@wtfalch/foundry 0.77.1 → 0.78.1

package/dist/org.d.ts

@@ -770,8 +770,8 @@ export interface EntryMail {
     bounceAlertPercent?: number;
 }
 /**
- * #1116: Jobs' settings, for the jobs scheduler's project, which does not read them yet (jobs#79 has no
- * project settings); foundry delivers them to nothing. `uses.jobs: true` is every setting at its default.
+ * Jobs' settings are delivered to the scheduler's project together with the company's owners.
+ * `uses.jobs: true` is every setting at its default.
  */
 export interface EntryJobs {
     /** How many times a failed job is tried again. Absent is {@link JOBS_RETRIES_DEFAULT}. */

package/dist/plan/diff.d.ts

@@ -92,6 +92,11 @@ export interface PlanOrgOptions {
     reportingPort?: boolean;
     /** foundry#1119: the executor's jobs scheduler port mints and revokes project keys; without it Boule's key per `uses.jobs` entry is blocked. */
     jobsProjectKeys?: boolean;
+    /** The Files port can set and remove each live app's owner space alert. */
+    serviceAlertMail?: boolean;
+    serviceAlertMailCurrent?: Partial<Record<'files' | 'jobs', boolean | 'unreadable'>>;
+    filesSpaceAlerts?: boolean;
+    jobsProjectSettings?: boolean;
     /**
      * foundry#1122: ai offers a company Boule's five read permissions (`ai-boule-key.ts`). With it the organisation
      * is offered them, the org's own ai key is minted again with them, and Boule's key is minted below it; without

package/dist/plan/diff.js

@@ -32,9 +32,11 @@ import { planEntryRepoKeys } from './entry-repo-key.js';
 import { planEntryReportingKeys } from './entry-reporting-key.js';
 import { BROKER_WORKSPACES_DATABASE_ENV, workspacesDatabaseRef } from './entry-workspaces.js';
 import { planFilesBouleKey } from './files-boule-key.js';
+import { planFilesSpaceAlerts } from './files-space-alert.js';
 import { gateIdRecordKey, hasWildcardGate, planGates } from './gates.js';
 import { githubSourceResourceKey, planGithubSource } from './github-source.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
+import { planJobsProjectSettings } from './jobs-project-settings.js';
 import { planKeysRegistrar } from './keys-registrar.js';
 import { desiredKosmosEnv, kosmosEnvDrift } from './kosmos.js';
 import { APP_GONE_KIND } from './live.js';
@@ -61,6 +63,7 @@ import { planRegisteredApps } from './registered-app.js';
 import { planRemoteDatabase } from './remote-database.js';
 import { planReportingBoule } from './reporting-boule.js';
 import { REPORTING_MAIL_TOKEN_ENV, desiredReportingEnv, reportingEnvDrift, reportingWanted, } from './reporting.js';
+import { planServiceAlertMail } from './service-alert-mail.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_IMAGE_TAG_SUFFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_LOGIN_INTERNAL_NAME, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, inAppSignIn, inAppStatePairs, inAppTargets, signInLoginNames, } from './sign-in.js';
 import { withStepSystem } from './step-system.js';
@@ -750,6 +753,10 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     // foundry#1121: Boule's files key, after Boule and after the org's own files key it is minted below.
     const filesBouleKey = planFilesBouleKey(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)());
     plannedSteps.push(...filesBouleKey.steps);
+    const filesSpaceAlerts = planFilesSpaceAlerts(org, recordedIds, platformReadiness.filesReady && !filesOrganisation.blocked, options.filesSpaceAlerts ?? false);
+    plannedSteps.push(...filesSpaceAlerts.steps);
+    const serviceAlertMail = planServiceAlertMail(org, platformReadiness, options.serviceAlertMail ?? false, options.ownMailKeyHeld ?? false, options.serviceAlertMailCurrent);
+    plannedSteps.push(...serviceAlertMail.steps);
     // foundry#1122: Boule's ai key, after Boule and after the org's own ai key it is minted below.
     const aiBouleKey = planAiBouleKey(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)(), aiBouleReads);
     plannedSteps.push(...aiBouleKey.steps);
@@ -805,6 +812,8 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     // A `uses.jobs` entry registers with the scheduler after its app, whose env the step writes.
     const entryJobs = planEntryJobs(org, recordedIds, plannedSteps, platformReadiness, schedulerUsable);
     plannedSteps.push(...entryJobs.steps);
+    const jobsSettings = planJobsProjectSettings(org, recordedIds, plannedSteps, schedulerUsable, options.jobsProjectSettings ?? false);
+    plannedSteps.push(...jobsSettings.steps);
     // foundry#1119: Boule's key for each entry's project, after the project and after Boule.
     const entryJobsBouleKeys = planEntryJobsBouleKeys(org, recordedIds, plannedSteps, platformReadiness, options.jobsProjectKeys ?? false);
     plannedSteps.push(...entryJobsBouleKeys.steps);
@@ -1086,6 +1095,8 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     unmanaged.push(...workspaces.unmanaged);
     unmanaged.push(...filesKeys.blocked);
     unmanaged.push(...filesBouleKey.blocked);
+    unmanaged.push(...filesSpaceAlerts.blocked);
+    unmanaged.push(...serviceAlertMail.blocked);
     unmanaged.push(...entryAiKeys.blocked);
     unmanaged.push(...aiBouleKey.blocked);
     unmanaged.push(...edgeWorkers.blocked);
@@ -1108,6 +1119,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     unmanaged.push(...appsDbRoute.blocked);
     unmanaged.push(...appsZones.blocked);
     unmanaged.push(...entryJobs.blocked);
+    unmanaged.push(...jobsSettings.blocked);
     unmanaged.push(...entryJobsBouleKeys.blocked);
     unmanaged.push(...authEventsBlocked(org, recordedIds));
     unmanaged.push(...entryAudit.blocked);

package/dist/plan/executor.d.ts

@@ -13,7 +13,9 @@ import { type DnsPort, type EdgePlatformDns } from './edge-dns.js';
 import { type EdgePlatformRateLimits, type RateLimitPort } from './edge-ratelimits.js';
 import { type EdgePlatformTunnels, type TunnelPort } from './edge-tunnels.js';
 import { type EdgePlatformZones, type ZonePort } from './edge-zones.js';
+import { type FilesSpaceAlertPort } from './files-space-alert.js';
 import type { GithubDeployKeysPort } from './github-deploy-keys.js';
+import { type JobsProjectSettings } from './jobs-project-settings.js';
 import { type KeysRegistrarPort } from './keys-registrar.js';
 import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
@@ -25,6 +27,7 @@ import type { RequestHeaderPort } from './platform-providers.js';
 import { type RegistrarApiPort } from './registered-app.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
 import { type ReportingPort } from './reporting.js';
+import { type ServiceAlertMailWant } from './service-alert-mail.js';
 import { type StageCopyHostConfig } from './stage-copy-host.js';
 import { type ReleasePreviewMembers, type StageProbePort } from './stage-guards.js';
 import type { WorkerAppDatabasePort } from './worker-app-database.js';
@@ -1375,6 +1378,8 @@ export interface ZitadelListAppsRawApp {
  * an operator's `MANAGEMENT_PUBLIC_KEYS`/`MANAGEMENT_ISSUER` pins.
  */
 export interface FilesOrganisationPort {
+    setSpaceAlert?: FilesSpaceAlertPort['setSpaceAlert'];
+    removeSpaceAlert?: FilesSpaceAlertPort['removeSpaceAlert'];
     /**
      * An own files host's R2 storage key, sent to that host once (the files route
      * `PUT /v1/manage/r2-credentials`). Absent on a port that cannot: the own R2 key step is then
@@ -1706,6 +1711,8 @@ export interface BouleOwnersPort {
     }>;
 }
 export interface JobsSchedulerPort {
+    /** Deliver settings without re-registering or minting project credentials. */
+    setProjectSettings?(project: string, settings: JobsProjectSettings): Promise<void>;
     registerProject(input: {
         name: string;
         baseUrl: string;
@@ -2197,6 +2204,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * timeout. `undefined` when there is nothing to read: the ref is a tag or a commit (it names one build), or the
      * host supplies no read. A failed or malformed read is a fixed reason, never the cause (it can echo a credential).
      */
+    serviceAlertMailCurrent(want: ServiceAlertMailWant, ids: Readonly<Record<string, string>>): Promise<boolean>;
     ownAuthHead(gitRef: string): Promise<OwnAuthHead | undefined>;
     /** Whether the held keys can store a Worker app database's CA and certificate. */
     workerAppDbKeysPuttable(): boolean;

package/dist/plan/executor.js

@@ -57,11 +57,13 @@ import { ensureRepoKey, removeRepoKey } from './entry-repo-key-apply.js';
 import { ENTRY_REPORTING_KEY_DELIVERY_ATTEMPTS, entryReportingAppliedScopeKey, entryReportingRetiredScopeKey, entryReportingUndeliveredScopeKey, stageReportingKeyName, } from './entry-reporting-key.js';
 import { BROKER_WORKSPACES_DATABASE_ENV, ensureWorkspacesKey, heldWorkspacesDatabase, heldWorkspacesKey, workspacesDatabaseRef, workspacesKeyHash, workspacesKeyRef, } from './entry-workspaces.js';
 import { ensureFilesBouleKey, retireFilesBouleKey } from './files-boule-key-apply.js';
+import { applyFilesSpaceAlert, } from './files-space-alert.js';
 import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
 import { GITHUB_SOURCE_INSTALLATION_SCOPE_KEY, GITHUB_SOURCE_TIMEOUT_MS, ensureGithubSource, githubSourceResourceKey, } from './github-source.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
 import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
 import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, workspaceHost, } from './hostnames.js';
+import { applyJobsProjectSettings, } from './jobs-project-settings.js';
 import { KEYS_REGISTRAR_DELIVERY_ATTEMPTS, KEYS_REGISTRAR_KEY_DAYS, KEYS_REGISTRAR_KEY_ENV, KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY, KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, KEYS_REGISTRAR_URL_ENV, } from './keys-registrar.js';
 import { KOSMOS_CLIENT_ID_SCOPE_KEY, KOSMOS_DATABASE_SCOPE_KEY, KOSMOS_DEPLOYED_SCOPE_KEY, desiredKosmosEnv, kosmosEnvDrift, kosmosHostnameFor, } from './kosmos.js';
 import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION, LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
@@ -90,6 +92,7 @@ import { STAGE_DEPLOY_ATTEMPTS, STAGE_DEPLOY_INTERVAL_MS, createReleaseHost, } f
 import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
 import { REPORTING_BOULE_APPLIED_SCOPE_KEY, REPORTING_BOULE_ENV_NAMES, reportingBouleMarker, } from './reporting-boule.js';
 import { REPORTING_DATABASE_SCOPE_KEY, REPORTING_DEPLOYED_SCOPE_KEY, REPORTING_OPERATOR_KEY_ENV, desiredReportingEnv, reportingEnvDrift, reportingHostnameFor, reportingUrlFor, } from './reporting.js';
+import { applyServiceAlertMail, serviceAlertMailCurrent, } from './service-alert-mail.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
@@ -1147,6 +1150,14 @@ export class FoundryStepExecutor {
      * timeout. `undefined` when there is nothing to read: the ref is a tag or a commit (it names one build), or the
      * host supplies no read. A failed or malformed read is a fixed reason, never the cause (it can echo a credential).
      */
+    async serviceAlertMailCurrent(want, ids) {
+        return serviceAlertMailCurrent({
+            want,
+            ids,
+            coolify: this.ports.coolify,
+            resolve: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
+        });
+    }
     async ownAuthHead(gitRef) {
         const read = this.ports.ownServices?.readBranchHead?.bind(this.ports.ownServices);
         if (!read || !isBranchRef(gitRef))
@@ -1441,6 +1452,53 @@ export class FoundryStepExecutor {
                 return this.filesOrganisation(action, org, context);
             case 'files:boule-key':
                 return this.filesBouleKey(action, org, context);
+            case 'coolify:service-alert-mail': {
+                await applyServiceAlertMail({
+                    want: action.desired,
+                    ids: context.recordedIds(),
+                    coolify: this.ports.coolify,
+                    resolve: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
+                    secret: (value) => {
+                        this.handledSecrets.add(value);
+                    },
+                    record: (key, value) => context.recordScopeId(key, value),
+                    forget: (key) => forgetScopeId(context, key),
+                    persist: () => context.persistScopeIds(),
+                });
+                return {};
+            }
+            case 'jobs:settings': {
+                const jobs = await this.jobsPort(org);
+                if (!jobs.setProjectSettings)
+                    throw new Error('The scheduler cannot deliver project settings.');
+                await applyJobsProjectSettings({
+                    org,
+                    want: action.desired,
+                    ids: context.recordedIds(),
+                    port: { setProjectSettings: jobs.setProjectSettings.bind(jobs) },
+                    record: (key, value) => context.recordScopeId(key, value),
+                    persist: () => context.persistScopeIds(),
+                });
+                return {};
+            }
+            case 'files:space-alert': {
+                const files = await this.filesPort();
+                if (!files.setSpaceAlert || !files.removeSpaceAlert)
+                    throw new Error('The Files service cannot set and remove space alerts.');
+                await applyFilesSpaceAlert({
+                    org,
+                    want: action.desired,
+                    ids: context.recordedIds(),
+                    port: {
+                        setSpaceAlert: files.setSpaceAlert.bind(files),
+                        removeSpaceAlert: files.removeSpaceAlert.bind(files),
+                    },
+                    record: (key, value) => context.recordScopeId(key, value),
+                    forget: (key) => forgetScopeId(context, key),
+                    persist: () => context.persistScopeIds(),
+                });
+                return {};
+            }
             case 'files:key':
                 // The org's own key is keyed `<orgId>`, an entry's `<orgId>:<entry>` (F6b).
                 return action.key.includes(':')

package/dist/plan/files-space-alert.d.ts

@@ -0,0 +1,40 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+export interface FilesSpaceAlertInput {
+    percent?: number;
+    name: string;
+    collections: string[];
+    recipients: string[];
+}
+export interface FilesSpaceAlertPort {
+    setSpaceAlert(orgId: string, entryKey: string, input: FilesSpaceAlertInput): Promise<unknown>;
+    removeSpaceAlert(orgId: string, entryKey: string): Promise<unknown>;
+}
+export declare const filesSpaceAlertScopeKey: (key: string) => string;
+/** Addresses are resolved only during apply. Plans and recorded ids hold their hash. */
+export declare function filesSpaceAlertInput(org: DeclaredOrg, entryKey: string, ids: Readonly<Record<string, string>>): FilesSpaceAlertInput | null;
+export type FilesSpaceAlertWant = {
+    entryKey: string;
+    hash: string;
+} | {
+    entryKey: string;
+    remove: true;
+};
+export declare function planFilesSpaceAlerts(org: DeclaredOrg, ids: Readonly<Record<string, string>>, ready: boolean, capable: boolean): {
+    steps: DraftStep[];
+    blocked: {
+        key: string;
+        description: string;
+    }[];
+};
+/** Idempotent delivery; a failed or timed-out call records nothing and can be retried. */
+export declare function applyFilesSpaceAlert(input: {
+    org: DeclaredOrg;
+    want: FilesSpaceAlertWant;
+    ids: Readonly<Record<string, string>>;
+    port: FilesSpaceAlertPort;
+    record(key: string, value: string): void;
+    forget(key: string): void;
+    persist(): Promise<void>;
+    timeoutMs?: number;
+}): Promise<void>;

package/dist/plan/files-space-alert.js

@@ -0,0 +1,90 @@
+import { createHash } from 'node:crypto';
+import { isLiveEntry } from '../org.js';
+import { withTimeout } from './call-timeout.js';
+import { entryCollectionNames } from './entry-files-key.js';
+const PREFIX = 'files_space_alert_';
+export const filesSpaceAlertScopeKey = (key) => `${PREFIX}${key}`;
+/** Addresses are resolved only during apply. Plans and recorded ids hold their hash. */
+export function filesSpaceAlertInput(org, entryKey, ids) {
+    const entry = org.hosting.enabled
+        ? org.hosting.entries.find((e) => e.key === entryKey && isLiveEntry(e) && e.uses?.files)
+        : undefined;
+    if (!entry?.uses?.files)
+        return null;
+    return {
+        name: entry.key,
+        ...(entry.uses.files.spaceAlertPercent === undefined
+            ? {}
+            : { percent: entry.uses.files.spaceAlertPercent }),
+        collections: [...new Set(Object.values(entryCollectionNames(entry, ids)))].sort(),
+        recipients: [...new Set(org.owners.map((owner) => owner.email.trim().toLowerCase()))].sort(),
+    };
+}
+const hashOf = (input) => createHash('sha256').update(JSON.stringify(input)).digest('hex');
+export function planFilesSpaceAlerts(org, ids, ready, capable) {
+    const steps = [];
+    const blocked = [];
+    const keys = new Set([
+        ...org.hosting.entries.filter((e) => isLiveEntry(e) && e.uses?.files).map((e) => e.key),
+        ...Object.keys(ids)
+            .filter((key) => key.startsWith(PREFIX))
+            .map((key) => key.slice(PREFIX.length)),
+    ]);
+    for (const entryKey of [...keys].sort()) {
+        const input = filesSpaceAlertInput(org, entryKey, ids);
+        const hash = input ? hashOf(input) : null;
+        if (hash === ids[filesSpaceAlertScopeKey(entryKey)] ||
+            (!input && !ids[filesSpaceAlertScopeKey(entryKey)]))
+            continue;
+        const key = `files:space-alert:${org.id}:${entryKey}`;
+        const reason = !ready
+            ? 'the Files service is not ready'
+            : !capable
+                ? 'the host cannot set and remove space alerts'
+                : input && (input.collections.length < 1 || input.collections.length > 50)
+                    ? 'the app needs between one and fifty collections'
+                    : input && input.recipients.length > 20
+                        ? 'the service accepts at most twenty owners'
+                        : null;
+        if (reason) {
+            blocked.push({
+                key,
+                description: `${org.slug}'s space alert for ${entryKey} is blocked: ${reason}`,
+            });
+            continue;
+        }
+        steps.push({
+            action: {
+                system: 'files',
+                kind: 'space-alert',
+                key: `${org.id}:${entryKey}`,
+                desired: input ? { entryKey, hash } : { entryKey, remove: true },
+            },
+            step: {
+                description: `${input ? 'set' : 'remove'} the space alert for ${org.slug}'s ${entryKey}`,
+                destroys: !input,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}
+/** Idempotent delivery; a failed or timed-out call records nothing and can be retried. */
+export async function applyFilesSpaceAlert(input) {
+    const { org, want, ids, port } = input;
+    const desired = filesSpaceAlertInput(org, want.entryKey, ids);
+    const marker = filesSpaceAlertScopeKey(want.entryKey);
+    if ('remove' in want) {
+        if (desired)
+            throw new Error('The app uses Files again. Make a new plan before removing its alert.');
+        await withTimeout('Files space alert removal', input.timeoutMs ?? 30_000, () => port.removeSpaceAlert(org.id, want.entryKey));
+        input.forget(marker);
+    }
+    else {
+        if (!desired || hashOf(desired) !== want.hash)
+            throw new Error('The app or its owners changed. Make a new plan before setting its alert.');
+        await withTimeout('Files space alert delivery', input.timeoutMs ?? 30_000, () => port.setSpaceAlert(org.id, want.entryKey, desired));
+        input.record(marker, want.hash);
+    }
+    await input.persist();
+}

package/dist/plan/jobs-project-settings.d.ts

@@ -0,0 +1,33 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+export interface JobsProjectSettings {
+    retries: number;
+    alertOwners: boolean;
+    pauseAfterFailures: number | null;
+    owners: string[];
+}
+export interface JobsProjectSettingsPort {
+    setProjectSettings(project: string, settings: JobsProjectSettings): Promise<void>;
+}
+export interface JobsProjectSettingsWant {
+    entryKey: string;
+    hash: string;
+}
+export declare const jobsProjectSettingsScopeKey: (key: string) => string;
+export declare function jobsProjectSettings(org: DeclaredOrg, entryKey: string): JobsProjectSettings | null;
+export declare function planJobsProjectSettings(org: DeclaredOrg, ids: Readonly<Record<string, string>>, planned: readonly DraftStep[], ready: boolean, capable: boolean): {
+    steps: DraftStep[];
+    blocked: {
+        key: string;
+        description: string;
+    }[];
+};
+export declare function applyJobsProjectSettings(input: {
+    org: DeclaredOrg;
+    want: JobsProjectSettingsWant;
+    ids: Readonly<Record<string, string>>;
+    port: JobsProjectSettingsPort;
+    record(key: string, value: string): void;
+    persist(): Promise<void>;
+    timeoutMs?: number;
+}): Promise<void>;

package/dist/plan/jobs-project-settings.js

@@ -0,0 +1,77 @@
+import { createHash } from 'node:crypto';
+import { JOBS_RETRIES_DEFAULT } from '../entry-rules.js';
+import { isLiveEntry } from '../org.js';
+import { withTimeout } from './call-timeout.js';
+import { entryJobsAppliedScopeKey, entryJobsProjectName, entryJobsUndeliveredScopeKey, } from './entry-jobs.js';
+export const jobsProjectSettingsScopeKey = (key) => `jobs_project_settings.${key}`;
+export function jobsProjectSettings(org, entryKey) {
+    const entry = org.hosting.enabled
+        ? org.hosting.entries.find((e) => e.key === entryKey && isLiveEntry(e) && e.uses?.jobs)
+        : undefined;
+    if (!entry?.uses?.jobs)
+        return null;
+    const settings = entry.uses.jobs === true ? {} : entry.uses.jobs;
+    return {
+        retries: settings.retries ?? JOBS_RETRIES_DEFAULT,
+        alertOwners: settings.alertOwners ?? true,
+        pauseAfterFailures: settings.pauseAfterFailures ?? null,
+        owners: [...new Set(org.owners.map((owner) => owner.email.trim().toLowerCase()))].sort(),
+    };
+}
+const hashOf = (project, settings) => createHash('sha256')
+    .update(JSON.stringify([project, settings]))
+    .digest('hex');
+export function planJobsProjectSettings(org, ids, planned, ready, capable) {
+    const steps = [];
+    const blocked = [];
+    for (const entry of org.hosting.entries) {
+        const settings = jobsProjectSettings(org, entry.key);
+        if (!settings)
+            continue;
+        const hash = hashOf(entryJobsProjectName(org, entry.key), settings);
+        if (ids[jobsProjectSettingsScopeKey(entry.key)] === hash)
+            continue;
+        const key = `${org.id}:${entry.key}`;
+        const projectReady = !ids[entryJobsUndeliveredScopeKey(entry.key)] &&
+            (Boolean(ids[entryJobsAppliedScopeKey(entry.key)]) ||
+                planned.some((p) => p.action.system === 'jobs' && p.action.kind === 'project' && p.action.key === key));
+        const reason = !ready
+            ? 'the scheduler is not ready'
+            : !capable
+                ? 'the host cannot deliver project settings'
+                : !projectReady
+                    ? 'the project and its credentials must be provisioned first'
+                    : settings.owners.length > 50
+                        ? 'the scheduler accepts at most fifty owners'
+                        : null;
+        if (reason) {
+            blocked.push({
+                key: `jobs:settings:${key}`,
+                description: `${org.slug}'s settings for ${entry.key} are blocked: ${reason}`,
+            });
+            continue;
+        }
+        steps.push({
+            action: { system: 'jobs', kind: 'settings', key, desired: { entryKey: entry.key, hash } },
+            step: {
+                description: `set the job settings and owner alerts for ${org.slug}'s ${entry.key}`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}
+export async function applyJobsProjectSettings(input) {
+    const { org, want, ids } = input;
+    const settings = jobsProjectSettings(org, want.entryKey);
+    const name = entryJobsProjectName(org, want.entryKey);
+    if (!settings || hashOf(name, settings) !== want.hash)
+        throw new Error('The app or its owners changed. Make a new plan before setting its job settings.');
+    if (!ids[entryJobsAppliedScopeKey(want.entryKey)] ||
+        ids[entryJobsUndeliveredScopeKey(want.entryKey)])
+        throw new Error('The job project and its credentials must be provisioned before setting its settings.');
+    await withTimeout('Job settings delivery', input.timeoutMs ?? 30_000, () => input.port.setProjectSettings(name, settings));
+    input.record(jobsProjectSettingsScopeKey(want.entryKey), want.hash);
+    await input.persist();
+}

package/dist/plan/jobs-scheduler-http.d.ts

@@ -1,4 +1,5 @@
 import type { JobsSchedulerPort } from './executor.js';
+import type { JobsProjectSettings } from './jobs-project-settings.js';
 /**
  * #173: the real {@link JobsSchedulerPort}, a thin client over the jobs
  * scheduler's admin HTTP API (https://github.com/wtfalch/jobs README, "The
@@ -17,6 +18,7 @@ export declare class HttpJobsSchedulerClient implements JobsSchedulerPort {
     private readonly fetchImpl;
     private readonly baseUrl;
     constructor(baseUrl: string, adminToken: string, fetchImpl?: typeof fetch);
+    setProjectSettings(project: string, settings: JobsProjectSettings): Promise<void>;
     registerProject(input: {
         name: string;
         baseUrl: string;

package/dist/plan/jobs-scheduler-http.js

@@ -22,6 +22,16 @@ export class HttpJobsSchedulerClient {
         this.fetchImpl = fetchImpl;
         this.baseUrl = baseUrl.replace(/\/+$/, '');
     }
+    async setProjectSettings(project, settings) {
+        const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(project)}/settings`, {
+            method: 'PUT',
+            headers: { authorization: `Bearer ${this.adminToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify(settings),
+            signal: AbortSignal.timeout(ADMIN_CALL_TIMEOUT_MS),
+        });
+        if (response.status !== 200)
+            throw new Error(`jobs scheduler: PUT /admin/projects/<name>/settings answered ${response.status}`);
+    }
     async registerProject(input) {
         const response = await this.fetchImpl(`${this.baseUrl}/admin/projects`, {
             method: 'POST',

package/dist/plan/plan-apply.d.ts

@@ -22,6 +22,7 @@ import type { OwnAuthHead } from './own-diff.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
+import { type ServiceAlertMailWant } from './service-alert-mail.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
     readonly id: string;
@@ -182,6 +183,7 @@ export interface StepExecutionContext {
  * `FoundryStepExecutor`).
  */
 export interface StepExecutor {
+    serviceAlertMailCurrent?(want: ServiceAlertMailWant, ids: Readonly<Record<string, string>>): Promise<boolean>;
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -626,6 +628,10 @@ export interface FoundryPlanApplyOptions {
      * `uses.jobs` entry's Boule key is reported blocked.
      */
     jobsProjectKeys?: boolean;
+    /** The host can deliver per-app Files space alerts. */
+    serviceAlertMail?: boolean;
+    filesSpaceAlerts?: boolean;
+    jobsProjectSettings?: boolean;
     /**
      * foundry#1122: true once ai offers a company Boule's five read permissions (`ai.usage:read`,
      * `ai.runs:read`, `ai.budgets:read`, `ai.budgets:update`, `ai.offerings:read`; all `offered: false` today).
@@ -801,6 +807,9 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly analyticsPort;
     private readonly reportingPort;
     private readonly jobsProjectKeys;
+    private readonly serviceAlertMail;
+    private readonly filesSpaceAlerts;
+    private readonly jobsProjectSettings;
     private readonly aiBouleReads;
     private readonly workerAppDatabase;
     private readonly workerAppNoDeleteCheck;
@@ -1060,6 +1069,7 @@ export declare class FoundryPlanApply implements PlanApply {
     /** #886: the head of an own org's declared auth branch, or nothing when the org is not own or the executor has no read. */
     private ownAuthHeadFor;
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
+    private readServiceAlertMail;
     private ownMailKeyHeld;
     /** An own org's registrar token is held (a rerun after a crash delivers it instead of blocking). */
     private ownRegistrarTokenHeld;

package/dist/plan/plan-apply.js

@@ -41,6 +41,7 @@ import { privatePageGateKey } from './private-pages.js';
 import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { finishStageCopy, runSubjectRelease, } from './release-host.js';
 import { remoteDatabaseFactsFrom, remoteDatabaseKeys } from './remote-database.js';
+import { planServiceAlertMail } from './service-alert-mail.js';
 import { STAGE_COPY_LOCK_MS, claimStageCopyLock, parseStageCopyLock, stageCopyLockValue, } from './stage-copy-host.js';
 import { heldSecretId, heldSecretVersion, liveWorkerApps, workerAppTraceScopeKeys, } from './worker-app.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
@@ -194,6 +195,9 @@ export class FoundryPlanApply {
     analyticsPort;
     reportingPort;
     jobsProjectKeys;
+    serviceAlertMail;
+    filesSpaceAlerts;
+    jobsProjectSettings;
     aiBouleReads;
     workerAppDatabase;
     workerAppNoDeleteCheck;
@@ -244,6 +248,9 @@ export class FoundryPlanApply {
         this.analyticsPort = options.analyticsPort ?? false;
         this.reportingPort = options.reportingPort ?? false;
         this.jobsProjectKeys = options.jobsProjectKeys ?? false;
+        this.filesSpaceAlerts = options.filesSpaceAlerts ?? false;
+        this.serviceAlertMail = options.serviceAlertMail ?? false;
+        this.jobsProjectSettings = options.jobsProjectSettings ?? false;
         this.aiBouleReads = options.aiBouleReads ?? false;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
         this.workerAppNoDeleteCheck = options.workerAppNoDeleteCheck ?? false;
@@ -1720,6 +1727,10 @@ export class FoundryPlanApply {
             analyticsPort: this.analyticsPort,
             reportingPort: this.reportingPort,
             jobsProjectKeys: this.jobsProjectKeys,
+            filesSpaceAlerts: this.filesSpaceAlerts,
+            serviceAlertMail: this.serviceAlertMail,
+            serviceAlertMailCurrent: await this.readServiceAlertMail(org, platformReadiness, recorded),
+            jobsProjectSettings: this.jobsProjectSettings,
             aiBouleReads: this.aiBouleReads,
             workerAppDatabase: this.workerAppDatabase,
             workerAppNoDeleteCheck: this.workerAppNoDeleteCheck,
@@ -1995,6 +2006,21 @@ export class FoundryPlanApply {
         return head ? { ownAuthHead: head } : {};
     }
     /** An own org's Lettermint key is held. A resolver that throws counts as not held. */
+    async readServiceAlertMail(org, readiness, ids) {
+        const current = {};
+        const planned = planServiceAlertMail(org, readiness, this.serviceAlertMail, await this.ownMailKeyHeld(org));
+        for (const step of planned.steps) {
+            const want = step.action.desired;
+            try {
+                current[want.service] =
+                    (await this.executor.serviceAlertMailCurrent?.(want, ids)) ?? 'unreadable';
+            }
+            catch {
+                current[want.service] = 'unreadable';
+            }
+        }
+        return current;
+    }
     async ownMailKeyHeld(org) {
         const held = this.platformDeps?.heldKeys;
         if (!ownsServices(org) || !held)

package/dist/plan/platform-diff.d.ts

@@ -1262,6 +1262,7 @@ export declare const PLATFORM_USAGE_TAIL_SCRIPT_NAME = "platform-usage-tail";
 export declare const PLATFORM_USAGE_TAIL_KEY_REF = "usage-tail:worker:key";
 export declare const PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY = "usage_tail_key_undelivered";
 export declare const PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY = "usage_tail_key_set";
+export declare const PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY = "usage_tail_applied_url";
 export declare const PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY = "usage_tail_applied_tag";
 export declare const PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY = "usage_tail_applied_sha256";
 export declare const PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY = "usage_tail_removed";

package/dist/plan/platform-diff.js

@@ -1461,6 +1461,7 @@ export const PLATFORM_USAGE_TAIL_SCRIPT_NAME = 'platform-usage-tail';
 export const PLATFORM_USAGE_TAIL_KEY_REF = 'usage-tail:worker:key';
 export const PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY = 'usage_tail_key_undelivered';
 export const PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY = 'usage_tail_key_set';
+export const PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY = 'usage_tail_applied_url';
 export const PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY = 'usage_tail_applied_tag';
 export const PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY = 'usage_tail_applied_sha256';
 export const PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY = 'usage_tail_removed';
@@ -3488,12 +3489,17 @@ function planUsageTail(platform, recordedIds, executorBlocked, edgeApplied) {
     const applied = deployed &&
         Boolean(recordedIds[PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY]) &&
         recordedIds[PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY] === usageTail.tag &&
-        recordedIds[PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY] === usageTail.sha256;
+        recordedIds[PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY] === usageTail.sha256 &&
+        recordedIds[PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY] === `https://${platform.edge.hostname}`;
     if (applied)
         return { step: null, blocked: [] };
     return {
         step: {
-            action: action({ gitRef: usageTail.tag, sha256: usageTail.sha256 }),
+            action: action({
+                gitRef: usageTail.tag,
+                sha256: usageTail.sha256,
+                url: `https://${platform.edge.hostname}`,
+            }),
             step: {
                 description: `deploy the usage tail Worker ${PLATFORM_USAGE_TAIL_SCRIPT_NAME} from edge release ${usageTail.tag}, with its held key`,
                 destroys: false,

package/dist/plan/platform-org.d.ts

@@ -69,6 +69,9 @@ export interface OrgPlatformReadiness {
     platformLettermintProjectId: string | null;
     /** The files host (#171). Files is always on for every org (#80), so `false` always blocks rather than only mattering when a flag is set. */
     filesReady: boolean;
+    /** Existing production service hosts, for alert sender reconciliation. */
+    filesAppId?: string;
+    jobsAppId?: string;
     /**
      * The files host's internal address, which an entry with `uses.files` gets
      * as `FILES_URL`. `null` or absent until the platform has recorded it.

package/dist/plan/platform-org.js

@@ -137,6 +137,8 @@ edgePortPresent = false) {
         platformOwnerOrgId: platform.ownerOrgId || null,
         platformLettermintProjectId: platform.mail.lettermintProjectId ?? null,
         filesReady: filesApplied && missingKeys.files === null,
+        filesAppId: platformRecordedIds[OWN_FILES_RUNNER_SCOPE_KEY],
+        jobsAppId: platformRecordedIds[`coolify:jobs:${JOBS_SCHEDULER_KEY}`],
         filesUrl: filesApplied
             ? (platformRecordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] ?? null)
             : null,
@@ -231,6 +233,8 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
         authReady,
         authIssuer: authReady ? ownHostnames(org).issuerUrl : null,
         filesReady: filesApplied && filesUrl !== undefined && missingKeys.files === null,
+        filesAppId: orgRecordedIds[OWN_FILES_RUNNER_SCOPE_KEY],
+        jobsAppId: orgRecordedIds[`coolify:own-jobs:${org.id}`],
         filesUrl: filesApplied ? (filesUrl ?? null) : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
         ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),

package/dist/plan/service-alert-mail.d.ts

@@ -0,0 +1,36 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { CoolifyPort } from './executor.js';
+import type { OrgPlatformReadiness } from './platform-org.js';
+export interface ServiceAlertMailWant {
+    service: 'files' | 'jobs';
+    appId: string;
+    from: string;
+    tokenRef: string;
+}
+/** Reconcile existing service hosts against live env, including held-token rotations. */
+export declare function planServiceAlertMail(org: DeclaredOrg, readiness: OrgPlatformReadiness, capable: boolean, ownMailKeyHeld: boolean, current?: Partial<Record<'files' | 'jobs', boolean | 'unreadable'>>): {
+    steps: DraftStep[];
+    blocked: {
+        key: string;
+        description: string;
+    }[];
+};
+export declare function applyServiceAlertMail(input: {
+    want: ServiceAlertMailWant;
+    ids: Readonly<Record<string, string>>;
+    coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs' | 'deployAndWait'>;
+    resolve(ref: string): Promise<string | null>;
+    secret(value: string): void;
+    record(key: string, value: string): void;
+    forget(key: string): void;
+    persist(): Promise<void>;
+    timeoutMs?: number;
+}): Promise<void>;
+/** Compare in memory only; no token or token digest is exposed to the planner. */
+export declare function serviceAlertMailCurrent(input: {
+    want: ServiceAlertMailWant;
+    ids: Readonly<Record<string, string>>;
+    coolify: Pick<CoolifyPort, 'listEnvs'>;
+    resolve(ref: string): Promise<string | null>;
+}): Promise<boolean>;

package/dist/plan/service-alert-mail.js

@@ -0,0 +1,105 @@
+import { ownsServices } from '../org.js';
+import { withTimeout } from './call-timeout.js';
+import { ownHostnames } from './own-hostnames.js';
+import { orgTarget, platformTarget } from './own-services.js';
+/** Reconcile existing service hosts against live env, including held-token rotations. */
+export function planServiceAlertMail(org, readiness, capable, ownMailKeyHeld, current = {}) {
+    const steps = [];
+    const blocked = [];
+    const own = ownsServices(org);
+    if (!own && org.id !== readiness.platformOwnerOrgId)
+        return { steps, blocked };
+    for (const service of ['files', 'jobs']) {
+        const appId = service === 'files' ? readiness.filesAppId : readiness.jobsAppId;
+        if (!appId)
+            continue; // A later reconcile follows provisioning the service host.
+        const ownerMail = service === 'jobs' && own;
+        const domain = ownerMail ? ownHostnames(org).mailDomain : readiness.platformApex;
+        const held = ownerMail ? ownMailKeyHeld : readiness.mailKeyHeld;
+        const key = `${org.id}:${service}`;
+        if (current[service] === true)
+            continue;
+        const reason = current[service] === 'unreadable'
+            ? 'the current sender configuration could not be read'
+            : !capable
+                ? 'the host cannot deliver service alert mail'
+                : !domain
+                    ? 'the sender domain is not declared'
+                    : !held
+                        ? 'the sender credential is not held'
+                        : null;
+        if (reason) {
+            blocked.push({
+                key: `coolify:service-alert-mail:${key}`,
+                description: `${org.slug}'s ${service} alert mail is blocked: ${reason}`,
+            });
+            continue;
+        }
+        steps.push({
+            action: {
+                system: 'coolify',
+                kind: 'service-alert-mail',
+                key,
+                desired: {
+                    service,
+                    appId,
+                    from: `noreply@${domain}`,
+                    tokenRef: ownerMail
+                        ? orgTarget(org).refs.brokerMailKey
+                        : platformTarget().refs.brokerMailKey,
+                },
+            },
+            step: {
+                description: `reconcile the sender for ${org.slug}'s ${service} alerts`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}
+export async function applyServiceAlertMail(input) {
+    const { want, coolify } = input;
+    const call = (fn) => withTimeout('Service alert mail delivery', input.timeoutMs ?? 30_000, fn);
+    const rows = (await call(() => coolify.listEnvs(want.appId))).filter((row) => !row.is_preview);
+    // Stage copies are provisioned through stageMailEnv. Never turn a sink host into a live sender.
+    if (rows.some((row) => row.key === 'MAIL_SINK_URL' && row.value))
+        throw new Error('Service alert mail delivery refuses a stage mail sink.');
+    const token = await call(() => input.resolve(want.tokenRef));
+    if (!token)
+        throw new Error('Service alert mail delivery: the sender credential is not held.');
+    input.secret(token);
+    const envs = [
+        { key: 'MAIL_FROM', value: want.from, literal: true },
+        { key: 'LETTERMINT_API_TOKEN', value: token, literal: true },
+    ];
+    const changed = envs.some((env) => rows.find((row) => row.key === env.key)?.value !== env.value);
+    const marker = `service_alert_mail_pending.${want.service}`;
+    if (!changed && input.ids[marker] !== want.appId)
+        return;
+    // Persist before the env write. A failed write or deployment must be retried even if env now matches.
+    input.record(marker, want.appId);
+    await input.persist();
+    if (changed)
+        await call(() => coolify.bulkUpsertEnvs(want.appId, envs));
+    const deployment = await withTimeout('Service alert mail deployment', 10 * 60_000, () => coolify.deployAndWait(want.appId));
+    if (deployment.status !== 'finished')
+        throw new Error('Service alert mail deployment did not finish successfully.');
+    input.forget(marker);
+    await input.persist();
+}
+/** Compare in memory only; no token or token digest is exposed to the planner. */
+export async function serviceAlertMailCurrent(input) {
+    const { want } = input;
+    if (input.ids[`service_alert_mail_pending.${want.service}`])
+        return false;
+    return withTimeout('Service alert mail read', 30_000, async () => {
+        const rows = (await input.coolify.listEnvs(want.appId)).filter((row) => !row.is_preview);
+        if (rows.some((row) => row.key === 'MAIL_SINK_URL' && row.value))
+            throw new Error('Service alert mail read refuses a stage mail sink.');
+        const token = await input.resolve(want.tokenRef);
+        return (Boolean(token) &&
+            rows.some((row) => row.key === 'MAIL_FROM' && row.value === want.from) &&
+            rows.some((row) => row.key === 'LETTERMINT_API_TOKEN' && row.value === token));
+    });
+}

package/dist/plan/usage-tail-worker.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { usageTailArtifactUrl } from '../platform.js';
-import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_KEY_REF, PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, } from './platform-diff.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_KEY_REF, PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, } from './platform-diff.js';
 /** The date Cloudflare's Workers runtime compatibility is pinned to; no Workers feature here needs a later one. */
 const USAGE_TAIL_COMPATIBILITY_DATE = '2026-10-01';
 /**
@@ -28,6 +28,7 @@ export async function provisionPlatformUsageTail(context, deps) {
             PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY,
             PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY,
             PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY,
+            PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY,
             PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY,
         ]) {
             context.recordScopeId(key, '');
@@ -64,7 +65,9 @@ export async function provisionPlatformUsageTail(context, deps) {
         artifactUrl: usageTailArtifactUrl(usageTail.tag),
         artifactSha256: usageTail.sha256,
         compatibilityDate: USAGE_TAIL_COMPATIBILITY_DATE,
-        bindings: [{ type: 'plain_text', name: 'EDGE_USAGE_URL', text: edgeUrl }],
+        bindings: [
+            { type: 'plain_text', name: 'EDGE_USAGE_URL', text: `https://${platform.edge.hostname}` },
+        ],
     });
     // The script is foundry's from here on. Recorded now, not at the end: after
     // a later failure the next plan must repair this Worker, not take it for a
@@ -84,6 +87,7 @@ export async function provisionPlatformUsageTail(context, deps) {
     // Last, after every write the applied values depend on.
     context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, usageTail.tag);
     context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, usageTail.sha256);
+    context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY, `https://${platform.edge.hostname}`);
     return { resourceId: PLATFORM_USAGE_TAIL_SCRIPT_NAME };
 }
 /** Rule 1: delivery is tried up to `deliverAttempts` times; the error names the ref only, never the cause. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.77.1",
+  "version": "0.78.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",