@impeccable/reviews 0.1.7 → 0.1.9

package/dist/tools.js

@@ -10,14 +10,14 @@ import { defineTool } from '@earendil-works/pi-coding-agent';
 import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, sentTo } from './host-questions.js';
-import { enableNetlifyPreviews } from './host-previews.js';
+import { APPS_QUESTION, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, sentTo, startedIn } from './host-questions.js';
+import { enableNetlifyPreviews, folderOf } from './host-previews.js';
 import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
-import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelPreviewsFact, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
@@ -107,6 +107,21 @@ export function resolveWrite(instructions, setupApi, repo, path) {
     }
     return { error: `No PUT or POST in the instructions' "endpoints" matches ${pathname}. Pick one from there.` };
 }
+/** The last screen's words for a run on several apps: the picked apps not set up, by name, the line naming which are and which are not, and a line for each that is not. */
+export function appsSummary(apps) {
+    const picked = apps.filter((a) => a.state !== 'unpicked');
+    const ready = picked.filter((a) => a.state === 'ready');
+    const rest = picked.filter((a) => a.state !== 'ready');
+    const names = (list) => list.map((a) => a.name).join(', ');
+    const line = [...(ready.length ? [`Set up: ${names(ready)}.`] : []), ...(rest.length ? [`Not set up: ${names(rest)}.`] : [])].join(' ');
+    return { notReady: rest.map((a) => a.name), line, todo: rest.flatMap((a) => (a.left ? [a.left] : [])) };
+}
+/** A host's lock in front of a preview, as impeccable_prove_preview names it: how the person reads it, the tool that gets a key past it, and the step left where none was saved (preview-protection's step 3). */
+const LOCKS = {
+    'vercel-protection': { lock: "Vercel's login", tool: 'impeccable_vercel_bypass', left: 'Save the Vercel bypass secret on the setup page' },
+    'netlify-protection': { lock: "Netlify's password or team login", tool: 'impeccable_netlify_password', left: 'Save the Netlify site password on the setup page, or make the site public on its Visitor access page' },
+    'cloudflare-access': { lock: 'Cloudflare Access', tool: 'impeccable_cloudflare_access', left: 'Save the Cloudflare service token on the setup page' },
+};
 const NO_INPUT = { type: 'object', properties: {}, additionalProperties: false };
 /** Why the status line and the task list say different things, one task in progress at a time and the status its detail; null when they agree. */
 function stageError(status, tasks) {
@@ -179,10 +194,15 @@ const TEST_PR = {
     ...PULL_REQUEST,
     properties: { ...PULL_REQUEST.properties, setup_pr: { ...PULL_REQUEST, description: 'The setup pull request, when there is one: this run\'s, or on a rerun the earlier run\'s.' } },
 };
+/** An app's key as the setup state gives it. */
+const APP_KEY_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
+/** The app a host tool reads for, on a repository with several apps: its previews are those of the project or site that builds the app's folder. */
+const APP_KEY = { type: 'string', minLength: 1, description: 'On a repository with several apps, the key of the app this is for, one the apps question picked: only the previews of the host project that builds that app\'s folder are read.' };
 const HOSTED_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: APP_KEY,
         branch: { type: 'string', minLength: 1, description: 'A branch of this run, once pushed and before its pull request exists, such as impeccable/test-drive: reads the deployments of its head only, and waits up to five minutes for one to finish building.' },
     },
 };
@@ -190,6 +210,7 @@ const NETLIFY_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: APP_KEY,
         pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
     },
 };
@@ -197,6 +218,7 @@ const CLOUDFLARE_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: APP_KEY,
         pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
         branch: { type: 'string', minLength: 1, description: 'A branch of this run, once pushed and before its pull request exists, such as impeccable/test-drive: reads the build of its head only, and waits up to five minutes for it to finish.' },
     },
@@ -796,18 +818,34 @@ export async function driveCoversSetup(cwd, setupBranch, driveBranch) {
  * What the pushed `head` changes against `base`, as their remote-tracking refs in this checkout show GitHub: each file's
  * `git diff --name-status` letter and its path as it is, never quoted; a rename as a removal and an addition. Null when either ref is missing or git fails.
  */
-export async function pushedChanges(cwd, base, head) {
+export async function pushedChanges(cwd, base, head, lessSetup = false) {
     try {
+        const git = (args, timeout = 10_000) => execFileAsync('git', args, { cwd, timeout, env: gitEnvironment() });
         // The two branches as the remote has them, fetched so the diff can be read here: refs/remotes/origin/* sit in the checkout's git folder, where a command in the sandbox can move them.
         const refs = [`refs/heads/${base}`, `refs/heads/${head}`];
-        const { stdout: heads } = await execFileAsync('git', ['ls-remote', '--heads', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
+        const { stdout: heads } = await git(['ls-remote', '--heads', 'origin', ...refs], 60_000);
         const sha = new Map(heads.split('\n').filter(Boolean).map((line) => line.split('\t').reverse()));
         if (!refs.every((ref) => sha.has(ref)))
             return null;
-        await execFileAsync('git', ['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
-        const { stdout } = await execFileAsync('git', ['diff', '-z', '--name-status', '--no-renames', `${sha.get(refs[0])}...${sha.get(refs[1])}`], { cwd, timeout: 10_000, env: gitEnvironment() });
-        const fields = stdout.split('\0');
-        return Array.from({ length: Math.floor(fields.length / 2) }, (_, i) => ({ status: fields[2 * i], path: fields[2 * i + 1] }));
+        await git(['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...refs], 60_000);
+        // From where the two met (three dots), so a base that moved on since the branch left it adds nothing of its own.
+        const changed = async (from, to) => {
+            const { stdout } = await git(['diff', '-z', '--name-status', '--no-renames', `${from}...${to}`]);
+            const fields = stdout.split('\0');
+            return Array.from({ length: Math.floor(fields.length / 2) }, (_, i) => ({ status: fields[2 * i], path: fields[2 * i + 1] }));
+        };
+        const pushed = sha.get(refs[1]);
+        if (!lessSetup)
+            return changed(sha.get(refs[0]), pushed);
+        // The test drive branches from the setup commit, so a diff from the base carries the setup branch's files too (the workflow, a build fix). Read from the local setup branch under the pushed head instead (impeccable/setup, or its -N; of several, the nearest), the changes are the test drive's own: a file the setup branch changed and the test drive changed again is among them, one it left as the setup branch had it is not.
+        const { stdout: setups } = await git(['for-each-ref', '--format=%(refname)', 'refs/heads/impeccable/setup', 'refs/heads/impeccable/setup-*']);
+        const isAncestor = (of, to) => git(['merge-base', '--is-ancestor', of, to]).then(() => true, () => false);
+        let setup;
+        for (const ref of setups.split('\n').filter(Boolean)) {
+            if ((await isAncestor(ref, pushed)) && (setup === undefined || (await isAncestor(setup, ref))))
+                setup = ref;
+        }
+        return changed(setup ?? sha.get(refs[0]), pushed);
     }
     catch {
         return null;
@@ -1519,14 +1557,19 @@ export function createTools(ctx) {
     };
     /** Of the origins listed, those of deployments Vercel's own bot made: the only addresses a bypass secret is ever sent to, since a deployment anyone with write access can record names any address. */
     const vercelMade = new Set();
-    /** The address impeccable_prove_preview met a host's lock at, the words it looked for there, and whose lock it was. */
+    /** On a repository with several apps, the app each listed origin was read for, with its own host project (#281): a key for that address goes to that project and is saved for that app. */
+    const listedApps = new Map();
+    /** The address impeccable_prove_preview met a host's lock at, the words it looked for there, whose lock it was, and the app it was listed for. */
     let gated;
-    /** The bypass secret saved in this run, for the proof of a Vercel address to send; never for the model. It is one project's, so it goes only to the origins impeccable_vercel_bypass proved it on, never to another project's deployment of this repository. */
-    let bypassSecret;
-    const bypassOrigins = new Set();
-    /** What impeccable_vercel_bypass answered, less the secret: a skip is asked once, so that answer stands; the saved one is what an address the secret opens later gets. */
-    let bypassOutcome;
-    let bypassSaved;
+    /**
+     * The bypass secret saved in this run, by where the setup API keeps it (the app's key, or '' for the repository's), with
+     * the project it is of and what the tool answered; never for the model. A secret is one project's, so it goes only to
+     * the origins impeccable_vercel_bypass proved it on (each by that same store), never to another project's deployment.
+     */
+    const bypassHeld = new Map();
+    const bypassOrigins = new Map();
+    /** What impeccable_vercel_bypass answered for a store, less the secret: a skip is asked once, so that answer stands. */
+    const bypassOutcomes = new Map();
     /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
     let sitePassword;
     const passwordSites = new Set();
@@ -1551,6 +1594,8 @@ export function createTools(ctx) {
     const enableOutcomes = new Map();
     /** Cloudflare's plain evidence as last read: the project, the Worker and the GitHub app facts impeccable_cloudflare_connect and the wait for a build act on. */
     let cloudflareEvidence;
+    /** Each app's Pages project, by key, as a plain read with its appKey told it: its name, and the label its addresses carry (its own host's, which a taken name suffixes). */
+    const cloudflareApps = new Map();
     /** What impeccable_cloudflare_connect answered: asked once, so that answer stands. */
     let connectOutcome;
     // Keep ownership of files for this one run; never recreate it per call.
@@ -1631,14 +1676,32 @@ export function createTools(ctx) {
     /** The live app's addresses, by origin: those the host tools answered as `production`, each with its host and, on Netlify, its site, so a custom domain's lock is known and the site's key goes with it; and those a proof opened with this app, the only ones impeccable_write saves as the before. */
     const productionListed = new Map();
     const provenLive = new Set();
-    /** The linked Vercel project's production address, read from Vercel, and the project it was read from: the one live address the project's own bypass secret is sent to, since a secret is one project's, and the link file can name another project of this repository between the two reads. */
-    let vercelProduction;
-    /** The project whose bypass secret is in hand, by the link it was read or made on. */
-    let bypassProject;
+    /** On a repository with several apps: the app each production address a host tool answered is the live app of, read for that app's own project or site, and the apps whose host preview a proof opened. */
+    const liveApps = new Map();
+    const provenApps = new Set();
+    /** On a repository with several apps (#286): the method each app's preview write saved; the host's lock a proof of each app's preview met; and the apps whose lock was met with no key tool called for them since, which holds every other app's steps until it is. */
+    const appMethods = new Map();
+    const lockMet = new Map();
+    const lockPending = new Map();
+    /** The projects whose deployments Vercel made of this repository, as impeccable_hosted_previews read them, by the app read for ('' for the repository): a repository Vercel deploys already needs no Vercel setup, since its previews start with the first pull request (#286). */
+    const vercelDeployed = new Map();
+    /** Each Vercel project's production address, read from Vercel, by origin, and the project it was read from: the one live address the project's own bypass secret is sent to, since a secret is one project's, and the link file can name another project of this repository between the two reads. */
+    const vercelProductions = new Map();
+    /** The bypass secret a proof sends to `origin`: the one proved there, or, for a live address, the one of the project whose production it is. */
+    const bypassFor = (origin, live) => {
+        const store = bypassOrigins.get(origin);
+        if (store !== undefined)
+            return bypassHeld.get(store)?.secret;
+        const project = live ? vercelProductions.get(origin) : undefined;
+        return project ? [...bypassHeld.values()].find((held) => held.projectId === project)?.secret : undefined;
+    };
     /** A host tool answered the live app's address: the proof may open it as the before, with the host's key where the lock is the same site's or project's. */
-    const noteProduction = (production, host, site) => {
-        if (production && URL.canParse(production))
-            productionListed.set(new URL(production).origin, { host, ...(site ? { site } : {}) });
+    const noteProduction = (production, host, site, appKey) => {
+        if (!production || !URL.canParse(production))
+            return;
+        productionListed.set(new URL(production).origin, { host, ...(site ? { site } : {}) });
+        if (appKey !== undefined)
+            liveApps.set(new URL(production).origin, appKey);
     };
     const hostCli = (host, pi, signal) => {
         const runner = (browser = false) => (ctx.hostRunner ?? commandRunner)(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
@@ -1776,6 +1839,8 @@ export function createTools(ctx) {
      * has no production deployment, before anything is pushed: Vercel makes a new project's first deployment Production
      * whatever branch it builds, and serves it at the project's own address.
      */
+    /** On a repository with several apps, the picked app whose folder the project impeccable_vercel_connect connects builds. */
+    let connectedApp;
     async function vercelConnect(pi, signal) {
         if (!hostSetupAgreed(ctx.log, 'vercel'))
             return { connected: false, reason: 'The Vercel sign-in comes first: impeccable_ask with the id vercel-setup.' };
@@ -1794,6 +1859,17 @@ export function createTools(ctx) {
             return { connected: false, reason: 'The project this folder is linked to no longer exists on Vercel, as far as the CLI can tell (.vercel/project.json is stale): nothing was connected, and the push stays held. vercel link --yes, on its own, links the project of the folder\'s name again; else the Vercel setup ends here, and the person removes or relinks the file.' };
         if (!project)
             return { connected: false, reason: 'The Vercel CLI could not read the linked project (vercel api), so whether this run created it is unknown: nothing was connected, and the push stays held.' };
+        // On a repository with several apps, a project builds one app's folder: one that builds no picked app's is connected and locked for none (#281).
+        if (appsRepo) {
+            const folders = new Map(await Promise.all([...(pickedApps ?? [])].map(async (key) => [await appFolder(pi, key), key])));
+            connectedApp = project.rootDirectory !== undefined ? folders.get(project.rootDirectory) : undefined;
+            if (connectedApp === undefined) {
+                // A project not connected to this repository builds no push of it, so the push goes; one connected already would build it, so it stays held.
+                if (project.repository !== repository.toLowerCase())
+                    settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'connection' });
+                return { connected: false, reason: `The linked project${project.name ? ` ${project.name}` : ''} builds ${project.rootDirectory ? `the folder ${project.rootDirectory}` : "the repository's root"}, which is no app this run sets up: it stays as it is, and nothing was connected. The Vercel setup ends here.` };
+            }
+        }
         // A project connected to this repository already is this repository's: the connection changes nothing on it, and the lock below is what it gets as the run's own project would.
         if (project.repository !== repository.toLowerCase()) {
             const foreign = !(project.name && vercelProjectsAdded(ctx.log).has(`${own.team}/${project.name.toLowerCase()}`)) ? `this run's vercel project add did not make it in ${own.team ? `the team ${own.team}` : 'the personal scope'}, so vercel link linked a project of that name that existed already` : null;
@@ -1873,11 +1949,13 @@ export function createTools(ctx) {
      * Saves a host's key for reviews: the key as Impeccable's credential for the lock, then the setting that sends it in
      * `header`, both through the setup API. `stored` says the first write took; `failed` what stopped it, else null.
      */
-    const saveLock = async (pi, what, header, value) => {
+    const saveLock = async (pi, what, header, value, appKey) => {
         const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
-        if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value } })).ok)
+        // On a repository with several apps, the key is that app's own: each app's previews are its own project's or site's.
+        const app = appKey !== undefined ? { appKey } : {};
+        if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value, ...app } })).ok)
             return { stored: false, failed: `The setup API did not store the ${what}.` };
-        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header } })).ok)
+        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header, ...app } })).ok)
             return { stored: true, failed: `The setup API stored the ${what}, but not the setting that sends it: it is turned on under Deployment protection on the setup page.` };
         return { stored: true, failed: null };
     };
@@ -1885,6 +1963,22 @@ export function createTools(ctx) {
     let instructions = ctx.instructions;
     /** Whether the run signed in again for apps the scan proposed after the sign-in. */
     let renewedForApps = false;
+    /** Whether the repository has several apps (the state's apps item), as the first state or a later read showed it. */
+    let appsRepo = ctx.severalApps === true;
+    /**
+     * The apps this run sets up, as the apps question answered (after a skip, the ones on): undefined until it was asked.
+     * On a repository with several apps every run asks it, however the setup page answered before (#280), and every write
+     * and host read for an app names one of these.
+     */
+    let pickedApps;
+    /** This run confirmed the scan's proposal, so nothing was answered before: the question opens with every app picked. */
+    let confirmedApps = false;
+    /** Each app's folder, by key, as the state names it: what its host project or site must build. */
+    const appFolders = new Map();
+    /** The apps as the state last listed them. */
+    let knownApps = null;
+    /** An app's name as the state gives it, or its key. */
+    const appName = (key) => knownApps?.find((a) => a.key === key)?.name ?? key;
     /**
      * A read of the state or the checkup, trimmed to this setup before the model sees it. The setup token covers the apps
      * there were at sign-in, so an app the scan proposed later reads `not-selected`: the run signs in again, for a token
@@ -1897,10 +1991,134 @@ export function createTools(ctx) {
             renewedForApps = true;
             res = await call(pi, `${ctx.setupApi}${path}`);
         }
+        if (res.ok && severalApps(res.data))
+            appsRepo = true;
         if (res.ok && ctx.allInstructions !== undefined && severalApps(res.data))
             instructions = focusInstructions(ctx.allInstructions, { apps: true });
         return answerText(res.ok ? { ...res, data: focus(res.data) } : res);
     };
+    /** The repository's apps as the state lists them, each with its folder and whether it is on; null when the state could not be read. */
+    const stateApps = async (pi) => {
+        const res = await call(pi, `${ctx.setupApi}/state`);
+        const repos = object(res.data)?.repos;
+        const repo = res.ok && Array.isArray(repos) ? repos.map(object).find((r) => r?.name === ctx.repo) : undefined;
+        if (!repo || !Array.isArray(repo.apps))
+            return null;
+        const apps = repo.apps.map(object).flatMap((a) => {
+            const prefixes = Array.isArray(a?.pathPrefixes) ? a.pathPrefixes : [];
+            const folder = folderOf(prefixes.find((p) => typeof p === 'string' && p) ?? '');
+            return a && typeof a.key === 'string' && APP_KEY_SHAPE.test(a.key) && folder !== undefined
+                ? [{ key: a.key, name: typeof a.name === 'string' && a.name ? a.name : a.key, folder, enabled: a.enabled !== false }] : [];
+        });
+        for (const app of apps)
+            appFolders.set(app.key, app.folder);
+        knownApps = apps;
+        return apps;
+    };
+    /** An app's folder, read from the state the first time it is asked for. */
+    const appFolder = async (pi, key) => (appFolders.has(key) ? appFolders.get(key) : (await stateApps(pi), appFolders.get(key)));
+    /**
+     * On a repository with several apps, why a step for `appKey` may not run yet: the apps question comes first, and only
+     * a picked app is set up. Null where it may: one app, or a picked one.
+     */
+    const appRefusal = (appKey, what, forApp = true) => {
+        if (!appsRepo)
+            return null;
+        if (!pickedApps)
+            return `Refused: this repository has several apps, so the apps question comes first, on every run: impeccable_ask with the id "apps", as the monorepo case says. Nothing was ${what}.`;
+        if (forApp && (typeof appKey !== 'string' || !pickedApps.has(appKey)))
+            return `Refused: give "appKey", the key of an app this run sets up (${[...pickedApps].join(', ')}). Nothing was ${what}.`;
+        return null;
+    };
+    /**
+     * On a repository with several apps, why a step for another app than `appKey` may not run yet: an app's proof met a
+     * host's lock, and the tool that gets a key past it was not called for that app since, so its key would never be put
+     * in place (#286). Null where it may: no lock met, or every one answered by its tool.
+     */
+    const lockRefusal = (appKey, what) => {
+        for (const [key, gate] of lockPending) {
+            if (key === appKey)
+                continue;
+            const { lock, tool } = LOCKS[gate];
+            return `Refused: ${appName(key)}'s preview is behind ${lock}, and ${tool} was not called for it: call it first, as preview-protection says, so each app gets its own key. Nothing was ${what}.`;
+        }
+        return null;
+    };
+    /** How this run left each app the state lists (#286), for the report and the last screen. */
+    const appOutcomes = async (pi) => {
+        const apps = knownApps ?? (await stateApps(pi)) ?? [];
+        return apps.map(({ key, name, folder }) => {
+            const method = appMethods.get(key);
+            const gate = lockMet.get(key);
+            const proven = provenApps.has(key);
+            if (!pickedApps?.has(key))
+                return { key, name, folder, state: 'unpicked' };
+            if (method !== undefined && (method !== 'preview-deploy' || proven))
+                return { key, name, folder, state: 'ready' };
+            if (gate && !proven)
+                return { key, name, folder, state: 'locked', left: `${name}: its previews are behind ${LOCKS[gate].lock}, and no key was saved. ${LOCKS[gate].left}.` };
+            return { key, name, folder, state: 'unset', left: `${name}: no preview method was saved; the report says why.` };
+        });
+    };
+    /** The report's section on the apps, one line each, from what this run saved and proved rather than from the model's words. */
+    const appsSection = (apps) => `\n\n## Each app, as this run left it\n\n${apps.map((a) => {
+        const where = `${a.name} (${a.folder || '/'})`;
+        const lock = lockMet.has(a.key) ? LOCKS[lockMet.get(a.key)].lock : undefined;
+        if (a.state === 'ready')
+            return `- ${where}: set up. Method: ${appMethods.get(a.key)}${provenApps.has(a.key) ? `, its preview proven${lock ? ` past ${lock}` : ''}` : ''}.`;
+        if (a.state === 'locked')
+            return `- ${where}: not set up. Its previews are behind ${lock}, and no key was saved for it.`;
+        if (a.state === 'unset')
+            return `- ${where}: not set up. No preview method was saved for it.`;
+        return `- ${where}: not set up this run.`;
+    }).join('\n')}`;
+    /** Each app's Vercel project, found once a run (a failure is read again, the CLI may have signed in since). */
+    const vercelApps = new Map();
+    /** The app's Vercel project as this repository's, read now for its deployments: the one that builds the app's folder, or why none can be told. */
+    async function vercelApp(pi, appKey, vercel) {
+        let found = vercelApps.get(appKey);
+        if (!found) {
+            const folder = await appFolder(pi, appKey);
+            if (folder === undefined)
+                return { reason: `The setup state names no folder for the app ${appKey}.` };
+            const resolved = await vercelProjectFor(vercel, repository, folder, (await readLink(pi.cwd))?.orgId);
+            found = 'reason' in resolved ? resolved : { ...resolved, folder };
+            if (!('reason' in found))
+                vercelApps.set(appKey, found);
+        }
+        if ('reason' in found)
+            return found;
+        const project = await readOwnProject(vercel, found.link, repository);
+        return 'reason' in project ? project : { ...found, project };
+    }
+    /**
+     * The apps question (#280), worded here and listing the apps the state has, each picked as it is on (every one, where
+     * this run confirmed the scan's proposal); the command started for one app (--app) answers it without a screen. The
+     * answer is the apps this run sets up; after a skip, those that are on.
+     */
+    async function appsQuestion(pi) {
+        const apps = await stateApps(pi);
+        if (!apps || apps.length < 2)
+            return 'Refused: the setup state could not be read, or lists fewer than two apps: read it again with impeccable_state, then ask again.';
+        // Started for one app (--app, from its card): one confirm screen naming it instead of the list, whose Skip opens the list for someone who wants another app (#286).
+        const named = ctx.app !== undefined ? apps.find((a) => a.key === ctx.app) : undefined;
+        if (named && !(await ask(namedAppQuestion(named))).skipped) {
+            pickedApps = new Set([named.key]);
+            return JSON.stringify({ values: [named.key], named: true });
+        }
+        // Started below the top: the app whose folder holds that folder (the deepest, never the root's) is ticked too, and the hint says so.
+        const start = ctx.start ?? '';
+        const here = start ? apps.filter((a) => a.folder && (start === a.folder || start.startsWith(`${a.folder}/`))).sort((a, b) => b.folder.length - a.folder.length)[0] : undefined;
+        const hint = here ? startedIn(`${here.name}'s folder`) : start ? startedIn(start) : APPS_QUESTION.hint;
+        const answer = await ask({ ...APPS_QUESTION, hint, options: apps.map((a) => ({ label: `${a.name} · ${a.folder || '/'}`, value: a.key, selected: confirmedApps || a.enabled || a === here || a === named })) });
+        if (answer.skipped) {
+            pickedApps = new Set(apps.filter((a) => a.enabled).map((a) => a.key));
+            return JSON.stringify({ skipped: true, on: [...pickedApps] });
+        }
+        const values = (answer.values ?? []).filter((value) => apps.some((a) => a.key === value));
+        pickedApps = new Set(values);
+        return JSON.stringify({ values });
+    }
     return [
         tool('impeccable_workflow_access', 'Check workflow access', 'Check that the setup pull request can carry the workflow: reads the active GitHub CLI account and its scopes, the origin remote and the default branch, and refreshes origin/<defaultBranch>. Call it before branching. needsWorkflowScope true means the account lacks workflow access over HTTPS; base.status "refreshed" means origin/<defaultBranch> is current. push is whether git may push to origin, as a dry run at the start found it.', NO_INPUT, (_p, pi, signal) => workflowAccessTool(pi, signal)),
         tool('impeccable_sync_workflow', 'Update the preview workflow', 'Write the state\'s workflow to .github/workflows/impeccable-preview.yml byte for byte and remove the retired workflow the state names, after checking access as impeccable_workflow_access does. Call it once the settings are saved, and again after committing: stagedMatches and committedMatches true (and retiredRemoval staged and committed) prove the commit holds the exact bytes; null means nothing was compared. It refuses, changing nothing, when the file has the person\'s local edits. It never branches, stages, commits or pushes.', NO_INPUT, (_p, pi, signal) => syncWorkflowTool(pi, signal)),
@@ -1979,13 +2197,20 @@ export function createTools(ctx) {
             const target = resolveWrite(instructions, ctx.setupApi, ctx.repo, p.path);
             if ('error' in target)
                 return `Refused: ${target.error}`;
+            // On a repository with several apps, nothing but the apps write goes before the apps question, and an app's setting or check names a picked app.
+            const forApp = /\/(preview|test-accounts|connection-check|latest-pull-check)$/.test(target.url);
+            if (!target.url.endsWith('/apps')) {
+                const refused = appRefusal(object(p.body)?.appKey, 'saved', forApp) ?? (target.url.endsWith('/preview') ? lockRefusal(object(p.body)?.appKey, 'saved') : null);
+                if (refused)
+                    return refused;
+            }
             if (/\/(preview-auth\/[^/]+|preview-protection)$/.test(target.url))
                 return "Refused: a host's key is saved by impeccable_vercel_bypass (a Vercel bypass secret), impeccable_netlify_password (a Netlify site password) or impeccable_cloudflare_access (a Cloudflare Access service token), which opens the preview with it first, and never through this tool. Nothing was saved.";
             if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'ci-tunnel') {
                 return "Refused: Impeccable no longer runs a server in CI for a new setup, so ci-tunnel is never saved. Pages that need a server get their host's pull request previews, as the server-previews case says. Nothing was saved.";
             }
-            if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'preview-deploy' && !hostedPreviewProven) {
-                return "Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app. Nothing was saved.";
+            if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'preview-deploy' && (appsRepo ? !provenApps.has(String(object(p.body)?.appKey)) : !hostedPreviewProven)) {
+                return `Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app${appsRepo ? `, read for it with its appKey (${String(object(p.body)?.appKey)})` : ''}. Nothing was saved.`;
             }
             const saved = object(p.body);
             if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPattern)) {
@@ -1995,6 +2220,15 @@ export function createTools(ctx) {
             if (target.url.endsWith('/preview') && saved && 'beforeUrl' in saved && (typeof saved.beforeUrl !== 'string' || !URL.canParse(saved.beforeUrl) || !provenLive.has(new URL(saved.beforeUrl).origin))) {
                 return "Refused: beforeUrl is the live app's address that impeccable_prove_preview opened with this app in this run (the production address a host tool answered, or the one the README names), or a page on it; an address no key opens is not set, and a saved one is never cleared from here. Nothing was saved.";
             }
+            // One app's before is its own: the production address its own project or site answered, or one a file in its own folder names.
+            if (appsRepo && target.url.endsWith('/preview') && saved && typeof saved.beforeUrl === 'string') {
+                const origin = new URL(saved.beforeUrl).origin;
+                const owner = liveApps.get(origin);
+                const folder = await appFolder(pi, String(saved.appKey));
+                if (owner !== undefined ? owner !== saved.appKey : folder === undefined || !(await checkoutNames(pi.cwd, origin, folder))) {
+                    return `Refused: ${origin} is not the live address of ${String(saved.appKey)}: it is another app's, or no file in that app's folder names it. Nothing was saved.`;
+                }
+            }
             const testAccounts = target.url.endsWith('/test-accounts');
             let body = p.body;
             if (testAccounts) {
@@ -2009,6 +2243,8 @@ export function createTools(ctx) {
             }
             const checkedHead = previews.active && target.url.endsWith('/latest-pull-check') ? await observe(signal) : undefined;
             const response = await call(pi, target.url, { method: target.method, body });
+            if (target.url.endsWith('/apps') && response.ok && object(p.body)?.action === 'confirm')
+                confirmedApps = true;
             if (target.url.endsWith('/preview') && response.ok) {
                 const keys = object(object(response.data)?.keys);
                 if (keys?.intendedMethod === 'stored' && object(p.body)?.intendedMethod === 'static-upload')
@@ -2017,6 +2253,8 @@ export function createTools(ctx) {
                     savedHost = provenHost;
                 if (saved?.appKey !== undefined)
                     perApp = true;
+                if (saved?.appKey !== undefined && typeof saved.intendedMethod === 'string')
+                    appMethods.set(String(saved.appKey), saved.intendedMethod);
                 if (saved && 'intendedMethod' in saved)
                     hostMethod = saved.intendedMethod === 'preview-deploy';
                 for (const key of Object.keys(object(p.body) ?? {}))
@@ -2041,10 +2279,18 @@ export function createTools(ctx) {
             // A test account never comes back to the model, even if the API echoed it.
             return testAccounts ? redact(answerText(response), typed.values()) : answerText(response);
         }),
-        tool('impeccable_ask', 'Ask the person', 'Ask the person one question in a dialog, and wait for the answer; the web page shows the run waiting meanwhile. Answers {"value": "…"} for text and single, {"values": […]} for multi, {"confirmed": true} for confirm, {"username": "…", "password": "secret:…"} for account, or {"skipped": true}. A host\'s setup question (id "vercel-setup", "vercel-team", "netlify-setup" or "netlify-team") is worded by this tool: give it that id and its kind. netlify-setup and vercel-setup are the host\'s sign-in: it shows its screen only when that CLI is signed out, signs the person in through the browser with a retry, and answers {"confirmed": true, "signedIn": true}, with "team" (the one the project goes into) or "teams" to choose from when the person has several, {"confirmed": true, "cli": "missing"} when the CLI is to be installed first and this asked again, or {"skipped": true}.', ASK, async (p, pi, signal) => {
+        tool('impeccable_ask', 'Ask the person', 'Ask the person one question in a dialog, and wait for the answer; the web page shows the run waiting meanwhile. Answers {"value": "…"} for text and single, {"values": […]} for multi, {"confirmed": true} for confirm, {"username": "…", "password": "secret:…"} for account, or {"skipped": true}. A host\'s setup question (id "vercel-setup", "vercel-team", "netlify-setup" or "netlify-team") is worded by this tool: give it that id and its kind. So is the apps question on a repository with several apps (id "apps", kind "multi"), which lists the state\'s apps itself and answers {"values": […]}, {"values": [key], "named": true} when the command was started for that app (it shows one confirm screen naming the app instead of the list, and the list when the person asks for other apps there), or {"skipped": true, "on": […]}. netlify-setup and vercel-setup are the host\'s sign-in: it shows its screen only when that CLI is signed out, signs the person in through the browser with a retry, and answers {"confirmed": true, "signedIn": true}, with "team" (the one the project goes into) or "teams" to choose from when the person has several, {"confirmed": true, "cli": "missing"} when the CLI is to be installed first and this asked again, or {"skipped": true}.', ASK, async (p, pi, signal) => {
             // A skip never stops the run, so every question offers one.
             const asked = p;
+            if (asked.id === APPS_QUESTION.id && appsRepo)
+                return appsQuestion(pi);
             const host = /^(netlify|vercel)-(setup|team)$/.exec(asked.id);
+            // The Vercel setup is for a repository Vercel has never deployed: one it deploys already (every app this run sets up, on a repository with several), as impeccable_hosted_previews read it, gets its previews from the first pull request on (#286). An app with no project of its own still gets the screen, and a setup under way (asked again once the CLI was installed) is not stopped here.
+            const deployed = appsRepo ? pickedApps !== undefined && pickedApps.size > 0 && [...pickedApps].every((key) => vercelDeployed.has(key)) : vercelDeployed.has('');
+            if (asked.id === 'vercel-setup' && deployed && !hostSignIns.has('vercel')) {
+                const projects = [...vercelDeployed.values()].filter(Boolean);
+                return `Refused: Vercel deploys this repository already${projects.length ? ` (${projects.join(', ')})` : ''}: it made deployments of it, production included, so its previews start with the first pull request, and there is no Vercel sign-in, project or connection to make. Go on as vercel-previews says: build and push the test drive as pull-requests' step 4 says, wait for Vercel's deployment of the pushed branch with impeccable_hosted_previews and branch, prove the test drive's page there (past Vercel's login as preview-protection says), and save the method.`;
+            }
             if (host?.[2] === 'setup')
                 return JSON.stringify(await hostSignIn(host[1], pi, signal));
             if (host && (teamChoices.get(host[1])?.length ?? 0) < 2)
@@ -2064,7 +2310,8 @@ export function createTools(ctx) {
                 ctx.log.write('ask hidden (names a credential)', q.id);
             if (q.kind === 'text' && !q.sensitive)
                 q.caution = NEVER_A_CREDENTIAL;
-            const answer = await askPerson(q);
+            // The apps question's screen is the tool's to show (TOOL_SHOWN), so the web page hears of it here.
+            const answer = q.id === APPS_QUESTION.id ? await ask(q) : await askPerson(q);
             if (answer.skipped) {
                 // Without a terminal the Vercel CLI names no team on its own, so a skipped team ends the Vercel setup.
                 if (host?.[1] === 'vercel')
@@ -2112,11 +2359,18 @@ export function createTools(ctx) {
                 return `Refused: ${found.problem}.`;
             drive.url = found.url;
             // The page that links to the test drive is an existing file the branch changes; files under dot folders (.github, .netlify) and dotfiles never link to it (#241).
-            const changes = !recordedBranches && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch) : null;
+            const changes = !recordedBranches && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch, true) : null;
             const files = (changes ?? []).filter(({ path }) => !path.split('/').some((part) => part.startsWith('.')));
             if (files.length && files.every(({ status }) => status === 'A')) {
                 return `Refused: ${found.branch} only adds ${files.map(({ path }) => path).join(', ')} and changes no existing page, so nothing links to the test drive. Commit the page that links to it and push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
             }
+            // On a repository with several apps, the test drive's page goes into a picked app's own folder, and no other app is touched (#286): a file it adds anywhere else is refused, whatever its name. The setup branch's own files (a build fix at the root) are not in `files`, as pushedChanges leaves them out.
+            if (appsRepo && pickedApps) {
+                const folders = (await Promise.all([...pickedApps].map((key) => appFolder(pi, key)))).filter((folder) => folder !== undefined);
+                const outside = files.filter(({ status, path }) => status === 'A' && !folders.some((folder) => !folder || path.startsWith(`${folder}/`))).map(({ path }) => path);
+                if (outside.length)
+                    return `Refused: ${found.branch} adds ${outside.join(', ')}, outside the folders of the apps this run sets up (${folders.map((folder) => folder || '/').join(', ')}). The test drive's page goes into each picked app's own folder, as the monorepo case says, and no other app is touched: move it, push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
+            }
             let setupBranch = recordedBranches?.setup, setupBase = recordedBranches?.setupBase;
             if (setup) {
                 // The setup pull request carries the preview attempts, so its binding cannot change.
@@ -2146,6 +2400,9 @@ export function createTools(ctx) {
             const control = left.find((line) => plainText(line) !== line);
             if (control)
                 return `Refused: "${control}" holds a control character or an escape sequence. Each line of "left" is plain text. Nothing was saved: call impeccable_report again.`;
+            const pending = lockRefusal(undefined, 'saved');
+            if (pending)
+                return `${pending} Call impeccable_report again once it answered.`;
             // The web page keeps the task list as the report leaves it, so no task may still read as waiting or running (#83).
             const open = ctx.sync.payload.tasks.filter((t) => !t.id.startsWith('preview-attempt-') && (t.status === 'pending' || t.status === 'in_progress'));
             if (open.length)
@@ -2159,6 +2416,10 @@ export function createTools(ctx) {
                 const shown = (path) => path.replace(/[\\`*_[\]<>|~]/g, '\\$&').replace(/[\x00-\x1f\x7f]/g, (c) => JSON.stringify(c).slice(1, -1));
                 markdown += `\n\n## What the setup pull request changes\n\n${changes ? changes.map(({ status, path }) => `- ${shown(path)} (${verbs[status] ?? status})`).join('\n') || 'Nothing: it carries no file.' : 'This checkout could not list its files: read them on the pull request before merging.'}`;
             }
+            // On a repository with several apps, how this run left each app, from what it saved and proved (#286).
+            const apps = appsRepo && pickedApps ? await appOutcomes(pi) : undefined;
+            if (apps)
+                markdown += appsSection(apps);
             if (previews.active && retry.pr) {
                 await observe(signal);
                 const lines = attempts().map((a, i) => `${i + 1}. [Attempt ${i + 1}](${a.url}) (run attempt ${a.attempt}): ${a.status}. ${a.diagnostics.map((d) => `${d.appKey}: step ${d.stage ?? 'unverified'}. ${d.reason}`).join(' ')}${a.changes.length ? ` Changed settings: ${a.changes.join(', ')}.` : ''}`);
@@ -2182,24 +2443,60 @@ export function createTools(ctx) {
                 return `Error: the report was refused (${res.status}: ${res.error}). Fix what it says and call impeccable_report again.`;
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
-            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
         }),
         tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. Without branch, where GitHub records a production deployment Vercel made and this folder is linked to the project (.vercel/project.json) the Vercel CLI reads as this repository\'s, production is the live app\'s address, the project\'s own domain, for the before. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer, and again on the person\'s yes when the time ran out. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
             const branch = p.branch;
-            const read = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
+            const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
+            if (refused)
+                return refused;
+            // The fact, the live app and an app's project read the same projects: each `vercel api` call is made once.
+            const reads = new Map();
+            const vercel = (args) => {
+                const key = JSON.stringify(args);
+                if (!reads.has(key))
+                    reads.set(key, (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal })(args));
+                return reads.get(key);
+            };
+            for (const origin of listedPreviews)
+                listedApps.delete(origin);
+            listedPreviews.clear();
+            vercelMade.clear();
+            publicProduction.clear();
+            // On a repository with several apps, the app's own project (#281): the one whose Root Directory is the app's folder, never the newest deployment's or the root link's.
+            const appKey = appsRepo ? p.appKey : undefined;
+            const app = appKey !== undefined ? await vercelApp(pi, appKey, vercel) : undefined;
+            if (app && 'reason' in app)
+                return JSON.stringify({ appKey, deployments: [], unmatched: app.reason });
+            const raw = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
+            // Vercel names each project's deployments on GitHub "Preview – <project>"; one without a name is told by the project's own record of it.
+            const owned = async (d) => {
+                if (!app)
+                    return true;
+                if (!d.vercel || !d.url)
+                    return false;
+                const named = /^(?:preview|production)\s[–-]\s(.+)$/i.exec(d.environment ?? '')?.[1];
+                return named !== undefined ? named === app.name : projectMadeDeployment(vercel, app.link, app.project, new URL(d.url).host);
+            };
+            const read = async () => {
+                const evidence = await raw();
+                if (!app)
+                    return evidence;
+                const kept = await Promise.all(evidence.deployments.map(owned));
+                return { ...evidence, deployments: evidence.deployments.filter((_, i) => kept[i]) };
+            };
             // With `branch` the evidence holds only the deployments of its head, and Vercel's is its build whatever environment it is called: the first deployment of a
             // project is its Production one, even from a branch. Another integration's deployment of the same commit says nothing about it. Without it a preview is a Preview.
             const isPreview = (d) => /preview/i.test(d.environment ?? '');
             const ofBranch = (d) => (branch !== undefined ? d.vercel : isPreview(d));
             // A head's build is still building until it has a final status.
             const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => ofBranch(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
-            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, () => vercelProjectPage('settings/git', chosenHostTeam(ctx.log, 'vercel'), vercelProject), signal) : await read();
-            listedPreviews.clear();
-            vercelMade.clear();
-            publicProduction.clear();
+            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, () => vercelProjectPage('settings/git', chosenHostTeam(ctx.log, 'vercel'), app?.name ?? vercelProject), signal) : await read();
+            /** The project the evidence is of: the app's, else the one this folder is linked to. */
+            const link = async () => (app ? app.link : readLink(pi.cwd));
             /** The hosts of the linked project's deployments while it is locked at every address, read from Vercel once a Production deployment turns up, and once per call. */
             let locked;
             for (const d of evidence.deployments) {
@@ -2209,8 +2506,8 @@ export function createTools(ctx) {
                 // A pushed branch's Production deployment is its preview only as the locked project's own: under Standard Protection a project's own address serves it to anyone, and another project of this repository may have made it.
                 if (branch !== undefined && !isPreview(d)) {
                     locked ??= await (async () => {
-                        const link = await readLink(pi.cwd);
-                        return link ? lockedDeploymentHosts((ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }), link, repository) : new Set();
+                        const linked = await link();
+                        return linked ? lockedDeploymentHosts(vercel, linked, repository) : new Set();
                     })();
                     if (!locked.has(url.host)) {
                         publicProduction.add(url.origin);
@@ -2220,39 +2517,48 @@ export function createTools(ctx) {
                 listedPreviews.add(url.origin);
                 if (d.vercel)
                     vercelMade.add(url.origin);
+                if (app)
+                    listedApps.set(url.origin, { appKey: appKey, link: app.link, name: app.name });
             }
-            // What vercel.json and the linked project say of the test drive's branch rides with the plain evidence, never with a wait: reported, never changed.
-            // The fact and the live app read the same linked project: one `vercel api` call answers both.
-            const reads = new Map();
-            const vercel = (args) => {
-                const key = JSON.stringify(args);
-                if (!reads.has(key))
-                    reads.set(key, (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal })(args));
-                return reads.get(key);
-            };
+            // Vercel deploys the repository (this app's project did) when it made a deployment of it, production included: then its previews start with the first pull request, and no Vercel setup is asked (#286).
+            if (branch === undefined) {
+                if (evidence.deployments.some((d) => d.vercel && d.state === 'success'))
+                    vercelDeployed.set(appKey ?? '', app?.name ?? '');
+                else
+                    vercelDeployed.delete(appKey ?? '');
+            }
+            // What vercel.json and the linked project (the app's, with its folder's vercel.json) say of the test drive's branch rides with the plain evidence, never with a wait: reported, never changed.
             if (branch === undefined) {
-                const fact = await (ctx.vercelPreviewsReader ?? vercelPreviewsFact)(pi.cwd, `${ctx.owner}/${ctx.repo}`, () => vercel);
+                const fact = await (ctx.vercelPreviewsReader ?? vercelPreviewsFact)(pi.cwd, `${ctx.owner}/${ctx.repo}`, () => vercel, app ? { directory: app.folder, link: app.link } : undefined);
                 if (fact) {
                     previewFacts.set('vercel', fact);
                     evidence.pullRequestPreviews = fact;
                 }
             }
             // The live app, where GitHub's record shows a production deployment Vercel made: its own address there is behind Vercel's login under Standard Protection, so the
-            // linked project is read for its alias, the project's own domain, and only as this repository's project.
+            // project is read for its alias, the project's own domain, and only as this repository's project.
             let production;
             if (branch === undefined && evidence.deployments.some((d) => d.vercel && d.state === 'success' && !isPreview(d))) {
-                const link = await readLink(pi.cwd);
-                const project = link ? await readOwnProject(vercel, link, repository) : null;
+                const linked = await link();
+                const project = linked ? await readOwnProject(vercel, linked, repository) : null;
                 production = project && !('reason' in project) ? project.productionUrl : undefined;
-                if (production && link)
-                    vercelProduction = { origin: new URL(production).origin, projectId: link.projectId };
-                noteProduction(production, 'vercel');
+                if (production && linked)
+                    vercelProductions.set(new URL(production).origin, linked.projectId);
+                noteProduction(production, 'vercel', undefined, appKey);
             }
-            return JSON.stringify({ ...evidence, ...(production ? { production } : {}) });
+            return JSON.stringify({ ...(appKey !== undefined ? { appKey, project: app.name } : {}), ...evidence, ...(production ? { production } : {}) });
         }),
         tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). production is the live site's own address, for the before. cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
-            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull });
+            const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
+            if (refused)
+                return refused;
+            // On a repository with several apps, only the site that builds the app's folder (#281).
+            const appKey = appsRepo ? p.appKey : undefined;
+            const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
+            if (appKey !== undefined && directory === undefined)
+                return JSON.stringify({ appKey, sites: [], previews: [], unmatched: `The setup state names no folder for the app ${appKey}.` });
+            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, ...(directory !== undefined ? { directory } : {}) });
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
             const states = ['success', 'ready', 'failure', 'error'];
             const final = (evidence) => Boolean(evidence.error) || evidence.previews.some((preview) => states.includes(preview.state ?? ''));
@@ -2262,21 +2568,42 @@ export function createTools(ctx) {
                 const site = e.previews.find((preview) => preview.pullRequest === pull)?.site ?? (known.size === 1 ? [...known][0] : undefined);
                 return site ? `https://app.netlify.com/projects/${encodeURIComponent(site)}/configuration/deploys#deploy-previews` : 'https://app.netlify.com/';
             }, signal) : await read();
+            for (const origin of netlifyListed)
+                listedApps.delete(origin);
             netlifyListed.clear();
-            for (const p of evidence.previews)
-                if (p.state === 'success' || p.state === 'ready')
-                    netlifyListed.add(new URL(p.url).origin);
+            for (const p of evidence.previews) {
+                if (p.state !== 'success' && p.state !== 'ready')
+                    continue;
+                netlifyListed.add(new URL(p.url).origin);
+                if (appKey !== undefined)
+                    listedApps.set(new URL(p.url).origin, { appKey });
+            }
             if (evidence.pullRequestPreviews)
                 previewFacts.set('netlify', evidence.pullRequestPreviews);
-            noteProduction(evidence.production, 'netlify', liveSite(evidence));
-            return JSON.stringify(evidence);
+            noteProduction(evidence.production, 'netlify', liveSite(evidence), appKey);
+            return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
         tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
                 return 'Invalid input: give pull or branch, not both.';
-            const read = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch });
+            const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
+            if (refused)
+                return refused;
+            // On a repository with several apps, only the Pages project that builds the app's folder (#281): told by the plain read, which a wait for a build keeps to.
+            const appKey = appsRepo ? p.appKey : undefined;
+            const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
+            if (appKey !== undefined && directory === undefined)
+                return JSON.stringify({ appKey, previews: [], unmatched: `The setup state names no folder for the app ${appKey}.` });
+            const appProject = appKey !== undefined ? cloudflareApps.get(appKey) : undefined;
+            if (appKey !== undefined && (pull !== undefined || branch !== undefined) && !appProject)
+                return `Refused: read impeccable_cloudflare_previews with appKey ${appKey} and no pull or branch first: it tells which Pages project builds that app.`;
+            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}) });
+            const read = async () => {
+                const evidence = await readAll();
+                return appProject ? { ...evidence, previews: evidence.previews.filter((preview) => pagesProject(preview.url) === appProject.label) } : evidence;
+            };
             // Cloudflare posts its check run once the build ended: until then the head lists nothing, or cf's row says it is building.
             // GitHub's record unread ends the wait; cf's alone does not, since the check run still says when the build ends.
             const final = (evidence) => Boolean(evidence.unread?.includes('GitHub')) || evidence.previews.some((preview) => preview.state !== 'building');
@@ -2289,18 +2616,24 @@ export function createTools(ctx) {
             const evidence = subject ? { ...waited, ...(app ? { githubApp: app } : {}) } : waited;
             if (!subject)
                 cloudflareEvidence = evidence;
+            if (!subject && appKey !== undefined && !evidence.unmatched && evidence.project)
+                cloudflareApps.set(appKey, { project: evidence.project, label: (evidence.production && pagesProject(evidence.production)) || evidence.project });
+            for (const origin of cloudflareListed)
+                listedApps.delete(origin);
             cloudflareListed.clear();
             for (const preview of evidence.previews) {
                 if (preview.state !== 'success')
                     continue;
-                cloudflareListed.add(new URL(preview.url).origin);
-                if (preview.alias)
-                    cloudflareListed.add(new URL(preview.alias).origin);
+                for (const address of [preview.url, ...(preview.alias ? [preview.alias] : [])]) {
+                    cloudflareListed.add(new URL(address).origin);
+                    if (appKey !== undefined)
+                        listedApps.set(new URL(address).origin, { appKey });
+                }
             }
             if (evidence.pullRequestPreviews)
                 previewFacts.set('cloudflare', evidence.pullRequestPreviews);
-            noteProduction(evidence.production, 'cloudflare');
-            return JSON.stringify(evidence);
+            noteProduction(evidence.unmatched ? undefined : evidence.production, 'cloudflare', undefined, appKey);
+            return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
         tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
@@ -2321,7 +2654,7 @@ export function createTools(ctx) {
             const proof = await provePreview(url, p.expect, pi.cwd, {
                 fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
                 // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
-                ...(bypassSecret && (bypassOrigins.has(origin) || (live && origin === vercelProduction?.origin && vercelProduction.projectId === bypassProject)) ? { bypass: bypassSecret } : {}),
+                ...(bypassFor(origin, live) ? { bypass: bypassFor(origin, live) } : {}),
                 ...(sitePassword && site && passwordSites.has(site) ? { password: sitePassword } : {}),
                 ...(token ? { access: token } : {}),
             });
@@ -2331,15 +2664,29 @@ export function createTools(ctx) {
                     provenLive.add(origin);
                 return JSON.stringify(proof);
             }
+            // On a repository with several apps, the app the address was listed for: its proof, its lock and its key are that app's alone (#281).
+            const app = listedApps.get(origin);
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
+            if (proof.proven && app)
+                provenApps.add(app.appKey);
+            if (proof.proven && app)
+                lockPending.delete(app.appKey);
+            // The lock in front of an app's preview is that app's own: its key tool is the next call for it, and every other app's steps wait for that (#286). An earlier proof of the app (another preview, or one the key opened before) says nothing about this lock: the app is proven again only once something opens it.
+            if (app && proof.gate && Object.hasOwn(LOCKS, proof.gate)) {
+                lockMet.set(app.appKey, proof.gate);
+                lockPending.set(app.appKey, proof.gate);
+                provenApps.delete(app.appKey);
+            }
             if (proof.proven && proof.pattern)
                 provenPattern = proof.pattern;
             if (proof.gate === 'vercel-protection' || proof.gate === 'netlify-protection')
-                gated = { url, expect: p.expect, gate: proof.gate, ...(proof.teamLogin ? { teamLogin: proof.teamLogin } : {}) };
+                gated = { url, expect: p.expect, gate: proof.gate, ...(proof.teamLogin ? { teamLogin: proof.teamLogin } : {}), ...(app ? { app } : {}) };
             if (proof.gate === 'cloudflare-access' && cloudflareListed.has(new URL(url).origin))
-                accessGated = { url, expect: p.expect };
+                accessGated = { url, expect: p.expect, ...(app ? { app } : {}) };
+            if (app)
+                return JSON.stringify({ ...proof, appKey: app.appKey });
             return JSON.stringify(proof);
         }),
         tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews: a site this run created with netlify sites:create, or one built from this repository already. A site built from another repository, or not created by this run, is left as it is, with the reason. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
@@ -2455,90 +2802,112 @@ export function createTools(ctx) {
             return answer('connected', { created: outcome.created, ...(outcome.subdomain ? { subdomain: outcome.subdomain } : {}), ...(outcome.productionBranch ? { productionBranch: outcome.productionBranch } : {}) });
         }),
         tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet. Only a project this run made with vercel project add and linked with vercel link, or one connected to this repository already, is connected: a project that existed before the run (vercel link links an existing project of the folder's name) is left as it is, with the reason, and the Vercel setup ends there. Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits, and when Vercel refuses the lock, it asks the person once to turn it on in the project's settings and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing; with production \"exists\", productionUrl is the live app's address, for the before. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => {
+            const refused = appRefusal(undefined, 'connected', false);
+            if (refused)
+                return refused;
             const answer = await vercelConnect(pi, signal);
             // A project that deploys production already names the live app's address, for the before.
             const link = answer.productionUrl ? await readLink(pi.cwd) : null;
             if (answer.productionUrl && link)
-                vercelProduction = { origin: new URL(answer.productionUrl).origin, projectId: link.projectId };
-            noteProduction(answer.productionUrl, 'vercel');
+                vercelProductions.set(new URL(answer.productionUrl).origin, link.projectId);
+            noteProduction(answer.productionUrl, 'vercel', undefined, connectedApp);
             return JSON.stringify(answer);
         }),
         tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts) and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
-            if (bypassOutcome?.status === 'skipped')
-                return JSON.stringify(bypassOutcome);
             const at = gated;
+            if (at.app)
+                lockPending.delete(at.app.appKey);
             const { origin, host } = new URL(at.url);
-            // Whose preview this is: a deployment status anyone with push access records gives any address, and the page there says nothing, so the project the
-            // link file names, read as the person and connected to this repository, has to have made the deployment before any secret of it goes there.
-            const link = await readLink(pi.cwd);
+            // Where the setup API keeps the secret: the app's own on a repository with several apps, else the repository's.
+            const store = at.app?.appKey ?? '';
+            const asked = bypassOutcomes.get(store);
+            if (asked?.status === 'skipped')
+                return JSON.stringify(asked);
+            // Whose preview this is: a deployment status anyone with push access records gives any address, and the page there says nothing, so the project has to have
+            // made the deployment before any secret of it goes there. That project is the app's own on a repository with several apps (#281), else the one the link file names.
+            const link = at.app?.link ?? (await readLink(pi.cwd));
             if (!link)
                 return `Refused: nothing was sent to ${at.url}. This folder is linked to no Vercel project (.vercel/project.json), and a bypass secret goes only to a preview the linked project serves.`;
             // Once this run's own vercel link wrote the file, only that link counts, as impeccable_vercel_connect holds it: rewritten since, it would name another project of the person's. A project the person linked before the run has no such record, and the reads below vouch for it.
+            // An app's project is read from Vercel's list of this repository's projects, never from the file.
             const links = linkedByRun(ctx.log);
             const own = links.get(link.projectId);
-            if ([...links.values()].some((l) => l.orgId !== undefined) && own?.orgId !== link.orgId)
+            if (!at.app && [...links.values()].some((l) => l.orgId !== undefined) && own?.orgId !== link.orgId)
                 return `Refused: nothing was sent to ${at.url}. This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team), and a bypass secret goes only to a preview the linked project serves.`;
             const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
             const project = await readOwnProject(vercel, link, repository);
+            const which = at.app ? 'The Vercel project that builds this app' : 'The Vercel project this folder is linked to';
             if ('reason' in project)
                 return `Refused: nothing was sent to ${at.url}. ${project.reason} A bypass secret goes only to a preview the linked project serves.`;
             // The page at the address is the deployment's to word, whatever host it is on, so the lock is told from the project's settings, read as the person: with none, no login of Vercel's stood in front.
             if (!project.previewsProtected)
                 return `Refused: nothing was sent to ${at.url}. Vercel's settings show no Deployment Protection on the project${project.name ? ` (${project.name})` : ''}, so what the address answered is the deployment's own page and the sign-in is the app's own: prove a page a visitor opens without signing in. A bypass secret goes only to a preview the linked project serves.`;
             if (!(await projectMadeDeployment(vercel, link, project, host)))
-                return `Refused: nothing was sent to ${at.url}. The Vercel project this folder is linked to${project.name ? ` (${project.name})` : ''} did not make the deployment at ${host}, and a bypass secret goes only to a preview the linked project serves.`;
-            // A secret in hand already: another address of the same project opens with it.
-            if (bypassSaved && bypassSecret && (await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: bypassSecret })).proven) {
-                bypassOrigins.add(origin);
-                return JSON.stringify(bypassSaved);
+                return `Refused: nothing was sent to ${at.url}. ${which}${project.name ? ` (${project.name})` : ''} did not make the deployment at ${host}, and a bypass secret goes only to a preview ${at.app ? 'that project' : 'the linked project'} serves.`;
+            /** The secret opened this address and is saved: proofs of it send that secret, and the app's preview is proven. */
+            const opened = () => {
+                bypassOrigins.set(origin, store);
+                hostedPreviewProven = true;
+                provenHost = 'Vercel';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
+            };
+            // A secret in hand already for the same store and project: another address of the project opens with it.
+            const held = bypassHeld.get(store);
+            if (held && held.projectId === link.projectId && (await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: held.secret })).proven) {
+                opened();
+                return JSON.stringify(held.saved);
             }
             /** The store took this attempt's secret: what was in hand no longer matches it, unless the setting followed. */
             let stored = false;
             const { value, ...told } = await passVercelLogin({
                 run: vercel,
                 link: async () => link,
+                // A project the folder is not linked to is named on the CLI's reads and makes; the reads are held to its id all the same.
+                ...(at.app?.name ? { project: at.app.name } : {}),
                 consent: async () => !(await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped,
                 paste: async () => {
-                    // The linked project's own settings page, in its team where the run knows it; else Vercel's picker.
+                    // The project's own settings page, in its team where the run knows it; else Vercel's picker.
                     (ctx.openBrowser ?? openBrowser)(vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), project.name));
                     const answer = await ask(sentTo(HOST_SCREENS['vercel-bypass-key'], at.url));
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
                 prove: (secret) => provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret }),
                 save: async (secret) => {
-                    const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret);
+                    const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret, at.app?.appKey);
                     stored = saved.stored;
                     return saved.failed;
                 },
                 remember: noteSensitiveAnswer,
             });
-            bypassOutcome = { ...told, ...(told.status === 'saved' ? { proven: true } : {}) };
+            const outcome = { ...told, ...(at.app ? { appKey: at.app.appKey } : {}), ...(told.status === 'saved' ? { proven: true } : {}) };
+            bypassOutcomes.set(store, outcome);
             if (value) {
                 // What is in hand follows the store: a new secret is the one saved now, and the origins the last one opened no longer stand.
-                bypassSecret = value;
-                bypassProject = link.projectId;
-                bypassOrigins.clear();
-                bypassOrigins.add(origin);
-                hostedPreviewProven = true;
-                provenHost = 'Vercel';
-                bypassSaved = bypassOutcome;
+                for (const [address, of] of bypassOrigins)
+                    if (of === store)
+                        bypassOrigins.delete(address);
+                bypassHeld.set(store, { secret: value, projectId: link.projectId, saved: outcome });
+                opened();
             }
             else if (told.status === 'save-failed' && stored) {
                 // The store holds the secret this attempt wrote without the setting that sends it: nothing in hand stands until a save goes through. A store the attempt never changed keeps the earlier one good.
-                bypassSecret = undefined;
-                bypassProject = undefined;
-                bypassOrigins.clear();
-                bypassSaved = undefined;
+                bypassHeld.delete(store);
+                for (const [address, of] of bypassOrigins)
+                    if (of === store)
+                        bypassOrigins.delete(address);
             }
-            return JSON.stringify(bypassOutcome);
+            return JSON.stringify(outcome);
         }),
         tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
             const at = gated;
+            if (at.app)
+                lockPending.delete(at.app.appKey);
             /** The address pattern the proof with the password answers, saved as the method once the password is. */
             let pattern;
             const prove = async (password, form = false) => {
@@ -2552,6 +2921,8 @@ export function createTools(ctx) {
                 // A site made public stands while the address opens with nothing sent; behind the login again, it is read again.
                 if ((await prove(undefined)).proven) {
                     provenPattern = pattern ?? provenPattern;
+                    if (at.app)
+                        provenApps.add(at.app.appKey);
                     return JSON.stringify(stands);
                 }
                 passwordStands.delete(site);
@@ -2561,6 +2932,8 @@ export function createTools(ctx) {
             // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
             if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
                 provenPattern = pattern ?? provenPattern;
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 return JSON.stringify(passwordSaved);
             }
             /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
@@ -2594,7 +2967,7 @@ export function createTools(ctx) {
                 },
                 prove,
                 save: async (password) => {
-                    const saved = await saveLock(pi, 'password', PASSWORD_HEADER, basicCredentials(password));
+                    const saved = await saveLock(pi, 'password', PASSWORD_HEADER, basicCredentials(password), at.app?.appKey);
                     stored = saved.stored;
                     return saved.failed;
                 },
@@ -2607,6 +2980,8 @@ export function createTools(ctx) {
                 // The site is public now: its previews open with nothing sent.
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 provenPattern = pattern ?? provenPattern;
             }
             if (value) {
@@ -2616,6 +2991,8 @@ export function createTools(ctx) {
                 passwordSites.add(site);
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 provenPattern = pattern ?? provenPattern;
                 passwordSaved = passwordOutcome;
             }
@@ -2630,21 +3007,25 @@ export function createTools(ctx) {
         tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
+            const at = accessGated;
+            // The call for this app is made, whatever it answers: the skip asked once stands for the next app's lock too.
+            if (at.app)
+                lockPending.delete(at.app.appKey);
             if (accessOutcome?.status === 'skipped')
                 return JSON.stringify(accessOutcome);
-            const at = accessGated;
             let proof;
             const prove = async (token) => (proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, access: token }));
             const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
             const save = async (token) => {
-                if (!(await call(pi, `${base}/preview-auth/access`, { method: 'PUT', body: { clientId: token.id, clientSecret: token.secret } })).ok)
+                const app = at.app ? { appKey: at.app.appKey } : {};
+                if (!(await call(pi, `${base}/preview-auth/access`, { method: 'PUT', body: { clientId: token.id, clientSecret: token.secret, ...app } })).ok)
                     return 'The setup API did not store the service token.';
                 // An app that signs in with Access sends this token already: the setting would make it a second credential, which the setup API refuses.
                 const repos = object((await call(pi, `${ctx.setupApi}/state`)).data)?.repos;
                 const lock = Array.isArray(repos) ? object(object(repos.map(object).find((r) => r?.name === ctx.repo)?.items)?.['preview-protection']) : undefined;
                 if (lock?.authMethod === 'access')
                     return null;
-                if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'access' } })).ok)
+                if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'access', ...app } })).ok)
                     return 'The setup API stored the service token, but not the setting that sends it: it is turned on under Preview protection on the setup page.';
                 return null;
             };
@@ -2695,6 +3076,8 @@ export function createTools(ctx) {
             if (told.status === 'saved') {
                 hostedPreviewProven = true;
                 provenHost = 'Cloudflare Pages';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 if (pattern)
                     provenPattern = pattern;
             }