@wtfalch/foundry 0.78.0 → 0.79.0

package/dist/plan/jobs-apps-key.js

@@ -0,0 +1,228 @@
+import { appsOn } from '../org.js';
+export const JOBS_APPS_PROJECT = 'jobs_apps_project';
+export const JOBS_APPS_KEY = 'jobs_apps_key';
+export const JOBS_APPS_UNDELIVERED = 'jobs_apps_key_undelivered';
+export const JOBS_APPS_APPLIED = 'jobs_apps_key_applied';
+export const JOBS_APPS_EXPIRES = 'jobs_apps_key_expires';
+export const jobsAppsRef = (org) => `jobs:apps-key:${org}`;
+export const jobsAppsProject = (org) => `boule-apps-${org}`;
+const DAY = 86_400_000;
+export function planJobsAppsKey(org, ids, steps, ready, usable, capable, now) {
+    const key = `jobs:apps-key:${org.id}`;
+    const block = (description) => ({
+        steps: [],
+        blocked: [{ key, description: `${org.slug}'s apps jobs key is blocked: ${description}` }],
+    });
+    if (!appsOn(org)) {
+        if ((ids[JOBS_APPS_KEY] ||
+            ids[JOBS_APPS_UNDELIVERED] ||
+            ids[JOBS_APPS_APPLIED] ||
+            ids.jobs_apps_key_withdrawing) &&
+            (!capable || !usable))
+            return block('the scheduler capability must be available to withdraw its provisioning key');
+        return ids[JOBS_APPS_KEY] ||
+            ids[JOBS_APPS_UNDELIVERED] ||
+            ids[JOBS_APPS_APPLIED] ||
+            ids.jobs_apps_key_withdrawing
+            ? {
+                steps: [
+                    {
+                        action: {
+                            system: 'jobs',
+                            kind: 'apps-key',
+                            key: org.id,
+                            desired: { mode: 'retire' },
+                        },
+                        step: {
+                            description: `revoke ${org.slug}'s Jobs provisioning key, remove JOBS_APPS_* from Boule and restart it; keep existing app projects, runtime credentials, schedules and history`,
+                            destroys: true,
+                            migrates: false,
+                        },
+                    },
+                ],
+                blocked: [],
+            }
+            : { steps: [], blocked: [] };
+    }
+    if (!capable)
+        return block('the host has not enabled company-scoped project provisioning on its scheduler');
+    if (!usable || !ready.jobsPublicUrl)
+        return block('the scheduler and its public route are not ready');
+    if (!ready.canHoldSecrets)
+        return block('the host cannot hold credentials');
+    if (!ids[`coolify:boule:${org.id}`] &&
+        !steps.some((s) => s.action.system === 'coolify' && s.action.kind === 'boule' && s.action.key === org.id))
+        return block('Boule is not recorded or planned');
+    if (ids[JOBS_APPS_UNDELIVERED] && ids[JOBS_APPS_UNDELIVERED] !== ids[JOBS_APPS_KEY])
+        return block(`key ${ids[JOBS_APPS_UNDELIVERED]} was not held; inspect and revoke the undelivered key before retrying`);
+    if (ids[JOBS_APPS_KEY] &&
+        ids[JOBS_APPS_APPLIED] === ready.jobsPublicUrl &&
+        Date.parse(ids[JOBS_APPS_EXPIRES] ?? '') - now > 30 * DAY &&
+        !ids[JOBS_APPS_UNDELIVERED])
+        return { steps: [], blocked: [] };
+    return {
+        steps: [
+            {
+                action: {
+                    system: 'jobs',
+                    kind: 'apps-key',
+                    key: org.id,
+                    desired: {
+                        mode: 'ensure',
+                        url: ready.jobsPublicUrl,
+                        expiresAt: new Date(now + 365 * DAY).toISOString(),
+                    },
+                },
+                step: {
+                    description: `give ${org.slug}'s Boule a company-scoped jobs project provisioner and restart Boule`,
+                    destroys: false,
+                    migrates: false,
+                },
+            },
+        ],
+        blocked: [],
+    };
+}
+/** Every scheduler/held-key/Coolify call is bounded, and no provider error text can carry a secret out. */
+export async function applyJobsAppsKey(deps, desired) {
+    const at = `jobs:apps-key for ${deps.org.slug}`;
+    const call = async (work) => {
+        let timer;
+        try {
+            return await Promise.race([
+                work(),
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error('timeout')), deps.timeoutMs ?? 30_000);
+                }),
+            ]);
+        }
+        catch {
+            throw new Error(`${at}: a scheduler, held-key or Boule call did not finish; retry after checking the recorded custody state`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    const id = deps.bouleAppId;
+    const project = jobsAppsProject(deps.org.id);
+    const mint = deps.scheduler.mintProjectKey?.bind(deps.scheduler);
+    const revoke = deps.scheduler.revokeProjectKey?.bind(deps.scheduler);
+    if (!mint || !revoke)
+        throw new Error(`${at}: the scheduler cannot mint and revoke scoped keys`);
+    const revokeOne = (key) => call(async () => {
+        try {
+            await revoke(project, key);
+        }
+        catch (error) {
+            if (error?.status !== 404)
+                throw error;
+        }
+    });
+    const ids = deps.recorded();
+    const old = ids[JOBS_APPS_KEY];
+    const undelivered = ids[JOBS_APPS_UNDELIVERED];
+    if (desired.mode === 'retire') {
+        deps.record('jobs_apps_key_withdrawing', '1');
+        deps.record(JOBS_APPS_PROJECT, project);
+        if (!ids.jobs_apps_project_base_url && ids[JOBS_APPS_APPLIED])
+            deps.record('jobs_apps_project_base_url', ids[JOBS_APPS_APPLIED]);
+        await deps.persist();
+        const revoked = new Set([old, undelivered, ids.jobs_apps_key_retiring].filter((key) => Boolean(key) && key !== 'pending'));
+        if (undelivered === 'pending') {
+            const list = deps.scheduler.listProjectKeys?.bind(deps.scheduler);
+            if (!list)
+                throw new Error(`${at}: the scheduler cannot inspect the ambiguous provisioning mint; no custody was cleared`);
+            for (const key of await call(() => list(project)))
+                if (!key.revoked && key.principal === 'boule' && key.scopes.includes('projects:manage'))
+                    revoked.add(key.id);
+            if (revoked.size > 8)
+                throw new Error(`${at}: too many management keys to withdraw in one bounded apply; inspect this namespace`);
+        }
+        for (const key of revoked)
+            await revokeOne(key);
+        // Record withdrawal before a restart: re-enabling Apps after a failed env cleanup must mint anew.
+        for (const field of [
+            JOBS_APPS_KEY,
+            JOBS_APPS_UNDELIVERED,
+            JOBS_APPS_EXPIRES,
+            'jobs_apps_key_retiring',
+        ])
+            deps.forget(field);
+        await call(() => deps.heldKeys.put(jobsAppsRef(deps.org.id), ''));
+        await deps.persist();
+        if (id) {
+            const rows = await call(() => deps.coolify.listEnvs(id));
+            for (const row of rows)
+                if (row.key.startsWith('JOBS_APPS_') && row.uuid)
+                    await call(() => deps.coolify.deleteEnv(id, row.uuid));
+            await call(() => deps.coolify.restart(id));
+        }
+        deps.forget(JOBS_APPS_APPLIED);
+        deps.forget('jobs_apps_key_withdrawing');
+        await deps.persist();
+        return;
+    }
+    if (!id)
+        throw new Error(`${at}: Boule is not recorded`);
+    if (undelivered && undelivered !== old)
+        throw new Error(`${at}: undelivered key ${undelivered}; nothing was minted`);
+    let key = old ? await call(() => deps.heldKeys.resolve(jobsAppsRef(deps.org.id))) : null;
+    const expired = Date.parse(ids[JOBS_APPS_EXPIRES] ?? '') - Date.now() < 30 * DAY;
+    if (!key || expired) {
+        deps.record(JOBS_APPS_PROJECT, project);
+        await deps.persist();
+        const registered = await call(() => deps.scheduler.registerProject({
+            name: project,
+            baseUrl: ids.jobs_apps_project_base_url ?? desired.url,
+        }));
+        deps.record('jobs_apps_project_base_url', ids.jobs_apps_project_base_url ?? desired.url);
+        await deps.persist();
+        if (registered.secret)
+            deps.secret(registered.secret);
+        if (registered.syncKey)
+            deps.secret(registered.syncKey);
+        // Persist intent before the non-repeatable mint. An ambiguous timeout never mints twice.
+        deps.record(JOBS_APPS_UNDELIVERED, 'pending');
+        await deps.persist();
+        const issued = await call(() => mint(project, {
+            principal: 'boule',
+            scopes: ['projects:manage'],
+            expiresAt: desired.expiresAt,
+        }));
+        deps.record(JOBS_APPS_UNDELIVERED, issued.id);
+        await deps.persist();
+        deps.secret(issued.key);
+        let held = false;
+        for (let attempt = 0; attempt < 3 && !held; attempt++)
+            try {
+                await call(() => deps.heldKeys.put(jobsAppsRef(deps.org.id), issued.key));
+                held = true;
+            }
+            catch { }
+        if (!held || !issued.key)
+            throw new Error(`${at}: key ${issued.id} was not held; nothing else was written`);
+        if (old && old !== issued.id)
+            deps.record('jobs_apps_key_retiring', old);
+        deps.record(JOBS_APPS_KEY, issued.id);
+        deps.record(JOBS_APPS_EXPIRES, desired.expiresAt);
+        await deps.persist();
+        key = issued.key;
+        // The namespace belongs to the project, not its key, so renewal can revoke the old manager.
+    }
+    const retiring = deps.recorded().jobs_apps_key_retiring;
+    if (retiring) {
+        await revokeOne(retiring);
+        deps.forget('jobs_apps_key_retiring');
+        await deps.persist();
+    }
+    deps.secret(key);
+    await call(() => deps.coolify.bulkUpsertEnvs(id, [
+        { key: 'JOBS_APPS_URL', value: desired.url, literal: true },
+        { key: 'JOBS_APPS_KEY', value: key, literal: true },
+    ]));
+    await call(() => deps.coolify.restart(id));
+    deps.forget('jobs_apps_key_withdrawing');
+    deps.record(JOBS_APPS_APPLIED, desired.url);
+    deps.forget(JOBS_APPS_UNDELIVERED);
+    await deps.persist();
+}

package/dist/plan/jobs-project-settings.js

@@ -25,6 +25,8 @@ export function planJobsProjectSettings(org, ids, planned, ready, capable) {
     const steps = [];
     const blocked = [];
     for (const entry of org.hosting.entries) {
+        if (entry.workerApp)
+            continue;
         const settings = jobsProjectSettings(org, entry.key);
         if (!settings)
             continue;

package/dist/plan/jobs-scheduler-http.d.ts

@@ -35,10 +35,17 @@ export declare class HttpJobsSchedulerClient implements JobsSchedulerPort {
     mintProjectKey(project: string, grant: {
         principal: string;
         scopes: readonly string[];
+        expiresAt?: string;
     }): Promise<{
         id: string;
         key: string;
     }>;
+    listProjectKeys(project: string): Promise<{
+        id: string;
+        principal: string;
+        scopes: string[];
+        revoked: boolean;
+    }[]>;
     /** `DELETE /admin/projects/<name>/keys/<id>`. A refusal throws with the status only (404: no such key). */
     revokeProjectKey(project: string, keyId: string): Promise<void>;
     /** `DELETE /admin/projects/<name>`. A refusal throws with the status only. */

package/dist/plan/jobs-scheduler-http.js

@@ -71,7 +71,11 @@ export class HttpJobsSchedulerClient {
                 authorization: `Bearer ${this.adminToken}`,
                 'content-type': 'application/json',
             },
-            body: JSON.stringify({ principal: grant.principal, scopes: [...grant.scopes] }),
+            body: JSON.stringify({
+                principal: grant.principal,
+                scopes: [...grant.scopes],
+                ...(grant.expiresAt ? { expiresAt: grant.expiresAt } : {}),
+            }),
             signal: AbortSignal.timeout(ADMIN_CALL_TIMEOUT_MS),
         });
         const body = await response.json().catch(() => undefined);
@@ -88,6 +92,33 @@ export class HttpJobsSchedulerClient {
         }
         return { id: fields.id, key: fields.key };
     }
+    async listProjectKeys(project) {
+        const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(project)}/keys`, {
+            headers: { authorization: `Bearer ${this.adminToken}` },
+            redirect: 'error',
+            signal: AbortSignal.timeout(ADMIN_CALL_TIMEOUT_MS),
+        });
+        if (response.status !== 200)
+            throw new Error('jobs scheduler: project key listing did not answer');
+        const body = await response.json();
+        if (!body || typeof body !== 'object' || !Array.isArray(body.keys))
+            throw new Error('jobs scheduler: invalid key listing');
+        return body.keys.map((value) => {
+            const key = value;
+            if (!key ||
+                typeof key.id !== 'string' ||
+                typeof key.principal !== 'string' ||
+                !Array.isArray(key.scopes) ||
+                !key.scopes.every((scope) => typeof scope === 'string'))
+                throw new Error('jobs scheduler: invalid key summary');
+            return {
+                id: key.id,
+                principal: key.principal,
+                scopes: key.scopes,
+                revoked: Boolean(key.revokedAt),
+            };
+        });
+    }
     /** `DELETE /admin/projects/<name>/keys/<id>`. A refusal throws with the status only (404: no such key). */
     async revokeProjectKey(project, keyId) {
         const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(project)}/keys/${encodeURIComponent(keyId)}`, {

package/dist/plan/own-jobs-route.d.ts

@@ -20,7 +20,7 @@ export declare const OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY = "coolify_own_jobs_
  * `/deliveries`) and what Boule reads and presses for one project with that project's key (`/project/*`,
  * jobs#79, foundry#1119). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
  */
-export declare const JOBS_ENTRY_PATH_PATTERN = "^/(sync$|timers(/|$)|deliveries$|project/)";
+export declare const JOBS_ENTRY_PATH_PATTERN = "^/(sync$|timers(/|$)|deliveries$|project/|projects/)";
 /** The path pattern the route's ingress was last written with; a different pattern plans the route again. */
 export declare const OWN_JOBS_ROUTE_PATHS_SCOPE_KEY = "own_jobs_route_paths";
 export declare const JOBS_ROUTE_CALL_TIMEOUT_MS = 60000;

package/dist/plan/own-jobs-route.js

@@ -21,7 +21,7 @@ export const OWN_JOBS_ROUTE_CONNECTOR_APP_SCOPE_KEY = 'coolify_own_jobs_connecto
  * `/deliveries`) and what Boule reads and presses for one project with that project's key (`/project/*`,
  * jobs#79, foundry#1119). `/admin/*` is not on the internet; foundry reaches it on the Coolify network.
  */
-export const JOBS_ENTRY_PATH_PATTERN = '^/(sync$|timers(/|$)|deliveries$|project/)';
+export const JOBS_ENTRY_PATH_PATTERN = '^/(sync$|timers(/|$)|deliveries$|project/|projects/)';
 /** The path pattern the route's ingress was last written with; a different pattern plans the route again. */
 export const OWN_JOBS_ROUTE_PATHS_SCOPE_KEY = 'own_jobs_route_paths';
 export const JOBS_ROUTE_CALL_TIMEOUT_MS = 60_000;

package/dist/plan/plan-apply.d.ts

@@ -628,6 +628,7 @@ export interface FoundryPlanApplyOptions {
      * `uses.jobs` entry's Boule key is reported blocked.
      */
     jobsProjectKeys?: boolean;
+    jobsAppProjects?: boolean;
     /** The host can deliver per-app Files space alerts. */
     serviceAlertMail?: boolean;
     filesSpaceAlerts?: boolean;
@@ -639,6 +640,8 @@ export interface FoundryPlanApplyOptions {
      * below it. Without it Boule's ai key is reported blocked.
      */
     aiBouleReads?: boolean;
+    /** Off until AI scoped revocation and the host adapter are deployed. */
+    aiAppsKeys?: boolean;
     /** C2: true when the host's executor was built with a `WorkerAppDatabasePort`. */
     workerAppDatabase?: boolean;
     /** True when that port has `deletableTables`. A `workerApp.database.noDelete` is blocked without it. */
@@ -807,10 +810,12 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly analyticsPort;
     private readonly reportingPort;
     private readonly jobsProjectKeys;
+    private readonly jobsAppProjects;
     private readonly serviceAlertMail;
     private readonly filesSpaceAlerts;
     private readonly jobsProjectSettings;
     private readonly aiBouleReads;
+    private readonly aiAppsKeys;
     private readonly workerAppDatabase;
     private readonly workerAppNoDeleteCheck;
     private readonly workerAppRegistryAccountId;
@@ -876,6 +881,7 @@ export declare class FoundryPlanApply implements PlanApply {
      * Throws {@link InvalidMigrationConfirmationError} for a confirmation that is not valid.
      */
     confirmOrgPostgresMigration(orgId: OrgId, confirmation: OrgPostgresMigrationConfirmation): Promise<void>;
+    private aiHeld;
     private computeAdopt;
     apply(plan: Plan, confirmedOrgName: string, options?: FoundryApplyOptions): Promise<AppliedState>;
     /**

package/dist/plan/plan-apply.js

@@ -23,7 +23,9 @@ import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, bouleEdgeKeyWanted, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_BOULE_KEY_SCOPE_KEY, FILES_BOULE_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { probeRepoKeys, repoKeyProbeTargets, repoKeysInPlay, } from './entry-repo-key.js';
+import { FILES_APPS_MINTER_SCOPE_KEY, FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY, } from './files-apps-minter.js';
 import { PLATFORM_GITHUB_APP_REFS } from './held-key-refs.js';
+import { JOBS_APPS_KEY, JOBS_APPS_PROJECT, JOBS_APPS_UNDELIVERED, jobsAppsProject, } from './jobs-apps-key.js';
 import { KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, } from './keys-registrar.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { hostingNames } from './locked-hostnames.js';
@@ -195,10 +197,12 @@ export class FoundryPlanApply {
     analyticsPort;
     reportingPort;
     jobsProjectKeys;
+    jobsAppProjects;
     serviceAlertMail;
     filesSpaceAlerts;
     jobsProjectSettings;
     aiBouleReads;
+    aiAppsKeys;
     workerAppDatabase;
     workerAppNoDeleteCheck;
     workerAppRegistryAccountId;
@@ -248,10 +252,12 @@ export class FoundryPlanApply {
         this.analyticsPort = options.analyticsPort ?? false;
         this.reportingPort = options.reportingPort ?? false;
         this.jobsProjectKeys = options.jobsProjectKeys ?? false;
+        this.jobsAppProjects = options.jobsAppProjects ?? false;
         this.filesSpaceAlerts = options.filesSpaceAlerts ?? false;
         this.serviceAlertMail = options.serviceAlertMail ?? false;
         this.jobsProjectSettings = options.jobsProjectSettings ?? false;
         this.aiBouleReads = options.aiBouleReads ?? false;
+        this.aiAppsKeys = options.aiAppsKeys ?? false;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
         this.workerAppNoDeleteCheck = options.workerAppNoDeleteCheck ?? false;
         this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
@@ -480,6 +486,23 @@ export class FoundryPlanApply {
             await record('recorded');
         }));
     }
+    async aiHeld(ref) {
+        let timer;
+        try {
+            return Boolean(await Promise.race([
+                this.platformDeps?.heldKeys?.resolve(ref),
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error('timeout')), 15_000);
+                }),
+            ]));
+        }
+        catch {
+            return false;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
     async computeAdopt(id, input) {
         const org = await this.store.get(id);
         if (!org)
@@ -1727,11 +1750,17 @@ export class FoundryPlanApply {
             analyticsPort: this.analyticsPort,
             reportingPort: this.reportingPort,
             jobsProjectKeys: this.jobsProjectKeys,
+            jobsAppProjects: this.jobsAppProjects,
             filesSpaceAlerts: this.filesSpaceAlerts,
             serviceAlertMail: this.serviceAlertMail,
             serviceAlertMailCurrent: await this.readServiceAlertMail(org, platformReadiness, recorded),
             jobsProjectSettings: this.jobsProjectSettings,
             aiBouleReads: this.aiBouleReads,
+            aiAppsKeys: this.aiAppsKeys,
+            aiAppsMinterHeld: this.aiAppsKeys && recorded.ai_apps_minter
+                ? await this.aiHeld(`ai:apps-minter:${org.id}`)
+                : true,
+            aiAppsRootKeyHeld: this.aiAppsKeys ? await this.aiHeld(`ai:key:${org.slug}`) : false,
             workerAppDatabase: this.workerAppDatabase,
             workerAppNoDeleteCheck: this.workerAppNoDeleteCheck,
             workerAppRegistryAccountId: this.workerAppRegistryAccountId,
@@ -2520,6 +2549,11 @@ function destroyTargets(serviceIds, orgId) {
         'edge:key:',
     ];
     const targets = [];
+    // Remove the provisioner project before its scheduler host. The service cascades to managed apps.
+    if (serviceIds[JOBS_APPS_PROJECT] ||
+        serviceIds[JOBS_APPS_KEY] ||
+        serviceIds[JOBS_APPS_UNDELIVERED])
+        targets.push({ system: 'jobs', kind: 'apps-projects', key: orgId, id: jobsAppsProject(orgId) });
     const adopted = adoptedResourceIds(serviceIds);
     for (const prefix of ORDERED_PREFIXES) {
         if (prefix === 'cloudflare:worker:') {
@@ -2678,7 +2712,9 @@ function keptDescriptions(serviceIds) {
 }
 function destroyStepDescriptions(targets) {
     return [
-        ...targets.map((t) => `delete ${t.system} ${t.kind} ${t.key}`),
+        ...targets.map((t) => t.system === 'jobs' && t.kind === 'apps-projects'
+            ? `delete Jobs namespace ${t.id}, including its app projects, schedules, history and keys`
+            : `delete ${t.system} ${t.kind} ${t.key}`),
         'delete the declared org',
     ];
 }
@@ -2812,6 +2848,8 @@ const STEP_FIELDS = {
     'coolify:reporting': 'hosting.entries.uses.reporting',
     'coolify:reporting-boule': 'boule.apps',
     'coolify:org-apps-admin': 'boule.apps',
+    'files:apps-minter': 'boule.apps',
+    'jobs:apps-key': 'boule.apps',
     'cloudflare:apps-db-route': 'boule.apps',
     'cloudflare:apps-zones': 'boule.apps',
 };
@@ -2938,8 +2976,12 @@ function failedFields(org, detail, completed, serviceIds) {
     // F7: a registrar key minted and never delivered stays unresolved until a later apply revokes it.
     if (serviceIds[KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY])
         failed.add('boule.apps');
-    // F4 (#925): the same for an apps admin role or a route service token minted and never delivered.
-    if (serviceIds[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY] ||
+    // F4 (#925): the same for an apps admin role or a route service token minted and never delivered, and
+    // Boule's apps files key minted and not yet held or written (a marker that differs from its guard).
+    if ((serviceIds[FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY] &&
+        serviceIds[FILES_APPS_MINTER_UNDELIVERED_SCOPE_KEY] !==
+            serviceIds[FILES_APPS_MINTER_SCOPE_KEY]) ||
+        serviceIds[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY] ||
         serviceIds[remoteDatabaseKeys(APPS_DB_ENTRY_KEY).undelivered]) {
         failed.add('boule.apps');
     }

package/dist/plan/platform-diff.d.ts

@@ -107,7 +107,7 @@ export declare const PLATFORM_AUTH_MCP_SCOPE_KEY = "auth_mcp_env_applied";
  * broker applied under `'1'` plans its sign-in step once more and gets the key without a hand step.
  */
 export declare const AUTH_MCP_ENV_VERSION = "2";
-/** True when a hosting entry of the org declares `uses.auth.mcp`: its broker needs the MCP database and secret. */
+/** Legacy and configurable MCP integrations both need the broker's MCP database and secret. */
 export declare function orgDeclaresMcp(org: Pick<DeclaredOrg, 'hosting'>): boolean;
 /**
  * The `gitRef` the platform's login, in-app login and broker apps were last built from (value: the ref). A
@@ -1262,6 +1262,7 @@ export declare const PLATFORM_USAGE_TAIL_SCRIPT_NAME = "platform-usage-tail";
 export declare const PLATFORM_USAGE_TAIL_KEY_REF = "usage-tail:worker:key";
 export declare const PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY = "usage_tail_key_undelivered";
 export declare const PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY = "usage_tail_key_set";
+export declare const PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY = "usage_tail_applied_url";
 export declare const PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY = "usage_tail_applied_tag";
 export declare const PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY = "usage_tail_applied_sha256";
 export declare const PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY = "usage_tail_removed";

package/dist/plan/platform-diff.js

@@ -117,9 +117,10 @@ export const PLATFORM_AUTH_MCP_SCOPE_KEY = 'auth_mcp_env_applied';
  * broker applied under `'1'` plans its sign-in step once more and gets the key without a hand step.
  */
 export const AUTH_MCP_ENV_VERSION = '2';
-/** True when a hosting entry of the org declares `uses.auth.mcp`: its broker needs the MCP database and secret. */
+/** Legacy and configurable MCP integrations both need the broker's MCP database and secret. */
 export function orgDeclaresMcp(org) {
-    return org.hosting.enabled && org.hosting.entries.some((e) => Boolean(e.uses?.auth?.mcp));
+    return (org.hosting.enabled &&
+        org.hosting.entries.some((e) => Boolean(e.uses?.auth?.mcp || e.uses?.auth?.mcpResources)));
 }
 /**
  * The `gitRef` the platform's login, in-app login and broker apps were last built from (value: the ref). A
@@ -1461,6 +1462,7 @@ export const PLATFORM_USAGE_TAIL_SCRIPT_NAME = 'platform-usage-tail';
 export const PLATFORM_USAGE_TAIL_KEY_REF = 'usage-tail:worker:key';
 export const PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY = 'usage_tail_key_undelivered';
 export const PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY = 'usage_tail_key_set';
+export const PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY = 'usage_tail_applied_url';
 export const PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY = 'usage_tail_applied_tag';
 export const PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY = 'usage_tail_applied_sha256';
 export const PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY = 'usage_tail_removed';
@@ -3488,12 +3490,17 @@ function planUsageTail(platform, recordedIds, executorBlocked, edgeApplied) {
     const applied = deployed &&
         Boolean(recordedIds[PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY]) &&
         recordedIds[PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY] === usageTail.tag &&
-        recordedIds[PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY] === usageTail.sha256;
+        recordedIds[PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY] === usageTail.sha256 &&
+        recordedIds[PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY] === `https://${platform.edge.hostname}`;
     if (applied)
         return { step: null, blocked: [] };
     return {
         step: {
-            action: action({ gitRef: usageTail.tag, sha256: usageTail.sha256 }),
+            action: action({
+                gitRef: usageTail.tag,
+                sha256: usageTail.sha256,
+                url: `https://${platform.edge.hostname}`,
+            }),
             step: {
                 description: `deploy the usage tail Worker ${PLATFORM_USAGE_TAIL_SCRIPT_NAME} from edge release ${usageTail.tag}, with its held key`,
                 destroys: false,

package/dist/plan/usage-tail-worker.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { usageTailArtifactUrl } from '../platform.js';
-import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_KEY_REF, PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, } from './platform-diff.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY, PLATFORM_USAGE_TAIL_KEY_REF, PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY, PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_USAGE_TAIL_REMOVED_SCOPE_KEY, PLATFORM_USAGE_TAIL_SCRIPT_NAME, } from './platform-diff.js';
 /** The date Cloudflare's Workers runtime compatibility is pinned to; no Workers feature here needs a later one. */
 const USAGE_TAIL_COMPATIBILITY_DATE = '2026-10-01';
 /**
@@ -28,6 +28,7 @@ export async function provisionPlatformUsageTail(context, deps) {
             PLATFORM_USAGE_TAIL_KEY_UNDELIVERED_SCOPE_KEY,
             PLATFORM_USAGE_TAIL_KEY_SET_SCOPE_KEY,
             PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY,
+            PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY,
             PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY,
         ]) {
             context.recordScopeId(key, '');
@@ -64,7 +65,9 @@ export async function provisionPlatformUsageTail(context, deps) {
         artifactUrl: usageTailArtifactUrl(usageTail.tag),
         artifactSha256: usageTail.sha256,
         compatibilityDate: USAGE_TAIL_COMPATIBILITY_DATE,
-        bindings: [{ type: 'plain_text', name: 'EDGE_USAGE_URL', text: edgeUrl }],
+        bindings: [
+            { type: 'plain_text', name: 'EDGE_USAGE_URL', text: `https://${platform.edge.hostname}` },
+        ],
     });
     // The script is foundry's from here on. Recorded now, not at the end: after
     // a later failure the next plan must repair this Worker, not take it for a
@@ -84,6 +87,7 @@ export async function provisionPlatformUsageTail(context, deps) {
     // Last, after every write the applied values depend on.
     context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_TAG_SCOPE_KEY, usageTail.tag);
     context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_SHA256_SCOPE_KEY, usageTail.sha256);
+    context.recordScopeId(PLATFORM_USAGE_TAIL_APPLIED_URL_SCOPE_KEY, `https://${platform.edge.hostname}`);
     return { resourceId: PLATFORM_USAGE_TAIL_SCRIPT_NAME };
 }
 /** Rule 1: delivery is tried up to `deliverAttempts` times; the error names the ref only, never the cause. */

package/dist/release/state.d.ts

@@ -137,8 +137,8 @@ export declare const releaseEventPayload: z.ZodObject<{
 }, z.core.$strip>;
 export declare const releaseEventKind: z.ZodEnum<{
     step: "step";
-    open: "open";
     check: "check";
+    open: "open";
     passed: "passed";
     hard_fail: "hard_fail";
     promote: "promote";

package/dist/store/schema.d.ts

@@ -1556,7 +1556,7 @@ export declare const foundryAuditEvents: import("drizzle-orm/pg-core").PgTableWi
             tableName: "foundry_audit_events";
             dataType: "string";
             columnType: "PgText";
-            data: "applied" | "failed" | "refused" | "destroyed";
+            data: "applied" | "refused" | "failed" | "destroyed";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -1568,7 +1568,7 @@ export declare const foundryAuditEvents: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: "applied" | "failed" | "refused" | "destroyed";
+            $type: "applied" | "refused" | "failed" | "destroyed";
         }>;
         reason: import("drizzle-orm/pg-core").PgColumn<{
             name: "reason";

package/dist/worker-app-config.js

@@ -196,9 +196,18 @@ export function validateEntryWorkerApp(entry, hosting, names) {
     if (Object.keys(entry.env).length > 0) {
         return `${at} has no Coolify app, so env does not apply: use workerApp.vars or workerApp.secrets`;
     }
-    const unsupported = Object.keys(entry.uses ?? {}).find((use) => use !== 'auth' && use !== 'audit' && use !== 'analytics' && use !== 'reporting');
+    const unsupported = Object.keys(entry.uses ?? {}).find((use) => use !== 'auth' &&
+        use !== 'audit' &&
+        use !== 'analytics' &&
+        use !== 'reporting' &&
+        use !== 'mail' &&
+        use !== 'files' &&
+        use !== 'customerGrants' &&
+        use !== 'repo' &&
+        use !== 'jobs' &&
+        use !== 'ai');
     if (unsupported)
-        return `${at} supports uses.auth, uses.audit, uses.analytics and uses.reporting only, not uses.${unsupported}`;
+        return `${at} supports uses.auth, uses.audit, uses.analytics, uses.reporting, uses.mail, uses.files, uses.jobs, uses.customerGrants, uses.repo and uses.ai only, not uses.${unsupported}`;
     if (entry.key.length > WORKER_NAME_MAX_LENGTH - WORKER_NAME_FIXED_LENGTH) {
         return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "${WORKER_APP_NAME_SUFFIX}") must fit Cloudflare's ${WORKER_NAME_MAX_LENGTH}-character limit`;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.78.0",
+  "version": "0.79.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -19,6 +19,10 @@
       "types": "./dist/modules/index.d.ts",
       "default": "./dist/modules/index.js"
     },
+    "./mcp-resources": {
+      "types": "./dist/mcp-resources/index.d.ts",
+      "default": "./dist/mcp-resources/index.js"
+    },
     "./catalogue": {
       "types": "./dist/catalogue/index.d.ts",
       "default": "./dist/catalogue/index.js"