@wtfalch/foundry 0.41.1 → 0.42.1

package/dist/plan/sign-in-bindings.js

@@ -0,0 +1,44 @@
+/** The login's host table env, and the document it holds (`auth/docs/company-login-hosts.md`). */
+export const LOGIN_HOST_BINDINGS_ENV = 'LOGIN_HOST_BINDINGS';
+/**
+ * The host table on a company's in-app login app. The company's own login stack has none of its own:
+ * its login host is the instance host, every in-app host is a binding. Parsed with a fixed error that
+ * never echoes the live value.
+ */
+function readDoc(raw, instanceHost, appId) {
+    if (!raw)
+        return { version: 1, instanceHost, sharedHosts: [instanceHost], bindings: [] };
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`${LOGIN_HOST_BINDINGS_ENV} on app ${appId} is not JSON; left as it is`);
+    }
+    const d = doc;
+    if (!d || d.version !== 1 || !Array.isArray(d.bindings) || !Array.isArray(d.sharedHosts)) {
+        throw new Error(`${LOGIN_HOST_BINDINGS_ENV} on app ${appId} has an unknown shape; left as it is`);
+    }
+    return d;
+}
+/**
+ * Adds, replaces and removes hosts in the host table of one in-app login app, then redeploys it when the
+ * document changed. Hosts not named stay as they are, so two steps that each own some hosts (the
+ * company's login-host step, Archon's step) never undo each other. Entries are sorted by host and the
+ * document is written compact, so a repeat writes the same text and deploys nothing.
+ */
+export async function editSignInBindings(coolify, input) {
+    const { appId, instanceHost } = input;
+    const live = (await coolify.listEnvs(appId)).find((e) => e.key === LOGIN_HOST_BINDINGS_ENV && !e.is_preview);
+    const doc = readDoc(live?.value || undefined, instanceHost, appId);
+    const touched = new Set([...(input.upsert ?? []).map((b) => b.host), ...(input.remove ?? [])]);
+    doc.bindings = [
+        ...doc.bindings.filter((b) => !touched.has(b.host)),
+        ...(input.upsert ?? []).map((b) => ({ ...b, clientIds: [...b.clientIds].sort() })),
+    ].sort((a, b) => (a.host < b.host ? -1 : 1));
+    const next = JSON.stringify(doc);
+    if (live?.value === next)
+        return;
+    await coolify.bulkUpsertEnvs(appId, [{ key: LOGIN_HOST_BINDINGS_ENV, value: next }]);
+    await coolify.deploy(appId);
+}

package/dist/plan/sign-in.d.ts

@@ -0,0 +1,135 @@
+import { type DeclaredOrg } from '../org.js';
+/**
+ * In-app sign-in (`signIn.inApp`, campaign 2026-10-15): a person signs in to Agora or Boule on that
+ * app's own address, under `/sign-in`, served by the login through the app's own proxy. This file holds
+ * the names the planner, the apps' env builders and the executor agree on. It imports `org.ts` only,
+ * so `agora.ts`, `boule.ts` and `login-host.ts` can all import it.
+ */
+/** The path the apps proxy to the login, and the login binding's `basePath`. */
+export declare const SIGN_IN_BASE_PATH = "/sign-in";
+/** The app env that turns the proxy on: the login's internal URL. Unset leaves the app unchanged. */
+export declare const SIGN_IN_UPSTREAM_ENV = "SIGNIN_UPSTREAM";
+/**
+ * The login image built with base path `/sign-in` (login build arg `NEXT_PUBLIC_BASE_PATH`). A Next.js
+ * base path is fixed at build, so the company login on `/` cannot also serve `/sign-in`: the in-app
+ * hosts are served by a second login app, `platform-auth-login-sign-in`, on the same Coolify network,
+ * with image tag suffix `-sign-in`.
+ */
+export declare const SIGN_IN_LOGIN_INTERNAL_NAME = "platform-auth-login-sign-in";
+export declare const SIGN_IN_LOGIN_PORT = "3000";
+export declare const SIGN_IN_IMAGE_TAG_SUFFIX = "-sign-in";
+/**
+ * Platform scope id the platform's sign-in step (`platform-providers.ts`) records once the second login app
+ * is created, deployed and holds the login token. Until it exists the login-host step plans no in-app host
+ * (a blocked line says so).
+ */
+export declare const SIGN_IN_LOGIN_APP_SCOPE_KEY = "coolify_platform_auth_login_sign_in_app";
+/**
+ * The order that switches a company on, and off again in reverse. Each step leaves people able to sign in on
+ * the old path until the next one is done, except where noted.
+ *
+ * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
+ * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
+ * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
+ *    the app's client id off the company's binding at the same write: that write and the base URI are the only
+ *    moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
+ */
+/**
+ * The app hosts the login-host step has trusted: `<host>=<clientId>` pairs, sorted and comma-joined
+ * ({@link inAppState}). Absent or empty means none. Recorded last, after every write it covers.
+ * A host stays here while its app still holds `SIGNIN_UPSTREAM`, even after the switch is off.
+ */
+export declare const SIGN_IN_TRUSTED_SCOPE_KEY = "login_host_in_app_trusted";
+/**
+ * What the login-host step last bound and pointed at the app's own address (base URI `https://<host>/sign-in/`):
+ * the same pairs, a subset of {@link SIGN_IN_TRUSTED_SCOPE_KEY}. Absent or empty means none. Recorded last,
+ * after every write it covers.
+ */
+export declare const SIGN_IN_IN_APP_SCOPE_KEY = "login_host_in_app";
+/**
+ * Prefix of the scope ids the Agora and Boule steps record after the app has been written, restarted or deployed:
+ * `<prefix>agora` holds the app host while its running env has `SIGNIN_UPSTREAM`, `''` while it has not.
+ */
+export declare const SIGN_IN_ENV_LIVE_SCOPE_PREFIX = "signin_env_live_";
+/** The app hosts whose running env holds `SIGNIN_UPSTREAM`, as the app steps recorded them. */
+export declare function signInEnvLiveHosts(recorded: Readonly<Record<string, string>>): Set<string>;
+/** Recorded `'1'` once the zone's one rate limit rule is the in-app one, `''` once it is the base one again. */
+export declare const SIGN_IN_RATE_LIMIT_SCOPE_KEY = "ratelimit_in_app";
+/**
+ * The `rate limit` rule description for a company with the switch: it also limits `/sign-in/` paths,
+ * except the static assets under `/sign-in/_next/`. Cloudflare Free allows the Path field only (no Method).
+ */
+export declare const SIGN_IN_RATE_LIMIT_DESCRIPTION = "foundry: rate limit sign-in paths (in-app)";
+export declare const SIGN_IN_RATE_LIMIT_EXPRESSION = "(starts_with(http.request.uri.path, \"/auth/\")) or (starts_with(http.request.uri.path, \"/sign-in/\") and not starts_with(http.request.uri.path, \"/sign-in/_next/\"))";
+/**
+ * True when the company has the switch on and it applies: a company domain whose login host is
+ * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
+ * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
+ */
+export declare function inAppSignIn(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): boolean;
+/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+export declare function staleSignInUpstream(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): boolean;
+/** The build argument (a build-time env in Coolify) that fixes the login's base path. */
+export declare const SIGN_IN_BUILD_ARG_ENV = "NEXT_PUBLIC_BASE_PATH";
+/** The Coolify name and internal address of the in-app login app next to a target's login app. */
+export declare function signInLoginNames(target: {
+    names: {
+        authLogin: string;
+    };
+    internal: {
+        authLogin: string;
+    };
+}): {
+    name: string;
+    internal: string;
+};
+/**
+ * True when the company's in-app sign-in goes through the platform's shared login (its sign-in is the
+ * platform's ZITADEL), so the platform needs the in-app login app. A company running its own services
+ * has its own login stack instead.
+ */
+export declare function inAppOnSharedLogin(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): boolean;
+/**
+ * The internal URL every in-app app proxies `/sign-in/*` to: the platform's in-app login, or, for a
+ * company that runs its own services, the one in its own sign-in stack (`<slug>-auth-login-sign-in`).
+ */
+export declare function signInUpstream(org?: Pick<DeclaredOrg, 'slug' | 'services'>): string;
+/** One app host that signs in on its own address. */
+export interface InAppApp {
+    app: 'agora' | 'boule' | 'archon';
+    host: string;
+    clientId: string;
+    /** The ZITADEL organisation the host signs people in to, when it is not the company's own (Archon's). */
+    organisationId?: string;
+}
+/** {@link SIGN_IN_IN_APP_SCOPE_KEY}'s value for these apps. */
+export declare function inAppState(apps: readonly Pick<InAppApp, 'host' | 'clientId'>[]): string;
+/** The `{host, clientId}` pairs a recorded {@link inAppState} names. */
+export declare function inAppStatePairs(state: string | undefined): Array<Pick<InAppApp, 'host' | 'clientId'>>;
+/** The hosts a recorded {@link inAppState} names. */
+export declare function inAppStateHosts(state: string | undefined): string[];
+/** The login binding, ZITADEL org id aside, for one in-app host. */
+export declare function inAppBindingFor(app: InAppApp): {
+    host: string;
+    clientIds: string[];
+    apps: Record<string, 'agora' | 'boule' | 'archon'>;
+    basePath: typeof SIGN_IN_BASE_PATH;
+};
+/**
+ * What the login-host step records for these wanted apps, given what the apps' steps have recorded:
+ * `trusted` is every wanted host plus any host given up whose app still holds `SIGNIN_UPSTREAM` (its trusted
+ * domain stays until the env is gone); `active` is the wanted hosts whose env is live: bound, with the app's own base URI.
+ */
+export declare function inAppTargets(apps: readonly InAppApp[], recorded: Readonly<Record<string, string>>): {
+    trusted: string;
+    active: string;
+};
+/**
+ * True when an app should proxy `/sign-in/*` to the login: its host is trusted there, and the
+ * company still has the switch on or the base URI still points at the app (it is switched off in reverse
+ * order: the base URI goes back before the app stops proxying).
+ */
+export declare function inAppHostApplied(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>, recorded: Readonly<Record<string, string>>, host: string): boolean;

package/dist/plan/sign-in.js

@@ -0,0 +1,172 @@
+import { ownsServices } from '../org.js';
+/**
+ * In-app sign-in (`signIn.inApp`, campaign 2026-10-15): a person signs in to Agora or Boule on that
+ * app's own address, under `/sign-in`, served by the login through the app's own proxy. This file holds
+ * the names the planner, the apps' env builders and the executor agree on. It imports `org.ts` only,
+ * so `agora.ts`, `boule.ts` and `login-host.ts` can all import it.
+ */
+/** The path the apps proxy to the login, and the login binding's `basePath`. */
+export const SIGN_IN_BASE_PATH = '/sign-in';
+/** The app env that turns the proxy on: the login's internal URL. Unset leaves the app unchanged. */
+export const SIGN_IN_UPSTREAM_ENV = 'SIGNIN_UPSTREAM';
+/**
+ * The login image built with base path `/sign-in` (login build arg `NEXT_PUBLIC_BASE_PATH`). A Next.js
+ * base path is fixed at build, so the company login on `/` cannot also serve `/sign-in`: the in-app
+ * hosts are served by a second login app, `platform-auth-login-sign-in`, on the same Coolify network,
+ * with image tag suffix `-sign-in`.
+ */
+export const SIGN_IN_LOGIN_INTERNAL_NAME = 'platform-auth-login-sign-in';
+export const SIGN_IN_LOGIN_PORT = '3000';
+export const SIGN_IN_IMAGE_TAG_SUFFIX = '-sign-in';
+/**
+ * Platform scope id the platform's sign-in step (`platform-providers.ts`) records once the second login app
+ * is created, deployed and holds the login token. Until it exists the login-host step plans no in-app host
+ * (a blocked line says so).
+ */
+export const SIGN_IN_LOGIN_APP_SCOPE_KEY = 'coolify_platform_auth_login_sign_in_app';
+/**
+ * The order that switches a company on, and off again in reverse. Each step leaves people able to sign in on
+ * the old path until the next one is done, except where noted.
+ *
+ * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
+ * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
+ * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
+ *    the app's client id off the company's binding at the same write: that write and the base URI are the only
+ *    moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
+ */
+/**
+ * The app hosts the login-host step has trusted: `<host>=<clientId>` pairs, sorted and comma-joined
+ * ({@link inAppState}). Absent or empty means none. Recorded last, after every write it covers.
+ * A host stays here while its app still holds `SIGNIN_UPSTREAM`, even after the switch is off.
+ */
+export const SIGN_IN_TRUSTED_SCOPE_KEY = 'login_host_in_app_trusted';
+/**
+ * What the login-host step last bound and pointed at the app's own address (base URI `https://<host>/sign-in/`):
+ * the same pairs, a subset of {@link SIGN_IN_TRUSTED_SCOPE_KEY}. Absent or empty means none. Recorded last,
+ * after every write it covers.
+ */
+export const SIGN_IN_IN_APP_SCOPE_KEY = 'login_host_in_app';
+/**
+ * Prefix of the scope ids the Agora and Boule steps record after the app has been written, restarted or deployed:
+ * `<prefix>agora` holds the app host while its running env has `SIGNIN_UPSTREAM`, `''` while it has not.
+ */
+export const SIGN_IN_ENV_LIVE_SCOPE_PREFIX = 'signin_env_live_';
+/** The app hosts whose running env holds `SIGNIN_UPSTREAM`, as the app steps recorded them. */
+export function signInEnvLiveHosts(recorded) {
+    return new Set(Object.entries(recorded)
+        .filter(([key, host]) => key.startsWith(SIGN_IN_ENV_LIVE_SCOPE_PREFIX) && host !== '')
+        .map(([, host]) => host));
+}
+/** Recorded `'1'` once the zone's one rate limit rule is the in-app one, `''` once it is the base one again. */
+export const SIGN_IN_RATE_LIMIT_SCOPE_KEY = 'ratelimit_in_app';
+/**
+ * The `rate limit` rule description for a company with the switch: it also limits `/sign-in/` paths,
+ * except the static assets under `/sign-in/_next/`. Cloudflare Free allows the Path field only (no Method).
+ */
+export const SIGN_IN_RATE_LIMIT_DESCRIPTION = 'foundry: rate limit sign-in paths (in-app)';
+export const SIGN_IN_RATE_LIMIT_EXPRESSION = '(starts_with(http.request.uri.path, "/auth/")) or (starts_with(http.request.uri.path, "/sign-in/") and not starts_with(http.request.uri.path, "/sign-in/_next/"))';
+/**
+ * True when the company has the switch on and it applies: a company domain whose login host is
+ * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
+ * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
+ */
+export function inAppSignIn(org) {
+    return org.signIn?.inApp === true && Boolean(org.domain) && org.issuer.usesDomain;
+}
+/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+export function staleSignInUpstream(desired, live) {
+    const held = live[SIGN_IN_UPSTREAM_ENV];
+    return desired[SIGN_IN_UPSTREAM_ENV] === undefined && held !== undefined && held !== '';
+}
+/** The build argument (a build-time env in Coolify) that fixes the login's base path. */
+export const SIGN_IN_BUILD_ARG_ENV = 'NEXT_PUBLIC_BASE_PATH';
+/** The Coolify name and internal address of the in-app login app next to a target's login app. */
+export function signInLoginNames(target) {
+    return {
+        name: `${target.names.authLogin}${SIGN_IN_IMAGE_TAG_SUFFIX}`,
+        internal: `${target.internal.authLogin}${SIGN_IN_IMAGE_TAG_SUFFIX}`,
+    };
+}
+/**
+ * True when the company's in-app sign-in goes through the platform's shared login (its sign-in is the
+ * platform's ZITADEL), so the platform needs the in-app login app. A company running its own services
+ * has its own login stack instead.
+ */
+export function inAppOnSharedLogin(org) {
+    return inAppSignIn(org) && !ownsServices(org);
+}
+/**
+ * The internal URL every in-app app proxies `/sign-in/*` to: the platform's in-app login, or, for a
+ * company that runs its own services, the one in its own sign-in stack (`<slug>-auth-login-sign-in`).
+ */
+export function signInUpstream(org) {
+    const host = org && ownsServices(org)
+        ? signInLoginNames({
+            names: { authLogin: `${org.slug}-auth-login` },
+            internal: { authLogin: `${org.slug}-auth-login` },
+        }).internal
+        : SIGN_IN_LOGIN_INTERNAL_NAME;
+    return `http://${host}:${SIGN_IN_LOGIN_PORT}`;
+}
+/** {@link SIGN_IN_IN_APP_SCOPE_KEY}'s value for these apps. */
+export function inAppState(apps) {
+    return apps
+        .map((a) => `${a.host}=${a.clientId}`)
+        .sort()
+        .join(',');
+}
+/** The `{host, clientId}` pairs a recorded {@link inAppState} names. */
+export function inAppStatePairs(state) {
+    return (state ?? '')
+        .split(',')
+        .map((pair) => {
+        const at = pair.indexOf('=');
+        return at < 0
+            ? { host: pair, clientId: '' }
+            : { host: pair.slice(0, at), clientId: pair.slice(at + 1) };
+    })
+        .filter((pair) => pair.host.length > 0);
+}
+/** The hosts a recorded {@link inAppState} names. */
+export function inAppStateHosts(state) {
+    return (state ?? '')
+        .split(',')
+        .map((pair) => pair.split('=')[0] ?? '')
+        .filter((host) => host.length > 0);
+}
+/** The login binding, ZITADEL org id aside, for one in-app host. */
+export function inAppBindingFor(app) {
+    return {
+        host: app.host,
+        clientIds: [app.clientId],
+        apps: { [app.clientId]: app.app },
+        basePath: SIGN_IN_BASE_PATH,
+    };
+}
+/**
+ * What the login-host step records for these wanted apps, given what the apps' steps have recorded:
+ * `trusted` is every wanted host plus any host given up whose app still holds `SIGNIN_UPSTREAM` (its trusted
+ * domain stays until the env is gone); `active` is the wanted hosts whose env is live: bound, with the app's own base URI.
+ */
+export function inAppTargets(apps, recorded) {
+    const live = signInEnvLiveHosts(recorded);
+    const wanted = new Set(apps.map((a) => a.host));
+    const kept = inAppStatePairs(recorded[SIGN_IN_TRUSTED_SCOPE_KEY]).filter((pair) => !wanted.has(pair.host) && live.has(pair.host));
+    return {
+        trusted: inAppState([...apps, ...kept]),
+        active: inAppState(apps.filter((a) => live.has(a.host))),
+    };
+}
+/**
+ * True when an app should proxy `/sign-in/*` to the login: its host is trusted there, and the
+ * company still has the switch on or the base URI still points at the app (it is switched off in reverse
+ * order: the base URI goes back before the app stops proxying).
+ */
+export function inAppHostApplied(org, recorded, host) {
+    if (!inAppStateHosts(recorded[SIGN_IN_TRUSTED_SCOPE_KEY]).includes(host))
+        return false;
+    return inAppSignIn(org) || inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY]).includes(host);
+}

package/dist/store/postgres.js

@@ -1,5 +1,5 @@
 import { and, asc, desc, eq, ne, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateDomainClaim, validateHosting, validateMail, validateOwners, validateServices, validateSite, validateVersionPin, } from '../org.js';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateDomainClaim, validateHosting, validateMail, validateOwners, validateServices, validateSignIn, validateSite, validateVersionPin, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
 import { findNameClashes, nameClashMessage } from '../plan/org-names.js';
 import { validatePlatform } from '../platform.js';
@@ -146,6 +146,8 @@ function rowToOrg(row) {
                 },
             }
             : {}),
+        // Omitted while off.
+        ...(row.signInInApp ? { signIn: { inApp: true } } : {}),
         // Omitted while unset. Validated on read: a stored value is not trusted.
         ...(row.versionPin ? { versionPin: readVersionPin(row) } : {}),
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
@@ -198,6 +200,7 @@ function orgToRow(org) {
         callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
         callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
+        signInInApp: org.signIn?.inApp ?? false,
         servicesOwn: org.services?.own ?? false,
         servicesSfuSlot: org.services?.sfuSlot ?? null,
         versionPin: org.versionPin && Object.keys(org.versionPin).length > 0 ? org.versionPin : null,
@@ -401,6 +404,9 @@ export function createPostgresDeclaredOrgStore(db) {
         const reason = validateServices(org);
         if (reason)
             throw new DeclaredOrgError(`services invalid: ${reason}`);
+        const signInReason = validateSignIn(org);
+        if (signInReason)
+            throw new DeclaredOrgError(`signIn invalid: ${signInReason}`);
         const slot = org.services?.sfuSlot ?? null;
         if (slot === null)
             return;

package/dist/store/schema.d.ts

@@ -355,6 +355,23 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        signInInApp: import("drizzle-orm/pg-core").PgColumn<{
+            name: "signin_in_app";
+            tableName: "foundry_declared_orgs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         versionPin: import("drizzle-orm/pg-core").PgColumn<{
             name: "version_pin";
             tableName: "foundry_declared_orgs";

package/dist/store/schema.js

@@ -38,6 +38,8 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     // ServicesConfig (org.ts): false and null are the platform's shared services.
     servicesOwn: boolean('services_own').notNull().default(false),
     servicesSfuSlot: integer('services_sfu_slot'),
+    // SignInConfig.inApp (org.ts); migrations/0054.
+    signInInApp: boolean('signin_in_app').notNull().default(false),
     // VersionPin (org.ts): null follows the platform. `migrations/0053_org_version_pin.sql`.
     versionPin: jsonb('version_pin').$type(),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.41.1",
+  "version": "0.42.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",