@wtfalch/foundry 0.66.0 → 0.68.0

package/dist/plan/executor.js

@@ -9,6 +9,8 @@ import { NATIVE_BUILD_KEY_ENV } from '../native-build.js';
 import { AI_ENTRY_PERMISSIONS, APPS_DOMAIN, APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, FULL_COMMIT_SHA, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, filesCollectionEnvName, heldEnvRef, isLiveEntry, isMainEntry, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
+import { ANALYTICS_BOULE_APPLIED_SCOPE_KEY, ANALYTICS_BOULE_ENV_NAMES, analyticsBouleMarker, } from './analytics-boule.js';
+import { ANALYTICS_DATABASE_SCOPE_KEY, ANALYTICS_DEPLOYED_SCOPE_KEY, ANALYTICS_OPERATOR_KEY_ENV, analyticsEnvDrift, analyticsHostnameFor, analyticsUrlFor, desiredAnalyticsEnv, } from './analytics.js';
 import { APPS_DATABASE_ADMIN_URL_ENV, applyAppsDbRoute, retireAppsDbRoute, } from './apps-db-route.js';
 import { APPS_ZONES_APPLIED_SCOPE_KEY, applyAppsZones, retireAppsZones } from './apps-zones.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, applyWorkspaceServer, } from './blue-green-apply.js';
@@ -38,6 +40,7 @@ import { createEdgeRateLimits, } from './edge-ratelimits.js';
 import { createEdgeTunnels } from './edge-tunnels.js';
 import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_KEY_DAYS, AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
+import { ENTRY_ANALYTICS_KEY_DELIVERY_ATTEMPTS, entryAnalyticsAppliedScopeKey, entryAnalyticsRetiredScopeKey, entryAnalyticsUndeliveredScopeKey, stageAnalyticsKeyName, } from './entry-analytics-key.js';
 import { applyEntryAudit } from './entry-audit.js';
 import { CUSTOMER_GRANTS_CREDENTIAL_ENV, CUSTOMER_GRANTS_ENV, CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY, customerGrantsEntries, customerGrantsJson, customerGrantsMintedScopeKey, customerGrantsRef, customerGrantsToDrop, ensureCustomerGrantsCredential, wantedCustomerGrants, } from './entry-customer-grants.js';
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, EDGE_SLUG_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, bouleEdgeKeyWanted, edgeKeyAppRecordKey, edgeKeyDomain, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
@@ -404,6 +407,10 @@ export const BOULE_PORT = 3000;
 export const KOSMOS_REPO = 'wtfalch/kosmos';
 export const KOSMOS_APP_DOCKERFILE = '/Dockerfile';
 export const KOSMOS_PORT = 3000;
+/** The company's analytics backend (https://github.com/wtfalch/analytics): root Dockerfile, serves on 3000, migrates in its own start script. */
+export const ANALYTICS_REPO = 'wtfalch/analytics';
+export const ANALYTICS_APP_DOCKERFILE = '/Dockerfile';
+export const ANALYTICS_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -969,6 +976,8 @@ function limitProfileOf(action) {
             return LIMITS.boule;
         case 'coolify:kosmos':
             return LIMITS.kosmos;
+        case 'coolify:analytics':
+            return LIMITS.analytics;
         case 'coolify:broker-registrar':
             return LIMITS.brokerEntry;
         case 'coolify:keys-registrar':
@@ -1404,6 +1413,12 @@ export class FoundryStepExecutor {
                 return this.bouleBrokerEntry(org, context);
             case 'coolify:kosmos':
                 return this.coolifyKosmos(action, org, context);
+            case 'coolify:analytics':
+                return this.coolifyAnalytics(action, org, context);
+            case 'coolify:analytics-boule':
+                return this.analyticsBoule(action, org, context);
+            case 'analytics:key':
+                return this.analyticsEntryKey(action, org, context);
             case 'coolify:broker-registrar':
                 return this.brokerRegistrar(org, context);
             case 'coolify:keys-registrar':
@@ -3831,8 +3846,34 @@ export class FoundryStepExecutor {
                     : { id: registered.id, name: projectName };
             },
         };
+        const analytics = {
+            held: held('analytics'),
+            available: async () => canHold &&
+                Boolean(this.ports.analytics) &&
+                Boolean(context.recordedIds()[`coolify:analytics:${org.id}`]) &&
+                entry?.uses?.analytics === true,
+            create: async () => {
+                const port = this.ports.analytics;
+                if (!port)
+                    throw new Error('no analytics port');
+                const operatorKey = await this.analyticsOperatorKey(org, context);
+                const name = stageAnalyticsKeyName(org, subject.id);
+                const minted = await port.mintSiteKey({
+                    baseUrl: analyticsUrlFor(org),
+                    operatorKey,
+                    name,
+                    environment: 'stage',
+                });
+                return {
+                    id: minted.id,
+                    name,
+                    keyIds: [minted.id],
+                    secrets: [{ env: 'ANALYTICS_SITE_KEY', value: minted.secret }],
+                };
+            },
+        };
         const prodJobsProjectId = context.recordedIds()[`jobs:registration:${org.id}`];
-        return { files, ai, jobs, ...(prodJobsProjectId ? { prodJobsProjectId } : {}) };
+        return { files, ai, jobs, analytics, ...(prodJobsProjectId ? { prodJobsProjectId } : {}) };
     }
     /**
      * Stage's own sign-in (`plan/stage-signin.ts`): a client named `<production client>-stage` on production's
@@ -7859,6 +7900,254 @@ export class FoundryStepExecutor {
         this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
+    // ---- analytics backend ----------------------------------------------------
+    /**
+     * `plan/diff.ts`'s `planAnalyticsBackend`: the company's analytics backend as one more Coolify application
+     * from https://github.com/wtfalch/analytics's root Dockerfile ({@link ANALYTICS_REPO}), with a database of its
+     * own, shaped like {@link coolifyKosmos}. Its start script migrates as the owner role and then serves as the
+     * runtime role, so `pushDatabaseUrl` gives it both URLs. It needs no sign-in client: it reads only
+     * `AUTH_ORGANIZATION_ID` (the tenant id derives from it), `APP_URL` and the operator key.
+     *
+     * `ANALYTICS_OPERATOR_KEY` is made once here (`mintIfAbsent`) and written only to this app's env. No outside
+     * service shows it once, so no undelivered marker is needed: a failed write leaves nothing live to mint twice.
+     * Steps that call the backend's operator API read it back from this env.
+     *
+     * A brand new app is deployed once ({@link ANALYTICS_DEPLOYED_SCOPE_KEY}), as for Boule (#504).
+     */
+    async coolifyAnalytics(_action, org, context) {
+        const { env, missing } = desiredAnalyticsEnv(org, context.recordedIds());
+        if (missing.length > 0) {
+            throw new Error(`the analytics backend for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
+        }
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const name = `${org.slug}-analytics`;
+        const dbName = `${org.slug}-analytics-db`.replace(/-/g, '_');
+        const dbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, `${org.slug}-analytics-db`, dbName, ANALYTICS_DATABASE_SCOPE_KEY);
+        context.recordScopeId(ANALYTICS_DATABASE_SCOPE_KEY, dbId);
+        const server = await this.resolveServer(org, context);
+        const githubApp = await this.ports.coolify.requireGithubApp();
+        const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            github_app_uuid: githubApp.uuid,
+            git_repository: ANALYTICS_REPO,
+            git_branch: 'main',
+            build_pack: 'dockerfile',
+            name,
+            domains: coolifyTunnelDomains([analyticsHostnameFor(org)]),
+            dockerfile_location: ANALYTICS_APP_DOCKERFILE,
+        }));
+        await this.ensureLogVolume(app.appId, org, app.existed);
+        await this.ports.coolify.updateApplication(app.appId, {
+            ...healthCheckSettings('/api/health', ANALYTICS_PORT),
+            ...(await this.routedLabels(name, analyticsHostnameFor(org), ANALYTICS_PORT)),
+        });
+        const liveEnv = Object.fromEntries((await this.ports.coolify.listEnvs(app.appId))
+            .filter((e) => !e.is_preview)
+            .map((e) => [e.key, e.value]));
+        const envChanged = analyticsEnvDrift(env, liveEnv).length > 0;
+        const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
+        const operatorKey = await this.mintIfAbsent(app.appId, ANALYTICS_OPERATOR_KEY_ENV, 32);
+        if (operatorKey) {
+            this.handledSecrets.add(operatorKey);
+            envs.push({ key: ANALYTICS_OPERATOR_KEY_ENV, value: operatorKey });
+        }
+        try {
+            await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        }
+        catch (error) {
+            if (!operatorKey)
+                throw error;
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), [operatorKey]));
+        }
+        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName);
+        if (!dbPush.pushed) {
+            throw new Error(`the analytics backend for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        if (!context.recordedIds()[ANALYTICS_DEPLOYED_SCOPE_KEY]) {
+            const runtime = this.ports.runtime ?? {};
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), analyticsHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:analytics', `${org.slug}'s analytics backend stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'analytics' }, (key, value) => context.recordScopeId(key, value));
+            context.recordScopeId(ANALYTICS_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (app.existed && (envChanged || operatorKey !== null || dbPush.changed)) {
+            await this.ports.coolify.restart(app.appId);
+        }
+        return { resourceId: app.appId };
+    }
+    /** The backend's operator key, read from its own env. Fixed text when the backend or the key is not there. */
+    async analyticsOperatorKey(org, context) {
+        const appId = context.recordedIds()[`coolify:analytics:${org.id}`];
+        if (!appId)
+            throw new Error(`the analytics backend for ${org.slug} is not recorded yet`);
+        const rows = await this.ports.coolify.listEnvs(appId);
+        const key = rows.find((e) => e.key === ANALYTICS_OPERATOR_KEY_ENV && !e.is_preview)?.value;
+        if (!key)
+            throw new Error(`the analytics backend for ${org.slug} has no operator key yet`);
+        this.handledSecrets.add(key);
+        return key;
+    }
+    /**
+     * C2 `coolify:analytics-boule` (`plan/analytics-boule.ts`): the backend's address and operator key into
+     * Boule's env, then Boule restarts. `analytics_boule_applied` is recorded last. Retire takes both names away.
+     */
+    async analyticsBoule(action, org, context) {
+        const at = `coolify:analytics-boule for ${org.slug}`;
+        const recorded = context.recordedIds();
+        const bouleId = recorded[`coolify:boule:${org.id}`];
+        if (!bouleId)
+            throw new Error(`${at}: Boule is not recorded yet`);
+        if (action.desired.mode === 'retire') {
+            const rows = await this.ports.coolify.listEnvs(bouleId);
+            for (const name of ANALYTICS_BOULE_ENV_NAMES) {
+                const row = rows.find((e) => e.key === name && !e.is_preview);
+                if (row?.uuid) {
+                    try {
+                        await this.ports.coolify.deleteEnv(bouleId, row.uuid);
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                }
+            }
+            await this.ports.coolify.restart(bouleId);
+            context.recordScopeId(ANALYTICS_BOULE_APPLIED_SCOPE_KEY, '');
+            return {};
+        }
+        if (!appsOn(org))
+            throw new Error(`${at}: the company's Boule runs no apps (org.boule.apps)`);
+        const backendId = recorded[`coolify:analytics:${org.id}`];
+        if (!backendId)
+            throw new Error(`${at}: the analytics backend is not recorded yet`);
+        const operatorKey = await this.analyticsOperatorKey(org, context);
+        try {
+            await this.ports.coolify.bulkUpsertEnvs(bouleId, [
+                { key: 'ANALYTICS_URL', value: analyticsUrlFor(org), literal: true },
+                { key: ANALYTICS_OPERATOR_KEY_ENV, value: operatorKey, literal: true },
+            ]);
+            await this.ports.coolify.restart(bouleId);
+        }
+        catch (error) {
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), [operatorKey]));
+        }
+        context.recordScopeId(ANALYTICS_BOULE_APPLIED_SCOPE_KEY, analyticsBouleMarker(org, backendId));
+        return {};
+    }
+    /**
+     * `plan/entry-analytics-key.ts`: one server entry's site key (CLAUDE.md "Platform steps" rule 1). Mint: the
+     * key's id is recorded as undelivered and persisted before anything is written; the env write is tried 3
+     * times with the same secret; the applied address and the cleared marker come last; every try failing leaves
+     * the marker, and the error names the id only. `url` rewrites the address. Retire revokes the key and the
+     * env names. The operator key is read from the backend's env and never recorded.
+     */
+    async analyticsEntryKey(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `analytics:key for ${org.slug} entry '${entryKey}'`;
+        const analytics = this.ports.analytics;
+        if (!analytics)
+            throw new Error(`${at}: this executor was built without an analytics port`);
+        const desired = action.desired;
+        const recorded = context.recordedIds();
+        const appId = recorded[`coolify:app:${action.key}`];
+        const baseUrl = analyticsUrlFor(org);
+        const tolerate = async (call, gone) => {
+            try {
+                return await call();
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+                return gone;
+            }
+        };
+        if (desired.mode === 'retire') {
+            const mainId = recorded[`analytics:key:${action.key}`];
+            const undelivered = recorded[entryAnalyticsUndeliveredScopeKey(entryKey)];
+            const ids = [...new Set([mainId, undelivered].filter((id) => Boolean(id)))];
+            if (ids.length > 0) {
+                const operatorKey = await this.analyticsOperatorKey(org, context);
+                for (const keyId of ids) {
+                    await tolerate(() => analytics.revokeSiteKey({ baseUrl, operatorKey, keyId }), undefined);
+                }
+            }
+            if (appId) {
+                const rows = await tolerate(() => this.ports.coolify.listEnvs(appId), []);
+                let removed = false;
+                for (const name of ['ANALYTICS_URL', 'ANALYTICS_SITE_KEY']) {
+                    const row = rows.find((e) => e.key === name && !e.is_preview);
+                    if (row?.uuid) {
+                        const uuid = row.uuid;
+                        await tolerate(() => this.ports.coolify.deleteEnv(appId, uuid), undefined);
+                        removed = true;
+                    }
+                }
+                if (removed)
+                    await tolerate(() => this.ports.coolify.restart(appId), undefined);
+            }
+            context.recordScopeId(entryAnalyticsUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryAnalyticsAppliedScopeKey(entryKey), '');
+            if (mainId ?? undelivered) {
+                context.recordScopeId(entryAnalyticsRetiredScopeKey(entryKey), (mainId ?? undelivered));
+            }
+            return {};
+        }
+        if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.analytics)) {
+            throw new Error(`${at}: the entry no longer declares uses.analytics`);
+        }
+        if (!appId)
+            throw new Error(`${at}: the entry's app is not recorded yet`);
+        if (desired.mode === 'url') {
+            await this.ports.coolify.bulkUpsertEnvs(appId, [
+                { key: 'ANALYTICS_URL', value: baseUrl, literal: true },
+            ]);
+            await this.ports.coolify.restart(appId);
+            context.recordScopeId(entryAnalyticsAppliedScopeKey(entryKey), baseUrl);
+            return {};
+        }
+        if (recorded[entryAnalyticsUndeliveredScopeKey(entryKey)]) {
+            throw new Error(`${at}: a key was minted and never delivered; it is not minted again`);
+        }
+        const operatorKey = await this.analyticsOperatorKey(org, context);
+        let minted;
+        try {
+            minted = await analytics.mintSiteKey({
+                baseUrl,
+                operatorKey,
+                name: desired.name,
+                environment: 'production',
+            });
+        }
+        catch (error) {
+            const status = error?.status;
+            throw new Error(`${at}: the backend did not mint a key${typeof status === 'number' ? ` (status ${status})` : ''}`);
+        }
+        this.handledSecrets.add(minted.secret);
+        context.recordScopeId(entryAnalyticsUndeliveredScopeKey(entryKey), minted.id);
+        await context.persistScopeIds();
+        const rows = [
+            { key: 'ANALYTICS_URL', value: baseUrl, literal: true },
+            { key: 'ANALYTICS_SITE_KEY', value: minted.secret, literal: true },
+        ];
+        let lastError;
+        for (let attempt = 1; attempt <= ENTRY_ANALYTICS_KEY_DELIVERY_ATTEMPTS; attempt++) {
+            try {
+                await this.ports.coolify.bulkUpsertEnvs(appId, rows);
+                await this.ports.coolify.restart(appId);
+                context.recordScopeId(entryAnalyticsAppliedScopeKey(entryKey), baseUrl);
+                context.recordScopeId(entryAnalyticsUndeliveredScopeKey(entryKey), '');
+                return { resourceId: minted.id };
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_ANALYTICS_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'})`);
+    }
     // ---- kosmos (foundry#949) --------------------------------------------------
     /**
      * `plan/diff.ts`'s `planKosmos`: provisions the org's own kosmos

package/dist/plan/hostnames.js

@@ -2,6 +2,7 @@ import { INBOX_HOST_PREFIX, WORKSPACE_HOST_PREFIX } from '../hosted-label.js';
 import { APPS_DOMAIN, isMainEntry, mainEntry } from '../org.js';
 import { workerAppHostnameOf } from '../worker-app-config.js';
 import { agoraHostnameFor } from './agora.js';
+import { analyticsHostnameFor, analyticsWanted } from './analytics.js';
 import { bouleHostnameFor } from './boule.js';
 import { workspaceWorkerParent } from './workspace-worker.js';
 /**
@@ -154,6 +155,9 @@ export function tunnelIngressHostnames(org, loginHost = null) {
         hostnames.push(agoraHostnameFor(org));
         // #161: and Boule moves onto `boule.<domain>` the same way.
         hostnames.push(bouleHostnameFor(org));
+        // The analytics backend's route, only while something uses it.
+        if (analyticsWanted(org))
+            hostnames.push(analyticsHostnameFor(org));
     }
     const share = filesShareHostname(org);
     if (share)

package/dist/plan/index.d.ts

@@ -1,4 +1,6 @@
 export type { KeysRegistrarPort } from './keys-registrar.js';
+export type { AnalyticsPort } from './analytics.js';
+export { httpAnalytics } from './analytics.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, } from './live.js';
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export type { StepAction, PlannedStep, PlanDetail, OrgPostgresPlan } from './diff.js';

package/dist/plan/index.js

@@ -1,3 +1,4 @@
+export { httpAnalytics } from './analytics.js';
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';

package/dist/plan/live.d.ts

@@ -42,7 +42,7 @@ export interface LiveResource {
      * see that function's own doc comment for why "always planned" broke
      * `bootstrapPlatform`.
      */
-    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats' | 'github' | 'audit';
+    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats' | 'github' | 'audit' | 'analytics';
     kind: string;
     key: string;
     config: Record<string, unknown>;

package/dist/plan/locked-hostnames.js

@@ -1,6 +1,7 @@
 import { kosmosOn, ownsServices } from '../org.js';
 import { OWN_SERVICE_LABELS } from '../service-labels.js';
 import { agoraHostnameFor } from './agora.js';
+import { analyticsHostnameFor } from './analytics.js';
 import { bouleHostnameFor } from './boule.js';
 import { cmsStudioHostnameFor, siteHostnameFor } from './hostnames.js';
 import { kosmosHostnameFor } from './kosmos.js';
@@ -32,6 +33,8 @@ export function lockedHostnames(org, platformHostnames) {
     }
     locked.add(agoraHostnameFor(org));
     locked.add(bouleHostnameFor(org));
+    // Reserved always, planned only while something uses analytics (`analyticsWanted`).
+    locked.add(analyticsHostnameFor(org));
     if (kosmosOn(org))
         locked.add(kosmosHostnameFor(org));
     if (org.site.enabled)

package/dist/plan/org-names.d.ts

@@ -6,13 +6,13 @@ export type OrgNameSource = 'own' | 'hosting';
  * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
  * calls and the cms site while they are on.
  */
-export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site' | 'kosmos'>): string[];
+export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule' | 'hosting'>): string[];
 /**
  * Every container name, network alias, database, tunnel and bucket name that
  * foundry derives for an org: its own-service names when it owns services,
  * and its hosting-entry and database names.
  */
-export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>): {
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule'>): {
     name: string;
     source: OrgNameSource;
 }[];
@@ -26,5 +26,5 @@ export interface NameClash {
     source: OrgNameSource;
 }
 /** Every name `org` derives that another org or the platform also derives. */
-export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>[]): NameClash[];
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos' | 'boule'>[]): NameClash[];
 export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -1,5 +1,6 @@
 import { kosmosOn, ownsServices } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
+import { analyticsWanted } from './analytics.js';
 import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
 import { workerAppHostname, workspaceHost, workspaceInboxHost } from './hostnames.js';
 import { orgTarget, platformTarget } from './own-services.js';
@@ -20,6 +21,8 @@ export function companyServiceNames(org) {
         `${s}-tunnel`,
         `${s}-cloudflared`,
     ];
+    if (analyticsWanted(org))
+        names.push(`${s}-analytics`, `${s}-analytics-db`);
     if (kosmosOn(org))
         names.push(`${s}-kosmos`, `${s}-kosmos-db`);
     if (org.chat?.enabled) {

package/dist/plan/own-limits.d.ts

@@ -113,6 +113,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly analytics: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly companyOther: {
         memory: string;
         dbMemory: string;

package/dist/plan/own-limits.js

@@ -30,6 +30,7 @@ export const LIMITS = {
     agora: profile('1g', '512m'),
     boule: profile('512m'),
     kosmos: profile('512m'),
+    analytics: profile('512m', '512m'),
     companyOther: profile('1g', '512m'),
     platformArchon: profile('1g'),
     platformAi: profile('1g'),

package/dist/plan/plan-apply.d.ts

@@ -583,6 +583,8 @@ export interface FoundryPlanApplyOptions {
     workerAppKeysUrl?: string;
     /** F7: the keys service's registrar address, when the executor has a `KeysRegistrarPort`. */
     keysRegistrarUrl?: string;
+    /** True when the host's executor was built with an `analytics` port. A `uses.analytics` key is blocked without it. */
+    analyticsPort?: boolean;
     /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
     workerAppDatabase?: boolean;
     /** True when that port has `deletableTables`. A `workerApp.database.noDelete` is blocked without it. */
@@ -747,6 +749,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly workerApps;
     private readonly workerAppKeysUrl;
     private readonly keysRegistrarUrl;
+    private readonly analyticsPort;
     private readonly workerAppDatabase;
     private readonly workerAppNoDeleteCheck;
     private readonly workerAppRegistryAccountId;

package/dist/plan/plan-apply.js

@@ -188,6 +188,7 @@ export class FoundryPlanApply {
     workerApps;
     workerAppKeysUrl;
     keysRegistrarUrl;
+    analyticsPort;
     workerAppDatabase;
     workerAppNoDeleteCheck;
     workerAppRegistryAccountId;
@@ -233,6 +234,7 @@ export class FoundryPlanApply {
         this.workerApps = options.workerApps ?? false;
         this.workerAppKeysUrl = options.workerAppKeysUrl;
         this.keysRegistrarUrl = options.keysRegistrarUrl;
+        this.analyticsPort = options.analyticsPort ?? false;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
         this.workerAppNoDeleteCheck = options.workerAppNoDeleteCheck ?? false;
         this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
@@ -1177,7 +1179,12 @@ export class FoundryPlanApply {
         const primaryUuid = context.recordedIds()[PRIMARY_SERVER_SCOPE_KEY];
         if (!store || !this.executor.releaseHost || !primaryUuid)
             return out;
-        const subjects = blueGreenSubjects(org, context.recordedIds());
+        // #1019: Boule and Agora are our own products, so their blue/green release only runs for the
+        // platform's own company; any other company's declaration was never planned as a structure, and a
+        // leftover one is not run here either.
+        const declaredPlatform = await this.platformDeps?.store.get();
+        const ownerOrgId = declaredPlatform?.ownerOrgId ?? null;
+        const subjects = blueGreenSubjects(org, context.recordedIds()).filter((s) => (s.builtin !== 'boule' && s.builtin !== 'agora') || ownerOrgId === org.id);
         // A copy waits while any subject of the org has a release running: the runner must stay free to roll back.
         if (copies === 'claim' && releaseRunning(subjects, context.recordedIds()))
             return out;
@@ -1627,6 +1634,7 @@ export class FoundryPlanApply {
             workerApps: this.workerApps,
             workerAppKeysUrl: this.workerAppKeysUrl,
             keysRegistrarUrl: this.keysRegistrarUrl,
+            analyticsPort: this.analyticsPort,
             workerAppDatabase: this.workerAppDatabase,
             workerAppNoDeleteCheck: this.workerAppNoDeleteCheck,
             workerAppRegistryAccountId: this.workerAppRegistryAccountId,
@@ -2665,6 +2673,8 @@ const STEP_FIELDS = {
     'cloudflare:worker': 'hosting.entries.worker',
     'cloudflare:worker-app': 'hosting.entries.workerApp',
     // F4 (#925): both hang off the company's Apps switch.
+    'coolify:analytics': 'hosting.entries.uses.analytics',
+    'coolify:analytics-boule': 'boule.apps',
     'coolify:org-apps-admin': 'boule.apps',
     'cloudflare:apps-db-route': 'boule.apps',
     'cloudflare:apps-zones': 'boule.apps',
@@ -2688,6 +2698,10 @@ function stepField(action) {
     // An entry's jobs project: always `<orgId>:<entry>`.
     if (action.system === 'jobs' && action.kind === 'project')
         return 'hosting.entries.uses.jobs';
+    // An entry's analytics site key: always `<orgId>:<entry>`.
+    if (action.system === 'analytics' && action.kind === 'key') {
+        return 'hosting.entries.uses.analytics';
+    }
     // An entry's audit ledger registration: always `<orgId>:<entry>`.
     if (action.system === 'audit' && action.kind === 'ledger')
         return 'hosting.entries.uses.audit';

package/dist/plan/platform-diff.d.ts

@@ -1117,6 +1117,13 @@ export declare const PLATFORM_UPTIME_KV_TITLE = "platform-uptime";
  * a blocked item, never a throw.
  */
 export declare const PLATFORM_UPTIME_TOKEN_REF = "uptime:worker:token";
+/**
+ * The release tick and audit seal tick tokens: minted by the step like `UPTIME_TOKEN`, each its own
+ * value, set on the Worker and on Archon's env under the same names. The Worker skips a tick while
+ * its token is unset, and Archon's route refuses every call while its own is unset.
+ */
+export declare const PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF = "uptime:worker:release-tick-token";
+export declare const PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF = "uptime:worker:audit-seal-tick-token";
 export declare const PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF = "uptime:worker:access-client-id";
 export declare const PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF = "uptime:worker:access-client-secret";
 export declare const PLATFORM_UPTIME_CHAT_TOKEN_REF = "uptime:worker:chat-token";
@@ -1138,6 +1145,15 @@ export declare const PLATFORM_UPTIME_OPTIONAL_SECRETS: Readonly<Record<string, s
  */
 export declare const PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY = "uptime_token_undelivered";
 export declare const PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY = "uptime_token_id";
+/** The same pair of scope keys for each tick token: `<undelivered>` before the value is held, `<id>` once it is. */
+export declare const PLATFORM_UPTIME_RELEASE_TICK_UNDELIVERED_SCOPE_KEY = "uptime_release_tick_undelivered";
+export declare const PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY = "uptime_release_tick_id";
+export declare const PLATFORM_UPTIME_AUDIT_SEAL_TICK_UNDELIVERED_SCOPE_KEY = "uptime_audit_seal_tick_undelivered";
+export declare const PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY = "uptime_audit_seal_tick_id";
+/** The tick token ids (`<release>:<seal>`) Archon's env was last written with; like {@link PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY}. */
+export declare const PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY = "archon_uptime_ticks_synced";
+/** What {@link PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY} holds once Archon's env carries the tick tokens; empty while neither is minted. */
+export declare function uptimeTicksSyncValue(recorded: Readonly<Record<string, string>>): string;
 /** The token id Archon's env was last written with; `planArchon` plans again when it differs from {@link PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY}. */
 export declare const PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY = "archon_uptime_token_synced";
 /** The tag, sha256 and Archon hostname the last successful run applied; a change plans the step again and mints nothing. */
@@ -1171,7 +1187,7 @@ export declare function uptimeEffectiveVars(hostVars: Readonly<Record<string, st
 } | null): Record<string, string | undefined>;
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export declare function uptimeVarsDigest(vars?: Readonly<Record<string, string | undefined>>): string;
-/** The Worker secret names the step sets: the three it mints, and each held one. */
+/** The Worker secret names the step sets: the five it mints, and each held one. */
 export declare function uptimeSecretNames(held: readonly string[]): string;
 /** The Access service token's name at Cloudflare; edge answers `conflict` when a token of this name exists. */
 export declare const PLATFORM_UPTIME_ACCESS_TOKEN_NAME = "platform-uptime";