@wtfalch/foundry 0.76.1 → 0.77.1

package/dist/plan/jobs-scheduler-http.js

@@ -50,6 +50,45 @@ export class HttpJobsSchedulerClient {
             syncKey: typeof fields.syncKey === 'string' ? fields.syncKey : undefined,
         };
     }
+    /**
+     * foundry#1119: `POST /admin/projects/<name>/keys` (jobs#79). Answers `201 { id, key, ... }`, the key shown
+     * once. A refusal throws with the status only: no response text reaches the error.
+     */
+    async mintProjectKey(project, grant) {
+        const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(project)}/keys`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${this.adminToken}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({ principal: grant.principal, scopes: [...grant.scopes] }),
+            signal: AbortSignal.timeout(ADMIN_CALL_TIMEOUT_MS),
+        });
+        const body = await response.json().catch(() => undefined);
+        if (response.status !== 201) {
+            throw Object.assign(new Error(`jobs scheduler: POST /admin/projects/<name>/keys answered ${response.status}`), { status: response.status });
+        }
+        const fields = typeof body === 'object' && body !== null ? body : {};
+        if (typeof fields.id !== 'string' || fields.id.length === 0) {
+            throw new Error('jobs scheduler: POST /admin/projects/<name>/keys answered 201 with no key id');
+        }
+        if (typeof fields.key !== 'string' || fields.key.length === 0) {
+            // The id is all the caller can act on: the key is shown once.
+            return { id: fields.id, key: '' };
+        }
+        return { id: fields.id, key: fields.key };
+    }
+    /** `DELETE /admin/projects/<name>/keys/<id>`. A refusal throws with the status only (404: no such key). */
+    async revokeProjectKey(project, keyId) {
+        const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(project)}/keys/${encodeURIComponent(keyId)}`, {
+            method: 'DELETE',
+            headers: { authorization: `Bearer ${this.adminToken}` },
+            signal: AbortSignal.timeout(ADMIN_CALL_TIMEOUT_MS),
+        });
+        if (response.status === 200 || response.status === 204)
+            return;
+        throw Object.assign(new Error(`jobs scheduler: DELETE /admin/projects/<name>/keys/<id> answered ${response.status}`), { status: response.status });
+    }
     /** `DELETE /admin/projects/<name>`. A refusal throws with the status only. */
     async deleteProject(name) {
         const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(name)}`, {

package/dist/plan/live.d.ts

@@ -42,7 +42,7 @@ export interface LiveResource {
      * see that function's own doc comment for why "always planned" broke
      * `bootstrapPlatform`.
      */
-    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats' | 'github' | 'audit' | 'analytics';
+    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge' | 'heartbeats' | 'github' | 'audit' | 'analytics' | 'reporting';
     kind: string;
     key: string;
     config: Record<string, unknown>;

package/dist/plan/locked-hostnames.d.ts

@@ -3,7 +3,7 @@ import { OWN_SERVICE_LABELS } from '../service-labels.js';
 export { OWN_SERVICE_LABELS };
 /**
  * The names under the org's domain that foundry owns, so no hosting entry may
- * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
+ * take one: Agora, Boule, the analytics and reporting backends, the cms studio when the site is on, calls when it uses the
  * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
  * `sfu.` for an org that runs its own services, and every platform service
  * hostname that falls under the domain. An own org with no domain holds its

package/dist/plan/locked-hostnames.js

@@ -7,10 +7,11 @@ import { cmsStudioHostnameFor, siteHostnameFor } from './hostnames.js';
 import { kosmosHostnameFor } from './kosmos.js';
 import { loginHostnameFor } from './login-host.js';
 import { ownHostnames } from './own-hostnames.js';
+import { reportingHostnameFor } from './reporting.js';
 export { OWN_SERVICE_LABELS };
 /**
  * The names under the org's domain that foundry owns, so no hosting entry may
- * take one: Agora, Boule, the cms studio when the site is on, calls when it uses the
+ * take one: Agora, Boule, the analytics and reporting backends, the cms studio when the site is on, calls when it uses the
  * domain, the sign-in host when the issuer does, `auth.`, `mail.`, `files.` and
  * `sfu.` for an org that runs its own services, and every platform service
  * hostname that falls under the domain. An own org with no domain holds its
@@ -35,6 +36,8 @@ export function lockedHostnames(org, platformHostnames) {
     locked.add(bouleHostnameFor(org));
     // Reserved always, planned only while something uses analytics (`analyticsWanted`).
     locked.add(analyticsHostnameFor(org));
+    // And the reporting backend's, the same way (`reportingWanted`).
+    locked.add(reportingHostnameFor(org));
     if (kosmosOn(org))
         locked.add(kosmosHostnameFor(org));
     if (org.site.enabled)

package/dist/plan/login-host.js

@@ -1,4 +1,4 @@
-import { ownsServices } from '../org.js';
+import { ownsServices, signsInCustomers } from '../org.js';
 import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, agoraHostnameFor, } from './agora.js';
 import { BOULE_CLIENT_ID_SCOPE_KEY, bouleHostnameFor } from './boule.js';
 import { SIGN_IN_IN_APP_SCOPE_KEY, inAppSignIn, inAppStatePairs, } from './sign-in.js';
@@ -170,7 +170,7 @@ export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
  */
 export function customersEntryKeys(org) {
     return new Set([
-        ...org.hosting.entries.filter((e) => e.uses?.auth?.users === 'customers').map((e) => e.key),
+        ...org.hosting.entries.filter((e) => signsInCustomers(e.uses?.auth)).map((e) => e.key),
         // A workspace's customers client signs in the test customers organisation, on the shared host as well.
         ...testCustomersEntries(org).map((e) => workspaceClientKey(e.key)),
     ]);

package/dist/plan/org-names.js

@@ -5,6 +5,7 @@ import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
 import { workerAppHostname, workspaceHost, workspaceInboxHost } from './hostnames.js';
 import { orgTarget, platformTarget } from './own-services.js';
 import { appNameFor } from './platform-diff.js';
+import { reportingWanted } from './reporting.js';
 /**
  * The names foundry gives the services every company can run beside its own
  * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
@@ -23,6 +24,8 @@ export function companyServiceNames(org) {
     ];
     if (analyticsWanted(org))
         names.push(`${s}-analytics`, `${s}-analytics-db`);
+    if (reportingWanted(org))
+        names.push(`${s}-reporting`, `${s}-reporting-db`);
     if (kosmosOn(org))
         names.push(`${s}-kosmos`, `${s}-kosmos-db`);
     if (org.chat?.enabled) {

package/dist/plan/own-diff.js

@@ -10,7 +10,7 @@ import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-hos
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
 import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
 import { ownHostnames, passkeyRpIdFor } from './own-hostnames.js';
-import { JOBS_PUBLIC_URL_SCOPE_KEY, OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY } from './own-jobs-route.js';
+import { JOBS_ENTRY_PATH_PATTERN, JOBS_PUBLIC_URL_SCOPE_KEY, OWN_JOBS_ROUTE_PATHS_SCOPE_KEY, OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY, } from './own-jobs-route.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
 import { AUTH_ISSUER_SOURCE_ENV_VERSION, AUTH_MCP_ENV_VERSION, AUTH_TUNNEL_ROUTES_VERSION, AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ISSUER_SOURCE_ENV_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_LOGIN_ENV_SCOPE_KEY, PLATFORM_AUTH_MCP_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, authLoginEnvMarker, orgDeclaresMcp, platformMailMxHost, } from './platform-diff.js';
@@ -92,7 +92,8 @@ export function planOwnJobsRoute(options) {
     if (!schedulerApplied && !options.schedulerPlanned)
         return { step: null, blocked: null };
     if (recordedIds[JOBS_PUBLIC_URL_SCOPE_KEY] === `https://${hostname}` &&
-        recordedIds[OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY]) {
+        recordedIds[OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY] &&
+        recordedIds[OWN_JOBS_ROUTE_PATHS_SCOPE_KEY] === JOBS_ENTRY_PATH_PATTERN) {
         return { step: null, blocked: null };
     }
     const waiting = (reason) => ({

package/dist/plan/own-jobs-route.d.ts

@@ -17,9 +17,12 @@ export declare const OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY = "cloudflare_own_jobs_tunn
 export declare const OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY = "coolify_own_jobs_connector_app";
 /**
  * The only paths the public route serves: what a project's app calls (`/sync`, `/timers`, `/timers/<name>`,
- * `/deliveries`). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
+ * `/deliveries`) and what Boule reads and presses for one project with that project's key (`/project/*`,
+ * jobs#79, foundry#1119). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
  */
-export declare const JOBS_ENTRY_PATH_PATTERN = "^/(sync$|timers(/|$)|deliveries$)";
+export declare const JOBS_ENTRY_PATH_PATTERN = "^/(sync$|timers(/|$)|deliveries$|project/)";
+/** The path pattern the route's ingress was last written with; a different pattern plans the route again. */
+export declare const OWN_JOBS_ROUTE_PATHS_SCOPE_KEY = "own_jobs_route_paths";
 export declare const JOBS_ROUTE_CALL_TIMEOUT_MS = 60000;
 /** The tunnel's name and the connector app's, one pair per company. */
 export declare const jobsRouteNames: (target: Pick<ServiceTarget, "id">) => {

package/dist/plan/own-jobs-route.js

@@ -18,9 +18,12 @@ export const OWN_JOBS_ROUTE_TUNNEL_SCOPE_KEY = 'cloudflare_own_jobs_tunnel';
 export const OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY = 'coolify_own_jobs_connector_app';
 /**
  * The only paths the public route serves: what a project's app calls (`/sync`, `/timers`, `/timers/<name>`,
- * `/deliveries`). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
+ * `/deliveries`) and what Boule reads and presses for one project with that project's key (`/project/*`,
+ * jobs#79, foundry#1119). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
  */
-export const JOBS_ENTRY_PATH_PATTERN = '^/(sync$|timers(/|$)|deliveries$)';
+export const JOBS_ENTRY_PATH_PATTERN = '^/(sync$|timers(/|$)|deliveries$|project/)';
+/** The path pattern the route's ingress was last written with; a different pattern plans the route again. */
+export const OWN_JOBS_ROUTE_PATHS_SCOPE_KEY = 'own_jobs_route_paths';
 export const JOBS_ROUTE_CALL_TIMEOUT_MS = 60_000;
 /** The tunnel's name and the connector app's, one pair per company. */
 export const jobsRouteNames = (target) => ({
@@ -55,6 +58,7 @@ export async function provisionJobsRoute(scope, ports, target, input) {
             { service: 'http_status:404' },
         ],
     }));
+    await record(OWN_JOBS_ROUTE_PATHS_SCOPE_KEY, JOBS_ENTRY_PATH_PATTERN);
     await withTimeout(`${at}: connector app`, ms * 5, () => ensureCloudflaredConnector({
         coolify: ports.coolify,
         tunnels,

package/dist/plan/own-limits.d.ts

@@ -119,6 +119,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly reporting: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly companyOther: {
         memory: string;
         dbMemory: string;

package/dist/plan/own-limits.js

@@ -31,6 +31,7 @@ export const LIMITS = {
     boule: profile('512m'),
     kosmos: profile('512m'),
     analytics: profile('512m', '512m'),
+    reporting: profile('512m', '512m'),
     companyOther: profile('1g', '512m'),
     platformArchon: profile('1g'),
     platformAi: profile('1g'),

package/dist/plan/plan-apply.d.ts

@@ -596,6 +596,11 @@ export interface FoundryPlanApplyOptions {
      * reported blocked instead of planned.
      */
     broker?: boolean;
+    /**
+     * ADR 0003: true when the host's executor was built with a `registrarApi` port. Optional, and false without
+     * it: an entry whose customers and team both sign in is reported blocked instead of registered.
+     */
+    registrarApi?: boolean;
     /**
      * #318: true when the host's executor was built with a `WorkersPort`.
      * Optional, and false without it: each entry's `worker` Worker is then
@@ -613,6 +618,21 @@ export interface FoundryPlanApplyOptions {
     keysRegistrarUrl?: string;
     /** True when the host's executor was built with an `analytics` port. A `uses.analytics` key is blocked without it. */
     analyticsPort?: boolean;
+    /** True when the host's executor was built with a `reporting` port. A `uses.reporting` key is blocked without it. */
+    reportingPort?: boolean;
+    /**
+     * foundry#1119: true when the host's jobs scheduler port (`FoundryStepExecutorPorts.jobsScheduler`, or the
+     * platform's `HttpJobsSchedulerClient`) has `mintProjectKey` and `revokeProjectKey`. Without it each
+     * `uses.jobs` entry's Boule key is reported blocked.
+     */
+    jobsProjectKeys?: boolean;
+    /**
+     * foundry#1122: true once ai offers a company Boule's five read permissions (`ai.usage:read`,
+     * `ai.runs:read`, `ai.budgets:read`, `ai.budgets:update`, `ai.offerings:read`; all `offered: false` today).
+     * With it each organisation is offered them, its own ai key is minted again with them, and Boule gets a key
+     * below it. Without it Boule's ai key is reported blocked.
+     */
+    aiBouleReads?: boolean;
     /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
     workerAppDatabase?: boolean;
     /** True when that port has `deletableTables`. A `workerApp.database.noDelete` is blocked without it. */
@@ -773,11 +793,15 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly zitadelMcp;
     private readonly zitadelOrgMetadata;
     private readonly broker;
+    private readonly registrarApi;
     private readonly edgeWorkers;
     private readonly workerApps;
     private readonly workerAppKeysUrl;
     private readonly keysRegistrarUrl;
     private readonly analyticsPort;
+    private readonly reportingPort;
+    private readonly jobsProjectKeys;
+    private readonly aiBouleReads;
     private readonly workerAppDatabase;
     private readonly workerAppNoDeleteCheck;
     private readonly workerAppRegistryAccountId;

package/dist/plan/plan-apply.js

@@ -11,6 +11,7 @@ import { StaleLeaseError, } from '../store.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
+import { AI_BOULE_KEY_SCOPE_KEY, AI_BOULE_UNDELIVERED_SCOPE_KEY } from './ai-boule-key.js';
 import { APPS_DB_ENTRY_KEY } from './apps-db-route.js';
 import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
 import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, blueGreenSubjects, declaresBlueGreen, lbOrigin, } from './blue-green.js';
@@ -20,7 +21,7 @@ import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, bouleEdgeKeyWanted, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
-import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
+import { FILES_BOULE_KEY_SCOPE_KEY, FILES_BOULE_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { probeRepoKeys, repoKeyProbeTargets, repoKeysInPlay, } from './entry-repo-key.js';
 import { PLATFORM_GITHUB_APP_REFS } from './held-key-refs.js';
 import { KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, } from './keys-registrar.js';
@@ -185,11 +186,15 @@ export class FoundryPlanApply {
     zitadelMcp;
     zitadelOrgMetadata;
     broker;
+    registrarApi;
     edgeWorkers;
     workerApps;
     workerAppKeysUrl;
     keysRegistrarUrl;
     analyticsPort;
+    reportingPort;
+    jobsProjectKeys;
+    aiBouleReads;
     workerAppDatabase;
     workerAppNoDeleteCheck;
     workerAppRegistryAccountId;
@@ -231,11 +236,15 @@ export class FoundryPlanApply {
         this.zitadelMcp = options.zitadelMcp ?? false;
         this.zitadelOrgMetadata = options.zitadelOrgMetadata ?? false;
         this.broker = options.broker ?? false;
+        this.registrarApi = options.registrarApi ?? false;
         this.edgeWorkers = options.edgeWorkers ?? false;
         this.workerApps = options.workerApps ?? false;
         this.workerAppKeysUrl = options.workerAppKeysUrl;
         this.keysRegistrarUrl = options.keysRegistrarUrl;
         this.analyticsPort = options.analyticsPort ?? false;
+        this.reportingPort = options.reportingPort ?? false;
+        this.jobsProjectKeys = options.jobsProjectKeys ?? false;
+        this.aiBouleReads = options.aiBouleReads ?? false;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
         this.workerAppNoDeleteCheck = options.workerAppNoDeleteCheck ?? false;
         this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
@@ -1703,11 +1712,15 @@ export class FoundryPlanApply {
             broker: ownsServices(org) && this.hostOwnServices && this.executor.ownBrokerPort
                 ? await this.executor.ownBrokerPort(org, recorded)
                 : this.broker,
+            registrarApi: this.registrarApi,
             edgeWorkers: this.edgeWorkers,
             workerApps: this.workerApps,
             workerAppKeysUrl: this.workerAppKeysUrl,
             keysRegistrarUrl: this.keysRegistrarUrl,
             analyticsPort: this.analyticsPort,
+            reportingPort: this.reportingPort,
+            jobsProjectKeys: this.jobsProjectKeys,
+            aiBouleReads: this.aiBouleReads,
             workerAppDatabase: this.workerAppDatabase,
             workerAppNoDeleteCheck: this.workerAppNoDeleteCheck,
             workerAppRegistryAccountId: this.workerAppRegistryAccountId,
@@ -2358,7 +2371,7 @@ export function stepEntryKey(step, orgId, entries = []) {
     }
     const entryOwned = (system === 'coolify' && kind === 'app') ||
         (system === 'cloudflare' && (kind === 'worker' || kind === 'worker-app' || kind === 'gate')) ||
-        (system === 'jobs' && kind === 'project') ||
+        (system === 'jobs' && (kind === 'project' || kind === 'boule-key')) ||
         (system === 'github' && kind === 'deploy-key') ||
         (system === 'audit' && kind === 'ledger') ||
         (kind === 'key' && (system === 'ai' || system === 'edge' || system === 'files'));
@@ -2770,6 +2783,8 @@ const STEP_FIELDS = {
     // F4 (#925): both hang off the company's Apps switch.
     'coolify:analytics': 'hosting.entries.uses.analytics',
     'coolify:analytics-boule': 'boule.apps',
+    'coolify:reporting': 'hosting.entries.uses.reporting',
+    'coolify:reporting-boule': 'boule.apps',
     'coolify:org-apps-admin': 'boule.apps',
     'cloudflare:apps-db-route': 'boule.apps',
     'cloudflare:apps-zones': 'boule.apps',
@@ -2780,6 +2795,9 @@ function stepField(action) {
         (action.desired.entry === 'boule' || action.desired.entry === 'agora')) {
         return `${action.desired.entry}.blueGreen`;
     }
+    // Boule's ai key (foundry#1122) belongs to the org's ai, like the org's own key.
+    if (action.system === 'ai' && action.kind === 'boule-key')
+        return 'ai';
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.
     if (action.system === 'ai' && action.kind === 'key' && action.key.includes(':')) {
         return 'hosting.entries.uses.ai';
@@ -2787,16 +2805,23 @@ function stepField(action) {
     // The org's own files key (F6b) is keyed `<orgId>`, an entry's `<orgId>:<entry>`.
     if (action.system === 'files' && action.kind === 'key')
         return 'hosting.entries.uses.files';
+    // Boule's files key (foundry#1121) is keyed `<orgId>` and follows the entries' `uses.files`.
+    if (action.system === 'files' && action.kind === 'boule-key')
+        return 'hosting.entries.uses.files';
     // An entry's edge key (F7): always `<orgId>:<entry>`, edge has no org-root key.
     if (action.system === 'edge' && action.kind === 'key')
         return 'hosting.entries.uses.edge';
     // An entry's jobs project: always `<orgId>:<entry>`.
-    if (action.system === 'jobs' && action.kind === 'project')
+    if (action.system === 'jobs' && (action.kind === 'project' || action.kind === 'boule-key'))
         return 'hosting.entries.uses.jobs';
     // An entry's analytics site key: always `<orgId>:<entry>`.
     if (action.system === 'analytics' && action.kind === 'key') {
         return 'hosting.entries.uses.analytics';
     }
+    // An entry's reporting site key: always `<orgId>:<entry>`.
+    if (action.system === 'reporting' && action.kind === 'key') {
+        return 'hosting.entries.uses.reporting';
+    }
     // An entry's audit ledger registration: always `<orgId>:<entry>`.
     if (action.system === 'audit' && action.kind === 'ledger')
         return 'hosting.entries.uses.audit';
@@ -2839,7 +2864,12 @@ function failedFields(org, detail, completed, serviceIds) {
     // `planAiKey` plans no step for a key minted but never delivered, so no
     // step is left to fail. Without this, the next apply would record the org
     // as converged with no working key.
-    if (serviceIds[AI_KEY_UNDELIVERED_SCOPE_KEY] && !serviceIds[`ai:key:${org.id}`])
+    if (serviceIds[AI_KEY_UNDELIVERED_SCOPE_KEY] &&
+        serviceIds[AI_KEY_UNDELIVERED_SCOPE_KEY] !== serviceIds[`ai:key:${org.id}`])
+        failed.add('ai');
+    // Boule's ai key (foundry#1122): minted, never held, so no step is planned.
+    if (serviceIds[AI_BOULE_UNDELIVERED_SCOPE_KEY] &&
+        serviceIds[AI_BOULE_UNDELIVERED_SCOPE_KEY] !== serviceIds[AI_BOULE_KEY_SCOPE_KEY])
         failed.add('ai');
     // The same for an entry's ai key (F6a): minted, never delivered, so no step is planned.
     for (const entry of org.hosting.entries) {
@@ -2858,6 +2888,11 @@ function failedFields(org, detail, completed, serviceIds) {
                 failed.add('hosting.entries.uses.files');
             }
         }
+        // Boule's files key (foundry#1121): minted, never held, so no step is planned.
+        if (serviceIds[FILES_BOULE_UNDELIVERED_SCOPE_KEY] &&
+            serviceIds[FILES_BOULE_UNDELIVERED_SCOPE_KEY] !== serviceIds[FILES_BOULE_KEY_SCOPE_KEY]) {
+            failed.add('hosting.entries.uses.files');
+        }
     }
     // The same for an entry's edge key (F7): minted, never delivered is no
     // longer blocked forever on its own (the next apply revokes it and

package/dist/plan/platform-diff.d.ts

@@ -1424,6 +1424,8 @@ export interface PlanPlatformOptions {
         };
         /** foundry#1024: why the usage tail Worker is blocked, or absent when it is not. */
         usageTail?: string;
+        /** foundry#1133: why the app-layer canary is blocked (`appCanaryBlockedReason`), or absent when it is not. */
+        appCanary?: string;
         /** Why the organisation's release webhook step cannot run (the token is not held), or absent. */
         githubReleaseHook?: string;
         /**

package/dist/plan/platform-diff.js

@@ -1,8 +1,9 @@
 import { createHash } from 'node:crypto';
 import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
-import { heldEnvRef } from '../org.js';
+import { entrySettingsEnv, heldEnvRef } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
+import { planAppCanary } from './app-canary.js';
 import { ARCHON_REPO, planArchonBlueGreen } from './blue-green.js';
 import { buildDriftNotes } from './build-record.js';
 import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
@@ -958,6 +959,12 @@ export function resolveAppEnv(org, entry, recorded, available = { sharedSecret:
         else if (typeof declared !== 'string')
             unresolved.push([name, declared.from]);
     }
+    // #1116: the module settings that go to the app (Files' share links, Email's sender name and reply-to).
+    // A name the entry's own `env` declares is refused by the org validator, so these never overwrite one.
+    for (const [name, value] of Object.entries(entrySettingsEnv(entry))) {
+        values[name] = value;
+        marker[name] = value;
+    }
     // F13: the entry's customer-grants credential is held and written by the app step. The marker names it,
     // never its value, so adding or removing the flag replans the step.
     if (entry.uses?.customerGrants && available.sharedSecret) {
@@ -1541,6 +1548,10 @@ export function planPlatform(platform, live, options = {}) {
     const usageTail = planUsageTail(platform, recordedIds, blocked.usageTail, edgeApplied);
     if (usageTail.step)
         plannedSteps.push(usageTail.step);
+    // foundry#1133: after edge too; its Worker, route and record all go through it.
+    const appCanary = planAppCanary(platform, recordedIds, blocked.appCanary, edgeApplied);
+    if (appCanary.step)
+        plannedSteps.push(appCanary.step);
     const dnsBlocked = edgeApplied || edge.step
         ? undefined
         : (service) => `the platform's ${service} is blocked, not planned: every DNS record is written through edge, and edge is neither applied nor planned (${platform.edge.enabled
@@ -1813,6 +1824,9 @@ export function planPlatform(platform, live, options = {}) {
     for (const description of usageTail.blocked) {
         unmanaged.push({ description, key: 'usage-tail' });
     }
+    for (const description of appCanary.blocked) {
+        unmanaged.push({ description, key: 'app-canary' });
+    }
     if (releaseHook.blocked) {
         unmanaged.push({ description: releaseHook.blocked, key: 'github-release-hook' });
     }

package/dist/plan/platform-providers.d.ts

@@ -25,6 +25,7 @@ import { type PlatformRegistryDeps } from './platform-registry.js';
 import type { SigninDbBackupPort } from './signin-db-backup.js';
 import { type PlatformZitadelMailBranding } from './signin-mail.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
+import { type PlatformAppCanaryDeps } from './app-canary-apply.js';
 import { type PlatformGithubReleaseHookDeps } from './github-release-hook.js';
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
@@ -343,6 +344,12 @@ export interface FoundryPlatformStepExecutorOptions {
      * for the same reason as `auth`; without it the step is reported blocked.
      */
     usageTail?: PlatformUsageTailDeps;
+    /**
+     * foundry#1133: dependencies for the app-layer canary step
+     * (`cloudflare:worker` keyed {@link PLATFORM_APP_CANARY_KEY}) -- optional
+     * for the same reason as `auth`; without it the step is reported blocked.
+     */
+    appCanary?: PlatformAppCanaryDeps;
     /**
      * #604: dependencies for the `cloudflare:access-provider` step -- optional
      * for the same reason as `auth`; edge and sign-in applied with this unset
@@ -380,6 +387,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly heartbeats?;
     private readonly uptime?;
     private readonly usageTail?;
+    private readonly appCanary?;
     private readonly accessProvider?;
     private readonly oikosIngress?;
     private readonly githubReleaseHook?;
@@ -448,6 +456,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
             blocked?: string;
         };
         usageTail?: string;
+        appCanary?: string;
         githubReleaseHook?: string;
         githubReleaseHookReady?: boolean;
         githubReleaseHookHash?: string;

package/dist/plan/platform-providers.js

@@ -45,6 +45,8 @@ import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, signinDbDsn, waitHealthy, withCallTimeout, } from './signin-db.js';
 import { PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY, applySigninMail, signinMailMarker, signinMailName, } from './signin-mail.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
+import { appCanaryBlockedReason, provisionPlatformAppCanary, } from './app-canary-apply.js';
+import { PLATFORM_APP_CANARY_KEY } from './app-canary.js';
 import { githubReleaseHookPlanInputs, provisionGithubReleaseHook, } from './github-release-hook.js';
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
@@ -155,6 +157,7 @@ export class FoundryPlatformStepExecutor {
     heartbeats;
     uptime;
     usageTail;
+    appCanary;
     accessProvider;
     oikosIngress;
     githubReleaseHook;
@@ -178,6 +181,7 @@ export class FoundryPlatformStepExecutor {
         this.heartbeats = options.heartbeats;
         this.uptime = options.uptime;
         this.usageTail = options.usageTail;
+        this.appCanary = options.appCanary;
         this.accessProvider = options.accessProvider;
         this.oikosIngress = options.oikosIngress;
         this.githubReleaseHook = options.githubReleaseHook;
@@ -623,6 +627,9 @@ export class FoundryPlatformStepExecutor {
         }
         await this.uptimeBlocked(platform, recordedIds, blocked, owner);
         await this.usageTailBlocked(platform, recordedIds, blocked);
+        const appCanaryBlocked = await appCanaryBlockedReason(this.appCanary, platform, recordedIds);
+        if (appCanaryBlocked)
+            blocked.appCanary = appCanaryBlocked;
         if (platform.archon.enabled && !this.githubReleaseHook) {
             blocked.githubReleaseHook = GITHUB_RELEASE_HOOK_DEPS_MISSING;
         }
@@ -1217,6 +1224,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformUsageTail(context, this.usageTail);
         }
+        if (action.system === 'cloudflare' &&
+            action.kind === 'worker' &&
+            action.key === PLATFORM_APP_CANARY_KEY) {
+            if (!this.appCanary) {
+                throw new Error('platform:app-canary needs FoundryPlatformStepExecutor to be constructed with its app-canary dependencies (foundry#1133)');
+            }
+            return provisionPlatformAppCanary(context, this.appCanary);
+        }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
             action.key === PLATFORM_OIKOS_INGRESS_KEY) {
@@ -4410,10 +4425,19 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'org-changes', path: '/api/orgs/*/changes' },
     { name: 'org-settings', path: '/api/orgs/*/settings' },
     { name: 'org-apps', path: '/api/orgs/*/apps' },
+    // Archon authenticates each image-app request with the company's scoped bearer credential.
+    { name: 'org-image-apps', path: '/api/orgs/*/image-apps' },
+    { name: 'org-image-apps-sub', path: '/api/orgs/*/image-apps/*' },
     { name: 'org-requests', path: '/api/orgs/*/requests' },
     { name: 'github-releases', path: '/api/github/releases' },
     { name: 'github-install-callback', path: '/api/github/install/callback' },
     { name: 'org-github', path: '/api/orgs/*/github' },
+    // archon#808: the company's mail, read by Boule's Email page; Archon checks `orgs:read` itself.
+    { name: 'org-mail', path: '/api/orgs/*/mail' },
+    { name: 'org-mail-sub', path: '/api/orgs/*/mail/*' },
+    // The audit host (foundry#1110): Archon mounts `createAuditHostHandler` here; every route below it checks a
+    // company's bearer key itself. Boule's `AUDIT_HOST_URL` is `https://<archon host>/api/audit`.
+    { name: 'audit-host', path: '/api/audit' },
 ];
 const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
 const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;

package/dist/plan/providers-readers.js

@@ -5,6 +5,7 @@ import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 import { previewsOn } from './coolify-previews.js';
 import { KOSMOS_MANAGED_ENV_KEYS } from './kosmos.js';
 import { APP_GONE_KIND, } from './live.js';
+import { REPORTING_MAIL_TOKEN_ENV, REPORTING_MANAGED_ENV_KEYS } from './reporting.js';
 import { SIGN_IN_UPSTREAM_ENV } from './sign-in.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
@@ -334,6 +335,28 @@ async function withAnalyticsEnvConfig(client, resource, recorded) {
     }
     return { ...resource, config: { ...resource.config, env } };
 }
+/**
+ * The recorded reporting backend's live env (`APP_URL`, `AUTH_ORGANIZATION_ID`, `MAIL_FROM`) as `config.env`,
+ * read like {@link withAnalyticsEnvConfig}, and `config.mailTokenHeld`: whether it holds a Lettermint token.
+ */
+async function withReportingEnvConfig(client, resource, recorded) {
+    if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('reporting:')) {
+        return resource;
+    }
+    const managed = REPORTING_MANAGED_ENV_KEYS;
+    const env = {};
+    let mailTokenHeld = false;
+    for (const e of await client.listEnvs(resource.key)) {
+        if (e.is_preview)
+            continue;
+        if (managed.includes(e.key))
+            env[e.key] = e.value;
+        // The token is a secret: only whether it is there leaves this reader.
+        if (e.key === REPORTING_MAIL_TOKEN_ENV && e.value)
+            mailTokenHeld = true;
+    }
+    return { ...resource, config: { ...resource.config, env, mailTokenHeld } };
+}
 /** `@wtfalch/providers`' own `LiveResource` (`resource.ts`) has no `system` field — foundry's adds it at this boundary. */
 function toFoundryResources(system, resources) {
     return resources.map((r) => ({ system, kind: r.kind, key: r.key, config: r.config }));
@@ -369,7 +392,8 @@ export class ProvidersCoolifyReader {
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded, liveKeys)));
         const withKosmosConfig = await Promise.all(withBouleConfig.map((r) => withKosmosEnvConfig(this.client, r, recorded)));
         const withAnalyticsConfig = await Promise.all(withKosmosConfig.map((r) => withAnalyticsEnvConfig(this.client, r, recorded)));
-        return applyRecordedIds(withAnalyticsConfig, recorded);
+        const withReportingConfig = await Promise.all(withAnalyticsConfig.map((r) => withReportingEnvConfig(this.client, r, recorded)));
+        return applyRecordedIds(withReportingConfig, recorded);
     }
     async liveEnvEquals(orgId, appKey, name, value) {
         const recorded = await this.resolveRecordedIds(orgId);