@wtfalch/foundry 0.76.1 → 0.77.1

package/dist/plan/app-canary-apply.js

@@ -0,0 +1,232 @@
+import { APPS_DOMAIN } from '../org.js';
+import { appCanaryArtifactUrl } from '../platform.js';
+import { WORKER_APP_DNS_RECORD, withCallTimeout } from '../worker-app-upload.js';
+import { PLATFORM_APP_CANARY_APPLIED_SHA256_SCOPE_KEY, PLATFORM_APP_CANARY_APPLIED_TAG_SCOPE_KEY, PLATFORM_APP_CANARY_DNS_SCOPE_KEY, PLATFORM_APP_CANARY_HOSTNAME, PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY, PLATFORM_APP_CANARY_REMOVED_SCOPE_KEY, PLATFORM_APP_CANARY_RESOURCE_KEY, PLATFORM_APP_CANARY_ROUTE_SCOPE_KEY, PLATFORM_APP_CANARY_SCRIPT_NAME, appCanaryDeployed, appCanaryRecorded, } from './app-canary.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY } from './platform-diff.js';
+/** The date Cloudflare's Workers runtime compatibility is pinned to; the canary needs nothing later. */
+const APP_CANARY_COMPATIBILITY_DATE = '2026-10-01';
+/** One outside call's limit: 60 s. */
+const APP_CANARY_CALL_TIMEOUT_MS = 60_000;
+/** How many times `GET https://<host>/` is asked before the step fails (rule 5: never forever). */
+const APP_CANARY_PROBE_ATTEMPTS = 6;
+/** Waits between probes: the route and record can take seconds to answer. */
+const APP_CANARY_PROBE_INTERVAL_MS = 5_000;
+/** One probe's limit. */
+const APP_CANARY_PROBE_TIMEOUT_MS = 10_000;
+const AT = 'platform:app-canary';
+const PATTERN = `${PLATFORM_APP_CANARY_HOSTNAME}/*`;
+function parse(raw) {
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+const isOurRecord = (r) => r.type === WORKER_APP_DNS_RECORD.type && r.content === WORKER_APP_DNS_RECORD.content;
+async function defaultProbe(url) {
+    const response = await fetch(url, {
+        method: 'GET',
+        redirect: 'manual',
+        signal: AbortSignal.timeout(APP_CANARY_PROBE_TIMEOUT_MS),
+    });
+    await response.body?.cancel();
+    return response.status;
+}
+/**
+ * Why the canary cannot be planned yet, read live (rule 2), or `undefined`.
+ * A script, route or DNS record on the canary's name that foundry did not
+ * make is never taken over: the plan says so and plans nothing, rather than a
+ * step that throws on every apply. A missing apps zone is the same.
+ */
+export async function appCanaryBlockedReason(deps, platform, recordedIds) {
+    const enabled = platform.appCanary?.enabled === true;
+    if (!enabled && !appCanaryRecorded(recordedIds))
+        return undefined;
+    if (!deps) {
+        return 'the app-layer canary is blocked, not planned: the host built the platform executor without its app-canary dependencies';
+    }
+    const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!enabled || !edgeUrl || !platform.appCanary?.tag)
+        return undefined;
+    const ms = deps.callTimeoutMs ?? APP_CANARY_CALL_TIMEOUT_MS;
+    const call = (label, task) => withCallTimeout(ms, `${AT}: ${label}`, task);
+    try {
+        const zones = await deps.zones(edgeUrl);
+        const zone = await call('find the apps zone', () => zones.findZoneByApex(APPS_DOMAIN));
+        if (!zone) {
+            return `the app-layer canary is blocked, not planned: edge has no zone for ${APPS_DOMAIN}`;
+        }
+        const workers = await deps.workers(edgeUrl);
+        const route = await call('find the route', () => workers.findRoute(zone.id, PATTERN));
+        if (route && route.script !== PLATFORM_APP_CANARY_SCRIPT_NAME) {
+            return `the app-layer canary is blocked, not planned: the route ${PATTERN} runs another Worker; remove it by hand`;
+        }
+        if (!appCanaryDeployed(recordedIds)) {
+            if (await call('check the script name', () => workers.scriptExists(PLATFORM_APP_CANARY_SCRIPT_NAME))) {
+                return `the app-layer canary is blocked, not planned: a Worker named ${PLATFORM_APP_CANARY_SCRIPT_NAME} already exists at Cloudflare and foundry did not make it; remove it by hand`;
+            }
+        }
+        if (!recordedIds[PLATFORM_APP_CANARY_DNS_SCOPE_KEY]) {
+            const dns = await deps.dns(edgeUrl);
+            const found = await call('look for the DNS record', () => dns.findDnsRecord(zone.name, PLATFORM_APP_CANARY_HOSTNAME));
+            if (found.length > 0 && !found.some(isOurRecord)) {
+                return `the app-layer canary is blocked, not planned: ${PLATFORM_APP_CANARY_HOSTNAME} already has a DNS record foundry did not make; remove it by hand`;
+            }
+        }
+    }
+    catch {
+        return 'the app-layer canary is blocked, not planned: edge could not be asked what is on the canary name';
+    }
+    return undefined;
+}
+/**
+ * foundry#1133: deploys the canary on the managed-app layer and records the
+ * hostname Archon's uptime probes, last, once it answers 200. The script is
+ * recorded right after its upload (a later failure leaves a half-made canary
+ * foundry owns, which the next apply repairs); the record and the route are
+ * recorded as each is made. Disabled, it clears the hostname first, so Archon
+ * stops probing, then removes the route, the record and the script.
+ */
+export async function provisionPlatformAppCanary(context, deps) {
+    const recorded = context.recordedIds();
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`${AT}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); the canary is deployed through it`);
+    }
+    const ms = deps.callTimeoutMs ?? APP_CANARY_CALL_TIMEOUT_MS;
+    const call = (label, task) => withCallTimeout(ms, `${AT}: ${label}`, task);
+    const workers = await deps.workers(edgeUrl);
+    const zones = await deps.zones(edgeUrl);
+    const dns = await deps.dns(edgeUrl);
+    const canary = context.platform.appCanary;
+    if (!canary?.enabled) {
+        await removeAppCanary(context, { workers, zones, dns, call });
+        return {};
+    }
+    if (!canary.tag || !canary.sha256) {
+        throw new Error(`${AT}: no artifact is pinned (appCanary.tag, appCanary.sha256)`);
+    }
+    // The zone and the route first: a foreign route is refused before anything is uploaded.
+    const zone = await call('find the apps zone', () => zones.findZoneByApex(APPS_DOMAIN));
+    if (!zone)
+        throw new Error(`${AT}: edge has no zone for ${APPS_DOMAIN}`);
+    const existing = await call('find the route', () => workers.findRoute(zone.id, PATTERN));
+    if (existing && existing.script !== PLATFORM_APP_CANARY_SCRIPT_NAME) {
+        throw new Error(`${AT}: the route ${PATTERN} runs another Worker; foundry does not take it over`);
+    }
+    // ---- the script ----------------------------------------------------------
+    await call('upload the script', () => workers.uploadScript({
+        name: PLATFORM_APP_CANARY_SCRIPT_NAME,
+        artifactUrl: appCanaryArtifactUrl(canary.tag),
+        artifactSha256: canary.sha256,
+        compatibilityDate: APP_CANARY_COMPATIBILITY_DATE,
+        bindings: [],
+    }));
+    context.recordScopeId(PLATFORM_APP_CANARY_RESOURCE_KEY, PLATFORM_APP_CANARY_SCRIPT_NAME);
+    context.recordScopeId(PLATFORM_APP_CANARY_REMOVED_SCOPE_KEY, '');
+    await context.persist?.();
+    // ---- the host's record ---------------------------------------------------
+    // `companyincluded.app` has no wildcard, and edge writes a company route's
+    // record itself but not a platform route's, so the host would not resolve.
+    const recordedDns = parse(context.recordedIds()[PLATFORM_APP_CANARY_DNS_SCOPE_KEY]);
+    if (recordedDns?.zone !== zone.name) {
+        const found = await call('look for the DNS record', () => dns.findDnsRecord(zone.name, PLATFORM_APP_CANARY_HOSTNAME));
+        const ours = found.find(isOurRecord);
+        let id;
+        if (ours)
+            id = ours.id;
+        else if (found.length > 0) {
+            throw new Error(`${AT}: ${PLATFORM_APP_CANARY_HOSTNAME} already has a DNS record foundry did not make; it does not replace it`);
+        }
+        else {
+            id = (await call('create the DNS record', () => dns.createDnsRecord(zone.name, {
+                ...WORKER_APP_DNS_RECORD,
+                name: PLATFORM_APP_CANARY_HOSTNAME,
+                proxied: true,
+                ttl: 1,
+            }))).id;
+        }
+        context.recordScopeId(PLATFORM_APP_CANARY_DNS_SCOPE_KEY, JSON.stringify({ zone: zone.name, id }));
+        await context.persist?.();
+    }
+    // ---- the route -----------------------------------------------------------
+    const routeId = existing?.id ??
+        (await call('create the route', () => workers.createRoute(zone.id, PATTERN, PLATFORM_APP_CANARY_SCRIPT_NAME))).id;
+    context.recordScopeId(PLATFORM_APP_CANARY_ROUTE_SCOPE_KEY, JSON.stringify({ zoneId: zone.id, id: routeId }));
+    await context.persist?.();
+    // ---- it answers ----------------------------------------------------------
+    await waitForAnswer(deps);
+    // Last: Archon probes the hostname only once it is here.
+    context.recordScopeId(PLATFORM_APP_CANARY_APPLIED_TAG_SCOPE_KEY, canary.tag);
+    context.recordScopeId(PLATFORM_APP_CANARY_APPLIED_SHA256_SCOPE_KEY, canary.sha256);
+    context.recordScopeId(PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY, PLATFORM_APP_CANARY_HOSTNAME);
+    return { resourceId: PLATFORM_APP_CANARY_SCRIPT_NAME };
+}
+/** `GET https://<host>/` until it answers 200, a bounded number of times; the error is fixed text. */
+async function waitForAnswer(deps) {
+    const probe = deps.probe ?? defaultProbe;
+    const attempts = deps.probeAttempts ?? APP_CANARY_PROBE_ATTEMPTS;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let last = 'no answer';
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            const status = await probe(`https://${PLATFORM_APP_CANARY_HOSTNAME}/`);
+            if (status === 200)
+                return;
+            last = `status ${status}`;
+        }
+        catch {
+            last = 'no answer';
+        }
+        if (attempt >= attempts) {
+            throw new Error(`${AT}: https://${PLATFORM_APP_CANARY_HOSTNAME}/ did not answer 200 after ${attempts} tries (${last}); the hostname is not recorded, so the next apply tries again`);
+        }
+        await sleep(APP_CANARY_PROBE_INTERVAL_MS);
+    }
+}
+async function removeAppCanary(context, ports) {
+    const { workers, zones, dns, call } = ports;
+    // First, so Archon stops probing a canary that is about to go.
+    context.recordScopeId(PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY, '');
+    context.recordScopeId(PLATFORM_APP_CANARY_APPLIED_TAG_SCOPE_KEY, '');
+    context.recordScopeId(PLATFORM_APP_CANARY_APPLIED_SHA256_SCOPE_KEY, '');
+    await context.persist?.();
+    const recorded = context.recordedIds();
+    const route = parse(recorded[PLATFORM_APP_CANARY_ROUTE_SCOPE_KEY]);
+    const dnsRecord = parse(recorded[PLATFORM_APP_CANARY_DNS_SCOPE_KEY]);
+    // A route made and not yet recorded is found on its pattern, and only when it runs the canary.
+    let zone;
+    const apexZone = async () => {
+        zone ??= await call('find the apps zone', () => zones.findZoneByApex(APPS_DOMAIN));
+        return zone;
+    };
+    const routes = route ? [route] : [];
+    if (!route) {
+        const z = await apexZone();
+        const found = z
+            ? await call('find the route', () => workers.findRoute(z.id, PATTERN))
+            : undefined;
+        if (z && found?.script === PLATFORM_APP_CANARY_SCRIPT_NAME)
+            routes.push({ zoneId: z.id, id: found.id });
+    }
+    for (const r of routes) {
+        await call('delete the route', () => workers.deleteRoute(r.zoneId, r.id));
+    }
+    context.recordScopeId(PLATFORM_APP_CANARY_ROUTE_SCOPE_KEY, '');
+    await context.persist?.();
+    // Only the record foundry made: `AAAA 100::` on the canary's host.
+    const zoneName = dnsRecord?.zone ?? (await apexZone())?.name;
+    if (zoneName) {
+        const found = await call('look for the DNS record', () => dns.findDnsRecord(zoneName, PLATFORM_APP_CANARY_HOSTNAME));
+        for (const r of found.filter(isOurRecord)) {
+            await call('delete the DNS record', () => dns.deleteDnsRecord(zoneName, r.id));
+        }
+    }
+    context.recordScopeId(PLATFORM_APP_CANARY_DNS_SCOPE_KEY, '');
+    await context.persist?.();
+    await call('delete the script', () => workers.deleteScript(PLATFORM_APP_CANARY_SCRIPT_NAME));
+    context.recordScopeId(PLATFORM_APP_CANARY_REMOVED_SCOPE_KEY, '1');
+}

package/dist/plan/app-canary.d.ts

@@ -0,0 +1,44 @@
+import type { DeclaredPlatform } from '../platform.js';
+import type { DraftStep } from './diff.js';
+/**
+ * foundry#1133: the app-layer canary, one `cloudflare:worker` step keyed
+ * {@link PLATFORM_APP_CANARY_KEY}. `runPlatformSteps` records the script name
+ * under `cloudflare:worker:platform:app-canary` once it succeeds.
+ */
+export declare const PLATFORM_APP_CANARY_KEY = "platform:app-canary";
+/** The Worker script's fixed name at Cloudflare, on the platform's own edge organisation. */
+export declare const PLATFORM_APP_CANARY_SCRIPT_NAME = "uptime-canary";
+/** The canary's first label under {@link APPS_DOMAIN}; locked for companies (`PLATFORM_APP_LABELS`). */
+export declare const PLATFORM_APP_CANARY_LABEL = "canary";
+/** Where the canary answers: one label under the apps zone, as archon#812 requires. */
+export declare const PLATFORM_APP_CANARY_HOSTNAME = "canary.companyincluded.app";
+/**
+ * The hostname Archon's uptime probes (`GET /`, 200). Recorded last, only once
+ * the canary answered 200 there; cleared first when the canary is removed.
+ * Archon reads exactly this key.
+ */
+export declare const PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY = "platform_app_canary_hostname";
+/** `{ zoneId, id }` of the route `canary.companyincluded.app/*`. */
+export declare const PLATFORM_APP_CANARY_ROUTE_SCOPE_KEY = "app_canary_route";
+/** `{ zone, id }` of the host's proxied `AAAA 100::` record (the zone has no wildcard). */
+export declare const PLATFORM_APP_CANARY_DNS_SCOPE_KEY = "app_canary_dns";
+export declare const PLATFORM_APP_CANARY_APPLIED_TAG_SCOPE_KEY = "app_canary_applied_tag";
+export declare const PLATFORM_APP_CANARY_APPLIED_SHA256_SCOPE_KEY = "app_canary_applied_sha256";
+export declare const PLATFORM_APP_CANARY_REMOVED_SCOPE_KEY = "app_canary_removed";
+/** The scope id of the script itself, written by `runPlatformSteps` from the step's `resourceId`. */
+export declare const PLATFORM_APP_CANARY_RESOURCE_KEY = "cloudflare:worker:platform:app-canary";
+/** Whether the script is recorded as foundry's and not removed since. */
+export declare function appCanaryDeployed(recordedIds: Readonly<Record<string, string>>): boolean;
+/** Whether anything of the canary is recorded that disabling it must remove. */
+export declare function appCanaryRecorded(recordedIds: Readonly<Record<string, string>>): boolean;
+/**
+ * The canary step. Blocked, not planned (rule 2), while no artifact is
+ * pinned, edge is not applied, or the executor lacks its dependencies or
+ * found something in the way (`executorBlocked`). Planned again when the pin
+ * changed or a run never got to recording the hostname. When the platform no
+ * longer enables it, a destructive step removes whatever of it is recorded.
+ */
+export declare function planAppCanary(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, executorBlocked: string | undefined, edgeApplied: boolean): {
+    step: DraftStep | null;
+    blocked: string[];
+};

package/dist/plan/app-canary.js

@@ -0,0 +1,110 @@
+import { APPS_DOMAIN } from '../org.js';
+/**
+ * foundry#1133: the app-layer canary, one `cloudflare:worker` step keyed
+ * {@link PLATFORM_APP_CANARY_KEY}. `runPlatformSteps` records the script name
+ * under `cloudflare:worker:platform:app-canary` once it succeeds.
+ */
+export const PLATFORM_APP_CANARY_KEY = 'platform:app-canary';
+/** The Worker script's fixed name at Cloudflare, on the platform's own edge organisation. */
+export const PLATFORM_APP_CANARY_SCRIPT_NAME = 'uptime-canary';
+/** The canary's first label under {@link APPS_DOMAIN}; locked for companies (`PLATFORM_APP_LABELS`). */
+export const PLATFORM_APP_CANARY_LABEL = 'canary';
+/** Where the canary answers: one label under the apps zone, as archon#812 requires. */
+export const PLATFORM_APP_CANARY_HOSTNAME = `${PLATFORM_APP_CANARY_LABEL}.${APPS_DOMAIN}`;
+/**
+ * The hostname Archon's uptime probes (`GET /`, 200). Recorded last, only once
+ * the canary answered 200 there; cleared first when the canary is removed.
+ * Archon reads exactly this key.
+ */
+export const PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY = 'platform_app_canary_hostname';
+/** `{ zoneId, id }` of the route `canary.companyincluded.app/*`. */
+export const PLATFORM_APP_CANARY_ROUTE_SCOPE_KEY = 'app_canary_route';
+/** `{ zone, id }` of the host's proxied `AAAA 100::` record (the zone has no wildcard). */
+export const PLATFORM_APP_CANARY_DNS_SCOPE_KEY = 'app_canary_dns';
+export const PLATFORM_APP_CANARY_APPLIED_TAG_SCOPE_KEY = 'app_canary_applied_tag';
+export const PLATFORM_APP_CANARY_APPLIED_SHA256_SCOPE_KEY = 'app_canary_applied_sha256';
+export const PLATFORM_APP_CANARY_REMOVED_SCOPE_KEY = 'app_canary_removed';
+/** The scope id of the script itself, written by `runPlatformSteps` from the step's `resourceId`. */
+export const PLATFORM_APP_CANARY_RESOURCE_KEY = `cloudflare:worker:${PLATFORM_APP_CANARY_KEY}`;
+/** Whether the script is recorded as foundry's and not removed since. */
+export function appCanaryDeployed(recordedIds) {
+    return (Boolean(recordedIds[PLATFORM_APP_CANARY_RESOURCE_KEY]) &&
+        !recordedIds[PLATFORM_APP_CANARY_REMOVED_SCOPE_KEY]);
+}
+/** Whether anything of the canary is recorded that disabling it must remove. */
+export function appCanaryRecorded(recordedIds) {
+    return (appCanaryDeployed(recordedIds) ||
+        Boolean(recordedIds[PLATFORM_APP_CANARY_ROUTE_SCOPE_KEY]) ||
+        Boolean(recordedIds[PLATFORM_APP_CANARY_DNS_SCOPE_KEY]) ||
+        Boolean(recordedIds[PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY]));
+}
+const BLOCKED = 'the app-layer canary is blocked, not planned';
+/**
+ * The canary step. Blocked, not planned (rule 2), while no artifact is
+ * pinned, edge is not applied, or the executor lacks its dependencies or
+ * found something in the way (`executorBlocked`). Planned again when the pin
+ * changed or a run never got to recording the hostname. When the platform no
+ * longer enables it, a destructive step removes whatever of it is recorded.
+ */
+export function planAppCanary(platform, recordedIds, executorBlocked, edgeApplied) {
+    const canary = platform.appCanary;
+    const action = (desired) => ({
+        system: 'cloudflare',
+        kind: 'worker',
+        key: PLATFORM_APP_CANARY_KEY,
+        desired,
+    });
+    if (!canary?.enabled) {
+        if (!appCanaryRecorded(recordedIds))
+            return { step: null, blocked: [] };
+        if (!edgeApplied) {
+            return {
+                step: null,
+                blocked: [`${BLOCKED}: its removal goes through edge, which is not applied`],
+            };
+        }
+        if (executorBlocked)
+            return { step: null, blocked: [executorBlocked] };
+        return {
+            step: {
+                action: action({ remove: true }),
+                step: {
+                    description: `remove the app-layer canary ${PLATFORM_APP_CANARY_SCRIPT_NAME}, its route and record on ${PLATFORM_APP_CANARY_HOSTNAME}, and the hostname Archon's uptime probes`,
+                    destroys: true,
+                    migrates: false,
+                },
+            },
+            blocked: [],
+        };
+    }
+    if (!canary.tag || !canary.sha256) {
+        return {
+            step: null,
+            blocked: [
+                `${BLOCKED}: no artifact is pinned; declare appCanary.tag and appCanary.sha256 (appCanaryShippedPin() gives the ones this foundry ships)`,
+            ],
+        };
+    }
+    if (!edgeApplied) {
+        return { step: null, blocked: [`${BLOCKED}: platform:edge has not been applied yet`] };
+    }
+    if (executorBlocked)
+        return { step: null, blocked: [executorBlocked] };
+    const applied = appCanaryDeployed(recordedIds) &&
+        recordedIds[PLATFORM_APP_CANARY_APPLIED_TAG_SCOPE_KEY] === canary.tag &&
+        recordedIds[PLATFORM_APP_CANARY_APPLIED_SHA256_SCOPE_KEY] === canary.sha256 &&
+        recordedIds[PLATFORM_APP_CANARY_HOSTNAME_SCOPE_KEY] === PLATFORM_APP_CANARY_HOSTNAME;
+    if (applied)
+        return { step: null, blocked: [] };
+    return {
+        step: {
+            action: action({ gitRef: canary.tag, sha256: canary.sha256 }),
+            step: {
+                description: `deploy the app-layer canary ${PLATFORM_APP_CANARY_SCRIPT_NAME} (${canary.tag}) on ${PLATFORM_APP_CANARY_HOSTNAME}, with no Access gate, and record the hostname once it answers`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: [],
+    };
+}

package/dist/plan/blue-green-apply.d.ts

@@ -61,10 +61,12 @@ export interface BlueGreenApplyDeps {
     guardInputs?: readonly string[];
     /**
      * The company the stage mail sink belongs to (its name is `<slug>-stage-sink`). Absent: no sink is made and
-     * stage holds no mail env at all, so the copy stays refused.
+     * stage holds no mail env at all, so the copy stays refused. `mailAppKey`, for an entry that sends mail, is
+     * the `MAIL_APP_KEY` stage's sends are tagged with (`<key>-work`); it is written with the sink's env.
      */
     stageSink?: {
         slug: string;
+        mailAppKey?: string;
     };
 }
 /**
@@ -119,7 +121,9 @@ export declare function applyBlueGreenWeights(deps: LbConfigDeps, subject: BlueG
 }): Promise<void>;
 /**
  * The primary blue's env for another color: the database host swapped when the server is not the primary, and
- * never the reporting names or the actions key, which differ by design. The structure apply and a deploy both
+ * never the color's own reporting names (`isColorReportingEnv`: color, release, health token) or the actions
+ * key, which differ by design. The reporting backend's address and keys (`REPORTING_URL`, `REPORTING_SITE_KEY`,
+ * `REPORTING_OPERATOR_KEY`) are the app's, not the color's, so they are copied like any other env. The structure apply and a deploy both
  * copy through this, so a color is never deployed with an older copy than the structure apply wrote.
  */
 export declare function copiedEnv(deps: {

package/dist/plan/blue-green-apply.js

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { MAIL_APP_KEY_ENV } from '../org.js';
 import { ACTIONS_KEY_ENV, COLORS, LB_CONFIG_PATH, bgKey, colorAppName, colorBackend, formatWeights, lbAppName, lbDockerfile, parseWeights, prodResources, renderLbConfig, reportingEnv, stageAppName, stageAppUrl, stageKindOf, stageResources, structureHash, } from './blue-green.js';
 import { recordBuiltCommit } from './build-record.js';
 import { withTimeout } from './call-timeout.js';
@@ -7,6 +8,7 @@ import { waitForNewDeployment } from './deploy-health.js';
 import { commandHealthCheckSettings, wgetProbe } from './health-check-settings.js';
 import { ENTRY_CONTAINER_LABELS } from './proxy-labels.js';
 import { remoteDatabaseAddress, remoteDatabaseHost } from './remote-database.js';
+import { isColorReportingEnv } from './reporting.js';
 import { STAGE_SIGN_IN_NAMES, buildStageEnv } from './stage-env.js';
 import { buildStageProbes, runStageProbes, stageProbesRecord, } from './stage-guards.js';
 import { assertStageIsolated, envClass, stageIsolationHash, } from './stage-isolation.js';
@@ -163,7 +165,9 @@ async function writeLbConfig(deps, subject, server, lbId, weights) {
 }
 /**
  * The primary blue's env for another color: the database host swapped when the server is not the primary, and
- * never the reporting names or the actions key, which differ by design. The structure apply and a deploy both
+ * never the color's own reporting names (`isColorReportingEnv`: color, release, health token) or the actions
+ * key, which differ by design. The reporting backend's address and keys (`REPORTING_URL`, `REPORTING_SITE_KEY`,
+ * `REPORTING_OPERATOR_KEY`) are the app's, not the color's, so they are copied like any other env. The structure apply and a deploy both
  * copy through this, so a color is never deployed with an older copy than the structure apply wrote.
  */
 export function copiedEnv(deps, subject, source, server) {
@@ -175,7 +179,7 @@ export function copiedEnv(deps, subject, source, server) {
     for (const env of source) {
         if (env.is_preview ||
             env.value === undefined ||
-            env.key.startsWith('REPORTING_') ||
+            isColorReportingEnv(env.key) ||
             env.key === ACTIONS_KEY_ENV) {
             continue;
         }
@@ -482,7 +486,14 @@ export async function ensureStage(deps, subject, serverUuid) {
     }
     // The sink's mail env, only once the sink app is deployed. Before that stage holds no mail env at all.
     const sinkApplied = deps.stageSink && deps.recorded()[STAGE_SINK_APPLIED_SCOPE_KEY];
-    const mail = deps.stageSink && sinkApplied ? stageMailEnv(deps.stageSink) : [];
+    const mail = deps.stageSink && sinkApplied
+        ? [
+            ...stageMailEnv(deps.stageSink),
+            ...(deps.stageSink.mailAppKey
+                ? [{ key: MAIL_APP_KEY_ENV, value: deps.stageSink.mailAppKey }]
+                : []),
+        ]
+        : [];
     const stageHas = new Map((await coolify.listEnvs(appId)).filter((e) => !e.is_preview).map((e) => [e.key, e.value]));
     const mailChanged = [...mail, ...signInEnv].some((e) => stageHas.get(e.key) !== e.value);
     stageEnv.push(...mail);

package/dist/plan/broker-entries.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { isFoundryOwnedBrokerEntryName, } from '../org.js';
+import { isFoundryOwnedBrokerEntryName, signsInBoth, signsInCustomers, } from '../org.js';
 import { entryClientIdScopeKey } from './agora.js';
 import { MCP_DATABASE_URL_ENV, MCP_OAUTH_SECRET_ENV } from './broker-mcp.js';
 import { BROKER_WORKSPACES_DATABASE_ENV, wantedWorkspaces, workspacesUrl, } from './entry-workspaces.js';
@@ -7,6 +7,7 @@ import { entryHostnames } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
 import { PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, parseBrokerDeployRecord, } from './platform-diff.js';
 import { archonOrgConflicts, brokerDeployNeeded, brokerDeployRecordValue, missingBrokerInputs, validateBrokerAppEntry, } from './platform-providers.js';
+import { registeredAppEnv } from './registered-app-env.js';
 /**
  * F5 (https://github.com/wtfalch/foundry/issues/314): an entry with
  * `uses.auth` gets one entry in the broker's `AUTH_APPS`. The org executor has
@@ -68,11 +69,23 @@ export function entryAuthEnv(org, entry, recorded, issuer) {
     const auth = entry.uses?.auth;
     if (!auth)
         return {};
-    const organizationId = auth.users === 'customers' ? recorded[`zitadel:customers:${org.id}`] : recorded.zitadel_org;
+    const organizationId = signsInCustomers(auth)
+        ? recorded[`zitadel:customers:${org.id}`]
+        : recorded.zitadel_org;
+    // An entry both sign in to holds what the broker answered its registration (ADR 0003), the team's client too.
+    const registered = signsInBoth(auth) ? registeredAppEnv(recorded, entry.key) : null;
     const values = {
         AUTH_ORGANIZATION_ID: organizationId,
-        AUTH_CLIENT_ID: recorded[entryClientIdScopeKey(entry.key)],
+        AUTH_CLIENT_ID: signsInBoth(auth)
+            ? registered?.AUTH_CLIENT_ID
+            : recorded[entryClientIdScopeKey(entry.key)],
         AUTH_ISSUER: issuer ?? undefined,
+        ...(registered
+            ? {
+                AUTH_TEAM_CLIENT_ID: registered.AUTH_TEAM_CLIENT_ID,
+                AUTH_TEAM_ORGANIZATION_ID: registered.AUTH_TEAM_ORGANIZATION_ID,
+            }
+            : {}),
     };
     const mcp = entryMcp(org, entry, recorded);
     const mcpValues = mcp
@@ -93,12 +106,14 @@ export function entryAuthEnvAppliedScopeKey(entryKey) {
 }
 export function wantedBrokerEntry(org, entry, recorded) {
     const auth = entry.uses?.auth;
-    const organizationId = auth.users === 'customers' ? recorded[`zitadel:customers:${org.id}`] : recorded.zitadel_org;
+    const organizationId = signsInCustomers(auth)
+        ? recorded[`zitadel:customers:${org.id}`]
+        : recorded.zitadel_org;
     const clientId = recorded[entryClientIdScopeKey(entry.key)];
     const mailDomain = recorded.mail_domain;
     const missing = [];
     if (!organizationId) {
-        missing.push(auth.users === 'customers'
+        missing.push(signsInCustomers(auth)
             ? { what: 'the customers organisation id', producedBy: ['zitadel', 'customers'] }
             : { what: "the org's ZITADEL org id", producedBy: ['zitadel', 'issuer'] });
     }

package/dist/plan/company-backups.js

@@ -4,6 +4,7 @@ import { BOULE_DATABASE_SCOPE_KEY } from './boule.js';
 import { CHAT_REKEY_MAS_DB_SCOPE_KEY, CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY } from './executor.js';
 import { MAIL_DATABASE_NAME, MAIL_DATABASE_SCOPE_KEY } from './mail-store.js';
 import { serviceOnServer } from './org-postgres.js';
+import { REPORTING_DATABASE_SCOPE_KEY } from './reporting.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db-tls.js';
 /**
@@ -31,6 +32,7 @@ export function companyDatabaseKeys(org) {
         chat_mas: 'coolify_chat_mas_database',
         boule: BOULE_DATABASE_SCOPE_KEY,
         analytics: ANALYTICS_DATABASE_SCOPE_KEY,
+        reporting: REPORTING_DATABASE_SCOPE_KEY,
         chat_rekey_synapse: CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY,
         chat_rekey_mas: CHAT_REKEY_MAS_DB_SCOPE_KEY,
         postgres: ORG_POSTGRES_SERVER_SCOPE_KEY,

package/dist/plan/diff.d.ts

@@ -66,6 +66,8 @@ export interface PlanOrgOptions {
     zitadelOrgMetadata?: boolean;
     /** F5: the executor was built with a `broker` port. */
     broker?: boolean;
+    /** ADR 0003: the executor was built with a `registrarApi` port, so an entry both sign in to can be registered. */
+    registrarApi?: boolean;
     /** The broker the org's entries are written to has `WORKSPACES_DATABASE_URL`, or a URL is held to give it. Absent reads as false. */
     brokerWorkspacesDatabase?: boolean;
     /** F5b: the broker has none, and the host can make the database and hold its URL (`canProvisionWorkspacesDatabase`). Absent reads as false. */
@@ -86,6 +88,16 @@ export interface PlanOrgOptions {
     keysRegistrarUrl?: string;
     /** The executor was built with an `analytics` port; without it each `uses.analytics` key is blocked. */
     analyticsPort?: boolean;
+    /** The executor was built with a `reporting` port; without it each `uses.reporting` key is blocked. */
+    reportingPort?: boolean;
+    /** foundry#1119: the executor's jobs scheduler port mints and revokes project keys; without it Boule's key per `uses.jobs` entry is blocked. */
+    jobsProjectKeys?: boolean;
+    /**
+     * foundry#1122: ai offers a company Boule's five read permissions (`ai-boule-key.ts`). With it the organisation
+     * is offered them, the org's own ai key is minted again with them, and Boule's key is minted below it; without
+     * it Boule's key is blocked.
+     */
+    aiBouleReads?: boolean;
     /** C2: true when the executor was built with a `WorkerAppDatabasePort`; a `workerApp.database` is blocked without it. */
     workerAppDatabase?: boolean;
     /** True when that port has `deletableTables`; a `workerApp.database.noDelete` is blocked without it. */
@@ -286,6 +298,16 @@ export interface OrgPostgresPlan {
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */
 export declare const JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY = "jobs_registration_undelivered";
+/**
+ * Deduped `ai.*` permissions offered to every organisation by default
+ * (Decision, this campaign's report): the minimum set that lets an org
+ * actually run jobs against the platform's own offered models --
+ * `ai.offerings:invoke` to invoke an offering, `ai.runs:create` to submit the
+ * run itself. `ai/packages/service/src/catalogue.ts`'s five `offered: true`
+ * permissions also include the three `ai.connections:*` ones, which let an
+ * organisation bring its own provider credentials (BYOK) -- a separate,
+ * explicit opt-in this default deliberately leaves out.
+ */
 /**
  * #484: the spend cap foundry applies when an org declares no AI limit
  * (`org.ai.limitMicros === null`) -- Archon creates every company that way,