@wtfalch/foundry 0.45.0 → 0.46.0

package/dist/plan/platform-providers.js

@@ -11,21 +11,24 @@ import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { previewsOn } from './coolify-previews.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
+import { desktopCallbackUri, unionRedirectUris } from './desktop-callback.js';
 import { placedOnPlatform } from './destinations.js';
 import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { LIMITS, limited } from './own-limits.js';
+import { postLogoutAppliedValue, postLogoutUrisFor } from './post-logout-uris.js';
 import { createReleaseHost } from './release-host.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+import { SIGN_IN_BIND_KEY_ENV, SIGN_IN_BIND_KEY_MIN_LENGTH, SIGN_IN_BIND_KEY_SCOPE_KEY, } from './cookie-domain.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
 import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAIL_DATABASE_SCOPE_KEY, MAIL_STORE_POSTGRES, MAIL_STORE_SCOPE_KEY, mailStoreIsLegacy, } from './mail-store.js';
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
 import { LOGIN_HOST_BINDINGS_ENV } from './sign-in-bindings.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
@@ -497,12 +500,32 @@ export class FoundryPlatformStepExecutor {
                     : undefined;
                 if (zitadel?.updateOidcAppIdTokenUserinfoAssertion)
                     blocked.archonIdTokenUserinfo = true;
+                if (zitadel?.updateOidcAppPostLogoutRedirectUris)
+                    blocked.archonPostLogoutUris = true;
+                if (zitadel?.getOidcAppRedirectUris && zitadel.updateOidcAppRedirectUris) {
+                    blocked.archonDesktopCallback = true;
+                }
             }
             catch (e) {
                 // No ZITADEL client for this instance: the flag stays unset and the repair is not planned.
                 console.error(`platform:archon: could not reach the platform's ZITADEL client to plan the ID token repair: ${e instanceof Error ? e.message : String(e)}`);
             }
         }
+        // Not a block: without a client that can make a project role and grant it, the mail role step is not planned.
+        if (this.mail && platform.mail.enabled) {
+            try {
+                const mailZitadel = this.mail.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? this.mail.zitadel;
+                if (mailZitadel.ensureProjectRole && mailZitadel.grantProjectRoles) {
+                    blocked.mailRole = true;
+                    if (this.mail.requireMailRole && mailZitadel.setProjectRoleChecks) {
+                        blocked.mailRoleCheck = true;
+                    }
+                }
+            }
+            catch (e) {
+                console.error(`platform:mail: could not reach the platform's ZITADEL client to plan the mail role: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
         // Not a block: without the auth dependencies and a ZITADEL client for the instance the sign-in policy step is not planned.
         if (this.auth && platform.auth.enabled && recordedIds[PLATFORM_ZITADEL_ORG_SCOPE_KEY]) {
             try {
@@ -684,6 +707,8 @@ export class FoundryPlatformStepExecutor {
             if (loginClientDrifted || (await this.signInLoginDrifted(this.auth, recordedIds))) {
                 result.auth = true;
             }
+            if (await authAppsNotRunning(this.auth.coolify, recordedIds))
+                result.authApps = true;
         }
         // #380: once the runner app is recorded, re-check its live env against
         // every setting `ensureStarted()` requires -- the gap that left the
@@ -757,6 +782,9 @@ export class FoundryPlatformStepExecutor {
         const loginId = recordedIds[PLATFORM_AUTH_LOGIN_SCOPE_KEY];
         if (!signInId)
             return true;
+        // The session bind key is not yet live on the in-app login: plan again and mint it.
+        if (recordedIds[SIGN_IN_BIND_KEY_SCOPE_KEY] !== '1')
+            return true;
         if (!loginId)
             return false;
         try {
@@ -779,7 +807,7 @@ export class FoundryPlatformStepExecutor {
                 throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
             }
             const company = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), company, await this.signInLoginWanted());
+            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), { ownerCompany: company, signInLogin: await this.signInLoginWanted() });
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_FILES_KEY) {
             if (!this.files) {
@@ -857,6 +885,30 @@ export class FoundryPlatformStepExecutor {
             }
             return switchOnArchonIdTokenUserinfo(context, this.archon);
         }
+        if (action.system === 'zitadel' &&
+            action.kind === 'post-logout-uris' &&
+            action.key === PLATFORM_ARCHON_KEY) {
+            if (!this.archon) {
+                throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
+            }
+            return updateArchonPostLogoutUris(context, this.archon);
+        }
+        if (action.system === 'zitadel' &&
+            action.kind === 'desktop-callback' &&
+            action.key === PLATFORM_ARCHON_KEY) {
+            if (!this.archon) {
+                throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
+            }
+            return registerArchonDesktopCallback(context, this.archon);
+        }
+        if (action.system === 'zitadel' &&
+            action.kind === 'mail-role' &&
+            action.key === PLATFORM_MAIL_KEY) {
+            if (!this.mail) {
+                throw new Error('platform:mail needs FoundryPlatformStepExecutor to be constructed with its mail dependencies (#169)');
+            }
+            return applyPlatformMailRole(context, this.mail);
+        }
         if (action.system === 'zitadel' &&
             action.kind === 'sign-in-policy' &&
             action.key === PLATFORM_AUTH_KEY) {
@@ -1691,10 +1743,16 @@ export async function provisionAuthStack(scope, deps, target, input) {
     });
     const loginAppId = loginApp.appId;
     await record(PLATFORM_AUTH_LOGIN_SCOPE_KEY, loginAppId);
+    // A declared `gitRef` that differs from the one the apps were last built from reaches all three apps
+    // that build from the auth repo: `git_branch` is patched and each is redeployed below.
+    const authRefChanged = target.kind === 'platform' && recorded[PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+    // An app made in this run was created on `gitRef` already.
+    const gitBranchPatchFor = (app) => authRefChanged && !app.justCreated ? { git_branch: gitRef } : {};
     // The Dockerfile's own HEALTHCHECK is the live check (`IMAGE_HEALTHCHECK_SETTINGS`).
     await deps.coolify.updateApplication(loginAppId, {
         custom_internal_name: target.internal.authLogin,
         ...IMAGE_HEALTHCHECK_SETTINGS,
+        ...gitBranchPatchFor(loginApp),
     });
     // ---- the in-app login app (`/sign-in`) ------------------------------------
     // A Next.js base path is fixed at build, so the login that serves `/sign-in` is a second app built from
@@ -1728,6 +1786,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         await deps.coolify.updateApplication(signInApp.appId, {
             custom_internal_name: signInNames.internal,
             ...IMAGE_HEALTHCHECK_SETTINGS,
+            ...gitBranchPatchFor(signInApp),
         });
     }
     // ---- the broker app (#204) -------------------------------------------------
@@ -1753,6 +1812,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await deps.coolify.updateApplication(brokerAppId, {
         custom_internal_name: target.internal.authBroker,
         ...IMAGE_HEALTHCHECK_SETTINGS,
+        ...gitBranchPatchFor(brokerApp),
     });
     // ---- env -----------------------------------------------------------------
     // Generated once, handed straight to `bulkUpsertEnvs` and nowhere else --
@@ -1871,12 +1931,23 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
     // The in-app login: the login's env, the base path as a build argument, and the host table.
     let signInEnvsChanged = false;
+    // The session bind key is minted once, on the in-app login app only: a key already live (32 characters or
+    // more) is kept, so a rerun after a crash mints nothing. It goes to this app's env and nowhere else.
+    let bindKeyWritten = false;
     if (signInApp && input.signInLogin) {
         const bindings = input.signInLogin.bindings ??
             (await currentEnvValue(deps.coolify, loginAppId, LOGIN_HOST_BINDINGS_ENV));
+        const mintedBindKey = await ensureGeneratedEnv(deps.coolify, signInApp.appId, SIGN_IN_BIND_KEY_ENV, () => randomBytes(32).toString('hex'), SIGN_IN_BIND_KEY_MIN_LENGTH);
+        const bindKey = mintedBindKey ?? (await currentEnvValue(deps.coolify, signInApp.appId, SIGN_IN_BIND_KEY_ENV));
+        if (!bindKey) {
+            throw new Error(`${label}: the in-app login app lost its session bind key between two reads`);
+        }
+        runtime.onSecret?.(bindKey);
+        bindKeyWritten = mintedBindKey !== null;
         const signInEnvs = [
             ...loginEnvs,
             { key: SIGN_IN_BUILD_ARG_ENV, value: SIGN_IN_BASE_PATH, buildTime: true },
+            { key: SIGN_IN_BIND_KEY_ENV, value: bindKey },
             ...(bindings ? [{ key: LOGIN_HOST_BINDINGS_ENV, value: bindings }] : []),
         ];
         signInEnvsChanged = await envsDiffer(deps.coolify, signInApp.appId, signInEnvs);
@@ -1902,11 +1973,22 @@ export async function provisionAuthStack(scope, deps, target, input) {
         await waitHealthy(withCallTimeout(deps.coolify), zitadelAppId, runtime, label, 'ZITADEL');
         await record(SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, '');
     }
-    if (loginApp.justCreated || !loginApp.running || loginEnvsChanged) {
+    if (loginApp.justCreated || !loginApp.running || loginEnvsChanged || authRefChanged) {
         await deps.coolify.deploy(loginAppId);
     }
-    if (signInApp && (signInApp.justCreated || !signInApp.running || signInEnvsChanged)) {
+    // The key counts as live only once the app was deployed after it was written: a crash between the write
+    // and the deploy leaves the marker unset, so the next run deploys.
+    const bindKeyUnconfirmed = Boolean(signInApp && input.signInLogin) && recorded[SIGN_IN_BIND_KEY_SCOPE_KEY] !== '1';
+    if (signInApp &&
+        (signInApp.justCreated ||
+            !signInApp.running ||
+            signInEnvsChanged ||
+            bindKeyWritten ||
+            bindKeyUnconfirmed ||
+            authRefChanged)) {
         await deps.coolify.deploy(signInApp.appId);
+        if (input.signInLogin)
+            await record(SIGN_IN_BIND_KEY_SCOPE_KEY, '1');
     }
     // #211: the broker's own `server.ts` refuses to start without
     // `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` and `LETTERMINT_API_TOKEN` --
@@ -1929,6 +2011,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         (brokerApp.justCreated ||
             !brokerApp.running ||
             brokerEnvsChanged ||
+            authRefChanged ||
             brokerDeployNeeded(brokerMissingInputs, brokerAppId, authAppsRaw, recordedBrokerDeploy))) {
         await deps.coolify.deploy(brokerAppId);
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, authAppsRaw));
@@ -2302,6 +2385,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
     if (signInApp && (await currentEnvValue(deps.coolify, signInApp.appId, SERVICE_USER_TOKEN_ENV))) {
         await record(SIGN_IN_LOGIN_APP_SCOPE_KEY, signInApp.appId);
     }
+    // Last, so a throw above runs the patch and the deploys again. Only the platform's own apps follow it.
+    if (target.kind === 'platform')
+        await record(PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     // ---- the owner company's own sign-in org ----------------------------------
     // Archon signs people in from this org; the `foundry` org holds none. The
     // company executor finds the same org by name (its slug) and makes no second.
@@ -2423,7 +2509,8 @@ const platformAuthProject = {
     },
 };
 /** The platform's sign-in: {@link provisionAuthStack} with {@link platformTarget} and the platform's own inputs. */
-async function provisionPlatformAuth(context, deps, ownerCompany = null, signInLogin = false) {
+async function provisionPlatformAuth(context, deps, options = {}) {
+    const { ownerCompany = null, signInLogin = false } = options;
     const { platform } = context;
     const scope = scopeFromPlatform(context);
     return provisionAuthStack(scope, deps, platformTarget(), {
@@ -2542,6 +2629,74 @@ async function provisionPlatformArchonOrg(context, deps, ownerCompany) {
     }
     return {};
 }
+/**
+ * #394 (decision D2, release one): makes the role {@link PLATFORM_MAIL_USER_ROLE} on the mail
+ * project and grants it to the platform owner (`zitadel:mail-role` keyed {@link PLATFORM_MAIL_KEY}).
+ * Each marker is recorded right after its call, so a failure leaves the earlier ones and the next
+ * plan names the step again. The role check is turned on only when the host asked for it and the
+ * grant was recorded before this run began, never in the run that made the grant. A grant is made
+ * only when the owner is in the mail project's own org (`planMailRole` reports the other case).
+ * The error names ids only, never the cause.
+ */
+async function applyPlatformMailRole(context, deps) {
+    const { platform } = context;
+    const recorded = context.recordedIds();
+    const orgId = recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const projectId = recorded[PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY];
+    const invite = recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    if (!orgId || !projectId || !invite) {
+        throw new Error("platform:mail: the sign-in's ZITADEL org, the mail project or the owner invite is not recorded yet -- cannot make the mail role");
+    }
+    const zitadel = deps.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? deps.zitadel;
+    // The planner plans nothing without the methods; a stale plan does nothing.
+    if (!zitadel.ensureProjectRole || !zitadel.grantProjectRoles)
+        return {};
+    const record = async (key, value) => {
+        context.recordScopeId(key, value);
+        await context.persist?.();
+    };
+    const grantedBefore = recorded[PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY] === `${projectId}|${invite}`;
+    if (recorded[PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY] !== projectId) {
+        try {
+            await zitadel.ensureProjectRole(orgId, projectId, {
+                key: PLATFORM_MAIL_USER_ROLE,
+                displayName: 'Mail user',
+            });
+        }
+        catch {
+            throw new Error(`platform:mail: making the mail role failed on project ${projectId}`);
+        }
+        await record(PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, projectId);
+    }
+    const sameOrg = invite === 'none' || recorded[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY] === orgId;
+    if (!sameOrg)
+        return {};
+    if (!grantedBefore) {
+        if (invite !== 'none') {
+            try {
+                await zitadel.grantProjectRoles(orgId, invite, projectId, [PLATFORM_MAIL_USER_ROLE]);
+            }
+            catch {
+                throw new Error(`platform:mail: granting the mail role to user ${invite} failed on project ${projectId}`);
+            }
+        }
+        await record(PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, `${projectId}|${invite}`);
+        return {};
+    }
+    if (deps.requireMailRole && zitadel.setProjectRoleChecks) {
+        try {
+            await zitadel.setProjectRoleChecks(orgId, projectId, {
+                projectRoleCheck: true,
+                hasProjectCheck: true,
+            });
+        }
+        catch {
+            throw new Error(`platform:mail: turning on the mail role check failed on project ${projectId}`);
+        }
+        await record(PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, projectId);
+    }
+    return {};
+}
 /**
  * Reserves the username `admin` and switches self-registration off in the
  * platform's sign-in org (`zitadel:sign-in-policy` keyed {@link PLATFORM_AUTH_KEY}).
@@ -3829,6 +3984,76 @@ async function switchOnArchonIdTokenUserinfo(context, deps) {
     await context.persist?.();
     return {};
 }
+/**
+ * Replaces the post-logout addresses of Archon's sign-in client
+ * (`zitadel:post-logout-uris` keyed {@link PLATFORM_ARCHON_KEY}). The marker
+ * (app id and set) is recorded only after the call returned, so a call that
+ * throws leaves none and the next plan names the step again. The error names
+ * the ids only, never the cause.
+ */
+async function updateArchonPostLogoutUris(context, deps) {
+    const recorded = context.recordedIds();
+    const ownerSignIn = context.owner?.signIn ?? null;
+    const zitadel = ownerSignIn
+        ? deps.zitadelForInstance?.(ownerSignIn.issuerUrl, ownerSignIn.bearerRef)
+        : undefined;
+    // The planner plans nothing without the method; a stale plan does nothing.
+    if (!ownerSignIn || !zitadel?.updateOidcAppPostLogoutRedirectUris)
+        return {};
+    const orgId = recorded[PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY] ?? ownerSignIn.organisationId;
+    const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
+    const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!orgId || !projectId || !appId) {
+        throw new Error('platform:archon: the sign-in client is not recorded yet -- cannot update its post-logout addresses');
+    }
+    const uris = postLogoutUrisFor([context.platform.archon.hostname]);
+    try {
+        await zitadel.updateOidcAppPostLogoutRedirectUris(orgId, projectId, appId, uris);
+    }
+    catch {
+        throw new Error(`platform:archon: updating the post-logout addresses failed for the sign-in client ${appId}`);
+    }
+    context.recordScopeId(PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, postLogoutAppliedValue(appId, uris));
+    await context.persist?.();
+    return {};
+}
+/**
+ * #339: registers `/auth/desktop/callback` on Archon's sign-in client
+ * (`zitadel:desktop-callback` keyed {@link PLATFORM_ARCHON_KEY}), keeping the
+ * redirect URIs it holds. The marker is the client's app id, recorded only
+ * after the read and the write resolved. The error names the ids only.
+ */
+async function registerArchonDesktopCallback(context, deps) {
+    const recorded = context.recordedIds();
+    const ownerSignIn = context.owner?.signIn ?? null;
+    const zitadel = ownerSignIn
+        ? deps.zitadelForInstance?.(ownerSignIn.issuerUrl, ownerSignIn.bearerRef)
+        : undefined;
+    // The planner plans nothing without the methods; a stale plan does nothing.
+    if (!ownerSignIn || !zitadel?.getOidcAppRedirectUris || !zitadel.updateOidcAppRedirectUris) {
+        return {};
+    }
+    const orgId = ownerSignIn.organisationId;
+    const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
+    const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    const hostname = recorded[PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY];
+    if (!orgId || !projectId || !appId || !hostname) {
+        throw new Error('platform:archon: the sign-in client is not recorded yet -- cannot register its desktop callback');
+    }
+    try {
+        const current = await zitadel.getOidcAppRedirectUris(orgId, projectId, appId);
+        const union = unionRedirectUris(current, [desktopCallbackUri(hostname)]);
+        if (union.length > current.length) {
+            await zitadel.updateOidcAppRedirectUris(orgId, projectId, appId, union);
+        }
+    }
+    catch {
+        throw new Error(`platform:archon: registering the desktop callback failed for the sign-in client ${appId}`);
+    }
+    context.recordScopeId(PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, appId);
+    await context.persist?.();
+    return {};
+}
 /**
  * #175: makes `coolify:app` keyed {@link PLATFORM_ARCHON_KEY} true: Archon
  * from https://github.com/wtfalch/archon on `platform.archon.gitRef`, its own
@@ -4130,12 +4355,15 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
             appType: 'web',
             // `@wtfalch/auth`'s default callback path (Archon's own
             // `docs/operator-deployment.md`, step 4).
-            redirectUris: [`https://${hostname}/auth/callback`],
-            postLogoutRedirectUris: [`https://${hostname}/`],
+            redirectUris: [`https://${hostname}/auth/callback`, desktopCallbackUri(hostname)],
+            postLogoutRedirectUris: postLogoutUrisFor([hostname]),
         });
         context.recordScopeId(PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, created.appId);
+        context.recordScopeId(PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, postLogoutAppliedValue(created.appId, postLogoutUrisFor([hostname])));
         // Made with the setting on (providers 0.9.0): nothing to repair on this id.
         context.recordScopeId(PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, created.appId);
+        // Made with the desktop callback (#339): nothing to repair on this id either.
+        context.recordScopeId(PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, created.appId);
         context.recordScopeId(PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY, hostname);
         context.recordScopeId(PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY, org.id);
         await record(PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY, created.clientId);
@@ -4654,14 +4882,27 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (!archonDeployedNow || !selfRedeploy) {
         if (inAppWanted) {
             await archonInAppPoint({ ...inAppTarget, zitadel: inAppCalls() });
+            // A changed Archon host: the old address's binding and trusted domain go once the client points at the new one.
+            const previousHost = archonInAppHost(context.recordedIds());
+            if (previousHost !== '' && previousHost !== hostname && ownerSignIn.signInLoginAppId) {
+                await archonInAppUnbind({
+                    ...inAppTarget,
+                    host: previousHost,
+                    zitadel: inAppCalls(),
+                    loginAppId: ownerSignIn.signInLoginAppId,
+                });
+            }
             await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, `${hostname}=${clientId}`);
         }
         else if (inAppOwed) {
+            if (!ownerSignIn.signInLoginAppId) {
+                throw new Error("platform:archon: Archon's sign-in address cannot be given up without the owner company's in-app login app");
+            }
             await archonInAppUnbind({
                 ...inAppTarget,
                 host: archonInAppHost(context.recordedIds()),
                 zitadel: inAppCalls(),
-                ...(ownerSignIn.signInLoginAppId ? { loginAppId: ownerSignIn.signInLoginAppId } : {}),
+                loginAppId: ownerSignIn.signInLoginAppId,
             });
             await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, '');
         }
@@ -5454,6 +5695,32 @@ async function archonDeploymentState(coolify, deploymentUuid) {
         return isNotFoundError(error) ? 'failed' : 'unreadable';
     }
 }
+/**
+ * #643: whether a recorded sign-in app (ZITADEL, login or broker) is gone from Coolify or not running.
+ * The same status test the step's own deploy decision uses. A read that fails for any other reason
+ * counts as running, with one fixed log line (the error can carry values).
+ */
+async function authAppsNotRunning(coolify, recordedIds) {
+    for (const scopeKey of [
+        PLATFORM_AUTH_ZITADEL_SCOPE_KEY,
+        PLATFORM_AUTH_LOGIN_SCOPE_KEY,
+        PLATFORM_AUTH_BROKER_SCOPE_KEY,
+    ]) {
+        const appId = recordedIds[scopeKey];
+        if (!appId)
+            continue;
+        try {
+            if (!isRunningOrStarting((await coolify.getApplication(appId)).status))
+                return true;
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return true;
+            console.error('platform:auth: could not read a sign-in app status; treating it as running');
+        }
+    }
+    return false;
+}
 async function archonRollingUpdateDrifted(coolify, appId) {
     if (!appId)
         return false;
@@ -6638,7 +6905,10 @@ async function findOrCreateSignInLoginApp(coolify, input) {
         if (app.environment_id !== environment.id) {
             throw new Error(`${label}: an application named ${name} exists outside the ${environment.name} environment of the sign-in project; foundry does not adopt it`);
         }
-        if (app.git_repository !== undefined && !app.git_repository.endsWith(AUTH_REPO)) {
+        if (app.git_repository === undefined) {
+            throw new Error(`${label}: the application ${name} has no git repository, so foundry cannot tell it is built from ${AUTH_REPO} and does not adopt it`);
+        }
+        if (!app.git_repository.endsWith(AUTH_REPO)) {
             throw new Error(`${label}: the application ${name} is built from ${app.git_repository}, not ${AUTH_REPO}; foundry does not adopt it`);
         }
     }

package/dist/plan/post-logout-uris.d.ts

@@ -0,0 +1,22 @@
+import type { DeclaredOrg } from '../org.js';
+/** The page `@wtfalch/auth` apps land on after ZITADEL ends the session. */
+export declare const SIGNED_OUT_PATH = "/auth/signed-out";
+/** Both landing addresses of a host: its root and its signed-out page. */
+export declare function postLogoutUrisFor(hosts: readonly string[]): string[];
+/**
+ * The marker value for an app: its ZITADEL id and the set it holds, in a fixed
+ * order. A changed set or a re-created app gives a different value, so the
+ * next plan names the app again.
+ */
+export declare function postLogoutAppliedValue(appId: string, uris: readonly string[]): string;
+/** True while the recorded marker is not the one the app holds with `uris`. */
+export declare function postLogoutUpdateOwed(recordedMarker: string | undefined, appId: string, uris: readonly string[]): boolean;
+/** The scope id holding company app `appKey`'s applied post-logout marker. */
+export declare function zitadelAppPostLogoutAppliedScopeKey(appKey: string): string;
+/**
+ * The post-logout addresses company app `appKey` is created with and kept at.
+ * Agora signs out locally and has no signed-out page, so it holds only its
+ * root; every `@wtfalch/auth` app (cms, boule, the app, entries with
+ * `uses.auth`) holds both on each of its hosts.
+ */
+export declare function companyAppPostLogoutUris(org: DeclaredOrg, appKey: string): string[];

package/dist/plan/post-logout-uris.js

@@ -0,0 +1,43 @@
+import { agoraHostnameFor } from './agora.js';
+import { bouleHostnameFor } from './boule.js';
+import { appHostname, cmsStudioHostnameFor, entryHostnames } from './hostnames.js';
+/** The page `@wtfalch/auth` apps land on after ZITADEL ends the session. */
+export const SIGNED_OUT_PATH = '/auth/signed-out';
+/** Both landing addresses of a host: its root and its signed-out page. */
+export function postLogoutUrisFor(hosts) {
+    return hosts.flatMap((host) => [`https://${host}/`, `https://${host}${SIGNED_OUT_PATH}`]);
+}
+/**
+ * The marker value for an app: its ZITADEL id and the set it holds, in a fixed
+ * order. A changed set or a re-created app gives a different value, so the
+ * next plan names the app again.
+ */
+export function postLogoutAppliedValue(appId, uris) {
+    return `${appId} ${[...uris].sort().join(' ')}`;
+}
+/** True while the recorded marker is not the one the app holds with `uris`. */
+export function postLogoutUpdateOwed(recordedMarker, appId, uris) {
+    return recordedMarker !== postLogoutAppliedValue(appId, uris);
+}
+/** The scope id holding company app `appKey`'s applied post-logout marker. */
+export function zitadelAppPostLogoutAppliedScopeKey(appKey) {
+    return `zitadel_app_post_logout_applied.${appKey}`;
+}
+/**
+ * The post-logout addresses company app `appKey` is created with and kept at.
+ * Agora signs out locally and has no signed-out page, so it holds only its
+ * root; every `@wtfalch/auth` app (cms, boule, the app, entries with
+ * `uses.auth`) holds both on each of its hosts.
+ */
+export function companyAppPostLogoutUris(org, appKey) {
+    const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
+    const hosts = authEntry ? entryHostnames(org, authEntry) : null;
+    if (appKey === 'agora')
+        return [`https://${agoraHostnameFor(org)}/`];
+    const hostname = appKey === 'cms' && org.site.enabled
+        ? cmsStudioHostnameFor(org)
+        : appKey === 'boule'
+            ? bouleHostnameFor(org)
+            : appHostname(org);
+    return postLogoutUrisFor(hosts ?? [hostname]);
+}

package/dist/plan/providers-readers.d.ts

@@ -3,7 +3,7 @@ import type { CoolifyClient } from '@wtfalch/providers/coolify';
 import { type ZitadelClient } from '@wtfalch/providers/zitadel';
 import { type OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
-import type { AiReader, CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
+import { type AiReader, type CloudflareReader, type CmsReader, type CoolifyReader, type LiveResource, type ZitadelReader } from './live.js';
 /** The `CoolifyClient` methods the readers call, so a host's own implementation needs no cast. */
 type CoolifyReaderClient = Pick<CoolifyClient, 'listResources' | 'getApplication' | 'getDatabase' | 'listEnvs' | 'listStorages'>;
 /**
@@ -152,6 +152,15 @@ export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly resolveLoginHost;
     constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds, resolveLoginHost?: ScopeResolver);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
+    /**
+     * #557: a recorded app the listing does not return, proven gone by a direct
+     * read by app id in every project the listing shows. One `app-gone`
+     * resource per proven app, keyed by the app's name: `diff.ts` offers the
+     * replacement only for it. Nothing is proven when the client has no
+     * `getApp` (providers before 0.12.0), when the read throws, or when it
+     * finds the app, so the plan blocks instead.
+     */
+    private goneApps;
     /**
      * #510: `client.listResources` reports only what is *inside* a ZITADEL org
      * (its projects and grants), never the org record itself, so nothing ever

package/dist/plan/providers-readers.js

@@ -2,6 +2,7 @@ import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { APP_ENTRY_KEY } from '../org.js';
 import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 import { previewsOn } from './coolify-previews.js';
+import { APP_GONE_KIND, } from './live.js';
 import { SIGN_IN_UPSTREAM_ENV } from './sign-in.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
@@ -416,7 +417,46 @@ export class ProvidersZitadelReader {
             this.liveIssuer(orgId, zitadelOrgId),
         ]);
         const mapped = applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
-        return issuer ? [...mapped, issuer] : mapped;
+        const gone = await this.goneApps(zitadelOrgId, resources, recorded);
+        return issuer ? [...mapped, ...gone, issuer] : [...mapped, ...gone];
+    }
+    /**
+     * #557: a recorded app the listing does not return, proven gone by a direct
+     * read by app id in every project the listing shows. One `app-gone`
+     * resource per proven app, keyed by the app's name: `diff.ts` offers the
+     * replacement only for it. Nothing is proven when the client has no
+     * `getApp` (providers before 0.12.0), when the read throws, or when it
+     * finds the app, so the plan blocks instead.
+     */
+    async goneApps(zitadelOrgId, listed, recorded) {
+        // A host may pass a client older than providers 0.12.0, which has no `getApp`.
+        const getApp = typeof this.client.getApp === 'function' ? this.client.getApp.bind(this.client) : undefined;
+        const listedIds = new Set(listed.filter((r) => r.kind === 'app').map((r) => r.key));
+        const projectIds = listed.filter((r) => r.kind === 'project').map((r) => r.key);
+        if (!getApp || projectIds.length === 0)
+            return [];
+        const gone = [];
+        for (const [appId, resourceKey] of Object.entries(recorded)) {
+            if (!resourceKey.startsWith('app:') || listedIds.has(appId))
+                continue;
+            try {
+                const found = await Promise.all(projectIds.map((projectId) => getApp(zitadelOrgId, projectId, appId)));
+                if (found.every((app) => app === null || app.state === 'APP_STATE_REMOVED')) {
+                    gone.push({
+                        system: 'zitadel',
+                        kind: APP_GONE_KIND,
+                        key: resourceKey.slice('app:'.length),
+                        config: {},
+                    });
+                }
+            }
+            catch (error) {
+                // Unproven, not gone: the plan blocks this app. Only the error's name is kept.
+                if (!(error instanceof ZitadelError))
+                    throw error;
+            }
+        }
+        return gone;
     }
     /**
      * #510: `client.listResources` reports only what is *inside* a ZITADEL org

package/dist/plan/sign-in-bindings.d.ts

@@ -13,4 +13,8 @@ export declare function editSignInBindings(coolify: Pick<CoolifyPort, 'listEnvs'
     instanceHost: string;
     upsert?: readonly LoginHostBinding[];
     remove?: readonly string[];
+    clientOrganizations?: {
+        upsert?: Readonly<Record<string, string>>;
+        remove?: readonly string[];
+    };
 }): Promise<void>;