@wtfalch/foundry 0.17.0 → 0.18.0

package/dist/bootstrap/declare.js

@@ -23,10 +23,12 @@ export const DEFAULT_GIT_REF = 'main';
  */
 export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
 /**
- * Every platform service except `sfu` is enabled, like the other steps: a
- * service whose dependencies the host did not supply is reported blocked, not
- * planned. `sfu` stays off because it needs a held SSH key and host
- * fingerprint, a separate human step (issue 170).
+ * Every platform service except `sfu` and `edge` is enabled, like the other
+ * steps: a service whose dependencies the host did not supply is reported
+ * blocked, not planned. `sfu` stays off because it needs a held SSH key and
+ * host fingerprint, a separate human step (issue 170). `edge` stays off
+ * because the edge service (N1) does not exist yet -- a human deploys it
+ * and sets its hostname before enabling it (#317's own "Human steps").
  */
 const SERVICES_ENABLED_BY_DEFAULT = new Set([
     'auth',

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
@@ -35,7 +35,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/index.js

@@ -12,7 +12,7 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';

package/dist/migrations/0043_platform_names.sql

@@ -0,0 +1,25 @@
+-- @wtfalch/foundry: #317 (F7) -- the names service, which mints an entry's
+-- own names key and holds the Cloudflare token `<username>.<org domain>`
+-- claims use, added to the declared platform the same way every other
+-- shared service here was (#165). Mirrors `src/store/schema.ts`'s
+-- `foundryDeclaredPlatform` table additions.
+--
+-- names_hostname has no static default the way every other service's
+-- column did at table creation -- #317 is the first service added after
+-- the table already carries its one live row, so a column that must not be
+-- empty (src/platform.ts's `validatePlatform`) cannot default to ''.
+-- Backfilled from this row's own apex before the column is required, so an
+-- existing platform keeps validating unchanged, at the default hostname an
+-- operator can still override afterwards.
+
+alter table foundry_declared_platform
+  add column if not exists names_enabled boolean not null default false,
+  add column if not exists names_hostname text,
+  add column if not exists names_git_ref text not null default '';
+
+update foundry_declared_platform
+  set names_hostname = 'names.' || apex
+  where names_hostname is null;
+
+alter table foundry_declared_platform
+  alter column names_hostname set not null;

package/dist/migrations/0044_platform_mail_lettermint_project.sql

@@ -0,0 +1,11 @@
+-- @wtfalch/foundry: #491 -- the Lettermint project id of the platform's own
+-- org (an org whose mail domain equals the platform apex, e.g. Company
+-- Included on companyincluded.com), so that org shares the platform's
+-- existing Lettermint project instead of getting a second `<slug>-app` one
+-- of its own. Declared, never discovered: null until an operator sets it
+-- (src/platform.ts's `validatePlatform` refuses a present-but-blank value,
+-- not this column). Mirrors src/store/schema.ts's `foundryDeclaredPlatform`
+-- table addition.
+
+alter table foundry_declared_platform
+  add column if not exists mail_lettermint_project_id text;

package/dist/migrations/0045_names_to_edge.sql

@@ -0,0 +1,107 @@
+-- @wtfalch/foundry: the names service is renamed edge, and the hosting entry
+-- field `edge` (a Cloudflare Worker) is renamed `worker`. No behaviour change.
+-- Mirrors `src/store/schema.ts`'s `foundryDeclaredPlatform` columns.
+--
+-- 1. foundry_declared_platform: names_enabled / names_hostname /
+--    names_git_ref become edge_*. Each rename runs only while the old column
+--    exists, so a second run is a no-op.
+-- 2. The hostname moves from `names.<apex>` to `edge.<apex>` only where it
+--    still equals the old default (0043); an operator's own value stays.
+-- 3. Recorded ids are rewritten in place: `names:key:`, `names:reserved-labels:`
+--    and `platform:names` (ids and step ids), and the colon-free scope keys
+--    `names_*` and `*_platform_names*`. The applied-hostname value is left
+--    alone, so the planner sees a changed hostname and applies the step again.
+--    Every WHERE clause matches only text that still holds an old key, so a
+--    second run changes nothing. `foundry_audit_events` is a signed chain and
+--    is not touched.
+-- 4. foundry_declared_orgs.hosting_entries: each entry's `uses.names` becomes
+--    `uses.edge`, and its `edge` becomes `worker`.
+
+do $$
+begin
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_enabled') then
+    alter table foundry_declared_platform rename column names_enabled to edge_enabled;
+  end if;
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_hostname') then
+    alter table foundry_declared_platform rename column names_hostname to edge_hostname;
+  end if;
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_git_ref') then
+    alter table foundry_declared_platform rename column names_git_ref to edge_git_ref;
+  end if;
+end
+$$;
+
+update foundry_declared_platform
+   set edge_hostname = 'edge.' || apex
+ where edge_hostname = 'names.' || apex;
+
+-- The old-to-new text rewrite for recorded ids, applied to the jsonb as text.
+create or replace function pg_temp.names_to_edge(value jsonb) returns jsonb
+language sql immutable as $fn$
+  select replace(
+           replace(
+             replace(
+               replace(
+                 replace(value::text, '"names:key:', '"edge:key:'),
+                 '"names:reserved-labels:', '"edge:reserved-labels:'),
+               '"names_', '"edge_'),
+             '_platform_names', '_platform_edge'),
+           'platform:names', 'platform:edge')::jsonb
+$fn$;
+
+update foundry_declared_platform
+   set service_ids = pg_temp.names_to_edge(service_ids)
+ where service_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set service_ids = pg_temp.names_to_edge(service_ids)
+ where service_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set checkpoints = pg_temp.names_to_edge(checkpoints)
+ where checkpoints::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set destroy = pg_temp.names_to_edge(destroy)
+ where destroy is not null
+   and destroy::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set step_ids = pg_temp.names_to_edge(step_ids)
+ where step_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set checkpoints = pg_temp.names_to_edge(checkpoints)
+ where checkpoints::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set failure = pg_temp.names_to_edge(failure)
+ where failure is not null
+   and failure::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_declared_orgs o
+   set hosting_entries = (
+         select coalesce(jsonb_agg(
+                  case
+                    when jsonb_typeof(s -> 'uses') = 'object' and (s -> 'uses') ? 'names'
+                    then jsonb_set(s, '{uses}',
+                           ((s -> 'uses') - 'names') || jsonb_build_object('edge', s -> 'uses' -> 'names'))
+                    else s
+                  end order by t.ord), '[]'::jsonb)
+           from jsonb_array_elements(o.hosting_entries) with ordinality as t(e, ord),
+                lateral (select case
+                                  when jsonb_typeof(t.e) = 'object' and t.e ? 'edge'
+                                  then (t.e - 'edge') || jsonb_build_object('worker', t.e -> 'edge')
+                                  else t.e
+                                end as s) as r(s))
+ where exists (
+         select 1 from jsonb_array_elements(o.hosting_entries) e
+          where jsonb_typeof(e) = 'object'
+            and (e ? 'edge' or (jsonb_typeof(e -> 'uses') = 'object' and (e -> 'uses') ? 'names'))
+       );

package/dist/org.d.ts

@@ -331,6 +331,62 @@ export interface HostingEntry {
     env: Record<string, EnvValue>;
     /** What the entry signs in through. Absent means it uses nothing. */
     uses?: HostingEntryUses;
+    /**
+     * F8: a Cloudflare Worker foundry deploys from this entry's own repo,
+     * beside the app, on the org's own zone. Only our own repos may use this
+     * (#318: outside customers need Workers for Platforms, not built yet), so
+     * `validateEntryWorker` refuses it unless `repo` is set (every non-null
+     * `repo` already matches `wtfalch/...`, {@link REPO}) and the route's zone
+     * is the org's own domain.
+     */
+    worker?: WorkerConfig;
+}
+/**
+ * One Cloudflare rate limiting binding on a Worker (#318) -- Cloudflare's own
+ * "simple" shape: a fixed number of requests per period, where `period` is
+ * the only two values Cloudflare's rate limiting binding accepts.
+ */
+export interface WorkerRateLimitBinding {
+    name: string;
+    namespaceId: string;
+    limit: number;
+    period: 10 | 60;
+}
+/** {@link HostingEntry.worker}'s bindings, one list per binding kind -- only rate limits today. */
+export interface WorkerBindings {
+    rateLimits: WorkerRateLimitBinding[];
+}
+/**
+ * A plain Worker deployed beside a hosting entry (#318), named by one route
+ * on the org's own zone. `artifactUrl`/`artifactSha256` name a *built*
+ * module -- the entry's own repo builds and publishes it (a release asset,
+ * typically), foundry only fetches and verifies it against the declared
+ * digest before uploading (estate DECISIONS.md, 2026-10-04, "offline.tf
+ * Worker setup": "The app's automated build process builds the bundle
+ * outside Foundry; Foundry consumes and deploys the artifact through the
+ * provider boundary... No manual build step and no source checkout/bundling
+ * in Foundry"). `validateEntryWorker` refuses anything that is not an
+ * `https://` URL -- a bare path or relative file name is exactly the shape
+ * this decision rules out.
+ */
+export interface WorkerConfig {
+    /** Where foundry fetches the built module from, behind `WorkersPort` -- never checked out or bundled here. */
+    artifactUrl: string;
+    /** The built module's sha256, lowercase hex. Verified against the fetched bytes before upload, and the sole signal `planWorkers` diffs on: an org that rebuilds under an unchanged URL redeploys only when this changes. */
+    artifactSha256: string;
+    /**
+     * One route per entry today. A wildcard route (`*.<domain>/*`) matches
+     * every subdomain, which also captures every other hostname the org
+     * serves under that domain -- its own app included, e.g. `app.<domain>`
+     * -- since Cloudflare routes the most specific match but a Worker route
+     * has no path-based exclusion of its own; declare it carefully so it
+     * does not shadow the app. The apex itself (`<domain>`, no subdomain
+     * label) is never matched by a wildcard route -- not even partially --
+     * so an org that wants the apex reachable through a Worker declares a
+     * separate entry with that exact route; there is no exclusion list.
+     */
+    route: string;
+    bindings?: WorkerBindings;
 }
 /**
  * Sign-in for one entry: one ZITADEL client and one broker entry, signing in
@@ -384,7 +440,17 @@ export interface HostingEntryUses {
     auth?: EntryAuth;
     ai?: EntryAi;
     files?: EntryFiles;
+    /**
+     * F7 (#317): the entry gets its own edge key, minted directly below the
+     * org with the edge service, and `EDGE_URL`/`EDGE_API_KEY` in its env.
+     * Serves only the org's own domain (edge claims `<label>.<org's domain>`),
+     * so `validateEntryEdge` refuses it without `hosting.usesDomain` and an
+     * org `domain`.
+     */
+    edge?: true;
 }
+/** The env names `uses.edge` writes; `env` may not name them (#317). */
+export declare const EDGE_ENTRY_ENV_NAMES: readonly ["EDGE_URL", "EDGE_API_KEY"];
 /**
  * A plain string is pushed as it is, so `validateHosting` refuses one that
  * looks like a secret. `{ from }` names a value the plan already mints.
@@ -526,9 +592,14 @@ export interface StorageConfig {
  * this is the declared value `apply` pushes onto it.
  *
  * A bigint-safe decimal string of a non-negative integer, never converted to
- * a number. `null` means uncapped. Spend itself (usage, money spent) is
- * never declared (#27 "Done when"): it is a runtime fact read live from AI's
- * usage ledger, shown beside this limit, never stored here.
+ * a number. `null` means no limit is declared -- not uncapped: `apply`
+ * (`diff.ts`'s `effectiveAiLimitMicros`) substitutes a default spend cap,
+ * `DEFAULT_AI_LIMIT_MICROS`, in that case (#484; Archon creates every
+ * company this way, and AI's own budget API has no uncapped
+ * representation). A declared numeric limit always wins over the default.
+ * Spend itself (usage, money spent) is never declared (#27 "Done when"): it
+ * is a runtime fact read live from AI's usage ledger, shown beside this
+ * limit, never stored here.
  */
 export interface AiConfig {
     limitMicros: string | null;

package/dist/org.js

@@ -36,6 +36,8 @@ export const FILES_ENTRY_ENV_NAMES = [
     'FILES_API_KEY',
 ];
 export const filesCollectionEnvName = (name) => `FILES_COLLECTION_${name}_ID`;
+/** The env names `uses.edge` writes; `env` may not name them (#317). */
+export const EDGE_ENTRY_ENV_NAMES = ['EDGE_URL', 'EDGE_API_KEY'];
 /** The org's `app` entry: today's one app. */
 export function appEntry(hosting) {
     return hosting.entries.find((entry) => entry.key === APP_ENTRY_KEY);
@@ -130,10 +132,30 @@ export function validateHosting(hosting, names) {
         const invalidFiles = validateEntryFiles(entry, hosting, names?.domain);
         if (invalidFiles)
             return invalidFiles;
+        const invalidWorker = validateEntryWorker(entry, hosting, names?.domain);
+        if (invalidWorker)
+            return invalidWorker;
+        const invalidEdgeUse = validateEntryEdge(entry, hosting, names?.domain);
+        if (invalidEdgeUse)
+            return invalidEdgeUse;
     }
     if (hosting.entries.filter((entry) => entry.uses?.ai?.webhookPath !== undefined).length > 1) {
         return 'at most one hosting entry may set uses.ai webhookPath: ai keeps one webhook per organisation';
     }
+    // #318 re-review: two entries declaring the same worker route both throw at
+    // apply (`cloudflareWorker` refuses a route already bound to a Worker
+    // that is not its own), one of which stops Agora and everything planned
+    // after it provisioning at all -- refused here instead, before an apply
+    // ever reaches it.
+    const seenWorkerRoutes = new Set();
+    for (const entry of hosting.entries) {
+        if (!entry.worker)
+            continue;
+        if (seenWorkerRoutes.has(entry.worker.route)) {
+            return `hosting.entries '${entry.key}' worker route '${entry.worker.route}' is already declared by another entry`;
+        }
+        seenWorkerRoutes.add(entry.worker.route);
+    }
     const invalidNames = validateEntryHostnames(hosting, names);
     if (invalidNames)
         return invalidNames;
@@ -415,6 +437,117 @@ function validateEntryFiles(entry, hosting, domain) {
         return `${at} writes ${named}; remove it from env`;
     return null;
 }
+/** A route pattern's zone apex: the host part before the first `/`, with one leading `*.` label stripped. */
+function workerRouteZone(route) {
+    const slash = route.indexOf('/');
+    if (slash < 1)
+        return null;
+    const host = route.slice(0, slash);
+    return host.startsWith('*.') ? host.slice(2) : host;
+}
+const WORKER_ROUTE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+\/.*$/;
+const WORKER_SHA256 = /^[0-9a-f]{64}$/;
+/**
+ * Restated, not shared, from `plan/worker.ts`'s `WORKER_ORG_HASH_LENGTH`/
+ * `WORKER_NAME_MAX_LENGTH` -- importing them here would import that
+ * module's own `DeclaredOrg`/`HostingEntry` imports right back into this
+ * one. `workerName`'s shape is `${8-hex-char hash}-${entry.key}-edge`;
+ * the hash and the `-edge` suffix are fixed length, so the entry key's own
+ * budget against Cloudflare's 63-character Worker name limit is fixed too.
+ */
+const WORKER_NAME_FIXED_LENGTH = 8 + 1 + '-edge'.length;
+const WORKER_NAME_MAX_LENGTH = 63;
+/**
+ * `worker`: the entry's own repo (never the shared standard app -- entries
+ * with `repo: null` have no Worker source of their own), an `https://`
+ * artifact URL with a lowercase-hex sha256 (never a bare path or relative
+ * file -- estate DECISIONS.md, 2026-10-04, rules out any checkout or
+ * bundling inside foundry), a route whose zone is the org's own domain
+ * (#318: our own projects only, never a customer's zone), and a rate limit
+ * binding's `period` restricted to the two values Cloudflare's simple rate
+ * limiting binding accepts.
+ */
+function validateEntryWorker(entry, hosting, domain) {
+    const worker = entry.worker;
+    if (!worker)
+        return null;
+    const at = `hosting.entries '${entry.key}' worker`;
+    if (!hosting.enabled)
+        return `${at} requires hosting.enabled`;
+    if (entry.repo === null) {
+        return `${at} needs its own repo (repo: null is the shared standard app, not a Worker source)`;
+    }
+    if (entry.key.length > WORKER_NAME_MAX_LENGTH - WORKER_NAME_FIXED_LENGTH) {
+        return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "-edge") must fit Cloudflare's ${WORKER_NAME_MAX_LENGTH}-character limit`;
+    }
+    let artifactUrl;
+    try {
+        artifactUrl = new URL(worker.artifactUrl);
+    }
+    catch {
+        return `${at} artifactUrl must be an absolute URL, not a bare path or relative file`;
+    }
+    if (artifactUrl.protocol !== 'https:') {
+        return `${at} artifactUrl must be an https:// URL`;
+    }
+    if (artifactUrl.username || artifactUrl.password) {
+        return `${at} artifactUrl must not carry userinfo (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
+    }
+    if (artifactUrl.search) {
+        return `${at} artifactUrl must not carry a query string (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
+    }
+    // `URL.hash` is '' for a bare trailing `#`, so the raw string is checked.
+    if (worker.artifactUrl.includes('#')) {
+        return `${at} artifactUrl must not carry a fragment (refused for the same reason as a query string)`;
+    }
+    if (!WORKER_SHA256.test(worker.artifactSha256)) {
+        return `${at} artifactSha256 must be 64 lowercase hex characters`;
+    }
+    if (!WORKER_ROUTE.test(worker.route)) {
+        return `${at} route must be a hostname (an optional leading '*.' label, then at least two more labels) and a path, joined by '/'`;
+    }
+    const zone = workerRouteZone(worker.route);
+    if (!domain || zone !== domain) {
+        return `${at} route '${worker.route}' must be on the org's own domain${domain ? ` (${domain})` : ''}: worker is only for our own projects`;
+    }
+    // A wildcard route (`*.<domain>/*`) is allowed beside hostnames foundry owns:
+    // `planWorkers` plans a no-Worker route for each of them, so they stay out of it.
+    for (const limit of worker.bindings?.rateLimits ?? []) {
+        if (!limit.name.trim())
+            return `${at} bindings.rateLimits needs a non-empty name`;
+        if (!limit.namespaceId.trim())
+            return `${at} bindings.rateLimits needs a non-empty namespaceId`;
+        if (!(Number.isInteger(limit.limit) && limit.limit > 0)) {
+            return `${at} bindings.rateLimits limit must be a positive whole number`;
+        }
+        if (limit.period !== 10 && limit.period !== 60) {
+            return `${at} bindings.rateLimits period must be 10 or 60 (Cloudflare allows no other value)`;
+        }
+    }
+    return null;
+}
+/**
+ * `uses.edge`: serves only the org's own domain (edge claims
+ * `<label>.<domain>`), so it needs `hosting.usesDomain` and a `domain`, and
+ * no `env` entry that names a value `uses.edge` writes.
+ */
+function validateEntryEdge(entry, hosting, domain) {
+    const edge = entry.uses?.edge;
+    if (edge === undefined)
+        return null;
+    const at = `hosting.entries '${entry.key}' uses.edge`;
+    if (edge !== true)
+        return `${at} must be true`;
+    if (!hosting.enabled)
+        return `${at} requires hosting.enabled`;
+    if (!hosting.usesDomain || !domain) {
+        return `${at} needs hosting.usesDomain and an org domain: edge serves only the org's own domain`;
+    }
+    const named = Object.keys(entry.env ?? {}).find((name) => EDGE_ENTRY_ENV_NAMES.includes(name));
+    if (named)
+        return `${at} writes ${named}; remove it from env`;
+    return null;
+}
 function urlHasPassword(value) {
     try {
         return new URL(value).password !== '';

package/dist/plan/chat-matrix.d.ts

@@ -90,7 +90,6 @@ export interface ChatServiceEnvInput {
     agoraHost: string;
     masClientId: string;
     masClientSecret: string;
-    databaseUrl: string;
 }
 /** Every variable `chat/apps/chat-service/src/config.ts` requires, plus the internal Synapse address and port. */
 export declare function chatServiceEnvs(input: ChatServiceEnvInput): Array<{

package/dist/plan/chat-matrix.js

@@ -195,7 +195,10 @@ export function chatServiceEnvs(input) {
         { key: 'MAS_URL', value: upstreams.mas },
         { key: 'MAS_CLIENT_ID', value: input.masClientId },
         { key: 'MAS_CLIENT_SECRET', value: input.masClientSecret },
-        { key: 'DATABASE_URL', value: input.databaseUrl },
+        // DATABASE_URL_OWNER/DATABASE_URL are pushed by executor.ts's
+        // pushDatabaseUrl instead, not here (the same split coolifyApp and
+        // cmsSite follow, #239) -- that call mints a distinct <dbName>_rt
+        // runtime role and never overwrites an already-minted DATABASE_URL.
         { key: 'CHAT_ALLOWED_ORIGINS', value: `https://${input.agoraHost}` },
         { key: 'PORT', value: CHAT_SERVICE_PORT },
     ];

package/dist/plan/diff.d.ts

@@ -51,6 +51,10 @@ export interface PlanOrgOptions {
     now?: () => number;
     /** #374: the Archon that bills this org (`plan-apply.ts`'s `orgArchonUrl`), written into Boule's env as `ARCHON_URL`. `null` with no platform wired. */
     archonUrl?: string | null;
+    /** #318: the executor was built with a `WorkersPort`, read by `planWorkers`. */
+    edgeWorkers?: boolean;
+    /** The platform's own service hostnames: `edgeReservedLabels` reserves them under the org's domain, and a wildcard Worker route (`planWorkers`) keeps them out. */
+    platformHostnames?: readonly string[];
 }
 export interface PlanDetail {
     orgId: OrgId;
@@ -117,3 +121,17 @@ export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */
 export declare const JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY = "jobs_registration_undelivered";
+/**
+ * #484: the spend cap foundry applies when an org declares no AI limit
+ * (`org.ai.limitMicros === null`) -- Archon creates every company that way,
+ * and AI's own `updateBudget` has no uncapped representation
+ * (`UpdateBudget.limitMicros` is a required string), so a null limit used to
+ * throw `ai:budget` out of every apply. William's Decision, 2026-10-05: 100
+ * EUR, in `ai`'s own USD-micros unit (`usdToMicros`,
+ * `ai/packages/service/src/money.ts`), billing to revisit the number later.
+ * 100 EUR at the ECB reference rate for 2 October 2026 (1.1225 USD/EUR, the
+ * most recent published rate as of the decision) is 112.25 USD = 112,250,000
+ * micros. A declared numeric limit always wins over this default --
+ * {@link effectiveAiLimitMicros} is the one place that substitutes it.
+ */
+export declare const DEFAULT_AI_LIMIT_MICROS = "112250000";