@wtfalch/foundry 0.65.0 → 0.66.0

package/dist/plan/executor.d.ts

@@ -844,6 +844,11 @@ export interface ZitadelPort {
         postLogoutRedirectUris: string[];
         /** `jwt` for an entry with `uses.auth.mcp` (providers 0.11.0). Omitted: opaque. */
         accessTokenType?: 'jwt' | 'opaque';
+        /**
+         * The instance's login host. With `loginV2.required` off an app with no base URI of its own lands on
+         * the v1 login, so every app foundry makes carries one from the start; a `required` instance ignores it.
+         */
+        loginBaseUri?: string;
     }): Promise<{
         appId: string;
         clientId: string;
@@ -1183,12 +1188,24 @@ export interface ZitadelPort {
     updateOidcAppLoginBaseUri(orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;
     /**
      * Lets each app's own Login V2 base URI count: foundry starts ZITADEL with `LOGINV2_REQUIRED=true`,
-     * which makes the instance ignore it. The host sets the instance feature (`PUT /v2/features/instance`
+     * which makes the instance ignore it (`internal/query/oidc_client.go` in ZITADEL v4.17.3, lines 88-92:
+     * with `required` the app's own base URI is overwritten by the instance's). Call it through
+     * {@link allowPerAppLoginBaseUris}, which first gives every app a base URI. The host sets the instance feature (`PUT /v2/features/instance`
      * with `loginV2.required` false and the instance default as `baseUri`). Called before an app is
      * pointed at its own `/sign-in/` on a company that runs its own ZITADEL; the shared instance's
      * bindings port does the same for the platform's. Optional: absent, nothing is called.
      */
     allowPerAppLoginBaseUri?(instanceBaseUri: string): Promise<void>;
+    /** Every organisation of the instance. Optional: {@link allowPerAppLoginBaseUris} refuses without it. */
+    listOrgs?(): Promise<Array<{
+        id: string;
+        state?: string;
+    }>>;
+    /** Every project of an organisation. Optional: {@link allowPerAppLoginBaseUris} refuses without it. */
+    listProjects?(orgId: string): Promise<Array<{
+        id: string;
+        state?: string;
+    }>>;
     /**
      * Occupies `userName` in `orgId` with a machine user that has no role and
      * no token, so nobody can register under that name. Idempotent: a user
@@ -2377,6 +2394,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *    the snapshot taken before the repoint still named it.
      */
     private zitadelLoginHost;
+    /**
+     * `{ loginBaseUri }` for an app made in the org's ZITADEL: the instance's own login host (a company's own
+     * `auth.` host, else the shared one). Nothing when the shared host is not known. See
+     * {@link FoundryStepExecutorPorts}' `createOidcApp` `loginBaseUri`.
+     */
+    private instanceLoginBaseUriFor;
     /**
      * The host table of a company's own in-app login app as a bindings port that collects its edits and
      * writes them once on `flush` (one redeploy, none when nothing changed). Used for a company that runs
@@ -2776,12 +2799,14 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private mintIfAbsent;
     /**
-     * Every company's Boule, F3/#970: `NATIVE_BUILD_KEY` is what Boule presents to Archon's
-     * native-build route (estate#262) to ask it to dispatch `build-app.yml`. Minted once, like
-     * {@link ensureAuthAppKey}, and never rotated; a present-but-empty value (the bug
-     * `mintNativeBuildKey`'s own read-then-generate had, see #957) is treated as not set.
+     * foundry#987: nothing reads `NATIVE_BUILD_KEY` any more -- Boule calls Archon's org build
+     * route (`/api/orgs/{orgId}/native/builds`) with its own org credential instead
+     * (`BOULE_ARCHON_CREDENTIAL_ENV`, archon#706, boule#432). This takes the env row away from
+     * every Boule that still has one from #970/#971; `NATIVE_BUILD_KEY_ENV` and
+     * `NATIVE_BUILD_KEY_BYTES` are deprecated and go in the next release (the two-release removal
+     * rule), once no live Boule holds the row any more.
      */
-    private ensureNativeBuildKey;
+    private dropNativeBuildKeyEnv;
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
      * only the first time (task brief), never regenerated or overwritten, so a
@@ -4103,4 +4128,16 @@ export declare function isNoChangesError(error: unknown): boolean;
  * {@link ZitadelPort.updateOidcAppLoginBaseUri} that counts an app already holding the wanted base URI as
  * done: ZITADEL answers that write with "No changes" and a repeat apply must not fail on it.
  */
+/**
+ * Turns the instance feature `loginV2.required` off so each app's own base URI counts, and makes sure no
+ * app can then land on ZITADEL's v1 login: with `required` off an app without a base URI of its own
+ * (ZITADEL's own console app, an app foundry did not make, an app made later) falls back to v1, and
+ * ZITADEL v4.17.3 gives a `required` instance's base URI to every app but ignores an app's own
+ * (`internal/query/oidc_client.go:88-92`), so the only way is a base URI on every app. Every live OIDC
+ * app of every organisation and project gets `instanceBaseUri` when it has none; an app that has one
+ * keeps it. The apps are set first, while `required` still makes the instance ignore them, so no sign-in
+ * passes through a gap. Without a way to list every app, or with a listing that may be cut short, it
+ * throws before the feature is touched.
+ */
+export declare function allowPerAppLoginBaseUris(zitadel: Pick<ZitadelPort, 'allowPerAppLoginBaseUri' | 'listOrgs' | 'listProjects' | 'listApps' | 'updateOidcAppLoginBaseUri'>, instanceBaseUri: string): Promise<void>;
 export declare function setOidcAppLoginBaseUri(zitadel: Pick<ZitadelPort, 'updateOidcAppLoginBaseUri'>, orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;

package/dist/plan/executor.js

@@ -5,7 +5,7 @@ import { EdgeApiError } from '@wtfalch/edge';
 import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { NATIVE_BUILD_KEY_BYTES, NATIVE_BUILD_KEY_ENV } from '../native-build.js';
+import { NATIVE_BUILD_KEY_ENV } from '../native-build.js';
 import { AI_ENTRY_PERMISSIONS, APPS_DOMAIN, APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, FULL_COMMIT_SHA, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, filesCollectionEnvName, heldEnvRef, isLiveEntry, isMainEntry, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
@@ -52,7 +52,7 @@ import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
 import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, workspaceHost, } from './hostnames.js';
 import { KEYS_REGISTRAR_DELIVERY_ATTEMPTS, KEYS_REGISTRAR_KEY_DAYS, KEYS_REGISTRAR_KEY_ENV, KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY, KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, KEYS_REGISTRAR_URL_ENV, } from './keys-registrar.js';
 import { KOSMOS_CLIENT_ID_SCOPE_KEY, KOSMOS_DATABASE_SCOPE_KEY, KOSMOS_DEPLOYED_SCOPE_KEY, desiredKosmosEnv, kosmosEnvDrift, kosmosHostnameFor, } from './kosmos.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION, LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { machineBypassScopeKey } from './machine-paths.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
@@ -1755,6 +1755,7 @@ export class FoundryStepExecutor {
                 : {}),
             zones: this.zonePort(),
             dns: this.dnsPort(),
+            secret: (value) => void this.handledSecrets.add(value),
             ...(this.ports.heldKeys ? { heldKeys: this.ports.heldKeys } : {}),
         };
     }
@@ -2354,6 +2355,7 @@ export class FoundryStepExecutor {
             ? loginHostClientIds(org, recorded, activePairs.map((pair) => pair.clientId).filter((id) => !movedIds.has(id)))
             : clientIds;
         const cookieDomain = inAppCookieDomain(action.desired.cookieDomain);
+        let swept = false;
         const writeCompanyBinding = async (ids) => {
             if (ids.length > 0 || activePairs.length === 0) {
                 await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds: ids });
@@ -2428,8 +2430,10 @@ export class FoundryStepExecutor {
             await writeClientOrgs();
             // One write for every upsert above (one redeploy of the login), before any app is repointed.
             await bindings.flush?.();
-            if (own && activeHosts.size > 0) {
-                await this.ports.zitadel.allowPerAppLoginBaseUri?.(`https://${host}/`);
+            // In-app sign-in recorded or wanted: `required` is off, so every app needs a base URI (marker below).
+            if (own && (activeHosts.size > 0 || recorded[SIGN_IN_IN_APP_SCOPE_KEY])) {
+                await allowPerAppLoginBaseUris(this.ports.zitadel, `https://${host}/`);
+                swept = Boolean(this.ports.zitadel.allowPerAppLoginBaseUri);
             }
         }
         // The base URI each app's sign-in starts from: its own address under `/sign-in/` in-app, else the login host.
@@ -2643,10 +2647,23 @@ export class FoundryStepExecutor {
         if (own) {
             // Written last: a failed base URI write leaves it behind and the step is planned again.
             context.recordScopeId(OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, ownCustomersSet.sort().join(','));
+            if (swept)
+                context.recordScopeId(LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION);
         }
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
+    /**
+     * `{ loginBaseUri }` for an app made in the org's ZITADEL: the instance's own login host (a company's own
+     * `auth.` host, else the shared one). Nothing when the shared host is not known. See
+     * {@link FoundryStepExecutorPorts}' `createOidcApp` `loginBaseUri`.
+     */
+    async instanceLoginBaseUriFor(org) {
+        if (ownsServices(org))
+            return { loginBaseUri: `https://${ownHostnames(org).auth}/` };
+        const shared = await this.ports.platformOrg?.authHostname?.();
+        return shared ? { loginBaseUri: `https://${shared}/` } : {};
+    }
     /**
      * The host table of a company's own in-app login app as a bindings port that collects its edits and
      * writes them once on `flush` (one redeploy, none when nothing changed). Used for a company that runs
@@ -2931,6 +2948,7 @@ export class FoundryStepExecutor {
                 : [...signInUris, ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : [])],
             postLogoutRedirectUris: postLogoutUris,
             ...(authEntry?.uses?.auth?.mcp ? { accessTokenType: 'jwt' } : {}),
+            ...(await this.instanceLoginBaseUriFor(org)),
         });
         if (appType === 'web') {
             // `coolifyApp`'s own `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` to
@@ -3869,6 +3887,7 @@ export class FoundryStepExecutor {
                         appType: 'web',
                         redirectUris: spec.redirectUris,
                         postLogoutRedirectUris: spec.postLogoutRedirectUris,
+                        ...(await this.instanceLoginBaseUriFor(org)),
                     });
                 },
             };
@@ -3921,6 +3940,7 @@ export class FoundryStepExecutor {
                     appType: 'web',
                     redirectUris: spec.redirectUris,
                     postLogoutRedirectUris: spec.postLogoutRedirectUris,
+                    ...(await this.instanceLoginBaseUriFor(org)),
                 });
             },
             writeBrokerEntry: async (entryWant, appKey) => {
@@ -5203,13 +5223,28 @@ export class FoundryStepExecutor {
         return already ? null : randomBytes(bytes).toString('base64url');
     }
     /**
-     * Every company's Boule, F3/#970: `NATIVE_BUILD_KEY` is what Boule presents to Archon's
-     * native-build route (estate#262) to ask it to dispatch `build-app.yml`. Minted once, like
-     * {@link ensureAuthAppKey}, and never rotated; a present-but-empty value (the bug
-     * `mintNativeBuildKey`'s own read-then-generate had, see #957) is treated as not set.
+     * foundry#987: nothing reads `NATIVE_BUILD_KEY` any more -- Boule calls Archon's org build
+     * route (`/api/orgs/{orgId}/native/builds`) with its own org credential instead
+     * (`BOULE_ARCHON_CREDENTIAL_ENV`, archon#706, boule#432). This takes the env row away from
+     * every Boule that still has one from #970/#971; `NATIVE_BUILD_KEY_ENV` and
+     * `NATIVE_BUILD_KEY_BYTES` are deprecated and go in the next release (the two-release removal
+     * rule), once no live Boule holds the row any more.
      */
-    async ensureNativeBuildKey(appId) {
-        return this.mintIfAbsent(appId, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, 1);
+    async dropNativeBuildKeyEnv(appId, liveRows) {
+        let changed = false;
+        for (const row of liveRows) {
+            if (row.key !== NATIVE_BUILD_KEY_ENV || !row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+                changed = true;
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        return changed;
     }
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
@@ -7703,12 +7738,10 @@ export class FoundryStepExecutor {
             this.handledSecrets.add(ownerSeedSecret);
             envs.push({ key: BOULE_OWNER_SEED_SECRET_ENV, value: ownerSeedSecret });
         }
-        // The key Boule presents to Archon's native-build route, for every org's Boule (foundry#970).
-        const nativeBuildKey = await this.ensureNativeBuildKey(app.appId);
-        if (nativeBuildKey) {
-            this.handledSecrets.add(nativeBuildKey);
-            envs.push({ key: NATIVE_BUILD_KEY_ENV, value: nativeBuildKey });
-        }
+        // foundry#987: Boule calls Archon's org build route with its own org credential now, so
+        // nothing reads this any more -- take the row away from every Boule that still has one.
+        if (await this.dropNativeBuildKeyEnv(app.appId, liveRows))
+            envChanged = true;
         // Held, minted once (C3). Compared with the live value so a changed one restarts the app.
         const credentialEnvs = [];
         let archonPushedAt = null;
@@ -7769,7 +7802,6 @@ export class FoundryStepExecutor {
                 peerPassword,
                 bridgeSecret,
                 ownerSeedSecret,
-                nativeBuildKey,
                 ...credentialEnvs.map((credential) => credential.value),
                 ...grants.secrets,
             ].filter((v) => v !== null);
@@ -7809,7 +7841,6 @@ export class FoundryStepExecutor {
                 peerPassword !== null ||
                 bridgeSecret !== null ||
                 ownerSeedSecret !== null ||
-                nativeBuildKey !== null ||
                 secretsNotRestarted ||
                 registrarUnstarted ||
                 dbPush.changed ||
@@ -11448,6 +11479,46 @@ export function isNoChangesError(error) {
  * {@link ZitadelPort.updateOidcAppLoginBaseUri} that counts an app already holding the wanted base URI as
  * done: ZITADEL answers that write with "No changes" and a repeat apply must not fail on it.
  */
+/**
+ * Turns the instance feature `loginV2.required` off so each app's own base URI counts, and makes sure no
+ * app can then land on ZITADEL's v1 login: with `required` off an app without a base URI of its own
+ * (ZITADEL's own console app, an app foundry did not make, an app made later) falls back to v1, and
+ * ZITADEL v4.17.3 gives a `required` instance's base URI to every app but ignores an app's own
+ * (`internal/query/oidc_client.go:88-92`), so the only way is a base URI on every app. Every live OIDC
+ * app of every organisation and project gets `instanceBaseUri` when it has none; an app that has one
+ * keeps it. The apps are set first, while `required` still makes the instance ignore them, so no sign-in
+ * passes through a gap. Without a way to list every app, or with a listing that may be cut short, it
+ * throws before the feature is touched.
+ */
+export async function allowPerAppLoginBaseUris(zitadel, instanceBaseUri) {
+    if (!zitadel.allowPerAppLoginBaseUri)
+        return;
+    const { listOrgs, listProjects } = zitadel;
+    if (!listOrgs || !listProjects) {
+        throw new Error('the ZITADEL port cannot list every organisation and project, so apps without a login base URI would fall back to the v1 login');
+    }
+    for (const org of await listOrgs()) {
+        if (org.state && org.state !== 'ORG_STATE_ACTIVE')
+            continue;
+        for (const project of await listProjects(org.id)) {
+            if (project.state && project.state !== 'PROJECT_STATE_ACTIVE')
+                continue;
+            const listed = await zitadel.listApps(org.id, project.id);
+            if (!listed.complete) {
+                throw new Error(`the app listing of project ${project.id} may be cut short, so apps without a login base URI could be missed`);
+            }
+            for (const app of listed.apps) {
+                if (app.state === 'APP_STATE_REMOVED' || app.appType === 'api')
+                    continue;
+                // `undefined` is "not read": set it, the write is the same either way.
+                if (typeof app.loginBaseUri === 'string' && app.loginBaseUri !== '')
+                    continue;
+                await setOidcAppLoginBaseUri(zitadel, org.id, project.id, app.id, instanceBaseUri);
+            }
+        }
+    }
+    await zitadel.allowPerAppLoginBaseUri(instanceBaseUri);
+}
 export async function setOidcAppLoginBaseUri(zitadel, orgId, projectId, appId, loginBaseUri) {
     try {
         await zitadel.updateOidcAppLoginBaseUri(orgId, projectId, appId, loginBaseUri);

package/dist/plan/login-host.d.ts

@@ -190,6 +190,14 @@ export declare function customersClientOrganizations(org: DeclaredOrg, recorded:
  * falls back to the v1 login once in-app sign-in turns `loginV2.required` off. Absent or empty means none.
  */
 export declare const OWN_CUSTOMERS_BASE_URI_SCOPE_KEY = "own_customers_login_base_uri";
+/**
+ * Scope id recording that the instance's apps were all given a Login V2 base URI ({@link LOGIN_BASE_URI_SWEEP_VERSION}),
+ * on a company's own instance and on the platform's (Archon's step). A value that is missing or older plans the step
+ * again while in-app sign-in has `loginV2.required` off, so an instance applied before the sweep gets it too.
+ */
+export declare const LOGIN_BASE_URI_SWEEP_SCOPE_KEY = "login_base_uri_sweep";
+/** The value {@link LOGIN_BASE_URI_SWEEP_SCOPE_KEY} holds once the sweep ran. Raise it to run the sweep again everywhere. */
+export declare const LOGIN_BASE_URI_SWEEP_VERSION = "1";
 /** The recorded ZITADEL app ids of the org's customers entries, sorted and joined by `,` ('' when none). */
 export declare function ownCustomersAppState(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string;
 /** {@link LOGIN_CLIENT_ORGS_SCOPE_KEY}'s value for a map. */

package/dist/plan/login-host.js

@@ -223,6 +223,14 @@ export function customersClientOrganizations(org, recorded) {
  * falls back to the v1 login once in-app sign-in turns `loginV2.required` off. Absent or empty means none.
  */
 export const OWN_CUSTOMERS_BASE_URI_SCOPE_KEY = 'own_customers_login_base_uri';
+/**
+ * Scope id recording that the instance's apps were all given a Login V2 base URI ({@link LOGIN_BASE_URI_SWEEP_VERSION}),
+ * on a company's own instance and on the platform's (Archon's step). A value that is missing or older plans the step
+ * again while in-app sign-in has `loginV2.required` off, so an instance applied before the sweep gets it too.
+ */
+export const LOGIN_BASE_URI_SWEEP_SCOPE_KEY = 'login_base_uri_sweep';
+/** The value {@link LOGIN_BASE_URI_SWEEP_SCOPE_KEY} holds once the sweep ran. Raise it to run the sweep again everywhere. */
+export const LOGIN_BASE_URI_SWEEP_VERSION = '1';
 /** The recorded ZITADEL app ids of the org's customers entries, sorted and joined by `,` ('' when none). */
 export function ownCustomersAppState(org, recorded) {
     return [...customersEntryKeys(org)]

package/dist/plan/plan-apply.d.ts

@@ -585,6 +585,8 @@ export interface FoundryPlanApplyOptions {
     keysRegistrarUrl?: string;
     /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
     workerAppDatabase?: boolean;
+    /** True when that port has `deletableTables`. A `workerApp.database.noDelete` is blocked without it. */
+    workerAppNoDeleteCheck?: boolean;
     /** ADR 0002: the platform's Cloudflare account id. A container image outside its registry is blocked. */
     workerAppRegistryAccountId?: string;
     /**
@@ -746,6 +748,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly workerAppKeysUrl;
     private readonly keysRegistrarUrl;
     private readonly workerAppDatabase;
+    private readonly workerAppNoDeleteCheck;
     private readonly workerAppRegistryAccountId;
     private readonly ownerInviteMail;
     private readonly hostFiles;
@@ -980,6 +983,12 @@ export declare class FoundryPlanApply implements PlanApply {
     private repoKeysReadiness;
     /** Which refs of the platform GitHub App hold no value now. A resolver that throws counts as not held; only refs are kept. */
     private githubAppKeysReadiness;
+    /**
+     * The Worker apps' `heldSecret` secrets that hold a value now, by `<entry key>/<NAME>`, with the version of
+     * the value. A resolver that throws, or a name that fits no ref, counts as not held. The value is hashed and
+     * dropped here; only the version leaves.
+     */
+    private workerAppSecretsReadiness;
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as

package/dist/plan/plan-apply.js

@@ -40,7 +40,7 @@ import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROU
 import { finishStageCopy, runSubjectRelease, } from './release-host.js';
 import { remoteDatabaseFactsFrom, remoteDatabaseKeys } from './remote-database.js';
 import { STAGE_COPY_LOCK_MS, claimStageCopyLock, parseStageCopyLock, stageCopyLockValue, } from './stage-copy-host.js';
-import { liveWorkerApps, workerAppTraceScopeKeys } from './worker-app.js';
+import { heldSecretId, heldSecretVersion, liveWorkerApps, workerAppTraceScopeKeys, } from './worker-app.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
@@ -189,6 +189,7 @@ export class FoundryPlanApply {
     workerAppKeysUrl;
     keysRegistrarUrl;
     workerAppDatabase;
+    workerAppNoDeleteCheck;
     workerAppRegistryAccountId;
     ownerInviteMail;
     hostFiles;
@@ -233,6 +234,7 @@ export class FoundryPlanApply {
         this.workerAppKeysUrl = options.workerAppKeysUrl;
         this.keysRegistrarUrl = options.keysRegistrarUrl;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
+        this.workerAppNoDeleteCheck = options.workerAppNoDeleteCheck ?? false;
         this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
         this.ownerInviteMail = options.ownerInviteMail ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
@@ -1626,6 +1628,7 @@ export class FoundryPlanApply {
             workerAppKeysUrl: this.workerAppKeysUrl,
             keysRegistrarUrl: this.keysRegistrarUrl,
             workerAppDatabase: this.workerAppDatabase,
+            workerAppNoDeleteCheck: this.workerAppNoDeleteCheck,
             workerAppRegistryAccountId: this.workerAppRegistryAccountId,
             ownerInviteMail: this.ownerInviteMail,
             otherSlugs,
@@ -1758,6 +1761,7 @@ export class FoundryPlanApply {
         const base = {
             ...(await this.sharedPlatformReadiness()),
             heldEnv: await this.heldEnvReadiness(org),
+            workerAppSecrets: await this.workerAppSecretsReadiness(org),
             ...(org.hosting.github ? { githubAppKeys: await this.githubAppKeysReadiness() } : {}),
             ...(repoKeysInPlay(org, orgRecordedIds)
                 ? { repoKeys: await this.repoKeysReadiness(org, orgRecordedIds) }
@@ -1805,6 +1809,32 @@ export class FoundryPlanApply {
         }
         return { store: true, missing };
     }
+    /**
+     * The Worker apps' `heldSecret` secrets that hold a value now, by `<entry key>/<NAME>`, with the version of
+     * the value. A resolver that throws, or a name that fits no ref, counts as not held. The value is hashed and
+     * dropped here; only the version leaves.
+     */
+    async workerAppSecretsReadiness(org) {
+        const heldKeys = this.platformDeps?.heldKeys;
+        const held = {};
+        if (!heldKeys)
+            return held;
+        for (const entry of org.hosting.entries) {
+            for (const [name, source] of Object.entries(entry.workerApp?.secrets ?? {})) {
+                if (source.from !== 'heldSecret')
+                    continue;
+                try {
+                    const value = await heldKeys.resolve(heldEnvRef(org.id, entry.key, name));
+                    if (value)
+                        held[heldSecretId(entry.key, name)] = heldSecretVersion(value);
+                }
+                catch {
+                    // Not held: the plan says the secret has no value yet, and the error is dropped.
+                }
+            }
+        }
+        return held;
+    }
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as

package/dist/plan/platform-diff.js

@@ -8,6 +8,7 @@ import { buildDriftNotes } from './build-record.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
+import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION } from './login-host.js';
 import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
@@ -3482,6 +3483,10 @@ function planArchon(platform, recordedIds, executorBlocked, ownerSignIn, ownerFi
         // In-app sign-in: Archon's own address is the sign-in address only once the owner company has the
         // switch on and its in-app login is applied, and goes back to the company's login host when it does not.
         archonInAppHost(recordedIds) === (ownerSignIn.signInInApp ? platform.archon.hostname : '') &&
+        // With in-app sign-in on, `loginV2.required` is off and every app of the instance owes a base URI
+        // until the sweep ran (an instance applied before it plans the step once more).
+        (!ownerSignIn.signInInApp ||
+            recordedIds[LOGIN_BASE_URI_SWEEP_SCOPE_KEY] === LOGIN_BASE_URI_SWEEP_VERSION) &&
         recordedIds[PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY] === archonOrgId &&
         !recordedIds[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY] &&
         Boolean(recordedIds[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY]) &&

package/dist/plan/platform-org.d.ts

@@ -194,6 +194,12 @@ export interface OrgPlatformReadiness {
         unreadable?: readonly string[];
         invalid?: readonly string[];
     };
+    /**
+     * The Worker apps' `heldSecret` secrets that hold a value now: `<entry key>/<NAME>` -> the version of that
+     * value (a hash, `heldSecretVersion`; never the value). A secret with no entry here is unset. Absent reads as
+     * none held.
+     */
+    workerAppSecrets?: Readonly<Record<string, string>>;
     /**
      * The platform GitHub App's held keys (`PLATFORM_GITHUB_APP_REFS`), read only for a company that declares
      * `hosting.github`. `store` is false when the host wired no held-keys reader; `missing` are the refs that hold

package/dist/plan/platform-providers.d.ts

@@ -542,13 +542,15 @@ export declare const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = "platform-auth-login";
 export declare function zitadelDockerfile(): string;
 export declare const AUTH_LOGIN_PORT = "3000";
 /**
- * Every ZITADEL OIDC/management/console/asset path -- `deploy/proxy/Caddyfile`'s
- * own explicit list, restated here as one regex since the tunnel routes by a
+ * Every ZITADEL OIDC/management/asset path -- `deploy/proxy/Caddyfile`'s own
+ * explicit list, restated here as one regex since the tunnel routes by a
  * single `path` per ingress rule rather than a set. Anything not matching
  * falls through to the login app's own ingress rule below (login v2 answers
- * everything else, including the root).
+ * everything else, including the root). `/ui/console` and `/ui/login/*` (the
+ * v1 login) are left out on purpose: nobody reaches ZITADEL's own screens, so
+ * they land on the login app, which sends them back to the app.
  */
-export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
+export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
 /**
  * The broker's MCP authorization server (auth ADR 0002): its metadata and `/mcp-oauth/*`.
  * Checked before {@link AUTH_ZITADEL_PATH_PATTERN}, which takes every other `/.well-known` path.
@@ -1000,7 +1002,7 @@ export interface PlatformArchonDeps {
     releasePreviewMembers?: ReleasePreviewMembers;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri' | 'updateOidcAppPostLogoutRedirectUris' | 'getOidcAppRedirectUris' | 'updateOidcAppRedirectUris'>>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri' | 'listOrgs' | 'listProjects' | 'updateOidcAppPostLogoutRedirectUris' | 'getOidcAppRedirectUris' | 'updateOidcAppRedirectUris'>>;
     /**
      * {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client:
      * the owner company's own ZITADEL, by its issuer and the held-key reference of
@@ -1641,7 +1643,7 @@ export interface PlatformAccessProviderDeps {
     /** Edge's Access calls, at its recorded address (see {@link PlatformAccessFactory}). */
     access: (edgeUrl: string) => PlatformAccessProviderPort | Promise<PlatformAccessProviderPort>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'listApps' | 'deleteApp'> & Required<Pick<ZitadelPort, 'createOidcAppWithSecret'>>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'listApps' | 'deleteApp'> & Required<Pick<ZitadelPort, 'createOidcAppWithSecret'>> & Partial<Pick<ZitadelPort, 'updateOidcAppLoginBaseUri'>>;
     /** {@link PlatformArchonDeps.zitadelForInstance}: the ZITADEL client for the sign-in at `issuerUrl`. */
     zitadelForInstance?: (issuerUrl: string, bearerRef?: string) => PlatformAccessProviderDeps['zitadel'];
     /** Sleep and delivery tries for the one call that carries the secret; real ones by default. */

package/dist/plan/platform-providers.js

@@ -13,7 +13,7 @@ import { previewsOn } from './coolify-previews.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { desktopCallbackUri, unionRedirectUris } from './desktop-callback.js';
 import { placedOnPlatform } from './destinations.js';
-import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, setOidcAppLoginBaseUri, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
@@ -27,6 +27,7 @@ import { BROKER_DB_NAME, BROKER_DB_USER, ensureBrokerMcpEnv } from './broker-mcp
 import { withTimeout } from './call-timeout.js';
 import { SIGN_IN_BIND_KEY_ENV, SIGN_IN_BIND_KEY_MIN_LENGTH, SIGN_IN_BIND_KEY_SCOPE_KEY, } from './cookie-domain.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
+import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION } from './login-host.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
 import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAIL_DATABASE_SCOPE_KEY, MAIL_STORE_POSTGRES, MAIL_STORE_SCOPE_KEY, mailStoreIsLegacy, } from './mail-store.js';
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
@@ -1473,17 +1474,18 @@ export const AUTH_LOGIN_PORT = '3000';
 /** `broker/Dockerfile`'s own `ENV PORT=3000` / `EXPOSE 3000`. */
 const AUTH_BROKER_PORT = '3000';
 /**
- * Every ZITADEL OIDC/management/console/asset path -- `deploy/proxy/Caddyfile`'s
- * own explicit list, restated here as one regex since the tunnel routes by a
+ * Every ZITADEL OIDC/management/asset path -- `deploy/proxy/Caddyfile`'s own
+ * explicit list, restated here as one regex since the tunnel routes by a
  * single `path` per ingress rule rather than a set. Anything not matching
  * falls through to the login app's own ingress rule below (login v2 answers
- * everything else, including the root).
+ * everything else, including the root). `/ui/console` and `/ui/login/*` (the
+ * v1 login) are left out on purpose: nobody reaches ZITADEL's own screens, so
+ * they land on the login app, which sends them back to the app.
  */
 // `v2`, `v2beta` and `zitadel.<service>` are ZITADEL's v2 REST and connect
 // APIs (providers' `inviteOrgOwner` calls `POST /v2/users`); without them those
-// calls reach the login app and answer 404. The login app itself lives under
-// `/ui/v2/login`, which none of these match.
-export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)';
+// calls reach the login app and answer 404. None of these match `/ui/*`.
+export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)';
 /**
  * `@wtfalch/auth`'s own `brokerUrl` default, `<issuer>/api`
  * (`packages/auth/src/config.ts`) -- `deploy/proxy/Caddyfile`'s own
@@ -4671,6 +4673,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
             // `docs/operator-deployment.md`, step 4).
             redirectUris: [`https://${hostname}/auth/callback`, desktopCallbackUri(hostname)],
             postLogoutRedirectUris: postLogoutUrisFor([hostname]),
+            // The owner company's login host: with `loginV2.required` off a client with none lands on the v1 login.
+            loginBaseUri: `https://${ownerSignIn.hostname}/`,
         });
         context.recordScopeId(PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, created.appId);
         context.recordScopeId(PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, postLogoutAppliedValue(created.appId, postLogoutUrisFor([hostname])));
@@ -4693,7 +4697,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const archonAppZitadelId = context.recordedIds()[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
     const inAppOwed = archonInAppHost(context.recordedIds()) !== '';
     const inAppCalls = () => {
-        const { ensureTrustedDomain, deleteTrustedDomain, updateOidcAppLoginBaseUri, allowPerAppLoginBaseUri, } = zitadel;
+        const { ensureTrustedDomain, deleteTrustedDomain, updateOidcAppLoginBaseUri, allowPerAppLoginBaseUri, listOrgs, listProjects, } = zitadel;
         if (!ensureTrustedDomain || !deleteTrustedDomain || !updateOidcAppLoginBaseUri) {
             throw new Error("platform:archon: the owner company's ZITADEL port lacks ensureTrustedDomain, deleteTrustedDomain or updateOidcAppLoginBaseUri, so Archon cannot sign in on its own address");
         }
@@ -4701,9 +4705,12 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
             ensureTrustedDomain: ensureTrustedDomain.bind(zitadel),
             deleteTrustedDomain: deleteTrustedDomain.bind(zitadel),
             updateOidcAppLoginBaseUri: updateOidcAppLoginBaseUri.bind(zitadel),
+            listApps: zitadel.listApps.bind(zitadel),
             ...(allowPerAppLoginBaseUri
                 ? { allowPerAppLoginBaseUri: allowPerAppLoginBaseUri.bind(zitadel) }
                 : {}),
+            ...(listOrgs ? { listOrgs: listOrgs.bind(zitadel) } : {}),
+            ...(listProjects ? { listProjects: listProjects.bind(zitadel) } : {}),
         };
     };
     const inAppTarget = {
@@ -5217,6 +5224,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
                 });
             }
             await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, `${hostname}=${clientId}`);
+            await record(LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION);
         }
         else if (inAppOwed) {
             if (!ownerSignIn.signInLoginAppId) {
@@ -8320,6 +8328,11 @@ async function provisionPlatformAccessProvider(context, deps) {
     context.recordScopeId(PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, client.appId);
     context.recordScopeId(PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, client.appId);
     await context.persist?.();
+    // The owner company's login host, so the client never lands on the v1 login when `loginV2.required` is off.
+    // After the ids are persisted: a failure here leaves the app recorded and costs no second secret.
+    if (zitadel.updateOidcAppLoginBaseUri) {
+        await setOidcAppLoginBaseUri({ updateOidcAppLoginBaseUri: zitadel.updateOidcAppLoginBaseUri.bind(zitadel) }, org.id, project.id, client.appId, `https://${ownerSignIn.hostname}/`);
+    }
     let providerId = '';
     await deliverWithRetry(async (_ref, secret) => {
         providerId = (await access.ensureProvider({