@wtfalch/foundry 0.69.0 → 0.70.1

package/dist/plan/platform-providers.d.ts

@@ -28,6 +28,7 @@ export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { type PlatformGithubReleaseHookDeps } from './github-release-hook.js';
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
+import { type PlatformUsageTailDeps } from './usage-tail-worker.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
 export declare function apexZoneKey(apex: string): string;
 /**
@@ -326,6 +327,12 @@ export interface FoundryPlatformStepExecutorOptions {
      * the same reason as `auth`; without it the step is reported blocked.
      */
     uptime?: PlatformUptimeDeps;
+    /**
+     * foundry#1024: dependencies for the usage tail Worker step
+     * (`cloudflare:worker` keyed {@link PLATFORM_USAGE_TAIL_KEY}) -- optional
+     * for the same reason as `auth`; without it the step is reported blocked.
+     */
+    usageTail?: PlatformUsageTailDeps;
     /**
      * #604: dependencies for the `cloudflare:access-provider` step -- optional
      * for the same reason as `auth`; edge and sign-in applied with this unset
@@ -362,6 +369,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly registry?;
     private readonly heartbeats?;
     private readonly uptime?;
+    private readonly usageTail?;
     private readonly accessProvider?;
     private readonly oikosIngress?;
     private readonly githubReleaseHook?;
@@ -401,6 +409,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         auth?: string;
         authExecutorMissing?: boolean;
         authOtherInputsMissing?: string[];
+        authMailKeyHeld?: boolean;
         authOwnerInvite?: string;
         files?: string;
         integrations?: string;
@@ -427,6 +436,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
             pending: boolean;
             blocked?: string;
         };
+        usageTail?: string;
         githubReleaseHook?: string;
         githubReleaseHookReady?: boolean;
         githubReleaseHookHash?: string;
@@ -449,6 +459,12 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
      * they hold.
      */
     private uptimeBlocked;
+    /**
+     * foundry#1024: why the usage tail Worker cannot run yet. A lost key is
+     * not a block here: the step mints a new one. The planner checks the pin
+     * and edge first, so none of the reads here happens before they hold.
+     */
+    private usageTailBlocked;
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
      * emails, or (#211 round 4) the broker it last registered with no longer

package/dist/plan/platform-providers.js

@@ -33,7 +33,7 @@ import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAI
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, orgDeclaresMcp, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeTicksSyncValue, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_HOOK_DEPS_MISSING, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TICKS_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_APPLIED_USAGE_TAIL_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, authLoginEnvMarker, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, orgDeclaresMcp, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeTicksSyncValue, uptimeVarsDigest, usageTailEdgeEnv, usageTailEdgeEnvValue, usageTailRecorded, } from './platform-diff.js';
 import { PLATFORM_REGISTRY_KEY, PLATFORM_REGISTRY_LOGINS_KEY, PLATFORM_REGISTRY_PASSWORDS_SET_SCOPE_KEY, PLATFORM_REGISTRY_PULL_PASSWORD_REF, registryImageTagBlocked, } from './platform-registry-keys.js';
 import { ensureRegistryLogins, provisionPlatformRegistry, registryLoginsDrifted, } from './platform-registry.js';
 import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
@@ -47,6 +47,7 @@ export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { githubReleaseHookPlanInputs, provisionGithubReleaseHook, } from './github-release-hook.js';
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
+import { provisionPlatformUsageTail } from './usage-tail-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, waitForSystemApi, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
 export function apexZoneKey(apex) {
@@ -152,6 +153,7 @@ export class FoundryPlatformStepExecutor {
     registry;
     heartbeats;
     uptime;
+    usageTail;
     accessProvider;
     oikosIngress;
     githubReleaseHook;
@@ -174,6 +176,7 @@ export class FoundryPlatformStepExecutor {
         this.registry = options.registry;
         this.heartbeats = options.heartbeats;
         this.uptime = options.uptime;
+        this.usageTail = options.usageTail;
         this.accessProvider = options.accessProvider;
         this.oikosIngress = options.oikosIngress;
         this.githubReleaseHook = options.githubReleaseHook;
@@ -407,7 +410,7 @@ export class FoundryPlatformStepExecutor {
             blocked.authExecutorMissing = true;
         }
         else if (platform.auth.enabled && this.auth) {
-            const { reason: authBlocked, otherInputsMissing } = await authBrokerBlockedReason(this.auth, recordedIds);
+            const { reason: authBlocked, otherInputsMissing, mailKeyHeld, } = await authBrokerBlockedReason(this.auth, recordedIds);
             if (authBlocked) {
                 blocked.auth = authBlocked;
             }
@@ -424,6 +427,9 @@ export class FoundryPlatformStepExecutor {
             // #216 round 5: see `PlanPlatformOptions.blocked.authOtherInputsMissing`.
             if (otherInputsMissing.length > 0)
                 blocked.authOtherInputsMissing = otherInputsMissing;
+            // Without the held key `provisionAuthStack` never records the login env marker, so the plan must not ask for it.
+            if (mailKeyHeld !== undefined)
+                blocked.authMailKeyHeld = mailKeyHeld;
             // C3: the owner's invite needs a work address and the host's mail port. Without them it is
             // a blocked item, never a throw on every apply.
             const ownerCompany = await this.declaredOrgStore.get(platform.ownerOrgId);
@@ -612,6 +618,7 @@ export class FoundryPlatformStepExecutor {
                 blocked.heartbeatsApiKeyMissing = true;
         }
         await this.uptimeBlocked(platform, recordedIds, blocked, owner);
+        await this.usageTailBlocked(platform, recordedIds, blocked);
         if (platform.archon.enabled && !this.githubReleaseHook) {
             blocked.githubReleaseHook = GITHUB_RELEASE_HOOK_DEPS_MISSING;
         }
@@ -797,6 +804,38 @@ export class FoundryPlatformStepExecutor {
             }
         }
     }
+    /**
+     * foundry#1024: why the usage tail Worker cannot run yet. A lost key is
+     * not a block here: the step mints a new one. The planner checks the pin
+     * and edge first, so none of the reads here happens before they hold.
+     */
+    async usageTailBlocked(platform, recordedIds, blocked) {
+        const deployed = Boolean(recordedIds[`cloudflare:worker:${PLATFORM_USAGE_TAIL_KEY}`]) &&
+            !recordedIds[PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY];
+        if (!platform.usageTail.enabled && !usageTailRecorded(recordedIds))
+            return;
+        const deps = this.usageTail;
+        if (!deps) {
+            blocked.usageTail =
+                'the usage tail Worker is blocked, not planned: the host built the platform executor without its usage-tail dependencies';
+            return;
+        }
+        if (!platform.usageTail.enabled)
+            return;
+        const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+        if (!deployed && edgeUrl && platform.usageTail.tag) {
+            try {
+                const workers = await deps.workers(edgeUrl);
+                if (await workers.scriptExists(PLATFORM_USAGE_TAIL_SCRIPT_NAME)) {
+                    blocked.usageTail = `the usage tail Worker is blocked, not planned: a Worker named ${PLATFORM_USAGE_TAIL_SCRIPT_NAME} already exists at Cloudflare and foundry did not make it; remove it by hand`;
+                }
+            }
+            catch {
+                blocked.usageTail =
+                    'the usage tail Worker is blocked, not planned: edge could not be asked whether the Worker exists';
+            }
+        }
+    }
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
      * emails, or (#211 round 4) the broker it last registered with no longer
@@ -1156,6 +1195,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformUptime(context, this.uptime);
         }
+        if (action.system === 'cloudflare' &&
+            action.kind === 'worker' &&
+            action.key === PLATFORM_USAGE_TAIL_KEY) {
+            if (!this.usageTail) {
+                throw new Error('platform:usage-tail needs FoundryPlatformStepExecutor to be constructed with its usage-tail dependencies (foundry#1024)');
+            }
+            return provisionPlatformUsageTail(context, this.usageTail);
+        }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
             action.key === PLATFORM_OIKOS_INGRESS_KEY) {
@@ -2239,7 +2286,16 @@ export async function provisionAuthStack(scope, deps, target, input) {
         await waitHealthy(withCallTimeout(deps.coolify), zitadelAppId, runtime, label, 'ZITADEL');
         await record(SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, '');
     }
-    if (loginApp.justCreated || !loginApp.running || loginEnvsChanged || authRefChanged) {
+    // The mail env counts as live only once the login apps were deployed after it was written: a run that
+    // died between the write and the deploy leaves the marker unset, and the next run sees no env diff.
+    const loginEnvUnconfirmed = Boolean(heldMailKey &&
+        input.smtpSender &&
+        recorded[PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY] !== authLoginEnvMarker(input.smtpSender));
+    if (loginApp.justCreated ||
+        !loginApp.running ||
+        loginEnvsChanged ||
+        loginEnvUnconfirmed ||
+        authRefChanged) {
         await deps.coolify.deploy(loginAppId);
     }
     // The key counts as live only once the app was deployed after it was written: a crash between the write
@@ -2251,11 +2307,17 @@ export async function provisionAuthStack(scope, deps, target, input) {
             signInEnvsChanged ||
             bindKeyWritten ||
             bindKeyUnconfirmed ||
+            loginEnvUnconfirmed ||
             authRefChanged)) {
         await deps.coolify.deploy(signInApp.appId);
         if (input.signInLogin)
             await record(SIGN_IN_BIND_KEY_SCOPE_KEY, '1');
     }
+    // The mail env is live on the login apps: written above and deployed with them. Without the held
+    // key the marker stays unset, so the step is planned again once the key is held.
+    if (heldMailKey && input.smtpSender) {
+        await record(PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, authLoginEnvMarker(input.smtpSender));
+    }
     // #211: the broker's own `server.ts` refuses to start without
     // `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` and `LETTERMINT_API_TOKEN` --
     // deploying it without them only produces a container that crash-loops
@@ -4022,8 +4084,9 @@ async function authBrokerBlockedReason(auth, recordedIds) {
     // #210: and `LETTERMINT_API_TOKEN`, once held -- see this function's own
     // doc comment.
     const otherInputsMissing = missing.filter((m) => m !== 'ZITADEL_SERVICE_USER_TOKEN' && !(m === 'LETTERMINT_API_TOKEN' && heldMailKey));
+    const mailKeyHeld = Boolean(heldMailKey);
     if (missing.length === 0)
-        return { reason: null, otherInputsMissing };
+        return { reason: null, otherInputsMissing, mailKeyHeld };
     // #210: say where the operator seals the Lettermint key, not only its env name.
     const named = (names) => names.map((m) => m === 'LETTERMINT_API_TOKEN'
         ? `LETTERMINT_API_TOKEN (seal it under the held-key ref ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF})`
@@ -4036,6 +4099,7 @@ async function authBrokerBlockedReason(auth, recordedIds) {
         return {
             reason: `the platform's sign-in broker ${brokerAppId} is blocked, not deployed: its AUTH_APPS is malformed${otherSuffix}`,
             otherInputsMissing,
+            mailKeyHeld,
         };
     }
     // AUTH_APPS isn't gated on #209/#210 the way the two tokens are; only cite
@@ -4044,6 +4108,7 @@ async function authBrokerBlockedReason(auth, recordedIds) {
     return {
         reason: `the platform's sign-in broker is created but not deployed, blocked: it has no ${named(missing).join(' and no ')} yet${suffix}`,
         otherInputsMissing,
+        mailKeyHeld,
     };
 }
 /** Polls until Coolify reports the mail app stopped, so a healthy answer read afterwards is the new deployment's. */
@@ -8119,6 +8184,12 @@ async function edgeBlockedReason(names) {
  * - `EDGE_TRUST_CF_CONNECTING_IP` is always written `true` rather than
  *   left to the host's own default, since this step always puts the
  *   runner behind the Cloudflare tunnel it also creates.
+ *
+ * foundry#1024: `USAGE_TAIL_WORKER` and `EDGE_USAGE_KEY_HASH` ({@link usageTailEdgeEnv})
+ * are written on every run too, once the usage tail Worker step has deployed
+ * and holds its key; `planEdge` replans this step while the recorded
+ * {@link PLATFORM_EDGE_APPLIED_USAGE_TAIL_SCOPE_KEY} differs from what is
+ * now desired, the same way a changed hostname or `gitRef` does.
  */
 async function provisionPlatformEdge(context, deps) {
     const { platform } = context;
@@ -8228,6 +8299,10 @@ async function provisionPlatformEdge(context, deps) {
         await record(PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, keyHash);
     }
     // ---- base env, written on every run --------------------------------------
+    // foundry#1024: the usage tail Worker's name and the hash of its key, so
+    // every company script can name it as its tail consumer and edge's ingest
+    // route can accept the key. Absent while the Worker is not deployed yet.
+    const usageTailEnv = usageTailEdgeEnv(recorded);
     await deps.coolify.bulkUpsertEnvs(appId, [
         { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
         { key: 'DATABASE_URL', value: runtimeUrl },
@@ -8237,6 +8312,12 @@ async function provisionPlatformEdge(context, deps) {
         { key: 'EDGE_TRUST_CF_CONNECTING_IP', value: 'true' },
         { key: 'NODE_ENV', value: 'production' },
         { key: 'EDGE_PLATFORM_KEY_HASH', value: keyHash },
+        ...(usageTailEnv
+            ? [
+                { key: 'USAGE_TAIL_WORKER', value: usageTailEnv.USAGE_TAIL_WORKER },
+                { key: 'EDGE_USAGE_KEY_HASH', value: usageTailEnv.EDGE_USAGE_KEY_HASH },
+            ]
+            : []),
         ...(await missingEnvs(deps.coolify, appId, PLATFORM_EDGE_RUNNER_DEFAULTS)),
     ]);
     // ---- deploy and wait, on edge's own address ---------------------------------
@@ -8297,6 +8378,7 @@ async function provisionPlatformEdge(context, deps) {
     }
     // Last: a run that failed anywhere above is planned again.
     context.recordScopeId(PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+    context.recordScopeId(PLATFORM_EDGE_APPLIED_USAGE_TAIL_SCOPE_KEY, usageTailEdgeEnvValue(recorded));
     await record(PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: appId };
 }

package/dist/plan/stage-env.js

@@ -19,6 +19,7 @@ export const STAGE_SIGN_IN_NAMES = [
     'AUTH_COOKIE_SECRET',
     'WORKSPACES_URL',
     'WORKSPACES_API_KEY',
+    'AUTH_EVENTS_SECRET',
     'MCP_AUDIENCE',
     'MCP_RESOURCE',
     'MCP_ISSUER',

package/dist/plan/stage-isolation.js

@@ -89,6 +89,7 @@ export const STAGE_ALLOWLIST = {
         'ANALYTICS_SITE_KEY',
         'WORKSPACES_URL',
         'WORKSPACES_API_KEY',
+        'AUTH_EVENTS_SECRET',
         'MCP_AUDIENCE',
         'MCP_RESOURCE',
         'MCP_ISSUER',

package/dist/plan/usage-tail-worker.d.ts

@@ -0,0 +1,29 @@
+import type { PlatformStepExecutionContext } from './plan-apply.js';
+import type { PlatformWorkersFactory } from './uptime-worker.js';
+/**
+ * Dependencies of the usage tail Worker step. `deliverSecret` and
+ * `heldKeys` are the host's: the minted key goes only to `deliverSecret`,
+ * and it is read back only to hand it to edge, which never returns one.
+ */
+export interface PlatformUsageTailDeps {
+    workers: PlatformWorkersFactory;
+    deliverSecret: (ref: string, secret: string) => Promise<void>;
+    heldKeys: {
+        resolve(ref: string): Promise<string | null>;
+    };
+    /** Tries per key delivery (rule 1), 3 by default. */
+    deliverAttempts?: number;
+    /** Waits between delivery tries; a real timer by default. */
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * foundry#1024: makes the usage tail Worker true. Upload the pinned edge
+ * release (the host fetches and verifies it) and record the script at once,
+ * so a later failure is a half-made Worker foundry owns. Then hold the key
+ * (minted once, its guard recorded as soon as its value is held) and set it
+ * on the Worker. The applied values are recorded only when all of it
+ * succeeded.
+ */
+export declare function provisionPlatformUsageTail(context: PlatformStepExecutionContext, deps: PlatformUsageTailDeps): Promise<{
+    resourceId?: string;
+}>;

package/dist/plan/usage-tail-worker.js

@@ -0,0 +1,105 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { usageTailArtifactUrl } from '../platform.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_KEY_REF, PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, } from './platform-diff.js';
+/** The date Cloudflare's Workers runtime compatibility is pinned to; no Workers feature here needs a later one. */
+const USAGE_TAIL_COMPATIBILITY_DATE = '2026-10-01';
+/**
+ * foundry#1024: makes the usage tail Worker true. Upload the pinned edge
+ * release (the host fetches and verifies it) and record the script at once,
+ * so a later failure is a half-made Worker foundry owns. Then hold the key
+ * (minted once, its guard recorded as soon as its value is held) and set it
+ * on the Worker. The applied values are recorded only when all of it
+ * succeeded.
+ */
+export async function provisionPlatformUsageTail(context, deps) {
+    const { platform } = context;
+    const { usageTail } = platform;
+    const recorded = context.recordedIds();
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`platform:usage-tail: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); the Worker is uploaded through it`);
+    }
+    const workers = await deps.workers(edgeUrl);
+    if (!usageTail.enabled) {
+        // Whatever of a (possibly half-made) deploy exists is removed; what does not exist is tolerated.
+        await workers.deleteScript(PLATFORM_USAGE_TAIL_SCRIPT_NAME);
+        await deps.deliverSecret(PLATFORM_USAGE_TAIL_KEY_REF, '');
+        for (const key of [
+            PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY,
+            PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY,
+            PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY,
+            PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY,
+        ]) {
+            context.recordScopeId(key, '');
+        }
+        context.recordScopeId(PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, '1');
+        return {};
+    }
+    if (!usageTail.tag || !usageTail.sha256) {
+        throw new Error('platform:usage-tail: no artifact is pinned (usageTail.tag, usageTail.sha256)');
+    }
+    // ---- the key, once ------------------------------------------------------
+    // The hash is never secret, so (the same pattern `provisionPlatformEdge`
+    // uses for `EDGE_PLATFORM_KEY_HASH`) it doubles as both the undelivered
+    // marker and the final recorded value: a marker with no guard means the
+    // mint may never have reached `deliverSecret`, so it is tried again with
+    // the same hash rather than minting a second key.
+    let keyHash = recorded[PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY] ?? '';
+    if (!keyHash) {
+        keyHash = recorded[PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY] ?? '';
+        let secret = keyHash ? await deps.heldKeys.resolve(PLATFORM_USAGE_TAIL_KEY_REF) : null;
+        if (!secret) {
+            secret = randomBytes(32).toString('base64url');
+            keyHash = createHash('sha256').update(secret).digest('hex');
+            context.recordScopeId(PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY, keyHash);
+            await context.persist?.();
+        }
+        await deliverKey(deps, secret);
+        context.recordScopeId(PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY, keyHash);
+        await context.persist?.();
+    }
+    // ---- the script ----------------------------------------------------------
+    await workers.uploadScript({
+        name: PLATFORM_USAGE_TAIL_SCRIPT_NAME,
+        artifactUrl: usageTailArtifactUrl(usageTail.tag),
+        artifactSha256: usageTail.sha256,
+        compatibilityDate: USAGE_TAIL_COMPATIBILITY_DATE,
+        bindings: [{ type: 'plain_text', name: 'EDGE_USAGE_URL', text: edgeUrl }],
+    });
+    // The script is foundry's from here on. Recorded now, not at the end: after
+    // a later failure the next plan must repair this Worker, not take it for a
+    // foreign one. "Fully applied" is the applied values recorded at the end.
+    context.recordScopeId(`cloudflare:worker:${PLATFORM_USAGE_TAIL_KEY}`, PLATFORM_USAGE_TAIL_SCRIPT_NAME);
+    context.recordScopeId(PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, '');
+    await context.persist?.();
+    // The key itself is read back only to hand it to the Worker (rule 6: it
+    // never reaches an error, a log, or a plan item); edge never returns it.
+    const secretValue = await deps.heldKeys.resolve(PLATFORM_USAGE_TAIL_KEY_REF);
+    if (!secretValue) {
+        throw new Error(`platform:usage-tail: the held key (${PLATFORM_USAGE_TAIL_KEY_REF}) is gone after it was minted; hold a new one to recover`);
+    }
+    await workers.setSecrets(PLATFORM_USAGE_TAIL_SCRIPT_NAME, [
+        { name: 'EDGE_USAGE_KEY', value: secretValue, version: keyHash },
+    ]);
+    // Last, after every write the applied values depend on.
+    context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, usageTail.tag);
+    context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, usageTail.sha256);
+    return { resourceId: PLATFORM_USAGE_TAIL_SCRIPT_NAME };
+}
+/** Rule 1: delivery is tried up to `deliverAttempts` times; the error names the ref only, never the cause. */
+async function deliverKey(deps, secret) {
+    const attempts = deps.deliverAttempts ?? 3;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await deps.deliverSecret(PLATFORM_USAGE_TAIL_KEY_REF, secret);
+            return;
+        }
+        catch {
+            if (attempt >= attempts) {
+                throw new Error(`platform:usage-tail: the key (${PLATFORM_USAGE_TAIL_KEY_REF}) could not be delivered after ${attempts} tries; it went nowhere, so the next apply mints a new one`);
+            }
+            await sleep(1000 * attempt);
+        }
+    }
+}

package/dist/plan/worker-app.d.ts

@@ -178,7 +178,7 @@ export interface WorkerAppWant {
      */
     secrets: {
         name: string;
-        source: 'generated' | 'keysCustody' | 'heldSecret';
+        source: 'generated' | 'keysCustody' | 'heldSecret' | 'authEvents';
         hostId?: string;
         version?: string;
     }[];

package/dist/plan/worker-app.js

@@ -4,6 +4,7 @@ import { APPS_DOMAIN, heldEnvRef } from '../org.js';
 import { WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
 import { WORKER_APP_DNS_RECORD, pendingWorkerAppMigrations, strayContainerImage, withCallTimeout, workerAppRegistryPrefix, workerAppShape, workerAppUpload, } from '../worker-app-upload.js';
 import { entryAuthEnv } from './broker-entries.js';
+import { AUTH_EVENTS_ENV, ensureAuthEventsSecret } from './entry-auth-events.js';
 import { workerAppHostname } from './hostnames.js';
 import { workspaceWorkerParent } from './workspace-worker.js';
 import { appStepKey } from './platform-diff.js';
@@ -165,6 +166,9 @@ export function wantedWorkerApp(org, entry, recorded, input) {
                 missing.push(what);
         }
         secrets.push({ name: WORKER_APP_AUTH_KEY_SECRET, source: 'generated' });
+        // The signing secret of assistant events: made by rule 1 (`ensureAuthEventsSecret`), shared with the broker entry.
+        if (entry.uses?.auth?.mcp?.events)
+            secrets.push({ name: AUTH_EVENTS_ENV, source: 'authEvents' });
         if (entry.uses?.auth?.mcp) {
             for (const name of ['MCP_AUDIENCE', 'MCP_RESOURCE', 'MCP_ISSUER']) {
                 if (env[name])
@@ -577,6 +581,23 @@ async function deliverSecrets(deps, org, entryKey, want, context, at, call) {
         if (delivered[secret.name] !== version)
             generated.push({ name: secret.name, value, version });
     }
+    for (const secret of want.secrets) {
+        if (secret.source !== 'authEvents')
+            continue;
+        const value = await ensureAuthEventsSecret({
+            orgId: org.id,
+            slug: org.slug,
+            entryKey,
+            heldKeys,
+            recorded: () => context.recordedIds(),
+            record: (key, recordedValue) => context.recordScopeId(key, recordedValue),
+            persist: () => context.persistScopeIds(),
+            secret: (held) => deps.secret?.(held),
+        });
+        const version = secretVersion(value);
+        if (delivered[secret.name] !== version)
+            generated.push({ name: secret.name, value, version });
+    }
     // Held secrets: the company's value, read from the held-key store. The plan found each one held; a
     // value gone since stops the step, and the error names the ref, never a value.
     for (const secret of want.secrets) {

package/dist/plan/workspace-sign-in.d.ts

@@ -1,6 +1,6 @@
 import type { DeclaredOrg, HostingEntry } from '../org.js';
 import type { UnmanagedItem } from '../plan.js';
-import { type BrokerEntryInput, type BrokerEntryWant } from './broker-entries.js';
+import { type BrokerEntryInput, type BrokerEntryMcp, type BrokerEntryWant } from './broker-entries.js';
 import type { DraftStep } from './diff.js';
 import type { LiveResource } from './live.js';
 /** The step `coolify:workspace-broker-entry` and its action key, for the planner and the executor to share. */
@@ -10,12 +10,7 @@ export declare const WORKSPACE_BROKER_ENTRY_KIND = "workspace-broker-entry";
  * project in the test customers organisation (recorded by `zitadel:mcp-project` under the client's name), and the
  * onboarding page on the workspace host. `null` without `mcp` or until the project is recorded.
  */
-export declare function workspaceMcp(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>): {
-    resource: string;
-    projectId: string;
-    loginHost: string;
-    onboardingUrl?: string;
-} | null;
+export declare function workspaceMcp(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>): BrokerEntryMcp | null;
 /**
  * What the app's env says about who signs in at the workspace, as recorded so far, or `null` until the
  * organisation, client and issuer are all known. Non-secret values only.

package/dist/plan/workspace-sign-in.js

@@ -37,6 +37,8 @@ export function workspaceMcp(org, entry, recorded) {
         projectId,
         loginHost: loginHostnameFor(org),
         ...(mcp.onboardingPath ? { onboardingUrl: `https://${host}${mcp.onboardingPath}` } : {}),
+        ...(mcp.events ? { events: { url: `https://${host}${mcp.events.path}` } } : {}),
+        ...(mcp.managePath ? { manageUrl: `https://${host}${mcp.managePath}` } : {}),
     };
 }
 /**
@@ -90,7 +92,9 @@ export function liveClientIds(org, recorded) {
 /** What `ws.<key>.signin` records: the sign-in env above as JSON, or `null` while it is not all known. */
 export function workspaceSignInMarker(org, entry, recorded, issuer) {
     const env = workspaceAuthEnv(org, entry, recorded, issuer);
-    return env ? JSON.stringify(env) : null;
+    if (!env)
+        return null;
+    return entry.uses?.auth?.mcp?.events ? `${JSON.stringify(env)}+events` : JSON.stringify(env);
 }
 /**
  * The test customers organisation, planned once an entry's workspace signs in customers. Sign-up and the emailed

package/dist/platform.d.ts

@@ -66,6 +66,24 @@ export interface PlatformUptimeWorker {
 }
 /** Where Archon publishes the Worker script for `tag` (a private repo; the host's `fetchArtifact` fetches it). */
 export declare function uptimeArtifactUrl(tag: string): string;
+/**
+ * foundry#1024: the usage tail Worker that meters every company Worker's
+ * use. `@wtfalch/edge`'s `packages/service/src/usage-tail-worker.ts` has no
+ * imports and builds to `usage-tail-worker.js`; foundry deploys the pinned
+ * build and never builds it, the same `tag`/`sha256` pin
+ * {@link PlatformUptimeWorker} uses. Both empty means nothing is pinned yet,
+ * and the planner reports that instead of planning the step. It has no
+ * hostname: it answers no request, only the tail events Cloudflare delivers.
+ */
+export interface PlatformUsageTailWorker {
+    enabled: boolean;
+    /** An edge release tag, `v1.2.3`. */
+    tag: string;
+    /** Lower-case hex SHA-256 of `usage-tail-worker.js` at that tag. */
+    sha256: string;
+}
+/** Where edge publishes the Worker script for `tag` (the host's `fetchArtifact` fetches it). */
+export declare function usageTailArtifactUrl(tag: string): string;
 /**
  * The shared services a declared platform names, decided in #165, plus
  * `edge` (#317, F7): the service that mints an entry's own edge key and
@@ -137,6 +155,8 @@ export interface DeclaredPlatform {
     coolify: PlatformService;
     /** foundry#542: the outside prober Worker; see {@link PlatformUptimeWorker}. */
     uptime: PlatformUptimeWorker;
+    /** foundry#1024: the usage tail Worker; see {@link PlatformUsageTailWorker}. */
+    usageTail: PlatformUsageTailWorker;
     /**
      * foundry#544: which Healthchecks instance manages the heartbeat checks
      * for every piece of scheduled work foundry sets up (the uptime Worker,

package/dist/platform.js

@@ -4,6 +4,10 @@ import { validateBlueGreen, validateDomain } from './org.js';
 export function uptimeArtifactUrl(tag) {
     return `https://github.com/wtfalch/archon/releases/download/${tag}/archon-uptime-worker.js`;
 }
+/** Where edge publishes the Worker script for `tag` (the host's `fetchArtifact` fetches it). */
+export function usageTailArtifactUrl(tag) {
+    return `https://github.com/wtfalch/edge/releases/download/${tag}/usage-tail-worker.js`;
+}
 export const PLATFORM_SERVICE_KEYS = [
     'auth',
     'mail',
@@ -87,6 +91,16 @@ export function validatePlatform(platform) {
     if (uptime.sha256 && !/^[0-9a-f]{64}$/.test(uptime.sha256)) {
         return 'uptime.sha256 must be 64 lower-case hex characters';
     }
+    const { usageTail } = platform;
+    if (Boolean(usageTail.tag.trim()) !== Boolean(usageTail.sha256.trim())) {
+        return 'usageTail.tag and usageTail.sha256 must be set together: a pin is both';
+    }
+    if (usageTail.tag && !/^v[0-9A-Za-z][0-9A-Za-z.+_-]*$/.test(usageTail.tag)) {
+        return `usageTail.tag '${usageTail.tag}' must be a release tag such as v1.2.3`;
+    }
+    if (usageTail.sha256 && !/^[0-9a-f]{64}$/.test(usageTail.sha256)) {
+        return 'usageTail.sha256 must be 64 lower-case hex characters';
+    }
     // #491: declared, never discovered -- a present-but-blank id is refused the
     // same way `serverIpv4`'s blank string is, rather than being read as unset.
     if (platform.mail.lettermintProjectId != null && !platform.mail.lettermintProjectId.trim()) {

package/dist/store/postgres.js

@@ -815,6 +815,11 @@ function rowToPlatform(row) {
             gitRef: row.coolifyGitRef,
         },
         uptime: { enabled: row.uptimeEnabled, tag: row.uptimeTag, sha256: row.uptimeSha256 },
+        usageTail: {
+            enabled: row.usageTailEnabled,
+            tag: row.usageTailTag,
+            sha256: row.usageTailSha256,
+        },
         heartbeatsProvider: row.heartbeatsProvider,
     };
 }
@@ -867,6 +872,9 @@ function platformToRow(platform) {
         uptimeEnabled: platform.uptime.enabled,
         uptimeTag: platform.uptime.tag,
         uptimeSha256: platform.uptime.sha256,
+        usageTailEnabled: platform.usageTail.enabled,
+        usageTailTag: platform.usageTail.tag,
+        usageTailSha256: platform.usageTail.sha256,
         heartbeatsProvider: platform.heartbeatsProvider,
     };
 }