@wtfalch/foundry 0.41.2 → 0.43.0

package/dist/plan/executor.js

@@ -7,6 +7,8 @@ import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, heldEnvRef, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
+import { bgKey, colorAppName, entrySubject, healthTokenName, liveAppNameFor, splitServers, } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { recordBuiltCommit } from './build-record.js';
@@ -14,6 +16,7 @@ import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerNam
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
+import { previewsOn } from './coolify-previews.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
@@ -43,7 +46,11 @@ import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { createReleaseHost } from './release-host.js';
+import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
+import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
+import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -122,6 +129,32 @@ export class NotBuiltError extends Error {
  * so a host is never read as "not in use" purely because ZITADEL's own
  * casing or slashing differs from this step's.
  */
+/**
+ * The in-app hosts a login-host step carries, read back and checked: a plan from an older build carries
+ * none, and a malformed entry is refused by name (never echoed) rather than bound.
+ */
+function inAppAppsOf(raw, slug) {
+    if (raw === undefined)
+        return [];
+    if (!Array.isArray(raw))
+        throw new Error(`zitadel:login-host for ${slug}: apps is not a list`);
+    return raw.map((entry) => {
+        const e = entry;
+        if (!e ||
+            (e.app !== 'agora' && e.app !== 'boule') ||
+            typeof e.host !== 'string' ||
+            !e.host ||
+            typeof e.clientId !== 'string' ||
+            !e.clientId) {
+            throw new Error(`zitadel:login-host for ${slug}: an in-app host entry is malformed`);
+        }
+        return { app: e.app, host: e.host, clientId: e.clientId };
+    });
+}
+/** The ZITADEL ids of the company's Agora and Boule clients: the apps in-app sign-in can move. */
+function ownInAppAppIds(recorded) {
+    return new Set([recorded['zitadel:app:agora'], recorded['zitadel:app:boule']].filter((id) => Boolean(id)));
+}
 function normalizedLoginBaseUri(uri) {
     return uri.toLowerCase().replace(/\/$/, '');
 }
@@ -854,7 +887,11 @@ function limitProfileOf(action) {
         case 'coolify:boule':
         case 'coolify:boule-broker-entry':
             return LIMITS.boule;
+        case 'coolify:bluegreen':
+        case 'coolify:bluegreen-lb':
+            return LIMITS.companyApp;
         case 'cloudflare:tunnel':
+        case 'coolify:bluegreen-connector':
             return LIMITS.connector;
         default:
             return action.system === 'coolify' ? LIMITS.companyOther : undefined;
@@ -1080,6 +1117,10 @@ export class FoundryStepExecutor {
                 return this.coolifyApp(action, org, context);
             case 'coolify:network':
                 return this.coolifyNetwork(action, org, context);
+            case 'coolify:bluegreen':
+            case 'coolify:bluegreen-lb':
+            case 'coolify:bluegreen-connector':
+                return this.coolifyBlueGreen(action, org, context);
             case 'coolify:broker-entry':
                 return this.coolifyBrokerEntry(action, org, context);
             case 'coolify:database':
@@ -1101,7 +1142,7 @@ export class FoundryStepExecutor {
             case 'cloudflare:gate':
                 return this.cloudflareGate(action, org, context);
             case 'cloudflare:ratelimit':
-                return this.cloudflareRateLimit(org);
+                return this.cloudflareRateLimit(org, context);
             case 'cloudflare:worker':
                 return this.cloudflareWorker(action, org, context);
             case 'files:organisation':
@@ -1140,6 +1181,8 @@ export class FoundryStepExecutor {
                 return this.bouleBrokerEntry(org, context);
             case 'jobs:registration':
                 return this.jobsRegistration(action, org, context);
+            case 'cloudflare:db-route':
+                return this.remoteDatabaseRoute(action, org, context);
             case 'coolify:own-auth':
                 return this.ownAuth(action, org, context);
             case 'coolify:own-auth-db-move':
@@ -1310,7 +1353,7 @@ export class FoundryStepExecutor {
      * `cloudflareAccess`'s own refusal when a foreign Access app already
      * holds the hostname.
      */
-    async cloudflareRateLimit(org) {
+    async cloudflareRateLimit(org, context) {
         if (!org.domain) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: hosting.usesDomain is set but domain is null`);
         }
@@ -1319,20 +1362,41 @@ export class FoundryStepExecutor {
         if (!zone) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
+        // The zone's one Free-plan rule: the base one, or with in-app sign-in the same limit that also
+        // covers POSTs under `/sign-in/` (static assets there stay unlimited).
+        const inApp = inAppSignIn(org);
+        const wanted = inApp
+            ? { description: SIGN_IN_RATE_LIMIT_DESCRIPTION, expression: SIGN_IN_RATE_LIMIT_EXPRESSION }
+            : { description: RATE_LIMIT_RULE_DESCRIPTION, expression: SIGN_IN_PATH_EXPRESSION };
+        const ours = [RATE_LIMIT_RULE_DESCRIPTION, SIGN_IN_RATE_LIMIT_DESCRIPTION];
         const rateLimits = this.rateLimitPort();
         const rules = await rateLimits.listRateLimitRules(zone.id);
-        const own = rules.find((r) => r.description === RATE_LIMIT_RULE_DESCRIPTION);
+        const own = rules.find((r) => r.description === wanted.description);
         if (!own) {
-            const foreign = rules[0];
+            const foreign = rules.find((r) => !ours.includes(r.description ?? ''));
             if (foreign) {
                 throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
             }
+            // The other variant of foundry's own rule holds the zone's one slot: remove it, then make this one.
+            const stale = rules.find((r) => ours.includes(r.description ?? ''));
+            if (stale) {
+                if (!rateLimits.deleteRateLimitRule) {
+                    throw new Error(`cloudflare:ratelimit for ${org.slug}: the rate limit rule must change but this host's rate limit port cannot delete a rule`);
+                }
+                try {
+                    await rateLimits.deleteRateLimitRule(zone.id, stale.id);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
         }
         // Edge adopts a live rule with no edge row (made before edge owned rate
         // limits) and then makes the rule once: a repeat returns it unchanged.
         const created = await rateLimits.createRateLimitRule(zone.id, {
-            description: RATE_LIMIT_RULE_DESCRIPTION,
-            expression: SIGN_IN_PATH_EXPRESSION,
+            description: wanted.description,
+            expression: wanted.expression,
             action: 'block',
             ratelimit: {
                 characteristics: ['cf.colo.id', 'ip.src'],
@@ -1341,6 +1405,8 @@ export class FoundryStepExecutor {
                 mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
             },
         });
+        // Last: a crash before here plans the step again.
+        context.recordScopeId(SIGN_IN_RATE_LIMIT_SCOPE_KEY, inApp ? '1' : '');
         return { resourceId: created.id };
     }
     /**
@@ -1745,6 +1811,13 @@ export class FoundryStepExecutor {
      * client id that binding holds. Apps created later are not in it yet:
      * the next run replans (`diff.ts`'s `planLoginHost`) and moves them.
      *
+     * In-app sign-in (`signIn.inApp`, `plan/sign-in.ts` has the order): an app host is trusted first. It is
+     * bound, and its app pointed at `/sign-in/`, only once its app runs `SIGNIN_UPSTREAM` (the app step
+     * records that). The bind moves the app's client id off the company's binding in the same write (the
+     * login refuses a client id in two bindings); a company binding left with no client is removed.
+     * Switched off, the client id goes back and the base URI returns to the login host, and a trusted
+     * domain is given up only after the app dropped the env.
+     *
      * #274: when the org's host has moved (`recorded[key]`, the *previous*
      * run's resourceId, differs from this run's `host`), also removes every
      * host that is no longer the org's current one from both places --
@@ -1812,8 +1885,13 @@ export class FoundryStepExecutor {
         if (!zitadelOrgId) {
             throw new Error(`zitadel:login-host for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
         }
-        // `planLoginHost` blocks the step while this port is not wired.
-        const bindings = this.ports.loginHostBindings;
+        // A company that runs its own services writes the host table of its own in-app login app; every
+        // other company, the shared one's through the host's port. `planLoginHost` blocks the step while
+        // the shared port is not wired.
+        const own = ownsServices(org);
+        const bindings = own
+            ? this.ownSignInBindings(org, recorded, action.desired.host)
+            : this.ports.loginHostBindings;
         if (!bindings) {
             throw new Error(`zitadel:login-host for ${org.slug}: the loginHostBindings port is not wired`);
         }
@@ -1821,13 +1899,84 @@ export class FoundryStepExecutor {
         // The platform's own shared sign-in host: already trusted and routed by
         // the shared instance, so it gets no trusted domain or binding here.
         const shared = action.desired.shared === true;
-        const clientIds = loginHostClientIds(org, recorded);
+        // In-app sign-in: the plan carries the app hosts to bind (empty with the switch off).
+        const inApp = inAppAppsOf(action.desired.apps, org.slug);
+        // The instance ignores an app's own base URI unless it is told not to: a port that cannot say so
+        // stops the step before anything is written, rather than recording a base URI that has no effect.
+        if (!shared && own && inApp.length > 0 && !this.ports.zitadel.allowPerAppLoginBaseUri) {
+            throw new Error(`zitadel:login-host for ${org.slug}: the ZITADEL port cannot allow a per-app login base URI, so the app hosts cannot sign in on their own addresses`);
+        }
+        // The app hosts that are bound and get the app's own address as base URI: only once their app runs
+        // with `SIGNIN_UPSTREAM` (the app steps record it), never before. Every other app host is trusted
+        // and waits, and the company's own binding keeps its client id, so the old path signs in meanwhile.
+        const targets = inAppTargets(inApp, recorded);
+        const activePairs = inAppStatePairs(targets.active);
+        const activeHosts = new Set(activePairs.map((pair) => pair.host));
+        const envLive = signInEnvLiveHosts(recorded);
+        // The login refuses a client id held by two bindings: an active app host's client id is in its own binding only.
+        const clientIds = loginHostClientIds(org, recorded, activePairs.map((pair) => pair.clientId));
         if (!shared) {
-            await this.ports.zitadel.ensureTrustedDomain(host);
+            // The company's own login host is its instance's external domain: trusted and routed already.
+            if (!own)
+                await this.ports.zitadel.ensureTrustedDomain(host);
+            // Each app host is trusted first.
+            for (const app of inApp)
+                await this.ports.zitadel.ensureTrustedDomain(app.host);
+            // An app host bound before and not active now gives its client id back to the company's binding:
+            // its own binding goes first, so no write leaves the id in two bindings.
+            let unbound = false;
+            for (const old of inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY])) {
+                if (activeHosts.has(old))
+                    continue;
+                try {
+                    await bindings.deleteBinding(old);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+                unbound = true;
+            }
+            if (unbound)
+                await bindings.flush?.();
             // zitadel-login's own routing table, written before any app is repointed
             // so no app ever points at a host with no binding.
-            await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+            if (!own) {
+                if (clientIds.length > 0 || activePairs.length === 0) {
+                    await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+                }
+                else {
+                    // Every client of the company signs in on its app's own address: the login refuses a binding
+                    // with no client ids, so the company's own binding goes (nothing signs in on this host).
+                    try {
+                        await bindings.deleteBinding(host);
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                }
+            }
+            for (const app of inApp) {
+                if (!activeHosts.has(app.host))
+                    continue;
+                await bindings.upsertBinding({ ...inAppBindingFor(app), organizationId: zitadelOrgId });
+            }
+            // One write for every upsert above (one redeploy of the login), before any app is repointed.
+            await bindings.flush?.();
+            if (own && activeHosts.size > 0) {
+                await this.ports.zitadel.allowPerAppLoginBaseUri?.(`https://${host}/`);
+            }
+        }
+        // The base URI each app's sign-in starts from: its own address under `/sign-in/` in-app, else the login host.
+        const appBaseUris = new Map();
+        for (const app of inApp) {
+            const appId = recorded[`zitadel:app:${app.app}`];
+            if (appId && activeHosts.has(app.host)) {
+                appBaseUris.set(appId, `https://${app.host}${SIGN_IN_BASE_PATH}/`);
+            }
         }
+        const baseUriOf = (appId) => appBaseUris.get(appId) ?? `https://${host}/`;
         // Only apps whose client id the binding now holds: any other app in the
         // project would lose sign-in. The rest move on a later run, once the
         // recorded client ids differ from the binding and replan this step.
@@ -1858,7 +2007,10 @@ export class FoundryStepExecutor {
             for (const app of liveApps) {
                 if (!boundAppIds.has(app.id))
                     continue;
-                await this.ports.zitadel.updateOidcAppLoginBaseUri(zitadelOrgId, projectId, app.id, `https://${host}/`);
+                // A company's own instance has the login host as its default; only the in-app apps move.
+                if (own && !appBaseUris.has(app.id) && !ownInAppAppIds(recorded).has(app.id))
+                    continue;
+                await setOidcAppLoginBaseUri(this.ports.zitadel, zitadelOrgId, projectId, app.id, baseUriOf(app.id));
             }
         }
         // Fix round 3 point 5: a bound app's current base URI is `host` for
@@ -1870,7 +2022,7 @@ export class FoundryStepExecutor {
         // compare against, same as an app this loop never visits at all.
         const currentLoginBaseUris = new Set();
         for (const app of liveApps) {
-            const uri = boundAppIds.has(app.id) ? `https://${host}/` : app.loginBaseUri;
+            const uri = boundAppIds.has(app.id) ? baseUriOf(app.id) : app.loginBaseUri;
             if (typeof uri === 'string')
                 currentLoginBaseUris.add(normalizedLoginBaseUri(uri));
         }
@@ -1897,6 +2049,19 @@ export class FoundryStepExecutor {
         candidates.delete(host);
         if (previousHost && previousHost !== host)
             candidates.add(previousHost);
+        // An in-app host applied before and no longer wanted (switch off, or the app is gone) is owed a removal
+        // the same way an old login host is; a host still wanted is never a candidate.
+        // An app that still holds `SIGNIN_UPSTREAM` keeps its binding and trusted domain: it is switched off
+        // in reverse order, the base URI first, then the app's env, then these.
+        for (const old of [
+            ...inAppStateHosts(recorded[SIGN_IN_TRUSTED_SCOPE_KEY]),
+            ...inAppStateHosts(recorded[SIGN_IN_IN_APP_SCOPE_KEY]),
+        ]) {
+            if (!envLive.has(old))
+                candidates.add(old);
+        }
+        for (const app of inApp)
+            candidates.delete(app.host);
         // #274: a removal, once the new host is fully live (trusted, bound, and
         // every repointable app repointed) -- never the other way round, so an
         // org is never left with no trusted host at all if this throws partway
@@ -1905,9 +2070,11 @@ export class FoundryStepExecutor {
         // its connector app and its tunnel): a domain already gone must not skip
         // the binding delete that follows it.
         const stillPending = [];
+        let removed = false;
         for (const candidate of candidates) {
             if (!canDecideSafely ||
-                currentLoginBaseUris.has(normalizedLoginBaseUri(`https://${candidate}/`))) {
+                currentLoginBaseUris.has(normalizedLoginBaseUri(`https://${candidate}/`)) ||
+                currentLoginBaseUris.has(normalizedLoginBaseUri(`https://${candidate}${SIGN_IN_BASE_PATH}/`))) {
                 stillPending.push(candidate);
                 continue;
             }
@@ -1918,6 +2085,7 @@ export class FoundryStepExecutor {
                 if (!isNotFoundError(error))
                     throw error;
             }
+            removed = true;
             try {
                 await bindings.deleteBinding(candidate);
             }
@@ -1926,6 +2094,9 @@ export class FoundryStepExecutor {
                     throw error;
             }
         }
+        // Nothing queued, nothing to write: a step that only added hosts has already flushed once.
+        if (removed)
+            await bindings.flush?.();
         // Both last, so a crash above reruns the whole step rather than losing
         // track of either. A client id recorded after this point differs from
         // the binding and replans the step next run; a nonempty pending list
@@ -1933,11 +2104,44 @@ export class FoundryStepExecutor {
         // normally alone decides it.
         if (shared)
             context.recordScopeId(LOGIN_HOST_SHARED_SCOPE_KEY, '1');
-        else
-            context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+        else {
+            if (!own)
+                context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+            context.recordScopeId(SIGN_IN_TRUSTED_SCOPE_KEY, targets.trusted);
+            context.recordScopeId(SIGN_IN_IN_APP_SCOPE_KEY, targets.active);
+        }
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
+    /**
+     * The host table of a company's own in-app login app as a bindings port that collects its edits and
+     * writes them once on `flush` (one redeploy, none when nothing changed). Used for a company that runs
+     * its own services, which has no host-supplied bindings port.
+     */
+    ownSignInBindings(org, recorded, instanceHost) {
+        const appId = recorded[SIGN_IN_LOGIN_APP_SCOPE_KEY];
+        if (!appId) {
+            throw new Error(`zitadel:login-host for ${org.slug}: the company's in-app login app is not recorded yet`);
+        }
+        const upsert = [];
+        const remove = [];
+        return {
+            upsertBinding: async (binding) => {
+                upsert.push(binding);
+            },
+            deleteBinding: async (host) => {
+                remove.push(host);
+            },
+            flush: async () => {
+                if (upsert.length === 0 && remove.length === 0)
+                    return;
+                const edits = { appId, instanceHost, upsert: [...upsert], remove: [...remove] };
+                upsert.length = 0;
+                remove.length = 0;
+                await editSignInBindings(this.ports.coolify, edits);
+            },
+        };
+    }
     /**
      * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
      * in through a second ZITADEL org, `<slug> customers`, with
@@ -2311,6 +2515,140 @@ export class FoundryStepExecutor {
         context.recordScopeId(COOLIFY_SERVER_SCOPE_KEY, server.uuid);
         return server;
     }
+    /**
+     * Contract C3: every usable, reachable Coolify server, the org's primary first. The primary is
+     * {@link resolveServer}'s (databases and single-copy services stay on it, unchanged). A server that is
+     * down is named in `down` and left out of `servers`; it is not an error.
+     */
+    async resolveServers(org, context) {
+        const primary = await this.resolveServer(org, context);
+        const { up, down } = splitServers(await this.blueGreenServers());
+        return {
+            primary,
+            servers: [primary, ...up.filter((uuid) => uuid !== primary.uuid).map((uuid) => ({ uuid }))],
+            down,
+        };
+    }
+    /**
+     * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`), or `null` while its
+     * blue copy is not recorded. The health token is only read here, never minted.
+     */
+    releaseHost(org, subject, context, renew) {
+        const recorded = context.recordedIds();
+        const primaryBlueAppId = recorded[`coolify:app:${appStepKey(org, subject.id)}`];
+        const primaryUuid = recorded[COOLIFY_SERVER_SCOPE_KEY];
+        if (!primaryBlueAppId || !primaryUuid)
+            return null;
+        return createReleaseHost({
+            subject,
+            context,
+            coolify: this.ports.coolify,
+            healthToken: async () => (await this.ports.heldKeys?.resolve(sharedSecretRef(org.id, healthTokenName(subject.id)))) ?? null,
+            secret: (value) => void this.handledSecrets.add(value),
+            primaryUuid,
+            primaryBlueAppId,
+            runtime: this.ports.runtime ?? {},
+            ...(this.ports.runtime?.fetch ? { fetch: this.ports.runtime.fetch } : {}),
+            renew,
+            label: `coolify:release:${subject.id}`,
+        });
+    }
+    /** Every server Coolify lists with whether it is usable and reachable, for the planner. */
+    async blueGreenServers() {
+        return (await this.ports.coolify.listServers()).map((s) => ({
+            uuid: s.uuid,
+            usable: s.is_usable,
+            reachable: s.is_reachable,
+        }));
+    }
+    /**
+     * The blue/green steps (`plan/blue-green.ts`): `bluegreen` makes the apps and the balancer on one server,
+     * `bluegreen-lb` only writes the balancer's weights, `bluegreen-connector` runs the tunnel's connector on a
+     * server. A server that went down since the plan is skipped by `bluegreen-connector`'s caller, not here:
+     * a step for it fails, which the next plan reports instead.
+     */
+    async coolifyBlueGreen(action, org, context) {
+        const recorded = () => context.recordedIds();
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const serverUuid = String(action.desired.server ?? '');
+        const primaryUuid = String(action.desired.primary ?? '');
+        const live = await this.resolveServers(org, context);
+        if (!live.servers.some((s) => s.uuid === serverUuid)) {
+            throw new Error(`${action.kind} for ${org.slug}: Coolify server ${serverUuid} is not usable and reachable`);
+        }
+        if (live.primary.uuid !== primaryUuid) {
+            throw new Error(`${action.kind} for ${org.slug}: the plan's primary server is not the recorded one`);
+        }
+        if (action.kind === 'bluegreen-connector') {
+            const tunnelId = recorded()[`cloudflare:tunnel:${org.id}`];
+            if (!tunnelId)
+                throw new Error(`bluegreen-connector for ${org.slug}: the tunnel is not recorded yet`);
+            await applyBlueGreenConnectors({
+                coolify: this.ports.coolify,
+                tunnels: this.tunnelPort(),
+                tunnelId,
+                baseAppName: `${org.slug}-cloudflared`,
+                baseScopeKey: CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY,
+                primaryUuid,
+                serverUuids: [serverUuid],
+                projectUuid,
+                environment,
+                recorded,
+                record: (key, id) => context.recordScopeId(key, id),
+                persist: () => context.persistScopeIds(),
+            });
+            return undefined;
+        }
+        const entry = org.hosting.entries.find((e) => e.key === action.desired.entry);
+        if (!entry || !entrySubject(org, entry)) {
+            throw new Error(`${action.kind} for ${org.slug}: no blue/green entry '${String(action.desired.entry)}'`);
+        }
+        const primaryBlueAppId = recorded()[`coolify:app:${appStepKey(org, entry.key)}`];
+        if (!primaryBlueAppId) {
+            throw new Error(`${action.kind} for ${org.slug}: entry '${entry.key}' has no blue app recorded yet`);
+        }
+        // The blue app keeps the name it has: an app that ran before blue/green is adopted under its own name.
+        if (!recorded()[bgKey.blueName(entry.key)]) {
+            const blue = await this.ports.coolify.getApplication(primaryBlueAppId);
+            if (blue.name) {
+                context.recordScopeId(bgKey.blueName(entry.key), blue.name);
+                await context.persistScopeIds();
+            }
+        }
+        const subject = entrySubject(org, entry, recorded());
+        const runtime = this.ports.runtime ?? {};
+        const deps = {
+            coolify: this.ports.coolify,
+            recorded,
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+            projectUuid,
+            environment,
+            healthToken: async () => {
+                if (typeof this.ports.heldKeys?.put !== 'function') {
+                    throw new Error(`${action.kind} for ${org.slug}: the executor's heldKeys cannot put the health token`);
+                }
+                const token = await this.ensureSharedSecret(org, healthTokenName(entry.key), recorded());
+                this.handledSecrets.add(token);
+                return token;
+            },
+            secret: (value) => void this.handledSecrets.add(value),
+            runtime,
+            sleep: runtime.sleep ?? defaultSleep,
+            label: `${action.system}:${action.kind}:${entry.key}`,
+            primaryBlueAppId,
+            logDir: LOG_DIR,
+            isRunning: isRunningOrStarting,
+        };
+        if (action.kind === 'bluegreen-lb') {
+            await applyBlueGreenWeights(deps, subject, { uuid: serverUuid, primaryUuid });
+        }
+        else {
+            await applyBlueGreenServer(deps, subject, { uuid: serverUuid, primaryUuid });
+        }
+        return undefined;
+    }
     async coolifyApp(action, org, context) {
         const recordedAppId = context.recordedIds()[`coolify:app:${action.key}`];
         if (action.desired.enabled === false) {
@@ -2348,6 +2686,11 @@ export class FoundryStepExecutor {
         }
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        // A blue/green entry's app is its blue copy. An app that ran before blue/green keeps its own name and is
+        // adopted as blue; an entry with no app yet gets `<base>-blue`. The name is recorded once decided.
+        const blueNameKey = bgKey.blueName(entry.key);
+        const blueNameRecorded = Boolean(context.recordedIds()[blueNameKey]);
+        let appName = liveAppNameFor(org, entry, context.recordedIds());
         // The recorded id first; the name when nothing is recorded, or when the
         // recorded app is gone.
         let existing = null;
@@ -2356,17 +2699,35 @@ export class FoundryStepExecutor {
             try {
                 live = await this.ports.coolify.getApplication(recordedAppId);
                 existing = { uuid: recordedAppId };
+                if (entry.blueGreen &&
+                    !blueNameRecorded &&
+                    live.name === colorAppName(appNameFor(org, entry), 'blue')) {
+                    appName = live.name;
+                }
             }
             catch (error) {
                 if (!isNotFoundError(error))
                     throw error;
             }
         }
+        if (!existing && entry.blueGreen && !blueNameRecorded) {
+            const own = await this.ports.coolify.findApplicationByName(appNameFor(org, entry), {
+                environmentIds: [environment.id],
+            });
+            if (own) {
+                existing = own;
+                appName = appNameFor(org, entry);
+            }
+        }
         if (!existing) {
-            existing = await this.ports.coolify.findApplicationByName(appNameFor(org, entry), {
+            existing = await this.ports.coolify.findApplicationByName(appName, {
                 environmentIds: [environment.id],
             });
         }
+        if (entry.blueGreen && !blueNameRecorded) {
+            context.recordScopeId(blueNameKey, appName);
+            await context.persistScopeIds();
+        }
         // No entry gets Coolify `domains`: Coolify would add a Traefik router for them. The company's
         // tunnel routes an entry's names straight to its container (also `<slug>.oikos.host`, through a
         // record in the platform's oikos.host zone), which every entry reaches as `<slug>-<key>` (its
@@ -2403,6 +2764,7 @@ export class FoundryStepExecutor {
             const server = await this.resolveServer(org, context);
             const githubApp = await this.ports.coolify.requireGithubApp();
             const created = await this.ports.coolify.createGithubAppApplication({
+                is_preview_deployments_enabled: false,
                 project_uuid: projectUuid,
                 server_uuid: server.uuid,
                 environment_name: environment.name,
@@ -2411,7 +2773,7 @@ export class FoundryStepExecutor {
                 git_repository: appRepo,
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
-                name: appNameFor(org, entry),
+                name: appName,
                 autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
@@ -2438,6 +2800,10 @@ export class FoundryStepExecutor {
         }
         if (want.autoDeploy !== have.autoDeploy)
             patch.is_auto_deploy_enabled = want.autoDeploy;
+        // #788: an app found with previews on gets them off (`planApp` plans the
+        // step for it). A created app has them off from the create.
+        if (previewsOn(live))
+            patch.is_preview_deployments_enabled = false;
         // #543: the health-check quartet too, every run -- the same reason
         // Archon's own doc comment gives (without one, Coolify's rolling update
         // has nothing to wait on and stops the old container immediately). The
@@ -2460,7 +2826,7 @@ export class FoundryStepExecutor {
             patch.domains = '';
         }
         if (!existing || patch.domains !== undefined) {
-            patch.custom_internal_name = appNameFor(org, entry);
+            patch.custom_internal_name = appName;
         }
         // A `*` entry's proxy labels: Coolify takes `custom_labels` base64 encoded
         // and uses them instead of the labels it generates from `domains`. Rule 4:
@@ -2514,8 +2880,8 @@ export class FoundryStepExecutor {
         // `ensureLogVolume` whether this app was already running before this
         // call -- see its own doc comment for why that decides whether to
         // restart it.
-        await this.ensureLogVolume(appId, org, Boolean(existing), appNameFor(org, entry));
-        await this.ensureEntryVolumes(appId, entry, Boolean(existing), appNameFor(org, entry));
+        await this.ensureLogVolume(appId, org, Boolean(existing), appName);
+        await this.ensureEntryVolumes(appId, entry, Boolean(existing), appName);
         // The app receives whatever it needs to sign in (gap P2). Unconditional,
         // unlike the database push above: every app has a hostname, and an
         // upsert of the same value on a later apply is a no-op, not a change.
@@ -2546,8 +2912,10 @@ export class FoundryStepExecutor {
             // The public name answers from the container only once the tunnel step has written the
             // direct route; before that (a first apply, or the one that moves it) the deployment is the check.
             hostname &&
+                // The public name goes through the balancer, which may answer from the other color.
+                !entry.blueGreen &&
                 (context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') ===
-                    entryRoutesMarker(org)
+                    entryRoutesMarker(org, context.recordedIds())
                 ? publicHealthCheck(org, context.recordedIds(), hostname, healthPath)
                 : { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, `coolify:app:${entry.key}`, `${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} stays at its previous deploy`);
             await recordBuiltCommit(this.ports.coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: entry.key }, (key, value) => context.recordScopeId(key, value));
@@ -3857,6 +4225,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(input.org, input.context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const created = await this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: input.projectUuid,
             server_uuid: server.uuid,
             environment_name: input.environment.name,
@@ -4389,6 +4758,7 @@ export class FoundryStepExecutor {
         }
         const githubApp = await this.ports.coolify.requireGithubApp();
         const synapse = await this.findOrCreateCallsApp(names.synapse, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -4413,6 +4783,7 @@ export class FoundryStepExecutor {
             instant_deploy: false,
         }), { startIfStopped: false });
         const service = await this.findOrCreateCallsApp(names.service, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -4613,6 +4984,7 @@ export class FoundryStepExecutor {
         }
         const githubApp = await this.ports.coolify.requireGithubApp();
         const synapse = await this.findOrCreateCallsApp(names.synapse, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -4819,6 +5191,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -5199,6 +5572,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -5233,10 +5607,10 @@ export class FoundryStepExecutor {
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
         // can no longer tell a changed value from one already live.
-        const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
-            .filter((e) => !e.is_preview)
-            .map((e) => [e.key, e.value]));
+        const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
+        const liveEnv = new Map(liveRows.map((e) => [e.key, e.value]));
         const envChanged = agoraEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
+        await this.dropStaleSignInUpstream(app.appId, env, liveRows);
         await this.ports.coolify.bulkUpsertEnvs(app.appId, Object.entries(env).map(([key, value]) => ({ key, value })));
         const revision = agoraEnvRevision(env);
         const alreadyActivated = context.recordedIds()[AGORA_ACTIVATED_ENV_SCOPE_KEY] === revision;
@@ -5262,9 +5636,43 @@ export class FoundryStepExecutor {
         else if (app.existed && (envChanged || !alreadyActivated)) {
             await this.ports.coolify.restart(app.appId);
         }
+        // The login-host step points the sign-in at this app's own address only once the env is running. Before the
+        // activation marker, so a crash between the two plans this step again and records it.
+        this.recordSignInEnvLive(context, 'agora', agoraHostnameFor(org), env);
         context.recordScopeId(AGORA_ACTIVATED_ENV_SCOPE_KEY, revision);
         return { resourceId: app.appId };
     }
+    /**
+     * Records whether an app's running env holds `SIGNIN_UPSTREAM` (the app's host while it does, `''` once it
+     * does not), so the login-host step knows when to point the base URI at the app and when it may give the
+     * host up. Written only when the value changes.
+     */
+    recordSignInEnvLive(context, app, host, env) {
+        const key = `${SIGN_IN_ENV_LIVE_SCOPE_PREFIX}${app}`;
+        const value = env[SIGN_IN_UPSTREAM_ENV] !== undefined ? host : '';
+        if ((context.recordedIds()[key] ?? '') !== value)
+            context.recordScopeId(key, value);
+    }
+    /**
+     * In-app sign-in switched off (or its host given up): the app's live `SIGNIN_UPSTREAM` is deleted, because
+     * `bulkUpsertEnvs` never removes a key. Left in place, the app would keep proxying `/sign-in/*` to the login.
+     * Nothing happens while the env is desired or the app does not hold it.
+     */
+    async dropStaleSignInUpstream(appId, desired, liveRows) {
+        if (desired[SIGN_IN_UPSTREAM_ENV] !== undefined)
+            return;
+        for (const row of liveRows) {
+            if (row.key !== SIGN_IN_UPSTREAM_ENV || !row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+    }
     // ---- boule (#161) --------------------------------------------------------
     /**
      * `plan/diff.ts`'s `planBoule`: provisions the org's own Boule
@@ -5318,6 +5726,7 @@ export class FoundryStepExecutor {
         const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -5339,10 +5748,10 @@ export class FoundryStepExecutor {
             ...healthCheckSettings('/api/health', BOULE_PORT),
             ...(await this.routedLabels(name, bouleHostnameFor(org), BOULE_PORT)),
         });
-        const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
-            .filter((e) => !e.is_preview)
-            .map((e) => [e.key, e.value]));
+        const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
+        const liveEnv = new Map(liveRows.map((e) => [e.key, e.value]));
         const envChanged = bouleEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
+        await this.dropStaleSignInUpstream(app.appId, env, liveRows);
         const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
         const cookieSecret = await this.ensureAuthCookieSecret(app.appId);
         if (cookieSecret)
@@ -5416,6 +5825,8 @@ export class FoundryStepExecutor {
         if (action.desired.platformOwner === true) {
             context.recordScopeId(BOULE_SECRETS_RESTARTED_SCOPE_KEY, '1');
         }
+        // Last: the login-host step points the sign-in at this app's own address only once the env is running.
+        this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
     /**
@@ -5858,6 +6269,9 @@ export class FoundryStepExecutor {
             smtpSender: `noreply@${hn.mailDomain}`,
             defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,
+            // In-app sign-in: the company's own stack gets the second login app. Its host table starts
+            // empty; the login-host step writes it once the apps' clients exist.
+            ...(inAppSignIn(org) ? { signInLogin: { bindings: null } } : {}),
         });
         if (refChanged) {
             const now = scope.recordedIds();
@@ -6017,6 +6431,42 @@ export class FoundryStepExecutor {
         }
         return { resourceId: registered.id };
     }
+    /** The blue/green database route (`plan/remote-database.ts`). */
+    async remoteDatabaseRoute(action, org, context) {
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const desired = action.desired;
+        // The tunnel's TCP rule names the database by the host the apps' own `DATABASE_URL` uses.
+        const db = await this.ports.coolify.getDatabase(desired.database);
+        if (db.internal_db_url)
+            this.handledSecrets.add(db.internal_db_url);
+        let databaseHost = '';
+        try {
+            databaseHost = new URL(db.internal_db_url ?? '').hostname;
+        }
+        catch {
+            // Fixed text below: the URL holds the database password.
+        }
+        if (!databaseHost) {
+            throw new Error(`cloudflare:db-route for ${org.slug}: the database reports no usable address`);
+        }
+        await applyRemoteDatabase({
+            tunnels: this.tunnelPort(),
+            access: this.accessPort(),
+            dns: this.dnsPort(),
+            zones: this.zonePort(),
+            coolify: this.ports.coolify,
+            secret: (value) => void this.handledSecrets.add(value),
+        }, {
+            org,
+            desired,
+            databaseHost,
+            projectUuid,
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+        });
+        return {};
+    }
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     async deliverWithRetry(ref, value) {
         for (let attempt = 1; attempt <= JOBS_DELIVERY_ATTEMPTS; attempt++) {
@@ -6096,17 +6546,19 @@ export class FoundryStepExecutor {
         const loginHost = action.desired.loginHost ?? null;
         // A hosting entry's names (and its wildcard) go straight to its container on the company network:
         // the container carries `traefik.enable=false`, so the proxy has no route for it.
-        const entryOrigins = new Map(entryRoutes(org).map((r) => [r.hostname, r.service]));
+        const entryOrigins = new Map(entryRoutes(org, context.recordedIds()).map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
                 ? `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`
                 : (entryOrigins.get(hostname) ?? COOLIFY_PROXY_ORIGIN),
         }));
+        const httpIngress = [...ingress, { service: 'http_status:404' }];
         await this.tunnelPort().putTunnelConfig(tunnel.id, {
-            ingress: [...ingress, { service: 'http_status:404' }],
+            ingress: mergeTcpIngress(httpIngress, recordedTcpRoutes(context.recordedIds())),
         });
-        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org));
+        context.recordScopeId(TUNNEL_HTTP_INGRESS_SCOPE_KEY, JSON.stringify(httpIngress));
+        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org, context.recordedIds()));
         // #235: a connector for this org's own tunnel, the same call every
         // platform tunnel step already makes (Decided, William, 2026-10-01:
         // one connector per org tunnel, never a shared tunnel with appended
@@ -7873,8 +8325,32 @@ export class FoundryStepExecutor {
                     return;
                 }
                 case 'coolify:app':
+                case 'coolify:bg-app':
                     await this.ports.coolify.deleteApplication(target.id);
                     return;
+                case 'cloudflare:bg-access':
+                    await this.accessPort().deleteAccessApp(target.id);
+                    return;
+                case 'cloudflare:bg-token':
+                    await this.accessPort().removeServiceToken(target.id);
+                    return;
+                case 'cloudflare:bg-dns': {
+                    // `target.id` is the recorded route ({ hostname, service }); its name lives in the org's zone.
+                    const hostname = JSON.parse(target.id).hostname;
+                    const zone = org.domain ? await this.zonePort().findZoneByApex(org.domain) : undefined;
+                    if (typeof hostname !== 'string' || !zone)
+                        return;
+                    const dns = this.dnsPort();
+                    for (const record of await dns.findDnsRecord(zone.name, hostname, 'CNAME')) {
+                        if (record.content.endsWith('.cfargotunnel.com')) {
+                            await dns.deleteDnsRecord(zone.name, record.id);
+                        }
+                    }
+                    return;
+                }
+                case 'coolify:bg-database':
+                    await this.ports.coolify.deleteDatabase(target.id);
+                    return;
                 case 'coolify:database':
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;
@@ -7953,3 +8429,23 @@ export function isNotFoundError(error) {
     const message = error instanceof Error ? error.message : String(error);
     return /^\S+ \S+ \S+ → 404:/.test(message);
 }
+/** ZITADEL's error code for an update that changes nothing (`COMMAND-1m88i`, "No changes"). */
+const ZITADEL_NO_CHANGES_CODE = 'COMMAND-1m88i';
+/** True when ZITADEL refused an update because the value already is the wanted one. Matches the error code, never the free text. */
+export function isNoChangesError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes(ZITADEL_NO_CHANGES_CODE);
+}
+/**
+ * {@link ZitadelPort.updateOidcAppLoginBaseUri} that counts an app already holding the wanted base URI as
+ * done: ZITADEL answers that write with "No changes" and a repeat apply must not fail on it.
+ */
+export async function setOidcAppLoginBaseUri(zitadel, orgId, projectId, appId, loginBaseUri) {
+    try {
+        await zitadel.updateOidcAppLoginBaseUri(orgId, projectId, appId, loginBaseUri);
+    }
+    catch (error) {
+        if (!isNoChangesError(error))
+            throw error;
+    }
+}