@wtfalch/foundry 0.60.0 → 0.61.0

package/dist/plan/own-jobs-route.js

@@ -0,0 +1,91 @@
+import { withTimeout } from './call-timeout.js';
+import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { recordOwnDnsHostname } from './own-dns.js';
+/**
+ * A company's jobs scheduler on a public hostname: a tunnel that dials the scheduler by its internal address,
+ * a connector app, and a proxied CNAME for `jobs.<domain>`. An entry runs on its own company's network and
+ * cannot dial the scheduler's container name, so `uses.jobs` gives it `https://<hostname>` once this is
+ * recorded. The owner company (hq) runs the scheduler every shared-services company registers on; a company
+ * that runs its own services publishes its own the same way. No Coolify domain and no Access app: the
+ * scheduler authenticates every caller itself (a project's sync key, the admin token), and a gate in front
+ * would stop the apps.
+ *
+ * One `coolify:own-jobs-route` step. It records {@link JOBS_PUBLIC_URL_SCOPE_KEY} last, so a run that fails
+ * halfway is planned again, finds the tunnel and connector by name, and no entry is given a dead URL.
+ */
+export const JOBS_PUBLIC_URL_SCOPE_KEY = 'jobs_public_url';
+export const OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY = 'cloudflare_own_jobs_tunnel';
+export const OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY = 'coolify_own_jobs_connector_app';
+/**
+ * The only paths the public route serves: what a project's app calls (`/sync`, `/timers`, `/timers/<name>`,
+ * `/deliveries`). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
+ */
+export const JOBS_ENTRY_PATH_PATTERN = '^/(sync$|timers(/|$)|deliveries$)';
+export const JOBS_ROUTE_CALL_TIMEOUT_MS = 60_000;
+/** The tunnel's name and the connector app's, one pair per company. */
+export const jobsRouteNames = (target) => ({
+    tunnel: `${target.id}-jobs-tunnel`,
+    connector: `${target.id}-jobs-cloudflared`,
+});
+/**
+ * Makes the route in this order: tunnel, its ingress, the connector app, the CNAME, then the recorded URL.
+ * Each is found by name or content first, so a second run makes nothing twice. A failure leaves what was made
+ * (found again on the next run) and no recorded URL. Errors carry the call's label only.
+ */
+export async function provisionJobsRoute(scope, ports, target, input) {
+    const ms = ports.callTimeoutMs ?? JOBS_ROUTE_CALL_TIMEOUT_MS;
+    const at = `own step coolify:own-jobs-route for ${target.id}`;
+    const names = jobsRouteNames(target);
+    const record = async (key, id) => {
+        scope.recordScopeId(key, id);
+        await scope.persist();
+    };
+    const zoneId = await withTimeout(`${at}: zone lookup`, ms, () => ports.network.zoneId(input.apex));
+    if (!zoneId)
+        throw new Error(`${at}: no Cloudflare zone for ${input.apex}`);
+    const tunnels = await ports.network.tunnels();
+    const dns = await ports.network.dns();
+    const { environment } = await withTimeout(`${at}: environment`, ms, () => ports.coolify.findOrCreateEnvironment(input.projectUuid, 'production'));
+    const tunnel = (await withTimeout(`${at}: tunnel lookup`, ms, () => tunnels.findTunnelByName(names.tunnel))) ??
+        (await withTimeout(`${at}: tunnel create`, ms, () => tunnels.createTunnel(names.tunnel)));
+    await record(OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY, tunnel.id);
+    await withTimeout(`${at}: tunnel ingress`, ms, () => tunnels.putTunnelConfig(tunnel.id, {
+        ingress: [
+            { hostname: input.hostname, path: JOBS_ENTRY_PATH_PATTERN, service: input.internalUrl },
+            { service: 'http_status:404' },
+        ],
+    }));
+    await withTimeout(`${at}: connector app`, ms * 5, () => ensureCloudflaredConnector({
+        coolify: ports.coolify,
+        tunnels,
+        tunnelId: tunnel.id,
+        appName: names.connector,
+        projectUuid: input.projectUuid,
+        environment,
+        resolveServer: async () => {
+            const servers = await ports.coolify.listServers();
+            const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
+            if (!server)
+                throw new Error('no usable Coolify server is registered');
+            return server;
+        },
+        recordedConnectorAppId: scope.recordedIds()[OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (appId) => record(OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY, appId),
+    }));
+    const wanted = {
+        type: 'CNAME',
+        name: input.hostname,
+        content: `${tunnel.id}.cfargotunnel.com`,
+        proxied: true,
+    };
+    const [live] = await withTimeout(`${at}: dns lookup`, ms, () => dns.findDnsRecord(input.apex, input.hostname, 'CNAME'));
+    if (!live) {
+        await withTimeout(`${at}: dns create`, ms, () => dns.createDnsRecord(input.apex, wanted));
+    }
+    else if (live.content !== wanted.content) {
+        await withTimeout(`${at}: dns update`, ms, () => dns.updateDnsRecord(input.apex, live.id, wanted));
+    }
+    await recordOwnDnsHostname(scope, input.hostname);
+    await record(JOBS_PUBLIC_URL_SCOPE_KEY, `https://${input.hostname}`);
+    return { resourceId: tunnel.id };
+}

package/dist/plan/own-services.d.ts

@@ -27,6 +27,8 @@ export interface ServiceTarget {
         authZitadel: string;
         authLogin: string;
         authBroker: string;
+        /** The Coolify Postgres database of the broker's customer workspaces. */
+        workspacesDb: string;
         authTunnel: string;
         authCloudflared: string;
         mailApp: string;
@@ -61,6 +63,8 @@ export interface ServiceTarget {
         instanceBearer: string;
         authAdmin: string;
         brokerMailKey: string;
+        /** The connection string of the database for the broker's customer workspaces: foundry holds it after making the database, or the operator holds one first. */
+        brokerWorkspacesDatabase: string;
         mailAdminKey: string;
         filesManagement: string;
         filesIntrospection: string;

package/dist/plan/own-services.js

@@ -16,6 +16,7 @@ export function platformTarget() {
             authZitadel: 'platform-auth-zitadel',
             authLogin: 'platform-auth-login',
             authBroker: 'platform-auth-broker',
+            workspacesDb: 'platform-workspaces-db',
             authTunnel: 'platform-auth-tunnel',
             authCloudflared: 'platform-auth-cloudflared',
             mailApp: 'platform-mail-stalwart',
@@ -47,6 +48,7 @@ export function platformTarget() {
             instanceBearer: 'zitadel:platform:instanceBearer',
             authAdmin: 'zitadel:platform:admin',
             brokerMailKey: 'lettermint:platform:apiToken',
+            brokerWorkspacesDatabase: 'auth:platform:workspacesDatabaseUrl',
             mailAdminKey: 'stalwart:platform:admin',
             filesManagement: 'files:platform:managementKey',
             filesIntrospection: 'zitadel:platform:files:introspection',
@@ -71,6 +73,7 @@ export function orgTarget(org) {
             authZitadel: `${s}-auth-zitadel`,
             authLogin: `${s}-auth-login`,
             authBroker: `${s}-auth-broker`,
+            workspacesDb: `${s}-workspaces-db`,
             authTunnel: `${s}-auth-tunnel`,
             authCloudflared: `${s}-auth-cloudflared`,
             mailApp: `${s}-mail-stalwart`,
@@ -102,6 +105,7 @@ export function orgTarget(org) {
             instanceBearer: `zitadel:org:${s}:instanceBearer`,
             authAdmin: `zitadel:org:${s}:admin`,
             brokerMailKey: `lettermint:org:${s}:apiToken`,
+            brokerWorkspacesDatabase: `auth:org:${s}:workspacesDatabaseUrl`,
             mailAdminKey: `stalwart:org:${s}:admin`,
             filesManagement: `files:org:${s}:managementKey`,
             filesIntrospection: `zitadel:org:${s}:files:introspection`,

package/dist/plan/plan-apply.d.ts

@@ -1,4 +1,6 @@
 import type { DestroyProgress, PlanApply } from '../apply.js';
+import type { SealResult } from '../audit/seal.js';
+import { type AuditSealingOptions } from '../audit/tick.js';
 import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
@@ -12,6 +14,7 @@ import { type MoveGatePorts } from './backup-gate.js';
 import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
 import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
+import type { GithubDeployKeysPort } from './github-deploy-keys.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
 import { type OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
@@ -249,6 +252,14 @@ export interface StepExecutor {
      * without it leaves the option as the answer.
      */
     ownBrokerPort?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /**
+     * Whether the host can make the broker's workspaces database: it can hold the URL and the broker and the held keys
+     * were just read and have none. Read only for an org whose entry declares workspaces and only while
+     * {@link brokerHasWorkspacesDatabase} is false. Optional: without it the plan only reports the entry blocked.
+     */
+    canProvisionWorkspacesDatabase?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /** Whether the broker this org's entries are written to has `WORKSPACES_DATABASE_URL`. Read only for an org whose entry declares workspaces. */
+    brokerHasWorkspacesDatabase?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
     /**
      * Every secret this executor minted or read so far (peer password, bridge
      * secret, invite code and link). The host's run adds them to its redactor
@@ -462,6 +473,8 @@ export interface FoundryApplyOptions {
         typed: string;
         /** The removed entry's gate keys, read by the caller from the company before the change. */
         gates?: readonly string[];
+        /** The paths the entry's private pages had before the change, for an entry that still exists: their `pp-`/`wp-` gate deletes pass with its confirmation. */
+        privatePages?: readonly string[];
     };
 }
 export interface FoundryPlanApplyOptions {
@@ -550,6 +563,8 @@ export interface FoundryPlanApplyOptions {
     workerApps?: boolean;
     /** ADR 0002: the keys custody Worker address, when the executor has a `KeysCustodyPort`. A `keysCustody` secret is blocked without it. */
     workerAppKeysUrl?: string;
+    /** F7: the keys service's registrar address, when the executor has a `KeysRegistrarPort`. */
+    keysRegistrarUrl?: string;
     /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
     workerAppDatabase?: boolean;
     /** ADR 0002: the platform's Cloudflare account id. A container image outside its registry is blocked. */
@@ -604,6 +619,16 @@ export interface FoundryPlanApplyOptions {
      * the release runner. Without it no release runs, in an apply or in {@link FoundryPlanApply.runReleaseTick}.
      */
     releaseStore?: ReleaseStore;
+    /**
+     * F12: the GitHub deploy-key client (`createGithubDeployKeys`), to ask which deploy keys an entry's repo has.
+     * Without it an entry with `uses.repo` is reported blocked and nothing else changes.
+     */
+    githubDeployKeys?: GithubDeployKeysPort;
+    /**
+     * `uses.audit` (foundry#929): what {@link FoundryPlanApply.runAuditSealTick} seals with. Without it the tick
+     * seals nothing and logs that it was not given.
+     */
+    auditSealing?: AuditSealingOptions;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -693,6 +718,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly edgeWorkers;
     private readonly workerApps;
     private readonly workerAppKeysUrl;
+    private readonly keysRegistrarUrl;
     private readonly workerAppDatabase;
     private readonly workerAppRegistryAccountId;
     private readonly ownerInviteMail;
@@ -709,6 +735,8 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly platformDeps;
     private readonly runner;
     private readonly releaseStore;
+    private readonly githubDeployKeys;
+    private readonly auditSealing;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     /**
@@ -872,6 +900,13 @@ export declare class FoundryPlanApply implements PlanApply {
         target: string;
         error?: string;
     }>>;
+    /**
+     * The recurring audit sealing run (foundry#929): seals every ledger registered by an `audit:ledger` step with the
+     * platform signer and has the timestamp authority stamp the new checkpoints. Foundry has no scheduler, so the host
+     * calls this every `AUDIT_SEAL_EVERY_MINUTES` (15). One ledger failing never stops the others; each result and a
+     * log line say what happened and why when nothing did. It writes nothing to the org's records.
+     */
+    runAuditSealTick(): Promise<SealResult[]>;
     private runOrgReleaseTick;
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     private readSfuPortsOpen;
@@ -891,6 +926,10 @@ export declare class FoundryPlanApply implements PlanApply {
      * org step that needs one is blocked.
      */
     private orgPlatformReadiness;
+    /** F12: asks GitHub about the repo of each entry with a deploy key to make, check or remove. Never throws; a failure is a plain line. */
+    private repoKeysReadiness;
+    /** Which refs of the platform GitHub App hold no value now. A resolver that throws counts as not held; only refs are kept. */
+    private githubAppKeysReadiness;
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as

package/dist/plan/plan-apply.js

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
+import { runAuditSealTick } from '../audit/tick.js';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { sfuSlotPorts } from '../calls-sfu.js';
 import { ORG_SERVICE_SCHEMAS, heldEnvRef, ownsServices, validateHosting } from '../org.js';
@@ -8,6 +9,7 @@ import { StaleLeaseError, } from '../store.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
+import { APPS_DB_ENTRY_KEY } from './apps-db-route.js';
 import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
 import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, blueGreenSubjects, declaresBlueGreen, lbOrigin, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
@@ -15,22 +17,27 @@ import { LEGACY_BACKUP_NAMES } from './company-backups.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
-import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
+import { BOULE_EDGE_ENTRY_KEY, bouleEdgeKeyWanted, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
+import { probeRepoKeys, repoKeyProbeTargets, repoKeysInPlay, } from './entry-repo-key.js';
+import { PLATFORM_GITHUB_APP_REFS } from './held-key-refs.js';
+import { KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, } from './keys-registrar.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { hostingNames } from './locked-hostnames.js';
 import { agoraIssuerHostFor, loginHostServesAgora, readLoginHostDiscovery, } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_MAX, OWN_MAIL_SMTP_PORT_SCOPE_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, isOwnMailSmtpPort, mailRelayFingerprint, } from './mail-relay.js';
+import { ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY } from './org-apps-admin.js';
 import { findNameClashes, nameClashMessage } from './org-names.js';
 import { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, invalidMigrationConfirmation, migrateHomeOf, parseMigrationConfirmation, } from './org-postgres-migrate.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerJobsPublicUrl, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
-import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
+import { privatePageGateKey } from './private-pages.js';
+import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { runSubjectRelease } from './release-host.js';
-import { remoteDatabaseFactsFrom } from './remote-database.js';
+import { remoteDatabaseFactsFrom, remoteDatabaseKeys } from './remote-database.js';
 import { liveWorkerApps, workerAppTraceScopeKeys } from './worker-app.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
@@ -129,7 +136,10 @@ const HOSTNAME_STEPS = new Set([
     'coolify:bluegreen',
     'coolify:bluegreen-lb',
     'coolify:bluegreen-connector',
+    'coolify:workspace',
+    'coolify:promote',
     'coolify:broker-entry',
+    'coolify:workspace-broker-entry',
     'coolify:database',
     'cloudflare:tunnel',
     'cloudflare:access',
@@ -173,6 +183,7 @@ export class FoundryPlanApply {
     edgeWorkers;
     workerApps;
     workerAppKeysUrl;
+    keysRegistrarUrl;
     workerAppDatabase;
     workerAppRegistryAccountId;
     ownerInviteMail;
@@ -189,7 +200,11 @@ export class FoundryPlanApply {
     platformDeps;
     runner;
     releaseStore;
+    githubDeployKeys;
+    auditSealing;
     constructor(options) {
+        this.githubDeployKeys = options.githubDeployKeys;
+        this.auditSealing = options.auditSealing;
         this.store = options.store;
         this.readers = options.readers;
         this.executor = options.executor;
@@ -211,6 +226,7 @@ export class FoundryPlanApply {
         this.edgeWorkers = options.edgeWorkers ?? false;
         this.workerApps = options.workerApps ?? false;
         this.workerAppKeysUrl = options.workerAppKeysUrl;
+        this.keysRegistrarUrl = options.keysRegistrarUrl;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
         this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
         this.ownerInviteMail = options.ownerInviteMail ?? false;
@@ -796,6 +812,7 @@ export class FoundryPlanApply {
                             // The tunnel is gone, so what was written into it is too.
                             delete serviceIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY];
                             delete serviceIds[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+                            delete serviceIds[CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY];
                         }
                         if (target.system === 'cloudflare' && target.kind === 'worker') {
                             // #318: its partial-deploy traces too, or a retry after a later
@@ -1249,6 +1266,37 @@ export class FoundryPlanApply {
         }
         return results;
     }
+    /**
+     * The recurring audit sealing run (foundry#929): seals every ledger registered by an `audit:ledger` step with the
+     * platform signer and has the timestamp authority stamp the new checkpoints. Foundry has no scheduler, so the host
+     * calls this every `AUDIT_SEAL_EVERY_MINUTES` (15). One ledger failing never stops the others; each result and a
+     * log line say what happened and why when nothing did. It writes nothing to the org's records.
+     */
+    async runAuditSealTick() {
+        const orgs = await this.store.list();
+        const options = this.auditSealing;
+        if (!options) {
+            if (orgs.some((org) => org.hosting.enabled && org.hosting.entries.some((e) => e.uses?.audit === true))) {
+                console.info('audit sealing: the host gave no auditSealing options, so no ledger is sealed');
+            }
+            return [];
+        }
+        const recorded = new Map();
+        return runAuditSealTick({
+            ...options,
+            orgs,
+            now: this.now,
+            recorded: async (org) => {
+                const cached = recorded.get(org.id);
+                if (cached)
+                    return cached;
+                const ids = (await this.store.getAppliedState(org.id))?.serviceIds ?? {};
+                recorded.set(org.id, ids);
+                return ids;
+            },
+            allowed: (org) => this.authz.canApply(this.actor, org.id),
+        });
+    }
     async runOrgReleaseTick(id) {
         const empty = { orgId: id, steps: [], unmanaged: [] };
         if (!(await this.authz.canApply(this.actor, id))) {
@@ -1317,6 +1365,12 @@ export class FoundryPlanApply {
         const stageSinkDown = sinkId && recorded.stage_sink_applied && declaresBlueGreen(org) && this.executor.stageSinkDown
             ? await this.executor.stageSinkDown(sinkId).catch(() => false)
             : false;
+        const brokerWorkspacesDatabase = org.hosting.entries.some((e) => e.uses?.auth?.workspaces)
+            ? ((await this.executor.brokerHasWorkspacesDatabase?.(org, recorded)) ?? false)
+            : false;
+        const provisionWorkspacesDatabase = !brokerWorkspacesDatabase && org.hosting.entries.some((e) => e.uses?.auth?.workspaces)
+            ? ((await this.executor.canProvisionWorkspacesDatabase?.(org, recorded)) ?? false)
+            : false;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
             loginHostClientOrganizations: this.loginHostClientOrganizations,
@@ -1326,12 +1380,15 @@ export class FoundryPlanApply {
             zitadelRedirectUris: this.zitadelRedirectUris,
             zitadelMcp: this.zitadelMcp,
             zitadelOrgMetadata: this.zitadelOrgMetadata,
+            brokerWorkspacesDatabase,
+            provisionWorkspacesDatabase,
             broker: ownsServices(org) && this.hostOwnServices && this.executor.ownBrokerPort
                 ? await this.executor.ownBrokerPort(org, recorded)
                 : this.broker,
             edgeWorkers: this.edgeWorkers,
             workerApps: this.workerApps,
             workerAppKeysUrl: this.workerAppKeysUrl,
+            keysRegistrarUrl: this.keysRegistrarUrl,
             workerAppDatabase: this.workerAppDatabase,
             workerAppRegistryAccountId: this.workerAppRegistryAccountId,
             ownerInviteMail: this.ownerInviteMail,
@@ -1462,6 +1519,10 @@ export class FoundryPlanApply {
         const base = {
             ...(await this.sharedPlatformReadiness()),
             heldEnv: await this.heldEnvReadiness(org),
+            ...(org.hosting.github ? { githubAppKeys: await this.githubAppKeysReadiness() } : {}),
+            ...(repoKeysInPlay(org, orgRecordedIds)
+                ? { repoKeys: await this.repoKeysReadiness(org, orgRecordedIds) }
+                : {}),
         };
         const platform = await this.platformDeps?.store.get();
         // The auth release gates the shared-host organisation check and the cookie domain of every company.
@@ -1474,6 +1535,37 @@ export class FoundryPlanApply {
         const readiness = orgPlatformReadinessFor(org, base, orgRecordedIds, held ? await heldOwnKeyRefs(held, org) : new Set());
         return withRefs(readiness);
     }
+    /** F12: asks GitHub about the repo of each entry with a deploy key to make, check or remove. Never throws; a failure is a plain line. */
+    async repoKeysReadiness(org, recorded) {
+        const port = this.githubDeployKeys;
+        if (!port)
+            return { store: false, probes: {} };
+        const probes = {};
+        for (const { entryKey, target } of repoKeyProbeTargets(org, recorded)) {
+            probes[entryKey] = await probeRepoKeys(port, target);
+        }
+        return { store: true, probes };
+    }
+    /** Which refs of the platform GitHub App hold no value now. A resolver that throws counts as not held; only refs are kept. */
+    async githubAppKeysReadiness() {
+        const heldKeys = this.platformDeps?.heldKeys;
+        if (!heldKeys)
+            return { store: false, missing: [] };
+        const missing = [];
+        for (const ref of Object.values(PLATFORM_GITHUB_APP_REFS)) {
+            let held;
+            try {
+                held = await heldKeys.resolve(ref);
+            }
+            catch {
+                // Not held: the plan reports the ref, and the error is dropped.
+                held = null;
+            }
+            if (!held)
+                missing.push(ref);
+        }
+        return { store: true, missing };
+    }
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as
@@ -1614,8 +1706,10 @@ export class FoundryPlanApply {
         const ownerRecorded = ownerOrg
             ? (await this.store.getAppliedState(ownerOrg.id))?.serviceIds
             : {};
+        const jobsPublicUrl = ownerJobsPublicUrl(ownerRecorded);
         return {
             ...readiness,
+            ...(jobsPublicUrl ? { jobsPublicUrl } : {}),
             platformOwnerUserId: platformOwnerUserIdFrom(ownerOrg, ownerRecorded ?? {}),
             mailKeyHeld,
             canHoldSecrets: typeof heldKeys?.put === 'function',
@@ -1888,6 +1982,9 @@ export function stepEntryKey(step, orgId, entries = []) {
     }
     const entryOwned = (system === 'coolify' && kind === 'app') ||
         (system === 'cloudflare' && (kind === 'worker' || kind === 'worker-app' || kind === 'gate')) ||
+        (system === 'jobs' && kind === 'project') ||
+        (system === 'github' && kind === 'deploy-key') ||
+        (system === 'audit' && kind === 'ledger') ||
         (kind === 'key' && (system === 'ai' || system === 'edge' || system === 'files'));
     if (!entryOwned)
         return null;
@@ -1914,7 +2011,8 @@ function isOrgDatabasePark(step, orgId) {
 }
 /**
  * The delete of one of the org's gates that no entry declares any more. The step names only the
- * gate, so the caller names the removed entry's gates (`entryConfirmation.gates`) and only those pass.
+ * gate, so the caller names the removed entry's gates (`entryConfirmation.gates`), or the former paths of a
+ * remaining entry's private pages (`entryConfirmation.privatePages`), and only those pass.
  */
 function isUndeclaredGateDelete(step, orgId) {
     const { system, kind, key, desired } = step.action;
@@ -1923,6 +2021,10 @@ function isUndeclaredGateDelete(step, orgId) {
         key.startsWith(`${orgId}:`) &&
         desired?.mode === 'delete');
 }
+/** Whether `gateKey` is the gate of a page the confirmed entry had (live or workspace) and has no more. */
+function isFormerPrivatePageGate(gateKey, confirmation) {
+    return (confirmation.privatePages ?? []).some((path) => ['live', 'workspace'].some((scope) => privatePageGateKey(scope, confirmation.entryKey, path) === gateKey));
+}
 /** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
 export function entryConfirms(confirmation, steps, orgId, entries) {
     if (!confirmation ||
@@ -1936,8 +2038,9 @@ export function entryConfirms(confirmation, steps, orgId, entries) {
         (isOrgDatabasePark(planned, orgId) && !entries.some(entryHasDatabase)) ||
         (isUndeclaredGateDelete(planned, orgId) &&
             !planned.step.migrates &&
-            (confirmation.gates ?? []).includes(planned.action.key.slice(orgId.length + 1)) &&
-            !entries.some((e) => e.key === confirmation.entryKey)));
+            (entries.some((e) => e.key === confirmation.entryKey)
+                ? isFormerPrivatePageGate(planned.action.key.slice(orgId.length + 1), confirmation)
+                : (confirmation.gates ?? []).includes(planned.action.key.slice(orgId.length + 1)))));
 }
 /** `AppliedState.serviceIds`' two flat ZITADEL scope keys (`executor.ts`'s `ensureZitadelProject`/`zitadelIssuer`) -- no `:`, unlike a resource key. */
 const ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_project';
@@ -1987,9 +2090,13 @@ function destroyTargets(serviceIds, orgId) {
         'cloudflare:worker-app:',
         'coolify:database:',
         'coolify:app:',
+        // The company's GitHub source, after its apps; the shared private key it uses is left alone.
+        'coolify:github-source:',
         // An own files host's storage key: the token id is the step's recorded resource id.
         'coolify:own-files-r2:',
         'zitadel:customers:',
+        // The workspaces' test customers organisation.
+        'zitadel:customers-test:',
         // F6a: an entry's ai key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
         'ai:key:',
         // F6b: an entry's files key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
@@ -2083,6 +2190,21 @@ function destroyTargets(serviceIds, orgId) {
             continue;
         targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
     }
+    // F7: the signed-records registrar key, live or minted and never delivered, is revoked with the org.
+    for (const [what, scopeKey] of [
+        ['live', KEYS_REGISTRAR_SCOPE_KEY],
+        ['undelivered', KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY],
+    ]) {
+        const id = serviceIds[scopeKey];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'keys-registrar', key: what, id });
+    }
+    // A mint whose answer was lost may have left a key no id points at: the company's registrar keys all go.
+    if (serviceIds[KEYS_REGISTRAR_SCOPE_KEY] ||
+        serviceIds[KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY] ||
+        serviceIds[KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY]) {
+        targets.push({ system: 'coolify', kind: 'keys-registrar', key: 'all', id: orgId });
+    }
     // A storage key minted but never delivered has no main id; its token is deleted too.
     const r2Undelivered = serviceIds[OWN_FILES_R2_UNDELIVERED_SCOPE_KEY];
     if (r2Undelivered) {
@@ -2198,12 +2320,15 @@ const STEP_FIELDS = {
     'zitadel:issuer': 'issuer.usesDomain',
     'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
+    'zitadel:customers-test': 'hosting.entries.workspace',
     'zitadel:id-token-userinfo': 'hosting.entries.uses.auth',
     'zitadel:desktop-callback': 'hosting.entries.uses.auth',
     'zitadel:mcp-project': 'hosting.entries.uses.auth.mcp',
     'zitadel:mcp-access': 'hosting.entries.uses.auth.mcp',
     'zitadel:access-token-lifetime': 'hosting.entries.uses.auth.mcp',
     'coolify:broker-entry': 'hosting.entries.uses.auth',
+    'coolify:workspace-broker-entry': 'hosting.entries.workspace',
+    'coolify:workspaces-database': 'hosting.entries.uses.auth.workspaces',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
     'coolify:own-auth': 'services.own',
@@ -2212,6 +2337,7 @@ const STEP_FIELDS = {
     'coolify:own-files': 'services.own',
     'coolify:own-files-r2': 'services.own',
     'coolify:own-jobs': 'services.own',
+    'coolify:own-jobs-route': 'services.own',
     'coolify:own-mail': 'services.own',
     'coolify:own-sfu': 'services.own',
     'coolify:calls': 'calls.enabled',
@@ -2221,9 +2347,12 @@ const STEP_FIELDS = {
     'ai:key': 'ai',
     'cms:site': 'site',
     'coolify:app': 'hosting.enabled',
+    'coolify:github-source': 'hosting.github',
     'coolify:bluegreen': 'hosting.entries.blueGreen',
     'coolify:bluegreen-lb': 'hosting.entries.blueGreen',
     'coolify:bluegreen-connector': 'hosting.entries.blueGreen',
+    'coolify:workspace': 'hosting.entries.workspace',
+    'coolify:promote': 'hosting.entries.liveCommit',
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',
@@ -2232,6 +2361,10 @@ const STEP_FIELDS = {
     'cloudflare:ratelimit': 'hosting.usesDomain',
     'cloudflare:worker': 'hosting.entries.worker',
     'cloudflare:worker-app': 'hosting.entries.workerApp',
+    // F4 (#925): both hang off the company's Apps switch.
+    'coolify:org-apps-admin': 'boule.apps',
+    'cloudflare:apps-db-route': 'boule.apps',
+    'cloudflare:apps-zones': 'boule.apps',
 };
 function stepField(action) {
     if (action.system === 'coolify' &&
@@ -2249,6 +2382,15 @@ function stepField(action) {
     // An entry's edge key (F7): always `<orgId>:<entry>`, edge has no org-root key.
     if (action.system === 'edge' && action.kind === 'key')
         return 'hosting.entries.uses.edge';
+    // An entry's jobs project: always `<orgId>:<entry>`.
+    if (action.system === 'jobs' && action.kind === 'project')
+        return 'hosting.entries.uses.jobs';
+    // An entry's audit ledger registration: always `<orgId>:<entry>`.
+    if (action.system === 'audit' && action.kind === 'ledger')
+        return 'hosting.entries.uses.audit';
+    // An entry's deploy key for its own repo (F12): always `<orgId>:<entry>`.
+    if (action.system === 'github' && action.kind === 'deploy-key')
+        return 'hosting.entries.uses.repo';
     // An org declares several issuer apps, each keyed by its name (#71).
     if (action.system === 'zitadel' && action.kind === 'app') {
         return `hosting.issuerApps.${action.key}`;
@@ -2257,6 +2399,10 @@ function stepField(action) {
     if (action.system === 'cloudflare' && action.kind === 'access' && action.desired.ownedBypass) {
         return 'hosting.entries.gates';
     }
+    // F11: a bypass for a machine path of a gated entry.
+    if (action.system === 'cloudflare' && action.kind === 'access' && action.desired.machineBypass) {
+        return 'hosting.entries.uses';
+    }
     return STEP_FIELDS[`${action.system}:${action.kind}`] ?? `${action.system}.${action.kind}`;
 }
 /**
@@ -2312,10 +2458,18 @@ function failedFields(org, detail, completed, serviceIds) {
             failed.add('hosting.entries.uses.edge');
         }
     }
-    // F3: Boule's own key, wanted whenever the org has a domain.
-    if (org.domain && serviceIds[entryEdgeUndeliveredScopeKey(BOULE_EDGE_ENTRY_KEY)]) {
+    // F3: Boule's own key, wanted whenever the org has a domain or its Boule runs apps.
+    if (bouleEdgeKeyWanted(org) && serviceIds[entryEdgeUndeliveredScopeKey(BOULE_EDGE_ENTRY_KEY)]) {
         failed.add('hosting.entries.uses.edge');
     }
+    // F7: a registrar key minted and never delivered stays unresolved until a later apply revokes it.
+    if (serviceIds[KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY])
+        failed.add('boule.apps');
+    // F4 (#925): the same for an apps admin role or a route service token minted and never delivered.
+    if (serviceIds[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY] ||
+        serviceIds[remoteDatabaseKeys(APPS_DB_ENTRY_KEY).undelivered]) {
+        failed.add('boule.apps');
+    }
     // The same for a jobs registration whose credentials never reached the host.
     if (serviceIds[JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY] &&
         !serviceIds[`jobs:registration:${org.id}`]) {

package/dist/plan/platform-diff.d.ts

@@ -1416,8 +1416,8 @@ export declare const JOBS_SCHEDULER_KEY = "jobs";
 /**
  * The scheduler's address on the Coolify network (`http://<custom_internal_name>:8080`),
  * the value the org steps' jobs port and Archon's `JOBS_URL` are read from.
- * Not a secret. The scheduler's public hostname has no tunnel and no DNS
- * record, so nothing on the platform can reach it there.
+ * Not a secret. Only containers on that network reach it; an entry's app uses
+ * the owner company's public origin `JOBS_PUBLIC_URL_SCOPE_KEY` (`own-jobs-route.ts`) instead.
  */
 export declare const JOBS_INTERNAL_URL_SCOPE_KEY = "jobs_internal_url";
 /**