@wtfalch/foundry 0.41.2 → 0.43.0

package/dist/plan/diff.js

@@ -1,6 +1,7 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
+import { planBlueGreen } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
@@ -12,7 +13,7 @@ import { planFilesKeys } from './entry-files-key.js';
 import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
@@ -23,7 +24,9 @@ import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryRoutes, entryRoutesMarker, } from './proxy-labels.js';
+import { planRemoteDatabase } from './remote-database.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
+import { SIGN_IN_BASE_PATH, SIGN_IN_IMAGE_TAG_SUFFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_LOGIN_INTERNAL_NAME, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, inAppSignIn, inAppStatePairs, inAppTargets, } from './sign-in.js';
 import { withStepSystem } from './step-system.js';
 import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
@@ -228,7 +231,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
-    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false);
+    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false, platformReadiness.signInLoginReady ?? false);
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
     // #444a: the org's one shared Postgres server and its fixed schema
@@ -455,6 +458,18 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const edgeReservedLabels = planEdgeReservedLabels(org, recordedIds, platformReadiness, options.platformHostnames ?? []);
     if (edgeReservedLabels.step)
         plannedSteps.push(edgeReservedLabels.step);
+    // Blue/green (`blue-green.ts`): the apps and balancers before the tunnel routes to them, a second
+    // server's connector after the tunnel exists.
+    const blueGreen = planBlueGreen({
+        org,
+        recordedIds,
+        servers: options.blueGreenServers,
+        canHoldSecrets: platformReadiness.canHoldSecrets === true,
+        appPlanned: (entryKey) => plannedSteps.some((p) => p.action.system === 'coolify' &&
+            p.action.kind === 'app' &&
+            p.action.key === appStepKey(org, entryKey)),
+    });
+    plannedSteps.push(...blueGreen.steps.filter((x) => x.phase === 'before').map(blueGreenDraft()));
     const tunnel = planTunnel(org, byKey, claimed, recordedIds, platformReadiness.platformApex);
     // #238: a tunnel that is being provisioned waits for an active zone; parking
     // one never does.
@@ -481,6 +496,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     else if (tunnel) {
         plannedSteps.push(tunnel);
     }
+    plannedSteps.push(...blueGreen.steps.filter((x) => x.phase === 'after').map(blueGreenDraft()));
     // Right after the zone (#43): `cloudflareRateLimit` resolves the zone by
     // apex domain, so the zone step above must already have run (or the zone
     // must already exist live) by the time this one's action executes.
@@ -548,6 +564,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     (jobsAvailable && !ownsServices(org)) || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
     if (jobsRegistration.step)
         plannedSteps.push(jobsRegistration.step);
+    const remoteDatabase = planRemoteDatabase(org, options.remoteDatabase, recordedIds);
+    if (remoteDatabase.step)
+        plannedSteps.push(remoteDatabase.step);
     // F8 (#318), after Agora and Boule, not right after the zone: a route
     // already bound by a hand-made entry, another entry's route, a taken
     // script name, or no Workers token all throw at apply, and `runSteps`
@@ -614,6 +633,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // orphan a second live key.
     if (aiKey.blocked)
         unmanaged.push({ description: aiKey.blocked, key: 'ai:key' });
+    unmanaged.push(...blueGreen.unmanaged);
     unmanaged.push(...filesKeys.blocked);
     unmanaged.push(...entryAiKeys.blocked);
     unmanaged.push(...edgeWorkers.blocked);
@@ -643,6 +663,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     if (jobsRegistration.blocked) {
         unmanaged.push({ description: jobsRegistration.blocked, key: 'jobs:registration' });
     }
+    if (remoteDatabase.blocked)
+        unmanaged.push(remoteDatabase.blocked);
     // #177: an org step whose own shared platform service is off or not yet
     // applied is blocked here, not planned -- the same rule, now driven by
     // `platformReadiness` instead of a host-supplied port. Each is reported at
@@ -739,6 +761,13 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         orgPostgres,
     };
 }
+/** A blue/green plan step as the draft step `computePlanDetail` collects. */
+function blueGreenDraft() {
+    return (step) => ({
+        action: { system: 'coolify', kind: step.kind, key: step.key, desired: step.desired },
+        step: { description: step.description, destroys: false, migrates: false },
+    });
+}
 /** Steps that run against the org's own ZITADEL instance (its projects, apps and broker entries). */
 const NEEDS_OWN_ZITADEL = new Set([
     'zitadel:issuer',
@@ -1085,13 +1114,21 @@ export function isPlatformOwnOrg(org, platformOwnerOrgId) {
  * platform's own domain, never plans the shared ZITADEL instance's own login
  * host as its own -- `auth.companyincluded.com` colliding with itself.
  */
-function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired) {
+function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, signInLoginReady = false) {
     const none = { step: null, blocked: null };
     // An own org's instance has no shared login host to bind: its issuer is the sign-in service's own.
+    // Only in-app sign-in plans a step for it: the app hosts, through its own in-app login app.
     if (ownsServices(org))
-        return none;
+        return planOwnLoginHost(org, recordedIds);
     const key = resourceKey('zitadel', 'login-host', org.id);
     const host = loginHostnameFor(org);
+    // In-app sign-in: each app host gets its own binding, trusted domain and base URI. Until the second
+    // login app that serves `/sign-in` is applied, no app host is planned (a blocked line says so).
+    const wantedApps = inAppApps(org, recordedIds);
+    const apps = signInLoginReady ? wantedApps : [];
+    const inAppWaiting = wantedApps.length > 0 && !signInLoginReady
+        ? `${org.slug}'s in-app sign-in waits for the login app that serves ${SIGN_IN_BASE_PATH} (${SIGN_IN_LOGIN_INTERNAL_NAME}), which the platform has not applied`
+        : null;
     function stepFor() {
         return {
             step: {
@@ -1099,7 +1136,11 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
                     system: 'zitadel',
                     kind: 'login-host',
                     key: org.id,
-                    desired: { host },
+                    desired: apps.length > 0 ||
+                        recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ||
+                        recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY]
+                        ? { host, apps }
+                        : { host },
                 },
                 step: {
                     description: `set ${org.slug}'s login host to ${host}`,
@@ -1107,7 +1148,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
                     migrates: false,
                 },
             },
-            blocked: null,
+            blocked: inAppWaiting,
         };
     }
     // Already applied -- a re-run plans nothing unless the host changed, an app
@@ -1116,11 +1157,14 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // `zitadelLoginHost` always advances the recorded host to the current one,
     // so a pending removal is the only way to know one is still owed, and
     // nothing else here would replan the step to retry it.
+    const targets = inAppTargets(apps, recordedIds);
     if (recordedIds[key] === host &&
         recordedIds[LOGIN_BINDING_SCOPE_KEY] ===
-            loginBindingState(host, loginHostClientIds(org, recordedIds)) &&
+            loginBindingState(host, loginHostClientIds(org, recordedIds, inAppStatePairs(targets.active).map((pair) => pair.clientId))) &&
+        (recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
+        (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
         pendingRemovalHosts(recordedIds).length === 0) {
-        return none;
+        return { step: null, blocked: inAppWaiting };
     }
     // #177: nothing to add a trusted domain to yet -- `planIssuer` already
     // reports the platform's sign-in as blocked, so this step stays silent
@@ -1132,6 +1176,55 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // repoint nothing until the port that writes the binding is wired.
     return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor();
 }
+/**
+ * In-app sign-in for a company that runs its own services: each app host is trusted in the company's
+ * own ZITADEL, bound in its in-app login app (`<slug>-auth-login-sign-in`) and given
+ * `https://<app host>/sign-in/` as its Login V2 base URI. Planned once the company's own sign-in is
+ * applied and that login app is recorded; until then one blocked line says what it waits for.
+ * Archon's host is not here: the platform's Archon step owns it.
+ */
+function planOwnLoginHost(org, recordedIds) {
+    const none = { step: null, blocked: null };
+    // Nothing wanted and nothing owed.
+    if (!inAppSignIn(org) && !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY])
+        return none;
+    // The company's own sign-in is reported on its own line (`coolify:own-auth`).
+    if (!ownAuthApplied(org, recordedIds))
+        return none;
+    const host = ownHostnames(org).auth;
+    const wantedApps = inAppApps(org, recordedIds);
+    const ready = Boolean(recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY]);
+    const apps = ready ? wantedApps : [];
+    const waiting = wantedApps.length > 0 && !ready
+        ? `${org.slug}'s in-app sign-in waits for the login app that serves ${SIGN_IN_BASE_PATH} (${org.slug}-auth-login${SIGN_IN_IMAGE_TAG_SUFFIX}), which the company's own sign-in has not applied`
+        : null;
+    // The company's own login host needs nothing here, so only the app hosts decide whether work is owed.
+    const targets = inAppTargets(apps, recordedIds);
+    if ((recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
+        (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
+        pendingRemovalHosts(recordedIds).length === 0) {
+        return { step: null, blocked: waiting };
+    }
+    // Nothing to trust a domain in, or to bind in, before the org exists in the company's ZITADEL.
+    if (!recordedIds.zitadel_org)
+        return { step: null, blocked: waiting };
+    return {
+        step: {
+            action: {
+                system: 'zitadel',
+                kind: 'login-host',
+                key: org.id,
+                desired: { host, apps },
+            },
+            step: {
+                description: `set ${org.slug}'s app hosts to sign in on their own addresses`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: waiting,
+    };
+}
 /**
  * Every sign-in app this org already has live (web or native, not api) gets
  * "user info inside the ID token" switched on once: apps made before the
@@ -2905,6 +2998,21 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             blocked,
         };
     }
+    // #788: pull-request previews on a live app. `coolifyApp` patches them off
+    // on every run, so replanning this one step is the whole repair.
+    if (live.config.previewsEnabled === true) {
+        return {
+            step: {
+                action,
+                step: {
+                    description: `turn Coolify's preview deployments off for ${org.slug}'s ${label} (#788)`,
+                    destroys: false,
+                    migrates: false,
+                },
+            },
+            blocked,
+        };
+    }
     // #239 (rule 4), from live state: an app with a database but no
     // `DATABASE_URL_OWNER` env still has the pre-split superuser URL, or never
     // got the push. Names only, never values. A reader that did not list env
@@ -3256,7 +3364,7 @@ function planTunnel(org, byKey, claimed, recordedIds, platformApex) {
         (org.calls.enabled && org.calls.usesDomain && Boolean(org.domain)) ||
         Boolean(org.domain) ||
         // A company without a domain still gets a tunnel of its own for an entry at `<slug>.oikos.host`.
-        entryRoutes(org).length > 0;
+        entryRoutes(org, recordedIds).length > 0;
     const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`, org.id, 
     // Cloudflare's status, read against what is declared: a park cannot change
     // it, so judging on/off by status alone would never let the plan empty.
@@ -3313,7 +3421,8 @@ function planTunnel(org, byKey, claimed, recordedIds, platformApex) {
     // An entry's hostname goes straight to its container, so a changed port, key or name, or an ingress
     // written before entries were routed that way, needs the ingress written again. Nothing recorded
     // equals no routes.
-    const routesStale = (recordedIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') !== entryRoutesMarker(org);
+    const routesStale = (recordedIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') !==
+        entryRoutesMarker(org, recordedIds);
     if (!connectorMissing && !dnsStale && !routesStale)
         return null;
     return {
@@ -3738,8 +3847,11 @@ function accessRuleDescription(org, rule) {
 function planRateLimit(org, recordedIds) {
     if (!(org.hosting.usesDomain || org.site.enabled) || !org.domain)
         return null;
-    if (recordedIds[resourceKey('cloudflare', 'ratelimit', org.id)])
+    // Recorded, and the rule is the variant the switch asks for (the in-app one also covers POSTs under `/sign-in/`).
+    if (recordedIds[resourceKey('cloudflare', 'ratelimit', org.id)] &&
+        (recordedIds[SIGN_IN_RATE_LIMIT_SCOPE_KEY] === '1') === inAppSignIn(org)) {
         return null;
+    }
     return {
         action: { system: 'cloudflare', kind: 'ratelimit', key: org.id, desired: {} },
         step: {

package/dist/plan/edge-ratelimits.d.ts

@@ -29,6 +29,11 @@ export interface RateLimitPort {
     createRateLimitRule(zoneId: string, rule: RateLimitRuleInput): Promise<{
         id: string;
     }>;
+    /**
+     * Deletes that one rule. Absent on a port that cannot; a step that needs it then fails by name.
+     * Rejects with a not-found error when the rule is already gone.
+     */
+    deleteRateLimitRule?(zoneId: string, id: string): Promise<void>;
 }
 /** Edge answers a create another create of the same rule is making `conflict` + `busy`. */
 export declare const EDGE_RATELIMITS_BUSY_ATTEMPTS = 5;

package/dist/plan/edge-ratelimits.js

@@ -45,14 +45,16 @@ export function createEdgeRateLimits(client, options = {}) {
             return;
         const { rules } = await retrying(() => client.list({ zoneId, description }));
         const view = rules.find((r) => r.description === description && r.state !== 'removed');
-        if (view && view.owner === null) {
-            const result = await writeSlot(() => retrying(() => client.adopt({ rules: [{ zoneId, description, id: view.id }] })));
-            if (result.skipped.length > 0) {
-                throw new Error(`edge rate limits: rule '${description}' in zone ${zoneId} cannot be adopted (${result.skipped[0]?.reason}); remove or fix it by hand`);
-            }
-        }
+        if (view && view.owner === null)
+            await adoptView(zoneId, view);
         adopted.add(key);
     };
+    const adoptView = async (zoneId, view) => {
+        const result = await writeSlot(() => retrying(() => client.adopt({ rules: [{ zoneId, description: view.description ?? '', id: view.id }] })));
+        if (result.skipped.length > 0) {
+            throw new Error(`edge rate limits: rule '${view.description}' in zone ${zoneId} cannot be adopted (${result.skipped[0]?.reason}); remove or fix it by hand`);
+        }
+    };
     return {
         async listRateLimitRules(zoneId) {
             const { rules } = await retrying(() => client.list({ zoneId }));
@@ -60,6 +62,14 @@ export function createEdgeRateLimits(client, options = {}) {
                 .filter((r) => r.state !== 'removed')
                 .map((r) => ({ id: r.id, description: r.description }));
         },
+        async deleteRateLimitRule(zoneId, id) {
+            // Edge removes only a rule it owns: a live rule it has no row for is adopted first, as a create does.
+            const { rules } = await retrying(() => client.list({ zoneId }));
+            const view = rules.find((r) => r.id === id && r.state !== 'removed');
+            if (view && view.owner === null)
+                await adoptView(zoneId, view);
+            await writeSlot(() => retrying(() => client.remove(zoneId, id)));
+        },
         async createRateLimitRule(zoneId, rule) {
             await adoptLive(zoneId, rule.description);
             const create = () => writeSlot(() => retrying(() => client.create({ zoneId, ...rule })));

package/dist/plan/executor.d.ts

@@ -2,6 +2,7 @@ import type { OrgMailOptions, OrgMailOrg, OrgMailResult } from '@wtfalch/email/p
 import { type CallsSfuUrls } from '../calls-sfu.js';
 import type { DeclaredOrg, HostingBuildPack } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
+import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type BrokerPort } from './broker-entries.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import { type StepAction } from './diff.js';
@@ -16,6 +17,7 @@ import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
 import type { RequestHeaderPort } from './platform-providers.js';
+import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
 /**
  * The Coolify calls this executor makes, shaped to match
@@ -103,11 +105,16 @@ export interface CoolifyPort {
      */
     getApplication(uuid: string): Promise<{
         uuid: string;
+        /** Coolify's name for the app; a blue/green entry's recorded app is its blue copy only when this is the blue name. */
+        name?: string;
         status?: string;
         custom_labels?: string | null;
         settings?: {
             is_consistent_container_name_enabled?: boolean;
+            is_preview_deployments_enabled?: boolean;
         };
+        /** #788: where Coolify reports previews is not documented, so `previewsOn` reads both places. */
+        is_preview_deployments_enabled?: boolean;
         custom_network_aliases?: string | null;
         health_check_enabled?: boolean;
         ports_exposes?: string;
@@ -120,6 +127,8 @@ export interface CoolifyPort {
         custom_docker_run_options?: string | null;
     }>;
     createGithubAppApplication(input: {
+        /** #788: previews off; every git app create sends `false`. */
+        is_preview_deployments_enabled?: boolean;
         project_uuid: string;
         server_uuid: string;
         /** The Docker network the app joins (`plan/destinations.ts`); absent: the server's default. */
@@ -1140,6 +1149,14 @@ export interface ZitadelPort {
      * the binding holds; `zitadelApp` never sets it at creation.
      */
     updateOidcAppLoginBaseUri(orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;
+    /**
+     * Lets each app's own Login V2 base URI count: foundry starts ZITADEL with `LOGINV2_REQUIRED=true`,
+     * which makes the instance ignore it. The host sets the instance feature (`PUT /v2/features/instance`
+     * with `loginV2.required` false and the instance default as `baseUri`). Called before an app is
+     * pointed at its own `/sign-in/` on a company that runs its own ZITADEL; the shared instance's
+     * bindings port does the same for the platform's. Optional: absent, nothing is called.
+     */
+    allowPerAppLoginBaseUri?(instanceBaseUri: string): Promise<void>;
     /**
      * Occupies `userName` in `orgId` with a machine user that has no role and
      * no token, so nobody can register under that name. Idempotent: a user
@@ -2006,6 +2023,13 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * client id that binding holds. Apps created later are not in it yet:
      * the next run replans (`diff.ts`'s `planLoginHost`) and moves them.
      *
+     * In-app sign-in (`signIn.inApp`, `plan/sign-in.ts` has the order): an app host is trusted first. It is
+     * bound, and its app pointed at `/sign-in/`, only once its app runs `SIGNIN_UPSTREAM` (the app step
+     * records that). The bind moves the app's client id off the company's binding in the same write (the
+     * login refuses a client id in two bindings); a company binding left with no client is removed.
+     * Switched off, the client id goes back and the base URI returns to the login host, and a trusted
+     * domain is given up only after the app dropped the env.
+     *
      * #274: when the org's host has moved (`recorded[key]`, the *previous*
      * run's resourceId, differs from this run's `host`), also removes every
      * host that is no longer the org's current one from both places --
@@ -2067,6 +2091,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *    the snapshot taken before the repoint still named it.
      */
     private zitadelLoginHost;
+    /**
+     * The host table of a company's own in-app login app as a bindings port that collects its edits and
+     * writes them once on `flush` (one redeploy, none when nothing changed). Used for a company that runs
+     * its own services, which has no host-supplied bindings port.
+     */
+    private ownSignInBindings;
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
@@ -2115,6 +2145,34 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * actually be created on.
      */
     private resolveServer;
+    /**
+     * Contract C3: every usable, reachable Coolify server, the org's primary first. The primary is
+     * {@link resolveServer}'s (databases and single-copy services stay on it, unchanged). A server that is
+     * down is named in `down` and left out of `servers`; it is not an error.
+     */
+    resolveServers(org: DeclaredOrg, context: StepExecutionContext): Promise<{
+        primary: {
+            uuid: string;
+        };
+        servers: Array<{
+            uuid: string;
+        }>;
+        down: string[];
+    }>;
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`), or `null` while its
+     * blue copy is not recorded. The health token is only read here, never minted.
+     */
+    releaseHost(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
+    blueGreenServers(): Promise<BlueGreenServer[]>;
+    /**
+     * The blue/green steps (`plan/blue-green.ts`): `bluegreen` makes the apps and the balancer on one server,
+     * `bluegreen-lb` only writes the balancer's weights, `bluegreen-connector` runs the tunnel's connector on a
+     * server. A server that went down since the plan is skipped by `bluegreen-connector`'s caller, not here:
+     * a step for it fails, which the next plan reports instead.
+     */
+    private coolifyBlueGreen;
     private coolifyApp;
     /**
      * #75: mounts a persistent volume at {@link LOG_DIR} on the app, unless one
@@ -2825,6 +2883,18 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * behind it.
      */
     private coolifyAgora;
+    /**
+     * Records whether an app's running env holds `SIGNIN_UPSTREAM` (the app's host while it does, `''` once it
+     * does not), so the login-host step knows when to point the base URI at the app and when it may give the
+     * host up. Written only when the value changes.
+     */
+    private recordSignInEnvLive;
+    /**
+     * In-app sign-in switched off (or its host given up): the app's live `SIGNIN_UPSTREAM` is deleted, because
+     * `bulkUpsertEnvs` never removes a key. Left in place, the app would keep proxying `/sign-in/*` to the login.
+     * Nothing happens while the env is desired or the app does not hold it.
+     */
+    private dropStaleSignInUpstream;
     /**
      * `plan/diff.ts`'s `planBoule`: provisions the org's own Boule
      * (https://github.com/wtfalch/boule) as one more Coolify application, from
@@ -2971,6 +3041,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private ownSfu;
     private jobsRegistration;
+    /** The blue/green database route (`plan/remote-database.ts`). */
+    private remoteDatabaseRoute;
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     private deliverWithRetry;
     private cloudflareTunnel;
@@ -3433,3 +3505,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
  * `:`. It never scans the path or the response body.
  */
 export declare function isNotFoundError(error: unknown): boolean;
+/** True when ZITADEL refused an update because the value already is the wanted one. Matches the error code, never the free text. */
+export declare function isNoChangesError(error: unknown): boolean;
+/**
+ * {@link ZitadelPort.updateOidcAppLoginBaseUri} that counts an app already holding the wanted base URI as
+ * done: ZITADEL answers that write with "No changes" and a repeat apply must not fail on it.
+ */
+export declare function setOidcAppLoginBaseUri(zitadel: Pick<ZitadelPort, 'updateOidcAppLoginBaseUri'>, orgId: string, projectId: string, appId: string, loginBaseUri: string): Promise<void>;