@wtfalch/foundry 0.41.2 → 0.42.1

package/dist/plan/platform-providers.js

@@ -7,6 +7,7 @@ import { ownerMailboxes } from '../org.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
 import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { previewsOn } from './coolify-previews.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { placedOnPlatform } from './destinations.js';
 import { ACCESS_POLICY_NAME, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
@@ -22,7 +23,10 @@ import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied,
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
+import { LOGIN_HOST_BINDINGS_ENV } from './sign-in-bindings.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
+import { SIGN_IN_BASE_PATH, SIGN_IN_BUILD_ARG_ENV, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppOnSharedLogin, signInLoginNames, signInUpstream, } from './sign-in.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
@@ -594,8 +598,9 @@ export class FoundryPlatformStepExecutor {
         }
         if (platform.auth.enabled && this.auth) {
             const loginClientDrifted = await authLoginClientDrifted(platform, this.auth, recordedIds);
-            if (loginClientDrifted)
+            if (loginClientDrifted || (await this.signInLoginDrifted(this.auth, recordedIds))) {
                 result.auth = true;
+            }
         }
         // #380: once the runner app is recorded, re-check its live env against
         // every setting `ensureStarted()` requires -- the gap that left the
@@ -653,13 +658,45 @@ export class FoundryPlatformStepExecutor {
         await coolify.deploy(runnerAppId);
         return { [PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY]: normalHosts(wanted).join(',') };
     }
+    /** True while a company signs in on its apps' own addresses through the platform's login. */
+    async signInLoginWanted() {
+        return (await this.declaredOrgStore.list()).some(inAppOnSharedLogin);
+    }
+    /**
+     * In-app sign-in: the login app that serves `/sign-in` is wanted and either not recorded, gone from
+     * Coolify, or holding a host table other than the login's. The step then plans again and repairs it.
+     * A Coolify read that fails counts as not drifted, with one fixed log line (the error can carry values).
+     */
+    async signInLoginDrifted(auth, recordedIds) {
+        if (!(await this.signInLoginWanted()))
+            return false;
+        const signInId = recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY];
+        const loginId = recordedIds[PLATFORM_AUTH_LOGIN_SCOPE_KEY];
+        if (!signInId)
+            return true;
+        if (!loginId)
+            return false;
+        try {
+            const [login, signIn] = await Promise.all([
+                currentEnvValue(auth.coolify, loginId, LOGIN_HOST_BINDINGS_ENV),
+                currentEnvValue(auth.coolify, signInId, LOGIN_HOST_BINDINGS_ENV),
+            ]);
+            return (login ?? '') !== (signIn ?? '');
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return true;
+            console.error('platform:auth: could not read the login apps to compare their host tables; treating the in-app login as in step');
+            return false;
+        }
+    }
     async execute(action, context) {
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_AUTH_KEY) {
             if (!this.auth) {
                 throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
             }
             const company = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), company);
+            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), company, await this.signInLoginWanted());
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_FILES_KEY) {
             if (!this.files) {
@@ -919,6 +956,7 @@ export async function provisionJobsHost(scope, deps, target, input) {
         const server = await resolvePlatformServer(coolify);
         const githubApp = await coolify.requireGithubApp();
         const created = await coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -1552,6 +1590,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -1571,11 +1610,46 @@ export async function provisionAuthStack(scope, deps, target, input) {
         custom_internal_name: target.internal.authLogin,
         ...IMAGE_HEALTHCHECK_SETTINGS,
     });
+    // ---- the in-app login app (`/sign-in`) ------------------------------------
+    // A Next.js base path is fixed at build, so the login that serves `/sign-in` is a second app built from
+    // the same Dockerfile with the base path as a build-time env. It is recorded as applied only at the end,
+    // once it is deployed and holds the login token.
+    const signInNames = input.signInLogin ? signInLoginNames(target) : null;
+    const signInApp = signInNames
+        ? await findOrCreateSignInLoginApp(deps.coolify, {
+            name: signInNames.name,
+            environment,
+            label,
+            create: async () => {
+                const server = await resolvePlatformServer(deps.coolify);
+                const githubApp = await deps.coolify.requireGithubApp();
+                return deps.coolify.createGithubAppApplication({
+                    project_uuid: projectUuid,
+                    server_uuid: server.uuid,
+                    environment_name: environment.name,
+                    environment_uuid: environment.uuid,
+                    github_app_uuid: githubApp.uuid,
+                    git_repository: AUTH_REPO,
+                    git_branch: gitRef,
+                    build_pack: 'dockerfile',
+                    name: signInNames.name,
+                    dockerfile_location: AUTH_LOGIN_DOCKERFILE,
+                });
+            },
+        })
+        : null;
+    if (signInApp && signInNames) {
+        await deps.coolify.updateApplication(signInApp.appId, {
+            custom_internal_name: signInNames.internal,
+            ...IMAGE_HEALTHCHECK_SETTINGS,
+        });
+    }
     // ---- the broker app (#204) -------------------------------------------------
     const brokerApp = await findOrCreatePlatformApp(deps.coolify, target.names.authBroker, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -1709,6 +1783,19 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await deps.coolify.bulkUpsertEnvs(zitadelAppId, zitadelEnvs);
     await deps.coolify.bulkUpsertEnvs(loginAppId, loginEnvs);
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
+    // The in-app login: the login's env, the base path as a build argument, and the host table.
+    let signInEnvsChanged = false;
+    if (signInApp && input.signInLogin) {
+        const bindings = input.signInLogin.bindings ??
+            (await currentEnvValue(deps.coolify, loginAppId, LOGIN_HOST_BINDINGS_ENV));
+        const signInEnvs = [
+            ...loginEnvs,
+            { key: SIGN_IN_BUILD_ARG_ENV, value: SIGN_IN_BASE_PATH, buildTime: true },
+            ...(bindings ? [{ key: LOGIN_HOST_BINDINGS_ENV, value: bindings }] : []),
+        ];
+        signInEnvsChanged = await envsDiffer(deps.coolify, signInApp.appId, signInEnvs);
+        await deps.coolify.bulkUpsertEnvs(signInApp.appId, signInEnvs);
+    }
     // Deploy an app that was just created, is not running (a throw after the
     // create left it never deployed, or it stopped), or whose envs changed.
     // A move that started ZITADEL on the TLS database and never saw it healthy there (#746): start it
@@ -1732,6 +1819,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
     if (loginApp.justCreated || !loginApp.running || loginEnvsChanged) {
         await deps.coolify.deploy(loginAppId);
     }
+    if (signInApp && (signInApp.justCreated || !signInApp.running || signInEnvsChanged)) {
+        await deps.coolify.deploy(signInApp.appId);
+    }
     // #211: the broker's own `server.ts` refuses to start without
     // `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` and `LETTERMINT_API_TOKEN` --
     // deploying it without them only produces a container that crash-loops
@@ -2010,8 +2100,33 @@ export async function provisionAuthStack(scope, deps, target, input) {
     const loginClientOtherInputsMissing = brokerMissingInputs.filter((m) => m !== 'ZITADEL_SERVICE_USER_TOKEN');
     const freshRecordedIds = scope.recordedIds();
     const freshLoginClientRecord = parseLoginClientRecord(freshRecordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]);
-    const loginClientNeedsMint = !freshLoginClientRecord ||
+    let loginClientNeedsMint = !freshLoginClientRecord ||
         (await authLoginClientDriftedAt({ hostname, bearerRef: target.refs.instanceBearer }, deps, freshRecordedIds));
+    // The in-app login app needs the same token. When the login already holds a live one, it is copied
+    // (no new mint, so the login is not restarted) if the in-app login holds none or another one -- a re-mint
+    // while the app was not delivered to leaves it a revoked token. When the login's cannot be read, the mint
+    // below delivers it. The tokens are compared, never logged.
+    if (signInApp && !loginClientNeedsMint) {
+        const signInHeld = await currentEnvValue(deps.coolify, signInApp.appId, SERVICE_USER_TOKEN_ENV);
+        const held = await currentEnvValue(deps.coolify, loginAppId, SERVICE_USER_TOKEN_ENV);
+        if (held && held !== signInHeld) {
+            runtime.onSecret?.(held);
+            const attempts = runtime.deliverAttempts ?? 3;
+            try {
+                await retryPlatformAuthCall(attempts, sleep, () => deps.coolify.bulkUpsertEnvs(signInApp.appId, [
+                    { key: SERVICE_USER_TOKEN_ENV, value: held },
+                ]));
+                await retryPlatformAuthCall(attempts, sleep, () => deps.coolify.deploy(signInApp.appId, true));
+            }
+            catch {
+                // Never echo the cause: Coolify's validation error can include the rejected value (the token).
+                throw new Error(`${label}: the login token could not be copied to ${signInNames?.name} after ${attempts} tries`);
+            }
+        }
+        else if (!held && !signInHeld) {
+            loginClientNeedsMint = true;
+        }
+    }
     if (loginClientNeedsMint && loginClientOtherInputsMissing.length === 0) {
         // An own org never mints a second time on top of a token that may be live:
         // the platform's re-mint revokes the old one, which would take the org's
@@ -2040,6 +2155,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
         // comment above gives.
         await record(PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, loginClientUserId);
         const deliverAttempts = runtime.deliverAttempts ?? 3;
+        const receivers = signInApp
+            ? `the login app, the in-app login app (${signInNames?.name}) and broker`
+            : 'the login app and broker';
         try {
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.bulkUpsertEnvs(loginAppId, [
                 { key: 'ZITADEL_SERVICE_USER_TOKEN', value: loginClientToken },
@@ -2047,6 +2165,11 @@ export async function provisionAuthStack(scope, deps, target, input) {
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.bulkUpsertEnvs(brokerAppId, [
                 { key: 'ZITADEL_SERVICE_USER_TOKEN', value: loginClientToken },
             ]));
+            if (signInApp) {
+                await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.bulkUpsertEnvs(signInApp.appId, [
+                    { key: SERVICE_USER_TOKEN_ENV, value: loginClientToken },
+                ]));
+            }
             // Forced: an unforced deploy answers 200 "skipped" when one for the
             // same commit is already queued -- likely here, since this function's
             // own deploys above may just have queued one for either app. An
@@ -2055,6 +2178,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
             // (#216 follow-up review, item 2).
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.deploy(loginAppId, true));
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.deploy(brokerAppId, true));
+            if (signInApp) {
+                await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.deploy(signInApp.appId, true));
+            }
         }
         catch {
             // Never echo the underlying error: Coolify's validation error can
@@ -2074,8 +2200,8 @@ export async function provisionAuthStack(scope, deps, target, input) {
             // saying "its prior token was already revoked" there would describe a
             // revoke that never happened, so the message only says so when it did.
             throw new Error(revokedPriorPat
-                ? `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so the login app and broker are down until a later apply mints and delivers a fresh one`
-                : `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so the login app and broker still have none until a later apply mints and delivers one`);
+                ? `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so ${receivers} are down until a later apply mints and delivers a fresh one`
+                : `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so ${receivers} still have none until a later apply mints and delivers one`);
         }
         // #216 round 4/5: records what was actually delivered -- the user id,
         // the exact PAT id, and (round 5) a hash of the exact token -- so the
@@ -2085,6 +2211,11 @@ export async function provisionAuthStack(scope, deps, target, input) {
         // own doc comment, and `authLoginClientDrifted`'s, for why.
         await record(PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, loginClientRecordValue(loginClientUserId, loginClientPatId, loginClientToken));
     }
+    // The in-app login app is ready once it is created, deployed (above) and holds the token: only then is
+    // it recorded, so the login-host step plans no app host for a login that cannot serve it yet.
+    if (signInApp && (await currentEnvValue(deps.coolify, signInApp.appId, SERVICE_USER_TOKEN_ENV))) {
+        await record(SIGN_IN_LOGIN_APP_SCOPE_KEY, signInApp.appId);
+    }
     // ---- the owner company's own sign-in org ----------------------------------
     // Archon signs people in from this org; the `foundry` org holds none. The
     // company executor finds the same org by name (its slug) and makes no second.
@@ -2206,7 +2337,7 @@ const platformAuthProject = {
     },
 };
 /** The platform's sign-in: {@link provisionAuthStack} with {@link platformTarget} and the platform's own inputs. */
-async function provisionPlatformAuth(context, deps, ownerCompany = null) {
+async function provisionPlatformAuth(context, deps, ownerCompany = null, signInLogin = false) {
     const { platform } = context;
     const scope = scopeFromPlatform(context);
     return provisionAuthStack(scope, deps, platformTarget(), {
@@ -2218,6 +2349,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         smtpSender: `noreply@${platform.apex}`,
         defaultRedirectUri: platform.archon.enabled ? `https://${platform.archon.hostname}` : null,
         ownerCompany,
+        // In-app sign-in: the second login app copies the login's host table (the host's port writes that).
+        ...(signInLogin ? { signInLogin: { bindings: null } } : {}),
     });
 }
 /**
@@ -3814,6 +3947,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -3850,6 +3984,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     await deps.coolify.updateApplication(appId, {
         custom_network_aliases: PLATFORM_ARCHON_INTERNAL_NAME,
         is_consistent_container_name_enabled: false,
+        // #788: previews off; `archonRollingUpdateDrifted` plans the step again if they come back on.
+        is_preview_deployments_enabled: false,
         // #543: the quartet below is the shared `healthCheckSettings` helper
         // every other app foundry creates now also goes through -- Archon's own
         // fields, unchanged in value, just no longer hand-rolled here.
@@ -3920,6 +4056,60 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         await record(PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY, created.clientId);
         clientId = created.clientId;
     }
+    // ---- in-app sign-in -----------------------------------------------------------
+    // Archon signs people in on its own address, through the owner company's in-app login app. Wanted when
+    // the company has the switch on and that login app is applied. In this order: trusted and bound, then
+    // the env (`SIGNIN_UPSTREAM`) written and deployed, then the client's base URI, so the proxy is never
+    // on for an address the login cannot serve and the base URI never points at an app that does not proxy.
+    // Given up in the reverse order: the base URI back first, then the env, then the binding and the domain.
+    const inAppWanted = Boolean(ownerSignIn.signInInApp && ownerSignIn.signInLoginAppId && ownerCompany);
+    const archonAppZitadelId = context.recordedIds()[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    const inAppOwed = archonInAppHost(context.recordedIds()) !== '';
+    const inAppCalls = () => {
+        const { ensureTrustedDomain, deleteTrustedDomain, updateOidcAppLoginBaseUri, allowPerAppLoginBaseUri, } = zitadel;
+        if (!ensureTrustedDomain || !deleteTrustedDomain || !updateOidcAppLoginBaseUri) {
+            throw new Error("platform:archon: the owner company's ZITADEL port lacks ensureTrustedDomain, deleteTrustedDomain or updateOidcAppLoginBaseUri, so Archon cannot sign in on its own address");
+        }
+        return {
+            ensureTrustedDomain: ensureTrustedDomain.bind(zitadel),
+            deleteTrustedDomain: deleteTrustedDomain.bind(zitadel),
+            updateOidcAppLoginBaseUri: updateOidcAppLoginBaseUri.bind(zitadel),
+            ...(allowPerAppLoginBaseUri
+                ? { allowPerAppLoginBaseUri: allowPerAppLoginBaseUri.bind(zitadel) }
+                : {}),
+        };
+    };
+    const inAppTarget = {
+        coolify: deps.coolify,
+        loginHost: ownerSignIn.hostname,
+        host: hostname,
+        organisationId: authOrgId,
+        projectId: project.id,
+        appId: archonAppZitadelId ?? '',
+    };
+    if (inAppWanted && ownerSignIn.signInLoginAppId) {
+        if (!archonAppZitadelId) {
+            throw new Error("platform:archon: Archon's sign-in client is not recorded yet");
+        }
+        // A port that cannot allow a per-app base URI stops the step before anything is written.
+        if (!zitadel.allowPerAppLoginBaseUri) {
+            throw new Error("platform:archon: the owner company's ZITADEL port cannot allow a per-app login base URI, so Archon cannot sign in on its own address");
+        }
+        await archonInAppBind({
+            ...inAppTarget,
+            zitadel: inAppCalls(),
+            loginAppId: ownerSignIn.signInLoginAppId,
+            clientId,
+        });
+    }
+    else if (inAppOwed) {
+        // Given up: the client goes back to the company's login host before the app stops proxying.
+        await archonInAppBack({
+            ...inAppTarget,
+            host: archonInAppHost(context.recordedIds()),
+            zitadel: inAppCalls(),
+        });
+    }
     // ---- env ------------------------------------------------------------------
     const envs = [
         { key: 'APP_URL', value: `https://${hostname}` },
@@ -3929,6 +4119,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         { key: 'AUTH_CLIENT_ID', value: clientId },
         ...(firstOwnerLink ? [{ key: 'ARCHON_FIRST_OWNER_LINK', value: firstOwnerLink }] : []),
     ];
+    if (inAppWanted)
+        envs.push({ key: SIGN_IN_UPSTREAM_ENV, value: signInUpstream(ownerCompany ?? undefined) });
     // #265: an owner URL or reporting site already on the app is kept as it is.
     // The owner URL must name the adopted database's host, or the app's two
     // database URLs would point at different databases.
@@ -4103,7 +4295,13 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         const staleOperator = stale.key === 'AUTHZ_BOOTSTRAP_OPERATOR';
         // The link is written only while both ids are known; one that is no longer wanted goes.
         const staleLink = !firstOwnerLink && stale.key === 'ARCHON_FIRST_OWNER_LINK';
-        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime || staleOperator || staleLink) &&
+        // In-app sign-in switched off: the proxy to the login goes.
+        const staleSignIn = !inAppWanted && stale.key === SIGN_IN_UPSTREAM_ENV;
+        if ((stale.key === 'FILES_MANAGEMENT_KEY' ||
+            staleUptime ||
+            staleOperator ||
+            staleLink ||
+            staleSignIn) &&
             stale.uuid) {
             await deps.coolify.deleteEnv(appId, stale.uuid);
             staleKeyDeleted = true;
@@ -4363,6 +4561,25 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (archonDeployedNow && !selfRedeploy) {
         await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
     }
+    // In-app sign-in, last half. The env is deployed and Archon answers health, or no deploy was owed (the
+    // running env is the one written), so Archon now proxies `/sign-in/*` (on) or no longer does (off).
+    // A host that deploys itself has not confirmed that yet: the next run does the rest, and until then the
+    // marker stays as it was, so the step is planned again. Recorded last of its own calls.
+    if (!archonDeployedNow || !selfRedeploy) {
+        if (inAppWanted) {
+            await archonInAppPoint({ ...inAppTarget, zitadel: inAppCalls() });
+            await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, `${hostname}=${clientId}`);
+        }
+        else if (inAppOwed) {
+            await archonInAppUnbind({
+                ...inAppTarget,
+                host: archonInAppHost(context.recordedIds()),
+                zitadel: inAppCalls(),
+                ...(ownerSignIn.signInLoginAppId ? { loginAppId: ownerSignIn.signInLoginAppId } : {}),
+            });
+            await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, '');
+        }
+    }
     // #398: the deployment finished and answers health, so Archon now runs with
     // the key id its env carries. `provisionPlatformIntegrations` drops the
     // previous public key only on this marker.
@@ -5158,7 +5375,8 @@ async function archonRollingUpdateDrifted(coolify, appId) {
         const app = await coolify.getApplication(appId);
         return (app.settings?.is_consistent_container_name_enabled === true ||
             app.custom_network_aliases !== PLATFORM_ARCHON_INTERNAL_NAME ||
-            app.health_check_enabled !== true);
+            app.health_check_enabled !== true ||
+            previewsOn(app));
     }
     catch {
         return false;
@@ -5770,6 +5988,7 @@ async function provisionPlatformAi(context, deps) {
             const server = await resolvePlatformServer(coolify);
             const githubApp = await coolify.requireGithubApp();
             return coolify.createGithubAppApplication({
+                is_preview_deployments_enabled: false,
                 project_uuid: projectUuid,
                 server_uuid: server.uuid,
                 environment_name: environment.name,
@@ -6314,6 +6533,31 @@ export async function findOrCreatePlatformApp(coolify, name, environment, create
     const created = await create();
     return { appId: created.uuid, justCreated: true, running: false };
 }
+const SERVICE_USER_TOKEN_ENV = 'ZITADEL_SERVICE_USER_TOKEN';
+/**
+ * {@link findOrCreatePlatformApp} for the in-app login app, which adopts only an app that is its own: one
+ * of that name outside this environment, or built from another repository, is refused and left as it is.
+ * The check reads the application list directly: a lookup by name through the limits wrapper would patch
+ * the stranger's resource limits before this could refuse it.
+ */
+async function findOrCreateSignInLoginApp(coolify, input) {
+    const { name, environment, label } = input;
+    const listed = await coolify.raw('GET', '/applications');
+    if (!Array.isArray(listed)) {
+        throw new Error(`${label}: Coolify's application list could not be read, so ${name} is not touched`);
+    }
+    for (const app of listed) {
+        if (app.name !== name)
+            continue;
+        if (app.environment_id !== environment.id) {
+            throw new Error(`${label}: an application named ${name} exists outside the ${environment.name} environment of the sign-in project; foundry does not adopt it`);
+        }
+        if (app.git_repository !== undefined && !app.git_repository.endsWith(AUTH_REPO)) {
+            throw new Error(`${label}: the application ${name} is built from ${app.git_repository}, not ${AUTH_REPO}; foundry does not adopt it`);
+        }
+    }
+    return findOrCreatePlatformApp(coolify, name, environment, input.create);
+}
 /**
  * #211: names of the envs the platform's sign-in broker (`wtfalch/auth`'s
  * `broker/server.ts`) refuses to start without -- `ZITADEL_SERVICE_USER_TOKEN`/
@@ -6790,6 +7034,7 @@ export async function provisionFilesHost(scope, deps, target, input) {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -7183,6 +7428,7 @@ async function provisionPlatformEdge(context, deps) {
     const app = await findOrCreatePlatformApp(deps.coolify, EDGE_APP_NAME, environment, async () => {
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -8082,6 +8328,7 @@ async function provisionPlatformIntegrations(action, context, deps) {
         const server = await resolvePlatformServer(coolify);
         const githubApp = await coolify.requireGithubApp();
         return coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,

package/dist/plan/providers-readers.js

@@ -1,6 +1,8 @@
 import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { APP_ENTRY_KEY } from '../org.js';
 import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
+import { previewsOn } from './coolify-previews.js';
+import { SIGN_IN_UPSTREAM_ENV } from './sign-in.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
  * — the one place foundry records a provider's own id for an org today,
@@ -169,9 +171,10 @@ async function withHealthCheckConfig(client, resource, recorded) {
         // above notes for `ports_exposes` -- `getApplication` returns the raw
         // Coolify API response regardless.
         const healthCheckEnabled = app.health_check_enabled;
+        // #788: the same read says whether pull-request previews are on.
         return {
             ...resource,
-            config: { ...resource.config, healthCheckEnabled },
+            config: { ...resource.config, healthCheckEnabled, previewsEnabled: previewsOn(app) },
         };
     }
     catch {
@@ -243,8 +246,9 @@ async function withAgoraEnvConfig(client, resource, recorded) {
     ]);
     const env = {};
     for (const e of envs) {
-        if (!e.is_preview && e.key.startsWith('AGORA_'))
+        if (!e.is_preview && (e.key.startsWith('AGORA_') || e.key === SIGN_IN_UPSTREAM_ENV)) {
             env[e.key] = e.value;
+        }
     }
     // `@wtfalch/providers`' `CoolifyApplication` type does not declare
     // `ports_exposes` (as of 0.7.3), but `getApplication` returns the raw

package/dist/plan/sign-in-archon.d.ts

@@ -0,0 +1,46 @@
+import type { CoolifyPort, ZitadelPort } from './executor.js';
+/**
+ * Archon in-app sign-in: Archon signs people in on its own address under `/sign-in`, through the owner
+ * company's in-app login app. Its sign-in client lives in the owner company's ZITADEL, in Archon's own
+ * organisation, so this is the platform's step and not the company's login-host step.
+ */
+/** Recorded `<host>=<clientId>` once Archon's address is trusted, bound, proxied by the app and pointed at; `''` once given up again, in the reverse order. */
+export declare const PLATFORM_ARCHON_IN_APP_SCOPE_KEY = "platform_archon_in_app";
+/** The host a recorded {@link PLATFORM_ARCHON_IN_APP_SCOPE_KEY} names; `''` when none. */
+export declare function archonInAppHost(recorded: Readonly<Record<string, string>>): string;
+/** The ZITADEL calls Archon's in-app sign-in makes, on the owner company's own instance. */
+export type ArchonInAppZitadel = Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri'> & Partial<Pick<ZitadelPort, 'allowPerAppLoginBaseUri'>>;
+interface ArchonInAppInput {
+    zitadel: ArchonInAppZitadel;
+    coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs' | 'deploy'>;
+    /** The owner company's in-app login app, whose host table holds Archon's binding. Giving the address up without it leaves no table to edit. */
+    loginAppId?: string;
+    /** The owner company's login host, the instance's own: Archon's default base URI. */
+    loginHost: string;
+    /** Archon's address. */
+    host: string;
+    /** Archon's ZITADEL organisation, project and sign-in client (app id and client id). */
+    organisationId: string;
+    projectId: string;
+    appId: string;
+}
+/**
+ * Archon's address becomes one the login serves, in two halves with the app's own env between them
+ * (`SIGNIN_UPSTREAM`, written and deployed by the step): first trusted in the company's ZITADEL and bound
+ * to Archon's organisation and client in the in-app login's host table; only after the app proxies
+ * `/sign-in/*`, the client's Login V2 base URI is set to the address ({@link archonInAppPoint}).
+ */
+export declare function archonInAppBind(input: ArchonInAppInput & {
+    clientId: string;
+    loginAppId: string;
+}): Promise<void>;
+/** Sets the client's Login V2 base URI to Archon's address. Only after the app proxies `/sign-in/*`. */
+export declare function archonInAppPoint(input: ArchonInAppInput): Promise<void>;
+/** First half of giving the address up: the client goes back to the company's login host. */
+export declare function archonInAppBack(input: ArchonInAppInput): Promise<void>;
+/**
+ * Last half: the binding and the trusted domain are removed, after the app stopped proxying. A domain or
+ * binding already gone counts as done.
+ */
+export declare function archonInAppUnbind(input: ArchonInAppInput): Promise<void>;
+export {};

package/dist/plan/sign-in-archon.js

@@ -0,0 +1,71 @@
+import { isNotFoundError, setOidcAppLoginBaseUri } from './executor.js';
+import { editSignInBindings } from './sign-in-bindings.js';
+import { SIGN_IN_BASE_PATH } from './sign-in.js';
+/**
+ * Archon in-app sign-in: Archon signs people in on its own address under `/sign-in`, through the owner
+ * company's in-app login app. Its sign-in client lives in the owner company's ZITADEL, in Archon's own
+ * organisation, so this is the platform's step and not the company's login-host step.
+ */
+/** Recorded `<host>=<clientId>` once Archon's address is trusted, bound, proxied by the app and pointed at; `''` once given up again, in the reverse order. */
+export const PLATFORM_ARCHON_IN_APP_SCOPE_KEY = 'platform_archon_in_app';
+/** The host a recorded {@link PLATFORM_ARCHON_IN_APP_SCOPE_KEY} names; `''` when none. */
+export function archonInAppHost(recorded) {
+    return (recorded[PLATFORM_ARCHON_IN_APP_SCOPE_KEY] ?? '').split('=')[0] ?? '';
+}
+/**
+ * Archon's address becomes one the login serves, in two halves with the app's own env between them
+ * (`SIGNIN_UPSTREAM`, written and deployed by the step): first trusted in the company's ZITADEL and bound
+ * to Archon's organisation and client in the in-app login's host table; only after the app proxies
+ * `/sign-in/*`, the client's Login V2 base URI is set to the address ({@link archonInAppPoint}).
+ */
+export async function archonInAppBind(input) {
+    const { zitadel, host } = input;
+    await zitadel.ensureTrustedDomain(host);
+    await editSignInBindings(input.coolify, {
+        appId: input.loginAppId,
+        instanceHost: input.loginHost,
+        upsert: [
+            {
+                host,
+                organizationId: input.organisationId,
+                clientIds: [input.clientId],
+                apps: { [input.clientId]: 'archon' },
+                basePath: SIGN_IN_BASE_PATH,
+            },
+        ],
+    });
+}
+/** Sets the client's Login V2 base URI to Archon's address. Only after the app proxies `/sign-in/*`. */
+export async function archonInAppPoint(input) {
+    const { zitadel, host } = input;
+    if (!zitadel.allowPerAppLoginBaseUri) {
+        throw new Error("platform:archon: the owner company's ZITADEL port cannot allow a per-app login base URI, so Archon cannot sign in on its own address");
+    }
+    await zitadel.allowPerAppLoginBaseUri(`https://${input.loginHost}/`);
+    await setOidcAppLoginBaseUri(zitadel, input.organisationId, input.projectId, input.appId, `https://${host}${SIGN_IN_BASE_PATH}/`);
+}
+/** First half of giving the address up: the client goes back to the company's login host. */
+export async function archonInAppBack(input) {
+    await setOidcAppLoginBaseUri(input.zitadel, input.organisationId, input.projectId, input.appId, `https://${input.loginHost}/`);
+}
+/**
+ * Last half: the binding and the trusted domain are removed, after the app stopped proxying. A domain or
+ * binding already gone counts as done.
+ */
+export async function archonInAppUnbind(input) {
+    const { zitadel, host } = input;
+    if (input.loginAppId) {
+        await editSignInBindings(input.coolify, {
+            appId: input.loginAppId,
+            instanceHost: input.loginHost,
+            remove: [host],
+        });
+    }
+    try {
+        await zitadel.deleteTrustedDomain(host);
+    }
+    catch (error) {
+        if (!isNotFoundError(error))
+            throw error;
+    }
+}

package/dist/plan/sign-in-bindings.d.ts

@@ -0,0 +1,16 @@
+import type { CoolifyPort } from './executor.js';
+import type { LoginHostBinding } from './login-host.js';
+/** The login's host table env, and the document it holds (`auth/docs/company-login-hosts.md`). */
+export declare const LOGIN_HOST_BINDINGS_ENV = "LOGIN_HOST_BINDINGS";
+/**
+ * Adds, replaces and removes hosts in the host table of one in-app login app, then redeploys it when the
+ * document changed. Hosts not named stay as they are, so two steps that each own some hosts (the
+ * company's login-host step, Archon's step) never undo each other. Entries are sorted by host and the
+ * document is written compact, so a repeat writes the same text and deploys nothing.
+ */
+export declare function editSignInBindings(coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs' | 'deploy'>, input: {
+    appId: string;
+    instanceHost: string;
+    upsert?: readonly LoginHostBinding[];
+    remove?: readonly string[];
+}): Promise<void>;