@wtfalch/foundry 0.76.1 → 0.77.1

package/dist/org.d.ts

@@ -301,7 +301,7 @@ export type AccessRule = {
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /** Why a validator refused. `code` is stable and never reworded; `message` is for people. */
-export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'issuer_app_name_reserved_kosmos' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'entry_image_invalid' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'hosting_repo_invalid' | 'hosting_github_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'hosted_name_invalid' | 'hosted_name_not_unique' | 'hosted_name_worker_app' | 'entry_workspace_invalid' | 'entry_workspace_unsupported' | 'entry_live_needs_workspace' | 'entry_live_commit_invalid' | 'gate_key_taken_by_workspace' | 'gate_key_taken_by_private_page' | 'private_page_invalid' | 'private_page_path_invalid' | 'private_page_duplicate' | 'private_page_limit' | 'private_page_needs_hosting' | 'private_page_roles_invalid' | 'private_page_people_invalid' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'blue_green_advance_invalid' | 'blue_green_min_requests_invalid' | 'blue_green_error_margin_invalid' | 'blue_green_staff_first_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'mcp_events_path_invalid' | 'mcp_manage_path_invalid' | 'auth_sign_in_invalid' | 'auth_sign_ins_invalid' | 'auth_second_factor_invalid' | 'sign_in_staff_password_only' | 'passkey_needs_another_method' | 'email_code_needs_customers' | 'email_code_needs_sign_in' | 'auth_room_invalid' | 'auth_room_needs_customers' | 'auth_room_not_unique' | 'client_name_taken' | 'workspaces_needs_customers' | 'workspaces_needs_server' | 'workspaces_roles_invalid' | 'workspaces_role_reserved' | 'workspaces_invite_path_invalid' | 'workspaces_env_clash' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_needs_own_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'mail_not_true' | 'mail_needs_hosting' | 'mail_env_clash' | 'jobs_not_true' | 'jobs_needs_hosting' | 'jobs_env_clash' | 'analytics_not_true' | 'analytics_needs_hosting' | 'analytics_env_clash' | 'customer_grants_not_true' | 'customer_grants_needs_customers' | 'customer_grants_env_clash' | 'repo_use_invalid' | 'repo_use_needs_repo' | 'repo_use_env_clash' | 'audit_not_true' | 'audit_needs_hosting' | 'audit_needs_worker_database' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
+export type OrgRefusalCode = 'hosting_tunnel_needs_hosting' | 'issuer_app_name_missing' | 'issuer_app_name_not_unique' | 'issuer_app_kind_unknown' | 'issuer_app_name_reserved_agora' | 'issuer_app_name_reserved_boule' | 'issuer_app_name_reserved_kosmos' | 'hosting_needs_entry' | 'hosting_main_count' | 'entry_key_not_unique' | 'entry_image_invalid' | 'ai_webhook_path_not_unique' | 'worker_route_not_unique' | 'database_not_unique' | 'access_hostname_not_unique' | 'access_hostname_invalid' | 'access_needs_hosting' | 'access_kind_unknown' | 'access_service_token_name_missing' | 'access_hostname_locked' | 'access_hostname_not_served' | 'gate_limit_invalid' | 'hosting_repo_invalid' | 'hosting_github_invalid' | 'gate_needs_domain' | 'gate_key_invalid' | 'gate_key_not_unique' | 'gate_needs_hostname' | 'gate_hostname_not_entry_hostname' | 'gate_hostname_held_twice' | 'gate_hostname_locked' | 'gate_limit_exceeded' | 'wildcard_needs_domain' | 'wildcard_held_twice' | 'hostnames_need_domain' | 'hostname_needed' | 'hostname_invalid' | 'hostname_not_unique' | 'hostname_locked' | 'hosted_name_invalid' | 'hosted_name_not_unique' | 'hosted_name_worker_app' | 'entry_workspace_invalid' | 'entry_workspace_unsupported' | 'entry_live_needs_workspace' | 'entry_live_commit_invalid' | 'gate_key_taken_by_workspace' | 'gate_key_taken_by_private_page' | 'private_page_invalid' | 'private_page_path_invalid' | 'private_page_duplicate' | 'private_page_limit' | 'private_page_needs_hosting' | 'private_page_roles_invalid' | 'private_page_people_invalid' | 'entry_key_invalid' | 'entry_key_reserved' | 'entry_repo_invalid' | 'entry_folder_invalid' | 'entry_branch_empty' | 'entry_build_pack_unknown' | 'entry_build_pack_unavailable' | 'entry_port_invalid' | 'entry_health_path_invalid' | 'entry_capabilities_invalid' | 'entry_database_needs_hosting' | 'blue_green_needs_hostname' | 'env_name_empty' | 'env_name_reserved' | 'env_source_platform_mail_key' | 'env_source_unknown' | 'env_shared_secret_name_invalid' | 'env_held_secret_name_mismatch' | 'env_held_secret_name_invalid' | 'env_looks_like_secret' | 'builtin_app_invalid' | 'blue_green_not_object' | 'blue_green_steps_length' | 'blue_green_steps_range' | 'blue_green_steps_order' | 'blue_green_steps_end' | 'blue_green_hold_invalid' | 'blue_green_advance_invalid' | 'blue_green_min_requests_invalid' | 'blue_green_error_margin_invalid' | 'blue_green_staff_first_invalid' | 'volumes_not_list' | 'volumes_too_many' | 'volume_name_invalid' | 'volume_name_logs' | 'volume_name_not_unique' | 'volume_mount_path_invalid' | 'volume_mount_path_too_long' | 'volume_mount_path_log_dir' | 'volume_mount_path_forbidden' | 'volume_mount_path_not_unique' | 'auth_needs_hosting' | 'auth_users_invalid' | 'auth_both_needs_customers' | 'auth_both_worker_app' | 'auth_both_unsupported' | 'auth_registration_invalid' | 'registration_open_needs_customers' | 'auth_replaces_broker_entry_invalid' | 'auth_replaces_broker_entry_owned' | 'auth_needs_exact_hostname' | 'mcp_needs_open_customers' | 'mcp_path_invalid' | 'mcp_onboarding_path_invalid' | 'mcp_events_path_invalid' | 'mcp_manage_path_invalid' | 'auth_sign_in_invalid' | 'auth_sign_ins_invalid' | 'auth_second_factor_invalid' | 'sign_in_staff_password_only' | 'passkey_needs_another_method' | 'email_code_needs_customers' | 'email_code_needs_sign_in' | 'auth_room_invalid' | 'auth_room_needs_customers' | 'auth_room_not_unique' | 'client_name_taken' | 'workspaces_needs_customers' | 'workspaces_needs_server' | 'workspaces_roles_invalid' | 'workspaces_role_reserved' | 'workspaces_invite_path_invalid' | 'workspaces_env_clash' | 'ai_needs_hosting' | 'ai_offerings_invalid' | 'ai_permissions_invalid' | 'ai_webhook_path_invalid' | 'ai_webhook_needs_exact_hostname' | 'ai_env_clash' | 'files_needs_hosting' | 'files_collections_invalid' | 'files_permissions_invalid' | 'files_share_host_invalid' | 'files_share_host_needs_domain' | 'files_env_clash' | 'files_settings_invalid' | 'worker_needs_hosting' | 'worker_needs_repo' | 'worker_needs_own_repo' | 'worker_key_too_long' | 'worker_artifact_invalid' | 'worker_route_invalid' | 'worker_route_off_domain' | 'worker_rate_limit_name_missing' | 'worker_rate_limit_namespace_missing' | 'worker_rate_limit_invalid' | 'worker_rate_limit_period_invalid' | 'worker_app_invalid' | 'edge_not_true' | 'edge_needs_hosting' | 'edge_needs_domain' | 'edge_env_clash' | 'mail_not_true' | 'mail_needs_hosting' | 'mail_env_clash' | 'mail_settings_invalid' | 'jobs_not_true' | 'jobs_needs_hosting' | 'jobs_env_clash' | 'jobs_settings_invalid' | 'analytics_not_true' | 'analytics_needs_hosting' | 'analytics_env_clash' | 'reporting_not_true' | 'reporting_needs_hosting' | 'reporting_env_clash' | 'reporting_site_invalid' | 'customer_grants_not_true' | 'customer_grants_needs_customers' | 'customer_grants_env_clash' | 'repo_use_invalid' | 'repo_use_needs_repo' | 'repo_use_env_clash' | 'audit_not_true' | 'audit_needs_hosting' | 'audit_needs_worker_database' | 'customers_invalid' | 'customers_sign_up_needs_enabled' | 'registration_open_needs_sign_up';
 /**
  * One refusal: a stable `code`, the dotted `path` into {@link DeclaredOrg} it is about
  * (`hosting.entries.terminal.uses.auth.registration`) and the sentence for people.
@@ -604,15 +604,22 @@ export interface WorkerConfig {
     route: string;
     bindings?: WorkerBindings;
 }
-/**
- * Sign-in for one entry: one ZITADEL client and one broker entry, signing in
- * ONE organisation. `staff` is the org's own ZITADEL org, `customers` the
- * `<slug> customers` org. `registration` is the broker entry's sign-up switch.
- * `replacesBrokerEntry` is the `name` of the hand-written broker `AUTH_APPS`
- * entry this entry's own entry replaces; the first write removes it.
+/** Who signs in to an app: `staff` is the company's own team, `customers` the people of its customers organisation. */
+export type EntryAudience = 'staff' | 'customers';
+export declare const ENTRY_AUDIENCES: readonly EntryAudience[];
+/**
+ * Sign-in for one entry. With one audience (`users: 'staff'` or `'customers'`, or a list of that one): one
+ * ZITADEL client foundry makes and one broker `AUTH_APPS` entry, signing in ONE organisation. `staff` is the
+ * org's own ZITADEL org, `customers` the `<slug> customers` org. With both (`users: ['customers', 'staff']`,
+ * ADR 0003): the app is registered at the sign-in broker through the company's registrar
+ * (`plan/registered-app.ts`, auth ADR 0008), in the customers organisation, and the broker makes its two
+ * clients: the customers' and the team's, in the company's own organisation. `registration` is the broker
+ * entry's sign-up switch (for customers). `replacesBrokerEntry` is the `name` of the hand-written broker
+ * `AUTH_APPS` entry this entry's own entry replaces; the first write removes it. Read who signs in only
+ * through {@link entryAudiences}, {@link signsInCustomers} and {@link signsInBoth}.
  */
 export interface EntryAuth {
-    users: 'staff' | 'customers';
+    users: EntryAudience | EntryAudience[];
     registration: 'open' | 'closed';
     replacesBrokerEntry?: string;
     /**
@@ -672,6 +679,16 @@ export interface EntryAuth {
      */
     room?: EntryAuthRoom;
 }
+/**
+ * Who signs in, as a sorted list without repeats (`['customers']`, `['staff']` or `['customers', 'staff']`).
+ * A one-value list is the same as the value. An invalid `users` answers what it holds that is known, so call
+ * this on a validated org.
+ */
+export declare function entryAudiences(auth: Pick<EntryAuth, 'users'>): EntryAudience[];
+/** True when the entry's customers sign in (alone, or beside the team): the app lives in the customers organisation. */
+export declare function signsInCustomers(auth: Pick<EntryAuth, 'users'> | undefined): boolean;
+/** True when both the customers and the company's team sign in: the app is registered through the registrar. */
+export declare function signsInBoth(auth: Pick<EntryAuth, 'users'> | undefined): boolean;
 export type SignInMethod = 'email-code' | 'password' | 'passkey';
 export declare const SIGN_IN_METHODS: readonly SignInMethod[];
 export type SecondFactorMode = 'off' | 'allowed' | 'required';
@@ -714,10 +731,66 @@ export interface EntryFiles {
     collections: string[];
     permissions?: string[];
     shareHost?: boolean;
+    /**
+     * #1116: how many days a new share link works, one of {@link FILES_SHARE_LINK_DAYS}, or `null` for links
+     * that never stop. Absent is {@link FILES_SHARE_LINK_DAYS_DEFAULT}. Delivered to the app as
+     * `FILES_SHARE_LINK_DAYS` (`never` for null) while it is not the default, for the app to pass to files as
+     * the link's `expiresAt`.
+     */
+    shareLinkDays?: number | null;
+    /**
+     * #1116: people may pick another time when they share a file. Absent is true. Delivered as
+     * `FILES_SHARE_LINK_PICK=false` while it is false.
+     */
+    shareLinkPick?: boolean;
+    /**
+     * #1116: the share of the space used, in percent, at which the company's owners are emailed. Absent is
+     * {@link FILES_SPACE_ALERT_DEFAULT}. For the files service, which does not read it yet; foundry delivers it
+     * to nothing.
+     */
+    spaceAlertPercent?: number;
 }
 /** The env names `uses.files` always writes, besides one `FILES_COLLECTION_<NAME>_ID` per collection. */
 export declare const FILES_ENTRY_ENV_NAMES: readonly ["FILES_URL", "FILES_ORGANISATION_ID", "FILES_API_KEY"];
 export declare const filesCollectionEnvName: (name: string) => string;
+/**
+ * #1116: Email's settings. `fromName` and `replyTo` go to the app's env (`MAIL_FROM_NAME`, `MAIL_REPLY_TO`,
+ * only when set), for `@wtfalch/mailer`'s `fromName` and `replyTo`. The bounce settings are for the
+ * company's mail service, which does not read them yet; foundry delivers them to nothing. `uses.mail: true`
+ * is every setting at its default.
+ */
+export interface EntryMail {
+    /** The name people see as the sender. Absent: the company's name, as today. */
+    fromName?: string;
+    /** Where replies go. Absent: to the sending address. */
+    replyTo?: string;
+    /** Stop sending to an address after this many bounces. Absent is {@link MAIL_BOUNCES_DEFAULT}. */
+    stopAfterBounces?: number;
+    /** Email the owners when more than this share of a week's mail bounces, in percent. Absent is {@link MAIL_BOUNCE_ALERT_DEFAULT}. */
+    bounceAlertPercent?: number;
+}
+/**
+ * #1116: Jobs' settings, for the jobs scheduler's project, which does not read them yet (jobs#79 has no
+ * project settings); foundry delivers them to nothing. `uses.jobs: true` is every setting at its default.
+ */
+export interface EntryJobs {
+    /** How many times a failed job is tried again. Absent is {@link JOBS_RETRIES_DEFAULT}. */
+    retries?: number;
+    /** Email the owners when a job failed all its tries. Absent is true. */
+    alertOwners?: boolean;
+    /** Pause a job after this many failed runs in a row. Absent or null: never paused for failing. */
+    pauseAfterFailures?: number | null;
+}
+/** #1116: the env names the module settings write; `env` may not name one while its setting is set. */
+export declare const FILES_SETTINGS_ENV_NAMES: readonly ["FILES_SHARE_LINK_DAYS", "FILES_SHARE_LINK_PICK"];
+export declare const MAIL_SETTINGS_ENV_NAMES: readonly ["MAIL_FROM_NAME", "MAIL_REPLY_TO"];
+/**
+ * #1116: the env an entry's module settings give the app. A name is written only while its setting differs
+ * from the default, so an entry saved before these settings plans as it did; the app reads an absent name as
+ * the default (`FILES_SHARE_LINK_DAYS` 7, `FILES_SHARE_LINK_PICK` true, no `MAIL_FROM_NAME` or
+ * `MAIL_REPLY_TO`). A name a setting stopped writing is taken out of the app's env by the next apply.
+ */
+export declare function entrySettingsEnv(entry: HostingEntry): Record<string, string>;
 export interface HostingEntryUses {
     auth?: EntryAuth;
     ai?: EntryAi;
@@ -732,19 +805,22 @@ export interface HostingEntryUses {
     edge?: true;
     /**
      * The entry sends mail from the company's mail domain: it gets the company's
-     * Lettermint token and `MAIL_FROM`, as the main app does. In a workspace the
-     * stage gets the mail sink's env only (`stageMailEnv`).
+     * Lettermint token and `MAIL_FROM`, as the main app does, and `MAIL_APP_KEY`
+     * ({@link MAIL_APP_KEY_ENV}). In a workspace the stage gets the mail sink's
+     * env only (`stageMailEnv`) and `MAIL_APP_KEY` = `<key>-work`. An object carries the Email module's settings
+     * ({@link EntryMail}); `true` is all of them at their defaults.
      */
-    mail?: true;
+    mail?: true | EntryMail;
     /**
      * The entry is a project of its own in the jobs scheduler and gets
      * `JOBS_SCHEDULER_URL` (the scheduler's public origin), `JOBS_SIGNING_SECRET`
      * and `JOBS_SYNC_KEY` (`plan/entry-jobs.ts`). Blocked, not planned, until the
      * scheduler's public route (`plan/own-jobs-route.ts`) is recorded: the owner
      * company's for a company on shared services, the company's own otherwise.
-     * A workspace gets none of the three.
+     * A workspace gets none of the three. An object carries the Jobs module's settings ({@link EntryJobs});
+     * `true` is all of them at their defaults.
      */
-    jobs?: true;
+    jobs?: true | EntryJobs;
     /**
      * The app keeps a tamper-evident audit log (`@wtfalch/audit`). A Worker app with a database: the append-only
      * tables and the two chain functions are derived (`audit/ledger-set.ts`), never listed by hand, and the
@@ -772,13 +848,38 @@ export interface HostingEntryUses {
      * app gets its keys from Boule, which installs them per copy, so foundry only plans the backend for it.
      */
     analytics?: true;
+    /**
+     * The app sends its errors to the company's own reporting backend, and Boule shows them. A server entry gets
+     * its own site key (`REPORTING_URL`, `REPORTING_SITE_KEY`; `plan/entry-reporting-key.ts`) with site = the
+     * entry key, and its stage another (environment `stage`). A Worker app gets its keys from Boule, which installs
+     * them per copy, so foundry only plans the backend for it. The entry key must be a site the backend accepts
+     * (`reporting_site_invalid`).
+     */
+    reporting?: true;
 }
 /** The env names `uses.edge` writes; `env` may not name them (#317). */
 export declare const EDGE_ENTRY_ENV_NAMES: readonly ["EDGE_URL", "EDGE_API_KEY"];
 /** The env names `uses.analytics` writes on a server entry; `env` may not name them. */
 export declare const ANALYTICS_ENTRY_ENV_NAMES: readonly ["ANALYTICS_URL", "ANALYTICS_SITE_KEY"];
+/**
+ * What the reporting backend accepts as a site (`SITE_PATTERN` in wtfalch/reporting's core): a lower-case
+ * letter, then letters, digits and hyphens, at most 64 in all. An entry's site is its key.
+ */
+export declare const REPORTING_SITE_PATTERN: RegExp;
+/** The env names `uses.reporting` writes on a server entry; `env` may not name them. */
+export declare const REPORTING_ENTRY_ENV_NAMES: readonly ["REPORTING_URL", "REPORTING_SITE_KEY"];
 /** The env names `uses.mail` writes; `env` may not name them. */
 export declare const MAIL_ENTRY_ENV_NAMES: readonly ["LETTERMINT_API_TOKEN", "MAIL_FROM"];
+/**
+ * The env name every entry that sends mail ({@link sendsMail}) gets, holding its entry key, and its
+ * stage or workspace copy `<key>-work` ({@link mailAppKeyOf}). `@wtfalch/mailer` 0.10.0 tags each send
+ * with it, so Archon's mail reads can split mail per app. Not a secret. No entry's `env` may name it.
+ */
+export declare const MAIL_APP_KEY_ENV = "MAIL_APP_KEY";
+/** Whether the entry sends mail: the main entry and each entry with `uses.mail`. */
+export declare function sendsMail(entry: Pick<HostingEntry, 'key' | 'main' | 'uses'>): boolean;
+/** The `MAIL_APP_KEY` of an entry's copy: its key live, `<key>-work` for its stage or workspace. */
+export declare function mailAppKeyOf(entryKey: string, copy: 'live' | 'work'): string;
 /** The env names `uses.jobs` writes; `env` may not name them. */
 export declare const JOBS_ENTRY_ENV_NAMES: readonly ["JOBS_SCHEDULER_URL", "JOBS_SIGNING_SECRET", "JOBS_SYNC_KEY"];
 /**

package/dist/org.js

@@ -1,6 +1,6 @@
 import { DEFAULT_RULES, checkName, explain } from '@wtfalch/auth/names';
 import { floatingRefBlocked, floatingTagBlocked } from './bootstrap/versions.js';
-import { AI_ENTRY_PERMISSIONS, AI_WEBHOOK_PATH, FILES_COLLECTION_NAME, FILES_ENTRY_PERMISSIONS, MCP_PATH, ONBOARDING_PATH_MAX_LENGTH, ROOM_STEPS_MAX, ROOM_STEPS_MIN, ROOM_TEXT_MAX, ROOM_UNSAFE_TEXT, WORKSPACE_ROLE, WORKSPACE_ROLES_MAX, isEdgePath, isPagePath, } from './entry-rules.js';
+import { AI_ENTRY_PERMISSIONS, AI_WEBHOOK_PATH, FILES_COLLECTION_NAME, FILES_ENTRY_PERMISSIONS, FILES_SHARE_LINK_DAYS, FILES_SHARE_LINK_DAYS_DEFAULT, JOBS_PAUSE_AFTER_MAX, JOBS_RETRIES_MAX, MAIL_BOUNCES_MAX, MAIL_FROM_NAME, MAIL_FROM_NAME_MAX, MAIL_REPLY_TO, MAIL_REPLY_TO_MAX, MCP_PATH, ONBOARDING_PATH_MAX_LENGTH, PERCENT_MAX, PERCENT_MIN, ROOM_STEPS_MAX, ROOM_STEPS_MIN, ROOM_TEXT_MAX, ROOM_UNSAFE_TEXT, WORKSPACE_ROLE, WORKSPACE_ROLES_MAX, isEdgePath, isPagePath, wholeIn, } from './entry-rules.js';
 import { hostedLabelRefusal } from './hosted-label.js';
 import { entryHasDatabase, validateArtifact, validateEntryWorkerApp, } from './worker-app-config.js';
 export { AI_ENTRY_PERMISSIONS, FILES_ENTRY_PERMISSIONS, MCP_PATH, ONBOARDING_PATH_MAX_LENGTH, ROOM_STEPS_MAX, ROOM_STEPS_MIN, ROOM_TEXT_MAX, WORKSPACE_ROLE, WORKSPACE_ROLES_MAX, } from './entry-rules.js';
@@ -55,6 +55,24 @@ export function withNewOrgAppsDefault(org) {
 export const kosmosOn = (org) => org.kosmos?.enabled === true;
 /** The most volumes one entry may declare. */
 export const MAX_ENTRY_VOLUMES = 8;
+export const ENTRY_AUDIENCES = ['customers', 'staff'];
+/**
+ * Who signs in, as a sorted list without repeats (`['customers']`, `['staff']` or `['customers', 'staff']`).
+ * A one-value list is the same as the value. An invalid `users` answers what it holds that is known, so call
+ * this on a validated org.
+ */
+export function entryAudiences(auth) {
+    const raw = Array.isArray(auth.users) ? auth.users : [auth.users];
+    return ENTRY_AUDIENCES.filter((audience) => raw.includes(audience));
+}
+/** True when the entry's customers sign in (alone, or beside the team): the app lives in the customers organisation. */
+export function signsInCustomers(auth) {
+    return auth !== undefined && entryAudiences(auth).includes('customers');
+}
+/** True when both the customers and the company's team sign in: the app is registered through the registrar. */
+export function signsInBoth(auth) {
+    return auth !== undefined && entryAudiences(auth).length === 2;
+}
 export const SIGN_IN_METHODS = ['email-code', 'password', 'passkey'];
 export const SECOND_FACTOR_MODES = ['off', 'allowed', 'required'];
 /** The env names `uses.auth.workspaces` writes; `env` may not name them. */
@@ -74,12 +92,63 @@ export const FILES_ENTRY_ENV_NAMES = [
     'FILES_API_KEY',
 ];
 export const filesCollectionEnvName = (name) => `FILES_COLLECTION_${name}_ID`;
+/** #1116: the env names the module settings write; `env` may not name one while its setting is set. */
+export const FILES_SETTINGS_ENV_NAMES = ['FILES_SHARE_LINK_DAYS', 'FILES_SHARE_LINK_PICK'];
+export const MAIL_SETTINGS_ENV_NAMES = ['MAIL_FROM_NAME', 'MAIL_REPLY_TO'];
+/**
+ * #1116: the env an entry's module settings give the app. A name is written only while its setting differs
+ * from the default, so an entry saved before these settings plans as it did; the app reads an absent name as
+ * the default (`FILES_SHARE_LINK_DAYS` 7, `FILES_SHARE_LINK_PICK` true, no `MAIL_FROM_NAME` or
+ * `MAIL_REPLY_TO`). A name a setting stopped writing is taken out of the app's env by the next apply.
+ */
+export function entrySettingsEnv(entry) {
+    const env = {};
+    const files = entry.uses?.files;
+    if (files) {
+        if (files.shareLinkDays !== undefined &&
+            files.shareLinkDays !== FILES_SHARE_LINK_DAYS_DEFAULT) {
+            env.FILES_SHARE_LINK_DAYS =
+                files.shareLinkDays === null ? 'never' : String(files.shareLinkDays);
+        }
+        if (files.shareLinkPick === false)
+            env.FILES_SHARE_LINK_PICK = 'false';
+    }
+    const mail = entry.uses?.mail;
+    if (mail && mail !== true) {
+        if (mail.fromName !== undefined)
+            env.MAIL_FROM_NAME = mail.fromName;
+        if (mail.replyTo !== undefined)
+            env.MAIL_REPLY_TO = mail.replyTo;
+    }
+    return env;
+}
 /** The env names `uses.edge` writes; `env` may not name them (#317). */
 export const EDGE_ENTRY_ENV_NAMES = ['EDGE_URL', 'EDGE_API_KEY'];
 /** The env names `uses.analytics` writes on a server entry; `env` may not name them. */
 export const ANALYTICS_ENTRY_ENV_NAMES = ['ANALYTICS_URL', 'ANALYTICS_SITE_KEY'];
+/**
+ * What the reporting backend accepts as a site (`SITE_PATTERN` in wtfalch/reporting's core): a lower-case
+ * letter, then letters, digits and hyphens, at most 64 in all. An entry's site is its key.
+ */
+export const REPORTING_SITE_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+/** The env names `uses.reporting` writes on a server entry; `env` may not name them. */
+export const REPORTING_ENTRY_ENV_NAMES = ['REPORTING_URL', 'REPORTING_SITE_KEY'];
 /** The env names `uses.mail` writes; `env` may not name them. */
 export const MAIL_ENTRY_ENV_NAMES = ['LETTERMINT_API_TOKEN', 'MAIL_FROM'];
+/**
+ * The env name every entry that sends mail ({@link sendsMail}) gets, holding its entry key, and its
+ * stage or workspace copy `<key>-work` ({@link mailAppKeyOf}). `@wtfalch/mailer` 0.10.0 tags each send
+ * with it, so Archon's mail reads can split mail per app. Not a secret. No entry's `env` may name it.
+ */
+export const MAIL_APP_KEY_ENV = 'MAIL_APP_KEY';
+/** Whether the entry sends mail: the main entry and each entry with `uses.mail`. */
+export function sendsMail(entry) {
+    return isMainEntry(entry) || entry.uses?.mail === true;
+}
+/** The `MAIL_APP_KEY` of an entry's copy: its key live, `<key>-work` for its stage or workspace. */
+export function mailAppKeyOf(entryKey, copy) {
+    return copy === 'live' ? entryKey : `${entryKey}-work`;
+}
 /** The env names `uses.jobs` writes; `env` may not name them. */
 export const JOBS_ENTRY_ENV_NAMES = [
     'JOBS_SCHEDULER_URL',
@@ -749,6 +818,7 @@ function validateHostingEntry(entry, enabled, reserveKeys, github) {
         }
         if (FOUNDRY_ENV_NAME.test(name) ||
             (name === 'APP_URL' && isMainEntry(entry)) ||
+            name === MAIL_APP_KEY_ENV ||
             (entry.blueGreen && BLUE_GREEN_ENV_NAME.test(name))) {
             return refusal('env_name_reserved', `hosting.entries.${entry.key}.env.${name}`, `${at} env '${name}' is set by foundry and cannot be declared`);
         }
@@ -916,14 +986,36 @@ function validateEntryAuth(entry, hosting, domain) {
     const at = `hosting.entries '${entry.key}' uses.auth`;
     if (!hosting.enabled)
         return refusal('auth_needs_hosting', `hosting.entries.${entry.key}.uses.auth`, `${at} requires hosting.enabled`);
-    if (auth.users !== 'staff' && auth.users !== 'customers') {
-        return refusal('auth_users_invalid', `hosting.entries.${entry.key}.uses.auth.users`, `${at} users must be 'staff' or 'customers'`);
+    const users = auth.users;
+    const usersList = Array.isArray(users) ? users : [users];
+    if (usersList.length < 1 ||
+        usersList.length > ENTRY_AUDIENCES.length ||
+        !usersList.every((u) => ENTRY_AUDIENCES.includes(u)) ||
+        new Set(usersList).size !== usersList.length) {
+        return refusal('auth_users_invalid', `hosting.entries.${entry.key}.uses.auth.users`, `${at} users must be 'staff', 'customers' or a list of one or both of them, each once`);
+    }
+    const both = signsInBoth(auth);
+    // Both audiences are registered through the company's registrar (ADR 0003, auth ADR 0008).
+    if (both && entry.workerApp !== undefined) {
+        return refusal('auth_both_worker_app', `hosting.entries.${entry.key}.uses.auth.users`, `${at} users 'customers' and 'staff' is for an app that runs as a server: a Worker app's sign-in is registered by Boule`);
+    }
+    if (both) {
+        const unsupported = [
+            [auth.mcp, 'uses.auth.mcp', 'mcp'],
+            [auth.workspaces, 'uses.auth.workspaces', 'workspaces'],
+            [auth.replacesBrokerEntry, 'uses.auth.replacesBrokerEntry', 'replacesBrokerEntry'],
+            [entry.blueGreen, 'blueGreen', 'blueGreen'],
+        ];
+        const found = unsupported.find(([value]) => value !== undefined);
+        if (found) {
+            return refusal('auth_both_unsupported', `hosting.entries.${entry.key}.${found[1]}`, `${at} users 'customers' and 'staff' cannot have ${found[2]} yet: an app both sign in to is registered at the sign-in broker, which foundry does not do with ${found[2]}`);
+        }
     }
     if (auth.registration !== 'open' && auth.registration !== 'closed') {
         return refusal('auth_registration_invalid', `hosting.entries.${entry.key}.uses.auth.registration`, `${at} registration must be 'open' or 'closed'`);
     }
     // The staff organisation holds the org's own people and its project.
-    if (auth.users === 'staff' && auth.registration === 'open') {
+    if (!signsInCustomers(auth) && auth.registration === 'open') {
         return refusal('registration_open_needs_customers', `hosting.entries.${entry.key}.uses.auth.registration`, `${at} registration 'open' needs users 'customers': nobody signs themselves up as staff`);
     }
     if (auth.replacesBrokerEntry !== undefined &&
@@ -938,7 +1030,7 @@ function validateEntryAuth(entry, hosting, domain) {
         return refusal('auth_needs_exact_hostname', `hosting.entries.${entry.key}.hostnames`, `${at} needs an exact hostname to sign in at`);
     }
     if (auth.mcp !== undefined) {
-        if (auth.users !== 'customers') {
+        if (!signsInCustomers(auth)) {
             return refusal('mcp_needs_open_customers', `hosting.entries.${entry.key}.uses.auth.mcp`, `${at} mcp needs users 'customers': an MCP client signs the customer in, and registration may be open or closed`);
         }
         if (typeof auth.mcp?.path !== 'string' ||
@@ -987,13 +1079,13 @@ function validateEntryAuth(entry, hosting, domain) {
         if (signIn !== undefined && !methods.includes(signIn)) {
             return refusal('auth_sign_ins_invalid', signInsAt, `${at} signIns must include signIn '${String(signIn)}'`);
         }
-        if (auth.users !== 'customers' && (methods.length !== 1 || methods[0] !== 'password')) {
+        if (!signsInCustomers(auth) && (methods.length !== 1 || methods[0] !== 'password')) {
             return refusal('sign_in_staff_password_only', signInsAt, `${at} signIns for users 'staff' must be ['password']: your team signs in with a password`);
         }
         if (methods.length === 1 && methods[0] === 'passkey') {
             return refusal('passkey_needs_another_method', signInsAt, `${at} signIns 'passkey' needs 'email-code' or 'password' beside it: a first passkey and its recovery both use one of them`);
         }
-        if (methods.includes('email-code') && auth.users !== 'customers') {
+        if (methods.includes('email-code') && !signsInCustomers(auth)) {
             return refusal('email_code_needs_customers', signInsAt, `${at} signIns 'email-code' needs users 'customers': only customers sign in with an emailed code`);
         }
         // Every reader of the emailed code (the sign-in metadata, the broker entry, the workspace sign-in) reads
@@ -1007,15 +1099,15 @@ function validateEntryAuth(entry, hosting, domain) {
         if (!SECOND_FACTOR_MODES.includes(secondFactor)) {
             return refusal('auth_second_factor_invalid', `hosting.entries.${entry.key}.uses.auth.secondFactor`, `${at} secondFactor must be 'off', 'allowed' or 'required'`);
         }
-        if (secondFactor !== 'off' && auth.users !== 'customers') {
+        if (secondFactor !== 'off' && !signsInCustomers(auth)) {
             return refusal('sign_in_staff_password_only', `hosting.entries.${entry.key}.uses.auth.secondFactor`, `${at} secondFactor for users 'staff' must be 'off': staff two-step sign-in is set for the whole company`);
         }
     }
-    if (signIn === 'email-code' && auth.users !== 'customers') {
+    if (signIn === 'email-code' && !signsInCustomers(auth)) {
         return refusal('email_code_needs_customers', `hosting.entries.${entry.key}.uses.auth.signIn`, `${at} signIn 'email-code' needs users 'customers': only customers sign in with an emailed code`);
     }
     if (auth.room !== undefined) {
-        if (auth.users !== 'customers') {
+        if (!signsInCustomers(auth)) {
             return refusal('auth_room_needs_customers', `hosting.entries.${entry.key}.uses.auth.room`, `${at} room needs users 'customers': only the customers' sign-in window shows it`);
         }
         const problem = roomProblem(auth.room);
@@ -1047,7 +1139,7 @@ function validateEntryAuth(entry, hosting, domain) {
  */
 function validateEntryWorkspaces(entry, workspaces, at) {
     const path = `hosting.entries.${entry.key}.uses.auth.workspaces`;
-    if (entry.uses?.auth?.users !== 'customers') {
+    if (!signsInCustomers(entry.uses?.auth)) {
         return refusal('workspaces_needs_customers', path, `${at} workspaces needs users 'customers': workspaces belong to an app's own customers`);
     }
     if (entry.workerApp !== undefined) {
@@ -1191,7 +1283,15 @@ function validateEntryFiles(entry, hosting, domain) {
     if (files.shareHost && !(hosting.usesDomain && domain)) {
         return refusal('files_share_host_needs_domain', `hosting.entries.${entry.key}.uses.files.shareHost`, `${at} shareHost needs hosting.usesDomain and a domain: it is served at share.<domain>`);
     }
-    const written = [...FILES_ENTRY_ENV_NAMES, ...files.collections.map(filesCollectionEnvName)];
+    const settings = filesSettingsProblem(files);
+    if (settings) {
+        return refusal('files_settings_invalid', `hosting.entries.${entry.key}.uses.files.${settings[0]}`, `${at} ${settings[1]}`);
+    }
+    const written = [
+        ...FILES_ENTRY_ENV_NAMES,
+        ...FILES_SETTINGS_ENV_NAMES.filter((name) => name in entrySettingsEnv(entry)),
+        ...files.collections.map(filesCollectionEnvName),
+    ];
     const named = Object.keys(entry.env ?? {}).find((name) => written.includes(name));
     if (named)
         return refusal('files_env_clash', `hosting.entries.${entry.key}.env.${named}`, `${at} writes ${named}; remove it from env`);
@@ -1335,7 +1435,7 @@ function validateEntryCustomerGrants(entry) {
     const at = `hosting.entries '${entry.key}' uses.customerGrants`;
     if (value !== true)
         return refusal('customer_grants_not_true', path, `${at} must be true`);
-    if (entry.uses?.auth?.users !== 'customers') {
+    if (!signsInCustomers(entry.uses?.auth)) {
         return refusal('customer_grants_needs_customers', path, `${at} is for an app whose customers sign in: declare uses.auth with users 'customers', or remove it`);
     }
     const named = Object.keys(entry.env ?? {}).find((name) => CUSTOMER_GRANTS_ENTRY_ENV_NAMES.includes(name));
@@ -1344,20 +1444,125 @@ function validateEntryCustomerGrants(entry) {
     }
     return null;
 }
-/** `uses.mail`, `uses.jobs` and `uses.analytics`: `true`, `hosting.enabled`, and no `env` entry that names a value they write. */
+/** #1116: the field and the words when `uses.files`' settings are not ones the module can write, else null. */
+function filesSettingsProblem(files) {
+    const days = files.shareLinkDays;
+    if (days !== undefined &&
+        days !== null &&
+        !FILES_SHARE_LINK_DAYS.includes(days)) {
+        return [
+            'shareLinkDays',
+            `shareLinkDays must be null or one of ${FILES_SHARE_LINK_DAYS.join(', ')}`,
+        ];
+    }
+    if (files.shareLinkPick !== undefined && typeof files.shareLinkPick !== 'boolean') {
+        return ['shareLinkPick', 'shareLinkPick must be true or false'];
+    }
+    if (files.spaceAlertPercent !== undefined &&
+        !wholeIn(files.spaceAlertPercent, PERCENT_MIN, PERCENT_MAX)) {
+        return [
+            'spaceAlertPercent',
+            `spaceAlertPercent must be a whole number from ${PERCENT_MIN} to ${PERCENT_MAX}`,
+        ];
+    }
+    return null;
+}
+const MAIL_SETTING_KEYS = ['fromName', 'replyTo', 'stopAfterBounces', 'bounceAlertPercent'];
+const JOBS_SETTING_KEYS = ['retries', 'alertOwners', 'pauseAfterFailures'];
+/** #1116: the field and the words when `uses.mail`'s settings object is not one the Email module can write, else null. */
+function mailSettingsProblem(mail) {
+    const stray = Object.keys(mail).find((key) => !MAIL_SETTING_KEYS.includes(key));
+    if (stray !== undefined)
+        return [stray, `has no setting ${stray}`];
+    const { fromName, replyTo, stopAfterBounces, bounceAlertPercent } = mail;
+    if (fromName !== undefined &&
+        (typeof fromName !== 'string' ||
+            fromName.length > MAIL_FROM_NAME_MAX ||
+            fromName.trim() !== fromName ||
+            !MAIL_FROM_NAME.test(fromName))) {
+        return [
+            'fromName',
+            `fromName must be 1 to ${MAIL_FROM_NAME_MAX} characters, with no space at either end and none of < > " , ; \\`,
+        ];
+    }
+    if (replyTo !== undefined &&
+        (typeof replyTo !== 'string' ||
+            replyTo.length > MAIL_REPLY_TO_MAX ||
+            !MAIL_REPLY_TO.test(replyTo))) {
+        return ['replyTo', 'replyTo must be one email address, such as help@example.com'];
+    }
+    if (stopAfterBounces !== undefined && !wholeIn(stopAfterBounces, 1, MAIL_BOUNCES_MAX)) {
+        return [
+            'stopAfterBounces',
+            `stopAfterBounces must be a whole number from 1 to ${MAIL_BOUNCES_MAX}`,
+        ];
+    }
+    if (bounceAlertPercent !== undefined && !wholeIn(bounceAlertPercent, PERCENT_MIN, PERCENT_MAX)) {
+        return [
+            'bounceAlertPercent',
+            `bounceAlertPercent must be a whole number from ${PERCENT_MIN} to ${PERCENT_MAX}`,
+        ];
+    }
+    return null;
+}
+/** #1116: the field and the words when `uses.jobs`' settings object is not one the Jobs module can write, else null. */
+function jobsSettingsProblem(jobs) {
+    const stray = Object.keys(jobs).find((key) => !JOBS_SETTING_KEYS.includes(key));
+    if (stray !== undefined)
+        return [stray, `has no setting ${stray}`];
+    const { retries, alertOwners, pauseAfterFailures } = jobs;
+    if (retries !== undefined && !wholeIn(retries, 0, JOBS_RETRIES_MAX)) {
+        return ['retries', `retries must be a whole number from 0 to ${JOBS_RETRIES_MAX}`];
+    }
+    if (alertOwners !== undefined && typeof alertOwners !== 'boolean') {
+        return ['alertOwners', 'alertOwners must be true or false'];
+    }
+    if (pauseAfterFailures !== undefined &&
+        pauseAfterFailures !== null &&
+        !wholeIn(pauseAfterFailures, 1, JOBS_PAUSE_AFTER_MAX)) {
+        return [
+            'pauseAfterFailures',
+            `pauseAfterFailures must be null or a whole number from 1 to ${JOBS_PAUSE_AFTER_MAX}`,
+        ];
+    }
+    return null;
+}
+/**
+ * `uses.mail`, `uses.jobs`, `uses.analytics` and `uses.reporting`: `true` (mail and jobs: or their settings
+ * object, #1116), `hosting.enabled`, and no `env` entry that names a value they write. `uses.reporting` also
+ * needs an entry key the reporting backend takes as a site (a letter first): the site of the entry's key is the
+ * entry key, and Boule reads an app's errors by it.
+ */
 function validateEntryMailJobs(entry, hosting) {
-    for (const [use, written, code] of [
-        ['mail', MAIL_ENTRY_ENV_NAMES, 'mail'],
-        ['jobs', JOBS_ENTRY_ENV_NAMES, 'jobs'],
-        ['analytics', ANALYTICS_ENTRY_ENV_NAMES, 'analytics'],
+    for (const [use, written, code, settings] of [
+        // A mail setting's env name clashes only while that setting is set: absent, the app's own env value stays.
+        [
+            'mail',
+            [
+                ...MAIL_ENTRY_ENV_NAMES,
+                ...MAIL_SETTINGS_ENV_NAMES.filter((name) => name in entrySettingsEnv(entry)),
+            ],
+            'mail',
+            mailSettingsProblem,
+        ],
+        ['jobs', JOBS_ENTRY_ENV_NAMES, 'jobs', jobsSettingsProblem],
+        ['analytics', ANALYTICS_ENTRY_ENV_NAMES, 'analytics', null],
+        ['reporting', REPORTING_ENTRY_ENV_NAMES, 'reporting', null],
     ]) {
         const value = entry.uses?.[use];
         if (value === undefined)
             continue;
         const path = `hosting.entries.${entry.key}.uses.${use}`;
         const at = `hosting.entries '${entry.key}' uses.${use}`;
-        if (value !== true)
-            return refusal(`${code}_not_true`, path, `${at} must be true`);
+        const isObject = typeof value === 'object' && value !== null && !Array.isArray(value);
+        if (value !== true && !(settings && isObject)) {
+            return refusal(`${code}_not_true`, path, settings ? `${at} must be true or an object of settings` : `${at} must be true`);
+        }
+        if (settings && isObject) {
+            const bad = settings(value);
+            if (bad)
+                return refusal(`${code}_settings_invalid`, `${path}.${bad[0]}`, `${at} ${bad[1]}`);
+        }
         if (!hosting.enabled) {
             return refusal(`${code}_needs_hosting`, path, `${at} requires hosting.enabled`);
         }
@@ -1365,6 +1570,9 @@ function validateEntryMailJobs(entry, hosting) {
         if (named) {
             return refusal(`${code}_env_clash`, `hosting.entries.${entry.key}.env.${named}`, `${at} writes ${named}; remove it from env`);
         }
+        if (use === 'reporting' && !REPORTING_SITE_PATTERN.test(entry.key)) {
+            return refusal('reporting_site_invalid', path, `${at} needs an entry key that starts with a letter: the key is the app's site in the reporting backend`);
+        }
     }
     return null;
 }
@@ -1630,6 +1838,11 @@ export function refuseCustomers(org) {
             return refusal('customers_sign_up_needs_enabled', 'customers.signUp', 'customers.signUp needs customers.enabled');
         }
     }
+    // Both audiences register in the customers organisation, which the registrar's record covers only with customers on.
+    const both = org.hosting.entries.find((entry) => signsInBoth(entry.uses?.auth));
+    if (both && !org.customers?.enabled) {
+        return refusal('auth_both_needs_customers', `hosting.entries.${both.key}.uses.auth.users`, `hosting.entries '${both.key}' uses.auth users 'customers' and 'staff' needs customers.enabled`);
+    }
     const open = org.hosting.entries.find((entry) => entry.uses?.auth?.registration === 'open');
     if (open && !(org.customers?.enabled && org.customers.signUp)) {
         return refusal('registration_open_needs_sign_up', `hosting.entries.${open.key}.uses.auth.registration`, `hosting.entries '${open.key}' uses.auth registration 'open' needs customers.enabled and customers.signUp`);