@wtfalch/foundry 0.73.0 → 0.75.0

package/dist/index.d.ts

@@ -22,9 +22,9 @@ export { StaleLeaseError } from './store.js';
 export type { PlanApply, DestroyProgress } from './apply.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
-export type { Color, ReleaseAction, ReleaseEvent, ReleaseEventKind, ReleaseSeries, ReleaseSeriesColor, ReleaseSignal, ReleaseState, WindowState, } from './release/types.js';
+export type { Color, ReleaseAction, ReleaseEvent, ReleaseEventKind, ReleaseSeries, ReleaseSeriesColor, ReleaseRequirement, ReleaseSignal, ReleaseState, ReleasedVersion, WindowState, } from './release/types.js';
 export type { ReleaseStore } from './release/state.js';
-export { readReleaseHistory, readReleaseState, requestReleaseAction } from './release/state.js';
+export { readReleaseHistory, readReleasedVersions, readReleaseState, requestReleaseAction, rescheduleRelease, } from './release/state.js';
 export type { BuiltinFanOut, FanOutApp, FanOutOrgState } from './release/fanout.js';
 export { readBuiltinFanOut } from './release/fanout.js';
 export type { ReleaseSeriesHost, ReleaseSeriesQuery } from './release/series.js';

package/dist/index.js

@@ -14,7 +14,7 @@ export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_RE
 export { StaleLeaseError } from './store.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
-export { readReleaseHistory, readReleaseState, requestReleaseAction } from './release/state.js';
+export { readReleaseHistory, readReleasedVersions, readReleaseState, requestReleaseAction, rescheduleRelease, } from './release/state.js';
 export { readBuiltinFanOut } from './release/fanout.js';
 export { readReleaseSeries } from './release/series.js';
 export { readEntryReleaseSeries } from './plan/release-series-reader.js';

package/dist/migrations/0071_release_request_schedule.sql

@@ -0,0 +1,12 @@
+-- @wtfalch/foundry: a release request can wait for a time. `not_before` is null for every request made
+-- until now, so each of them stays due at once. The release runner reads only the open rows whose time has come.
+-- `claimed_at` is set when the runner starts a due go-live: from then on it can no longer be cancelled or moved.
+-- Additive: two nullable columns and one partial index; no existing row is touched.
+-- Mirrors src/store/schema.ts's `foundryReleaseRequests`.
+
+alter table foundry_release_requests add column if not exists not_before timestamptz;
+alter table foundry_release_requests add column if not exists claimed_at timestamptz;
+
+create index if not exists foundry_release_requests_scheduled_idx
+  on foundry_release_requests (org_id, entry_key, not_before)
+  where consumed_at is null and not_before is not null;

package/dist/plan/broker-mcp.d.ts

@@ -8,6 +8,13 @@ import { type JobRuntime } from './job-app.js';
  */
 export declare const MCP_DATABASE_URL_ENV = "MCP_DATABASE_URL";
 export declare const MCP_OAUTH_SECRET_ENV = "MCP_OAUTH_SECRET";
+/**
+ * The key that seals the broker's shared auth state (`wtfalch/auth` broker/src/auth/state-config.ts). The
+ * broker runs in shared mode whenever `MCP_DATABASE_URL` is set and exits at boot without this key: at
+ * least 32 bytes, the same on every replica, never regenerated. `AUTH_STATE_SECRET_PREVIOUS` (rotation)
+ * is the operator's and is never touched here.
+ */
+export declare const AUTH_STATE_SECRET_ENV = "AUTH_STATE_SECRET";
 /** The broker's own role and database on the sign-in Postgres. */
 export declare const BROKER_DB_NAME = "broker";
 export declare const BROKER_DB_USER = "broker";

package/dist/plan/broker-mcp.js

@@ -11,6 +11,13 @@ import { SIGNIN_DB_CA_MOUNT, boundedCall } from './signin-db.js';
  */
 export const MCP_DATABASE_URL_ENV = 'MCP_DATABASE_URL';
 export const MCP_OAUTH_SECRET_ENV = 'MCP_OAUTH_SECRET';
+/**
+ * The key that seals the broker's shared auth state (`wtfalch/auth` broker/src/auth/state-config.ts). The
+ * broker runs in shared mode whenever `MCP_DATABASE_URL` is set and exits at boot without this key: at
+ * least 32 bytes, the same on every replica, never regenerated. `AUTH_STATE_SECRET_PREVIOUS` (rotation)
+ * is the operator's and is never touched here.
+ */
+export const AUTH_STATE_SECRET_ENV = 'AUTH_STATE_SECRET';
 /** The broker's own role and database on the sign-in Postgres. */
 export const BROKER_DB_NAME = 'broker';
 export const BROKER_DB_USER = 'broker';
@@ -84,9 +91,18 @@ export async function ensureBrokerMcpEnv(input) {
         throw new Error(`${input.label}: the broker lost its ${MCP_OAUTH_SECRET_ENV} between two reads`);
     }
     runtime.onSecret?.(secret);
+    // The same rule as the OAuth secret: minted once, a live value (hand-set too) is kept, and it is written
+    // wherever `MCP_DATABASE_URL` is, so a broker never has the one without the other.
+    const mintedState = await ensureGeneratedEnv(coolify, brokerAppId, AUTH_STATE_SECRET_ENV, () => randomBytes(32).toString('hex'), MCP_OAUTH_SECRET_MIN_LENGTH);
+    const stateSecret = mintedState ?? (await currentEnvValue(coolify, brokerAppId, AUTH_STATE_SECRET_ENV));
+    if (!stateSecret) {
+        throw new Error(`${input.label}: the broker lost its ${AUTH_STATE_SECRET_ENV} between two reads`);
+    }
+    runtime.onSecret?.(stateSecret);
     return [
         { key: MCP_DATABASE_URL_ENV, value: url },
         { key: MCP_OAUTH_SECRET_ENV, value: secret },
+        { key: AUTH_STATE_SECRET_ENV, value: stateSecret },
     ];
 }
 /** Runs the job once, waits for it, deletes it. Every error is fixed text with the app id, never a cause. */

package/dist/plan/diff.js

@@ -48,7 +48,7 @@ import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY,
 import { ownDnsHostnames } from './own-dns.js';
 import { ownHostnames } from './own-hostnames.js';
 import { platformMailMxHost } from './platform-diff.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appImageAppliedScopeKey, appSecretAvailability, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, entryImageRef, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
+import { AUTH_MCP_ENV_VERSION, CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appImageAppliedScopeKey, appSecretAvailability, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, entryImageRef, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutUpdateOwed, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
@@ -4611,7 +4611,9 @@ export function planBrokerEntries(org, recordedIds, plannedSteps, brokerWired, b
         // Auth ADR 0002: a broker given an `mcp` entry before it holds its database and secret exits at boot.
         // A company's own sign-in step sets them and records it; a shared org's broker is the platform's, whose
         // marker this plan cannot see, so `writeBrokerEntry` refuses there until the platform step has run.
-        if (auth.mcp && ownsServices(org) && recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] !== '1') {
+        if (auth.mcp &&
+            ownsServices(org) &&
+            recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] !== AUTH_MCP_ENV_VERSION) {
             blocked.push({
                 description: `${at} is blocked, not planned: the broker's MCP database and secret are not set yet (the sign-in step sets them)`,
                 key,

package/dist/plan/own-diff.js

@@ -13,7 +13,7 @@ import { ownHostnames, passkeyRpIdFor } from './own-hostnames.js';
 import { JOBS_PUBLIC_URL_SCOPE_KEY, OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY } from './own-jobs-route.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
-import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_MCP_ENV_VERSION, AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
 import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
 import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn, signInLoginNames } from './sign-in.js';
@@ -273,7 +273,7 @@ export function planOwnAuth(options) {
         (options.signinMailWritable === false ||
             recordedIds[PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY] === signinMailMarker(org.displayName)) &&
         // An entry with `mcp` needs the broker's database and secret (auth ADR 0002).
-        (!orgDeclaresMcp(org) || recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] === '1') &&
+        (!orgDeclaresMcp(org) || recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] === AUTH_MCP_ENV_VERSION) &&
         (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry) &&
         // In-app sign-in: the second login app is recorded once it is deployed and holds the token, which
         // needs the login client; until the broker holds an entry that cannot be, so the step waits.

package/dist/plan/plan-apply.js

@@ -1207,6 +1207,8 @@ export class FoundryPlanApply {
                 host,
                 context,
                 now: this.now(),
+                nowFn: () => this.now(),
+                ...(ownerOrgId !== null ? { ownerOrgId } : {}),
                 primaryUuid,
                 ...(copies === 'defer' ? { deferCopies: true } : {}),
             });
@@ -1248,6 +1250,7 @@ export class FoundryPlanApply {
             host,
             context,
             now: this.now(),
+            nowFn: () => this.now(),
             primaryUuid,
             ...(copies === 'defer' ? { deferCopies: true } : {}),
         });

package/dist/plan/platform-diff.d.ts

@@ -87,11 +87,16 @@ export declare function authLoginEnvMarker(smtpSender: string, passkeyRpId?: str
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export declare const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = "auth_login_env_applied";
 /**
- * `'1'` once the broker holds `MCP_DATABASE_URL` and `MCP_OAUTH_SECRET` (auth ADR 0002), recorded by the
+ * `AUTH_MCP_ENV_VERSION` once the broker holds `MCP_DATABASE_URL`, `MCP_OAUTH_SECRET` and `AUTH_STATE_SECRET` (auth ADR 0002), recorded by the
  * sign-in step when an entry of that broker declares `uses.auth.mcp`. A broker entry with `mcp` is not
  * written before it, and an applied sign-in that wants it and lacks it plans its step again.
  */
 export declare const PLATFORM_AUTH_MCP_SCOPE_KEY = "auth_mcp_env_applied";
+/**
+ * The value of that marker. `'2'` since the broker also needs `AUTH_STATE_SECRET` (auth PR 510), so a
+ * broker applied under `'1'` plans its sign-in step once more and gets the key without a hand step.
+ */
+export declare const AUTH_MCP_ENV_VERSION = "2";
 /** True when a hosting entry of the org declares `uses.auth.mcp`: its broker needs the MCP database and secret. */
 export declare function orgDeclaresMcp(org: Pick<DeclaredOrg, 'hosting'>): boolean;
 /**

package/dist/plan/platform-diff.js

@@ -96,11 +96,16 @@ export function authLoginEnvMarker(smtpSender, passkeyRpId) {
 /** The {@link authLoginEnvMarker} the login apps' env was last written with, once live on them. */
 export const PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY = 'auth_login_env_applied';
 /**
- * `'1'` once the broker holds `MCP_DATABASE_URL` and `MCP_OAUTH_SECRET` (auth ADR 0002), recorded by the
+ * `AUTH_MCP_ENV_VERSION` once the broker holds `MCP_DATABASE_URL`, `MCP_OAUTH_SECRET` and `AUTH_STATE_SECRET` (auth ADR 0002), recorded by the
  * sign-in step when an entry of that broker declares `uses.auth.mcp`. A broker entry with `mcp` is not
  * written before it, and an applied sign-in that wants it and lacks it plans its step again.
  */
 export const PLATFORM_AUTH_MCP_SCOPE_KEY = 'auth_mcp_env_applied';
+/**
+ * The value of that marker. `'2'` since the broker also needs `AUTH_STATE_SECRET` (auth PR 510), so a
+ * broker applied under `'1'` plans its sign-in step once more and gets the key without a hand step.
+ */
+export const AUTH_MCP_ENV_VERSION = '2';
 /** True when a hosting entry of the org declares `uses.auth.mcp`: its broker needs the MCP database and secret. */
 export function orgDeclaresMcp(org) {
     return org.hosting.enabled && org.hosting.entries.some((e) => Boolean(e.uses?.auth?.mcp));

package/dist/plan/platform-providers.js

@@ -34,7 +34,7 @@ import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAI
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_APPLIED_USAGE_TAIL_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, authLoginEnvMarker, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, orgDeclaresMcp, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeTicksSyncValue, uptimeVarsDigest, usageTailEdgeEnv, usageTailEdgeEnvValue, usageTailRecorded, } from './platform-diff.js';
+import { AUTH_MCP_ENV_VERSION, AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_APPLIED_USAGE_TAIL_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, authLoginEnvMarker, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, orgDeclaresMcp, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeTicksSyncValue, uptimeVarsDigest, usageTailEdgeEnv, usageTailEdgeEnvValue, usageTailRecorded, } from './platform-diff.js';
 import { PLATFORM_REGISTRY_KEY, PLATFORM_REGISTRY_LOGINS_KEY, PLATFORM_REGISTRY_PASSWORDS_SET_SCOPE_KEY, PLATFORM_REGISTRY_PULL_PASSWORD_REF, registryImageTagBlocked, } from './platform-registry-keys.js';
 import { ensureRegistryLogins, provisionPlatformRegistry, registryLoginsDrifted, } from './platform-registry.js';
 import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
@@ -914,7 +914,8 @@ export class FoundryPlatformStepExecutor {
         if (platform.auth.enabled && this.auth) {
             const loginClientDrifted = await authLoginClientDrifted(platform, this.auth, recordedIds);
             // The broker lacks the MCP database and secret a shared org's entry needs (auth ADR 0002).
-            const mcpDrifted = recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] !== '1' && (await this.mcpWanted());
+            const mcpDrifted = recordedIds[PLATFORM_AUTH_MCP_SCOPE_KEY] !== AUTH_MCP_ENV_VERSION &&
+                (await this.mcpWanted());
             // The broker has no registrar token yet (`ZITADEL_REGISTRAR_TOKEN`).
             // A token minted and never held is blocked (`blockedSteps`), not drift: no apply could change it.
             const registrarDrifted = this.auth.registrarTokenWritable === true &&
@@ -2420,7 +2421,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
     }
     // The env is live on the broker (and deployed when it changed): the entry write may now carry `mcp`.
     if (input.mcp)
-        await record(PLATFORM_AUTH_MCP_SCOPE_KEY, '1');
+        await record(PLATFORM_AUTH_MCP_SCOPE_KEY, AUTH_MCP_ENV_VERSION);
     // ---- tunnel and DNS ------------------------------------------------------
     const tunnels = await network.tunnels();
     const existingTunnel = await tunnels.findTunnelByName(target.names.authTunnel);

package/dist/plan/release-host.d.ts

@@ -84,7 +84,11 @@ export declare function createReleaseHost(input: ReleaseHostInput): ReleaseHost;
  * (like the next apply, through its `bluegreen-lb` step) writes it again.
  */
 export declare function runSubjectRelease(input: {
-    store: Pick<ReleaseStore, 'openRequests' | 'consumeRequests'> & Partial<Pick<ReleaseStore, 'appendEvents'>>;
+    store: Pick<ReleaseStore, 'openRequests' | 'consumeRequests' | 'claimRequests'> & Partial<Pick<ReleaseStore, 'appendEvents'>>;
+    /** `DeclaredPlatform.ownerOrgId`: without it no go_live or set_required request runs. */
+    ownerOrgId?: string;
+    /** The clock for the repeated passes of a go-live; absent: `now` for every pass. */
+    nowFn?: () => Date;
     scopeOwnerId: string;
     subject: BlueGreenSubject;
     host: ReleaseHost;

package/dist/plan/release-host.js

@@ -9,6 +9,9 @@ import { waitForDeploymentFinished, waitForNewDeployment, } from './deploy-healt
 import { isNotFoundError } from './executor.js';
 import { runStageCopyRequest } from './stage-copy-host.js';
 const COMMIT = /^[0-9a-f]{40}$/;
+const APP_RELEASE_ENV = ['APP_TAG', 'APP_RELEASE', 'APP_MINIMUM_RELEASE'];
+/** One tick runs a pending go-live at most this many times (stage, idle, staff, open). */
+const GO_LIVE_RUNS = 4;
 /** A stage deploy waits at most this many polls of this long (10 minutes) for Coolify's deployment to finish. */
 export const STAGE_DEPLOY_ATTEMPTS = 60;
 export const STAGE_DEPLOY_INTERVAL_MS = 10_000;
@@ -109,7 +112,7 @@ export function createReleaseHost(input) {
     const pinInput = () => pinInputOf(input, recorded);
     const addressOf = (color) => colorAddress(input, recorded, color);
     const healthColor = () => healthColorOf(recorded(), id);
-    const deployTo = async (color, digest) => {
+    const deployTo = async (color, digest, appEnv) => {
         if (!COMMIT.test(digest))
             throw new Error(`${input.label}: the release is not a built commit`);
         const token = subject.reporting ? await input.healthToken() : null;
@@ -135,22 +138,40 @@ export function createReleaseHost(input) {
                     throw new Error(`${input.label}: reading the env of the blue app failed`);
                 }
             }
+            // A go-live's own values replace blue's: the color boots with the tag's tag, release and minimum.
             const refreshed = copiedEnv({ label: input.label, secret: input.secret }, subject, source, {
                 uuid: server,
                 primaryUuid: input.primaryUuid,
-            });
+            }).filter((e) => !appEnv || !APP_RELEASE_ENV.includes(e.key));
+            const release = appEnv
+                ? [
+                    { key: 'APP_TAG', value: appEnv.tag },
+                    { key: 'APP_RELEASE', value: String(appEnv.release) },
+                    ...(appEnv.minimum === null
+                        ? []
+                        : [{ key: 'APP_MINIMUM_RELEASE', value: String(appEnv.minimum) }]),
+                ]
+                : [];
             const reporting = token ? reportingEnv({ color, release: digest, healthToken: token }) : [];
             try {
-                const envs = [...refreshed, ...reporting];
+                const envs = [...refreshed, ...reporting, ...release];
                 if (envs.length > 0) {
                     await coolify.bulkUpsertEnvs(appId, envs.map((e) => ({ ...e, literal: true })));
                 }
                 // A key removed from blue (a rotated-out credential) must not stay on the slot.
-                if (appId !== input.primaryBlueAppId) {
-                    const keep = new Set([...source.map((e) => e.key), ...envs.map((e) => e.key)]);
+                if (appId !== input.primaryBlueAppId || (appEnv && appEnv.minimum === null)) {
+                    const keep = new Set([
+                        ...(appId === input.primaryBlueAppId
+                            ? []
+                            : source
+                                .map((e) => e.key)
+                                .filter((key) => !appEnv || !APP_RELEASE_ENV.includes(key))),
+                        ...envs.map((e) => e.key),
+                    ]);
                     for (const env of await coolify.listEnvs(appId)) {
                         if (env.uuid &&
                             !keep.has(env.key) &&
+                            (appId !== input.primaryBlueAppId || env.key === 'APP_MINIMUM_RELEASE') &&
                             !env.key.startsWith('REPORTING_') &&
                             env.key !== ACTIONS_KEY_ENV) {
                             await coolify.deleteEnv(appId, env.uuid);
@@ -272,7 +293,7 @@ export function createReleaseHost(input) {
         stageCopy: (request) => runStageCopyRequest({ subject, context, ports: input.stageCopy, renew: input.renew }, request),
         async effect(effect) {
             if (effect.kind === 'deploy')
-                await deployTo(effect.color, effect.digest);
+                await deployTo(effect.color, effect.digest, effect.appEnv);
             else if (effect.kind === 'stop')
                 await stop(effect.color);
             else if (effect.kind === 'deploy_stage')
@@ -355,53 +376,81 @@ export async function runSubjectRelease(input) {
             context.recordScopeId(bgKey.weights(id), DEFAULT_WEIGHTS);
         await context.persist();
     }
-    await input.host.refreshStage();
-    const before = ids()[bgKey.weights(id)];
-    const result = await runRelease({
-        store: {
-            getScopeIds: async () => ({ ...ids() }),
-            openRequests: (query) => input.store.openRequests(query),
-        },
-        orgId: input.scopeOwnerId,
-        entryKey: id,
-        entry: subject.config,
-        now: input.now,
-        deps: input.host.deps,
-        ...(subject.reporting ? {} : { hardOnly: true }),
-        ...(input.deferCopies ? { deferCopies: true } : {}),
-    });
-    for (const [key, value] of Object.entries(result.writes)) {
-        if (value === null)
-            context.forgetId(key);
-        else
-            context.recordScopeId(key, value);
-    }
-    await context.persist();
-    if (input.store.appendEvents && result.events.length > 0) {
-        try {
-            await input.store.appendEvents({
-                orgId: input.scopeOwnerId,
-                entryKey: id,
-                events: result.events,
-            });
+    /** Where a go-live stands: it moves when stage, a color's digest or the window changes. */
+    const stand = () => [
+        ids()[bgKey.stage(id)] ?? '',
+        ids()[bgKey.digest(id, 'blue')] ?? '',
+        ids()[bgKey.digest(id, 'green')] ?? '',
+        // A window never written reads as idle, so the first run's own write is not a change.
+        ids()[bgKey.window(id)] ?? '{"kind":"idle"}',
+    ].join('|');
+    const pass = async (now) => {
+        await input.host.refreshStage();
+        const before = ids()[bgKey.weights(id)];
+        const result = await runRelease({
+            store: {
+                getScopeIds: async () => ({ ...ids() }),
+                openRequests: (query) => input.store.openRequests(query),
+                claimRequests: (claim) => input.store.claimRequests(claim),
+            },
+            orgId: input.scopeOwnerId,
+            ...(input.ownerOrgId !== undefined ? { ownerOrgId: input.ownerOrgId } : {}),
+            entryKey: id,
+            entry: subject.config,
+            now,
+            deps: input.host.deps,
+            ...(subject.reporting ? {} : { hardOnly: true }),
+            ...(input.deferCopies ? { deferCopies: true } : {}),
+        });
+        for (const [key, value] of Object.entries(result.writes)) {
+            if (value === null)
+                context.forgetId(key);
+            else
+                context.recordScopeId(key, value);
         }
-        catch {
-            // The history is a record, not a gate: losing a line must not leave the run's requests open to replay.
-            console.error(`release ${id}: recording ${result.events.length} history lines failed`);
+        await context.persist();
+        if (input.store.appendEvents && result.events.length > 0) {
+            try {
+                await input.store.appendEvents({
+                    orgId: input.scopeOwnerId,
+                    entryKey: id,
+                    events: result.events,
+                });
+            }
+            catch {
+                // The history is a record, not a gate: losing a line must not leave the run's requests open to replay.
+                console.error(`release ${id}: recording ${result.events.length} history lines failed`);
+            }
         }
-    }
-    await input.store.consumeRequests(result.requestIds);
-    const after = parseWeights(ids()[bgKey.weights(id)]);
-    // Also when a balancer lags the weights (an earlier write failed), so the next tick retries it.
-    if (after && (formatWeights(after) !== before || balancerLags(ids(), id, formatWeights(after)))) {
-        await input.host.writeWeights();
-    }
-    return {
-        blocked: result.blocked,
-        refused: result.refused,
-        deferredCopy: result.deferredCopy,
-        copy: result.copy,
+        await input.store.consumeRequests(result.requestIds);
+        const after = parseWeights(ids()[bgKey.weights(id)]);
+        // Also when a balancer lags the weights (an earlier write failed), so the next tick retries it.
+        if (after &&
+            (formatWeights(after) !== before || balancerLags(ids(), id, formatWeights(after)))) {
+            await input.host.writeWeights();
+        }
+        return result;
     };
+    let was = stand();
+    let result = await pass(input.now);
+    const seen = { blocked: new Set(result.blocked), refused: new Set(result.refused) };
+    let copy = result.copy;
+    let deferredCopy = result.deferredCopy;
+    // A go-live is stage, then idle, then staff, then open: each step is one run, and a step that worked makes the
+    // next one possible, so the tag goes live in one tick when nothing fails. A run that changed nothing stops it.
+    for (let more = 1; more < GO_LIVE_RUNS && result.goLiveOpen; more += 1) {
+        if (stand() === was)
+            break;
+        was = stand();
+        result = await pass(input.nowFn?.() ?? input.now);
+        for (const line of result.blocked)
+            seen.blocked.add(line);
+        for (const line of result.refused)
+            seen.refused.add(line);
+        copy ??= result.copy;
+        deferredCopy ||= result.deferredCopy;
+    }
+    return { blocked: [...seen.blocked], refused: [...seen.refused], deferredCopy, copy };
 }
 /**
  * Runs the stage copy a release run decided on and records what came of it. Call it after

package/dist/release/decide.d.ts

@@ -79,6 +79,15 @@ export type ReleaseEffect = {
     kind: 'deploy';
     color: Color;
     digest: string;
+    /**
+     * A go-live's `APP_TAG`, `APP_RELEASE` and `APP_MINIMUM_RELEASE` (removed when `minimum` is null). The host
+     * writes them to this color with the deploy, so the color boots with them; the serving color is never touched.
+     */
+    appEnv?: {
+        tag: string;
+        release: number;
+        minimum: number | null;
+    };
 } | {
     kind: 'stop';
     color: Color;

package/dist/release/decide.js

@@ -161,7 +161,7 @@ function applyActions(r, actions, now, out, kind) {
                 out.refused.push('promote refused: stage has no digest');
             else if (cur.held.includes(digest))
                 out.refused.push('promote refused: digest is held');
-            else if (digest === cur.digests[cur.live])
+            else if (digest === cur.digests[cur.live] && !a.redeploy)
                 out.refused.push('promote refused: digest is already live');
             else {
                 const to = otherColor(cur.live);

package/dist/release/golive.d.ts

@@ -0,0 +1,77 @@
+import type { Recorded } from './decide.js';
+import type { ReleaseAction, ReleaseEvent, ReleasedVersion } from './types.js';
+export type GoLiveAction = Extract<ReleaseAction, {
+    kind: 'go_live';
+}>;
+export type SetRequiredAction = Extract<ReleaseAction, {
+    kind: 'set_required';
+}>;
+export type App = 'boule' | 'agora';
+/** A go-live tries each deploy step this many ticks before it is refused. */
+export declare const GO_LIVE_TRIES = 3;
+/** `bg.<entry>.golive`: `<request id>|<stage deploys tried>|<release reserved by the idle deploy>|<idle deploys failed>`. */
+export interface GoLiveState {
+    requestId: number;
+    tries: number;
+    release: number | null;
+    idle: number;
+}
+export declare function parseGoLive(value: string | undefined): GoLiveState | null;
+export declare function formatGoLive(s: GoLiveState): string;
+/** What one due `go_live` request comes to in this run. */
+export interface GoLivePlan {
+    /** For `decide`: `deploy_stage`, `promote` or `open` (never more than one). */
+    actions: ReleaseAction[];
+    /** The `promote` among `actions`, when there is one: its deploy carries the tag's env. */
+    promote?: ReleaseAction;
+    /** The tag completed in this run: record it. */
+    record: boolean;
+    /** The request is consumed. False: it stays open and the next run judges it again. */
+    consume: boolean;
+    /** The runner starts this go-live: the request is claimed before any effect, so it can no longer be cancelled or moved. */
+    claim: boolean;
+    /** The env the idle color is deployed with (only with `promote`). */
+    appEnv?: {
+        tag: string;
+        release: number;
+        minimum: number | null;
+    };
+    /** The tries to carry into `bg.<entry>.golive` when the idle deploy worked or failed (only with `promote`). */
+    carry?: {
+        tries: number;
+        idle: number;
+    };
+    /** `bg.<entry>.golive` after this run (null removes it); not used with `promote`. */
+    state?: GoLiveState | null;
+    refused?: string;
+    blocked?: string;
+    events: Array<Pick<ReleaseEvent, 'kind' | 'reason'>>;
+}
+/**
+ * Decides one `go_live`. Stage is deployed at the tag's commit when it differs, then the idle color is deployed
+ * with the tag's env (`promote`, also for a commit the live color already runs), then it is opened (the staff hold
+ * is passed here: stage was the review) only when the idle color runs and answers, and the request waits until
+ * the release completes, one color at 100 % with the window closed. Only then is the version recorded, and only
+ * when `bg.<entry>.golive` holds the release number this request's own idle deploy reserved: a tag no color
+ * carries is never recorded. Each deploy step is tried `GO_LIVE_TRIES` ticks, a history line for each retry.
+ */
+export declare function planGoLive(input: {
+    app: App;
+    action: GoLiveAction;
+    requestId: number;
+    recorded: Recorded;
+    ids: Readonly<Record<string, string>>;
+    released: readonly ReleasedVersion[];
+    now: Date;
+    /** The new color's observation (only meaningful while a release runs). */
+    observation: {
+        status: 'running' | 'crash_loop' | 'other';
+        address: 'ok' | 'failed' | 'unchecked';
+    };
+}): GoLivePlan;
+/** The highest release at or below `release` that is required; null when none. */
+export declare function minimumFor(versions: readonly ReleasedVersion[], release: number): number | null;
+/** A free release number: the unix second of `now`, or the next free one when a version already took it. */
+export declare function releaseNumber(now: Date, versions: readonly ReleasedVersion[]): number;
+/** The scope writes that record `v`. */
+export declare function recordWrites(v: ReleasedVersion): Record<string, string>;