public_https_port ?? 443,
       clickstack_ui_port: requireDefined(raw.services?.clickstack_ui_port, "services.clickstack_ui_port"),
@@ -2489,7 +2512,8 @@ function emptyGeneratedState() {
       openfga_db_password: "",
       minikms_root_key: "",
       minikms_session_signing_key: "",
-      minikms_db_password: ""
+      minikms_db_password: "",
+      saml_session_secret: ""
     },
     bootstrap: {
       completed_at: ""
@@ -2526,7 +2550,8 @@ function normalizeGeneratedState(raw) {
       openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
       minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
       minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
-      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
+      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password,
+      saml_session_secret: raw?.secrets?.saml_session_secret ?? defaults.secrets.saml_session_secret
     },
     bootstrap: {
       completed_at: raw?.bootstrap?.completed_at ?? defaults.bootstrap.completed_at
@@ -2535,7 +2560,7 @@ function normalizeGeneratedState(raw) {
 }
 function readInternalState() {
   if (!exists2(INTERNAL_CONFIG_JSON)) return null;
-  const raw = JSON.parse(fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
   return {
     config: raw.config ? normalizeConfig(raw.config) : void 0,
     generated: normalizeGeneratedState(raw.generated)
@@ -2545,7 +2570,7 @@ function loadConfig() {
   if (!exists2(DEPLOY_YAML)) {
     throw new Error(`Missing deploy config at ${DEPLOY_YAML}. Run setup first.`);
   }
-  const raw = fs4.readFileSync(DEPLOY_YAML, "utf8");
+  const raw = fs5.readFileSync(DEPLOY_YAML, "utf8");
   if (raw.trimStart().startsWith("{")) {
     return normalizeConfig(JSON.parse(raw));
   }
@@ -2553,7 +2578,7 @@ function loadConfig() {
 }
 function loadGeneratedEnv() {
   if (!exists2(DEPLOY_ENV)) return {};
-  return parseEnvFile(fs4.readFileSync(DEPLOY_ENV, "utf8"));
+  return parseEnvFile(fs5.readFileSync(DEPLOY_ENV, "utf8"));
 }
 function mergeGeneratedState(env, generated) {
   const normalized = normalizeGeneratedState(generated);
@@ -2577,7 +2602,8 @@ function mergeGeneratedState(env, generated) {
       openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
       minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
       minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
-      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
+      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password,
+      saml_session_secret: env.SAML_SESSION_SECRET ?? normalized.secrets.saml_session_secret
     },
     bootstrap: normalized.bootstrap
   });
@@ -2606,7 +2632,8 @@ function ensureGeneratedRuntimeState(config, generated) {
       openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
       minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
       minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
-      minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
+      minikms_db_password: generated.secrets.minikms_db_password || randomSecret(),
+      saml_session_secret: generated.secrets.saml_session_secret || randomBytes2(32).toString("hex")
     },
     bootstrap: generated.bootstrap
   });
@@ -2839,7 +2866,7 @@ function extractStaticBundle(kind, image, targetDir) {
     logDryRun(`Would extract ${kind} bundle from ${image} into ${targetDir}`);
     return;
   }
-  fs4.rmSync(targetDir, { recursive: true, force: true });
+  fs5.rmSync(targetDir, { recursive: true, force: true });
   ensureDir(targetDir);
   const containerId = run("docker", ["create", image], { quiet: true }).trim();
   try {
@@ -2867,23 +2894,23 @@ function writeFrontendRuntimeConfig(targetDir, runtimeConfig) {
 function syncFrontendReleaseContents(sourceDir, targetDir) {
   ensureDir(targetDir);
   const deferredEntries = /* @__PURE__ */ new Set(["index.html", "runtime-config.js"]);
-  const entries = fs4.readdirSync(sourceDir, { withFileTypes: true });
+  const entries = fs5.readdirSync(sourceDir, { withFileTypes: true });
   for (const entry of entries) {
     if (deferredEntries.has(entry.name)) {
       continue;
     }
-    fs4.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
+    fs5.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
       recursive: true,
       force: true
     });
   }
   const stagedRuntimeConfig = path4.join(sourceDir, "runtime-config.js");
   if (exists2(stagedRuntimeConfig)) {
-    fs4.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
+    fs5.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
   }
   const stagedIndex = path4.join(sourceDir, "index.html");
   if (exists2(stagedIndex)) {
-    fs4.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
+    fs5.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
   }
 }
 function activateFrontendRelease(kind, version, runtimeConfig) {
@@ -3281,7 +3308,7 @@ ${trimmed}`
 }
 function readRenderedRuntimeConfig(filePath) {
   if (!exists2(filePath)) return null;
-  const raw = fs4.readFileSync(filePath, "utf8").trim();
+  const raw = fs5.readFileSync(filePath, "utf8").trim();
   const prefix = "window.__ENVSYNC_RUNTIME_CONFIG__ = ";
   if (!raw.startsWith(prefix) || !raw.endsWith(";")) return null;
   try {
@@ -3578,7 +3605,7 @@ function removeTarget(target) {
     logDryRun(`Would remove ${target}`);
     return;
   }
-  fs4.rmSync(target, { recursive: true, force: true });
+  fs5.rmSync(target, { recursive: true, force: true });
   logInfo(`Removed ${target}`);
 }
 async function cmdRemove() {
@@ -3977,7 +4004,6 @@ async function cmdSetup() {
     domain: { root_domain: rootDomain, acme_email: acmeEmail },
     images: {
       api: releaseImages.api,
-      management_api: releaseImages.management_api,
       keycloak: releaseImages.keycloak,
       web: releaseImages.web,
       landing: releaseImages.landing,
@@ -3988,7 +4014,6 @@ async function cmdSetup() {
     services: {
       stack_name: "envsync",
       api_port: 4e3,
-      management_api_port: 4001,
       public_http_port: 80,
       public_https_port: 443,
       clickstack_ui_port: 8080,
@@ -4327,7 +4352,7 @@ async function cmdDeploy() {
       sleepSeconds(3);
       promoted = true;
       if (snapshotPath && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
     } catch (error) {
       const rollbackTarget = preUpgradeHead ?? "zero";
@@ -4361,7 +4386,7 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
       deployRenderedStack(config, "rollback recovery");
       waitForApiSlotHealthy(config, recoveredState.deployment.active_slot);
       if (snapshotPath && !config.upgrade.keep_failed_upgrade_db_snapshot && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
       throw new Error(
         usedSnapshotRestore ? `Deploy failed after DB migration. Previous release was restored using DB snapshot recovery. ${error instanceof Error ? error.message : String(error)}` : `Deploy failed after DB migration. Previous release was restored. ${error instanceof Error ? error.message : String(error)}`
@@ -4387,7 +4412,6 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
     { label: "openfga", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_openfga`) },
     { label: "minikms", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_minikms`) },
     { label: "clickstack", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_clickstack`) },
-    ...isOssConfig2(config) ? [] : [{ label: "landing", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_landing_nginx`) }],
     { label: "web", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_web_nginx`) },
     { label: "api", getHealth: (services) => apiHealth(services, config.services.stack_name) }
   ]);
@@ -4430,7 +4454,7 @@ async function cmdPromote(target) {
     }
   });
   writeDeployArtifacts(config, promotedState);
-  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version)) && exists2(releaseAssetDir("landing", promotedState.deployment.slots[targetSlot].release_version))) {
+  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version))) {
     activateFrontendReleaseForState(config, promotedState);
   } else {
     logWarn(`Missing staged frontend assets for release ${promotedState.deployment.slots[targetSlot].release_version}; leaving current frontend assets unchanged.`);
@@ -4461,7 +4485,7 @@ async function cmdRollback() {
     }
   });
   writeDeployArtifacts(config, rollbackState);
-  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version)) && exists2(releaseAssetDir("landing", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
+  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
     activateFrontendReleaseForState(config, rollbackState);
   } else {
     logWarn(`Missing staged frontend assets for release ${rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version}; leaving current frontend assets unchanged.`);
@@ -4483,7 +4507,7 @@ async function cmdHealth(asJson) {
   const hosts = domainMap2(config.domain.root_domain);
   const services = listStackServices(config);
   const stackName = config.services.stack_name;
-  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
+  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
   const webRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "web", "current", "runtime-config.js"));
   const landingRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "landing", "current", "runtime-config.js"));
   const clickstackSearchState = getClickstackSearchState(config);
@@ -4557,7 +4581,7 @@ async function cmdHealth(asJson) {
         }
       },
       web: serviceHealth(services, `${stackName}_web_nginx`),
-      landing: serviceHealth(services, `${stackName}_landing_nginx`)
+      landing: "omitted"
     },
     database: {
       api: databaseHealth
@@ -4675,8 +4699,8 @@ async function cmdUpgradeDeps() {
   await cmdDeploy();
 }
 function sha256File(filePath) {
-  const hash = createHash2("sha256");
-  hash.update(fs4.readFileSync(filePath));
+  const hash = createHash3("sha256");
+  hash.update(fs5.readFileSync(filePath));
   return hash.digest("hex");
 }
 function parseEnterpriseLicenseBundle(raw) {
@@ -4705,7 +4729,7 @@ function parseEnterpriseLicenseBundle(raw) {
   return candidate;
 }
 function readEnterpriseLicenseBundle(bundlePath) {
-  return parseEnterpriseLicenseBundle(JSON.parse(fs4.readFileSync(bundlePath, "utf8")));
+  return parseEnterpriseLicenseBundle(JSON.parse(fs5.readFileSync(bundlePath, "utf8")));
 }
 function normalizeLicenseServerUrl(serverUrl, route) {
   const trimmed = serverUrl.replace(/\/+$/, "");
@@ -4967,19 +4991,19 @@ async function cmdBackup() {
       logWarn("Backup will temporarily stop the EnvSync stack to capture consistent volume data.");
       stopManagedRuntime(config, "Stopping existing EnvSync services for consistent backup");
     }
-    writeFile(path4.join(staged, "deploy.env"), fs4.readFileSync(DEPLOY_ENV, "utf8"));
-    writeFile(path4.join(staged, "deploy.yaml"), fs4.readFileSync(DEPLOY_YAML, "utf8"));
-    writeFile(path4.join(staged, "config.json"), fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
-    writeFile(path4.join(staged, "versions.lock.json"), fs4.readFileSync(VERSIONS_LOCK, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs4.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs4.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.yaml"), fs4.readFileSync(STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
-    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs4.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
-    writeFile(path4.join(staged, "otel-agent.yaml"), fs4.readFileSync(OTEL_AGENT_CONF, "utf8"));
-    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs4.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
+    writeFile(path4.join(staged, "deploy.env"), fs5.readFileSync(DEPLOY_ENV, "utf8"));
+    writeFile(path4.join(staged, "deploy.yaml"), fs5.readFileSync(DEPLOY_YAML, "utf8"));
+    writeFile(path4.join(staged, "config.json"), fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+    writeFile(path4.join(staged, "versions.lock.json"), fs5.readFileSync(VERSIONS_LOCK, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs5.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs5.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.yaml"), fs5.readFileSync(STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
+    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs5.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
+    writeFile(path4.join(staged, "otel-agent.yaml"), fs5.readFileSync(OTEL_AGENT_CONF, "utf8"));
+    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs5.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
     if (!isOssConfig2(config) && exists2(LICENSE_ROOT)) {
-      fs4.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
+      fs5.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
     }
     const volumesDir = path4.join(staged, "volumes");
     for (const volume of STACK_VOLUMES) {
@@ -5046,21 +5070,21 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   }
   ensureDir(restoreRoot);
   run("bash", ["-lc", `tar -xzf ${JSON.stringify(archivePath)} -C ${JSON.stringify(restoreRoot)}`]);
-  writeFile(DEPLOY_ENV, fs4.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
-  writeFile(DEPLOY_YAML, fs4.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
-  writeFile(INTERNAL_CONFIG_JSON, fs4.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
-  writeFile(VERSIONS_LOCK, fs4.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
-  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
-  writeFile(BOOTSTRAP_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
-  writeFile(STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
-  writeFile(TRAEFIK_DYNAMIC_FILE, fs4.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
-  writeFile(KEYCLOAK_REALM_FILE, fs4.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
-  writeFile(OTEL_AGENT_CONF, fs4.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
-  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs4.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
+  writeFile(DEPLOY_ENV, fs5.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
+  writeFile(DEPLOY_YAML, fs5.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
+  writeFile(INTERNAL_CONFIG_JSON, fs5.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
+  writeFile(VERSIONS_LOCK, fs5.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
+  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
+  writeFile(BOOTSTRAP_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
+  writeFile(STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
+  writeFile(TRAEFIK_DYNAMIC_FILE, fs5.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
+  writeFile(KEYCLOAK_REALM_FILE, fs5.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
+  writeFile(OTEL_AGENT_CONF, fs5.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
+  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs5.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
   const restoredLicenseRoot = path4.join(restoreRoot, "license");
   if (exists2(restoredLicenseRoot)) {
-    fs4.rmSync(LICENSE_ROOT, { recursive: true, force: true });
-    fs4.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
+    fs5.rmSync(LICENSE_ROOT, { recursive: true, force: true });
+    fs5.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
     ensureEnterpriseLicenseFilesReadable();
   }
   const config = loadConfig();

package/dist/index.js

@@ -243,13 +243,11 @@ var init_src = __esm({
       services: z.object({
         stack_name: z.string().default("envsync"),
         api_port: z.number().int().positive().default(4e3),
-        management_api_port: z.number().int().positive().default(4001),
         public_http_port: z.number().int().positive().default(80),
         public_https_port: z.number().int().positive().default(443)
       }).default({}),
       images: z.object({
         api: z.string().default("ghcr.io/envsync-cloud/envsync-api:stable"),
-        management_api: z.string().default("ghcr.io/envsync-cloud/envsync-management-api:stable"),
         web: z.string().default("ghcr.io/envsync-cloud/envsync-web-oss-static:stable"),
         enterprise_web: z.string().default("ghcr.io/envsync-cloud/envsync-web-static:stable"),
         landing: z.string().default("ghcr.io/envsync-cloud/envsync-landing-static:stable"),
@@ -287,6 +285,16 @@ var init_src = __esm({
 });
 
 // src/render.ts
+import { createHash } from "crypto";
+import fs2 from "fs";
+function swarmConfigObjectName(stackName, logical, filePath, fallbackVersion) {
+  let token = fallbackVersion.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_|_$/g, "") || "v";
+  try {
+    token = createHash("sha256").update(fs2.readFileSync(filePath)).digest("hex").slice(0, 12);
+  } catch {
+  }
+  return `${stackName}_${logical}_${token}`;
+}
 function domainMap(rootDomain) {
   return {
     landing: rootDomain,
@@ -384,7 +392,6 @@ function buildRuntimeEnv2(config, generated, options) {
     ENVSYNC_STACK_NAME: config.services.stack_name,
     DB_AUTO_MIGRATE: "false",
     PORT: `${config.services.api_port}`,
-    MANAGEMENT_API_PORT: `${config.services.management_api_port}`,
     DATABASE_HOST: "postgres",
     DATABASE_PORT: "5432",
     DATABASE_USER: "postgres",
@@ -428,7 +435,13 @@ function buildRuntimeEnv2(config, generated, options) {
     OPENFGA_MODEL_ID: generated.openfga.model_id,
     OPENFGA_DB_PASSWORD: generated.secrets.openfga_db_password,
     API_URL: publicHttpsUrl(config, hosts.api),
+    SAML_SESSION_SECRET: generated.secrets.saml_session_secret,
     MANAGEMENT_API_URL: oss ? "" : publicHttpsUrl(config, hosts.api, "/api/v1/manage"),
+    KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS: "3600",
+    KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS: "604800",
+    KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS: "604800",
     CLICKSTACK_OPERATOR_EMAIL: generated.clickstack.operator_email,
     CLICKSTACK_OPERATOR_PASSWORD: generated.clickstack.operator_password,
     CLICKSTACK_ACCESS_KEY: generated.clickstack.access_key,
@@ -467,12 +480,22 @@ function renderKeycloakRealm(config, runtimeEnv) {
   const webOrigins = publicHttpsOriginVariants(config, hosts.app);
   const apiRedirectUris = publicHttpsUrlVariants(config, hosts.api, "/api/access/api/callback");
   const apiOrigins = publicHttpsOriginVariants(config, hosts.api);
+  const accessTokenLifespan = Number(runtimeEnv.KEYCLOAK_ACCESS_TOKEN_LIFESPAN_SECONDS || "3600");
+  const ssoSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const ssoSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_SSO_SESSION_MAX_LIFESPAN_SECONDS || "604800");
+  const clientSessionIdleTimeout = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_IDLE_TIMEOUT_SECONDS || "604800");
+  const clientSessionMaxLifespan = Number(runtimeEnv.KEYCLOAK_CLIENT_SESSION_MAX_LIFESPAN_SECONDS || "604800");
   return JSON.stringify(
     {
       realm: config.auth.keycloak_realm,
       enabled: true,
       loginTheme: "envsync",
       emailTheme: "envsync",
+      accessTokenLifespan,
+      ssoSessionIdleTimeout,
+      ssoSessionMaxLifespan,
+      clientSessionIdleTimeout,
+      clientSessionMaxLifespan,
       clients: [
         {
           clientId: config.auth.web_client_id,
@@ -525,7 +548,7 @@ function renderTraefikDynamicConfig(config, generated) {
   const landingEnabled = false;
   const managementEnabled = !isOssConfig(config);
   const otelAllowedOrigins = [
-    ...landingEnabled ? publicHttpsOriginVariants(config, hosts.landing) : [],
+    ...publicHttpsOriginVariants(config, hosts.landing),
     ...publicHttpsOriginVariants(config, hosts.app)
   ];
   return [
@@ -909,6 +932,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const apiLicenseVolume = managementEnabled ? "\n    volumes:\n      - /etc/envsync/license:/etc/envsync/license:ro" : "";
   const deployment = createSteadyApiDeploymentState(config, generated);
   const stackName = config.services.stack_name;
+  const configName = (logical, filePath) => swarmConfigObjectName(stackName, logical, filePath, config.release.version);
   const s3RouterName = `${stackName}-s3-router`;
   const s3ServiceName = `${stackName}-s3-service`;
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
@@ -1018,7 +1042,7 @@ ${includeRuntimeInfra ? `
     image: ${config.images.keycloak}
     entrypoint: ["/bin/sh", "-lc"]
     command:
-      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override true && exec /opt/keycloak/bin/kc.sh start --optimized
+      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override false && exec /opt/keycloak/bin/kc.sh start --optimized
     environment:
 ${renderEnvList({
     KC_DB: "postgres",
@@ -1200,17 +1224,23 @@ volumes:
 
 configs:
   keycloak_realm:
+    name: ${configName("keycloak_realm", paths.keycloakRealmFile)}
     file: ${paths.keycloakRealmFile}
   clickstack_clickhouse_conf:
+    name: ${configName("clickstack_clickhouse_conf", paths.clickstackClickhouseConf)}
     file: ${paths.clickstackClickhouseConf}
   otel_agent_conf:
+    name: ${configName("otel_agent_conf", paths.otelAgentConf)}
     file: ${paths.otelAgentConf}
 ${landingEnabled ? `  nginx_landing_conf:
+    name: ${configName("nginx_landing_conf", paths.nginxLandingConf)}
     file: ${paths.nginxLandingConf}
 ` : ""}
   nginx_web_conf:
+    name: ${configName("nginx_web_conf", paths.nginxWebConf)}
     file: ${paths.nginxWebConf}
   nginx_api_maintenance_conf:
+    name: ${configName("nginx_api_maintenance_conf", paths.nginxApiMaintenanceConf)}
     file: ${paths.nginxApiMaintenanceConf}
 `.trimStart();
 }
@@ -1226,32 +1256,32 @@ var init_render = __esm({
 });
 
 // src/static-bundle.ts
-import fs2 from "fs";
+import fs3 from "fs";
 import path2 from "path";
 function exists(target) {
-  return fs2.existsSync(target);
+  return fs3.existsSync(target);
 }
 function normalizeExtractedStaticBundle(kind, targetDir) {
   const directIndex = path2.join(targetDir, "index.html");
   if (exists(directIndex)) {
     return;
   }
-  const childDirs = fs2.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
+  const childDirs = fs3.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
   const candidateRoots = childDirs.filter((dir) => exists(path2.join(dir, "index.html")));
   if (candidateRoots.length !== 1) {
     return;
   }
   const nestedRoot = candidateRoots[0];
-  for (const entry of fs2.readdirSync(nestedRoot)) {
-    fs2.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
+  for (const entry of fs3.readdirSync(nestedRoot)) {
+    fs3.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
   }
-  fs2.rmSync(nestedRoot, { recursive: true, force: true });
+  fs3.rmSync(nestedRoot, { recursive: true, force: true });
 }
 function validateStaticBundle(kind, targetDir) {
   if (exists(path2.join(targetDir, "index.html"))) {
     return;
   }
-  const entries = exists(targetDir) ? fs2.readdirSync(targetDir).slice(0, 20).join(", ") : "";
+  const entries = exists(targetDir) ? fs3.readdirSync(targetDir).slice(0, 20).join(", ") : "";
   throw new Error(
     `Invalid ${kind} static bundle at ${targetDir}: missing index.html${entries ? `. Found: ${entries}` : ""}`
   );
@@ -1263,8 +1293,8 @@ var init_static_bundle = __esm({
 });
 
 // src/org-setup.ts
-import { createHash, randomBytes } from "crypto";
-import fs3 from "fs";
+import { createHash as createHash2, randomBytes } from "crypto";
+import fs4 from "fs";
 import path3 from "path";
 import readline from "readline";
 function generateSetupToken() {
@@ -1273,33 +1303,33 @@ function generateSetupToken() {
 function ensureSetupTokenFile(tokenFile, existingToken) {
   if (existingToken?.trim()) {
     const dir2 = path3.dirname(tokenFile);
-    fs3.mkdirSync(dir2, { recursive: true, mode: 448 });
-    fs3.writeFileSync(tokenFile, `${existingToken.trim()}
+    fs4.mkdirSync(dir2, { recursive: true, mode: 448 });
+    fs4.writeFileSync(tokenFile, `${existingToken.trim()}
 `, { mode: 384 });
     return existingToken.trim();
   }
-  if (fs3.existsSync(tokenFile)) {
-    const fromFile = fs3.readFileSync(tokenFile, "utf8").trim();
+  if (fs4.existsSync(tokenFile)) {
+    const fromFile = fs4.readFileSync(tokenFile, "utf8").trim();
     if (fromFile.length >= 16) {
       return fromFile;
     }
   }
   const token = generateSetupToken();
   const dir = path3.dirname(tokenFile);
-  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs3.writeFileSync(tokenFile, `${token}
+  fs4.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs4.writeFileSync(tokenFile, `${token}
 `, { mode: 384 });
   return token;
 }
 function readSetupTokenFile(tokenFile) {
-  if (!fs3.existsSync(tokenFile)) {
+  if (!fs4.existsSync(tokenFile)) {
     return null;
   }
-  const token = fs3.readFileSync(tokenFile, "utf8").trim();
+  const token = fs4.readFileSync(tokenFile, "utf8").trim();
   return token.length >= 16 ? token : null;
 }
 function setupTokenFingerprint(token) {
-  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+  return createHash2("sha256").update(token).digest("hex").slice(0, 12);
 }
 async function fetchSetupStatus(apiBaseUrl, setupToken) {
   const base = apiBaseUrl.replace(/\/$/, "");
@@ -1442,9 +1472,9 @@ var init_org_setup = __esm({
 
 // src/cli.ts
 var cli_exports = {};
-import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
+import { createHash as createHash3, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
 import { spawnSync } from "child_process";
-import fs4 from "fs";
+import fs5 from "fs";
 import path4 from "path";
 import readline2 from "readline";
 import chalk from "chalk";
@@ -1638,12 +1668,12 @@ ${typeof result.stderr === "string" ? result.stderr : ""}`.toLowerCase();
 ${stderr}` : ""}`);
 }
 function ensureDir(dir) {
-  fs4.mkdirSync(dir, { recursive: true });
+  fs5.mkdirSync(dir, { recursive: true });
 }
 function writeFile(target, content, mode) {
   ensureDir(path4.dirname(target));
-  fs4.writeFileSync(target, content, "utf8");
-  if (mode != null) fs4.chmodSync(target, mode);
+  fs5.writeFileSync(target, content, "utf8");
+  if (mode != null) fs5.chmodSync(target, mode);
 }
 function writeFileMaybe(target, content, mode) {
   if (currentOptions.dryRun) {
@@ -1655,7 +1685,7 @@ function writeFileMaybe(target, content, mode) {
 function ensureEnterpriseLicenseFilesReadable() {
   if (exists2(LICENSE_ROOT)) {
     try {
-      fs4.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
+      fs5.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
     } catch {
       throw new Error(
         `Cannot update directory mode for ${LICENSE_ROOT}. Fix by running: chmod ${LICENSE_DIR_MODE.toString(8)} ${LICENSE_ROOT}`
@@ -1665,7 +1695,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   for (const filePath of [LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE]) {
     if (!exists2(filePath)) continue;
     try {
-      fs4.chmodSync(filePath, LICENSE_FILE_MODE);
+      fs5.chmodSync(filePath, LICENSE_FILE_MODE);
     } catch {
       throw new Error(
         `Cannot update file mode for ${filePath}. Fix by running: chmod ${LICENSE_FILE_MODE.toString(8)} ${filePath}`
@@ -1674,7 +1704,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   }
 }
 function exists2(target) {
-  return fs4.existsSync(target);
+  return fs5.existsSync(target);
 }
 function randomSecret(bytes = 24) {
   return randomBytes2(bytes).toString("hex");
@@ -1684,7 +1714,7 @@ function generateMinikmsSessionSigningKey() {
   return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
 }
 function deterministicInstallFingerprint(rootDomain, stackName) {
-  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
+  return `envsync-${createHash3("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
 }
 function randomStrongPassword() {
   return `EnvSync!${randomBytes2(8).toString("hex")}Aa1`;
@@ -1788,7 +1818,7 @@ function normalizeNetutilsForwards(raw, stackName, enabled) {
 }
 function loadWireguardState() {
   if (!exists2(WIREGUARD_STATE_FILE)) return null;
-  const raw = JSON.parse(fs4.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
   return {
     private_key: raw.private_key,
     public_key: raw.public_key,
@@ -1972,7 +2002,7 @@ function publicHttpsUrl2(config, host, path5 = "") {
 function getDeployCliVersion() {
   try {
     const packageJsonPath = new URL("../package.json", import.meta.url);
-    const raw = fs4.readFileSync(packageJsonPath, "utf8");
+    const raw = fs5.readFileSync(packageJsonPath, "utf8");
     return JSON.parse(raw).version ?? "0.0.0";
   } catch {
     return process.env.npm_package_version ?? "0.0.0";
@@ -2064,7 +2094,6 @@ function buildOperatorOverview() {
   const bootstrapComplete = hasCompleteBootstrapState(generated) && generated.bootstrap.completed_at.length > 0;
   const api = apiHealth(services, config.services.stack_name);
   const web = serviceHealth(services, `${config.services.stack_name}_web_nginx`);
-  const landing = serviceHealth(services, `${config.services.stack_name}_landing_nginx`);
   statusLines.push(`Configured: ${chalk.green("yes")}`);
   statusLines.push(`Pinned release: ${chalk.cyan(config.release.version)}`);
   statusLines.push(`Stack: ${stackRunning ? chalk.green(config.services.stack_name) : chalk.yellow("not running")}`);
@@ -2072,7 +2101,7 @@ function buildOperatorOverview() {
   statusLines.push(`Active API slot: ${chalk.cyan(generated.deployment.active_slot)}`);
   statusLines.push(`API: ${api === "healthy" ? chalk.green(api) : api === "missing" ? chalk.red(api) : chalk.yellow(api)}`);
   statusLines.push(`Web: ${web === "healthy" ? chalk.green(web) : web === "missing" ? chalk.red(web) : chalk.yellow(web)}`);
-  statusLines.push(`Landing: ${landing === "healthy" ? chalk.green(landing) : landing === "missing" ? chalk.red(landing) : chalk.yellow(landing)}`);
+  statusLines.push(`Landing: ${chalk.dim("omitted")}`);
   if (!bootstrapComplete) {
     return {
       statusLines,
@@ -2082,7 +2111,7 @@ function buildOperatorOverview() {
       ]
     };
   }
-  if (api !== "healthy" || web !== "healthy" || landing !== "healthy") {
+  if (api !== "healthy" || web !== "healthy") {
     return {
       statusLines,
       nextSteps: [
@@ -2151,8 +2180,6 @@ function versionedImages(version, edition = "enterprise") {
   const api = edition === "oss" ? `ghcr.io/envsync-cloud/envsync-api:${version}` : `ghcr.io/envsync-cloud/envsync-api-enterprise:${version}`;
   return {
     api,
-    // Deprecated field: kept for older deploy.yaml keys; unused by stack render.
-    management_api: api,
     keycloak: `envsync-keycloak:${version}`,
     web,
     landing: `ghcr.io/envsync-cloud/envsync-landing-static:${version}`
@@ -2238,7 +2265,6 @@ function normalizeConfig(raw) {
     },
     images: {
       api: !raw.images?.api || isManagedVersionedImage(raw.images.api, "api") ? derivedImages.api : raw.images.api,
-      management_api: !raw.images?.management_api || isManagedVersionedImage(raw.images.management_api, "management_api") ? derivedImages.management_api : raw.images.management_api,
       keycloak: !raw.images?.keycloak || isManagedVersionedImage(raw.images.keycloak, "keycloak") ? derivedImages.keycloak : raw.images.keycloak,
       web: !raw.images?.web || isManagedVersionedImage(raw.images.web, "web") ? derivedImages.web : raw.images.web,
       landing: !raw.images?.landing || isManagedVersionedImage(raw.images.landing, "landing") ? derivedImages.landing : raw.images.landing,
@@ -2249,7 +2275,6 @@ function normalizeConfig(raw) {
     services: {
       stack_name: stackName,
       api_port: requireDefined(raw.services?.api_port, "services.api_port"),
-      management_api_port: raw.services?.management_api_port ?? 4001,
       public_http_port: raw.services?.public_http_port ?? 80,
       public_https_port: raw.services?.public_https_port ?? 443,
       clickstack_ui_port: requireDefined(raw.services?.clickstack_ui_port, "services.clickstack_ui_port"),
@@ -2350,7 +2375,8 @@ function emptyGeneratedState() {
       openfga_db_password: "",
       minikms_root_key: "",
       minikms_session_signing_key: "",
-      minikms_db_password: ""
+      minikms_db_password: "",
+      saml_session_secret: ""
     },
     bootstrap: {
       completed_at: ""
@@ -2387,7 +2413,8 @@ function normalizeGeneratedState(raw) {
       openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
       minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
       minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
-      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
+      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password,
+      saml_session_secret: raw?.secrets?.saml_session_secret ?? defaults.secrets.saml_session_secret
     },
     bootstrap: {
       completed_at: raw?.bootstrap?.completed_at ?? defaults.bootstrap.completed_at
@@ -2396,7 +2423,7 @@ function normalizeGeneratedState(raw) {
 }
 function readInternalState() {
   if (!exists2(INTERNAL_CONFIG_JSON)) return null;
-  const raw = JSON.parse(fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
   return {
     config: raw.config ? normalizeConfig(raw.config) : void 0,
     generated: normalizeGeneratedState(raw.generated)
@@ -2406,7 +2433,7 @@ function loadConfig() {
   if (!exists2(DEPLOY_YAML)) {
     throw new Error(`Missing deploy config at ${DEPLOY_YAML}. Run setup first.`);
   }
-  const raw = fs4.readFileSync(DEPLOY_YAML, "utf8");
+  const raw = fs5.readFileSync(DEPLOY_YAML, "utf8");
   if (raw.trimStart().startsWith("{")) {
     return normalizeConfig(JSON.parse(raw));
   }
@@ -2414,7 +2441,7 @@ function loadConfig() {
 }
 function loadGeneratedEnv() {
   if (!exists2(DEPLOY_ENV)) return {};
-  return parseEnvFile(fs4.readFileSync(DEPLOY_ENV, "utf8"));
+  return parseEnvFile(fs5.readFileSync(DEPLOY_ENV, "utf8"));
 }
 function mergeGeneratedState(env, generated) {
   const normalized = normalizeGeneratedState(generated);
@@ -2438,7 +2465,8 @@ function mergeGeneratedState(env, generated) {
       openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
       minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
       minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
-      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
+      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password,
+      saml_session_secret: env.SAML_SESSION_SECRET ?? normalized.secrets.saml_session_secret
     },
     bootstrap: normalized.bootstrap
   });
@@ -2467,7 +2495,8 @@ function ensureGeneratedRuntimeState(config, generated) {
       openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
       minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
       minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
-      minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
+      minikms_db_password: generated.secrets.minikms_db_password || randomSecret(),
+      saml_session_secret: generated.secrets.saml_session_secret || randomBytes2(32).toString("hex")
     },
     bootstrap: generated.bootstrap
   });
@@ -2700,7 +2729,7 @@ function extractStaticBundle(kind, image, targetDir) {
     logDryRun(`Would extract ${kind} bundle from ${image} into ${targetDir}`);
     return;
   }
-  fs4.rmSync(targetDir, { recursive: true, force: true });
+  fs5.rmSync(targetDir, { recursive: true, force: true });
   ensureDir(targetDir);
   const containerId = run("docker", ["create", image], { quiet: true }).trim();
   try {
@@ -2728,23 +2757,23 @@ function writeFrontendRuntimeConfig(targetDir, runtimeConfig) {
 function syncFrontendReleaseContents(sourceDir, targetDir) {
   ensureDir(targetDir);
   const deferredEntries = /* @__PURE__ */ new Set(["index.html", "runtime-config.js"]);
-  const entries = fs4.readdirSync(sourceDir, { withFileTypes: true });
+  const entries = fs5.readdirSync(sourceDir, { withFileTypes: true });
   for (const entry of entries) {
     if (deferredEntries.has(entry.name)) {
       continue;
     }
-    fs4.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
+    fs5.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
       recursive: true,
       force: true
     });
   }
   const stagedRuntimeConfig = path4.join(sourceDir, "runtime-config.js");
   if (exists2(stagedRuntimeConfig)) {
-    fs4.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
+    fs5.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
   }
   const stagedIndex = path4.join(sourceDir, "index.html");
   if (exists2(stagedIndex)) {
-    fs4.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
+    fs5.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
   }
 }
 function activateFrontendRelease(kind, version, runtimeConfig) {
@@ -3137,7 +3166,7 @@ ${trimmed}`
 }
 function readRenderedRuntimeConfig(filePath) {
   if (!exists2(filePath)) return null;
-  const raw = fs4.readFileSync(filePath, "utf8").trim();
+  const raw = fs5.readFileSync(filePath, "utf8").trim();
   const prefix = "window.__ENVSYNC_RUNTIME_CONFIG__ = ";
   if (!raw.startsWith(prefix) || !raw.endsWith(";")) return null;
   try {
@@ -3434,7 +3463,7 @@ function removeTarget(target) {
     logDryRun(`Would remove ${target}`);
     return;
   }
-  fs4.rmSync(target, { recursive: true, force: true });
+  fs5.rmSync(target, { recursive: true, force: true });
   logInfo(`Removed ${target}`);
 }
 async function cmdRemove() {
@@ -3833,7 +3862,6 @@ async function cmdSetup() {
     domain: { root_domain: rootDomain, acme_email: acmeEmail },
     images: {
       api: releaseImages.api,
-      management_api: releaseImages.management_api,
       keycloak: releaseImages.keycloak,
       web: releaseImages.web,
       landing: releaseImages.landing,
@@ -3844,7 +3872,6 @@ async function cmdSetup() {
     services: {
       stack_name: "envsync",
       api_port: 4e3,
-      management_api_port: 4001,
       public_http_port: 80,
       public_https_port: 443,
       clickstack_ui_port: 8080,
@@ -4183,7 +4210,7 @@ async function cmdDeploy() {
       sleepSeconds(3);
       promoted = true;
       if (snapshotPath && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
     } catch (error) {
       const rollbackTarget = preUpgradeHead ?? "zero";
@@ -4217,7 +4244,7 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
       deployRenderedStack(config, "rollback recovery");
       waitForApiSlotHealthy(config, recoveredState.deployment.active_slot);
       if (snapshotPath && !config.upgrade.keep_failed_upgrade_db_snapshot && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
       throw new Error(
         usedSnapshotRestore ? `Deploy failed after DB migration. Previous release was restored using DB snapshot recovery. ${error instanceof Error ? error.message : String(error)}` : `Deploy failed after DB migration. Previous release was restored. ${error instanceof Error ? error.message : String(error)}`
@@ -4243,7 +4270,6 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
     { label: "openfga", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_openfga`) },
     { label: "minikms", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_minikms`) },
     { label: "clickstack", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_clickstack`) },
-    ...isOssConfig2(config) ? [] : [{ label: "landing", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_landing_nginx`) }],
     { label: "web", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_web_nginx`) },
     { label: "api", getHealth: (services) => apiHealth(services, config.services.stack_name) }
   ]);
@@ -4286,7 +4312,7 @@ async function cmdPromote(target) {
     }
   });
   writeDeployArtifacts(config, promotedState);
-  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version)) && exists2(releaseAssetDir("landing", promotedState.deployment.slots[targetSlot].release_version))) {
+  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version))) {
     activateFrontendReleaseForState(config, promotedState);
   } else {
     logWarn(`Missing staged frontend assets for release ${promotedState.deployment.slots[targetSlot].release_version}; leaving current frontend assets unchanged.`);
@@ -4317,7 +4343,7 @@ async function cmdRollback() {
     }
   });
   writeDeployArtifacts(config, rollbackState);
-  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version)) && exists2(releaseAssetDir("landing", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
+  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
     activateFrontendReleaseForState(config, rollbackState);
   } else {
     logWarn(`Missing staged frontend assets for release ${rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version}; leaving current frontend assets unchanged.`);
@@ -4339,7 +4365,7 @@ async function cmdHealth(asJson) {
   const hosts = domainMap2(config.domain.root_domain);
   const services = listStackServices(config);
   const stackName = config.services.stack_name;
-  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
+  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
   const webRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "web", "current", "runtime-config.js"));
   const landingRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "landing", "current", "runtime-config.js"));
   const clickstackSearchState = getClickstackSearchState(config);
@@ -4413,7 +4439,7 @@ async function cmdHealth(asJson) {
         }
       },
       web: serviceHealth(services, `${stackName}_web_nginx`),
-      landing: serviceHealth(services, `${stackName}_landing_nginx`)
+      landing: "omitted"
     },
     database: {
       api: databaseHealth
@@ -4531,8 +4557,8 @@ async function cmdUpgradeDeps() {
   await cmdDeploy();
 }
 function sha256File(filePath) {
-  const hash = createHash2("sha256");
-  hash.update(fs4.readFileSync(filePath));
+  const hash = createHash3("sha256");
+  hash.update(fs5.readFileSync(filePath));
   return hash.digest("hex");
 }
 function parseEnterpriseLicenseBundle(raw) {
@@ -4561,7 +4587,7 @@ function parseEnterpriseLicenseBundle(raw) {
   return candidate;
 }
 function readEnterpriseLicenseBundle(bundlePath) {
-  return parseEnterpriseLicenseBundle(JSON.parse(fs4.readFileSync(bundlePath, "utf8")));
+  return parseEnterpriseLicenseBundle(JSON.parse(fs5.readFileSync(bundlePath, "utf8")));
 }
 function normalizeLicenseServerUrl(serverUrl, route) {
   const trimmed = serverUrl.replace(/\/+$/, "");
@@ -4823,19 +4849,19 @@ async function cmdBackup() {
       logWarn("Backup will temporarily stop the EnvSync stack to capture consistent volume data.");
       stopManagedRuntime(config, "Stopping existing EnvSync services for consistent backup");
     }
-    writeFile(path4.join(staged, "deploy.env"), fs4.readFileSync(DEPLOY_ENV, "utf8"));
-    writeFile(path4.join(staged, "deploy.yaml"), fs4.readFileSync(DEPLOY_YAML, "utf8"));
-    writeFile(path4.join(staged, "config.json"), fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
-    writeFile(path4.join(staged, "versions.lock.json"), fs4.readFileSync(VERSIONS_LOCK, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs4.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs4.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.yaml"), fs4.readFileSync(STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
-    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs4.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
-    writeFile(path4.join(staged, "otel-agent.yaml"), fs4.readFileSync(OTEL_AGENT_CONF, "utf8"));
-    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs4.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
+    writeFile(path4.join(staged, "deploy.env"), fs5.readFileSync(DEPLOY_ENV, "utf8"));
+    writeFile(path4.join(staged, "deploy.yaml"), fs5.readFileSync(DEPLOY_YAML, "utf8"));
+    writeFile(path4.join(staged, "config.json"), fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+    writeFile(path4.join(staged, "versions.lock.json"), fs5.readFileSync(VERSIONS_LOCK, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs5.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs5.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.yaml"), fs5.readFileSync(STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
+    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs5.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
+    writeFile(path4.join(staged, "otel-agent.yaml"), fs5.readFileSync(OTEL_AGENT_CONF, "utf8"));
+    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs5.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
     if (!isOssConfig2(config) && exists2(LICENSE_ROOT)) {
-      fs4.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
+      fs5.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
     }
     const volumesDir = path4.join(staged, "volumes");
     for (const volume of STACK_VOLUMES) {
@@ -4902,21 +4928,21 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   }
   ensureDir(restoreRoot);
   run("bash", ["-lc", `tar -xzf ${JSON.stringify(archivePath)} -C ${JSON.stringify(restoreRoot)}`]);
-  writeFile(DEPLOY_ENV, fs4.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
-  writeFile(DEPLOY_YAML, fs4.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
-  writeFile(INTERNAL_CONFIG_JSON, fs4.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
-  writeFile(VERSIONS_LOCK, fs4.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
-  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
-  writeFile(BOOTSTRAP_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
-  writeFile(STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
-  writeFile(TRAEFIK_DYNAMIC_FILE, fs4.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
-  writeFile(KEYCLOAK_REALM_FILE, fs4.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
-  writeFile(OTEL_AGENT_CONF, fs4.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
-  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs4.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
+  writeFile(DEPLOY_ENV, fs5.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
+  writeFile(DEPLOY_YAML, fs5.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
+  writeFile(INTERNAL_CONFIG_JSON, fs5.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
+  writeFile(VERSIONS_LOCK, fs5.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
+  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
+  writeFile(BOOTSTRAP_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
+  writeFile(STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
+  writeFile(TRAEFIK_DYNAMIC_FILE, fs5.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
+  writeFile(KEYCLOAK_REALM_FILE, fs5.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
+  writeFile(OTEL_AGENT_CONF, fs5.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
+  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs5.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
   const restoredLicenseRoot = path4.join(restoreRoot, "license");
   if (exists2(restoredLicenseRoot)) {
-    fs4.rmSync(LICENSE_ROOT, { recursive: true, force: true });
-    fs4.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
+    fs5.rmSync(LICENSE_ROOT, { recursive: true, force: true });
+    fs5.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
     ensureEnterpriseLicenseFilesReadable();
   }
   const config = loadConfig();
@@ -5338,8 +5364,6 @@ var init_cli = __esm({
     MANAGED_VERSIONED_IMAGE_PREFIXES = {
       api: "ghcr.io/envsync-cloud/envsync-api:",
       api_enterprise: "ghcr.io/envsync-cloud/envsync-api-enterprise:",
-      // Retired second process — kept so old deploy.yaml image strings still parse as "managed".
-      management_api: "ghcr.io/envsync-cloud/envsync-management-api:",
       keycloak: "envsync-keycloak:",
       web: "ghcr.io/envsync-cloud/envsync-web-static:",
       web_oss: "ghcr.io/envsync-cloud/envsync-web-oss-static:",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy",
-  "version": "0.20.12",
+  "version": "0.21.2",
   "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@envsync-cloud/deploy-core": "0.20.12",
+    "@envsync-cloud/deploy-core": "0.21.2",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2"
   },