@wtfalch/foundry 0.17.0 → 0.17.1

package/dist/bootstrap/declare.js

@@ -23,10 +23,12 @@ export const DEFAULT_GIT_REF = 'main';
  */
 export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
 /**
- * Every platform service except `sfu` is enabled, like the other steps: a
- * service whose dependencies the host did not supply is reported blocked, not
- * planned. `sfu` stays off because it needs a held SSH key and host
- * fingerprint, a separate human step (issue 170).
+ * Every platform service except `sfu` and `names` is enabled, like the other
+ * steps: a service whose dependencies the host did not supply is reported
+ * blocked, not planned. `sfu` stays off because it needs a held SSH key and
+ * host fingerprint, a separate human step (issue 170). `names` stays off
+ * because the names service (N1) does not exist yet -- a human deploys it
+ * and sets its hostname before enabling it (#317's own "Human steps").
  */
 const SERVICES_ENABLED_BY_DEFAULT = new Set([
     'auth',

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
@@ -35,7 +35,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformNamesDeps, PlatformNamesRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/index.js

@@ -12,7 +12,7 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';

package/dist/migrations/0043_platform_names.sql

@@ -0,0 +1,25 @@
+-- @wtfalch/foundry: #317 (F7) -- the names service, which mints an entry's
+-- own names key and holds the Cloudflare token `<username>.<org domain>`
+-- claims use, added to the declared platform the same way every other
+-- shared service here was (#165). Mirrors `src/store/schema.ts`'s
+-- `foundryDeclaredPlatform` table additions.
+--
+-- names_hostname has no static default the way every other service's
+-- column did at table creation -- #317 is the first service added after
+-- the table already carries its one live row, so a column that must not be
+-- empty (src/platform.ts's `validatePlatform`) cannot default to ''.
+-- Backfilled from this row's own apex before the column is required, so an
+-- existing platform keeps validating unchanged, at the default hostname an
+-- operator can still override afterwards.
+
+alter table foundry_declared_platform
+  add column if not exists names_enabled boolean not null default false,
+  add column if not exists names_hostname text,
+  add column if not exists names_git_ref text not null default '';
+
+update foundry_declared_platform
+  set names_hostname = 'names.' || apex
+  where names_hostname is null;
+
+alter table foundry_declared_platform
+  alter column names_hostname set not null;

package/dist/migrations/0044_platform_mail_lettermint_project.sql

@@ -0,0 +1,11 @@
+-- @wtfalch/foundry: #491 -- the Lettermint project id of the platform's own
+-- org (an org whose mail domain equals the platform apex, e.g. Company
+-- Included on companyincluded.com), so that org shares the platform's
+-- existing Lettermint project instead of getting a second `<slug>-app` one
+-- of its own. Declared, never discovered: null until an operator sets it
+-- (src/platform.ts's `validatePlatform` refuses a present-but-blank value,
+-- not this column). Mirrors src/store/schema.ts's `foundryDeclaredPlatform`
+-- table addition.
+
+alter table foundry_declared_platform
+  add column if not exists mail_lettermint_project_id text;

package/dist/org.d.ts

@@ -331,6 +331,62 @@ export interface HostingEntry {
     env: Record<string, EnvValue>;
     /** What the entry signs in through. Absent means it uses nothing. */
     uses?: HostingEntryUses;
+    /**
+     * F8: a Cloudflare Worker foundry deploys from this entry's own repo,
+     * beside the app, on the org's own zone. Only our own repos may use this
+     * (#318: outside customers need Workers for Platforms, not built yet), so
+     * `validateEntryEdge` refuses it unless `repo` is set (every non-null
+     * `repo` already matches `wtfalch/...`, {@link REPO}) and the route's zone
+     * is the org's own domain.
+     */
+    edge?: EdgeConfig;
+}
+/**
+ * One Cloudflare rate limiting binding on a Worker (#318) -- Cloudflare's own
+ * "simple" shape: a fixed number of requests per period, where `period` is
+ * the only two values Cloudflare's rate limiting binding accepts.
+ */
+export interface EdgeRateLimitBinding {
+    name: string;
+    namespaceId: string;
+    limit: number;
+    period: 10 | 60;
+}
+/** {@link HostingEntry.edge}'s bindings, one list per binding kind -- only rate limits today. */
+export interface EdgeBindings {
+    rateLimits: EdgeRateLimitBinding[];
+}
+/**
+ * A plain Worker deployed beside a hosting entry (#318), named by one route
+ * on the org's own zone. `artifactUrl`/`artifactSha256` name a *built*
+ * module -- the entry's own repo builds and publishes it (a release asset,
+ * typically), foundry only fetches and verifies it against the declared
+ * digest before uploading (estate DECISIONS.md, 2026-10-04, "offline.tf
+ * Worker setup": "The app's automated build process builds the bundle
+ * outside Foundry; Foundry consumes and deploys the artifact through the
+ * provider boundary... No manual build step and no source checkout/bundling
+ * in Foundry"). `validateEntryEdge` refuses anything that is not an
+ * `https://` URL -- a bare path or relative file name is exactly the shape
+ * this decision rules out.
+ */
+export interface EdgeConfig {
+    /** Where foundry fetches the built module from, behind `WorkersPort` -- never checked out or bundled here. */
+    artifactUrl: string;
+    /** The built module's sha256, lowercase hex. Verified against the fetched bytes before upload, and the sole signal `planEdgeWorkers` diffs on: an org that rebuilds under an unchanged URL redeploys only when this changes. */
+    artifactSha256: string;
+    /**
+     * One route per entry today. A wildcard route (`*.<domain>/*`) matches
+     * every subdomain, which also captures every other hostname the org
+     * serves under that domain -- its own app included, e.g. `app.<domain>`
+     * -- since Cloudflare routes the most specific match but a Worker route
+     * has no path-based exclusion of its own; declare it carefully so it
+     * does not shadow the app. The apex itself (`<domain>`, no subdomain
+     * label) is never matched by a wildcard route -- not even partially --
+     * so an org that wants the apex reachable through a Worker declares a
+     * separate entry with that exact route; there is no exclusion list.
+     */
+    route: string;
+    bindings?: EdgeBindings;
 }
 /**
  * Sign-in for one entry: one ZITADEL client and one broker entry, signing in
@@ -384,7 +440,17 @@ export interface HostingEntryUses {
     auth?: EntryAuth;
     ai?: EntryAi;
     files?: EntryFiles;
+    /**
+     * F7 (#317): the entry gets its own names key, minted directly below the
+     * org with the names service, and `NAMES_URL`/`NAMES_API_KEY` in its env.
+     * Serves only the org's own domain (names claims `<label>.<org's domain>`),
+     * so `validateEntryNames` refuses it without `hosting.usesDomain` and an
+     * org `domain`.
+     */
+    names?: true;
 }
+/** The env names `uses.names` writes; `env` may not name them (#317). */
+export declare const NAMES_ENTRY_ENV_NAMES: readonly ["NAMES_URL", "NAMES_API_KEY"];
 /**
  * A plain string is pushed as it is, so `validateHosting` refuses one that
  * looks like a secret. `{ from }` names a value the plan already mints.
@@ -526,9 +592,14 @@ export interface StorageConfig {
  * this is the declared value `apply` pushes onto it.
  *
  * A bigint-safe decimal string of a non-negative integer, never converted to
- * a number. `null` means uncapped. Spend itself (usage, money spent) is
- * never declared (#27 "Done when"): it is a runtime fact read live from AI's
- * usage ledger, shown beside this limit, never stored here.
+ * a number. `null` means no limit is declared -- not uncapped: `apply`
+ * (`diff.ts`'s `effectiveAiLimitMicros`) substitutes a default spend cap,
+ * `DEFAULT_AI_LIMIT_MICROS`, in that case (#484; Archon creates every
+ * company this way, and AI's own budget API has no uncapped
+ * representation). A declared numeric limit always wins over the default.
+ * Spend itself (usage, money spent) is never declared (#27 "Done when"): it
+ * is a runtime fact read live from AI's usage ledger, shown beside this
+ * limit, never stored here.
  */
 export interface AiConfig {
     limitMicros: string | null;

package/dist/org.js

@@ -36,6 +36,8 @@ export const FILES_ENTRY_ENV_NAMES = [
     'FILES_API_KEY',
 ];
 export const filesCollectionEnvName = (name) => `FILES_COLLECTION_${name}_ID`;
+/** The env names `uses.names` writes; `env` may not name them (#317). */
+export const NAMES_ENTRY_ENV_NAMES = ['NAMES_URL', 'NAMES_API_KEY'];
 /** The org's `app` entry: today's one app. */
 export function appEntry(hosting) {
     return hosting.entries.find((entry) => entry.key === APP_ENTRY_KEY);
@@ -130,10 +132,30 @@ export function validateHosting(hosting, names) {
         const invalidFiles = validateEntryFiles(entry, hosting, names?.domain);
         if (invalidFiles)
             return invalidFiles;
+        const invalidEdge = validateEntryEdge(entry, hosting, names?.domain, names?.locked);
+        if (invalidEdge)
+            return invalidEdge;
+        const invalidNamesUse = validateEntryNames(entry, hosting, names?.domain);
+        if (invalidNamesUse)
+            return invalidNamesUse;
     }
     if (hosting.entries.filter((entry) => entry.uses?.ai?.webhookPath !== undefined).length > 1) {
         return 'at most one hosting entry may set uses.ai webhookPath: ai keeps one webhook per organisation';
     }
+    // #318 re-review: two entries declaring the same edge route both throw at
+    // apply (`cloudflareWorker` refuses a route already bound to a Worker
+    // that is not its own), one of which stops Agora and everything planned
+    // after it provisioning at all -- refused here instead, before an apply
+    // ever reaches it.
+    const seenEdgeRoutes = new Set();
+    for (const entry of hosting.entries) {
+        if (!entry.edge)
+            continue;
+        if (seenEdgeRoutes.has(entry.edge.route)) {
+            return `hosting.entries '${entry.key}' edge route '${entry.edge.route}' is already declared by another entry`;
+        }
+        seenEdgeRoutes.add(entry.edge.route);
+    }
     const invalidNames = validateEntryHostnames(hosting, names);
     if (invalidNames)
         return invalidNames;
@@ -415,6 +437,127 @@ function validateEntryFiles(entry, hosting, domain) {
         return `${at} writes ${named}; remove it from env`;
     return null;
 }
+/** A route pattern's zone apex: the host part before the first `/`, with one leading `*.` label stripped. */
+function edgeRouteZone(route) {
+    const slash = route.indexOf('/');
+    if (slash < 1)
+        return null;
+    const host = route.slice(0, slash);
+    return host.startsWith('*.') ? host.slice(2) : host;
+}
+const EDGE_ROUTE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+\/.*$/;
+const EDGE_SHA256 = /^[0-9a-f]{64}$/;
+/**
+ * Restated, not shared, from `plan/edge-worker.ts`'s `EDGE_WORKER_ORG_HASH_LENGTH`/
+ * `EDGE_WORKER_NAME_MAX_LENGTH` -- importing them here would import that
+ * module's own `DeclaredOrg`/`HostingEntry` imports right back into this
+ * one. `edgeWorkerName`'s shape is `${8-hex-char hash}-${entry.key}-edge`;
+ * the hash and the `-edge` suffix are fixed length, so the entry key's own
+ * budget against Cloudflare's 63-character Worker name limit is fixed too.
+ */
+const EDGE_WORKER_NAME_FIXED_LENGTH = 8 + 1 + '-edge'.length;
+const EDGE_WORKER_NAME_MAX_LENGTH = 63;
+/**
+ * `edge`: the entry's own repo (never the shared standard app -- entries
+ * with `repo: null` have no Worker source of their own), an `https://`
+ * artifact URL with a lowercase-hex sha256 (never a bare path or relative
+ * file -- estate DECISIONS.md, 2026-10-04, rules out any checkout or
+ * bundling inside foundry), a route whose zone is the org's own domain
+ * (#318: our own projects only, never a customer's zone), and a rate limit
+ * binding's `period` restricted to the two values Cloudflare's simple rate
+ * limiting binding accepts.
+ */
+function validateEntryEdge(entry, hosting, domain, locked) {
+    const edge = entry.edge;
+    if (!edge)
+        return null;
+    const at = `hosting.entries '${entry.key}' edge`;
+    if (!hosting.enabled)
+        return `${at} requires hosting.enabled`;
+    if (entry.repo === null) {
+        return `${at} needs its own repo (repo: null is the shared standard app, not a Worker source)`;
+    }
+    if (entry.key.length > EDGE_WORKER_NAME_MAX_LENGTH - EDGE_WORKER_NAME_FIXED_LENGTH) {
+        return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "-edge") must fit Cloudflare's ${EDGE_WORKER_NAME_MAX_LENGTH}-character limit`;
+    }
+    let artifactUrl;
+    try {
+        artifactUrl = new URL(edge.artifactUrl);
+    }
+    catch {
+        return `${at} artifactUrl must be an absolute URL, not a bare path or relative file`;
+    }
+    if (artifactUrl.protocol !== 'https:') {
+        return `${at} artifactUrl must be an https:// URL`;
+    }
+    if (artifactUrl.username || artifactUrl.password) {
+        return `${at} artifactUrl must not carry userinfo (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
+    }
+    if (artifactUrl.search) {
+        return `${at} artifactUrl must not carry a query string (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
+    }
+    // `URL.hash` is '' for a bare trailing `#`, so the raw string is checked.
+    if (edge.artifactUrl.includes('#')) {
+        return `${at} artifactUrl must not carry a fragment (refused for the same reason as a query string)`;
+    }
+    if (!EDGE_SHA256.test(edge.artifactSha256)) {
+        return `${at} artifactSha256 must be 64 lowercase hex characters`;
+    }
+    if (!EDGE_ROUTE.test(edge.route)) {
+        return `${at} route must be a hostname (an optional leading '*.' label, then at least two more labels) and a path, joined by '/'`;
+    }
+    const zone = edgeRouteZone(edge.route);
+    if (!domain || zone !== domain) {
+        return `${at} route '${edge.route}' must be on the org's own domain${domain ? ` (${domain})` : ''}: edge is only for our own projects`;
+    }
+    // #318 re-review: a Worker route has no path-based exclusion of its own,
+    // so a wildcard (`*.<domain>/*`) captures every hostname foundry already
+    // owns under the domain -- Agora, Boule, the login host and the rest of
+    // `locked-hostnames.ts`'s set -- not only the org's other entries. (A
+    // non-wildcard route can only ever be the bare apex here -- the check
+    // just above requires `edgeRouteZone(edge.route) === domain`, and that
+    // function returns a non-wildcard route's host unchanged -- and the apex
+    // alone is never itself a locked name, so there is no direct-match case
+    // to refuse alongside this one.)
+    if (locked && locked.size > 0 && edge.route.startsWith('*.')) {
+        return `${at} route '${edge.route}' is a wildcard: it would also capture ${[...locked].sort().join(', ')}, every hostname foundry already owns under this domain`;
+    }
+    for (const limit of edge.bindings?.rateLimits ?? []) {
+        if (!limit.name.trim())
+            return `${at} bindings.rateLimits needs a non-empty name`;
+        if (!limit.namespaceId.trim())
+            return `${at} bindings.rateLimits needs a non-empty namespaceId`;
+        if (!(Number.isInteger(limit.limit) && limit.limit > 0)) {
+            return `${at} bindings.rateLimits limit must be a positive whole number`;
+        }
+        if (limit.period !== 10 && limit.period !== 60) {
+            return `${at} bindings.rateLimits period must be 10 or 60 (Cloudflare allows no other value)`;
+        }
+    }
+    return null;
+}
+/**
+ * `uses.names`: serves only the org's own domain (names claims
+ * `<label>.<domain>`), so it needs `hosting.usesDomain` and a `domain`, and
+ * no `env` entry that names a value `uses.names` writes.
+ */
+function validateEntryNames(entry, hosting, domain) {
+    const names = entry.uses?.names;
+    if (names === undefined)
+        return null;
+    const at = `hosting.entries '${entry.key}' uses.names`;
+    if (names !== true)
+        return `${at} must be true`;
+    if (!hosting.enabled)
+        return `${at} requires hosting.enabled`;
+    if (!hosting.usesDomain || !domain) {
+        return `${at} needs hosting.usesDomain and an org domain: names serves only the org's own domain`;
+    }
+    const named = Object.keys(entry.env ?? {}).find((name) => NAMES_ENTRY_ENV_NAMES.includes(name));
+    if (named)
+        return `${at} writes ${named}; remove it from env`;
+    return null;
+}
 function urlHasPassword(value) {
     try {
         return new URL(value).password !== '';

package/dist/plan/chat-matrix.d.ts

@@ -90,7 +90,6 @@ export interface ChatServiceEnvInput {
     agoraHost: string;
     masClientId: string;
     masClientSecret: string;
-    databaseUrl: string;
 }
 /** Every variable `chat/apps/chat-service/src/config.ts` requires, plus the internal Synapse address and port. */
 export declare function chatServiceEnvs(input: ChatServiceEnvInput): Array<{

package/dist/plan/chat-matrix.js

@@ -195,7 +195,10 @@ export function chatServiceEnvs(input) {
         { key: 'MAS_URL', value: upstreams.mas },
         { key: 'MAS_CLIENT_ID', value: input.masClientId },
         { key: 'MAS_CLIENT_SECRET', value: input.masClientSecret },
-        { key: 'DATABASE_URL', value: input.databaseUrl },
+        // DATABASE_URL_OWNER/DATABASE_URL are pushed by executor.ts's
+        // pushDatabaseUrl instead, not here (the same split coolifyApp and
+        // cmsSite follow, #239) -- that call mints a distinct <dbName>_rt
+        // runtime role and never overwrites an already-minted DATABASE_URL.
         { key: 'CHAT_ALLOWED_ORIGINS', value: `https://${input.agoraHost}` },
         { key: 'PORT', value: CHAT_SERVICE_PORT },
     ];

package/dist/plan/diff.d.ts

@@ -51,6 +51,8 @@ export interface PlanOrgOptions {
     now?: () => number;
     /** #374: the Archon that bills this org (`plan-apply.ts`'s `orgArchonUrl`), written into Boule's env as `ARCHON_URL`. `null` with no platform wired. */
     archonUrl?: string | null;
+    /** #318: the executor was built with a `WorkersPort`, read by `planEdgeWorkers`. */
+    edgeWorkers?: boolean;
 }
 export interface PlanDetail {
     orgId: OrgId;
@@ -117,3 +119,17 @@ export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */
 export declare const JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY = "jobs_registration_undelivered";
+/**
+ * #484: the spend cap foundry applies when an org declares no AI limit
+ * (`org.ai.limitMicros === null`) -- Archon creates every company that way,
+ * and AI's own `updateBudget` has no uncapped representation
+ * (`UpdateBudget.limitMicros` is a required string), so a null limit used to
+ * throw `ai:budget` out of every apply. William's Decision, 2026-10-05: 100
+ * EUR, in `ai`'s own USD-micros unit (`usdToMicros`,
+ * `ai/packages/service/src/money.ts`), billing to revisit the number later.
+ * 100 EUR at the ECB reference rate for 2 October 2026 (1.1225 USD/EUR, the
+ * most recent published rate as of the decision) is 112.25 USD = 112,250,000
+ * micros. A declared numeric limit always wins over this default --
+ * {@link effectiveAiLimitMicros} is the one place that substitutes it.
+ */
+export declare const DEFAULT_AI_LIMIT_MICROS = "112250000";