@wtfalch/foundry 0.41.2 → 0.42.1

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, VersionPin, VersionPinPart, } from './org.js';
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateVersionPin, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, EntryVolume, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, EnvHeldSecret, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, OrgServiceSchema, ServicesConfig, SignInConfig, VersionPin, VersionPinPart, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey, PlatformSfuService, HeartbeatsProvider, } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateVersionPin, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, ORG_SERVICE_SCHEMAS, SFU_SLOT_MAX, VERSION_PIN_PARTS, appEntry, heldEnvRef, ownerMailboxes, ownsServices, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateServices, validateSignIn, validateVersionPin, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, HEARTBEATS_PROVIDERS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own

package/dist/migrations/0054_org_signin_in_app.sql

@@ -0,0 +1,6 @@
+-- @wtfalch/foundry: a company's in-app sign-in switch. `signin_in_app` true moves the
+-- people's sign-in onto each app's own address (`/sign-in`); false (default) keeps the
+-- company's login host. Additive. Mirrors src/store/schema.ts's `declaredOrgs`.
+
+alter table foundry_declared_orgs
+  add column if not exists signin_in_app boolean not null default false;

package/dist/org.d.ts

@@ -636,6 +636,21 @@ export interface ServicesConfig {
     sfuSlot?: number | null;
 }
 export declare const SFU_SLOT_MAX = 20;
+/**
+ * Per-company sign-in placement. `inApp` (default off) moves the people's sign-in from the
+ * company's login host onto each app's own address (`/sign-in` on agora.<domain>, boule.<domain>),
+ * through the login that serves that path. Read through `plan/sign-in.ts`'s `inAppSignIn`.
+ */
+export interface SignInConfig {
+    inApp: boolean;
+}
+/**
+ * `null` when `signIn` is valid. The switch needs a company domain whose login host is
+ * `auth.<domain>`: a company on `oikos.host` (tier 1) keeps today's flow, so the declaration
+ * is refused there rather than silently ignored. A company with its own services is covered: its
+ * own sign-in stack gets the second login app.
+ */
+export declare function validateSignIn(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): string | null;
 /** The only reader of `services.own`. Every company runs its own services, the platform's owner company too; a company without a domain runs them on oikos.host. */
 export declare function ownsServices(org: Pick<DeclaredOrg, 'services'>): boolean;
 /** The pure part of the `services` rules; that no two orgs share an `sfuSlot` is the store's check. */
@@ -916,6 +931,8 @@ export interface DeclaredOrg {
     hosting: HostingConfig;
     /** Absent means `{ own: false }`. Optional so every existing literal and test fixture compiles unchanged, as `calls.versionPin` and `MailConfig.mailApps` do. */
     services?: ServicesConfig;
+    /** Absent means `{ inApp: false }`. Optional so every existing literal and fixture compiles unchanged. */
+    signIn?: SignInConfig;
     /** Parts of this company held on their own version. Absent or null follows the platform. Ignored for the owner company. */
     versionPin?: VersionPin | null;
     sso: SsoConfig;

package/dist/org.js

@@ -904,6 +904,20 @@ export function validateVersionPin(org) {
     return null;
 }
 export const SFU_SLOT_MAX = 20;
+/**
+ * `null` when `signIn` is valid. The switch needs a company domain whose login host is
+ * `auth.<domain>`: a company on `oikos.host` (tier 1) keeps today's flow, so the declaration
+ * is refused there rather than silently ignored. A company with its own services is covered: its
+ * own sign-in stack gets the second login app.
+ */
+export function validateSignIn(org) {
+    if (org.signIn?.inApp !== true)
+        return null;
+    if (!org.domain || !org.issuer.usesDomain) {
+        return 'signIn.inApp needs a company domain with issuer.usesDomain: a company on oikos.host keeps the sign-in on its login host';
+    }
+    return null;
+}
 /** The only reader of `services.own`. Every company runs its own services, the platform's owner company too; a company without a domain runs them on oikos.host. */
 export function ownsServices(org) {
     return org.services?.own === true;

package/dist/plan/agora.d.ts

@@ -224,7 +224,10 @@ export declare function desiredAgoraEnv(org: DeclaredOrg, recorded: Readonly<Rec
     env: Record<string, string>;
     missing: string[];
 };
-/** The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored. */
+/**
+ * The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored,
+ * except `SIGNIN_UPSTREAM`: the switch turned off must take it away, so a live one that is not desired is drift.
+ */
 export declare function agoraEnvDrift(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): string[];
 /**
  * #442: recorded once a restart has confirmed the org's live Agora process

package/dist/plan/agora.js

@@ -1,5 +1,6 @@
 import { chatUpstreams } from './chat-matrix.js';
 import { FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
+import { SIGN_IN_UPSTREAM_ENV, inAppHostApplied, signInUpstream, staleSignInUpstream, } from './sign-in.js';
 /**
  * #164: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's Agora -- the hostname, the values the host
@@ -288,6 +289,9 @@ export function desiredAgoraEnv(org, recorded, rawHost) {
             chat: { enabled: org.chat.enabled },
             // Agora draws call buttons only when this is true.
             calls: { enabled: org.calls.enabled },
+            // In-app sign-in: Agora reads this at runtime (one image serves every company). Set with `SIGNIN_UPSTREAM`
+            // only, so Agora never shows the in-app screen before the login can serve it.
+            ...(inAppHostApplied(org, recorded, agoraHostnameFor(org)) ? { signInInApp: true } : {}),
         });
     }
     if (org.mail.mode !== 'off' && host.mailUpstream) {
@@ -309,6 +313,10 @@ export function desiredAgoraEnv(org, recorded, rawHost) {
     if (org.calls.enabled && callsServiceHasName(org, recorded)) {
         env.AGORA_CALLS_UPSTREAM = `http://${callsServiceInternalName(org)}:${CALLS_SERVICE_PORT}`;
     }
+    // In-app sign-in: the app proxies `/sign-in/*` to the login only after its host is applied there.
+    if (inAppHostApplied(org, recorded, agoraHostnameFor(org))) {
+        env[SIGN_IN_UPSTREAM_ENV] = signInUpstream(org);
+    }
     return { env, missing };
 }
 function stable(value) {
@@ -330,14 +338,20 @@ function sameEnvValue(key, desired, live) {
         return false;
     }
 }
-/** The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored. */
+/**
+ * The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored,
+ * except `SIGNIN_UPSTREAM`: the switch turned off must take it away, so a live one that is not desired is drift.
+ */
 export function agoraEnvDrift(desired, live) {
-    return Object.entries(desired)
+    const drift = Object.entries(desired)
         .filter(([key, value]) => {
         const liveValue = live[key];
         return liveValue === undefined || !sameEnvValue(key, value, liveValue);
     })
         .map(([key]) => key);
+    if (staleSignInUpstream(desired, live))
+        drift.push(SIGN_IN_UPSTREAM_ENV);
+    return drift;
 }
 /**
  * #442: recorded once a restart has confirmed the org's live Agora process

package/dist/plan/boule.d.ts

@@ -80,7 +80,7 @@ export declare const BOULE_BRIDGE_SECRET_ENV = "ARCHON_BRIDGE_SECRET";
 /** The role Boule creates from {@link BOULE_PEER_PASSWORD_ENV}, with grants on schema `authz` only. */
 export declare const BOULE_PEER_ROLE = "authz_operator_rt";
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "AUTHZ_FIRST_OWNER", "ARCHON_URL", "MAIL_FROM", "LETTERMINT_API_TOKEN", "AUTHZ_PEER_PASSWORD_OPERATOR", "ARCHON_BRIDGE_SECRET", "SIGNIN_UPSTREAM"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a
@@ -124,5 +124,8 @@ export declare function wantedBouleBrokerEntry(org: DeclaredOrg, recorded: Reado
 } | {
     missing: BrokerEntryInput[];
 };
-/** The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored. */
+/**
+ * The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored,
+ * except `SIGNIN_UPSTREAM`: the switch turned off must take it away, so a live one that is not desired is drift.
+ */
 export declare function bouleEnvDrift(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): string[];

package/dist/plan/boule.js

@@ -1,5 +1,6 @@
 import { DEFAULT_NO_REPLY_LOCAL_PART } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { SIGN_IN_UPSTREAM_ENV, inAppHostApplied, signInUpstream, staleSignInUpstream, } from './sign-in.js';
 /**
  * #161 (Boule part): what both the planner (`diff.ts`) and the executor
  * (`executor.ts`) need to agree on for an org's Boule -- the hostname, the
@@ -103,6 +104,7 @@ export const BOULE_MANAGED_ENV_KEYS = [
     BOULE_MAIL_TOKEN_ENV,
     BOULE_PEER_PASSWORD_ENV,
     BOULE_BRIDGE_SECRET_ENV,
+    SIGN_IN_UPSTREAM_ENV,
 ];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
@@ -162,6 +164,10 @@ export function desiredBouleEnv(org, recorded, issuer, archonUrl, mailWanted = f
     const mailDomain = recorded[MAIL_DOMAIN_RECORDED_KEY];
     if (mailWanted && mailDomain)
         env.MAIL_FROM = bouleMailFrom(org, mailDomain);
+    // In-app sign-in: the app proxies `/sign-in/*` to the login only after its host is applied there.
+    if (inAppHostApplied(org, recorded, bouleHostnameFor(org))) {
+        env[SIGN_IN_UPSTREAM_ENV] = signInUpstream(org);
+    }
     return { env, missing };
 }
 /** The `AUTH_APPS` name of an org's Boule broker entry, and the scope key suffix it records under. */
@@ -201,9 +207,15 @@ export function wantedBouleBrokerEntry(org, recorded) {
         },
     };
 }
-/** The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored. */
+/**
+ * The desired env keys the live app lacks or holds a different value for. Extra live keys are ignored,
+ * except `SIGNIN_UPSTREAM`: the switch turned off must take it away, so a live one that is not desired is drift.
+ */
 export function bouleEnvDrift(desired, live) {
-    return Object.entries(desired)
+    const drift = Object.entries(desired)
         .filter(([key, value]) => live[key] !== value)
         .map(([key]) => key);
+    if (staleSignInUpstream(desired, live))
+        drift.push(SIGN_IN_UPSTREAM_ENV);
+    return drift;
 }

package/dist/plan/coolify-previews.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Foundry deploys from its own pipeline, so Coolify's pull-request previews
+ * stay off on every app it manages (#788).
+ *
+ * Whether a live app has them on. `@wtfalch/providers` types the field on
+ * create and update only, and the read location (top level, or under
+ * `settings` as `is_consistent_container_name_enabled` is) is not documented,
+ * so both are read. Absent in both reads as off.
+ */
+export declare function previewsOn(app: unknown): boolean;

package/dist/plan/coolify-previews.js

@@ -0,0 +1,14 @@
+/**
+ * Foundry deploys from its own pipeline, so Coolify's pull-request previews
+ * stay off on every app it manages (#788).
+ *
+ * Whether a live app has them on. `@wtfalch/providers` types the field on
+ * create and update only, and the read location (top level, or under
+ * `settings` as `is_consistent_container_name_enabled` is) is not documented,
+ * so both are read. Absent in both reads as off.
+ */
+export function previewsOn(app) {
+    const a = app;
+    return (a?.is_preview_deployments_enabled === true ||
+        a?.settings?.is_preview_deployments_enabled === true);
+}

package/dist/plan/diff.js

@@ -12,7 +12,7 @@ import { planFilesKeys } from './entry-files-key.js';
 import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
@@ -24,6 +24,7 @@ import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryRoutes, entryRoutesMarker, } from './proxy-labels.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
+import { SIGN_IN_BASE_PATH, SIGN_IN_IMAGE_TAG_SUFFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_LOGIN_INTERNAL_NAME, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, inAppSignIn, inAppStatePairs, inAppTargets, } from './sign-in.js';
 import { withStepSystem } from './step-system.js';
 import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
@@ -228,7 +229,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
-    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false);
+    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false, platformReadiness.signInLoginReady ?? false);
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
     // #444a: the org's one shared Postgres server and its fixed schema
@@ -1085,13 +1086,21 @@ export function isPlatformOwnOrg(org, platformOwnerOrgId) {
  * platform's own domain, never plans the shared ZITADEL instance's own login
  * host as its own -- `auth.companyincluded.com` colliding with itself.
  */
-function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired) {
+function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, signInLoginReady = false) {
     const none = { step: null, blocked: null };
     // An own org's instance has no shared login host to bind: its issuer is the sign-in service's own.
+    // Only in-app sign-in plans a step for it: the app hosts, through its own in-app login app.
     if (ownsServices(org))
-        return none;
+        return planOwnLoginHost(org, recordedIds);
     const key = resourceKey('zitadel', 'login-host', org.id);
     const host = loginHostnameFor(org);
+    // In-app sign-in: each app host gets its own binding, trusted domain and base URI. Until the second
+    // login app that serves `/sign-in` is applied, no app host is planned (a blocked line says so).
+    const wantedApps = inAppApps(org, recordedIds);
+    const apps = signInLoginReady ? wantedApps : [];
+    const inAppWaiting = wantedApps.length > 0 && !signInLoginReady
+        ? `${org.slug}'s in-app sign-in waits for the login app that serves ${SIGN_IN_BASE_PATH} (${SIGN_IN_LOGIN_INTERNAL_NAME}), which the platform has not applied`
+        : null;
     function stepFor() {
         return {
             step: {
@@ -1099,7 +1108,11 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
                     system: 'zitadel',
                     kind: 'login-host',
                     key: org.id,
-                    desired: { host },
+                    desired: apps.length > 0 ||
+                        recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ||
+                        recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY]
+                        ? { host, apps }
+                        : { host },
                 },
                 step: {
                     description: `set ${org.slug}'s login host to ${host}`,
@@ -1107,7 +1120,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
                     migrates: false,
                 },
             },
-            blocked: null,
+            blocked: inAppWaiting,
         };
     }
     // Already applied -- a re-run plans nothing unless the host changed, an app
@@ -1116,11 +1129,14 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // `zitadelLoginHost` always advances the recorded host to the current one,
     // so a pending removal is the only way to know one is still owed, and
     // nothing else here would replan the step to retry it.
+    const targets = inAppTargets(apps, recordedIds);
     if (recordedIds[key] === host &&
         recordedIds[LOGIN_BINDING_SCOPE_KEY] ===
-            loginBindingState(host, loginHostClientIds(org, recordedIds)) &&
+            loginBindingState(host, loginHostClientIds(org, recordedIds, inAppStatePairs(targets.active).map((pair) => pair.clientId))) &&
+        (recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
+        (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
         pendingRemovalHosts(recordedIds).length === 0) {
-        return none;
+        return { step: null, blocked: inAppWaiting };
     }
     // #177: nothing to add a trusted domain to yet -- `planIssuer` already
     // reports the platform's sign-in as blocked, so this step stays silent
@@ -1132,6 +1148,55 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // repoint nothing until the port that writes the binding is wired.
     return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor();
 }
+/**
+ * In-app sign-in for a company that runs its own services: each app host is trusted in the company's
+ * own ZITADEL, bound in its in-app login app (`<slug>-auth-login-sign-in`) and given
+ * `https://<app host>/sign-in/` as its Login V2 base URI. Planned once the company's own sign-in is
+ * applied and that login app is recorded; until then one blocked line says what it waits for.
+ * Archon's host is not here: the platform's Archon step owns it.
+ */
+function planOwnLoginHost(org, recordedIds) {
+    const none = { step: null, blocked: null };
+    // Nothing wanted and nothing owed.
+    if (!inAppSignIn(org) && !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY])
+        return none;
+    // The company's own sign-in is reported on its own line (`coolify:own-auth`).
+    if (!ownAuthApplied(org, recordedIds))
+        return none;
+    const host = ownHostnames(org).auth;
+    const wantedApps = inAppApps(org, recordedIds);
+    const ready = Boolean(recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY]);
+    const apps = ready ? wantedApps : [];
+    const waiting = wantedApps.length > 0 && !ready
+        ? `${org.slug}'s in-app sign-in waits for the login app that serves ${SIGN_IN_BASE_PATH} (${org.slug}-auth-login${SIGN_IN_IMAGE_TAG_SUFFIX}), which the company's own sign-in has not applied`
+        : null;
+    // The company's own login host needs nothing here, so only the app hosts decide whether work is owed.
+    const targets = inAppTargets(apps, recordedIds);
+    if ((recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
+        (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
+        pendingRemovalHosts(recordedIds).length === 0) {
+        return { step: null, blocked: waiting };
+    }
+    // Nothing to trust a domain in, or to bind in, before the org exists in the company's ZITADEL.
+    if (!recordedIds.zitadel_org)
+        return { step: null, blocked: waiting };
+    return {
+        step: {
+            action: {
+                system: 'zitadel',
+                kind: 'login-host',
+                key: org.id,
+                desired: { host, apps },
+            },
+            step: {
+                description: `set ${org.slug}'s app hosts to sign in on their own addresses`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: waiting,
+    };
+}
 /**
  * Every sign-in app this org already has live (web or native, not api) gets
  * "user info inside the ID token" switched on once: apps made before the
@@ -2905,6 +2970,21 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             blocked,
         };
     }
+    // #788: pull-request previews on a live app. `coolifyApp` patches them off
+    // on every run, so replanning this one step is the whole repair.
+    if (live.config.previewsEnabled === true) {
+        return {
+            step: {
+                action,
+                step: {
+                    description: `turn Coolify's preview deployments off for ${org.slug}'s ${label} (#788)`,
+                    destroys: false,
+                    migrates: false,
+                },
+            },
+            blocked,
+        };
+    }
     // #239 (rule 4), from live state: an app with a database but no
     // `DATABASE_URL_OWNER` env still has the pre-split superuser URL, or never
     // got the push. Names only, never values. A reader that did not list env
@@ -3738,8 +3818,11 @@ function accessRuleDescription(org, rule) {
 function planRateLimit(org, recordedIds) {
     if (!(org.hosting.usesDomain || org.site.enabled) || !org.domain)
         return null;
-    if (recordedIds[resourceKey('cloudflare', 'ratelimit', org.id)])
+    // Recorded, and the rule is the variant the switch asks for (the in-app one also covers POSTs under `/sign-in/`).
+    if (recordedIds[resourceKey('cloudflare', 'ratelimit', org.id)] &&
+        (recordedIds[SIGN_IN_RATE_LIMIT_SCOPE_KEY] === '1') === inAppSignIn(org)) {
         return null;
+    }
     return {
         action: { system: 'cloudflare', kind: 'ratelimit', key: org.id, desired: {} },
         step: {

package/dist/plan/edge-ratelimits.d.ts

@@ -29,6 +29,11 @@ export interface RateLimitPort {
     createRateLimitRule(zoneId: string, rule: RateLimitRuleInput): Promise<{
         id: string;
     }>;
+    /**
+     * Deletes that one rule. Absent on a port that cannot; a step that needs it then fails by name.
+     * Rejects with a not-found error when the rule is already gone.
+     */
+    deleteRateLimitRule?(zoneId: string, id: string): Promise<void>;
 }
 /** Edge answers a create another create of the same rule is making `conflict` + `busy`. */
 export declare const EDGE_RATELIMITS_BUSY_ATTEMPTS = 5;

package/dist/plan/edge-ratelimits.js

@@ -45,14 +45,16 @@ export function createEdgeRateLimits(client, options = {}) {
             return;
         const { rules } = await retrying(() => client.list({ zoneId, description }));
         const view = rules.find((r) => r.description === description && r.state !== 'removed');
-        if (view && view.owner === null) {
-            const result = await writeSlot(() => retrying(() => client.adopt({ rules: [{ zoneId, description, id: view.id }] })));
-            if (result.skipped.length > 0) {
-                throw new Error(`edge rate limits: rule '${description}' in zone ${zoneId} cannot be adopted (${result.skipped[0]?.reason}); remove or fix it by hand`);
-            }
-        }
+        if (view && view.owner === null)
+            await adoptView(zoneId, view);
         adopted.add(key);
     };
+    const adoptView = async (zoneId, view) => {
+        const result = await writeSlot(() => retrying(() => client.adopt({ rules: [{ zoneId, description: view.description ?? '', id: view.id }] })));
+        if (result.skipped.length > 0) {
+            throw new Error(`edge rate limits: rule '${view.description}' in zone ${zoneId} cannot be adopted (${result.skipped[0]?.reason}); remove or fix it by hand`);
+        }
+    };
     return {
         async listRateLimitRules(zoneId) {
             const { rules } = await retrying(() => client.list({ zoneId }));
@@ -60,6 +62,14 @@ export function createEdgeRateLimits(client, options = {}) {
                 .filter((r) => r.state !== 'removed')
                 .map((r) => ({ id: r.id, description: r.description }));
         },
+        async deleteRateLimitRule(zoneId, id) {
+            // Edge removes only a rule it owns: a live rule it has no row for is adopted first, as a create does.
+            const { rules } = await retrying(() => client.list({ zoneId }));
+            const view = rules.find((r) => r.id === id && r.state !== 'removed');
+            if (view && view.owner === null)
+                await adoptView(zoneId, view);
+            await writeSlot(() => retrying(() => client.remove(zoneId, id)));
+        },
         async createRateLimitRule(zoneId, rule) {
             await adoptLive(zoneId, rule.description);
             const create = () => writeSlot(() => retrying(() => client.create({ zoneId, ...rule })));

package/dist/plan/executor.d.ts

@@ -107,7 +107,10 @@ export interface CoolifyPort {
         custom_labels?: string | null;
         settings?: {
             is_consistent_container_name_enabled?: boolean;
+            is_preview_deployments_enabled?: boolean;
         };
+        /** #788: where Coolify reports previews is not documented, so `previewsOn` reads both places. */
+        is_preview_deployments_enabled?: boolean;
         custom_network_aliases?: string | null;
         health_check_enabled?: boolean;
         ports_exposes?: string;
@@ -120,6 +123,8 @@ export interface CoolifyPort {
         custom_docker_run_options?: string | null;
     }>;
     createGithubAppApplication(input: {
+        /** #788: previews off; every git app create sends `false`. */
+        is_preview_deployments_enabled?: boolean;
         project_uuid: string;
         server_uuid: string;
         /** The Docker network the app joins (`plan/destinations.ts`); absent: the server's default. */
@@ -1140,6 +1145,14 @@ export interface ZitadelPort {
      * the binding holds; `zitadelApp` never sets it at creation.
      */
     updateOidcAppLoginBaseUri(orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;
+    /**
+     * Lets each app's own Login V2 base URI count: foundry starts ZITADEL with `LOGINV2_REQUIRED=true`,
+     * which makes the instance ignore it. The host sets the instance feature (`PUT /v2/features/instance`
+     * with `loginV2.required` false and the instance default as `baseUri`). Called before an app is
+     * pointed at its own `/sign-in/` on a company that runs its own ZITADEL; the shared instance's
+     * bindings port does the same for the platform's. Optional: absent, nothing is called.
+     */
+    allowPerAppLoginBaseUri?(instanceBaseUri: string): Promise<void>;
     /**
      * Occupies `userName` in `orgId` with a machine user that has no role and
      * no token, so nobody can register under that name. Idempotent: a user
@@ -2006,6 +2019,13 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * client id that binding holds. Apps created later are not in it yet:
      * the next run replans (`diff.ts`'s `planLoginHost`) and moves them.
      *
+     * In-app sign-in (`signIn.inApp`, `plan/sign-in.ts` has the order): an app host is trusted first. It is
+     * bound, and its app pointed at `/sign-in/`, only once its app runs `SIGNIN_UPSTREAM` (the app step
+     * records that). The bind moves the app's client id off the company's binding in the same write (the
+     * login refuses a client id in two bindings); a company binding left with no client is removed.
+     * Switched off, the client id goes back and the base URI returns to the login host, and a trusted
+     * domain is given up only after the app dropped the env.
+     *
      * #274: when the org's host has moved (`recorded[key]`, the *previous*
      * run's resourceId, differs from this run's `host`), also removes every
      * host that is no longer the org's current one from both places --
@@ -2067,6 +2087,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *    the snapshot taken before the repoint still named it.
      */
     private zitadelLoginHost;
+    /**
+     * The host table of a company's own in-app login app as a bindings port that collects its edits and
+     * writes them once on `flush` (one redeploy, none when nothing changed). Used for a company that runs
+     * its own services, which has no host-supplied bindings port.
+     */
+    private ownSignInBindings;
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
@@ -2825,6 +2851,18 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * behind it.
      */
     private coolifyAgora;
+    /**
+     * Records whether an app's running env holds `SIGNIN_UPSTREAM` (the app's host while it does, `''` once it
+     * does not), so the login-host step knows when to point the base URI at the app and when it may give the
+     * host up. Written only when the value changes.
+     */
+    private recordSignInEnvLive;
+    /**
+     * In-app sign-in switched off (or its host given up): the app's live `SIGNIN_UPSTREAM` is deleted, because
+     * `bulkUpsertEnvs` never removes a key. Left in place, the app would keep proxying `/sign-in/*` to the login.
+     * Nothing happens while the env is desired or the app does not hold it.
+     */
+    private dropStaleSignInUpstream;
     /**
      * `plan/diff.ts`'s `planBoule`: provisions the org's own Boule
      * (https://github.com/wtfalch/boule) as one more Coolify application, from
@@ -3433,3 +3471,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
  * `:`. It never scans the path or the response body.
  */
 export declare function isNotFoundError(error: unknown): boolean;
+/** True when ZITADEL refused an update because the value already is the wanted one. Matches the error code, never the free text. */
+export declare function isNoChangesError(error: unknown): boolean;
+/**
+ * {@link ZitadelPort.updateOidcAppLoginBaseUri} that counts an app already holding the wanted base URI as
+ * done: ZITADEL answers that write with "No changes" and a repeat apply must not fail on it.
+ */
+export declare function setOidcAppLoginBaseUri(zitadel: Pick<ZitadelPort, 'updateOidcAppLoginBaseUri'>, orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;