@wtfalch/foundry 0.41.2 → 0.42.1

package/dist/plan/executor.js

@@ -14,6 +14,7 @@ import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerNam
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
+import { previewsOn } from './coolify-previews.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
@@ -43,7 +44,9 @@ import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
+import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -122,6 +125,32 @@ export class NotBuiltError extends Error {
  * so a host is never read as "not in use" purely because ZITADEL's own
  * casing or slashing differs from this step's.
  */
+/**
+ * The in-app hosts a login-host step carries, read back and checked: a plan from an older build carries
+ * none, and a malformed entry is refused by name (never echoed) rather than bound.
+ */
+function inAppAppsOf(raw, slug) {
+    if (raw === undefined)
+        return [];
+    if (!Array.isArray(raw))
+        throw new Error(`zitadel:login-host for ${slug}: apps is not a list`);
+    return raw.map((entry) => {
+        const e = entry;
+        if (!e ||
+            (e.app !== 'agora' && e.app !== 'boule') ||
+            typeof e.host !== 'string' ||
+            !e.host ||
+            typeof e.clientId !== 'string' ||
+            !e.clientId) {
+            throw new Error(`zitadel:login-host for ${slug}: an in-app host entry is malformed`);
+        }
+        return { app: e.app, host: e.host, clientId: e.clientId };
+    });
+}
+/** The ZITADEL ids of the company's Agora and Boule clients: the apps in-app sign-in can move. */
+function ownInAppAppIds(recorded) {
+    return new Set([recorded['zitadel:app:agora'], recorded['zitadel:app:boule']].filter((id) => Boolean(id)));
+}
 function normalizedLoginBaseUri(uri) {
     return uri.toLowerCase().replace(/\/$/, '');
 }
@@ -1101,7 +1130,7 @@ export class FoundryStepExecutor {
             case 'cloudflare:gate':
                 return this.cloudflareGate(action, org, context);
             case 'cloudflare:ratelimit':
-                return this.cloudflareRateLimit(org);
+                return this.cloudflareRateLimit(org, context);
             case 'cloudflare:worker':
                 return this.cloudflareWorker(action, org, context);
             case 'files:organisation':
@@ -1310,7 +1339,7 @@ export class FoundryStepExecutor {
      * `cloudflareAccess`'s own refusal when a foreign Access app already
      * holds the hostname.
      */
-    async cloudflareRateLimit(org) {
+    async cloudflareRateLimit(org, context) {
         if (!org.domain) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: hosting.usesDomain is set but domain is null`);
         }
@@ -1319,20 +1348,41 @@ export class FoundryStepExecutor {
         if (!zone) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
+        // The zone's one Free-plan rule: the base one, or with in-app sign-in the same limit that also
+        // covers POSTs under `/sign-in/` (static assets there stay unlimited).
+        const inApp = inAppSignIn(org);
+        const wanted = inApp
+            ? { description: SIGN_IN_RATE_LIMIT_DESCRIPTION, expression: SIGN_IN_RATE_LIMIT_EXPRESSION }
+            : { description: RATE_LIMIT_RULE_DESCRIPTION, expression: SIGN_IN_PATH_EXPRESSION };
+        const ours = [RATE_LIMIT_RULE_DESCRIPTION, SIGN_IN_RATE_LIMIT_DESCRIPTION];
         const rateLimits = this.rateLimitPort();
         const rules = await rateLimits.listRateLimitRules(zone.id);
-        const own = rules.find((r) => r.description === RATE_LIMIT_RULE_DESCRIPTION);
+        const own = rules.find((r) => r.description === wanted.description);
         if (!own) {
-            const foreign = rules[0];
+            const foreign = rules.find((r) => !ours.includes(r.description ?? ''));
             if (foreign) {
                 throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
             }
+            // The other variant of foundry's own rule holds the zone's one slot: remove it, then make this one.
+            const stale = rules.find((r) => ours.includes(r.description ?? ''));
+            if (stale) {
+                if (!rateLimits.deleteRateLimitRule) {
+                    throw new Error(`cloudflare:ratelimit for ${org.slug}: the rate limit rule must change but this host's rate limit port cannot delete a rule`);
+                }
+                try {
+                    await rateLimits.deleteRateLimitRule(zone.id, stale.id);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
         }
         // Edge adopts a live rule with no edge row (made before edge owned rate
         // limits) and then makes the rule once: a repeat returns it unchanged.
         const created = await rateLimits.createRateLimitRule(zone.id, {
-            description: RATE_LIMIT_RULE_DESCRIPTION,
-            expression: SIGN_IN_PATH_EXPRESSION,
+            description: wanted.description,
+            expression: wanted.expression,
             action: 'block',
             ratelimit: {
                 characteristics: ['cf.colo.id', 'ip.src'],
@@ -1341,6 +1391,8 @@ export class FoundryStepExecutor {
                 mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
             },
         });
+        // Last: a crash before here plans the step again.
+        context.recordScopeId(SIGN_IN_RATE_LIMIT_SCOPE_KEY, inApp ? '1' : '');
         return { resourceId: created.id };
     }
     /**
@@ -1745,6 +1797,13 @@ export class FoundryStepExecutor {
      * client id that binding holds. Apps created later are not in it yet:
      * the next run replans (`diff.ts`'s `planLoginHost`) and moves them.
      *
+     * In-app sign-in (`signIn.inApp`, `plan/sign-in.ts` has the order): an app host is trusted first. It is
+     * bound, and its app pointed at `/sign-in/`, only once its app runs `SIGNIN_UPSTREAM` (the app step
+     * records that). The bind moves the app's client id off the company's binding in the same write (the
+     * login refuses a client id in two bindings); a company binding left with no client is removed.
+     * Switched off, the client id goes back and the base URI returns to the login host, and a trusted
+     * domain is given up only after the app dropped the env.
+     *
      * #274: when the org's host has moved (`recorded[key]`, the *previous*
      * run's resourceId, differs from this run's `host`), also removes every
      * host that is no longer the org's current one from both places --
@@ -1812,8 +1871,13 @@ export class FoundryStepExecutor {
         if (!zitadelOrgId) {
             throw new Error(`zitadel:login-host for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
         }
-        // `planLoginHost` blocks the step while this port is not wired.
-        const bindings = this.ports.loginHostBindings;
+        // A company that runs its own services writes the host table of its own in-app login app; every
+        // other company, the shared one's through the host's port. `planLoginHost` blocks the step while
+        // the shared port is not wired.
+        const own = ownsServices(org);
+        const bindings = own
+            ? this.ownSignInBindings(org, recorded, action.desired.host)
+            : this.ports.loginHostBindings;
         if (!bindings) {
             throw new Error(`zitadel:login-host for ${org.slug}: the loginHostBindings port is not wired`);
         }
@@ -1821,13 +1885,84 @@ export class FoundryStepExecutor {
         // The platform's own shared sign-in host: already trusted and routed by
         // the shared instance, so it gets no trusted domain or binding here.
         const shared = action.desired.shared === true;
-        const clientIds = loginHostClientIds(org, recorded);
+        // In-app sign-in: the plan carries the app hosts to bind (empty with the switch off).
+        const inApp = inAppAppsOf(action.desired.apps, org.slug);
+        // The instance ignores an app's own base URI unless it is told not to: a port that cannot say so
+        // stops the step before anything is written, rather than recording a base URI that has no effect.
+        if (!shared && own && inApp.length > 0 && !this.ports.zitadel.allowPerAppLoginBaseUri) {
+            throw new Error(`zitadel:login-host for ${org.slug}: the ZITADEL port cannot allow a per-app login base URI, so the app hosts cannot sign in on their own addresses`);
+        }
+        // The app hosts that are bound and get the app's own address as base URI: only once their app runs
+        // with `SIGNIN_UPSTREAM` (the app steps record it), never before. Every other app host is trusted
+        // and waits, and the company's own binding keeps its client id, so the old path signs in meanwhile.
+        const targets = inAppTargets(inApp, recorded);
+        const activePairs = inAppStatePairs(targets.active);
+        const activeHosts = new Set(activePairs.map((pair) => pair.host));
+        const envLive = signInEnvLiveHosts(recorded);
+        // The login refuses a client id held by two bindings: an active app host's client id is in its own binding only.
+        const clientIds = loginHostClientIds(org, recorded, activePairs.map((pair) => pair.clientId));
         if (!shared) {
-            await this.ports.zitadel.ensureTrustedDomain(host);
+            // The company's own login host is its instance's external domain: trusted and routed already.
+            if (!own)
+                await this.ports.zitadel.ensureTrustedDomain(host);
+            // Each app host is trusted first.
+            for (const app of inApp)
+                await this.ports.zitadel.ensureTrustedDomain(app.host);
+            // An app host bound before and not active now gives its client id back to the company's binding:
+            // its own binding goes first, so no write leaves the id in two bindings.
+            let unbound = false;
+            for (const old of inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY])) {
+                if (activeHosts.has(old))
+                    continue;
+                try {
+                    await bindings.deleteBinding(old);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+                unbound = true;
+            }
+            if (unbound)
+                await bindings.flush?.();
             // zitadel-login's own routing table, written before any app is repointed
             // so no app ever points at a host with no binding.
-            await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+            if (!own) {
+                if (clientIds.length > 0 || activePairs.length === 0) {
+                    await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+                }
+                else {
+                    // Every client of the company signs in on its app's own address: the login refuses a binding
+                    // with no client ids, so the company's own binding goes (nothing signs in on this host).
+                    try {
+                        await bindings.deleteBinding(host);
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                }
+            }
+            for (const app of inApp) {
+                if (!activeHosts.has(app.host))
+                    continue;
+                await bindings.upsertBinding({ ...inAppBindingFor(app), organizationId: zitadelOrgId });
+            }
+            // One write for every upsert above (one redeploy of the login), before any app is repointed.
+            await bindings.flush?.();
+            if (own && activeHosts.size > 0) {
+                await this.ports.zitadel.allowPerAppLoginBaseUri?.(`https://${host}/`);
+            }
         }
+        // The base URI each app's sign-in starts from: its own address under `/sign-in/` in-app, else the login host.
+        const appBaseUris = new Map();
+        for (const app of inApp) {
+            const appId = recorded[`zitadel:app:${app.app}`];
+            if (appId && activeHosts.has(app.host)) {
+                appBaseUris.set(appId, `https://${app.host}${SIGN_IN_BASE_PATH}/`);
+            }
+        }
+        const baseUriOf = (appId) => appBaseUris.get(appId) ?? `https://${host}/`;
         // Only apps whose client id the binding now holds: any other app in the
         // project would lose sign-in. The rest move on a later run, once the
         // recorded client ids differ from the binding and replan this step.
@@ -1858,7 +1993,10 @@ export class FoundryStepExecutor {
             for (const app of liveApps) {
                 if (!boundAppIds.has(app.id))
                     continue;
-                await this.ports.zitadel.updateOidcAppLoginBaseUri(zitadelOrgId, projectId, app.id, `https://${host}/`);
+                // A company's own instance has the login host as its default; only the in-app apps move.
+                if (own && !appBaseUris.has(app.id) && !ownInAppAppIds(recorded).has(app.id))
+                    continue;
+                await setOidcAppLoginBaseUri(this.ports.zitadel, zitadelOrgId, projectId, app.id, baseUriOf(app.id));
             }
         }
         // Fix round 3 point 5: a bound app's current base URI is `host` for
@@ -1870,7 +2008,7 @@ export class FoundryStepExecutor {
         // compare against, same as an app this loop never visits at all.
         const currentLoginBaseUris = new Set();
         for (const app of liveApps) {
-            const uri = boundAppIds.has(app.id) ? `https://${host}/` : app.loginBaseUri;
+            const uri = boundAppIds.has(app.id) ? baseUriOf(app.id) : app.loginBaseUri;
             if (typeof uri === 'string')
                 currentLoginBaseUris.add(normalizedLoginBaseUri(uri));
         }
@@ -1897,6 +2035,19 @@ export class FoundryStepExecutor {
         candidates.delete(host);
         if (previousHost && previousHost !== host)
             candidates.add(previousHost);
+        // An in-app host applied before and no longer wanted (switch off, or the app is gone) is owed a removal
+        // the same way an old login host is; a host still wanted is never a candidate.
+        // An app that still holds `SIGNIN_UPSTREAM` keeps its binding and trusted domain: it is switched off
+        // in reverse order, the base URI first, then the app's env, then these.
+        for (const old of [
+            ...inAppStateHosts(recorded[SIGN_IN_TRUSTED_SCOPE_KEY]),
+            ...inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY]),
+        ]) {
+            if (!envLive.has(old))
+                candidates.add(old);
+        }
+        for (const app of inApp)
+            candidates.delete(app.host);
         // #274: a removal, once the new host is fully live (trusted, bound, and
         // every repointable app repointed) -- never the other way round, so an
         // org is never left with no trusted host at all if this throws partway
@@ -1905,9 +2056,11 @@ export class FoundryStepExecutor {
         // its connector app and its tunnel): a domain already gone must not skip
         // the binding delete that follows it.
         const stillPending = [];
+        let removed = false;
         for (const candidate of candidates) {
             if (!canDecideSafely ||
-                currentLoginBaseUris.has(normalizedLoginBaseUri(`https://${candidate}/`))) {
+                currentLoginBaseUris.has(normalizedLoginBaseUri(`https://${candidate}/`)) ||
+                currentLoginBaseUris.has(normalizedLoginBaseUri(`https://${candidate}${SIGN_IN_BASE_PATH}/`))) {
                 stillPending.push(candidate);
                 continue;
             }
@@ -1918,6 +2071,7 @@ export class FoundryStepExecutor {
                 if (!isNotFoundError(error))
                     throw error;
             }
+            removed = true;
             try {
                 await bindings.deleteBinding(candidate);
             }
@@ -1926,6 +2080,9 @@ export class FoundryStepExecutor {
                     throw error;
             }
         }
+        // Nothing queued, nothing to write: a step that only added hosts has already flushed once.
+        if (removed)
+            await bindings.flush?.();
         // Both last, so a crash above reruns the whole step rather than losing
         // track of either. A client id recorded after this point differs from
         // the binding and replans the step next run; a nonempty pending list
@@ -1933,11 +2090,44 @@ export class FoundryStepExecutor {
         // normally alone decides it.
         if (shared)
             context.recordScopeId(LOGIN_HOST_SHARED_SCOPE_KEY, '1');
-        else
-            context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+        else {
+            if (!own)
+                context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+            context.recordScopeId(SIGN_IN_TRUSTED_SCOPE_KEY, targets.trusted);
+            context.recordScopeId(SIGN_IN_IN_APP_SCOPE_KEY, targets.active);
+        }
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
+    /**
+     * The host table of a company's own in-app login app as a bindings port that collects its edits and
+     * writes them once on `flush` (one redeploy, none when nothing changed). Used for a company that runs
+     * its own services, which has no host-supplied bindings port.
+     */
+    ownSignInBindings(org, recorded, instanceHost) {
+        const appId = recorded[SIGN_IN_LOGIN_APP_SCOPE_KEY];
+        if (!appId) {
+            throw new Error(`zitadel:login-host for ${org.slug}: the company's in-app login app is not recorded yet`);
+        }
+        const upsert = [];
+        const remove = [];
+        return {
+            upsertBinding: async (binding) => {
+                upsert.push(binding);
+            },
+            deleteBinding: async (host) => {
+                remove.push(host);
+            },
+            flush: async () => {
+                if (upsert.length === 0 && remove.length === 0)
+                    return;
+                const edits = { appId, instanceHost, upsert: [...upsert], remove: [...remove] };
+                upsert.length = 0;
+                remove.length = 0;
+                await editSignInBindings(this.ports.coolify, edits);
+            },
+        };
+    }
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
@@ -2403,6 +2593,7 @@ export class FoundryStepExecutor {
             const server = await this.resolveServer(org, context);
             const githubApp = await this.ports.coolify.requireGithubApp();
             const created = await this.ports.coolify.createGithubAppApplication({
+                is_preview_deployments_enabled: false,
                 project_uuid: projectUuid,
                 server_uuid: server.uuid,
                 environment_name: environment.name,
@@ -2438,6 +2629,10 @@ export class FoundryStepExecutor {
         }
         if (want.autoDeploy !== have.autoDeploy)
             patch.is_auto_deploy_enabled = want.autoDeploy;
+        // #788: an app found with previews on gets them off (`planApp` plans the
+        // step for it). A created app has them off from the create.
+        if (previewsOn(live))
+            patch.is_preview_deployments_enabled = false;
         // #543: the health-check quartet too, every run -- the same reason
         // Archon's own doc comment gives (without one, Coolify's rolling update
         // has nothing to wait on and stops the old container immediately). The
@@ -3857,6 +4052,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(input.org, input.context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const created = await this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: input.projectUuid,
             server_uuid: server.uuid,
             environment_name: input.environment.name,
@@ -4389,6 +4585,7 @@ export class FoundryStepExecutor {
         }
         const githubApp = await this.ports.coolify.requireGithubApp();
         const synapse = await this.findOrCreateCallsApp(names.synapse, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -4413,6 +4610,7 @@ export class FoundryStepExecutor {
             instant_deploy: false,
         }), { startIfStopped: false });
         const service = await this.findOrCreateCallsApp(names.service, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -4613,6 +4811,7 @@ export class FoundryStepExecutor {
         }
         const githubApp = await this.ports.coolify.requireGithubApp();
         const synapse = await this.findOrCreateCallsApp(names.synapse, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -4819,6 +5018,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -5199,6 +5399,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -5233,10 +5434,10 @@ export class FoundryStepExecutor {
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
         // can no longer tell a changed value from one already live.
-        const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
-            .filter((e) => !e.is_preview)
-            .map((e) => [e.key, e.value]));
+        const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
+        const liveEnv = new Map(liveRows.map((e) => [e.key, e.value]));
         const envChanged = agoraEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
+        await this.dropStaleSignInUpstream(app.appId, env, liveRows);
         await this.ports.coolify.bulkUpsertEnvs(app.appId, Object.entries(env).map(([key, value]) => ({ key, value })));
         const revision = agoraEnvRevision(env);
         const alreadyActivated = context.recordedIds()[AGORA_ACTIVATED_ENV_SCOPE_KEY] === revision;
@@ -5262,9 +5463,43 @@ export class FoundryStepExecutor {
         else if (app.existed && (envChanged || !alreadyActivated)) {
             await this.ports.coolify.restart(app.appId);
         }
+        // The login-host step points the sign-in at this app's own address only once the env is running. Before the
+        // activation marker, so a crash between the two plans this step again and records it.
+        this.recordSignInEnvLive(context, 'agora', agoraHostnameFor(org), env);
         context.recordScopeId(AGORA_ACTIVATED_ENV_SCOPE_KEY, revision);
         return { resourceId: app.appId };
     }
+    /**
+     * Records whether an app's running env holds `SIGNIN_UPSTREAM` (the app's host while it does, `''` once it
+     * does not), so the login-host step knows when to point the base URI at the app and when it may give the
+     * host up. Written only when the value changes.
+     */
+    recordSignInEnvLive(context, app, host, env) {
+        const key = `${SIGN_IN_ENV_LIVE_SCOPE_PREFIX}${app}`;
+        const value = env[SIGN_IN_UPSTREAM_ENV] !== undefined ? host : '';
+        if ((context.recordedIds()[key] ?? '') !== value)
+            context.recordScopeId(key, value);
+    }
+    /**
+     * In-app sign-in switched off (or its host given up): the app's live `SIGNIN_UPSTREAM` is deleted, because
+     * `bulkUpsertEnvs` never removes a key. Left in place, the app would keep proxying `/sign-in/*` to the login.
+     * Nothing happens while the env is desired or the app does not hold it.
+     */
+    async dropStaleSignInUpstream(appId, desired, liveRows) {
+        if (desired[SIGN_IN_UPSTREAM_ENV] !== undefined)
+            return;
+        for (const row of liveRows) {
+            if (row.key !== SIGN_IN_UPSTREAM_ENV || !row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+    }
     // ---- boule (#161) --------------------------------------------------------
     /**
      * `plan/diff.ts`'s `planBoule`: provisions the org's own Boule
@@ -5318,6 +5553,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -5339,10 +5575,10 @@ export class FoundryStepExecutor {
             ...healthCheckSettings('/api/health', BOULE_PORT),
             ...(await this.routedLabels(name, bouleHostnameFor(org), BOULE_PORT)),
         });
-        const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
-            .filter((e) => !e.is_preview)
-            .map((e) => [e.key, e.value]));
+        const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
+        const liveEnv = new Map(liveRows.map((e) => [e.key, e.value]));
         const envChanged = bouleEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
+        await this.dropStaleSignInUpstream(app.appId, env, liveRows);
         const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
         const cookieSecret = await this.ensureAuthCookieSecret(app.appId);
         if (cookieSecret)
@@ -5416,6 +5652,8 @@ export class FoundryStepExecutor {
         if (action.desired.platformOwner === true) {
             context.recordScopeId(BOULE_SECRETS_RESTARTED_SCOPE_KEY, '1');
         }
+        // Last: the login-host step points the sign-in at this app's own address only once the env is running.
+        this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
     /**
@@ -5858,6 +6096,9 @@ export class FoundryStepExecutor {
             smtpSender: `noreply@${hn.mailDomain}`,
             defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,
+            // In-app sign-in: the company's own stack gets the second login app. Its host table starts
+            // empty; the login-host step writes it once the apps' clients exist.
+            ...(inAppSignIn(org) ? { signInLogin: { bindings: null } } : {}),
         });
         if (refChanged) {
             const now = scope.recordedIds();
@@ -7953,3 +8194,23 @@ export function isNotFoundError(error) {
     const message = error instanceof Error ? error.message : String(error);
     return /^\S+ \S+ \S+ → 404:/.test(message);
 }
+/** ZITADEL's error code for an update that changes nothing (`COMMAND-1m88i`, "No changes"). */
+const ZITADEL_NO_CHANGES_CODE = 'COMMAND-1m88i';
+/** True when ZITADEL refused an update because the value already is the wanted one. Matches the error code, never the free text. */
+export function isNoChangesError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes(ZITADEL_NO_CHANGES_CODE);
+}
+/**
+ * {@link ZitadelPort.updateOidcAppLoginBaseUri} that counts an app already holding the wanted base URI as
+ * done: ZITADEL answers that write with "No changes" and a repeat apply must not fail on it.
+ */
+export async function setOidcAppLoginBaseUri(zitadel, orgId, projectId, appId, loginBaseUri) {
+    try {
+        await zitadel.updateOidcAppLoginBaseUri(orgId, projectId, appId, loginBaseUri);
+    }
+    catch (error) {
+        if (!isNoChangesError(error))
+            throw error;
+    }
+}

package/dist/plan/login-host.d.ts

@@ -1,4 +1,5 @@
 import { type DeclaredOrg } from '../org.js';
+import { type InAppApp, type SIGN_IN_BASE_PATH } from './sign-in.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -99,7 +100,17 @@ export interface LoginHostBinding {
     host: string;
     organizationId: string;
     clientIds: string[];
+    /** In-app sign-in: which app each client id is, so the login draws that app's room. Absent: the company's own room. */
+    apps?: Record<string, 'agora' | 'boule' | 'archon'>;
+    /** In-app sign-in: the login serves this host under `/sign-in`. Absent: the root. */
+    basePath?: typeof SIGN_IN_BASE_PATH;
 }
+/**
+ * The app hosts that sign in on their own address when the company has `signIn.inApp`: Agora's and
+ * Boule's, each only once its client id is recorded. Empty with the switch off. Archon (owner company
+ * only) is not here: the platform's Archon step owns its host (`sign-in-archon.ts`).
+ */
+export declare function inAppApps(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): InAppApp[];
 /**
  * Host-supplied write access to zitadel-login's own `LOGIN_HOST_BINDINGS`
  * env (`auth/docs/company-login-hosts.md`'s own "Set `LOGIN_HOST_BINDINGS`
@@ -121,6 +132,12 @@ export interface LoginHostBindingsPort {
      * package.
      */
     deleteBinding(host: string): Promise<void>;
+    /**
+     * A port that queues its upserts writes them here, once: one redeploy of the login however many hosts
+     * the step bound. A port without it writes on each call. `deleteBinding` writes at once on either.
+     * The login-host step calls it after all its upserts and before any app is repointed.
+     */
+    flush?(): Promise<void>;
 }
 /**
  * Scope id holding what the binding was last written with
@@ -137,8 +154,12 @@ export declare const LOGIN_BINDING_SCOPE_KEY = "login_host_binding";
  * is no longer declared is not here, so it stays bound as before.
  */
 export declare function customersEntryKeys(org: DeclaredOrg): Set<string>;
-/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
-export declare function loginHostClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string[];
+/**
+ * The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule),
+ * deduplicated and sorted, bar `except`: the login refuses a client id held by two bindings, so the ids of the
+ * app hosts that have their own binding (in-app sign-in) are not in the company's.
+ */
+export declare function loginHostClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, except?: readonly string[]): string[];
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export declare function loginBindingState(host: string, clientIds: readonly string[]): string;
 /**