@wtfalch/foundry 0.65.0 → 0.67.0

package/dist/plan/executor.js

@@ -5,10 +5,12 @@ import { EdgeApiError } from '@wtfalch/edge';
 import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { NATIVE_BUILD_KEY_BYTES, NATIVE_BUILD_KEY_ENV } from '../native-build.js';
+import { NATIVE_BUILD_KEY_ENV } from '../native-build.js';
 import { AI_ENTRY_PERMISSIONS, APPS_DOMAIN, APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, FULL_COMMIT_SHA, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, filesCollectionEnvName, heldEnvRef, isLiveEntry, isMainEntry, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
+import { ANALYTICS_BOULE_APPLIED_SCOPE_KEY, ANALYTICS_BOULE_ENV_NAMES, analyticsBouleMarker, } from './analytics-boule.js';
+import { ANALYTICS_DATABASE_SCOPE_KEY, ANALYTICS_DEPLOYED_SCOPE_KEY, ANALYTICS_OPERATOR_KEY_ENV, analyticsEnvDrift, analyticsHostnameFor, analyticsUrlFor, desiredAnalyticsEnv, } from './analytics.js';
 import { APPS_DATABASE_ADMIN_URL_ENV, applyAppsDbRoute, retireAppsDbRoute, } from './apps-db-route.js';
 import { APPS_ZONES_APPLIED_SCOPE_KEY, applyAppsZones, retireAppsZones } from './apps-zones.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, applyWorkspaceServer, } from './blue-green-apply.js';
@@ -38,6 +40,7 @@ import { createEdgeRateLimits, } from './edge-ratelimits.js';
 import { createEdgeTunnels } from './edge-tunnels.js';
 import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_KEY_DAYS, AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
+import { ENTRY_ANALYTICS_KEY_DELIVERY_ATTEMPTS, entryAnalyticsAppliedScopeKey, entryAnalyticsRetiredScopeKey, entryAnalyticsUndeliveredScopeKey, stageAnalyticsKeyName, } from './entry-analytics-key.js';
 import { applyEntryAudit } from './entry-audit.js';
 import { CUSTOMER_GRANTS_CREDENTIAL_ENV, CUSTOMER_GRANTS_ENV, CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY, customerGrantsEntries, customerGrantsJson, customerGrantsMintedScopeKey, customerGrantsRef, customerGrantsToDrop, ensureCustomerGrantsCredential, wantedCustomerGrants, } from './entry-customer-grants.js';
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, EDGE_SLUG_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, bouleEdgeKeyWanted, edgeKeyAppRecordKey, edgeKeyDomain, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
@@ -52,7 +55,7 @@ import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
 import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, workspaceHost, } from './hostnames.js';
 import { KEYS_REGISTRAR_DELIVERY_ATTEMPTS, KEYS_REGISTRAR_KEY_DAYS, KEYS_REGISTRAR_KEY_ENV, KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY, KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, KEYS_REGISTRAR_URL_ENV, } from './keys-registrar.js';
 import { KOSMOS_CLIENT_ID_SCOPE_KEY, KOSMOS_DATABASE_SCOPE_KEY, KOSMOS_DEPLOYED_SCOPE_KEY, desiredKosmosEnv, kosmosEnvDrift, kosmosHostnameFor, } from './kosmos.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION, LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { machineBypassScopeKey } from './machine-paths.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
@@ -404,6 +407,10 @@ export const BOULE_PORT = 3000;
 export const KOSMOS_REPO = 'wtfalch/kosmos';
 export const KOSMOS_APP_DOCKERFILE = '/Dockerfile';
 export const KOSMOS_PORT = 3000;
+/** The company's analytics backend (https://github.com/wtfalch/analytics): root Dockerfile, serves on 3000, migrates in its own start script. */
+export const ANALYTICS_REPO = 'wtfalch/analytics';
+export const ANALYTICS_APP_DOCKERFILE = '/Dockerfile';
+export const ANALYTICS_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -969,6 +976,8 @@ function limitProfileOf(action) {
             return LIMITS.boule;
         case 'coolify:kosmos':
             return LIMITS.kosmos;
+        case 'coolify:analytics':
+            return LIMITS.analytics;
         case 'coolify:broker-registrar':
             return LIMITS.brokerEntry;
         case 'coolify:keys-registrar':
@@ -1404,6 +1413,12 @@ export class FoundryStepExecutor {
                 return this.bouleBrokerEntry(org, context);
             case 'coolify:kosmos':
                 return this.coolifyKosmos(action, org, context);
+            case 'coolify:analytics':
+                return this.coolifyAnalytics(action, org, context);
+            case 'coolify:analytics-boule':
+                return this.analyticsBoule(action, org, context);
+            case 'analytics:key':
+                return this.analyticsEntryKey(action, org, context);
             case 'coolify:broker-registrar':
                 return this.brokerRegistrar(org, context);
             case 'coolify:keys-registrar':
@@ -1755,6 +1770,7 @@ export class FoundryStepExecutor {
                 : {}),
             zones: this.zonePort(),
             dns: this.dnsPort(),
+            secret: (value) => void this.handledSecrets.add(value),
             ...(this.ports.heldKeys ? { heldKeys: this.ports.heldKeys } : {}),
         };
     }
@@ -2354,6 +2370,7 @@ export class FoundryStepExecutor {
             ? loginHostClientIds(org, recorded, activePairs.map((pair) => pair.clientId).filter((id) => !movedIds.has(id)))
             : clientIds;
         const cookieDomain = inAppCookieDomain(action.desired.cookieDomain);
+        let swept = false;
         const writeCompanyBinding = async (ids) => {
             if (ids.length > 0 || activePairs.length === 0) {
                 await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds: ids });
@@ -2428,8 +2445,10 @@ export class FoundryStepExecutor {
             await writeClientOrgs();
             // One write for every upsert above (one redeploy of the login), before any app is repointed.
             await bindings.flush?.();
-            if (own && activeHosts.size > 0) {
-                await this.ports.zitadel.allowPerAppLoginBaseUri?.(`https://${host}/`);
+            // In-app sign-in recorded or wanted: `required` is off, so every app needs a base URI (marker below).
+            if (own && (activeHosts.size > 0 || recorded[SIGN_IN_IN_APP_SCOPE_KEY])) {
+                await allowPerAppLoginBaseUris(this.ports.zitadel, `https://${host}/`);
+                swept = Boolean(this.ports.zitadel.allowPerAppLoginBaseUri);
             }
         }
         // The base URI each app's sign-in starts from: its own address under `/sign-in/` in-app, else the login host.
@@ -2643,10 +2662,23 @@ export class FoundryStepExecutor {
         if (own) {
             // Written last: a failed base URI write leaves it behind and the step is planned again.
             context.recordScopeId(OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, ownCustomersSet.sort().join(','));
+            if (swept)
+                context.recordScopeId(LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION);
         }
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
+    /**
+     * `{ loginBaseUri }` for an app made in the org's ZITADEL: the instance's own login host (a company's own
+     * `auth.` host, else the shared one). Nothing when the shared host is not known. See
+     * {@link FoundryStepExecutorPorts}' `createOidcApp` `loginBaseUri`.
+     */
+    async instanceLoginBaseUriFor(org) {
+        if (ownsServices(org))
+            return { loginBaseUri: `https://${ownHostnames(org).auth}/` };
+        const shared = await this.ports.platformOrg?.authHostname?.();
+        return shared ? { loginBaseUri: `https://${shared}/` } : {};
+    }
     /**
      * The host table of a company's own in-app login app as a bindings port that collects its edits and
      * writes them once on `flush` (one redeploy, none when nothing changed). Used for a company that runs
@@ -2931,6 +2963,7 @@ export class FoundryStepExecutor {
                 : [...signInUris, ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : [])],
             postLogoutRedirectUris: postLogoutUris,
             ...(authEntry?.uses?.auth?.mcp ? { accessTokenType: 'jwt' } : {}),
+            ...(await this.instanceLoginBaseUriFor(org)),
         });
         if (appType === 'web') {
             // `coolifyApp`'s own `pushAppEnv` reads `APP_CLIENT_ID_SCOPE_KEY` to
@@ -3813,8 +3846,34 @@ export class FoundryStepExecutor {
                     : { id: registered.id, name: projectName };
             },
         };
+        const analytics = {
+            held: held('analytics'),
+            available: async () => canHold &&
+                Boolean(this.ports.analytics) &&
+                Boolean(context.recordedIds()[`coolify:analytics:${org.id}`]) &&
+                entry?.uses?.analytics === true,
+            create: async () => {
+                const port = this.ports.analytics;
+                if (!port)
+                    throw new Error('no analytics port');
+                const operatorKey = await this.analyticsOperatorKey(org, context);
+                const name = stageAnalyticsKeyName(org, subject.id);
+                const minted = await port.mintSiteKey({
+                    baseUrl: analyticsUrlFor(org),
+                    operatorKey,
+                    name,
+                    environment: 'stage',
+                });
+                return {
+                    id: minted.id,
+                    name,
+                    keyIds: [minted.id],
+                    secrets: [{ env: 'ANALYTICS_SITE_KEY', value: minted.secret }],
+                };
+            },
+        };
         const prodJobsProjectId = context.recordedIds()[`jobs:registration:${org.id}`];
-        return { files, ai, jobs, ...(prodJobsProjectId ? { prodJobsProjectId } : {}) };
+        return { files, ai, jobs, analytics, ...(prodJobsProjectId ? { prodJobsProjectId } : {}) };
     }
     /**
      * Stage's own sign-in (`plan/stage-signin.ts`): a client named `<production client>-stage` on production's
@@ -3869,6 +3928,7 @@ export class FoundryStepExecutor {
                         appType: 'web',
                         redirectUris: spec.redirectUris,
                         postLogoutRedirectUris: spec.postLogoutRedirectUris,
+                        ...(await this.instanceLoginBaseUriFor(org)),
                     });
                 },
             };
@@ -3921,6 +3981,7 @@ export class FoundryStepExecutor {
                     appType: 'web',
                     redirectUris: spec.redirectUris,
                     postLogoutRedirectUris: spec.postLogoutRedirectUris,
+                    ...(await this.instanceLoginBaseUriFor(org)),
                 });
             },
             writeBrokerEntry: async (entryWant, appKey) => {
@@ -5203,13 +5264,28 @@ export class FoundryStepExecutor {
         return already ? null : randomBytes(bytes).toString('base64url');
     }
     /**
-     * Every company's Boule, F3/#970: `NATIVE_BUILD_KEY` is what Boule presents to Archon's
-     * native-build route (estate#262) to ask it to dispatch `build-app.yml`. Minted once, like
-     * {@link ensureAuthAppKey}, and never rotated; a present-but-empty value (the bug
-     * `mintNativeBuildKey`'s own read-then-generate had, see #957) is treated as not set.
+     * foundry#987: nothing reads `NATIVE_BUILD_KEY` any more -- Boule calls Archon's org build
+     * route (`/api/orgs/{orgId}/native/builds`) with its own org credential instead
+     * (`BOULE_ARCHON_CREDENTIAL_ENV`, archon#706, boule#432). This takes the env row away from
+     * every Boule that still has one from #970/#971; `NATIVE_BUILD_KEY_ENV` and
+     * `NATIVE_BUILD_KEY_BYTES` are deprecated and go in the next release (the two-release removal
+     * rule), once no live Boule holds the row any more.
      */
-    async ensureNativeBuildKey(appId) {
-        return this.mintIfAbsent(appId, NATIVE_BUILD_KEY_ENV, NATIVE_BUILD_KEY_BYTES, 1);
+    async dropNativeBuildKeyEnv(appId, liveRows) {
+        let changed = false;
+        for (const row of liveRows) {
+            if (row.key !== NATIVE_BUILD_KEY_ENV || !row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+                changed = true;
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        return changed;
     }
     /**
      * `null` once the app already has one -- `AUTH_COOKIE_SECRET` is generated
@@ -7703,12 +7779,10 @@ export class FoundryStepExecutor {
             this.handledSecrets.add(ownerSeedSecret);
             envs.push({ key: BOULE_OWNER_SEED_SECRET_ENV, value: ownerSeedSecret });
         }
-        // The key Boule presents to Archon's native-build route, for every org's Boule (foundry#970).
-        const nativeBuildKey = await this.ensureNativeBuildKey(app.appId);
-        if (nativeBuildKey) {
-            this.handledSecrets.add(nativeBuildKey);
-            envs.push({ key: NATIVE_BUILD_KEY_ENV, value: nativeBuildKey });
-        }
+        // foundry#987: Boule calls Archon's org build route with its own org credential now, so
+        // nothing reads this any more -- take the row away from every Boule that still has one.
+        if (await this.dropNativeBuildKeyEnv(app.appId, liveRows))
+            envChanged = true;
         // Held, minted once (C3). Compared with the live value so a changed one restarts the app.
         const credentialEnvs = [];
         let archonPushedAt = null;
@@ -7769,7 +7843,6 @@ export class FoundryStepExecutor {
                 peerPassword,
                 bridgeSecret,
                 ownerSeedSecret,
-                nativeBuildKey,
                 ...credentialEnvs.map((credential) => credential.value),
                 ...grants.secrets,
             ].filter((v) => v !== null);
@@ -7809,7 +7882,6 @@ export class FoundryStepExecutor {
                 peerPassword !== null ||
                 bridgeSecret !== null ||
                 ownerSeedSecret !== null ||
-                nativeBuildKey !== null ||
                 secretsNotRestarted ||
                 registrarUnstarted ||
                 dbPush.changed ||
@@ -7828,6 +7900,254 @@ export class FoundryStepExecutor {
         this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
+    // ---- analytics backend ----------------------------------------------------
+    /**
+     * `plan/diff.ts`'s `planAnalyticsBackend`: the company's analytics backend as one more Coolify application
+     * from https://github.com/wtfalch/analytics's root Dockerfile ({@link ANALYTICS_REPO}), with a database of its
+     * own, shaped like {@link coolifyKosmos}. Its start script migrates as the owner role and then serves as the
+     * runtime role, so `pushDatabaseUrl` gives it both URLs. It needs no sign-in client: it reads only
+     * `AUTH_ORGANIZATION_ID` (the tenant id derives from it), `APP_URL` and the operator key.
+     *
+     * `ANALYTICS_OPERATOR_KEY` is made once here (`mintIfAbsent`) and written only to this app's env. No outside
+     * service shows it once, so no undelivered marker is needed: a failed write leaves nothing live to mint twice.
+     * Steps that call the backend's operator API read it back from this env.
+     *
+     * A brand new app is deployed once ({@link ANALYTICS_DEPLOYED_SCOPE_KEY}), as for Boule (#504).
+     */
+    async coolifyAnalytics(_action, org, context) {
+        const { env, missing } = desiredAnalyticsEnv(org, context.recordedIds());
+        if (missing.length > 0) {
+            throw new Error(`the analytics backend for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
+        }
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const name = `${org.slug}-analytics`;
+        const dbName = `${org.slug}-analytics-db`.replace(/-/g, '_');
+        const dbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, `${org.slug}-analytics-db`, dbName, ANALYTICS_DATABASE_SCOPE_KEY);
+        context.recordScopeId(ANALYTICS_DATABASE_SCOPE_KEY, dbId);
+        const server = await this.resolveServer(org, context);
+        const githubApp = await this.ports.coolify.requireGithubApp();
+        const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            github_app_uuid: githubApp.uuid,
+            git_repository: ANALYTICS_REPO,
+            git_branch: 'main',
+            build_pack: 'dockerfile',
+            name,
+            domains: coolifyTunnelDomains([analyticsHostnameFor(org)]),
+            dockerfile_location: ANALYTICS_APP_DOCKERFILE,
+        }));
+        await this.ensureLogVolume(app.appId, org, app.existed);
+        await this.ports.coolify.updateApplication(app.appId, {
+            ...healthCheckSettings('/api/health', ANALYTICS_PORT),
+            ...(await this.routedLabels(name, analyticsHostnameFor(org), ANALYTICS_PORT)),
+        });
+        const liveEnv = Object.fromEntries((await this.ports.coolify.listEnvs(app.appId))
+            .filter((e) => !e.is_preview)
+            .map((e) => [e.key, e.value]));
+        const envChanged = analyticsEnvDrift(env, liveEnv).length > 0;
+        const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
+        const operatorKey = await this.mintIfAbsent(app.appId, ANALYTICS_OPERATOR_KEY_ENV, 32);
+        if (operatorKey) {
+            this.handledSecrets.add(operatorKey);
+            envs.push({ key: ANALYTICS_OPERATOR_KEY_ENV, value: operatorKey });
+        }
+        try {
+            await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        }
+        catch (error) {
+            if (!operatorKey)
+                throw error;
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), [operatorKey]));
+        }
+        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName);
+        if (!dbPush.pushed) {
+            throw new Error(`the analytics backend for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        if (!context.recordedIds()[ANALYTICS_DEPLOYED_SCOPE_KEY]) {
+            const runtime = this.ports.runtime ?? {};
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), analyticsHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:analytics', `${org.slug}'s analytics backend stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'analytics' }, (key, value) => context.recordScopeId(key, value));
+            context.recordScopeId(ANALYTICS_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (app.existed && (envChanged || operatorKey !== null || dbPush.changed)) {
+            await this.ports.coolify.restart(app.appId);
+        }
+        return { resourceId: app.appId };
+    }
+    /** The backend's operator key, read from its own env. Fixed text when the backend or the key is not there. */
+    async analyticsOperatorKey(org, context) {
+        const appId = context.recordedIds()[`coolify:analytics:${org.id}`];
+        if (!appId)
+            throw new Error(`the analytics backend for ${org.slug} is not recorded yet`);
+        const rows = await this.ports.coolify.listEnvs(appId);
+        const key = rows.find((e) => e.key === ANALYTICS_OPERATOR_KEY_ENV && !e.is_preview)?.value;
+        if (!key)
+            throw new Error(`the analytics backend for ${org.slug} has no operator key yet`);
+        this.handledSecrets.add(key);
+        return key;
+    }
+    /**
+     * C2 `coolify:analytics-boule` (`plan/analytics-boule.ts`): the backend's address and operator key into
+     * Boule's env, then Boule restarts. `analytics_boule_applied` is recorded last. Retire takes both names away.
+     */
+    async analyticsBoule(action, org, context) {
+        const at = `coolify:analytics-boule for ${org.slug}`;
+        const recorded = context.recordedIds();
+        const bouleId = recorded[`coolify:boule:${org.id}`];
+        if (!bouleId)
+            throw new Error(`${at}: Boule is not recorded yet`);
+        if (action.desired.mode === 'retire') {
+            const rows = await this.ports.coolify.listEnvs(bouleId);
+            for (const name of ANALYTICS_BOULE_ENV_NAMES) {
+                const row = rows.find((e) => e.key === name && !e.is_preview);
+                if (row?.uuid) {
+                    try {
+                        await this.ports.coolify.deleteEnv(bouleId, row.uuid);
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                }
+            }
+            await this.ports.coolify.restart(bouleId);
+            context.recordScopeId(ANALYTICS_BOULE_APPLIED_SCOPE_KEY, '');
+            return {};
+        }
+        if (!appsOn(org))
+            throw new Error(`${at}: the company's Boule runs no apps (org.boule.apps)`);
+        const backendId = recorded[`coolify:analytics:${org.id}`];
+        if (!backendId)
+            throw new Error(`${at}: the analytics backend is not recorded yet`);
+        const operatorKey = await this.analyticsOperatorKey(org, context);
+        try {
+            await this.ports.coolify.bulkUpsertEnvs(bouleId, [
+                { key: 'ANALYTICS_URL', value: analyticsUrlFor(org), literal: true },
+                { key: ANALYTICS_OPERATOR_KEY_ENV, value: operatorKey, literal: true },
+            ]);
+            await this.ports.coolify.restart(bouleId);
+        }
+        catch (error) {
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), [operatorKey]));
+        }
+        context.recordScopeId(ANALYTICS_BOULE_APPLIED_SCOPE_KEY, analyticsBouleMarker(org, backendId));
+        return {};
+    }
+    /**
+     * `plan/entry-analytics-key.ts`: one server entry's site key (CLAUDE.md "Platform steps" rule 1). Mint: the
+     * key's id is recorded as undelivered and persisted before anything is written; the env write is tried 3
+     * times with the same secret; the applied address and the cleared marker come last; every try failing leaves
+     * the marker, and the error names the id only. `url` rewrites the address. Retire revokes the key and the
+     * env names. The operator key is read from the backend's env and never recorded.
+     */
+    async analyticsEntryKey(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `analytics:key for ${org.slug} entry '${entryKey}'`;
+        const analytics = this.ports.analytics;
+        if (!analytics)
+            throw new Error(`${at}: this executor was built without an analytics port`);
+        const desired = action.desired;
+        const recorded = context.recordedIds();
+        const appId = recorded[`coolify:app:${action.key}`];
+        const baseUrl = analyticsUrlFor(org);
+        const tolerate = async (call, gone) => {
+            try {
+                return await call();
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+                return gone;
+            }
+        };
+        if (desired.mode === 'retire') {
+            const mainId = recorded[`analytics:key:${action.key}`];
+            const undelivered = recorded[entryAnalyticsUndeliveredScopeKey(entryKey)];
+            const ids = [...new Set([mainId, undelivered].filter((id) => Boolean(id)))];
+            if (ids.length > 0) {
+                const operatorKey = await this.analyticsOperatorKey(org, context);
+                for (const keyId of ids) {
+                    await tolerate(() => analytics.revokeSiteKey({ baseUrl, operatorKey, keyId }), undefined);
+                }
+            }
+            if (appId) {
+                const rows = await tolerate(() => this.ports.coolify.listEnvs(appId), []);
+                let removed = false;
+                for (const name of ['ANALYTICS_URL', 'ANALYTICS_SITE_KEY']) {
+                    const row = rows.find((e) => e.key === name && !e.is_preview);
+                    if (row?.uuid) {
+                        const uuid = row.uuid;
+                        await tolerate(() => this.ports.coolify.deleteEnv(appId, uuid), undefined);
+                        removed = true;
+                    }
+                }
+                if (removed)
+                    await tolerate(() => this.ports.coolify.restart(appId), undefined);
+            }
+            context.recordScopeId(entryAnalyticsUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryAnalyticsAppliedScopeKey(entryKey), '');
+            if (mainId ?? undelivered) {
+                context.recordScopeId(entryAnalyticsRetiredScopeKey(entryKey), (mainId ?? undelivered));
+            }
+            return {};
+        }
+        if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.analytics)) {
+            throw new Error(`${at}: the entry no longer declares uses.analytics`);
+        }
+        if (!appId)
+            throw new Error(`${at}: the entry's app is not recorded yet`);
+        if (desired.mode === 'url') {
+            await this.ports.coolify.bulkUpsertEnvs(appId, [
+                { key: 'ANALYTICS_URL', value: baseUrl, literal: true },
+            ]);
+            await this.ports.coolify.restart(appId);
+            context.recordScopeId(entryAnalyticsAppliedScopeKey(entryKey), baseUrl);
+            return {};
+        }
+        if (recorded[entryAnalyticsUndeliveredScopeKey(entryKey)]) {
+            throw new Error(`${at}: a key was minted and never delivered; it is not minted again`);
+        }
+        const operatorKey = await this.analyticsOperatorKey(org, context);
+        let minted;
+        try {
+            minted = await analytics.mintSiteKey({
+                baseUrl,
+                operatorKey,
+                name: desired.name,
+                environment: 'production',
+            });
+        }
+        catch (error) {
+            const status = error?.status;
+            throw new Error(`${at}: the backend did not mint a key${typeof status === 'number' ? ` (status ${status})` : ''}`);
+        }
+        this.handledSecrets.add(minted.secret);
+        context.recordScopeId(entryAnalyticsUndeliveredScopeKey(entryKey), minted.id);
+        await context.persistScopeIds();
+        const rows = [
+            { key: 'ANALYTICS_URL', value: baseUrl, literal: true },
+            { key: 'ANALYTICS_SITE_KEY', value: minted.secret, literal: true },
+        ];
+        let lastError;
+        for (let attempt = 1; attempt <= ENTRY_ANALYTICS_KEY_DELIVERY_ATTEMPTS; attempt++) {
+            try {
+                await this.ports.coolify.bulkUpsertEnvs(appId, rows);
+                await this.ports.coolify.restart(appId);
+                context.recordScopeId(entryAnalyticsAppliedScopeKey(entryKey), baseUrl);
+                context.recordScopeId(entryAnalyticsUndeliveredScopeKey(entryKey), '');
+                return { resourceId: minted.id };
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_ANALYTICS_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'})`);
+    }
     // ---- kosmos (foundry#949) --------------------------------------------------
     /**
      * `plan/diff.ts`'s `planKosmos`: provisions the org's own kosmos
@@ -11448,6 +11768,46 @@ export function isNoChangesError(error) {
  * {@link ZitadelPort.updateOidcAppLoginBaseUri} that counts an app already holding the wanted base URI as
  * done: ZITADEL answers that write with "No changes" and a repeat apply must not fail on it.
  */
+/**
+ * Turns the instance feature `loginV2.required` off so each app's own base URI counts, and makes sure no
+ * app can then land on ZITADEL's v1 login: with `required` off an app without a base URI of its own
+ * (ZITADEL's own console app, an app foundry did not make, an app made later) falls back to v1, and
+ * ZITADEL v4.17.3 gives a `required` instance's base URI to every app but ignores an app's own
+ * (`internal/query/oidc_client.go:88-92`), so the only way is a base URI on every app. Every live OIDC
+ * app of every organisation and project gets `instanceBaseUri` when it has none; an app that has one
+ * keeps it. The apps are set first, while `required` still makes the instance ignore them, so no sign-in
+ * passes through a gap. Without a way to list every app, or with a listing that may be cut short, it
+ * throws before the feature is touched.
+ */
+export async function allowPerAppLoginBaseUris(zitadel, instanceBaseUri) {
+    if (!zitadel.allowPerAppLoginBaseUri)
+        return;
+    const { listOrgs, listProjects } = zitadel;
+    if (!listOrgs || !listProjects) {
+        throw new Error('the ZITADEL port cannot list every organisation and project, so apps without a login base URI would fall back to the v1 login');
+    }
+    for (const org of await listOrgs()) {
+        if (org.state && org.state !== 'ORG_STATE_ACTIVE')
+            continue;
+        for (const project of await listProjects(org.id)) {
+            if (project.state && project.state !== 'PROJECT_STATE_ACTIVE')
+                continue;
+            const listed = await zitadel.listApps(org.id, project.id);
+            if (!listed.complete) {
+                throw new Error(`the app listing of project ${project.id} may be cut short, so apps without a login base URI could be missed`);
+            }
+            for (const app of listed.apps) {
+                if (app.state === 'APP_STATE_REMOVED' || app.appType === 'api')
+                    continue;
+                // `undefined` is "not read": set it, the write is the same either way.
+                if (typeof app.loginBaseUri === 'string' && app.loginBaseUri !== '')
+                    continue;
+                await setOidcAppLoginBaseUri(zitadel, org.id, project.id, app.id, instanceBaseUri);
+            }
+        }
+    }
+    await zitadel.allowPerAppLoginBaseUri(instanceBaseUri);
+}
 export async function setOidcAppLoginBaseUri(zitadel, orgId, projectId, appId, loginBaseUri) {
     try {
         await zitadel.updateOidcAppLoginBaseUri(orgId, projectId, appId, loginBaseUri);

package/dist/plan/hostnames.js

@@ -2,6 +2,7 @@ import { INBOX_HOST_PREFIX, WORKSPACE_HOST_PREFIX } from '../hosted-label.js';
 import { APPS_DOMAIN, isMainEntry, mainEntry } from '../org.js';
 import { workerAppHostnameOf } from '../worker-app-config.js';
 import { agoraHostnameFor } from './agora.js';
+import { analyticsHostnameFor, analyticsWanted } from './analytics.js';
 import { bouleHostnameFor } from './boule.js';
 import { workspaceWorkerParent } from './workspace-worker.js';
 /**
@@ -154,6 +155,9 @@ export function tunnelIngressHostnames(org, loginHost = null) {
         hostnames.push(agoraHostnameFor(org));
         // #161: and Boule moves onto `boule.<domain>` the same way.
         hostnames.push(bouleHostnameFor(org));
+        // The analytics backend's route, only while something uses it.
+        if (analyticsWanted(org))
+            hostnames.push(analyticsHostnameFor(org));
     }
     const share = filesShareHostname(org);
     if (share)

package/dist/plan/index.d.ts

@@ -1,4 +1,6 @@
 export type { KeysRegistrarPort } from './keys-registrar.js';
+export type { AnalyticsPort } from './analytics.js';
+export { httpAnalytics } from './analytics.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, } from './live.js';
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export type { StepAction, PlannedStep, PlanDetail, OrgPostgresPlan } from './diff.js';

package/dist/plan/index.js

@@ -1,3 +1,4 @@
+export { httpAnalytics } from './analytics.js';
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';

package/dist/plan/live.d.ts

@@ -42,7 +42,7 @@ export interface LiveResource {
      * see that function's own doc comment for why "always planned" broke
      * `bootstrapPlatform`.
      */
-    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats' | 'github' | 'audit';
+    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats' | 'github' | 'audit' | 'analytics';
     kind: string;
     key: string;
     config: Record<string, unknown>;

package/dist/plan/locked-hostnames.js

@@ -1,6 +1,7 @@
 import { kosmosOn, ownsServices } from '../org.js';
 import { OWN_SERVICE_LABELS } from '../service-labels.js';
 import { agoraHostnameFor } from './agora.js';
+import { analyticsHostnameFor } from './analytics.js';
 import { bouleHostnameFor } from './boule.js';
 import { cmsStudioHostnameFor, siteHostnameFor } from './hostnames.js';
 import { kosmosHostnameFor } from './kosmos.js';
@@ -32,6 +33,8 @@ export function lockedHostnames(org, platformHostnames) {
     }
     locked.add(agoraHostnameFor(org));
     locked.add(bouleHostnameFor(org));
+    // Reserved always, planned only while something uses analytics (`analyticsWanted`).
+    locked.add(analyticsHostnameFor(org));
     if (kosmosOn(org))
         locked.add(kosmosHostnameFor(org));
     if (org.site.enabled)

package/dist/plan/login-host.d.ts

@@ -190,6 +190,14 @@ export declare function customersClientOrganizations(org: DeclaredOrg, recorded:
  * falls back to the v1 login once in-app sign-in turns `loginV2.required` off. Absent or empty means none.
  */
 export declare const OWN_CUSTOMERS_BASE_URI_SCOPE_KEY = "own_customers_login_base_uri";
+/**
+ * Scope id recording that the instance's apps were all given a Login V2 base URI ({@link LOGIN_BASE_URI_SWEEP_VERSION}),
+ * on a company's own instance and on the platform's (Archon's step). A value that is missing or older plans the step
+ * again while in-app sign-in has `loginV2.required` off, so an instance applied before the sweep gets it too.
+ */
+export declare const LOGIN_BASE_URI_SWEEP_SCOPE_KEY = "login_base_uri_sweep";
+/** The value {@link LOGIN_BASE_URI_SWEEP_SCOPE_KEY} holds once the sweep ran. Raise it to run the sweep again everywhere. */
+export declare const LOGIN_BASE_URI_SWEEP_VERSION = "1";
 /** The recorded ZITADEL app ids of the org's customers entries, sorted and joined by `,` ('' when none). */
 export declare function ownCustomersAppState(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string;
 /** {@link LOGIN_CLIENT_ORGS_SCOPE_KEY}'s value for a map. */

package/dist/plan/login-host.js

@@ -223,6 +223,14 @@ export function customersClientOrganizations(org, recorded) {
  * falls back to the v1 login once in-app sign-in turns `loginV2.required` off. Absent or empty means none.
  */
 export const OWN_CUSTOMERS_BASE_URI_SCOPE_KEY = 'own_customers_login_base_uri';
+/**
+ * Scope id recording that the instance's apps were all given a Login V2 base URI ({@link LOGIN_BASE_URI_SWEEP_VERSION}),
+ * on a company's own instance and on the platform's (Archon's step). A value that is missing or older plans the step
+ * again while in-app sign-in has `loginV2.required` off, so an instance applied before the sweep gets it too.
+ */
+export const LOGIN_BASE_URI_SWEEP_SCOPE_KEY = 'login_base_uri_sweep';
+/** The value {@link LOGIN_BASE_URI_SWEEP_SCOPE_KEY} holds once the sweep ran. Raise it to run the sweep again everywhere. */
+export const LOGIN_BASE_URI_SWEEP_VERSION = '1';
 /** The recorded ZITADEL app ids of the org's customers entries, sorted and joined by `,` ('' when none). */
 export function ownCustomersAppState(org, recorded) {
     return [...customersEntryKeys(org)]