@wtfalch/foundry 0.65.0 → 0.67.0

package/dist/plan/org-names.d.ts

@@ -6,13 +6,13 @@ export type OrgNameSource = 'own' | 'hosting';
  * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
  * calls and the cms site while they are on.
  */
-export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site' | 'kosmos'>): string[];
+export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule' | 'hosting'>): string[];
 /**
  * Every container name, network alias, database, tunnel and bucket name that
  * foundry derives for an org: its own-service names when it owns services,
  * and its hosting-entry and database names.
  */
-export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>): {
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule'>): {
     name: string;
     source: OrgNameSource;
 }[];
@@ -26,5 +26,5 @@ export interface NameClash {
     source: OrgNameSource;
 }
 /** Every name `org` derives that another org or the platform also derives. */
-export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>[]): NameClash[];
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule'>[]): NameClash[];
 export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -1,5 +1,6 @@
 import { kosmosOn, ownsServices } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
+import { analyticsWanted } from './analytics.js';
 import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
 import { workerAppHostname, workspaceHost, workspaceInboxHost } from './hostnames.js';
 import { orgTarget, platformTarget } from './own-services.js';
@@ -20,6 +21,8 @@ export function companyServiceNames(org) {
         `${s}-tunnel`,
         `${s}-cloudflared`,
     ];
+    if (analyticsWanted(org))
+        names.push(`${s}-analytics`, `${s}-analytics-db`);
     if (kosmosOn(org))
         names.push(`${s}-kosmos`, `${s}-kosmos-db`);
     if (org.chat?.enabled) {

package/dist/plan/own-limits.d.ts

@@ -113,6 +113,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly analytics: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly companyOther: {
         memory: string;
         dbMemory: string;

package/dist/plan/own-limits.js

@@ -30,6 +30,7 @@ export const LIMITS = {
     agora: profile('1g', '512m'),
     boule: profile('512m'),
     kosmos: profile('512m'),
+    analytics: profile('512m', '512m'),
     companyOther: profile('1g', '512m'),
     platformArchon: profile('1g'),
     platformAi: profile('1g'),

package/dist/plan/plan-apply.d.ts

@@ -583,8 +583,12 @@ export interface FoundryPlanApplyOptions {
     workerAppKeysUrl?: string;
     /** F7: the keys service's registrar address, when the executor has a `KeysRegistrarPort`. */
     keysRegistrarUrl?: string;
+    /** True when the host's executor was built with an `analytics` port. A `uses.analytics` key is blocked without it. */
+    analyticsPort?: boolean;
     /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
     workerAppDatabase?: boolean;
+    /** True when that port has `deletableTables`. A `workerApp.database.noDelete` is blocked without it. */
+    workerAppNoDeleteCheck?: boolean;
     /** ADR 0002: the platform's Cloudflare account id. A container image outside its registry is blocked. */
     workerAppRegistryAccountId?: string;
     /**
@@ -745,7 +749,9 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly workerApps;
     private readonly workerAppKeysUrl;
     private readonly keysRegistrarUrl;
+    private readonly analyticsPort;
     private readonly workerAppDatabase;
+    private readonly workerAppNoDeleteCheck;
     private readonly workerAppRegistryAccountId;
     private readonly ownerInviteMail;
     private readonly hostFiles;
@@ -980,6 +986,12 @@ export declare class FoundryPlanApply implements PlanApply {
     private repoKeysReadiness;
     /** Which refs of the platform GitHub App hold no value now. A resolver that throws counts as not held; only refs are kept. */
     private githubAppKeysReadiness;
+    /**
+     * The Worker apps' `heldSecret` secrets that hold a value now, by `<entry key>/<NAME>`, with the version of
+     * the value. A resolver that throws, or a name that fits no ref, counts as not held. The value is hashed and
+     * dropped here; only the version leaves.
+     */
+    private workerAppSecretsReadiness;
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as

package/dist/plan/plan-apply.js

@@ -40,7 +40,7 @@ import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROU
 import { finishStageCopy, runSubjectRelease, } from './release-host.js';
 import { remoteDatabaseFactsFrom, remoteDatabaseKeys } from './remote-database.js';
 import { STAGE_COPY_LOCK_MS, claimStageCopyLock, parseStageCopyLock, stageCopyLockValue, } from './stage-copy-host.js';
-import { liveWorkerApps, workerAppTraceScopeKeys } from './worker-app.js';
+import { heldSecretId, heldSecretVersion, liveWorkerApps, workerAppTraceScopeKeys, } from './worker-app.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
@@ -188,7 +188,9 @@ export class FoundryPlanApply {
     workerApps;
     workerAppKeysUrl;
     keysRegistrarUrl;
+    analyticsPort;
     workerAppDatabase;
+    workerAppNoDeleteCheck;
     workerAppRegistryAccountId;
     ownerInviteMail;
     hostFiles;
@@ -232,7 +234,9 @@ export class FoundryPlanApply {
         this.workerApps = options.workerApps ?? false;
         this.workerAppKeysUrl = options.workerAppKeysUrl;
         this.keysRegistrarUrl = options.keysRegistrarUrl;
+        this.analyticsPort = options.analyticsPort ?? false;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
+        this.workerAppNoDeleteCheck = options.workerAppNoDeleteCheck ?? false;
         this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
         this.ownerInviteMail = options.ownerInviteMail ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
@@ -1625,7 +1629,9 @@ export class FoundryPlanApply {
             workerApps: this.workerApps,
             workerAppKeysUrl: this.workerAppKeysUrl,
             keysRegistrarUrl: this.keysRegistrarUrl,
+            analyticsPort: this.analyticsPort,
             workerAppDatabase: this.workerAppDatabase,
+            workerAppNoDeleteCheck: this.workerAppNoDeleteCheck,
             workerAppRegistryAccountId: this.workerAppRegistryAccountId,
             ownerInviteMail: this.ownerInviteMail,
             otherSlugs,
@@ -1758,6 +1764,7 @@ export class FoundryPlanApply {
         const base = {
             ...(await this.sharedPlatformReadiness()),
             heldEnv: await this.heldEnvReadiness(org),
+            workerAppSecrets: await this.workerAppSecretsReadiness(org),
             ...(org.hosting.github ? { githubAppKeys: await this.githubAppKeysReadiness() } : {}),
             ...(repoKeysInPlay(org, orgRecordedIds)
                 ? { repoKeys: await this.repoKeysReadiness(org, orgRecordedIds) }
@@ -1805,6 +1812,32 @@ export class FoundryPlanApply {
         }
         return { store: true, missing };
     }
+    /**
+     * The Worker apps' `heldSecret` secrets that hold a value now, by `<entry key>/<NAME>`, with the version of
+     * the value. A resolver that throws, or a name that fits no ref, counts as not held. The value is hashed and
+     * dropped here; only the version leaves.
+     */
+    async workerAppSecretsReadiness(org) {
+        const heldKeys = this.platformDeps?.heldKeys;
+        const held = {};
+        if (!heldKeys)
+            return held;
+        for (const entry of org.hosting.entries) {
+            for (const [name, source] of Object.entries(entry.workerApp?.secrets ?? {})) {
+                if (source.from !== 'heldSecret')
+                    continue;
+                try {
+                    const value = await heldKeys.resolve(heldEnvRef(org.id, entry.key, name));
+                    if (value)
+                        held[heldSecretId(entry.key, name)] = heldSecretVersion(value);
+                }
+                catch {
+                    // Not held: the plan says the secret has no value yet, and the error is dropped.
+                }
+            }
+        }
+        return held;
+    }
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as
@@ -2635,6 +2668,8 @@ const STEP_FIELDS = {
     'cloudflare:worker': 'hosting.entries.worker',
     'cloudflare:worker-app': 'hosting.entries.workerApp',
     // F4 (#925): both hang off the company's Apps switch.
+    'coolify:analytics': 'hosting.entries.uses.analytics',
+    'coolify:analytics-boule': 'boule.apps',
     'coolify:org-apps-admin': 'boule.apps',
     'cloudflare:apps-db-route': 'boule.apps',
     'cloudflare:apps-zones': 'boule.apps',
@@ -2658,6 +2693,10 @@ function stepField(action) {
     // An entry's jobs project: always `<orgId>:<entry>`.
     if (action.system === 'jobs' && action.kind === 'project')
         return 'hosting.entries.uses.jobs';
+    // An entry's analytics site key: always `<orgId>:<entry>`.
+    if (action.system === 'analytics' && action.kind === 'key') {
+        return 'hosting.entries.uses.analytics';
+    }
     // An entry's audit ledger registration: always `<orgId>:<entry>`.
     if (action.system === 'audit' && action.kind === 'ledger')
         return 'hosting.entries.uses.audit';

package/dist/plan/platform-diff.d.ts

@@ -1117,6 +1117,13 @@ export declare const PLATFORM_UPTIME_KV_TITLE = "platform-uptime";
  * a blocked item, never a throw.
  */
 export declare const PLATFORM_UPTIME_TOKEN_REF = "uptime:worker:token";
+/**
+ * The release tick and audit seal tick tokens: minted by the step like `UPTIME_TOKEN`, each its own
+ * value, set on the Worker and on Archon's env under the same names. The Worker skips a tick while
+ * its token is unset, and Archon's route refuses every call while its own is unset.
+ */
+export declare const PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF = "uptime:worker:release-tick-token";
+export declare const PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF = "uptime:worker:audit-seal-tick-token";
 export declare const PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF = "uptime:worker:access-client-id";
 export declare const PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF = "uptime:worker:access-client-secret";
 export declare const PLATFORM_UPTIME_CHAT_TOKEN_REF = "uptime:worker:chat-token";
@@ -1138,6 +1145,15 @@ export declare const PLATFORM_UPTIME_OPTIONAL_SECRETS: Readonly<Record<string, s
  */
 export declare const PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY = "uptime_token_undelivered";
 export declare const PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY = "uptime_token_id";
+/** The same pair of scope keys for each tick token: `<undelivered>` before the value is held, `<id>` once it is. */
+export declare const PLATFORM_UPTIME_RELEASE_TICK_UNDELIVERED_SCOPE_KEY = "uptime_release_tick_undelivered";
+export declare const PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY = "uptime_release_tick_id";
+export declare const PLATFORM_UPTIME_AUDIT_SEAL_TICK_UNDELIVERED_SCOPE_KEY = "uptime_audit_seal_tick_undelivered";
+export declare const PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY = "uptime_audit_seal_tick_id";
+/** The tick token ids (`<release>:<seal>`) Archon's env was last written with; like {@link PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY}. */
+export declare const PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY = "archon_uptime_ticks_synced";
+/** What {@link PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY} holds once Archon's env carries the tick tokens; empty while neither is minted. */
+export declare function uptimeTicksSyncValue(recorded: Readonly<Record<string, string>>): string;
 /** The token id Archon's env was last written with; `planArchon` plans again when it differs from {@link PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY}. */
 export declare const PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY = "archon_uptime_token_synced";
 /** The tag, sha256 and Archon hostname the last successful run applied; a change plans the step again and mints nothing. */
@@ -1171,7 +1187,7 @@ export declare function uptimeEffectiveVars(hostVars: Readonly<Record<string, st
 } | null): Record<string, string | undefined>;
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export declare function uptimeVarsDigest(vars?: Readonly<Record<string, string | undefined>>): string;
-/** The Worker secret names the step sets: the three it mints, and each held one. */
+/** The Worker secret names the step sets: the five it mints, and each held one. */
 export declare function uptimeSecretNames(held: readonly string[]): string;
 /** The Access service token's name at Cloudflare; edge answers `conflict` when a token of this name exists. */
 export declare const PLATFORM_UPTIME_ACCESS_TOKEN_NAME = "platform-uptime";

package/dist/plan/platform-diff.js

@@ -8,6 +8,7 @@ import { buildDriftNotes } from './build-record.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
+import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION } from './login-host.js';
 import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
@@ -1271,6 +1272,13 @@ export const PLATFORM_UPTIME_KV_TITLE = 'platform-uptime';
  * a blocked item, never a throw.
  */
 export const PLATFORM_UPTIME_TOKEN_REF = 'uptime:worker:token';
+/**
+ * The release tick and audit seal tick tokens: minted by the step like `UPTIME_TOKEN`, each its own
+ * value, set on the Worker and on Archon's env under the same names. The Worker skips a tick while
+ * its token is unset, and Archon's route refuses every call while its own is unset.
+ */
+export const PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF = 'uptime:worker:release-tick-token';
+export const PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF = 'uptime:worker:audit-seal-tick-token';
 export const PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF = 'uptime:worker:access-client-id';
 export const PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF = 'uptime:worker:access-client-secret';
 export const PLATFORM_UPTIME_CHAT_TOKEN_REF = 'uptime:worker:chat-token';
@@ -1295,6 +1303,19 @@ export const PLATFORM_UPTIME_OPTIONAL_SECRETS = {
  */
 export const PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY = 'uptime_token_undelivered';
 export const PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY = 'uptime_token_id';
+/** The same pair of scope keys for each tick token: `<undelivered>` before the value is held, `<id>` once it is. */
+export const PLATFORM_UPTIME_RELEASE_TICK_UNDELIVERED_SCOPE_KEY = 'uptime_release_tick_undelivered';
+export const PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY = 'uptime_release_tick_id';
+export const PLATFORM_UPTIME_AUDIT_SEAL_TICK_UNDELIVERED_SCOPE_KEY = 'uptime_audit_seal_tick_undelivered';
+export const PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY = 'uptime_audit_seal_tick_id';
+/** The tick token ids (`<release>:<seal>`) Archon's env was last written with; like {@link PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY}. */
+export const PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY = 'archon_uptime_ticks_synced';
+/** What {@link PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY} holds once Archon's env carries the tick tokens; empty while neither is minted. */
+export function uptimeTicksSyncValue(recorded) {
+    const release = recorded[PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY];
+    const seal = recorded[PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY];
+    return release && seal ? `${release}:${seal}` : '';
+}
 /** The token id Archon's env was last written with; `planArchon` plans again when it differs from {@link PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY}. */
 export const PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY = 'archon_uptime_token_synced';
 /** The tag, sha256 and Archon hostname the last successful run applied; a change plans the step again and mints nothing. */
@@ -1338,9 +1359,16 @@ export function uptimeVarsDigest(vars = {}) {
         return '';
     return createHash('sha256').update(JSON.stringify(set)).digest('hex').slice(0, 16);
 }
-/** The Worker secret names the step sets: the three it mints, and each held one. */
+/** The Worker secret names the step sets: the five it mints, and each held one. */
 export function uptimeSecretNames(held) {
-    return ['UPTIME_TOKEN', 'CF_ACCESS_CLIENT_ID', 'CF_ACCESS_CLIENT_SECRET', ...held]
+    return [
+        'UPTIME_TOKEN',
+        'RELEASE_TICK_TOKEN',
+        'AUDIT_SEAL_TICK_TOKEN',
+        'CF_ACCESS_CLIENT_ID',
+        'CF_ACCESS_CLIENT_SECRET',
+        ...held,
+    ]
         .sort()
         .join(',');
 }
@@ -3249,6 +3277,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     const applied = deployed &&
         Boolean(recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY]) &&
         uptimeHeld.token &&
+        Boolean(uptimeTicksSyncValue(recordedIds)) &&
         Boolean(recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]) &&
         uptimeHeld.access &&
         recordedIds[PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY] === uptime.tag &&
@@ -3482,6 +3511,10 @@ function planArchon(platform, recordedIds, executorBlocked, ownerSignIn, ownerFi
         // In-app sign-in: Archon's own address is the sign-in address only once the owner company has the
         // switch on and its in-app login is applied, and goes back to the company's login host when it does not.
         archonInAppHost(recordedIds) === (ownerSignIn.signInInApp ? platform.archon.hostname : '') &&
+        // With in-app sign-in on, `loginV2.required` is off and every app of the instance owes a base URI
+        // until the sweep ran (an instance applied before it plans the step once more).
+        (!ownerSignIn.signInInApp ||
+            recordedIds[LOGIN_BASE_URI_SWEEP_SCOPE_KEY] === LOGIN_BASE_URI_SWEEP_VERSION) &&
         recordedIds[PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY] === archonOrgId &&
         !recordedIds[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY] &&
         Boolean(recordedIds[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY]) &&
@@ -3506,6 +3539,11 @@ function planArchon(platform, recordedIds, executorBlocked, ownerSignIn, ownerFi
                 recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY] ===
                     recordedIds[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY]
             : !recordedIds[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY]) &&
+        // The tick tokens the same way: minted after Archon's last apply means not in its env yet.
+        (platform.uptime.enabled
+            ? (recordedIds[PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY] ?? '') ===
+                uptimeTicksSyncValue(recordedIds)
+            : !recordedIds[PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY]) &&
         // #398: a rotated integrations key id Archon's env was not yet written
         // with (see PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY). Absent
         // before the first rotation on a platform applied before #398.

package/dist/plan/platform-org.d.ts

@@ -194,6 +194,12 @@ export interface OrgPlatformReadiness {
         unreadable?: readonly string[];
         invalid?: readonly string[];
     };
+    /**
+     * The Worker apps' `heldSecret` secrets that hold a value now: `<entry key>/<NAME>` -> the version of that
+     * value (a hash, `heldSecretVersion`; never the value). A secret with no entry here is unset. Absent reads as
+     * none held.
+     */
+    workerAppSecrets?: Readonly<Record<string, string>>;
     /**
      * The platform GitHub App's held keys (`PLATFORM_GITHUB_APP_REFS`), read only for a company that declares
      * `hosting.github`. `store` is false when the host wired no held-keys reader; `missing` are the refs that hold

package/dist/plan/platform-providers.d.ts

@@ -542,13 +542,15 @@ export declare const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = "platform-auth-login";
 export declare function zitadelDockerfile(): string;
 export declare const AUTH_LOGIN_PORT = "3000";
 /**
- * Every ZITADEL OIDC/management/console/asset path -- `deploy/proxy/Caddyfile`'s
- * own explicit list, restated here as one regex since the tunnel routes by a
+ * Every ZITADEL OIDC/management/asset path -- `deploy/proxy/Caddyfile`'s own
+ * explicit list, restated here as one regex since the tunnel routes by a
  * single `path` per ingress rule rather than a set. Anything not matching
  * falls through to the login app's own ingress rule below (login v2 answers
- * everything else, including the root).
+ * everything else, including the root). `/ui/console` and `/ui/login/*` (the
+ * v1 login) are left out on purpose: nobody reaches ZITADEL's own screens, so
+ * they land on the login app, which sends them back to the app.
  */
-export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
+export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
 /**
  * The broker's MCP authorization server (auth ADR 0002): its metadata and `/mcp-oauth/*`.
  * Checked before {@link AUTH_ZITADEL_PATH_PATTERN}, which takes every other `/.well-known` path.
@@ -1000,7 +1002,7 @@ export interface PlatformArchonDeps {
     releasePreviewMembers?: ReleasePreviewMembers;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri' | 'updateOidcAppPostLogoutRedirectUris' | 'getOidcAppRedirectUris' | 'updateOidcAppRedirectUris'>>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri' | 'listOrgs' | 'listProjects' | 'updateOidcAppPostLogoutRedirectUris' | 'getOidcAppRedirectUris' | 'updateOidcAppRedirectUris'>>;
     /**
      * {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client:
      * the owner company's own ZITADEL, by its issuer and the held-key reference of
@@ -1641,7 +1643,7 @@ export interface PlatformAccessProviderDeps {
     /** Edge's Access calls, at its recorded address (see {@link PlatformAccessFactory}). */
     access: (edgeUrl: string) => PlatformAccessProviderPort | Promise<PlatformAccessProviderPort>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'listApps' | 'deleteApp'> & Required<Pick<ZitadelPort, 'createOidcAppWithSecret'>>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'listApps' | 'deleteApp'> & Required<Pick<ZitadelPort, 'createOidcAppWithSecret'>> & Partial<Pick<ZitadelPort, 'updateOidcAppLoginBaseUri'>>;
     /** {@link PlatformArchonDeps.zitadelForInstance}: the ZITADEL client for the sign-in at `issuerUrl`. */
     zitadelForInstance?: (issuerUrl: string, bearerRef?: string) => PlatformAccessProviderDeps['zitadel'];
     /** Sleep and delivery tries for the one call that carries the secret; real ones by default. */

package/dist/plan/platform-providers.js

@@ -13,7 +13,7 @@ import { previewsOn } from './coolify-previews.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { desktopCallbackUri, unionRedirectUris } from './desktop-callback.js';
 import { placedOnPlatform } from './destinations.js';
-import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, setOidcAppLoginBaseUri, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
@@ -27,12 +27,13 @@ import { BROKER_DB_NAME, BROKER_DB_USER, ensureBrokerMcpEnv } from './broker-mcp
 import { withTimeout } from './call-timeout.js';
 import { SIGN_IN_BIND_KEY_ENV, SIGN_IN_BIND_KEY_MIN_LENGTH, SIGN_IN_BIND_KEY_SCOPE_KEY, } from './cookie-domain.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
+import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION } from './login-host.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
 import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAIL_DATABASE_SCOPE_KEY, MAIL_STORE_POSTGRES, MAIL_STORE_SCOPE_KEY, mailStoreIsLegacy, } from './mail-store.js';
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, orgDeclaresMcp, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, orgDeclaresMcp, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeTicksSyncValue, uptimeVarsDigest, } from './platform-diff.js';
 import { PLATFORM_REGISTRY_KEY, PLATFORM_REGISTRY_LOGINS_KEY, PLATFORM_REGISTRY_PASSWORDS_SET_SCOPE_KEY, PLATFORM_REGISTRY_PULL_PASSWORD_REF, registryImageTagBlocked, } from './platform-registry-keys.js';
 import { ensureRegistryLogins, provisionPlatformRegistry, registryLoginsDrifted, } from './platform-registry.js';
 import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
@@ -730,7 +731,10 @@ export class FoundryPlatformStepExecutor {
         const accessHeld = Boolean((await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF)) &&
             (await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF)));
         blocked.uptimeHeld = {
-            token: Boolean(await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF)),
+            // The Worker token and both tick tokens: the step is not applied while one is missing.
+            token: Boolean((await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF)) &&
+                (await deps.heldKeys.resolve(PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF)) &&
+                (await deps.heldKeys.resolve(PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF))),
             access: accessHeld,
             vars: uptimeVarsDigest(uptimeEffectiveVars(deps.vars, deps.chat && owner.chat && recordedIds[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY]
                 ? {
@@ -1473,17 +1477,18 @@ export const AUTH_LOGIN_PORT = '3000';
 /** `broker/Dockerfile`'s own `ENV PORT=3000` / `EXPOSE 3000`. */
 const AUTH_BROKER_PORT = '3000';
 /**
- * Every ZITADEL OIDC/management/console/asset path -- `deploy/proxy/Caddyfile`'s
- * own explicit list, restated here as one regex since the tunnel routes by a
+ * Every ZITADEL OIDC/management/asset path -- `deploy/proxy/Caddyfile`'s own
+ * explicit list, restated here as one regex since the tunnel routes by a
  * single `path` per ingress rule rather than a set. Anything not matching
  * falls through to the login app's own ingress rule below (login v2 answers
- * everything else, including the root).
+ * everything else, including the root). `/ui/console` and `/ui/login/*` (the
+ * v1 login) are left out on purpose: nobody reaches ZITADEL's own screens, so
+ * they land on the login app, which sends them back to the app.
  */
 // `v2`, `v2beta` and `zitadel.<service>` are ZITADEL's v2 REST and connect
 // APIs (providers' `inviteOrgOwner` calls `POST /v2/users`); without them those
-// calls reach the login app and answer 404. The login app itself lives under
-// `/ui/v2/login`, which none of these match.
-export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)';
+// calls reach the login app and answer 404. None of these match `/ui/*`.
+export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)';
 /**
  * `@wtfalch/auth`'s own `brokerUrl` default, `<issuer>/api`
  * (`packages/auth/src/config.ts`) -- `deploy/proxy/Caddyfile`'s own
@@ -4671,6 +4676,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
             // `docs/operator-deployment.md`, step 4).
             redirectUris: [`https://${hostname}/auth/callback`, desktopCallbackUri(hostname)],
             postLogoutRedirectUris: postLogoutUrisFor([hostname]),
+            // The owner company's login host: with `loginV2.required` off a client with none lands on the v1 login.
+            loginBaseUri: `https://${ownerSignIn.hostname}/`,
         });
         context.recordScopeId(PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, created.appId);
         context.recordScopeId(PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, postLogoutAppliedValue(created.appId, postLogoutUrisFor([hostname])));
@@ -4693,7 +4700,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const archonAppZitadelId = context.recordedIds()[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
     const inAppOwed = archonInAppHost(context.recordedIds()) !== '';
     const inAppCalls = () => {
-        const { ensureTrustedDomain, deleteTrustedDomain, updateOidcAppLoginBaseUri, allowPerAppLoginBaseUri, } = zitadel;
+        const { ensureTrustedDomain, deleteTrustedDomain, updateOidcAppLoginBaseUri, allowPerAppLoginBaseUri, listOrgs, listProjects, } = zitadel;
         if (!ensureTrustedDomain || !deleteTrustedDomain || !updateOidcAppLoginBaseUri) {
             throw new Error("platform:archon: the owner company's ZITADEL port lacks ensureTrustedDomain, deleteTrustedDomain or updateOidcAppLoginBaseUri, so Archon cannot sign in on its own address");
         }
@@ -4701,9 +4708,12 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
             ensureTrustedDomain: ensureTrustedDomain.bind(zitadel),
             deleteTrustedDomain: deleteTrustedDomain.bind(zitadel),
             updateOidcAppLoginBaseUri: updateOidcAppLoginBaseUri.bind(zitadel),
+            listApps: zitadel.listApps.bind(zitadel),
             ...(allowPerAppLoginBaseUri
                 ? { allowPerAppLoginBaseUri: allowPerAppLoginBaseUri.bind(zitadel) }
                 : {}),
+            ...(listOrgs ? { listOrgs: listOrgs.bind(zitadel) } : {}),
+            ...(listProjects ? { listProjects: listProjects.bind(zitadel) } : {}),
         };
     };
     const inAppTarget = {
@@ -4881,6 +4891,21 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const uptimeToken = uptimeTokenId ? await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF) : null;
     if (uptimeToken)
         envs.push({ key: 'UPTIME_TOKEN', value: uptimeToken });
+    // The two tick tokens, the same way. Foundry's held value replaces one set by hand, so the Worker
+    // and Archon hold the same value.
+    const ticksWanted = platform.uptime.enabled &&
+        Boolean(recorded[PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY]) &&
+        Boolean(recorded[PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY]);
+    const releaseTickToken = ticksWanted
+        ? await deps.heldKeys.resolve(PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF)
+        : null;
+    const auditSealTickToken = ticksWanted
+        ? await deps.heldKeys.resolve(PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF)
+        : null;
+    const ticksSyncValue = releaseTickToken && auditSealTickToken ? uptimeTicksSyncValue(recorded) : '';
+    if (releaseTickToken && auditSealTickToken) {
+        envs.push({ key: 'RELEASE_TICK_TOKEN', value: releaseTickToken }, { key: 'AUDIT_SEAL_TICK_TOKEN', value: auditSealTickToken });
+    }
     const changed = await envsDiffer(deps.coolify, appId, envs);
     // #467: this run's intended env set, hashed before anything below writes
     // it -- compared against {@link PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY}
@@ -4928,6 +4953,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     for (const stale of await deps.coolify.listEnvs(appId)) {
         // foundry#542: a disabled Worker's token leaves Archon's env too.
         const staleUptime = !platform.uptime.enabled && stale.key === 'UPTIME_TOKEN';
+        // The tick tokens go only if foundry wrote them: a hand-set one is not ours to remove.
+        const staleUptimeTick = !platform.uptime.enabled &&
+            Boolean(recorded[PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY]) &&
+            (stale.key === 'RELEASE_TICK_TOKEN' || stale.key === 'AUDIT_SEAL_TICK_TOKEN');
         // People now come from the owner company's store, so a first operator set by an older apply goes.
         const staleOperator = stale.key === 'AUTHZ_BOOTSTRAP_OPERATOR';
         // The link is written only while both ids are known; one that is no longer wanted goes.
@@ -4936,6 +4965,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         const staleSignIn = !inAppWanted && stale.key === SIGN_IN_UPSTREAM_ENV;
         if ((stale.key === 'FILES_MANAGEMENT_KEY' ||
             staleUptime ||
+            staleUptimeTick ||
             staleOperator ||
             staleLink ||
             staleSignIn) &&
@@ -5217,6 +5247,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
                 });
             }
             await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, `${hostname}=${clientId}`);
+            await record(LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION);
         }
         else if (inAppOwed) {
             if (!ownerSignIn.signInLoginAppId) {
@@ -5244,6 +5275,16 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         (!selfRedeploy || deployState === 'finished')) {
         await record(PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, '');
     }
+    if (!platform.uptime.enabled &&
+        recorded[PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY] &&
+        (!selfRedeploy || deployState === 'finished')) {
+        await record(PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY, '');
+    }
+    if (ticksSyncValue &&
+        recorded[PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY] !== ticksSyncValue &&
+        (!selfRedeploy || deployState === 'finished')) {
+        await record(PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY, ticksSyncValue);
+    }
     if (uptimeToken &&
         uptimeTokenId &&
         recorded[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY] !== uptimeTokenId &&
@@ -8320,6 +8361,11 @@ async function provisionPlatformAccessProvider(context, deps) {
     context.recordScopeId(PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, client.appId);
     context.recordScopeId(PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, client.appId);
     await context.persist?.();
+    // The owner company's login host, so the client never lands on the v1 login when `loginV2.required` is off.
+    // After the ids are persisted: a failure here leaves the app recorded and costs no second secret.
+    if (zitadel.updateOidcAppLoginBaseUri) {
+        await setOidcAppLoginBaseUri({ updateOidcAppLoginBaseUri: zitadel.updateOidcAppLoginBaseUri.bind(zitadel) }, org.id, project.id, client.appId, `https://${ownerSignIn.hostname}/`);
+    }
     let providerId = '';
     await deliverWithRetry(async (_ref, secret) => {
         providerId = (await access.ensureProvider({

package/dist/plan/providers-readers.js

@@ -1,5 +1,6 @@
 import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { APP_ENTRY_KEY } from '../org.js';
+import { ANALYTICS_MANAGED_ENV_KEYS } from './analytics.js';
 import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 import { previewsOn } from './coolify-previews.js';
 import { KOSMOS_MANAGED_ENV_KEYS } from './kosmos.js';
@@ -320,6 +321,19 @@ async function withKosmosEnvConfig(client, resource, recorded) {
     }
     return { ...resource, config: { ...resource.config, env } };
 }
+/** The recorded analytics backend's live env (`APP_URL`, `AUTH_ORGANIZATION_ID`) as `config.env`, read like {@link withKosmosEnvConfig}. */
+async function withAnalyticsEnvConfig(client, resource, recorded) {
+    if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('analytics:')) {
+        return resource;
+    }
+    const managed = ANALYTICS_MANAGED_ENV_KEYS;
+    const env = {};
+    for (const e of await client.listEnvs(resource.key)) {
+        if (!e.is_preview && managed.includes(e.key))
+            env[e.key] = e.value;
+    }
+    return { ...resource, config: { ...resource.config, env } };
+}
 /** `@wtfalch/providers`' own `LiveResource` (`resource.ts`) has no `system` field — foundry's adds it at this boundary. */
 function toFoundryResources(system, resources) {
     return resources.map((r) => ({ system, kind: r.kind, key: r.key, config: r.config }));
@@ -354,7 +368,8 @@ export class ProvidersCoolifyReader {
         const liveKeys = new Set(withAgoraConfig.map((r) => r.key));
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded, liveKeys)));
         const withKosmosConfig = await Promise.all(withBouleConfig.map((r) => withKosmosEnvConfig(this.client, r, recorded)));
-        return applyRecordedIds(withKosmosConfig, recorded);
+        const withAnalyticsConfig = await Promise.all(withKosmosConfig.map((r) => withAnalyticsEnvConfig(this.client, r, recorded)));
+        return applyRecordedIds(withAnalyticsConfig, recorded);
     }
     async liveEnvEquals(orgId, appKey, name, value) {
         const recorded = await this.resolveRecordedIds(orgId);