@wtfalch/foundry 0.59.0 → 0.61.0

package/dist/plan/worker-app.d.ts

@@ -1,10 +1,13 @@
-import type { DeclaredOrg, HostingEntry } from '../org.js';
+import { type DeclaredOrg, type HostingEntry } from '../org.js';
 import { type WorkerAppConfig } from '../worker-app-config.js';
+import { WORKER_APP_DNS_RECORD, type WorkerAppContainer, type WorkerAppUpload, withCallTimeout, workerAppRegistryPrefix } from '../worker-app-upload.js';
 import type { DraftStep, StepAction } from './diff.js';
 import type { DnsPort } from './edge-dns.js';
 import type { ZonePort } from './edge-zones.js';
 import type { StepExecutionContext } from './plan-apply.js';
 import { type WorkerAppDatabaseDeps } from './worker-app-database.js';
+export type { WorkerAppBinding, WorkerAppContainer, WorkerAppMigrations, WorkerAppUpload, } from '../worker-app-upload.js';
+export { WORKER_APP_DNS_RECORD, withCallTimeout, workerAppRegistryPrefix };
 /**
  * ADR 0002: a hosting entry that declares `workerApp` runs as one Cloudflare
  * Worker with Durable Objects and Containers on the platform account. One step
@@ -46,11 +49,6 @@ export declare const WORKER_APP_ORG_HASH_LENGTH = 8;
 export declare const workerAppName: (org: DeclaredOrg, entry: HostingEntry) => string;
 /** The zone that holds the routes of an org with no domain of its own. */
 export declare const WORKER_APP_OIKOS_ZONE = "oikos.host";
-/** The record a Worker route needs on the org's own zone: Cloudflare's documented dummy, proxied. */
-export declare const WORKER_APP_DNS_RECORD: {
-    readonly type: "AAAA";
-    readonly content: "100::";
-};
 /** True once the Worker app holds the broker key (`authEnv` delivered it). */
 export declare const brokerKeyDelivered: (recorded: Readonly<Record<string, string>>, entryKey: string) => boolean;
 /**
@@ -69,57 +67,6 @@ export declare const WORKER_APP_AUTH_KEY_SECRET = "AUTH_APP_KEY";
  * and name are hashed: a held ref is at most 128 characters.
  */
 export declare const workerAppSecretRef: (orgId: string, entryKey: string, name: string) => string;
-export type WorkerAppBinding = {
-    type: 'durable_object_namespace';
-    name: string;
-    class_name: string;
-} | {
-    type: 'plain_text';
-    name: string;
-    text: string;
-} | {
-    type: 'hyperdrive';
-    name: string;
-    id: string;
-};
-export interface WorkerAppMigrations {
-    /** The tag the script holds now. Absent for a script with none. */
-    oldTag?: string;
-    newTag: string;
-    steps: {
-        newSqliteClasses?: string[];
-        deletedClasses?: string[];
-        renamedClasses?: {
-            from: string;
-            to: string;
-        }[];
-    }[];
-}
-export interface WorkerAppUpload {
-    name: string;
-    artifactUrl: string;
-    artifactSha256: string;
-    compatibilityDate: string;
-    compatibilityFlags: string[];
-    /** All of them: a redeploy replaces the list. Secrets survive a redeploy. */
-    bindings: WorkerAppBinding[];
-    /** Only the migrations not yet applied; absent when there are none. */
-    migrations?: WorkerAppMigrations;
-    /** Durable Object classes the upload marks container-enabled; absent when the entry declares no container. */
-    containers?: string[];
-    /** Workers Logs: always on, every request sampled. The adapter sends it as the upload metadata's `observability`. */
-    observability: {
-        enabled: true;
-        head_sampling_rate: 1;
-    };
-}
-export interface WorkerAppContainer {
-    className: string;
-    /** `<repository>@sha256:<digest>`. */
-    image: string;
-    instanceType: string;
-    maxInstances: number;
-}
 /**
  * The Cloudflare calls a Worker app needs. Edge 0.13.0 has none of the Durable
  * Object, migration or container calls, so no adapter ships with this port yet
@@ -208,6 +155,7 @@ export interface WorkerAppWant {
     /** `workerApp.database`: the Hyperdrive binding and the tables the runtime role may only append to, sorted. */
     database?: {
         appendOnly: string[];
+        grants?: string[];
         migrationsSha256?: string;
     };
     /** Secret names and where each comes from, sorted. */
@@ -218,7 +166,7 @@ export interface WorkerAppWant {
     }[];
 }
 /** The zone apex the entry's route lives in. */
-export declare const workerAppApex: (org: DeclaredOrg) => string;
+export declare const workerAppApex: (org: DeclaredOrg, entry?: HostingEntry) => string;
 /**
  * What the Worker must look like, or the inputs still missing (names only).
  * `issuer` is the sign-in issuer the plan read; `keysUrl` the custody Worker.
@@ -268,8 +216,6 @@ export interface WorkerAppPlanInput {
         accessReady: boolean;
     };
 }
-/** The registry prefix a container image of this platform must start with. */
-export declare const workerAppRegistryPrefix: (accountId: string) => string;
 /** Every entry key with a deployed or half-deployed Worker app recorded. */
 export declare function liveWorkerApps(orgId: string, recordedIds: Readonly<Record<string, string>>): Map<string, string>;
 /**
@@ -305,10 +251,6 @@ export interface WorkerAppDeps {
 /** An outside call that has not answered in this long fails the step; the next apply repairs it. */
 export declare const WORKER_APP_CALL_TIMEOUT_MS = 120000;
 export declare const WORKER_APP_KEYS_DELIVERY_ATTEMPTS = 3;
-/**
- * Races `task` against a timer. An error names the call and edge's error code, never the cause.
- */
-export declare function withCallTimeout<T>(ms: number, label: string, task: () => Promise<T>): Promise<T>;
 /**
  * Makes the Worker app true. Throws a fixed message on a failure, naming the
  * step and never a value or a provider's cause for anything that carried a
@@ -324,4 +266,3 @@ export declare function applyWorkerApp(deps: WorkerAppDeps, org: DeclaredOrg, ac
  * by org destroy.
  */
 export declare function teardownWorkerApp(deps: WorkerAppDeps, entryKey: string, scriptName: string | undefined, recorded: Readonly<Record<string, string>>, call: <T>(label: string, task: () => Promise<T>) => Promise<T>, orgId: string, context?: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null): Promise<void>;
-export {};

package/dist/plan/worker-app.js

@@ -1,11 +1,14 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { WORKER_APP_HYPERDRIVE_BINDING, WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
+import { APPS_DOMAIN } from '../org.js';
+import { WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
+import { WORKER_APP_DNS_RECORD, pendingWorkerAppMigrations, strayContainerImage, withCallTimeout, workerAppRegistryPrefix, workerAppShape, workerAppUpload, } from '../worker-app-upload.js';
 import { entryAuthEnv } from './broker-entries.js';
 import { workerAppHostname } from './hostnames.js';
+import { workspaceWorkerParent } from './workspace-worker.js';
 import { appStepKey } from './platform-diff.js';
 import { remoteDatabaseKeys } from './remote-database.js';
 import { applyWorkerAppDatabase, deleteWorkerAppDatabaseRoute, deleteWorkerAppHyperdrive, workerAppDbRouteMarkerScopeKey, workerAppHyperdriveScopeKey, workerAppMigrationsScopeKey, } from './worker-app-database.js';
-import { WORKER_COMPATIBILITY_DATE } from './worker.js';
+export { WORKER_APP_DNS_RECORD, withCallTimeout, workerAppRegistryPrefix };
 /**
  * ADR 0002: a hosting entry that declares `workerApp` runs as one Cloudflare
  * Worker with Durable Objects and Containers on the platform account. One step
@@ -60,14 +63,11 @@ export const workerAppTraceScopeKeys = (entryKey) => [
 export const workerAppResourceKey = (stepKey) => `cloudflare:worker-app:${stepKey}`;
 export const WORKER_APP_ORG_HASH_LENGTH = 8;
 /** `${8 hex of the org id's sha256}-${entry key}-app`. */
-export const workerAppName = (org, entry) => `${createHash('sha256').update(org.id).digest('hex').slice(0, WORKER_APP_ORG_HASH_LENGTH)}-${entry.key}-app`;
+export const workerAppName = (org, entry) => workspaceWorkerParent(entry) !== null
+    ? `${org.slug}-${workspaceWorkerParent(entry)}-work`
+    : `${createHash('sha256').update(org.id).digest('hex').slice(0, WORKER_APP_ORG_HASH_LENGTH)}-${entry.key}-app`;
 /** The zone that holds the routes of an org with no domain of its own. */
 export const WORKER_APP_OIKOS_ZONE = 'oikos.host';
-/** The record a Worker route needs on the org's own zone: Cloudflare's documented dummy, proxied. */
-export const WORKER_APP_DNS_RECORD = {
-    type: 'AAAA',
-    content: '100::',
-};
 /** True once the Worker app holds the broker key (`authEnv` delivered it). */
 export const brokerKeyDelivered = (recorded, entryKey) => Boolean(parseJson(recorded[workerAppSecretsScopeKey(entryKey)], {})
     .AUTH_APP_KEY);
@@ -107,7 +107,11 @@ export function custodyRenewalDue(recorded, entryKey, now) {
 }
 const sortedEntries = (record) => Object.entries(record ?? {}).sort(([a], [b]) => a.localeCompare(b));
 /** The zone apex the entry's route lives in. */
-export const workerAppApex = (org) => org.hosting.usesDomain && org.domain ? org.domain : WORKER_APP_OIKOS_ZONE;
+export const workerAppApex = (org, entry) => entry && workspaceWorkerParent(entry) !== null
+    ? APPS_DOMAIN
+    : org.hosting.usesDomain && org.domain
+        ? org.domain
+        : WORKER_APP_OIKOS_ZONE;
 /** True when the want has a secret that must be held (a generated one, the broker key, a custody credential). */
 const holdsGenerated = (want) => want.secrets.length > 0;
 /**
@@ -160,32 +164,25 @@ export function wantedWorkerApp(org, entry, recorded, input) {
     }
     if (missing.length > 0)
         return { missing };
+    const shape = workerAppShape(app);
     return {
         want: {
             name: workerAppName(org, entry),
-            artifactUrl: app.artifactUrl,
-            artifactSha256: app.artifactSha256,
-            compatibilityDate: app.compatibilityDate ?? WORKER_COMPATIBILITY_DATE,
-            compatibilityFlags: [...(app.compatibilityFlags ?? [])].sort(),
+            artifactUrl: shape.artifactUrl,
+            artifactSha256: shape.artifactSha256,
+            compatibilityDate: shape.compatibilityDate,
+            compatibilityFlags: shape.compatibilityFlags,
             host: workerAppHostname(org, entry),
-            apex: workerAppApex(org),
-            classes: Object.entries(app.durableObjects.classes)
-                .map(([binding, className]) => ({ binding, className }))
-                .sort((a, b) => a.binding.localeCompare(b.binding)),
-            migrations: app.durableObjects.migrations,
-            containers: (app.containers ?? [])
-                .map((c) => ({
-                className: c.className,
-                image: `${c.image.repository}@${c.image.digest}`,
-                instanceType: c.instanceType,
-                maxInstances: c.maxInstances,
-            }))
-                .sort((a, b) => a.className.localeCompare(b.className)),
+            apex: workerAppApex(org, entry),
+            classes: shape.classes,
+            migrations: shape.migrations,
+            containers: shape.containers,
             vars: sortedEntries(vars),
             ...(app.database
                 ? {
                     database: {
                         appendOnly: [...(app.database.appendOnly ?? [])].sort(),
+                        ...(app.database.grants?.length ? { grants: [...app.database.grants].sort() } : {}),
                         ...(app.database.migrationsSha256
                             ? { migrationsSha256: app.database.migrationsSha256 }
                             : {}),
@@ -222,8 +219,6 @@ export function migrationPrefixError(applied, declared) {
 }
 /** The unapplied migrations after the last tag in `applied`. */
 export const unappliedMigrations = (declared, applied) => declared.slice(applied.length);
-/** The registry prefix a container image of this platform must start with. */
-export const workerAppRegistryPrefix = (accountId) => `registry.cloudflare.com/${accountId}/`;
 /** Every entry key with a deployed or half-deployed Worker app recorded. */
 export function liveWorkerApps(orgId, recordedIds) {
     const mainPrefix = `cloudflare:worker-app:${orgId}:`;
@@ -327,9 +322,7 @@ export function planWorkerApps(org, recordedIds, input) {
             continue;
         }
         const { want } = wanted;
-        const stray = (app.containers ?? []).find((c) => input.registryAccountId === undefined ||
-            !c.image.repository.startsWith(workerAppRegistryPrefix(input.registryAccountId)) ||
-            c.image.repository.split('/').some((part) => /^\.+$/.test(part)));
+        const stray = strayContainerImage(app, input.registryAccountId);
         if (stray) {
             block(input.registryAccountId === undefined
                 ? 'the host supplies no Cloudflare account id for the container registry'
@@ -399,31 +392,6 @@ export function planWorkerApps(org, recordedIds, input) {
 /** An outside call that has not answered in this long fails the step; the next apply repairs it. */
 export const WORKER_APP_CALL_TIMEOUT_MS = 120_000;
 export const WORKER_APP_KEYS_DELIVERY_ATTEMPTS = 3;
-/**
- * Races `task` against a timer. An error names the call and edge's error code, never the cause.
- */
-export function withCallTimeout(ms, label, task) {
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => reject(new Error(`${label}: no answer within ${ms} ms`)), ms);
-        task().then((value) => {
-            clearTimeout(timer);
-            resolve(value);
-        }, (error) => {
-            clearTimeout(timer);
-            // The cause is dropped: a provider error can echo a request body. The
-            // HTTP status stays, because callers tell "already gone" by it. So does
-            // edge's error code (a fixed lower-case enum, never a secret), to say why.
-            const { status, code } = (error ?? {});
-            const known = typeof code === 'string' && /^[a-z_]{1,40}$/.test(code) ? code : undefined;
-            const failure = new Error(known ? `${label} failed (${known})` : `${label} failed`);
-            if (typeof status === 'number')
-                failure.status = status;
-            if (known)
-                failure.code = known;
-            reject(failure);
-        });
-    });
-}
 const isGone = (error) => {
     const status = error?.status;
     return typeof status === 'number' && status === 404;
@@ -480,58 +448,14 @@ export async function applyWorkerApp(deps, org, action, context) {
     const recordedTags = parseJson(recorded0[workerAppTagsScopeKey(entryKey)], []);
     // The live tag is the fact; the record can be behind it after a crash between upload and record.
     const liveTag = await call('read the migration tag', () => workers.liveMigrationTag(want.name));
-    let appliedCount;
-    if (liveTag === undefined)
-        appliedCount = 0;
-    else {
-        const index = declaredTags.indexOf(liveTag);
-        if (index < 0) {
-            throw new Error(`${at}: the live Worker holds migration '${liveTag}', which is not in the declared list; migrations are append-only and foundry will not guess`);
-        }
-        appliedCount = index + 1;
-    }
+    const pending = pendingWorkerAppMigrations(want.migrations, liveTag);
+    if (!pending.ok)
+        throw new Error(`${at}: ${pending.reason}`);
     const recordedError = migrationPrefixError(recordedTags, declaredTags);
     if (recordedError)
         throw new Error(`${at}: ${recordedError}`);
-    const pending = want.migrations.slice(appliedCount);
-    const migrations = pending.length > 0
-        ? {
-            ...(liveTag !== undefined ? { oldTag: liveTag } : {}),
-            newTag: pending[pending.length - 1]?.tag,
-            steps: pending.map((m) => ({
-                ...(m.newSqliteClasses ? { newSqliteClasses: m.newSqliteClasses } : {}),
-                ...(m.deletedClasses ? { deletedClasses: m.deletedClasses } : {}),
-                ...(m.renamedClasses ? { renamedClasses: m.renamedClasses } : {}),
-            })),
-        }
-        : undefined;
-    await call('upload the script', () => workers.uploadWorkerApp({
-        name: want.name,
-        artifactUrl: want.artifactUrl,
-        artifactSha256: want.artifactSha256,
-        compatibilityDate: want.compatibilityDate,
-        compatibilityFlags: want.compatibilityFlags,
-        bindings: [
-            ...want.classes.map((c) => ({
-                type: 'durable_object_namespace',
-                name: c.binding,
-                class_name: c.className,
-            })),
-            ...want.vars.map(([name, text]) => ({
-                type: 'plain_text',
-                name,
-                text,
-            })),
-            ...(hyperdriveId
-                ? [{ type: 'hyperdrive', name: WORKER_APP_HYPERDRIVE_BINDING, id: hyperdriveId }]
-                : []),
-        ],
-        observability: { enabled: true, head_sampling_rate: 1 },
-        ...(migrations ? { migrations } : {}),
-        ...(want.containers.length > 0
-            ? { containers: want.containers.map((c) => c.className) }
-            : {}),
-    }));
+    const migrations = pending.migrations;
+    await call('upload the script', () => workers.uploadWorkerApp(workerAppUpload(want.name, want, want.vars, migrations, hyperdriveId)));
     context.recordScopeId(workerAppTagsScopeKey(entryKey), JSON.stringify(declaredTags));
     await context.persistScopeIds();
     // A Worker that no longer declares a database no longer binds its config: delete it now.

package/dist/plan/worker.d.ts

@@ -1,4 +1,5 @@
 import type { DeclaredOrg, HostingEntry, WorkerConfig } from '../org.js';
+import { WORKER_COMPATIBILITY_DATE } from '../worker-app-upload.js';
 import type { DraftStep } from './diff.js';
 /**
  * F8 (#318): one plain Cloudflare Worker per hosting entry that declares
@@ -91,7 +92,7 @@ export declare const workerName: (org: DeclaredOrg, entry: HostingEntry) => stri
  * like {@link RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS} is a fixed Cloudflare
  * Free plan value rather than something an org declares.
  */
-export declare const WORKER_COMPATIBILITY_DATE = "2026-09-12";
+export { WORKER_COMPATIBILITY_DATE };
 export type WorkerMode = 'apply' | 'retire';
 export interface WorkerWant {
     name: string;
@@ -131,4 +132,3 @@ export declare function planWorkers(org: DeclaredOrg, recordedIds: Readonly<Reco
     steps: DraftStep[];
     blocked: Blocked;
 };
-export {};

package/dist/plan/worker.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { WORKER_COMPATIBILITY_DATE } from '../worker-app-upload.js';
 import { entryHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { appStepKey } from './platform-diff.js';
@@ -123,7 +124,7 @@ export const workerName = (org, entry) =>
  * like {@link RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS} is a fixed Cloudflare
  * Free plan value rather than something an org declares.
  */
-export const WORKER_COMPATIBILITY_DATE = '2026-09-12';
+export { WORKER_COMPATIBILITY_DATE };
 /**
  * With a wildcard route (`*.<domain>/*`) the Worker would also capture every
  * hostname foundry provisions on the domain, so each gets a no-Worker route

package/dist/plan/workspace-client.d.ts

@@ -0,0 +1,25 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+/** The name of an entry's workspace client and of the key its workspace broker entry is held under. */
+export declare const workspaceClientKey: (entryKey: string) => string;
+/** The company's ZITADEL organisation for the customers of its workspaces. The space keeps it apart from every slug. */
+export declare const testCustomersOrgName: (slug: string) => string;
+/** The recorded id of that organisation (the step's `system:kind:key`). */
+export declare const testCustomersOrgKey: (orgId: string) => string;
+/** `'1'` or `'0'`: whether the test customers organisation was last left open to self-registration. */
+export declare const TEST_CUSTOMERS_SIGN_UP_SCOPE_KEY = "test_customers_sign_up";
+/** `'email-code'` once the emailed-code metadata was written to the test customers organisation. */
+export declare const TEST_CUSTOMERS_SIGN_IN_SCOPE_KEY = "test_customers_sign_in";
+/** The server entries whose workspace has its own sign-in: a workspace and `uses.auth`. */
+export declare function workspaceAuthEntries(org: DeclaredOrg): HostingEntry[];
+/** The entry whose workspace client is named `clientKey`, or `undefined`. */
+export declare const workspaceAuthEntryOf: (org: DeclaredOrg, clientKey: string) => HostingEntry | undefined;
+/** The entries whose workspace signs in the test customers organisation. */
+export declare const testCustomersEntries: (org: DeclaredOrg) => HostingEntry[];
+/** The addresses a workspace client signs in at: the workspace host. */
+export declare const workspaceClientHosts: (org: DeclaredOrg, entry: HostingEntry) => string[];
+/**
+ * `org` (planned without its dark entries) plus the sign-in-only shape of the dark entries whose workspace has
+ * sign-in, so the login host's lists of customers clients match what the executor, which reads the org as
+ * declared, writes. The copies have no address and no Worker.
+ */
+export declare function withDarkWorkspaceSignIn(org: DeclaredOrg, declared: DeclaredOrg): DeclaredOrg;

package/dist/plan/workspace-client.js

@@ -0,0 +1,48 @@
+import { workspaceHost } from './hostnames.js';
+/**
+ * What the sign-in of a server workspace is called, shared by the planners that must agree on it. A workspace of
+ * an entry with `uses.auth` signs in with its own ZITADEL client named `<entry key>-work`, and its customers
+ * sign in a separate "<slug> test customers" organisation, never the live customers one.
+ */
+/** The suffix of the client, broker entry and held key that belong to an entry's workspace. */
+const WORKSPACE_CLIENT_SUFFIX = '-work';
+/** The name of an entry's workspace client and of the key its workspace broker entry is held under. */
+export const workspaceClientKey = (entryKey) => `${entryKey}${WORKSPACE_CLIENT_SUFFIX}`;
+/** The company's ZITADEL organisation for the customers of its workspaces. The space keeps it apart from every slug. */
+export const testCustomersOrgName = (slug) => `${slug} test customers`;
+/** The recorded id of that organisation (the step's `system:kind:key`). */
+export const testCustomersOrgKey = (orgId) => `zitadel:customers-test:${orgId}`;
+/** `'1'` or `'0'`: whether the test customers organisation was last left open to self-registration. */
+export const TEST_CUSTOMERS_SIGN_UP_SCOPE_KEY = 'test_customers_sign_up';
+/** `'email-code'` once the emailed-code metadata was written to the test customers organisation. */
+export const TEST_CUSTOMERS_SIGN_IN_SCOPE_KEY = 'test_customers_sign_in';
+/** The server entries whose workspace has its own sign-in: a workspace and `uses.auth`. */
+export function workspaceAuthEntries(org) {
+    if (!org.hosting.enabled)
+        return [];
+    return org.hosting.entries.filter((entry) => entry.workspace !== undefined &&
+        entry.workerApp === undefined &&
+        entry.uses?.auth !== undefined);
+}
+/** The entry whose workspace client is named `clientKey`, or `undefined`. */
+export const workspaceAuthEntryOf = (org, clientKey) => workspaceAuthEntries(org).find((entry) => workspaceClientKey(entry.key) === clientKey);
+/** The entries whose workspace signs in the test customers organisation. */
+export const testCustomersEntries = (org) => workspaceAuthEntries(org).filter((entry) => entry.uses?.auth?.users === 'customers');
+/** The addresses a workspace client signs in at: the workspace host. */
+export const workspaceClientHosts = (org, entry) => [
+    workspaceHost(org.slug, entry.key),
+];
+/**
+ * `org` (planned without its dark entries) plus the sign-in-only shape of the dark entries whose workspace has
+ * sign-in, so the login host's lists of customers clients match what the executor, which reads the org as
+ * declared, writes. The copies have no address and no Worker.
+ */
+export function withDarkWorkspaceSignIn(org, declared) {
+    const present = new Set(org.hosting.entries.map((entry) => entry.key));
+    const dark = workspaceAuthEntries(declared)
+        .filter((entry) => !present.has(entry.key))
+        .map((entry) => ({ ...entry, hostnames: [], gates: [] }));
+    if (dark.length === 0)
+        return org;
+    return { ...org, hosting: { ...org.hosting, entries: [...org.hosting.entries, ...dark] } };
+}

package/dist/plan/workspace-sign-in.d.ts

@@ -0,0 +1,55 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+import type { UnmanagedItem } from '../plan.js';
+import { type BrokerEntryInput, type BrokerEntryWant } from './broker-entries.js';
+import type { DraftStep } from './diff.js';
+import type { LiveResource } from './live.js';
+/** The step `coolify:workspace-broker-entry` and its action key, for the planner and the executor to share. */
+export declare const WORKSPACE_BROKER_ENTRY_KIND = "workspace-broker-entry";
+/**
+ * The MCP resource of a workspace with `uses.auth.mcp`: its own endpoint on the workspace host, its own audience
+ * project in the test customers organisation (recorded by `zitadel:mcp-project` under the client's name), and the
+ * onboarding page on the workspace host. `null` without `mcp` or until the project is recorded.
+ */
+export declare function workspaceMcp(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>): {
+    resource: string;
+    projectId: string;
+    loginHost: string;
+    onboardingUrl?: string;
+} | null;
+/**
+ * What the app's env says about who signs in at the workspace, as recorded so far, or `null` until the
+ * organisation, client and issuer are all known. Non-secret values only.
+ */
+export declare function workspaceAuthEnv(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>, issuer: string | null): Record<string, string> | null;
+/**
+ * The client ids of the company's live apps: every recorded client id except the workspaces' own. A stage that
+ * holds one of them could sign in as the live app.
+ */
+export declare function liveClientIds(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string[];
+/** What `ws.<key>.signin` records: the sign-in env above as JSON, or `null` while it is not all known. */
+export declare function workspaceSignInMarker(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>, issuer: string | null): string | null;
+/**
+ * The test customers organisation, planned once an entry's workspace signs in customers. Sign-up and the emailed
+ * code follow what the company declares for its live customers (`customers.signUp`, the entries' `signIn`), so
+ * testers meet the same sign-in the customers will. Idempotent on the recorded id and the two markers.
+ */
+export declare function planTestCustomers(org: DeclaredOrg, live: readonly LiveResource[], claimed: Set<string>, recordedIds: Readonly<Record<string, string>>, metadataWired: boolean): {
+    step: DraftStep | null;
+    blocked: UnmanagedItem[];
+};
+/** One ZITADEL web client `<key>-work` per workspace with sign-in, planned once; its redirect addresses name the workspace host. */
+export declare function planWorkspaceClients(org: DeclaredOrg, byKey: ReadonlyMap<string, LiveResource>, claimed: Set<string>): DraftStep[];
+/** What a workspace broker entry must say, without its keys, or what is still missing. */
+export declare function wantedWorkspaceBrokerEntry(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>): {
+    want: BrokerEntryWant;
+} | {
+    missing: BrokerEntryInput[];
+};
+/**
+ * One broker `AUTH_APPS` entry per workspace with sign-in, written after the workspace step has put the stage's
+ * `AUTH_APP_KEY` in its env. Idempotent on the recorded marker of what the last write said.
+ */
+export declare function planWorkspaceBrokerEntries(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], brokerWired: boolean, brokerWorkspacesDatabase: boolean, stageReady: (entry: HostingEntry) => boolean): {
+    steps: DraftStep[];
+    blocked: UnmanagedItem[];
+};