@wtfalch/foundry 0.60.0 → 0.61.0

package/dist/plan/platform-diff.js

@@ -899,6 +899,11 @@ export function resolveAppEnv(org, entry, recorded, available = { sharedSecret:
         else if (typeof declared !== 'string')
             unresolved.push([name, declared.from]);
     }
+    // F13: the entry's customer-grants credential is held and written by the app step. The marker names it,
+    // never its value, so adding or removing the flag replans the step.
+    if (entry.uses?.customerGrants && available.sharedSecret) {
+        marker.CUSTOMER_GRANTS_CREDENTIAL = 'secret:customerGrants';
+    }
     return { values, unresolved, secrets, unresolvedSecrets, heldSecrets, unresolvedHeld, marker };
 }
 /**
@@ -1720,8 +1725,8 @@ export const JOBS_SCHEDULER_KEY = 'jobs';
 /**
  * The scheduler's address on the Coolify network (`http://<custom_internal_name>:8080`),
  * the value the org steps' jobs port and Archon's `JOBS_URL` are read from.
- * Not a secret. The scheduler's public hostname has no tunnel and no DNS
- * record, so nothing on the platform can reach it there.
+ * Not a secret. Only containers on that network reach it; an entry's app uses
+ * the owner company's public origin `JOBS_PUBLIC_URL_SCOPE_KEY` (`own-jobs-route.ts`) instead.
  */
 export const JOBS_INTERNAL_URL_SCOPE_KEY = 'jobs_internal_url';
 /**

package/dist/plan/platform-org.d.ts

@@ -1,6 +1,7 @@
 import { type DeclaredOrg, type VersionPin } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import { type AgoraHostValues } from './agora.js';
+import type { RepoKeyProbe } from './entry-repo-key.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -80,6 +81,12 @@ export interface OrgPlatformReadiness {
      * gets as `AI_URL`. `null` or absent until the platform has applied the AI host.
      */
     aiUrl?: string | null;
+    /**
+     * The public origin of the jobs scheduler an entry with `uses.jobs` registers on, which it gets as
+     * `JOBS_SCHEDULER_URL`. A company on shared services reads the owner company's (`ownerJobsPublicUrl`); a
+     * company that runs its own services reads its own. `null` or absent until that route is recorded.
+     */
+    jobsPublicUrl?: string | null;
     /**
      * The shared calls SFU (#170) an org's own calls Matrix stack depends on.
      * Declared is enough here: `platform-diff.ts`'s `planSfu` plans the step
@@ -187,6 +194,24 @@ export interface OrgPlatformReadiness {
         unreadable?: readonly string[];
         invalid?: readonly string[];
     };
+    /**
+     * The platform GitHub App's held keys (`PLATFORM_GITHUB_APP_REFS`), read only for a company that declares
+     * `hosting.github`. `store` is false when the host wired no held-keys reader; `missing` are the refs that hold
+     * no value now. Refs only, never a value. Absent reads as no store.
+     */
+    githubAppKeys?: {
+        store: boolean;
+        missing: readonly string[];
+    };
+    /**
+     * F12: what GitHub said about the repo of each entry that declares `uses.repo` (or has a key to remove), by
+     * entry key. `store` is false when the host wired no GitHub deploy-key client. Lines only, never a credential.
+     * Absent for an org with neither.
+     */
+    repoKeys?: {
+        store: boolean;
+        probes: Readonly<Record<string, RepoKeyProbe>>;
+    };
     /**
      * True when the host wired no held-keys reader, so no key could be checked.
      * A missing key is then reported as "no reader given" instead of "not held".
@@ -277,6 +302,11 @@ export declare const OWN_FILES_RUNNER_SCOPE_KEY = "coolify_platform_files_runner
  * `base`. Any other org gets `base` back unchanged.
  */
 export declare function orgPlatformReadinessFor(org: DeclaredOrg, base: OrgPlatformReadiness, orgRecordedIds: Readonly<Record<string, string>>, heldRefs: ReadonlySet<string>): OrgPlatformReadiness;
+/**
+ * The public origin of the owner company's jobs scheduler, which a company on shared services registers its
+ * entries on: what the owner's `coolify:own-jobs-route` step recorded, or `undefined` before it ran.
+ */
+export declare function ownerJobsPublicUrl(ownerRecordedIds: Readonly<Record<string, string>> | undefined): string | undefined;
 /** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
 export declare function heldOwnKeyRefs(heldKeys: HeldKeyResolver, org: Pick<DeclaredOrg, 'slug'>): Promise<Set<string>>;
 /** {@link agoraHostValuesFromPlatform}'s counterpart for an own org: every value is the org's own, null until recorded. */

package/dist/plan/platform-org.js

@@ -6,6 +6,7 @@ import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { oikosIngressApplied } from './oikos-ingress.js';
 import { ownHostnames } from './own-hostnames.js';
+import { JOBS_PUBLIC_URL_SCOPE_KEY } from './own-jobs-route.js';
 import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
@@ -223,7 +224,8 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
         ai: base.missingKeys.ai,
         jobs: missing(jobsApplied, refs.jobsAdminToken),
     };
-    const { jobsUrlMissing: _shared, ...rest } = base;
+    const { jobsUrlMissing: _shared, jobsPublicUrl: _sharedRoute, ...rest } = base;
+    const ownJobsUrl = orgRecordedIds[JOBS_PUBLIC_URL_SCOPE_KEY];
     return {
         ...rest,
         authReady,
@@ -232,6 +234,7 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
         filesUrl: filesApplied ? (filesUrl ?? null) : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
         ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),
+        ...(jobsApplied && ownJobsUrl ? { jobsPublicUrl: ownJobsUrl } : {}),
         callsReady: ownStepRecorded(orgRecordedIds, org, 'own-sfu'),
         // The MX name is the shared relay's, `mx.<platform apex>`: no platform mail step is needed.
         // The apex is the company's mail zone: its domain when mail runs on it, else oikos.host.
@@ -244,6 +247,14 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
         missingKeys,
     };
 }
+/**
+ * The public origin of the owner company's jobs scheduler, which a company on shared services registers its
+ * entries on: what the owner's `coolify:own-jobs-route` step recorded, or `undefined` before it ran.
+ */
+export function ownerJobsPublicUrl(ownerRecordedIds) {
+    const url = ownerRecordedIds?.[JOBS_PUBLIC_URL_SCOPE_KEY];
+    return url?.startsWith('https://') ? url : undefined;
+}
 /** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
 export async function heldOwnKeyRefs(heldKeys, org) {
     const held = new Set();

package/dist/plan/platform-providers.d.ts

@@ -496,6 +496,8 @@ export interface JobsHostInput {
 export declare function provisionJobsHost(scope: StepScope, deps: JobsHostDeps, target: ServiceTarget, input: JobsHostInput): Promise<{
     resourceId?: string;
 }>;
+/** The Coolify project of the platform's sign-in stack, the broker included. */
+export declare const PLATFORM_AUTH_PROJECT = "platform";
 /**
  * Fixed `custom_internal_name`s (`diff.ts`'s `coolifyCalls` sets the same
  * kind of name on Synapse/MAS) so the Cloudflare tunnel below can address

package/dist/plan/platform-providers.js

@@ -5,7 +5,7 @@ import { VERSIONS, coolifyImageFor, floatingTagBlocked, pinnedRef } from '../boo
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { applyArchonBlueGreen } from './archon-blue-green.js';
-import { ARCHON_REPO, archonSubject, healthTokenName, tunnelOriginFor, } from './blue-green.js';
+import { ARCHON_REPO, archonSubject, healthTokenName, pinKeyName, tunnelOriginFor, } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
 import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
@@ -215,6 +215,8 @@ export class FoundryPlatformStepExecutor {
             coolify: archon.coolify,
             healthToken: async () => (await archon.heldKeys?.resolve(sharedSecretRef(platform.ownerOrgId, healthTokenName(subject.id)))) ?? null,
             secret: (value) => archon.runtime?.onSecret?.(value),
+            pinRef: sharedSecretRef(platform.ownerOrgId, pinKeyName(subject.id)),
+            ...(archon.heldKeys ? { heldKeys: archon.heldKeys } : {}),
             primaryUuid,
             primaryBlueAppId,
             runtime: this.runtime,
@@ -1272,7 +1274,8 @@ export async function provisionJobsHost(scope, deps, target, input) {
 // ---------------------------------------------------------------------------
 // #168: the platform's own sign-in (ZITADEL)
 // ---------------------------------------------------------------------------
-const PLATFORM_AUTH_PROJECT = 'platform';
+/** The Coolify project of the platform's sign-in stack, the broker included. */
+export const PLATFORM_AUTH_PROJECT = 'platform';
 /**
  * Fixed `custom_internal_name`s (`diff.ts`'s `coolifyCalls` sets the same
  * kind of name on Synapse/MAS) so the Cloudflare tunnel below can address
@@ -4027,6 +4030,8 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'org-apps', path: '/api/orgs/*/apps' },
     { name: 'org-requests', path: '/api/orgs/*/requests' },
     { name: 'github-releases', path: '/api/github/releases' },
+    { name: 'github-install-callback', path: '/api/github/install/callback' },
+    { name: 'org-github', path: '/api/orgs/*/github' },
 ];
 const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
 const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;

package/dist/plan/post-logout-uris.js

@@ -1,6 +1,7 @@
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { appHostname, cmsStudioHostnameFor, entryHostnames } from './hostnames.js';
+import { workspaceAuthEntryOf, workspaceClientHosts } from './workspace-client.js';
 /** The page `@wtfalch/auth` apps land on after ZITADEL ends the session. */
 export const SIGNED_OUT_PATH = '/auth/signed-out';
 /** Both landing addresses of a host: its root and its signed-out page. */
@@ -31,7 +32,12 @@ export function zitadelAppPostLogoutAppliedScopeKey(appKey) {
  */
 export function companyAppPostLogoutUris(org, appKey) {
     const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
-    const hosts = authEntry ? entryHostnames(org, authEntry) : null;
+    const workspaceEntry = authEntry ? undefined : workspaceAuthEntryOf(org, appKey);
+    const hosts = authEntry
+        ? entryHostnames(org, authEntry)
+        : workspaceEntry
+            ? workspaceClientHosts(org, workspaceEntry)
+            : null;
     if (appKey === 'agora')
         return [`https://${agoraHostnameFor(org)}/`];
     const hostname = appKey === 'cms' && org.site.enabled

package/dist/plan/private-pages.d.ts

@@ -0,0 +1,26 @@
+import { type DeclaredOrg, type PrivatePage } from '../org.js';
+/**
+ * Private pages (`HostingEntry.privatePages`): a path of an app that only the company's people may open. Each is
+ * a path-scoped Cloudflare Access application (`<host><path>`, a self-hosted app whose domain carries a path)
+ * made by `planGates` like any other gate, with the company sign-in claim, over the entry's live hosts (`pp-`)
+ * and over its workspace host (`wp-`). Cloudflare applies the most specific application, so the page's gate
+ * wins over the workspace's whole-host gate, and a tester who may open the workspace is refused here.
+ *
+ * Foundry cannot turn a role into people: `roles` are the company's role ids, and the host that declares the
+ * org puts the email addresses of the people holding them in `people`. The gate admits the owners and those.
+ */
+export type PrivatePageScope = 'live' | 'workspace';
+/** The gate key of one private page: a hash of the scope, entry key and path, so it fits a DNS label, never clashes with `ws-<key>` or a declared gate key, and needs no escaping. */
+export declare function privatePageGateKey(scope: PrivatePageScope, entryKey: string, path: string): string;
+/** Who passes a private page: the owners and the page's `people`, lowercased, distinct, sorted. */
+export declare function privatePagePeople(org: Pick<DeclaredOrg, 'owners'>, page: PrivatePage): string[];
+export interface PrivatePageGate {
+    entry: string;
+    hostnames: string[];
+    people: string[];
+}
+/**
+ * The private page gates by key: the live ones from `org` (an entry that is not live has no live host) and the
+ * workspace ones from `declared` (the org with its dark entries).
+ */
+export declare function privatePageGates(org: DeclaredOrg, declared: DeclaredOrg): Map<string, PrivatePageGate>;

package/dist/plan/private-pages.js

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+import { normalizeTesters } from '../org.js';
+import { entryHostnames, workspaceHost } from './hostnames.js';
+import { companyPeople, workspaceEntries } from './workspace.js';
+/** The gate key of one private page: a hash of the scope, entry key and path, so it fits a DNS label, never clashes with `ws-<key>` or a declared gate key, and needs no escaping. */
+export function privatePageGateKey(scope, entryKey, path) {
+    const hash = createHash('sha256').update(`${scope}\0${entryKey}\0${path}`).digest('hex');
+    return `${scope === 'live' ? 'pp' : 'wp'}-${hash.slice(0, 16)}`;
+}
+/** Who passes a private page: the owners and the page's `people`, lowercased, distinct, sorted. */
+export function privatePagePeople(org, page) {
+    return normalizeTesters([...companyPeople(org), ...(page.people ?? [])]).sort();
+}
+/**
+ * The private page gates by key: the live ones from `org` (an entry that is not live has no live host) and the
+ * workspace ones from `declared` (the org with its dark entries).
+ */
+export function privatePageGates(org, declared) {
+    const gates = new Map();
+    if (!org.hosting.enabled)
+        return gates;
+    const add = (scope, entry, hosts) => {
+        if (hosts.length === 0)
+            return;
+        for (const page of entry.privatePages ?? []) {
+            gates.set(privatePageGateKey(scope, entry.key, page.path), {
+                entry: entry.key,
+                hostnames: hosts.map((host) => `${host}${page.path}`).sort(),
+                people: privatePagePeople(declared, page),
+            });
+        }
+    };
+    for (const entry of org.hosting.entries)
+        add('live', entry, entryHostnames(org, entry));
+    for (const entry of workspaceEntries(declared)) {
+        add('workspace', entry, [workspaceHost(declared.slug, entry.key)]);
+    }
+    return gates;
+}

package/dist/plan/proxy-labels.d.ts

@@ -26,6 +26,8 @@ export declare const CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY = "cloudflare_tunn
  * last written for, comma-joined. Recorded only once every record is in place.
  */
 export declare const CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY = "cloudflare_tunnel_oikos_hostnames";
+/** The same for the entry names in the platform's companyincluded.app zone ({@link entryAppsHostnames}). */
+export declare const CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY = "cloudflare_tunnel_apps_hostnames";
 /**
  * The run label every customer hosting-entry container gets. A run label overrides the image's own
  * `LABEL` of the same key, so Traefik ignores the container whatever its image says: a customer image
@@ -92,9 +94,18 @@ export declare function sameLabelSets(a: string, b: string): boolean;
  * The entry names that live in the platform's `oikos.host` zone (a company with no domain of its own, or with
  * `usesDomain` off): the names the company's tunnel gets a proxied CNAME for. Sorted.
  */
-export declare function entryOikosHostnames(org: DeclaredOrg): string[];
+export declare function entryOikosHostnames(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): string[];
 /**
  * Whether `name` is one the company may write in the platform's `oikos.host` zone: exactly its own
  * `<slug>.oikos.host`. A company writes no other company's name, whatever an entry declares.
  */
 export declare function ownsOikosName(org: DeclaredOrg, name: string): boolean;
+/**
+ * The entry names that live in the platform's `companyincluded.app` zone: an entry's `hostedName`, and the
+ * workspace host of each server workspace that is applied. Sorted.
+ */
+export declare function entryAppsHostnames(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): string[];
+/** Whether `name` is one this org may write in the `companyincluded.app` zone: a hosted name or its workspace host. */
+export declare const ownsAppsZoneName: (org: DeclaredOrg, name: string) => boolean;
+/** Whether `name` is one label directly under `companyincluded.app`. */
+export declare function isAppsEntryName(name: string): boolean;

package/dist/plan/proxy-labels.js

@@ -1,8 +1,10 @@
 import { createHash } from 'node:crypto';
+import { APPS_DOMAIN } from '../org.js';
 import { BUILTIN_APPS, PRIMARY_SERVER_SCOPE_KEY, balancerApplied, builtinSubject, lbAppName, lbOrigin, liveAppNameFor, } from './blue-green.js';
 import { entryHostnames, wildcardHostname } from './hostnames.js';
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
 import { appNameFor } from './platform-diff.js';
+import { ownsWorkspaceName, workspaceRoutes } from './workspace.js';
 /**
  * The label every routed container carries, with the install's token as its value. Traefik is told
  * (`--providers.docker.constraints=Label(`foundry.edge`,`<token>`)`) to route only containers that carry
@@ -29,6 +31,8 @@ export const CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY = 'cloudflare_tunnel_entry
  * last written for, comma-joined. Recorded only once every record is in place.
  */
 export const CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY = 'cloudflare_tunnel_oikos_hostnames';
+/** The same for the entry names in the platform's companyincluded.app zone ({@link entryAppsHostnames}). */
+export const CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY = 'cloudflare_tunnel_apps_hostnames';
 /**
  * The run label every customer hosting-entry container gets. A run label overrides the image's own
  * `LABEL` of the same key, so Traefik ignores the container whatever its image says: a customer image
@@ -65,6 +69,8 @@ export function entryRoutes(org, recorded = {}) {
     for (const entry of org.hosting.entries) {
         if (entry.workerApp)
             continue; // Served by its Worker route, not the tunnel.
+        if (entry.live === false)
+            continue; // Only its workspace exists (below).
         // A blue/green entry is reached through its balancer, which each server's connector finds on its own
         // network, once the balancer exists on the primary. Until then it keeps the origin it had.
         const target = !entry.blueGreen
@@ -81,6 +87,10 @@ export function entryRoutes(org, recorded = {}) {
         if (wildcardName && !wildcard)
             wildcard = { hostname: wildcardName, service };
     }
+    for (const route of workspaceRoutes(org, recorded)) {
+        if (!routes.some((r) => r.hostname === route.hostname))
+            routes.push(route);
+    }
     if (wildcard)
         routes.push(wildcard);
     return routes;
@@ -171,8 +181,8 @@ export function sameLabelSets(a, b) {
  * The entry names that live in the platform's `oikos.host` zone (a company with no domain of its own, or with
  * `usesDomain` off): the names the company's tunnel gets a proxied CNAME for. Sorted.
  */
-export function entryOikosHostnames(org) {
-    return entryRoutes(org)
+export function entryOikosHostnames(org, recorded = {}) {
+    return entryRoutes(org, recorded)
         .map((r) => r.hostname)
         .filter((h) => h.endsWith(`.${NO_DOMAIN_ZONE}`))
         .sort();
@@ -184,3 +194,23 @@ export function entryOikosHostnames(org) {
 export function ownsOikosName(org, name) {
     return name.toLowerCase() === `${org.slug}.${NO_DOMAIN_ZONE}`;
 }
+/**
+ * The entry names that live in the platform's `companyincluded.app` zone: an entry's `hostedName`, and the
+ * workspace host of each server workspace that is applied. Sorted.
+ */
+export function entryAppsHostnames(org, recorded = {}) {
+    return entryRoutes(org, recorded)
+        .map((r) => r.hostname)
+        .filter((name) => isAppsEntryName(name) || ownsWorkspaceName(org, name))
+        .sort();
+}
+/** Whether `name` is one this org may write in the `companyincluded.app` zone: a hosted name or its workspace host. */
+export const ownsAppsZoneName = (org, name) => isAppsEntryName(name) || ownsWorkspaceName(org, name);
+/** Whether `name` is one label directly under `companyincluded.app`. */
+export function isAppsEntryName(name) {
+    const suffix = `.${APPS_DOMAIN}`;
+    const lower = name.toLowerCase();
+    return (lower.endsWith(suffix) &&
+        lower.length > suffix.length &&
+        !lower.slice(0, -suffix.length).includes('.'));
+}

package/dist/plan/release-host.d.ts

@@ -1,6 +1,6 @@
 import { type ReleaseDeps } from '../release/run.js';
 import type { ReleaseStore } from '../release/state.js';
-import { type BlueGreenSubject } from './blue-green.js';
+import { type BlueGreenSubject, type PinHeldKeys } from './blue-green.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import type { CoolifyPort } from './executor.js';
 /** The recorded ids a release run reads and writes: an org's apply context, or the platform's. */
@@ -21,13 +21,17 @@ export interface ReleaseHost {
 export interface ReleaseHostInput {
     subject: BlueGreenSubject;
     context: ReleaseContext;
-    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
+    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
         listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
     };
     /** Reads the entry's health token (`sharedSecretRef(org.id, healthTokenName(id))`). Never mints. */
     healthToken: () => Promise<string | null>;
     /** Registers a value for redaction before it is written anywhere. */
     secret: (value: string) => void;
+    /** The held ref of the balancer's pin key (`sharedSecretRef(owner, pinKeyName(id))`). */
+    pinRef: string;
+    /** The held store. Without it the pin key cannot be read, so a check through the balancer is inconclusive. */
+    heldKeys?: PinHeldKeys;
     primaryUuid: string;
     /** The Coolify app of the blue copy on the primary (the entry's `coolify:app`, or the running archon app). */
     primaryBlueAppId: string;

package/dist/plan/release-host.js

@@ -1,7 +1,8 @@
+import { randomBytes } from 'node:crypto';
 import { checkColorAddress, readReleaseHealth } from '../release/health.js';
 import { runRelease } from '../release/run.js';
 import { applyBlueGreenWeights, copiedEnv } from './blue-green-apply.js';
-import { DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, parseWeights, reportingEnv, } from './blue-green.js';
+import { ACTIONS_KEY_ENV, DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, mintPinKey, parseWeights, readPinKey, reportingEnv, } from './blue-green.js';
 import { waitForNewDeployment } from './deploy-health.js';
 import { isNotFoundError } from './executor.js';
 const COMMIT = /^[0-9a-f]{40}$/;
@@ -41,13 +42,20 @@ export function createReleaseHost(input) {
      * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
      * header router. The balancer routes the pinned request to that color whatever its weight.
      */
-    const addressOf = (color) => {
+    const pinInput = () => ({
+        id,
+        ref: input.pinRef,
+        recorded,
+        secret: input.secret,
+        heldKeys: input.heldKeys ?? { resolve: async () => null },
+    });
+    const addressOf = async (color) => {
         const hostname = subject.hostnames.find((name) => !name.startsWith('*'));
         if (!hostname)
             throw new Error(`${input.label}: the app has no public hostname to check through`);
-        const pinKey = recorded()[bgKey.pinKey(id)];
+        const pinKey = await readPinKey(pinInput());
         if (!pinKey)
-            throw new Error(`${input.label}: the balancer's pin key is not recorded`);
+            throw new Error(`${input.label}: the balancer's pin key is not held`);
         return {
             address: `https://${hostname}`,
             headers: { [LB_COLOR_HEADER]: color, [LB_PIN_HEADER]: pinKey },
@@ -101,6 +109,18 @@ export function createReleaseHost(input) {
                 if (envs.length > 0) {
                     await coolify.bulkUpsertEnvs(appId, envs.map((e) => ({ ...e, literal: true })));
                 }
+                // A key removed from blue (a rotated-out credential) must not stay on the slot.
+                if (appId !== input.primaryBlueAppId) {
+                    const keep = new Set([...source.map((e) => e.key), ...envs.map((e) => e.key)]);
+                    for (const env of await coolify.listEnvs(appId)) {
+                        if (env.uuid &&
+                            !keep.has(env.key) &&
+                            !env.key.startsWith('REPORTING_') &&
+                            env.key !== ACTIONS_KEY_ENV) {
+                            await coolify.deleteEnv(appId, env.uuid);
+                        }
+                    }
+                }
             }
             catch {
                 // A Coolify error can echo the request body, which holds the token.
@@ -129,7 +149,7 @@ export function createReleaseHost(input) {
                 return null;
             input.secret(token);
             return readReleaseHealth({
-                ...addressOf(healthColor()),
+                ...(await addressOf(healthColor())),
                 token,
                 ...range,
                 ...(input.fetch ? { fetchImpl: input.fetch } : {}),
@@ -146,9 +166,10 @@ export function createReleaseHost(input) {
             return {
                 status,
                 address: await checkColorAddress({
-                    ...addressOf(color),
+                    ...(await addressOf(color)),
                     healthPath: subject.healthPath,
-                    expectJson: subject.reporting && subject.healthPath === '/api/health',
+                    // A server answers JSON on its health path; a static app answers HTML, which must not be an Access page.
+                    expectJson: subject.reporting,
                     ...(input.fetch ? { fetchImpl: input.fetch } : {}),
                 }),
             };
@@ -156,8 +177,9 @@ export function createReleaseHost(input) {
         async effect(effect) {
             if (effect.kind === 'deploy')
                 await deployTo(effect.color, effect.digest);
-            else
+            else if (effect.kind === 'stop')
                 await stop(effect.color);
+            // deploy_stage is executed by the stage deploy task (F4); until then it is passed on and ignored here.
         },
     };
     return {
@@ -187,6 +209,12 @@ export function createReleaseHost(input) {
             for (const uuid of servers) {
                 await input.renew();
                 await applyBlueGreenWeights({
+                    pinKey: () => mintPinKey({
+                        ...pinInput(),
+                        record: (key, value) => context.recordScopeId(key, value),
+                        persist: () => context.persist(),
+                        generate: () => randomBytes(32).toString('hex'),
+                    }),
                     coolify,
                     recorded,
                     record: (key, value) => context.recordScopeId(key, value),

package/dist/plan/stage-env.d.ts

@@ -1,4 +1,20 @@
-import { type StageKind } from './stage-isolation.js';
+import { type LiveSignIn, type StageKind } from './stage-isolation.js';
+/** A stage with its own sign-in: a workspace. Its values are the stage's, never the live app's. */
+export interface StageSignIn {
+    /** Issuer, organisation id, client id and, with workspaces, the broker URL and the stage's own key. */
+    env: ReadonlyArray<{
+        key: string;
+        value: string;
+    }>;
+    /** Stage signs in the company's test customers organisation. */
+    customers: boolean;
+    /** The redirect URI registered for the stage client. */
+    redirectUri: string;
+    /** What stage must never hold. */
+    live: LiveSignIn;
+}
+/** The names a stage's own sign-in sets; a change to one of them redeploys stage. */
+export declare const STAGE_SIGN_IN_NAMES: readonly string[];
 export interface StageEnvInput {
     kind: StageKind;
     /** Where the stage app is reached: its own container address, since stage has no hostname. */
@@ -22,6 +38,8 @@ export interface StageEnvInput {
         is_preview?: boolean;
     }>;
     mint: () => string;
+    /** Stage's own sign-in. Its values override any copied from the live app; its cookie secret and app key are minted. */
+    signIn?: StageSignIn;
 }
 export interface StageEnv {
     env: Array<{

package/dist/plan/stage-env.js

@@ -5,9 +5,26 @@ const WAITS_FOR_STAGE_SERVICE = new Set([
     'AI_URL',
     'JOBS_SCHEDULER_URL',
     'ANALYTICS_URL',
+    'WORKSPACES_URL',
+    'MCP_ISSUER',
 ]);
 /** Secrets stage mints for itself, when the app uses them. A copy of prod's value would be a prod credential. */
 const MINTED = ['AUTH_COOKIE_SECRET', 'KEYSTORE_KEK'];
+/** The names a stage's own sign-in sets; a change to one of them redeploys stage. */
+export const STAGE_SIGN_IN_NAMES = [
+    'AUTH_ISSUER',
+    'AUTH_ORGANIZATION_ID',
+    'AUTH_CLIENT_ID',
+    'AUTH_APP_KEY',
+    'AUTH_COOKIE_SECRET',
+    'WORKSPACES_URL',
+    'WORKSPACES_API_KEY',
+    'MCP_AUDIENCE',
+    'MCP_RESOURCE',
+    'MCP_ISSUER',
+];
+/** The shortest `AUTH_APP_KEY` the broker accepts. */
+const MIN_APP_KEY_LENGTH = 32;
 /**
  * The env of a stage app, built from the kind's allowlist and never from a copy of the live app's env. Every
  * name is allowed and none is denied, or this throws a fixed text with the name.
@@ -41,10 +58,17 @@ export function buildStageEnv(input) {
             set(key, value);
         }
     }
+    for (const { key, value } of input.signIn?.env ?? [])
+        set(key, value);
     for (const key of MINTED) {
-        if (prod.has(key) && isAllowed(kind, key))
+        const wanted = prod.has(key) || (input.signIn !== undefined && key === 'AUTH_COOKIE_SECRET');
+        if (wanted && isAllowed(kind, key))
             set(key, existing.get(key) ?? input.mint());
     }
+    if (input.signIn) {
+        const kept = existing.get('AUTH_APP_KEY');
+        set('AUTH_APP_KEY', kept && kept.length >= MIN_APP_KEY_LENGTH ? kept : input.mint());
+    }
     const absent = STAGE_ALLOWLIST[kind]
         .filter((name) => !name.endsWith('*') && prod.has(name) && !env.has(name))
         .sort();

package/dist/plan/stage-guards.d.ts

@@ -37,6 +37,22 @@ export interface StageProbePort {
         syncKey: string;
         projectId: string;
     }): Promise<boolean>;
+    /** Uses the stage workspaces key on the live customers organisation's workspaces in the broker. */
+    workspacesRejects?(input: {
+        url: string;
+        apiKey: string;
+        organisationId: string;
+    }): Promise<boolean>;
+    /**
+     * Starts a real authorization request at the issuer for the live customers organisation with the stage client
+     * id and the redirect URI registered for that client, and answers `true` when the live sign-in refuses it.
+     */
+    signInRejects?(input: {
+        issuer: string;
+        clientId: string;
+        organisationId: string;
+        redirectUri: string;
+    }): Promise<boolean>;
 }
 /** One probe. `run` is `null` when the host has no port for it: the probe is then reported as not run. */
 export interface StageProbe {
@@ -52,6 +68,10 @@ export interface StageProbeInput {
     prod: ReadonlyMap<string, string>;
     /** Whether stage has a database: if no database probe can be built, one is kept as not run. */
     database?: boolean;
+    /** The live customers organisation's id, where the company has one: the sign-in probes aim at it. */
+    liveCustomersOrgId?: string;
+    /** The redirect URI registered for the stage client: the sign-in probe sends it. */
+    signInRedirectUri?: string;
 }
 /**
  * The probes for what stage holds: its database role against production's database host, and its files, ai and

package/dist/plan/stage-guards.js

@@ -77,6 +77,30 @@ export function buildStageProbes(input) {
             run: call ? () => call({ url: jobsUrl, syncKey, projectId }) : null,
         });
     }
+    const customersOrgId = input.liveCustomersOrgId;
+    const workspacesUrl = stage.get('WORKSPACES_URL');
+    const workspacesKey = stage.get('WORKSPACES_API_KEY');
+    if (customersOrgId && workspacesUrl && workspacesKey) {
+        const call = port?.workspacesRejects?.bind(port);
+        probes.push({
+            what: 'workspaces:stage-key-on-live-customers',
+            run: call
+                ? () => call({ url: workspacesUrl, apiKey: workspacesKey, organisationId: customersOrgId })
+                : null,
+        });
+    }
+    const issuer = stage.get('AUTH_ISSUER');
+    const clientId = stage.get('AUTH_CLIENT_ID');
+    const redirectUri = input.signInRedirectUri;
+    if (customersOrgId && issuer && clientId && redirectUri) {
+        const call = port?.signInRejects?.bind(port);
+        probes.push({
+            what: 'sign-in:stage-client-on-live-customers',
+            run: call
+                ? () => call({ issuer, clientId, organisationId: customersOrgId, redirectUri })
+                : null,
+        });
+    }
     return probes;
 }
 /** Runs every probe once, each under a timeout. A throw and a timeout count as failed, never as rejected. */