@wtfalch/foundry 0.78.1 → 0.79.0

package/dist/plan/diff.js

@@ -3,6 +3,7 @@ import { NATIVE_BUILD_KEY_ENV } from '../native-build.js';
 import { APP_ENTRY_KEY, MAIL_APP_KEY_ENV, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, heldEnvRef, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownerNameProblem, ownsServices, sendsMail, signsInBoth, signsInCustomers, } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, entryClientIdScopeKey, withRecordedMessagingProject, } from './agora.js';
+import { planAiAppsMinter } from './ai-apps-minter.js';
 import { AI_OFFERS_SCOPE_KEY, aiKeyPermissions, aiOffers, planAiBouleKey } from './ai-boule-key.js';
 import { planAnalyticsBoule } from './analytics-boule.js';
 import { analyticsEnvDrift, analyticsWanted, desiredAnalyticsEnv } from './analytics.js';
@@ -25,17 +26,19 @@ import { planEntryAudit } from './entry-audit.js';
 import { authEventsAppliedScopeKey, authEventsBlocked, authEventsMarker, } from './entry-auth-events.js';
 import { CUSTOMER_GRANTS_ENV, CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY, customerGrantsEntries, customerGrantsShapeMatches, customerGrantsToDrop, wantedCustomerGrants, } from './entry-customer-grants.js';
 import { planEdgeReservedLabels, planEdgeSlug, planEntryEdgeKeys } from './entry-edge-key.js';
-import { planFilesKeys } from './entry-files-key.js';
+import { planFilesKeys, usesServerFiles } from './entry-files-key.js';
 import { planEntryJobsBouleKeys } from './entry-jobs-boule-key.js';
 import { planEntryJobs } from './entry-jobs.js';
 import { planEntryRepoKeys } from './entry-repo-key.js';
 import { planEntryReportingKeys } from './entry-reporting-key.js';
-import { BROKER_WORKSPACES_DATABASE_ENV, workspacesDatabaseRef } from './entry-workspaces.js';
+import { BROKER_WORKSPACES_DATABASE_ENV, serverWorkspaces, workspacesDatabaseRef, } from './entry-workspaces.js';
+import { planFilesAppsMinter } from './files-apps-minter.js';
 import { planFilesBouleKey } from './files-boule-key.js';
 import { planFilesSpaceAlerts } from './files-space-alert.js';
 import { gateIdRecordKey, hasWildcardGate, planGates } from './gates.js';
 import { githubSourceResourceKey, planGithubSource } from './github-source.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
+import { planJobsAppsKey } from './jobs-apps-key.js';
 import { planJobsProjectSettings } from './jobs-project-settings.js';
 import { planKeysRegistrar } from './keys-registrar.js';
 import { desiredKosmosEnv, kosmosEnvDrift } from './kosmos.js';
@@ -457,13 +460,13 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
     const aiBouleReads = options.aiBouleReads ?? false;
-    const aiOrganisation = planAiOrganisation(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader, recordedIds, aiBouleReads);
+    const aiOrganisation = planAiOrganisation(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader, recordedIds, aiBouleReads, options.aiAppsKeys ?? false);
     if (aiOrganisation.step)
         plannedSteps.push(aiOrganisation.step);
     const aiBudget = planAiBudget(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader);
     if (aiBudget.step)
         plannedSteps.push(aiBudget.step);
-    const aiKey = planAiKey(org, recordedIds, platformReadiness.aiReady, aiBouleReads);
+    const aiKey = planAiKey(org, recordedIds, platformReadiness.aiReady, aiBouleReads, options.aiAppsKeys ?? false);
     if (aiKey.step)
         plannedSteps.push(aiKey.step);
     // Before `planSite`'s own step (#139): `cmsSite`'s executor reads this
@@ -557,7 +560,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     plannedSteps.push(...app.steps);
     // The broker's workspaces database, before any broker entry that needs it: made once, when none is held or set.
     const workspacesDatabasePlanned = declaredOrg.hosting.enabled &&
-        declaredOrg.hosting.entries.some((e) => e.uses?.auth?.workspaces) &&
+        declaredOrg.hosting.entries.some((e) => serverWorkspaces(e)) &&
         (options.broker ?? false) &&
         !(options.brokerWorkspacesDatabase ?? false) &&
         (options.provisionWorkspacesDatabase ?? false);
@@ -753,6 +756,9 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     // foundry#1121: Boule's files key, after Boule and after the org's own files key it is minted below.
     const filesBouleKey = planFilesBouleKey(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)());
     plannedSteps.push(...filesBouleKey.steps);
+    // Files for Boule's own apps: one key that mints each app's files key, while apps are on.
+    const filesAppsMinter = planFilesAppsMinter(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)());
+    plannedSteps.push(...filesAppsMinter.steps);
     const filesSpaceAlerts = planFilesSpaceAlerts(org, recordedIds, platformReadiness.filesReady && !filesOrganisation.blocked, options.filesSpaceAlerts ?? false);
     plannedSteps.push(...filesSpaceAlerts.steps);
     const serviceAlertMail = planServiceAlertMail(org, platformReadiness, options.serviceAlertMail ?? false, options.ownMailKeyHeld ?? false, options.serviceAlertMailCurrent);
@@ -760,6 +766,8 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     // foundry#1122: Boule's ai key, after Boule and after the org's own ai key it is minted below.
     const aiBouleKey = planAiBouleKey(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)(), aiBouleReads);
     plannedSteps.push(...aiBouleKey.steps);
+    const aiAppsMinter = planAiAppsMinter(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)(), options.aiAppsKeys ?? false, options.aiAppsRootKeyHeld ?? false, options.aiAppsMinterHeld ?? true);
+    plannedSteps.push(...aiAppsMinter.steps);
     // foundry#949: the company's kosmos, only once it turns it on. Its fixed ZITADEL client first, the same
     // reason Boule's and Agora's do: `coolifyKosmos` reads this step's recorded client id.
     const kosmosClient = planKosmosClient(org, byKey, claimed);
@@ -809,6 +817,8 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     // A company on shared services registers on the scheduler the host supplies (the owner company's); a company
     // that runs its own services never does, only on its own.
     const schedulerUsable = (jobsAvailable && !ownsServices(org)) || platformReadiness.jobsReady;
+    const jobsApps = planJobsAppsKey(org, recordedIds, plannedSteps, platformReadiness, schedulerUsable, options.jobsAppProjects ?? false, (options.now ?? Date.now)());
+    plannedSteps.push(...jobsApps.steps);
     // A `uses.jobs` entry registers with the scheduler after its app, whose env the step writes.
     const entryJobs = planEntryJobs(org, recordedIds, plannedSteps, platformReadiness, schedulerUsable);
     plannedSteps.push(...entryJobs.steps);
@@ -1095,6 +1105,8 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     unmanaged.push(...workspaces.unmanaged);
     unmanaged.push(...filesKeys.blocked);
     unmanaged.push(...filesBouleKey.blocked);
+    unmanaged.push(...filesAppsMinter.blocked);
+    unmanaged.push(...aiAppsMinter.blocked);
     unmanaged.push(...filesSpaceAlerts.blocked);
     unmanaged.push(...serviceAlertMail.blocked);
     unmanaged.push(...entryAiKeys.blocked);
@@ -1118,6 +1130,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     unmanaged.push(...appsAdmin.blocked);
     unmanaged.push(...appsDbRoute.blocked);
     unmanaged.push(...appsZones.blocked);
+    unmanaged.push(...jobsApps.blocked);
     unmanaged.push(...entryJobs.blocked);
     unmanaged.push(...jobsSettings.blocked);
     unmanaged.push(...entryJobsBouleKeys.blocked);
@@ -2624,7 +2637,7 @@ ownFilesPending = false) {
             blocked: `${org.slug}'s Files organisation is blocked, not planned: ${notReadyReason('files', 'files management key', missingKeyRef, noKeyReader)}`,
         };
     }
-    const shareHost = org.domain && org.hosting.entries.some((e) => e.uses?.files?.shareHost)
+    const shareHost = org.domain && org.hosting.entries.some((e) => usesServerFiles(e) && e.uses?.files?.shareHost)
         ? `share.${org.domain}`
         : null;
     return {
@@ -2673,15 +2686,17 @@ ownFilesPending = false) {
  * #177: blocked, not planned, while `aiReady` is false -- the platform's own
  * AI host (#172) is off or not yet applied.
  */
-function planAiOrganisation(org, byKey, claimed, aiReady, missingKeyRef, noKeyReader = false, recordedIds = {}, bouleReads = false) {
+function planAiOrganisation(org, byKey, claimed, aiReady, missingKeyRef, noKeyReader = false, recordedIds = {}, bouleReads = false, appsKeys = false) {
     const key = resourceKey('ai', 'organisation', org.id);
     const live = byKey.get(key);
-    const offers = aiOffers(bouleReads);
+    const offers = aiOffers(bouleReads, appsKeys);
     if (live) {
         claimed.add(key);
         // foundry#1122: once ai offers Boule's reads, an organisation offered fewer is offered them (both calls
         // are repeatable). Without the host's word nothing changes.
-        if (!bouleReads || !aiReady || recordedIds[AI_OFFERS_SCOPE_KEY] === JSON.stringify(offers)) {
+        if ((!bouleReads && !appsKeys) ||
+            !aiReady ||
+            recordedIds[AI_OFFERS_SCOPE_KEY] === JSON.stringify(offers)) {
             return { step: null, blocked: null };
         }
         return {
@@ -2804,14 +2819,15 @@ function planAiBudget(org, byKey, claimed, aiReady, missingKeyRef, noKeyReader =
  * organisation to mint a key inside yet, and {@link planAiOrganisation}
  * already reports the platform's AI host as missing once.
  */
-function planAiKey(org, recordedIds, aiReady, bouleReads = false) {
+function planAiKey(org, recordedIds, aiReady, bouleReads = false, appsKeys = false) {
     const key = resourceKey('ai', 'key', org.id);
-    const permissions = aiOffers(bouleReads);
+    const permissions = aiOffers(bouleReads, appsKeys);
     // foundry#1122: a delivered key that holds fewer than the organisation now offers is minted again with them,
     // so Boule's key can be minted below it. Without the host's word a delivered key plans nothing.
     const widen = Boolean(recordedIds[key]) &&
-        bouleReads &&
-        aiKeyPermissions(recordedIds) !== JSON.stringify(permissions);
+        (bouleReads || appsKeys) &&
+        (aiKeyPermissions(recordedIds) !== JSON.stringify(permissions) ||
+            (appsKeys && recordedIds.ai_key_purpose !== 'company_root'));
     if (recordedIds[key] && !widen)
         return { step: null, blocked: null }; // delivered -- a re-run plans nothing.
     if (!aiReady)
@@ -2838,6 +2854,7 @@ function planAiKey(org, recordedIds, aiReady, bouleReads = false) {
                     name: `${org.slug}-app`,
                     expiresDays: 365,
                     permissions,
+                    ...(appsKeys ? { protectedRoot: true } : {}),
                     ...(widen ? { mode: 'widen' } : {}),
                 },
             },
@@ -4809,6 +4826,9 @@ export function planBrokerEntries(org, recordedIds, plannedSteps, brokerWired, b
         // An entry both sign in to is registered (`registered-app.ts`), not an `AUTH_APPS` entry.
         if (!auth || signsInBoth(auth))
             continue;
+        // Boule's registrar owns this copy's workspaces key; AUTH_APPS must not replace it.
+        if (entry.workerApp && auth.workspaces)
+            continue;
         const at = `${org.slug}'s ${entry.key} broker entry`;
         const key = `coolify:broker-entry:${entry.key}`;
         const warnings = recordedIds[brokerEntryWarningsScopeKey(entry.key)];

package/dist/plan/entry-ai-key.d.ts

@@ -9,6 +9,8 @@ import type { OrgPlatformReadiness } from './platform-org.js';
 export declare const AI_ENTRY_KEY_DAYS = 365;
 /** A key with fewer days left than this is renewed. */
 export declare const AI_ENTRY_RENEW_WINDOW_DAYS = 30;
+/** Worker app keys are delivered by Boule; the server plan must never mint or write their env. */
+export declare const usesServerAi: (entry: Pick<HostingEntry, "uses" | "workerApp">) => boolean;
 /** Flat scope ids (no `:`) per entry. Entry keys hold neither `:` nor `.`. */
 export declare const entryAiUndeliveredScopeKey: (entryKey: string) => string;
 /** The ISO time the entry's live key expires. */

package/dist/plan/entry-ai-key.js

@@ -9,6 +9,8 @@ import { appStepKey } from './platform-diff.js';
 export const AI_ENTRY_KEY_DAYS = 365;
 /** A key with fewer days left than this is renewed. */
 export const AI_ENTRY_RENEW_WINDOW_DAYS = 30;
+/** Worker app keys are delivered by Boule; the server plan must never mint or write their env. */
+export const usesServerAi = (entry) => Boolean(entry.uses?.ai) && !entry.workerApp;
 const DAY_MS = 24 * 60 * 60 * 1000;
 /** Flat scope ids (no `:`) per entry. Entry keys hold neither `:` nor `.`. */
 export const entryAiUndeliveredScopeKey = (entryKey) => `ai_key_undelivered_${entryKey}`;
@@ -74,7 +76,7 @@ export function planEntryAiKeys(org, recordedIds, plannedSteps, readiness, now)
             });
         }
     }
-    const declared = new Set(org.hosting.entries.filter((e) => e.uses?.ai).map((e) => e.key));
+    const declared = new Set(org.hosting.entries.filter(usesServerAi).map((e) => e.key));
     const keyPrefix = `ai:key:${org.id}:`;
     // A key whose entry is gone, or no longer declares `uses.ai`, is revoked.
     if (readiness.aiReady) {
@@ -100,7 +102,7 @@ export function planEntryAiKeys(org, recordedIds, plannedSteps, readiness, now)
         }
     }
     for (const entry of org.hosting.entries) {
-        if (!entry.uses?.ai)
+        if (!usesServerAi(entry))
             continue;
         const at = `${org.slug}'s ${entry.key} ai key`;
         const stepKey = appStepKey(org, entry.key);

package/dist/plan/entry-customer-grants.d.ts

@@ -39,7 +39,7 @@ export declare function ensureCustomerGrantsCredential(input: {
     persist: () => Promise<void>;
     secret: (value: string) => void;
 }): Promise<string>;
-/** The entries that declare `uses.customerGrants`, in declared order. */
+/** Server entries: Boule provisions Worker credentials privately, never through the static server manifest. */
 export declare const customerGrantsEntries: (org: Pick<DeclaredOrg, "hosting">) => HostingEntry[];
 /** Entry keys that were given a credential and no longer declare the flag (or are gone). */
 export declare function customerGrantsToDrop(org: Pick<DeclaredOrg, 'hosting'>, recorded: Readonly<Record<string, string>>): string[];

package/dist/plan/entry-customer-grants.js

@@ -49,8 +49,10 @@ export async function ensureCustomerGrantsCredential(input) {
     await input.persist();
     return credential;
 }
-/** The entries that declare `uses.customerGrants`, in declared order. */
-export const customerGrantsEntries = (org) => org.hosting.enabled ? org.hosting.entries.filter((e) => e.uses?.customerGrants) : [];
+/** Server entries: Boule provisions Worker credentials privately, never through the static server manifest. */
+export const customerGrantsEntries = (org) => org.hosting.enabled
+    ? org.hosting.entries.filter((e) => e.uses?.customerGrants && !e.workerApp)
+    : [];
 /** Entry keys that were given a credential and no longer declare the flag (or are gone). */
 export function customerGrantsToDrop(org, recorded) {
     const wanted = new Set(customerGrantsEntries(org).map((e) => e.key));

package/dist/plan/entry-files-key.d.ts

@@ -7,6 +7,16 @@ import type { OrgPlatformReadiness } from './platform-org.js';
  * it. A secret goes to `deliverSecret` (the org key) or into the entry's env
  * (an entry key) and nowhere else.
  */
+/**
+ * An entry foundry mints a files key for: a server entry with `uses.files`. A Worker app's files keys come from
+ * its Boule (`files-apps-minter.ts`), so foundry plans nothing for one.
+ */
+export declare const usesServerFiles: (entry: {
+    uses?: {
+        files?: unknown;
+    };
+    workerApp?: unknown;
+}) => boolean;
 /** How long a key lives. files refuses more than 365 and anything past its minter's own expiry. */
 export declare const FILES_KEY_DAYS = 365;
 /** A key with fewer days left than this is renewed. */

package/dist/plan/entry-files-key.js

@@ -7,6 +7,11 @@ import { appStepKey } from './platform-diff.js';
  * it. A secret goes to `deliverSecret` (the org key) or into the entry's env
  * (an entry key) and nowhere else.
  */
+/**
+ * An entry foundry mints a files key for: a server entry with `uses.files`. A Worker app's files keys come from
+ * its Boule (`files-apps-minter.ts`), so foundry plans nothing for one.
+ */
+export const usesServerFiles = (entry) => Boolean(entry.uses?.files) && !entry.workerApp;
 /** How long a key lives. files refuses more than 365 and anything past its minter's own expiry. */
 export const FILES_KEY_DAYS = 365;
 /** A key with fewer days left than this is renewed. */
@@ -211,7 +216,7 @@ export function planFilesKeys(org, recordedIds, plannedSteps, readiness, now) {
             key: `files:agora-key:${org.id}`,
         });
     }
-    const entries = org.hosting.entries.filter((e) => e.uses?.files);
+    const entries = org.hosting.entries.filter(usesServerFiles);
     const declared = new Set(entries.map((e) => e.key));
     const rootKeyId = recordedIds[`files:key:${org.id}`];
     // A key whose entry is gone, or no longer declares `uses.files`, is revoked:

package/dist/plan/entry-jobs-boule-key.js

@@ -40,7 +40,7 @@ export const JOBS_BOULE_KEY_GRANT = {
     principal: 'boule',
     scopes: ['jobs:read', 'jobs:control'],
 };
-const usesJobs = (entry) => entry.uses?.jobs === true;
+const usesJobs = (entry) => !entry.workerApp && Boolean(entry.uses?.jobs);
 /**
  * Mint or deliver one step per `uses.jobs` entry whose key is not in Boule's env at the scheduler's current
  * address; retire one per entry that no longer declares it and still has a key recorded. Blocked, not planned

package/dist/plan/entry-jobs.js

@@ -40,7 +40,7 @@ export function planEntryJobs(org, recordedIds, plannedSteps, readiness, schedul
         return { steps, blocked };
     const appPlanned = (stepKey) => plannedSteps.some((p) => p.action.system === 'coolify' && p.action.kind === 'app' && p.action.key === stepKey);
     for (const entry of org.hosting.entries) {
-        if (!entry.uses?.jobs)
+        if (!entry.uses?.jobs || entry.workerApp)
             continue;
         const stepKey = appStepKey(org, entry.key);
         const key = `jobs:project:${stepKey}`;

package/dist/plan/entry-repo-key.js

@@ -66,7 +66,7 @@ export function repoKeyTarget(org, repo) {
  * has no app, so it counts as none: a key it had is removed, and made again when it goes live.
  */
 export const repoKeyEntries = (org) => org.hosting.enabled
-    ? org.hosting.entries.filter((e) => e.uses?.repo && e.repo !== null && e.live !== false)
+    ? org.hosting.entries.filter((e) => e.uses?.repo && !e.workerApp && e.repo !== null && e.live !== false)
     : [];
 /** Entry keys that were given a key and no longer declare `uses.repo` (or are gone, or hosting is off). */
 export function repoKeysToRemove(org, recorded) {
@@ -98,7 +98,7 @@ export function planEntryRepoKeys(org, recorded, plannedSteps, readiness) {
     const appPlanned = (stepKey) => plannedSteps.some((p) => p.action.system === 'coolify' && p.action.kind === 'app' && p.action.key === stepKey);
     for (const entry of org.hosting.enabled ? org.hosting.entries : []) {
         const use = entry.uses?.repo;
-        if (!use)
+        if (!use || entry.workerApp)
             continue;
         const stepKey = appStepKey(org, entry.key);
         const key = `github:deploy-key:${stepKey}`;

package/dist/plan/entry-workspaces.d.ts

@@ -4,6 +4,11 @@ import { type DeclaredOrg, type HostingEntry } from '../org.js';
  * entry, holds it, and gives it to two places: the app's env (`WORKSPACES_API_KEY`) and, as a sha256, the
  * broker entry (`workspacesKey`). The broker never sees the key and the plan never holds it.
  */
+/** Worker copies register through Boule, whose registrar answer owns the per-copy key. */
+export declare const serverWorkspaces: (entry: HostingEntry) => {
+    roles: string[];
+    invitePath: string;
+} | undefined;
 /** The marker that the entry's key was put in the held-key store: its ref, never the key. */
 export declare const entryWorkspacesMintedScopeKey: (entryKey: string) => string;
 /** The held-key ref of an entry's workspaces key. At most 123 characters: a UUID and an entry key of up to 63. */

package/dist/plan/entry-workspaces.js

@@ -8,6 +8,8 @@ import { orgTarget, platformTarget } from './own-services.js';
  * entry, holds it, and gives it to two places: the app's env (`WORKSPACES_API_KEY`) and, as a sha256, the
  * broker entry (`workspacesKey`). The broker never sees the key and the plan never holds it.
  */
+/** Worker copies register through Boule, whose registrar answer owns the per-copy key. */
+export const serverWorkspaces = (entry) => entry.workerApp ? undefined : entry.uses?.auth?.workspaces;
 /** The marker that the entry's key was put in the held-key store: its ref, never the key. */
 export const entryWorkspacesMintedScopeKey = (entryKey) => `workspaces_key_minted.${entryKey}`;
 /** The held-key ref of an entry's workspaces key. At most 123 characters: a UUID and an entry key of up to 63. */
@@ -26,7 +28,7 @@ export const workspacesUrl = (org) => `https://${loginHostnameFor(org)}/api`;
  * broker entry either, so the link never points at a private workspace address.
  */
 export function wantedWorkspaces(org, entry) {
-    const workspaces = entry.uses?.auth?.workspaces;
+    const workspaces = serverWorkspaces(entry);
     const host = entryHostnames(org, entry)[0];
     if (!workspaces || !host)
         return null;

package/dist/plan/executor.d.ts

@@ -1538,6 +1538,16 @@ export interface AiOrganisationPort {
         id: string;
         secret: string;
     }>;
+    /** Trusted infrastructure-root issuance route; ordinary operator app/user issuance remains ordinary. */
+    issueOrganisationRootKey?(organisationId: string, input: {
+        name: string;
+        expiresDays: number;
+        permissions: string[];
+    }): Promise<{
+        organisationId: string;
+        id: string;
+        secret: string;
+    }>;
     /**
      * F6a: mints an entry's key below the org's own key, matching ai's
      * `POST /v1/keys` (wtfalch/ai#162, SDK `mintKey`), which the management key
@@ -1569,6 +1579,12 @@ export interface AiOrganisationPort {
         secret: string;
         expiresAt: string;
     }>;
+    /** Ordinary descendant revocation authenticated by explicit company parent authority, never the platform token. */
+    revokeDescendantKey?(input: {
+        organisationId: string;
+        credential: string;
+        keyId: string;
+    }): Promise<unknown>;
     /**
      * F6a: registers `address` as the org's webhook, matching `PUT /v1/webhooks`
      * (`setWebhookAddress`). `secret` is present only when ai created the
@@ -1735,10 +1751,18 @@ export interface JobsSchedulerPort {
     mintProjectKey?(project: string, grant: {
         principal: string;
         scopes: readonly string[];
+        expiresAt?: string;
     }): Promise<{
         id: string;
         key: string;
     }>;
+    /** Names only, used to recover an ambiguous one-time provisioning mint without deleting runtime projects. */
+    listProjectKeys?(project: string): Promise<{
+        id: string;
+        principal: string;
+        scopes: string[];
+        revoked: boolean;
+    }[]>;
     /** Revokes one project key (`DELETE /admin/projects/<name>/keys/<id>`); an unknown key throws with `status: 404`. */
     revokeProjectKey?(project: string, keyId: string): Promise<void>;
 }
@@ -4253,6 +4277,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * foundry#1122, `plan/ai-boule-key.ts`: Boule's ai key, minted below the org's own ai key under rule 1, held,
      * and written to Boule's `AI_URL`, `AI_ORGANISATION_ID` and `AI_API_KEY`. See `ai-boule-key-apply.ts`.
      */
+    private aiAppsMinter;
     private aiBouleKey;
     /**
      * REVOKE SEAM (ai#157): revokes through `revokeKey` when the port has one.
@@ -4323,6 +4348,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * `files-boule-key-apply.ts`.
      */
     private filesBouleKey;
+    /** Files for Boule's own apps (`files-apps-minter.ts`): the key Boule mints each app's files key with. */
+    private filesAppsMinter;
     /**
      * Revokes one entry key. When the call fails the id joins the entry's list
      * of keys left live, which the plan shows, and the step goes on: the app

package/dist/plan/executor.js

@@ -9,6 +9,7 @@ import { NATIVE_BUILD_KEY_ENV } from '../native-build.js';
 import { AI_ENTRY_PERMISSIONS, APPS_DOMAIN, APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, FILES_SETTINGS_ENV_NAMES, FULL_COMMIT_SHA, MAIL_APP_KEY_ENV, MAIL_SETTINGS_ENV_NAMES, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, filesCollectionEnvName, heldEnvRef, isLiveEntry, isMainEntry, kosmosOn, mailAppKeyOf, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sendsMail, sharedSecretRef, signsInBoth, signsInCustomers, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
+import { ensureAiAppsMinter } from './ai-apps-minter.js';
 import { ensureAiBouleKey } from './ai-boule-key-apply.js';
 import { AI_KEY_PERMISSIONS_SCOPE_KEY, AI_KEY_PREVIOUS_SCOPE_KEY, AI_OFFERS_SCOPE_KEY, parseIds as parseAiIds, } from './ai-boule-key.js';
 import { ANALYTICS_BOULE_APPLIED_SCOPE_KEY, ANALYTICS_BOULE_ENV_NAMES, analyticsBouleMarker, } from './analytics-boule.js';
@@ -50,12 +51,13 @@ import { applyEntryAudit } from './entry-audit.js';
 import { AUTH_EVENTS_ENV, authEventsAppliedScopeKey, authEventsMarker, authEventsWanted, ensureAuthEventsSecret, heldAuthEventsSecret, } from './entry-auth-events.js';
 import { CUSTOMER_GRANTS_CREDENTIAL_ENV, CUSTOMER_GRANTS_ENV, CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY, customerGrantsEntries, customerGrantsJson, customerGrantsMintedScopeKey, customerGrantsRef, customerGrantsToDrop, ensureCustomerGrantsCredential, wantedCustomerGrants, } from './entry-customer-grants.js';
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, EDGE_SLUG_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, bouleEdgeKeyWanted, edgeKeyAppRecordKey, edgeKeyDomain, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
-import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PERMISSIONS_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, bouleKeyBelow, entryFilesAppliedScopeKey, entryFilesCollectionsScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, knownCollectionNames, parseIdList as parseFilesIdList, } from './entry-files-key.js';
+import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PERMISSIONS_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, bouleKeyBelow, entryFilesAppliedScopeKey, entryFilesCollectionsScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, knownCollectionNames, parseIdList as parseFilesIdList, usesServerFiles, } from './entry-files-key.js';
 import { ensureJobsBouleKey, retireJobsBouleKey } from './entry-jobs-boule-key-apply.js';
 import { entryJobsAppliedScopeKey, entryJobsRefs, entryJobsUndeliveredScopeKey, entryJobsWantMarker, } from './entry-jobs.js';
 import { ensureRepoKey, removeRepoKey } from './entry-repo-key-apply.js';
 import { ENTRY_REPORTING_KEY_DELIVERY_ATTEMPTS, entryReportingAppliedScopeKey, entryReportingRetiredScopeKey, entryReportingUndeliveredScopeKey, stageReportingKeyName, } from './entry-reporting-key.js';
 import { BROKER_WORKSPACES_DATABASE_ENV, ensureWorkspacesKey, heldWorkspacesDatabase, heldWorkspacesKey, workspacesDatabaseRef, workspacesKeyHash, workspacesKeyRef, } from './entry-workspaces.js';
+import { ensureFilesAppsMinter, retireFilesAppsMinter, } from './files-apps-minter.js';
 import { ensureFilesBouleKey, retireFilesBouleKey } from './files-boule-key-apply.js';
 import { applyFilesSpaceAlert, } from './files-space-alert.js';
 import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
@@ -63,6 +65,7 @@ import { GITHUB_SOURCE_INSTALLATION_SCOPE_KEY, GITHUB_SOURCE_TIMEOUT_MS, ensureG
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
 import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
 import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, workspaceHost, } from './hostnames.js';
+import { applyJobsAppsKey, jobsAppsRef } from './jobs-apps-key.js';
 import { applyJobsProjectSettings, } from './jobs-project-settings.js';
 import { KEYS_REGISTRAR_DELIVERY_ATTEMPTS, KEYS_REGISTRAR_KEY_DAYS, KEYS_REGISTRAR_KEY_ENV, KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY, KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, KEYS_REGISTRAR_URL_ENV, } from './keys-registrar.js';
 import { KOSMOS_CLIENT_ID_SCOPE_KEY, KOSMOS_DATABASE_SCOPE_KEY, KOSMOS_DEPLOYED_SCOPE_KEY, desiredKosmosEnv, kosmosEnvDrift, kosmosHostnameFor, } from './kosmos.js';
@@ -1452,6 +1455,10 @@ export class FoundryStepExecutor {
                 return this.filesOrganisation(action, org, context);
             case 'files:boule-key':
                 return this.filesBouleKey(action, org, context);
+            case 'ai:apps-minter':
+                return this.aiAppsMinter(action, org, context);
+            case 'files:apps-minter':
+                return this.filesAppsMinter(action, org, context);
             case 'coolify:service-alert-mail': {
                 await applyServiceAlertMail({
                     want: action.desired,
@@ -1523,6 +1530,29 @@ export class FoundryStepExecutor {
                 return this.edgeSlug(action, org, context);
             case 'jobs:project':
                 return this.jobsProject(action, org, context);
+            case 'jobs:apps-key': {
+                const held = this.ports.heldKeys;
+                if (!held?.put)
+                    throw new Error('jobs:apps-key: held keys cannot put');
+                const desired = action.desired;
+                if (desired.mode === 'ensure' && org.boule?.apps !== true)
+                    throw new Error('jobs:apps-key: apps are off now');
+                if (desired.mode === 'retire' && org.boule?.apps === true)
+                    throw new Error('jobs:apps-key: apps are on again');
+                await applyJobsAppsKey({
+                    scheduler: await this.jobsPort(org),
+                    heldKeys: { resolve: held.resolve.bind(held), put: held.put.bind(held) },
+                    coolify: this.ports.coolify,
+                    org,
+                    bouleAppId: context.recordedIds()[`coolify:boule:${org.id}`],
+                    recorded: () => context.recordedIds(),
+                    record: (key, value) => context.recordScopeId(key, value),
+                    forget: (key) => forgetScopeId(context, key),
+                    persist: () => context.persistScopeIds(),
+                    secret: (value) => void this.handledSecrets.add(value),
+                }, desired);
+                return {};
+            }
             case 'jobs:boule-key':
                 return this.jobsBouleKey(action, org, context);
             case 'github:deploy-key':
@@ -5533,6 +5563,9 @@ export class FoundryStepExecutor {
         if (!entry?.uses?.auth) {
             throw new Error(`coolify:broker-entry for ${org.slug}: no uses.auth entry for ${action.key}`);
         }
+        if (entry.workerApp && entry.uses.auth.workspaces) {
+            throw new Error(`coolify:broker-entry for ${org.slug}: Worker workspaces are registered through Boule, not AUTH_APPS`);
+        }
         const wanted = wantedBrokerEntry(org, entry, recorded);
         if ('missing' in wanted) {
             throw new Error(`coolify:broker-entry for ${org.slug}: ${wanted.missing.map((m) => m.what).join(', ')} not recorded yet`);
@@ -11377,7 +11410,12 @@ export class FoundryStepExecutor {
      */
     async aiKey(action, org, context) {
         const ai = await this.aiPort();
-        const issued = await ai.issueOrganisationKey(org.id, {
+        const issue = action.desired.protectedRoot
+            ? ai.issueOrganisationRootKey?.bind(ai)
+            : ai.issueOrganisationKey.bind(ai);
+        if (!issue)
+            throw new Error(`ai:key for ${org.slug}: the released infrastructure-root adapter is required`);
+        const issued = await issue(org.id, {
             name: action.desired.name,
             expiresDays: action.desired.expiresDays,
             permissions: action.desired.permissions ?? [],
@@ -11397,6 +11435,7 @@ export class FoundryStepExecutor {
                 // foundry#1122: what the key holds, so a narrower one is minted again (`planAiKey`). A key it
                 // replaced stays live until it expires (no revoke route yet, ai#157); the plan lists it.
                 context.recordScopeId(AI_KEY_PERMISSIONS_SCOPE_KEY, JSON.stringify(action.desired.permissions ?? []));
+                context.recordScopeId('ai_key_purpose', action.desired.protectedRoot ? 'company_root' : 'ordinary');
                 const replaced = context.recordedIds()[`ai:key:${org.id}`];
                 if (replaced && replaced !== issued.id) {
                     const previous = parseAiIds(context.recordedIds()[AI_KEY_PREVIOUS_SCOPE_KEY]);
@@ -11565,6 +11604,32 @@ export class FoundryStepExecutor {
      * foundry#1122, `plan/ai-boule-key.ts`: Boule's ai key, minted below the org's own ai key under rule 1, held,
      * and written to Boule's `AI_URL`, `AI_ORGANISATION_ID` and `AI_API_KEY`. See `ai-boule-key-apply.ts`.
      */
+    async aiAppsMinter(action, org, context) {
+        const ai = await this.aiPort();
+        const held = this.ports.heldKeys;
+        if (!ai.revokeDescendantKey || !held?.put)
+            throw new Error(`ai:apps-minter for ${org.slug}: scoped lifecycle and held-key adapters are required`);
+        const step = action.desired;
+        if (step.mode === 'retire' && org.boule?.apps === true)
+            throw new Error(`ai:apps-minter for ${org.slug}: apps are on again; nothing was revoked`);
+        await ensureAiAppsMinter({
+            ai: {
+                mintNestedKey: ai.mintNestedKey.bind(ai),
+                revokeDescendantKey: ai.revokeDescendantKey.bind(ai),
+            },
+            heldKeys: { resolve: held.resolve.bind(held), put: held.put.bind(held) },
+            coolify: this.ports.coolify,
+            org,
+            bouleAppId: context.recordedIds()[`coolify:boule:${org.id}`],
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            forget: (key) => forgetScopeId(context, key),
+            persist: () => context.persistScopeIds(),
+            secret: (value) => void this.handledSecrets.add(value),
+            now: () => context.now?.() ?? Date.now(),
+        }, step);
+        return {};
+    }
     async aiBouleKey(action, org, context) {
         const at = `ai:boule-key for ${org.slug}`;
         const ai = await this.aiPort();
@@ -11963,7 +12028,7 @@ export class FoundryStepExecutor {
             // Every entry must already hold a key below the new org key; otherwise
             // an app would lose its key. The next plan asks again.
             const ready = org.hosting.entries
-                .filter((e) => e.uses?.files)
+                .filter(usesServerFiles)
                 .every((e) => recorded[`files:key:${org.id}:${e.key}`] &&
                 recorded[entryFilesMinterScopeKey(e.key)] === rootId &&
                 !recorded[entryFilesUndeliveredScopeKey(e.key)]);
@@ -12213,7 +12278,7 @@ export class FoundryStepExecutor {
             now: () => context.now?.() ?? Date.now(),
         };
         if (desired.mode === 'retire') {
-            if (org.hosting.enabled && org.hosting.entries.some((e) => e.uses?.files)) {
+            if (org.hosting.enabled && org.hosting.entries.some(usesServerFiles)) {
                 throw new Error(`${at}: an entry declares uses.files again; nothing was revoked`);
             }
             await retireFilesBouleKey(deps);
@@ -12224,6 +12289,47 @@ export class FoundryStepExecutor {
         await ensureFilesBouleKey(deps, action.desired);
         return {};
     }
+    /** Files for Boule's own apps (`files-apps-minter.ts`): the key Boule mints each app's files key with. */
+    async filesAppsMinter(action, org, context) {
+        const at = `files:apps-minter for ${org.slug}`;
+        const files = await this.filesPort();
+        const held = this.ports.heldKeys;
+        const put = held?.put?.bind(held);
+        const desired = action.desired;
+        const deps = {
+            files: {
+                issueOrganisationKey: files.issueOrganisationKey.bind(files),
+                revokeOrganisationKey: files.revokeOrganisationKey.bind(files),
+            },
+            heldKeys: {
+                resolve: async (ref) => (held ? held.resolve(ref) : null),
+                put: async (ref, value) => {
+                    if (!put)
+                        throw new Error('the held keys cannot put');
+                    await put(ref, value);
+                },
+            },
+            coolify: this.ports.coolify,
+            org: { id: org.id, slug: org.slug },
+            bouleAppId: context.recordedIds()[`coolify:boule:${org.id}`],
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            forget: (key) => forgetScopeId(context, key),
+            persist: () => context.persistScopeIds(),
+            secret: (value) => void this.handledSecrets.add(value),
+        };
+        if (desired.mode === 'retire') {
+            if (org.boule?.apps === true) {
+                throw new Error(`${at}: apps are on again; nothing was revoked`);
+            }
+            await retireFilesAppsMinter(deps);
+            return {};
+        }
+        if (!held || !put)
+            throw new Error(`${at}: the held keys cannot hold the key`);
+        await ensureFilesAppsMinter(deps, action.desired);
+        return {};
+    }
     /**
      * Revokes one entry key. When the call fails the id joins the entry's list
      * of keys left live, which the plan shows, and the step goes on: the app
@@ -12468,6 +12574,21 @@ export class FoundryStepExecutor {
                     await port.deleteOrganisation(stageOrgId);
                     return;
                 }
+                case 'jobs:apps-projects': {
+                    const scheduler = await this.jobsPort(org);
+                    if (!scheduler.deleteProject)
+                        throw new Error('jobs:apps-projects: project removal is not wired');
+                    try {
+                        await withTimeout(scheduler.deleteProject(target.id), 30_000);
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw new Error('jobs:apps-projects: the project could not be removed');
+                    }
+                    if (this.ports.heldKeys?.put)
+                        await withTimeout(this.ports.heldKeys.put(jobsAppsRef(org.id), ''), 30_000);
+                    return;
+                }
                 case 'jobs:bg-keys':
                     // A jobs project's keys go with the project.
                     return;