@wtfalch/foundry 0.60.0 → 0.62.0

package/dist/plan/private-pages.d.ts

@@ -0,0 +1,26 @@
+import { type DeclaredOrg, type PrivatePage } from '../org.js';
+/**
+ * Private pages (`HostingEntry.privatePages`): a path of an app that only the company's people may open. Each is
+ * a path-scoped Cloudflare Access application (`<host><path>`, a self-hosted app whose domain carries a path)
+ * made by `planGates` like any other gate, with the company sign-in claim, over the entry's live hosts (`pp-`)
+ * and over its workspace host (`wp-`). Cloudflare applies the most specific application, so the page's gate
+ * wins over the workspace's whole-host gate, and a tester who may open the workspace is refused here.
+ *
+ * Foundry cannot turn a role into people: `roles` are the company's role ids, and the host that declares the
+ * org puts the email addresses of the people holding them in `people`. The gate admits the owners and those.
+ */
+export type PrivatePageScope = 'live' | 'workspace';
+/** The gate key of one private page: a hash of the scope, entry key and path, so it fits a DNS label, never clashes with `ws-<key>` or a declared gate key, and needs no escaping. */
+export declare function privatePageGateKey(scope: PrivatePageScope, entryKey: string, path: string): string;
+/** Who passes a private page: the owners and the page's `people`, lowercased, distinct, sorted. */
+export declare function privatePagePeople(org: Pick<DeclaredOrg, 'owners'>, page: PrivatePage): string[];
+export interface PrivatePageGate {
+    entry: string;
+    hostnames: string[];
+    people: string[];
+}
+/**
+ * The private page gates by key: the live ones from `org` (an entry that is not live has no live host) and the
+ * workspace ones from `declared` (the org with its dark entries).
+ */
+export declare function privatePageGates(org: DeclaredOrg, declared: DeclaredOrg): Map<string, PrivatePageGate>;

package/dist/plan/private-pages.js

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+import { normalizeTesters } from '../org.js';
+import { entryHostnames, workspaceHost } from './hostnames.js';
+import { companyPeople, workspaceEntries } from './workspace.js';
+/** The gate key of one private page: a hash of the scope, entry key and path, so it fits a DNS label, never clashes with `ws-<key>` or a declared gate key, and needs no escaping. */
+export function privatePageGateKey(scope, entryKey, path) {
+    const hash = createHash('sha256').update(`${scope}\0${entryKey}\0${path}`).digest('hex');
+    return `${scope === 'live' ? 'pp' : 'wp'}-${hash.slice(0, 16)}`;
+}
+/** Who passes a private page: the owners and the page's `people`, lowercased, distinct, sorted. */
+export function privatePagePeople(org, page) {
+    return normalizeTesters([...companyPeople(org), ...(page.people ?? [])]).sort();
+}
+/**
+ * The private page gates by key: the live ones from `org` (an entry that is not live has no live host) and the
+ * workspace ones from `declared` (the org with its dark entries).
+ */
+export function privatePageGates(org, declared) {
+    const gates = new Map();
+    if (!org.hosting.enabled)
+        return gates;
+    const add = (scope, entry, hosts) => {
+        if (hosts.length === 0)
+            return;
+        for (const page of entry.privatePages ?? []) {
+            gates.set(privatePageGateKey(scope, entry.key, page.path), {
+                entry: entry.key,
+                hostnames: hosts.map((host) => `${host}${page.path}`).sort(),
+                people: privatePagePeople(declared, page),
+            });
+        }
+    };
+    for (const entry of org.hosting.entries)
+        add('live', entry, entryHostnames(org, entry));
+    for (const entry of workspaceEntries(declared)) {
+        add('workspace', entry, [workspaceHost(declared.slug, entry.key)]);
+    }
+    return gates;
+}

package/dist/plan/providers-readers.js

@@ -2,6 +2,7 @@ import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { APP_ENTRY_KEY } from '../org.js';
 import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 import { previewsOn } from './coolify-previews.js';
+import { KOSMOS_MANAGED_ENV_KEYS } from './kosmos.js';
 import { APP_GONE_KIND, } from './live.js';
 import { SIGN_IN_UPSTREAM_ENV } from './sign-in.js';
 /**
@@ -302,6 +303,23 @@ async function withBouleEnvConfig(client, resource, recorded, liveKeys) {
         config: { ...resource.config, env, ...(appToken ? { appMailToken: appToken } : {}) },
     };
 }
+/**
+ * The org's own recorded kosmos app's live sign-in env vars, as `config.env`, so `diff.ts`'s `planKosmos`
+ * can compare them with what `executor.ts` would write. Gated and failing exactly like
+ * {@link withAgoraEnvConfig}.
+ */
+async function withKosmosEnvConfig(client, resource, recorded) {
+    if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('kosmos:')) {
+        return resource;
+    }
+    const managed = KOSMOS_MANAGED_ENV_KEYS;
+    const env = {};
+    for (const e of await client.listEnvs(resource.key)) {
+        if (!e.is_preview && managed.includes(e.key))
+            env[e.key] = e.value;
+    }
+    return { ...resource, config: { ...resource.config, env } };
+}
 /** `@wtfalch/providers`' own `LiveResource` (`resource.ts`) has no `system` field — foundry's adds it at this boundary. */
 function toFoundryResources(system, resources) {
     return resources.map((r) => ({ system, kind: r.kind, key: r.key, config: r.config }));
@@ -335,7 +353,8 @@ export class ProvidersCoolifyReader {
         const withAgoraConfig = await Promise.all(withDbUrl.map((r) => withAgoraEnvConfig(this.client, r, recorded)));
         const liveKeys = new Set(withAgoraConfig.map((r) => r.key));
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded, liveKeys)));
-        return applyRecordedIds(withBouleConfig, recorded);
+        const withKosmosConfig = await Promise.all(withBouleConfig.map((r) => withKosmosEnvConfig(this.client, r, recorded)));
+        return applyRecordedIds(withKosmosConfig, recorded);
     }
     async liveEnvEquals(orgId, appKey, name, value) {
         const recorded = await this.resolveRecordedIds(orgId);

package/dist/plan/proxy-labels.d.ts

@@ -26,6 +26,8 @@ export declare const CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY = "cloudflare_tunn
  * last written for, comma-joined. Recorded only once every record is in place.
  */
 export declare const CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY = "cloudflare_tunnel_oikos_hostnames";
+/** The same for the entry names in the platform's companyincluded.app zone ({@link entryAppsHostnames}). */
+export declare const CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY = "cloudflare_tunnel_apps_hostnames";
 /**
  * The run label every customer hosting-entry container gets. A run label overrides the image's own
  * `LABEL` of the same key, so Traefik ignores the container whatever its image says: a customer image
@@ -92,9 +94,18 @@ export declare function sameLabelSets(a: string, b: string): boolean;
  * The entry names that live in the platform's `oikos.host` zone (a company with no domain of its own, or with
  * `usesDomain` off): the names the company's tunnel gets a proxied CNAME for. Sorted.
  */
-export declare function entryOikosHostnames(org: DeclaredOrg): string[];
+export declare function entryOikosHostnames(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): string[];
 /**
  * Whether `name` is one the company may write in the platform's `oikos.host` zone: exactly its own
  * `<slug>.oikos.host`. A company writes no other company's name, whatever an entry declares.
  */
 export declare function ownsOikosName(org: DeclaredOrg, name: string): boolean;
+/**
+ * The entry names that live in the platform's `companyincluded.app` zone: an entry's `hostedName`, and the
+ * workspace host of each server workspace that is applied. Sorted.
+ */
+export declare function entryAppsHostnames(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): string[];
+/** Whether `name` is one this org may write in the `companyincluded.app` zone: a hosted name or its workspace host. */
+export declare const ownsAppsZoneName: (org: DeclaredOrg, name: string) => boolean;
+/** Whether `name` is one label directly under `companyincluded.app`. */
+export declare function isAppsEntryName(name: string): boolean;

package/dist/plan/proxy-labels.js

@@ -1,8 +1,10 @@
 import { createHash } from 'node:crypto';
+import { APPS_DOMAIN } from '../org.js';
 import { BUILTIN_APPS, PRIMARY_SERVER_SCOPE_KEY, balancerApplied, builtinSubject, lbAppName, lbOrigin, liveAppNameFor, } from './blue-green.js';
 import { entryHostnames, wildcardHostname } from './hostnames.js';
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
 import { appNameFor } from './platform-diff.js';
+import { ownsWorkspaceName, workspaceRoutes } from './workspace.js';
 /**
  * The label every routed container carries, with the install's token as its value. Traefik is told
  * (`--providers.docker.constraints=Label(`foundry.edge`,`<token>`)`) to route only containers that carry
@@ -29,6 +31,8 @@ export const CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY = 'cloudflare_tunnel_entry
  * last written for, comma-joined. Recorded only once every record is in place.
  */
 export const CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY = 'cloudflare_tunnel_oikos_hostnames';
+/** The same for the entry names in the platform's companyincluded.app zone ({@link entryAppsHostnames}). */
+export const CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY = 'cloudflare_tunnel_apps_hostnames';
 /**
  * The run label every customer hosting-entry container gets. A run label overrides the image's own
  * `LABEL` of the same key, so Traefik ignores the container whatever its image says: a customer image
@@ -65,6 +69,8 @@ export function entryRoutes(org, recorded = {}) {
     for (const entry of org.hosting.entries) {
         if (entry.workerApp)
             continue; // Served by its Worker route, not the tunnel.
+        if (entry.live === false)
+            continue; // Only its workspace exists (below).
         // A blue/green entry is reached through its balancer, which each server's connector finds on its own
         // network, once the balancer exists on the primary. Until then it keeps the origin it had.
         const target = !entry.blueGreen
@@ -81,6 +87,10 @@ export function entryRoutes(org, recorded = {}) {
         if (wildcardName && !wildcard)
             wildcard = { hostname: wildcardName, service };
     }
+    for (const route of workspaceRoutes(org, recorded)) {
+        if (!routes.some((r) => r.hostname === route.hostname))
+            routes.push(route);
+    }
     if (wildcard)
         routes.push(wildcard);
     return routes;
@@ -171,8 +181,8 @@ export function sameLabelSets(a, b) {
  * The entry names that live in the platform's `oikos.host` zone (a company with no domain of its own, or with
  * `usesDomain` off): the names the company's tunnel gets a proxied CNAME for. Sorted.
  */
-export function entryOikosHostnames(org) {
-    return entryRoutes(org)
+export function entryOikosHostnames(org, recorded = {}) {
+    return entryRoutes(org, recorded)
         .map((r) => r.hostname)
         .filter((h) => h.endsWith(`.${NO_DOMAIN_ZONE}`))
         .sort();
@@ -184,3 +194,23 @@ export function entryOikosHostnames(org) {
 export function ownsOikosName(org, name) {
     return name.toLowerCase() === `${org.slug}.${NO_DOMAIN_ZONE}`;
 }
+/**
+ * The entry names that live in the platform's `companyincluded.app` zone: an entry's `hostedName`, and the
+ * workspace host of each server workspace that is applied. Sorted.
+ */
+export function entryAppsHostnames(org, recorded = {}) {
+    return entryRoutes(org, recorded)
+        .map((r) => r.hostname)
+        .filter((name) => isAppsEntryName(name) || ownsWorkspaceName(org, name))
+        .sort();
+}
+/** Whether `name` is one this org may write in the `companyincluded.app` zone: a hosted name or its workspace host. */
+export const ownsAppsZoneName = (org, name) => isAppsEntryName(name) || ownsWorkspaceName(org, name);
+/** Whether `name` is one label directly under `companyincluded.app`. */
+export function isAppsEntryName(name) {
+    const suffix = `.${APPS_DOMAIN}`;
+    const lower = name.toLowerCase();
+    return (lower.endsWith(suffix) &&
+        lower.length > suffix.length &&
+        !lower.slice(0, -suffix.length).includes('.'));
+}

package/dist/plan/release-host.d.ts

@@ -1,6 +1,6 @@
 import { type ReleaseDeps } from '../release/run.js';
 import type { ReleaseStore } from '../release/state.js';
-import { type BlueGreenSubject } from './blue-green.js';
+import { type BlueGreenSubject, type PinHeldKeys } from './blue-green.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import type { CoolifyPort } from './executor.js';
 /** The recorded ids a release run reads and writes: an org's apply context, or the platform's. */
@@ -21,13 +21,17 @@ export interface ReleaseHost {
 export interface ReleaseHostInput {
     subject: BlueGreenSubject;
     context: ReleaseContext;
-    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
+    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
         listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
     };
     /** Reads the entry's health token (`sharedSecretRef(org.id, healthTokenName(id))`). Never mints. */
     healthToken: () => Promise<string | null>;
     /** Registers a value for redaction before it is written anywhere. */
     secret: (value: string) => void;
+    /** The held ref of the balancer's pin key (`sharedSecretRef(owner, pinKeyName(id))`). */
+    pinRef: string;
+    /** The held store. Without it the pin key cannot be read, so a check through the balancer is inconclusive. */
+    heldKeys?: PinHeldKeys;
     primaryUuid: string;
     /** The Coolify app of the blue copy on the primary (the entry's `coolify:app`, or the running archon app). */
     primaryBlueAppId: string;

package/dist/plan/release-host.js

@@ -1,7 +1,8 @@
+import { randomBytes } from 'node:crypto';
 import { checkColorAddress, readReleaseHealth } from '../release/health.js';
 import { runRelease } from '../release/run.js';
 import { applyBlueGreenWeights, copiedEnv } from './blue-green-apply.js';
-import { DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, parseWeights, reportingEnv, } from './blue-green.js';
+import { ACTIONS_KEY_ENV, DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, mintPinKey, parseWeights, readPinKey, reportingEnv, } from './blue-green.js';
 import { waitForNewDeployment } from './deploy-health.js';
 import { isNotFoundError } from './executor.js';
 const COMMIT = /^[0-9a-f]{40}$/;
@@ -41,13 +42,20 @@ export function createReleaseHost(input) {
      * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
      * header router. The balancer routes the pinned request to that color whatever its weight.
      */
-    const addressOf = (color) => {
+    const pinInput = () => ({
+        id,
+        ref: input.pinRef,
+        recorded,
+        secret: input.secret,
+        heldKeys: input.heldKeys ?? { resolve: async () => null },
+    });
+    const addressOf = async (color) => {
         const hostname = subject.hostnames.find((name) => !name.startsWith('*'));
         if (!hostname)
             throw new Error(`${input.label}: the app has no public hostname to check through`);
-        const pinKey = recorded()[bgKey.pinKey(id)];
+        const pinKey = await readPinKey(pinInput());
         if (!pinKey)
-            throw new Error(`${input.label}: the balancer's pin key is not recorded`);
+            throw new Error(`${input.label}: the balancer's pin key is not held`);
         return {
             address: `https://${hostname}`,
             headers: { [LB_COLOR_HEADER]: color, [LB_PIN_HEADER]: pinKey },
@@ -101,6 +109,18 @@ export function createReleaseHost(input) {
                 if (envs.length > 0) {
                     await coolify.bulkUpsertEnvs(appId, envs.map((e) => ({ ...e, literal: true })));
                 }
+                // A key removed from blue (a rotated-out credential) must not stay on the slot.
+                if (appId !== input.primaryBlueAppId) {
+                    const keep = new Set([...source.map((e) => e.key), ...envs.map((e) => e.key)]);
+                    for (const env of await coolify.listEnvs(appId)) {
+                        if (env.uuid &&
+                            !keep.has(env.key) &&
+                            !env.key.startsWith('REPORTING_') &&
+                            env.key !== ACTIONS_KEY_ENV) {
+                            await coolify.deleteEnv(appId, env.uuid);
+                        }
+                    }
+                }
             }
             catch {
                 // A Coolify error can echo the request body, which holds the token.
@@ -129,7 +149,7 @@ export function createReleaseHost(input) {
                 return null;
             input.secret(token);
             return readReleaseHealth({
-                ...addressOf(healthColor()),
+                ...(await addressOf(healthColor())),
                 token,
                 ...range,
                 ...(input.fetch ? { fetchImpl: input.fetch } : {}),
@@ -146,9 +166,10 @@ export function createReleaseHost(input) {
             return {
                 status,
                 address: await checkColorAddress({
-                    ...addressOf(color),
+                    ...(await addressOf(color)),
                     healthPath: subject.healthPath,
-                    expectJson: subject.reporting && subject.healthPath === '/api/health',
+                    // A server answers JSON on its health path; a static app answers HTML, which must not be an Access page.
+                    expectJson: subject.reporting,
                     ...(input.fetch ? { fetchImpl: input.fetch } : {}),
                 }),
             };
@@ -156,8 +177,9 @@ export function createReleaseHost(input) {
         async effect(effect) {
             if (effect.kind === 'deploy')
                 await deployTo(effect.color, effect.digest);
-            else
+            else if (effect.kind === 'stop')
                 await stop(effect.color);
+            // deploy_stage is executed by the stage deploy task (F4); until then it is passed on and ignored here.
         },
     };
     return {
@@ -187,6 +209,12 @@ export function createReleaseHost(input) {
             for (const uuid of servers) {
                 await input.renew();
                 await applyBlueGreenWeights({
+                    pinKey: () => mintPinKey({
+                        ...pinInput(),
+                        record: (key, value) => context.recordScopeId(key, value),
+                        persist: () => context.persist(),
+                        generate: () => randomBytes(32).toString('hex'),
+                    }),
                     coolify,
                     recorded,
                     record: (key, value) => context.recordScopeId(key, value),

package/dist/plan/stage-env.d.ts

@@ -1,4 +1,20 @@
-import { type StageKind } from './stage-isolation.js';
+import { type LiveSignIn, type StageKind } from './stage-isolation.js';
+/** A stage with its own sign-in: a workspace. Its values are the stage's, never the live app's. */
+export interface StageSignIn {
+    /** Issuer, organisation id, client id and, with workspaces, the broker URL and the stage's own key. */
+    env: ReadonlyArray<{
+        key: string;
+        value: string;
+    }>;
+    /** Stage signs in the company's test customers organisation. */
+    customers: boolean;
+    /** The redirect URI registered for the stage client. */
+    redirectUri: string;
+    /** What stage must never hold. */
+    live: LiveSignIn;
+}
+/** The names a stage's own sign-in sets; a change to one of them redeploys stage. */
+export declare const STAGE_SIGN_IN_NAMES: readonly string[];
 export interface StageEnvInput {
     kind: StageKind;
     /** Where the stage app is reached: its own container address, since stage has no hostname. */
@@ -22,6 +38,8 @@ export interface StageEnvInput {
         is_preview?: boolean;
     }>;
     mint: () => string;
+    /** Stage's own sign-in. Its values override any copied from the live app; its cookie secret and app key are minted. */
+    signIn?: StageSignIn;
 }
 export interface StageEnv {
     env: Array<{

package/dist/plan/stage-env.js

@@ -5,9 +5,26 @@ const WAITS_FOR_STAGE_SERVICE = new Set([
     'AI_URL',
     'JOBS_SCHEDULER_URL',
     'ANALYTICS_URL',
+    'WORKSPACES_URL',
+    'MCP_ISSUER',
 ]);
 /** Secrets stage mints for itself, when the app uses them. A copy of prod's value would be a prod credential. */
 const MINTED = ['AUTH_COOKIE_SECRET', 'KEYSTORE_KEK'];
+/** The names a stage's own sign-in sets; a change to one of them redeploys stage. */
+export const STAGE_SIGN_IN_NAMES = [
+    'AUTH_ISSUER',
+    'AUTH_ORGANIZATION_ID',
+    'AUTH_CLIENT_ID',
+    'AUTH_APP_KEY',
+    'AUTH_COOKIE_SECRET',
+    'WORKSPACES_URL',
+    'WORKSPACES_API_KEY',
+    'MCP_AUDIENCE',
+    'MCP_RESOURCE',
+    'MCP_ISSUER',
+];
+/** The shortest `AUTH_APP_KEY` the broker accepts. */
+const MIN_APP_KEY_LENGTH = 32;
 /**
  * The env of a stage app, built from the kind's allowlist and never from a copy of the live app's env. Every
  * name is allowed and none is denied, or this throws a fixed text with the name.
@@ -41,10 +58,17 @@ export function buildStageEnv(input) {
             set(key, value);
         }
     }
+    for (const { key, value } of input.signIn?.env ?? [])
+        set(key, value);
     for (const key of MINTED) {
-        if (prod.has(key) && isAllowed(kind, key))
+        const wanted = prod.has(key) || (input.signIn !== undefined && key === 'AUTH_COOKIE_SECRET');
+        if (wanted && isAllowed(kind, key))
             set(key, existing.get(key) ?? input.mint());
     }
+    if (input.signIn) {
+        const kept = existing.get('AUTH_APP_KEY');
+        set('AUTH_APP_KEY', kept && kept.length >= MIN_APP_KEY_LENGTH ? kept : input.mint());
+    }
     const absent = STAGE_ALLOWLIST[kind]
         .filter((name) => !name.endsWith('*') && prod.has(name) && !env.has(name))
         .sort();

package/dist/plan/stage-guards.d.ts

@@ -37,6 +37,22 @@ export interface StageProbePort {
         syncKey: string;
         projectId: string;
     }): Promise<boolean>;
+    /** Uses the stage workspaces key on the live customers organisation's workspaces in the broker. */
+    workspacesRejects?(input: {
+        url: string;
+        apiKey: string;
+        organisationId: string;
+    }): Promise<boolean>;
+    /**
+     * Starts a real authorization request at the issuer for the live customers organisation with the stage client
+     * id and the redirect URI registered for that client, and answers `true` when the live sign-in refuses it.
+     */
+    signInRejects?(input: {
+        issuer: string;
+        clientId: string;
+        organisationId: string;
+        redirectUri: string;
+    }): Promise<boolean>;
 }
 /** One probe. `run` is `null` when the host has no port for it: the probe is then reported as not run. */
 export interface StageProbe {
@@ -52,6 +68,10 @@ export interface StageProbeInput {
     prod: ReadonlyMap<string, string>;
     /** Whether stage has a database: if no database probe can be built, one is kept as not run. */
     database?: boolean;
+    /** The live customers organisation's id, where the company has one: the sign-in probes aim at it. */
+    liveCustomersOrgId?: string;
+    /** The redirect URI registered for the stage client: the sign-in probe sends it. */
+    signInRedirectUri?: string;
 }
 /**
  * The probes for what stage holds: its database role against production's database host, and its files, ai and

package/dist/plan/stage-guards.js

@@ -77,6 +77,30 @@ export function buildStageProbes(input) {
             run: call ? () => call({ url: jobsUrl, syncKey, projectId }) : null,
         });
     }
+    const customersOrgId = input.liveCustomersOrgId;
+    const workspacesUrl = stage.get('WORKSPACES_URL');
+    const workspacesKey = stage.get('WORKSPACES_API_KEY');
+    if (customersOrgId && workspacesUrl && workspacesKey) {
+        const call = port?.workspacesRejects?.bind(port);
+        probes.push({
+            what: 'workspaces:stage-key-on-live-customers',
+            run: call
+                ? () => call({ url: workspacesUrl, apiKey: workspacesKey, organisationId: customersOrgId })
+                : null,
+        });
+    }
+    const issuer = stage.get('AUTH_ISSUER');
+    const clientId = stage.get('AUTH_CLIENT_ID');
+    const redirectUri = input.signInRedirectUri;
+    if (customersOrgId && issuer && clientId && redirectUri) {
+        const call = port?.signInRejects?.bind(port);
+        probes.push({
+            what: 'sign-in:stage-client-on-live-customers',
+            run: call
+                ? () => call({ issuer, clientId, organisationId: customersOrgId, redirectUri })
+                : null,
+        });
+    }
     return probes;
 }
 /** Runs every probe once, each under a timeout. A throw and a timeout count as failed, never as rejected. */

package/dist/plan/stage-isolation.d.ts

@@ -36,10 +36,31 @@ export declare function isAllowed(kind: StageKind, name: string): boolean;
 export declare const SHARED_WITH_PROD: Readonly<Record<string, string>>;
 /** Whether `name` may equal production's value. */
 export declare const isSharedWithProd: (name: string) => boolean;
+/** The live app's own sign-in values. Stage must hold none of them. */
+export interface LiveSignIn {
+    /** The live customers organisation's id. */
+    customersOrgId?: string;
+    /** The live app's client ids. */
+    clientIds: readonly string[];
+    /** The live workspaces keys. */
+    workspacesKeys: readonly string[];
+    /** The live apps' MCP audiences (the ZITADEL project ids). */
+    mcpAudiences?: readonly string[];
+    /** The live apps' MCP resources (their public MCP addresses). */
+    mcpResources?: readonly string[];
+}
+/** What a stage with its own sign-in says about it, for the isolation check. */
+export interface StageSignInGuard {
+    /** Stage signs in its own test customers organisation, so its organisation id may differ from production's. */
+    customers: boolean;
+    live: LiveSignIn;
+}
 export interface StageIsolationInput {
     kind: StageKind;
     prod: Surface;
     stage: Surface;
+    /** Present for a stage with its own sign-in (a workspace). */
+    signIn?: StageSignInGuard;
     /** The mail env stage is allowed to hold: the sink's wiring. Empty: stage holds no mail env. */
     sinkMail?: Readonly<Record<string, string>>;
 }
@@ -51,6 +72,9 @@ export interface StageIsolationInput {
  *    {@link SHARED_WITH_PROD} differs from production's), `live_mode_key`.
  *  - A4 names: `resource_shared`, `host_is_prod_internal`.
  *  - A5 mail: `mail_not_sink`, `mail_token`.
+ *  - A6 sign-in (with `signIn`): `live_customers_org`, `live_client_id`, `live_workspaces_key`,
+ *    `live_mcp_audience`, `live_mcp_resource` when stage holds the live customers organisation id, a live client
+ *    id, the live workspaces key, or a live MCP audience or resource.
  */
 export declare function assertStageIsolated(input: StageIsolationInput): string[];
 /** The sha256 of the stage env name set plus the resource set: what `bg.<id>.stageisolation` records. */

package/dist/plan/stage-isolation.js

@@ -87,6 +87,11 @@ export const STAGE_ALLOWLIST = {
         'JOBS_SYNC_KEY',
         'ANALYTICS_URL',
         'ANALYTICS_SITE_KEY',
+        'WORKSPACES_URL',
+        'WORKSPACES_API_KEY',
+        'MCP_AUDIENCE',
+        'MCP_RESOURCE',
+        'MCP_ISSUER',
     ],
 };
 /** Names no stage holds, whatever the app. */
@@ -159,6 +164,8 @@ export const SHARED_WITH_PROD = {
     AI_URL: 'the ai service is shared; stage reaches it only with its own organisation and key',
     JOBS_SCHEDULER_URL: 'the jobs service is shared; stage reaches it only with its own project and signing secret',
     ANALYTICS_URL: 'the analytics collector is shared; stage reports under its own site key',
+    MCP_ISSUER: 'the sign-in service is shared by decision; the issuer is a public address, not a credential',
+    WORKSPACES_URL: "the broker is shared; stage's own workspaces key opens its own product tenant, which holds no live customers' workspaces",
 };
 /** Whether `name` may equal production's value. */
 export const isSharedWithProd = (name) => Object.keys(SHARED_WITH_PROD).some((p) => globMatches(p, name));
@@ -174,6 +181,9 @@ const hostOf = (value) => URL_HOST.exec(value)?.[1]?.toLowerCase() ?? null;
  *    {@link SHARED_WITH_PROD} differs from production's), `live_mode_key`.
  *  - A4 names: `resource_shared`, `host_is_prod_internal`.
  *  - A5 mail: `mail_not_sink`, `mail_token`.
+ *  - A6 sign-in (with `signIn`): `live_customers_org`, `live_client_id`, `live_workspaces_key`,
+ *    `live_mcp_audience`, `live_mcp_resource` when stage holds the live customers organisation id, a live client
+ *    id, the live workspaces key, or a live MCP audience or resource.
  */
 export function assertStageIsolated(input) {
     const { kind, prod, stage } = input;
@@ -211,9 +221,27 @@ export function assertStageIsolated(input) {
             out.add(`env_not_allowed:${name}`);
         if (item.value !== undefined && LIVE_MODE_KEY.test(item.value))
             out.add(`live_mode_key:${name}`);
+        if (input.signIn && item.value !== undefined) {
+            const { live } = input.signIn;
+            if (name === 'AUTH_ORGANIZATION_ID' && item.value === live.customersOrgId) {
+                out.add(`live_customers_org:${name}`);
+            }
+            if (name === 'AUTH_CLIENT_ID' && live.clientIds.includes(item.value)) {
+                out.add(`live_client_id:${name}`);
+            }
+            if (name === 'WORKSPACES_API_KEY' && live.workspacesKeys.includes(item.value)) {
+                out.add(`live_workspaces_key:${name}`);
+            }
+            if (name === 'MCP_AUDIENCE' && live.mcpAudiences?.includes(item.value)) {
+                out.add(`live_mcp_audience:${name}`);
+            }
+            if (name === 'MCP_RESOURCE' && live.mcpResources?.includes(item.value)) {
+                out.add(`live_mcp_resource:${name}`);
+            }
+        }
         if (item.class === 'literal')
             continue;
-        const shared = isSharedWithProd(name);
+        const shared = isSharedWithProd(name) && !(input.signIn?.customers && name === 'AUTH_ORGANIZATION_ID');
         const counterpart = prodByName.get(name);
         if (shared) {
             const same = item.value !== undefined && counterpart?.value !== undefined