@wtfalch/foundry 0.78.1 → 0.79.0

package/dist/org.js

@@ -2,6 +2,7 @@ import { DEFAULT_RULES, checkName, explain } from '@wtfalch/auth/names';
 import { floatingRefBlocked, floatingTagBlocked } from './bootstrap/versions.js';
 import { AI_ENTRY_PERMISSIONS, AI_WEBHOOK_PATH, FILES_COLLECTION_NAME, FILES_ENTRY_PERMISSIONS, FILES_SHARE_LINK_DAYS, FILES_SHARE_LINK_DAYS_DEFAULT, JOBS_PAUSE_AFTER_MAX, JOBS_RETRIES_MAX, MAIL_BOUNCES_MAX, MAIL_FROM_NAME, MAIL_FROM_NAME_MAX, MAIL_REPLY_TO, MAIL_REPLY_TO_MAX, MCP_PATH, ONBOARDING_PATH_MAX_LENGTH, PERCENT_MAX, PERCENT_MIN, ROOM_STEPS_MAX, ROOM_STEPS_MIN, ROOM_TEXT_MAX, ROOM_UNSAFE_TEXT, WORKSPACE_ROLE, WORKSPACE_ROLES_MAX, isEdgePath, isPagePath, wholeIn, } from './entry-rules.js';
 import { hostedLabelRefusal } from './hosted-label.js';
+import { McpResourceIntegrationSchema, } from './mcp-resources/schema.js';
 import { entryHasDatabase, validateArtifact, validateEntryWorkerApp, } from './worker-app-config.js';
 export { AI_ENTRY_PERMISSIONS, FILES_ENTRY_PERMISSIONS, MCP_PATH, ONBOARDING_PATH_MAX_LENGTH, ROOM_STEPS_MAX, ROOM_STEPS_MIN, ROOM_TEXT_MAX, WORKSPACE_ROLE, WORKSPACE_ROLES_MAX, } from './entry-rules.js';
 /** {@link MailConfig.mailApps} when the org declares none of its own (#34, decided 2026-09-30). */
@@ -1002,6 +1003,7 @@ function validateEntryAuth(entry, hosting, domain) {
     if (both) {
         const unsupported = [
             [auth.mcp, 'uses.auth.mcp', 'mcp'],
+            [auth.mcpResources, 'uses.auth.mcpResources', 'mcpResources'],
             [auth.workspaces, 'uses.auth.workspaces', 'workspaces'],
             [auth.replacesBrokerEntry, 'uses.auth.replacesBrokerEntry', 'replacesBrokerEntry'],
             [entry.blueGreen, 'blueGreen', 'blueGreen'],
@@ -1029,6 +1031,10 @@ function validateEntryAuth(entry, hosting, domain) {
     if (!hasExactHostname(entry, hosting, domain)) {
         return refusal('auth_needs_exact_hostname', `hosting.entries.${entry.key}.hostnames`, `${at} needs an exact hostname to sign in at`);
     }
+    if (auth.mcpResources !== undefined &&
+        (!signsInCustomers(auth) || !McpResourceIntegrationSchema.safeParse(auth.mcpResources).success)) {
+        return refusal('mcp_path_invalid', `hosting.entries.${entry.key}.uses.auth.mcpResources`, `${at} mcpResources needs customer sign-in, version 1 and a safe absolute path prefix`);
+    }
     if (auth.mcp !== undefined) {
         if (!signsInCustomers(auth)) {
             return refusal('mcp_needs_open_customers', `hosting.entries.${entry.key}.uses.auth.mcp`, `${at} mcp needs users 'customers': an MCP client signs the customer in, and registration may be open or closed`);
@@ -1133,7 +1139,7 @@ function validateEntryAuth(entry, hosting, domain) {
     return null;
 }
 /**
- * `uses.auth.workspaces`: customers only, a server entry (a Worker app has nowhere to keep the key), roles the
+ * `uses.auth.workspaces`: customers only; Boule delivers a Worker copy’s key through the registrar. Roles the
  * broker accepts (1 to 20 distinct names, no `c_` prefix, `owner` only as the first, never `self_service`),
  * a plain invite path, and no `env` entry that names a value it writes.
  */
@@ -1142,9 +1148,6 @@ function validateEntryWorkspaces(entry, workspaces, at) {
     if (!signsInCustomers(entry.uses?.auth)) {
         return refusal('workspaces_needs_customers', path, `${at} workspaces needs users 'customers': workspaces belong to an app's own customers`);
     }
-    if (entry.workerApp !== undefined) {
-        return refusal('workspaces_needs_server', path, `${at} workspaces needs an app that runs as a server: a Worker app has nowhere to keep the workspaces key`);
-    }
     const config = workspaces;
     const roles = config?.roles;
     if (!Array.isArray(roles) || roles.length < 1 || roles.length > WORKSPACE_ROLES_MAX) {
@@ -1395,7 +1398,7 @@ function validateEntryEdge(entry, hosting, domain) {
 export const REPO_ENTRY_ENV_NAMES = ['GIT_REPO_URL', 'GIT_SSH_KEY'];
 /**
  * `uses.repo` (F12): `{ access: 'read' | 'write' }` and nothing else, on an entry that has its own `repo` (a
- * Worker app has none to clone and is already refused for any use but `uses.auth`), and no `env` entry that
+ * Worker app instead uses Boule's source-bound HTTPS credential), and no server `env` entry that
  * names a value it writes.
  */
 function validateEntryRepoUse(entry) {
@@ -1411,7 +1414,7 @@ function validateEntryRepoUse(entry) {
         Object.keys(value).some((k) => k !== 'access')) {
         return refusal('repo_use_invalid', path, `${at} must be { access: 'read' } or { access: 'write' }: read lets the app clone its repo, write lets it push too`);
     }
-    if (entry.repo === null) {
+    if (entry.repo === null && !entry.workerApp) {
         return refusal('repo_use_needs_repo', path, `${at} gives the app access to its own repo, and this entry has none: set repo, or remove uses.repo`);
     }
     const named = Object.keys(entry.env ?? {}).find((name) => REPO_ENTRY_ENV_NAMES.includes(name));
@@ -1425,7 +1428,7 @@ export const CUSTOMER_GRANTS_ENTRY_ENV_NAMES = ['CUSTOMER_GRANTS_CREDENTIAL'];
 /**
  * `uses.customerGrants`: `true`, customers signing in (`uses.auth` with `users: 'customers'`, which already
  * needs hosting on and an exact hostname for the app), and no `env` entry that names the credential. A Worker
- * app is already refused for any use but `uses.auth` (`validateEntryWorkerApp`).
+ * app is accepted by `validateEntryWorkerApp`; Boule owns its credential and directory registration.
  */
 function validateEntryCustomerGrants(entry) {
     const value = entry.uses?.customerGrants;

package/dist/plan/ai-apps-minter.d.ts

@@ -0,0 +1,79 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { OrgPlatformReadiness } from './platform-org.js';
+export declare const AI_APPS_PERMISSIONS: readonly ["ai.keys:mint", "ai.keys:revoke", "ai.offerings:invoke"];
+export declare const AI_APPS_ENV: {
+    readonly url: "AI_APPS_URL";
+    readonly organisationId: "AI_APPS_ORGANISATION_ID";
+    readonly keyId: "AI_APPS_KEY_ID";
+    readonly keyExpires: "AI_APPS_KEY_EXPIRES";
+    readonly key: "AI_APPS_KEY";
+};
+export declare const aiAppsMinterRef: (id: string) => string;
+export declare const aiAppsParentRef: (org: string, parent: string) => string;
+export interface AiAppsMinterStep {
+    mode: 'mint' | 'renew' | 'deliver' | 'retire';
+    url?: string;
+    organisationId?: string;
+    name?: string;
+    parent?: string;
+}
+export declare function planAiAppsMinter(org: DeclaredOrg, ids: Readonly<Record<string, string>>, planned: readonly DraftStep[], ready: OrgPlatformReadiness, now: number, capability: boolean, rootHeld: boolean, minterHeld?: boolean): {
+    steps: DraftStep[];
+    blocked: {
+        description: string;
+        key: string;
+    }[];
+};
+export interface AiAppsMinterDeps {
+    org: {
+        id: string;
+        slug: string;
+    };
+    bouleAppId?: string;
+    ai: {
+        mintNestedKey(input: {
+            organisationId: string;
+            minterKeyId: string;
+            name: string;
+            expiresDays: number;
+            permissions: string[];
+        }): Promise<{
+            id: string;
+            secret: string;
+            expiresAt: string;
+        }>;
+        revokeDescendantKey(input: {
+            organisationId: string;
+            credential: string;
+            keyId: string;
+        }): Promise<unknown>;
+    };
+    heldKeys: {
+        resolve(ref: string): Promise<string | null | undefined>;
+        put(ref: string, value: string): Promise<void>;
+    };
+    coolify: {
+        bulkUpsertEnvs(app: string, values: {
+            key: string;
+            value: string;
+            literal?: boolean;
+        }[]): Promise<unknown>;
+        listEnvs(app: string): Promise<{
+            uuid?: string;
+            key: string;
+            is_preview: boolean;
+        }[]>;
+        deleteEnv(app: string, id: string): Promise<unknown>;
+        restart(app: string): Promise<unknown>;
+    };
+    recorded(): Readonly<Record<string, string>>;
+    record(key: string, value: string): void;
+    forget(key: string): void;
+    persist(): Promise<void>;
+    secret(value: string): void;
+    now?: () => number;
+    timeoutMs?: number;
+}
+/** Retains each prior parent authority in held custody: renewals never revoke a minter and its still-running children. */
+export declare function ensureAiAppsMinter(deps: AiAppsMinterDeps, step: AiAppsMinterStep): Promise<void>;

package/dist/plan/ai-apps-minter.js

@@ -0,0 +1,263 @@
+import { appsOn } from '../org.js';
+import { parseIds } from './ai-boule-key.js';
+export const AI_APPS_PERMISSIONS = [
+    'ai.keys:mint',
+    'ai.keys:revoke',
+    'ai.offerings:invoke',
+];
+export const AI_APPS_ENV = {
+    url: 'AI_APPS_URL',
+    organisationId: 'AI_APPS_ORGANISATION_ID',
+    keyId: 'AI_APPS_KEY_ID',
+    keyExpires: 'AI_APPS_KEY_EXPIRES',
+    key: 'AI_APPS_KEY',
+};
+const S = 'ai_apps_minter';
+const DAY = 86_400_000;
+export const aiAppsMinterRef = (id) => `ai:apps-minter:${id}`;
+export const aiAppsParentRef = (org, parent) => `ai:apps-parent:${org}:${parent}`;
+export function planAiAppsMinter(org, ids, planned, ready, now, capability, rootHeld, minterHeld = true) {
+    const steps = [];
+    const blocked = [];
+    const key = `ai:apps-minter:${org.id}`;
+    const block = (why) => blocked.push({ key, description: `${org.slug}'s Worker AI keys are blocked: ${why}` });
+    const emit = (desired) => steps.push({
+        action: { system: 'ai', kind: 'apps-minter', key: org.id, desired: { ...desired } },
+        step: {
+            description: desired.mode === 'retire'
+                ? `retire ${org.slug}'s Worker AI minters and their app keys`
+                : `${desired.mode} ${org.slug}'s Worker AI minter below its organisation root, hold it and deliver AI_APPS_* to Boule`,
+            destroys: desired.mode === 'retire',
+            migrates: false,
+        },
+    });
+    if (!appsOn(org)) {
+        if (ids[S] || ids[`${S}_previous`] || ids[`${S}_undelivered`] || ids[`${S}_minting`]) {
+            if (capability)
+                emit({ mode: 'retire' });
+            else
+                block('the scoped AI key lifecycle adapter is not enabled');
+        }
+        return { steps, blocked };
+    }
+    if (!ready.aiReady)
+        return { steps, blocked };
+    if (!capability)
+        return { steps, blocked };
+    if (ids[`${S}_minting`] || (ids[`${S}_undelivered`] && ids[`${S}_undelivered`] !== ids[S])) {
+        block('a one-time minter may have been made but was not safely held; inspect it before another is minted');
+        return { steps, blocked };
+    }
+    if (ids[S] && !minterHeld) {
+        block('the recorded minter has no held value; restore or retire it before continuing');
+        return { steps, blocked };
+    }
+    if (!ready.aiUrl || !ready.canHoldSecrets) {
+        block('AI or held credential custody is not ready');
+        return { steps, blocked };
+    }
+    const parent = ids[`ai:key:${org.id}`];
+    const rootPlanned = planned.some((p) => p.action.system === 'ai' && p.action.kind === 'key' && p.action.key === org.id);
+    if (!rootPlanned && (!parent || !rootHeld)) {
+        block('the organisation root key and its held secret are required');
+        return { steps, blocked };
+    }
+    if (!ids[`coolify:boule:${org.id}`] &&
+        !planned.some((p) => p.action.system === 'coolify' && p.action.kind === 'boule' && p.action.key === org.id)) {
+        block('Boule is not recorded yet');
+        return { steps, blocked };
+    }
+    const mode = ids[S] && ids[`${S}_undelivered`] === ids[S]
+        ? 'deliver'
+        : !ids[S]
+            ? 'mint'
+            : rootPlanned || ids[`${S}_parent`] !== parent
+                ? 'renew'
+                : Date.parse(ids[`${S}_expires`] ?? '') - now < 30 * DAY
+                    ? 'renew'
+                    : ids[`${S}_undelivered`] || ids[`${S}_applied`] !== ready.aiUrl
+                        ? 'deliver'
+                        : null;
+    if (mode === 'renew' && ids[`${S}_clamped`] === parent && !rootPlanned) {
+        block('the organisation root must be renewed before another minter can live long enough');
+        return { steps, blocked };
+    }
+    if (mode)
+        emit({
+            mode,
+            url: ready.aiUrl,
+            organisationId: org.id,
+            name: `${org.slug}-boule-apps-ai`,
+            parent,
+        });
+    return { steps, blocked };
+}
+async function timed(read, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            read(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Retains each prior parent authority in held custody: renewals never revoke a minter and its still-running children. */
+export async function ensureAiAppsMinter(deps, step) {
+    const at = `ai:apps-minter for ${deps.org.slug}`;
+    const ms = deps.timeoutMs ?? 30_000;
+    const now = deps.now ?? Date.now;
+    const call = (fn) => timed(fn, ms);
+    const ids = deps.recorded();
+    const ref = aiAppsMinterRef(deps.org.id);
+    const hold = async (ref, value) => {
+        deps.secret(value);
+        for (let i = 0; i < 3; i++) {
+            try {
+                await call(() => deps.heldKeys.put(ref, value));
+                return;
+            }
+            catch { }
+        }
+        throw new Error(`${at}: the credential could not be held at ${ref}`);
+    };
+    const resolve = async (ref) => {
+        try {
+            const value = await call(() => deps.heldKeys.resolve(ref));
+            if (value)
+                deps.secret(value);
+            return value;
+        }
+        catch {
+            throw new Error(`${at}: held credential ${ref} could not be read`);
+        }
+    };
+    if (step.mode === 'retire') {
+        if (ids[`${S}_minting`])
+            throw new Error(`${at}: an uncertain minter must be inspected before retirement`);
+        const keys = [
+            ...new Set([ids[S], ids[`${S}_undelivered`], ...parseIds(ids[`${S}_previous`])].filter((v) => Boolean(v))),
+        ];
+        for (const keyId of keys) {
+            const expires = Date.parse(ids[`${S}_expires_${keyId}`] ?? '');
+            if (Number.isFinite(expires) && expires <= now())
+                continue;
+            const parent = ids[`${S}_parent_${keyId}`];
+            if (!parent)
+                throw new Error(`${at}: key ${keyId} has no recorded parent authority`);
+            const credential = await resolve(aiAppsParentRef(deps.org.id, parent));
+            if (!credential)
+                throw new Error(`${at}: parent authority for key ${keyId} is not held`);
+            try {
+                await call(() => deps.ai.revokeDescendantKey({ organisationId: deps.org.id, credential, keyId }));
+            }
+            catch {
+                throw new Error(`${at}: key ${keyId} could not be retired`);
+            }
+        }
+        if (deps.bouleAppId) {
+            const app = deps.bouleAppId;
+            try {
+                const rows = await call(() => deps.coolify.listEnvs(app));
+                const names = new Set(Object.values(AI_APPS_ENV));
+                for (const row of rows)
+                    if (row.uuid && !row.is_preview && names.has(row.key))
+                        await call(() => deps.coolify.deleteEnv(app, row.uuid));
+                await call(() => deps.coolify.restart(app));
+            }
+            catch {
+                throw new Error(`${at}: revoked minters could not be removed from Boule's environment`);
+            }
+        }
+        for (const name of Object.keys(ids))
+            if (name === S || name.startsWith(`${S}_`))
+                deps.forget(name);
+        await deps.persist();
+        return;
+    }
+    if (!deps.bouleAppId || !step.url)
+        throw new Error(`${at}: Boule or AI is not recorded yet`);
+    if (ids[`${S}_minting`] || (ids[`${S}_undelivered`] && ids[`${S}_undelivered`] !== ids[S]))
+        throw new Error(`${at}: a one-time minter was not safely held; no second mint is allowed`);
+    let keyId = ids[S];
+    let key = keyId ? await resolve(ref) : null;
+    if (keyId && !key)
+        throw new Error(`${at}: the recorded minter has no held value; no new key was minted`);
+    if (step.mode !== 'deliver') {
+        if (keyId) {
+            const previous = parseIds(ids[`${S}_previous`]);
+            if (!previous.includes(keyId))
+                previous.push(keyId);
+            deps.record(`${S}_previous`, JSON.stringify(previous));
+            await deps.persist();
+        }
+        const parent = deps.recorded()[`ai:key:${deps.org.id}`];
+        if (!parent)
+            throw new Error(`${at}: the organisation root is not recorded`);
+        const root = await resolve(`ai:key:${deps.org.slug}`);
+        if (!root)
+            throw new Error(`${at}: the organisation root secret is not held`);
+        await hold(aiAppsParentRef(deps.org.id, parent), root);
+        deps.record(`${S}_minting`, '1');
+        await deps.persist();
+        let minted;
+        try {
+            minted = await call(() => deps.ai.mintNestedKey({
+                organisationId: deps.org.id,
+                minterKeyId: parent,
+                name: step.name ?? `${deps.org.slug}-boule-apps-ai`,
+                expiresDays: 365,
+                permissions: [...AI_APPS_PERMISSIONS],
+            }));
+        }
+        catch {
+            throw new Error(`${at}: AI did not confirm a one-time minter; inspect it before retrying`);
+        }
+        if (minted.secret)
+            deps.secret(minted.secret);
+        if (!minted.id)
+            throw new Error(`${at}: AI returned no minter identifier`);
+        deps.record(`${S}_undelivered`, minted.id);
+        deps.record(`${S}_parent_${minted.id}`, parent);
+        deps.forget(`${S}_minting`);
+        await deps.persist();
+        if (!minted.secret || !Number.isFinite(Date.parse(minted.expiresAt)))
+            throw new Error(`${at}: the one-time minter response was incomplete`);
+        await hold(ref, minted.secret);
+        deps.record(S, minted.id);
+        deps.record(`${S}_parent`, parent);
+        deps.record(`${S}_expires`, minted.expiresAt);
+        deps.record(`${S}_expires_${minted.id}`, minted.expiresAt);
+        deps.record(`${S}_clamped`, Date.parse(minted.expiresAt) - now() < 30 * DAY ? parent : '');
+        await deps.persist();
+        key = minted.secret;
+        keyId = minted.id;
+    }
+    if (!key || !keyId)
+        throw new Error(`${at}: the recorded minter's held value is missing; no new key was minted`);
+    const app = deps.bouleAppId;
+    try {
+        await call(() => deps.coolify.bulkUpsertEnvs(app, [
+            { key: AI_APPS_ENV.url, value: step.url, literal: true },
+            { key: AI_APPS_ENV.organisationId, value: deps.org.id, literal: true },
+            { key: AI_APPS_ENV.keyId, value: keyId, literal: true },
+            {
+                key: AI_APPS_ENV.keyExpires,
+                value: deps.recorded()[`${S}_expires`] ?? '',
+                literal: true,
+            },
+            { key: AI_APPS_ENV.key, value: key, literal: true },
+        ]));
+        await call(() => deps.coolify.restart(app));
+    }
+    catch {
+        throw new Error(`${at}: the minter is held but could not be delivered; the next apply reuses it`);
+    }
+    deps.forget(`${S}_undelivered`);
+    deps.record(`${S}_applied`, step.url);
+    await deps.persist();
+}

package/dist/plan/ai-boule-key.d.ts

@@ -37,7 +37,7 @@ export declare const AI_BOULE_PERMISSIONS: readonly ["ai.usage:read", "ai.runs:r
 /** What every organisation is offered, and its own key holds, without Boule's reads. */
 export declare const AI_DEFAULT_OFFERS: readonly ["ai.offerings:invoke", "ai.runs:create"];
 /** The organisation's offers, and the permissions its own key is minted with. */
-export declare function aiOffers(bouleReads: boolean): string[];
+export declare function aiOffers(bouleReads: boolean, appsKeys?: boolean): string[];
 /** The offers `ai:organisation` last set, as JSON. */
 export declare const AI_OFFERS_SCOPE_KEY = "ai_offers_applied";
 /** The permissions the recorded org key was minted with, as JSON. Absent: the default offers it was always minted with. */

package/dist/plan/ai-boule-key.js

@@ -40,8 +40,14 @@ export const AI_BOULE_PERMISSIONS = [
 /** What every organisation is offered, and its own key holds, without Boule's reads. */
 export const AI_DEFAULT_OFFERS = ['ai.offerings:invoke', 'ai.runs:create'];
 /** The organisation's offers, and the permissions its own key is minted with. */
-export function aiOffers(bouleReads) {
-    return bouleReads ? [...AI_DEFAULT_OFFERS, ...AI_BOULE_PERMISSIONS] : [...AI_DEFAULT_OFFERS];
+export function aiOffers(bouleReads, appsKeys = false) {
+    return [
+        ...new Set([
+            ...AI_DEFAULT_OFFERS,
+            ...(bouleReads ? AI_BOULE_PERMISSIONS : []),
+            ...(appsKeys ? ['ai.keys:mint', 'ai.keys:revoke', 'ai.usage:read'] : []),
+        ]),
+    ];
 }
 /** The offers `ai:organisation` last set, as JSON. */
 export const AI_OFFERS_SCOPE_KEY = 'ai_offers_applied';
@@ -139,7 +145,8 @@ export function planAiBouleKey(org, recordedIds, plannedSteps, readiness, now, b
     }
     const orgKey = recordedIds[`ai:key:${org.id}`];
     const orgKeyPlanned = planned('ai', 'key', org.id);
-    const orgKeyHolds = Boolean(orgKey) && aiKeyPermissions(recordedIds) === JSON.stringify(aiOffers(true));
+    const orgKeyHolds = Boolean(orgKey) &&
+        aiOffers(true).every((permission) => parseIds(aiKeyPermissions(recordedIds)).includes(permission));
     if (!orgKeyHolds && !orgKeyPlanned) {
         block("the org's own ai key does not hold Boule's permissions yet, and is not being minted with them");
         return { steps, blocked };

package/dist/plan/broker-entries.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { isFoundryOwnedBrokerEntryName, signsInBoth, signsInCustomers, } from '../org.js';
 import { entryClientIdScopeKey } from './agora.js';
 import { MCP_DATABASE_URL_ENV, MCP_OAUTH_SECRET_ENV } from './broker-mcp.js';
-import { BROKER_WORKSPACES_DATABASE_ENV, wantedWorkspaces, workspacesUrl, } from './entry-workspaces.js';
+import { BROKER_WORKSPACES_DATABASE_ENV, serverWorkspaces, wantedWorkspaces, workspacesUrl, } from './entry-workspaces.js';
 import { entryHostnames } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
 import { PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, parseBrokerDeployRecord, } from './platform-diff.js';
@@ -96,7 +96,7 @@ export function entryAuthEnv(org, entry, recorded, issuer) {
         }
         : {};
     Object.assign(values, mcpValues);
-    if (auth.workspaces)
+    if (serverWorkspaces(entry))
         Object.assign(values, { WORKSPACES_URL: workspacesUrl(org) });
     return Object.fromEntries(Object.entries(values).filter(([, value]) => Boolean(value)));
 }
@@ -126,14 +126,14 @@ export function wantedBrokerEntry(org, entry, recorded) {
         missing.push({ what: 'its MCP audience project id', producedBy: ['zitadel', 'mcp-project'] });
     }
     const workspaces = wantedWorkspaces(org, entry);
-    if (auth.workspaces && !workspaces) {
+    if (serverWorkspaces(entry) && !workspaces) {
         missing.push({ what: 'its public address', producedBy: ['coolify', 'app'] });
     }
     if (!organizationId ||
         !clientId ||
         !mailDomain ||
         (auth.mcp && !mcp) ||
-        (auth.workspaces && !workspaces)) {
+        (serverWorkspaces(entry) && !workspaces)) {
         return { missing };
     }
     return {

package/dist/plan/diff.d.ts

@@ -92,6 +92,8 @@ export interface PlanOrgOptions {
     reportingPort?: boolean;
     /** foundry#1119: the executor's jobs scheduler port mints and revokes project keys; without it Boule's key per `uses.jobs` entry is blocked. */
     jobsProjectKeys?: boolean;
+    /** Host confirms the scheduler supports company-scoped app project provisioning. */
+    jobsAppProjects?: boolean;
     /** The Files port can set and remove each live app's owner space alert. */
     serviceAlertMail?: boolean;
     serviceAlertMailCurrent?: Partial<Record<'files' | 'jobs', boolean | 'unreadable'>>;
@@ -103,6 +105,10 @@ export interface PlanOrgOptions {
      * it Boule's key is blocked.
      */
     aiBouleReads?: boolean;
+    /** Host guarantees deployed ordinary scoped AI revocation, purpose-aware issuance and held root authority. Off until released. */
+    aiAppsKeys?: boolean;
+    aiAppsRootKeyHeld?: boolean;
+    aiAppsMinterHeld?: boolean;
     /** C2: true when the executor was built with a `WorkerAppDatabasePort`; a `workerApp.database` is blocked without it. */
     workerAppDatabase?: boolean;
     /** True when that port has `deletableTables`; a `workerApp.database.noDelete` is blocked without it. */