@wtfalch/foundry 0.17.0 → 0.18.0

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -15,7 +15,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, } from './platform-providers.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';

package/dist/plan/live.d.ts

@@ -26,9 +26,11 @@ export interface LiveResource {
      * `platform-diff.ts`'s `planSfu` always plans its step when
      * `DeclaredPlatform.sfu.enabled` is true, rather than diffing against a
      * live resource the way every other system here does. It is still part of
-     * this union so `StepAction.system` (`diff.ts`) can name it.
+     * this union so `StepAction.system` (`diff.ts`) can name it. `'edge'`
+     * (#317) is the same: a edge key has no live lookup of its own, the same
+     * shape `ai`/`files` entry keys already follow.
      */
-    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu';
+    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge';
     kind: string;
     key: string;
     config: Record<string, unknown>;

package/dist/plan/login-host.d.ts

@@ -21,8 +21,19 @@ import type { DeclaredOrg } from '../org.js';
  * `RESERVED_AUTH_AND_ENVIRONMENTS` already reserves the `auth` *slug* so no
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
+ *
+ * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
+ * -- the platform's own org, declared with-domain on the platform's own
+ * domain, would otherwise compute the shared ZITADEL instance's own login
+ * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
+ * `auth.companyincluded.com`). Archon's login-host write throws on that
+ * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
+ * written instead, `auth`'s own `company-host.ts` denies every request
+ * through a duplicate host, the shared one included. `platformAuthHostname`
+ * is `null` when the caller has none to compare against (no platform
+ * declared, or sign-in not ready yet), in which case this never refuses.
  */
-export declare function loginHostnameFor(org: DeclaredOrg): string;
+export declare function loginHostnameFor(org: DeclaredOrg, platformAuthHostname?: string | null): string;
 /**
  * One entry in zitadel-login's own `LOGIN_HOST_BINDINGS`
  * (`auth/docs/company-login-hosts.md`) -- a single-line JSON document naming

package/dist/plan/login-host.js

@@ -22,12 +22,30 @@ import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
  * `RESERVED_AUTH_AND_ENVIRONMENTS` already reserves the `auth` *slug* so no
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
+ *
+ * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
+ * -- the platform's own org, declared with-domain on the platform's own
+ * domain, would otherwise compute the shared ZITADEL instance's own login
+ * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
+ * `auth.companyincluded.com`). Archon's login-host write throws on that
+ * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
+ * written instead, `auth`'s own `company-host.ts` denies every request
+ * through a duplicate host, the shared one included. `platformAuthHostname`
+ * is `null` when the caller has none to compare against (no platform
+ * declared, or sign-in not ready yet), in which case this never refuses.
  */
-export function loginHostnameFor(org) {
+export function loginHostnameFor(org, platformAuthHostname = null) {
     // `issuer.usesDomain` is the issuer's opt-in into the org's domain
     // (`org.ts`'s `IssuerConfig`): a domain alone never moves it, so a domain
     // with `usesDomain` false stays on the tier 1 host.
-    return org.domain && org.issuer.usesDomain ? `auth.${org.domain}` : `${org.slug}-auth.oikos.host`;
+    if (org.domain && org.issuer.usesDomain) {
+        const host = `auth.${org.domain}`;
+        if (platformAuthHostname && host === platformAuthHostname) {
+            return `${org.slug}-auth.oikos.host`;
+        }
+        return host;
+    }
+    return `${org.slug}-auth.oikos.host`;
 }
 /**
  * Scope id holding what the binding was last written with

package/dist/plan/plan-apply.d.ts

@@ -333,6 +333,12 @@ export interface FoundryPlanApplyOptions {
      * reported blocked instead of planned.
      */
     broker?: boolean;
+    /**
+     * #318: true when the host's executor was built with a `WorkersPort`.
+     * Optional, and false without it: each entry's `worker` Worker is then
+     * reported blocked instead of planned.
+     */
+    edgeWorkers?: boolean;
     /**
      * #177: true when the host's executor was built with its own `filesOrganisation`
      * / `aiOrganisation` port. Without one, the org step needs the platform's
@@ -340,6 +346,12 @@ export interface FoundryPlanApplyOptions {
      */
     filesOrganisation?: boolean;
     aiOrganisation?: boolean;
+    /**
+     * #317: true when the host's executor was built with a `EdgePort`.
+     * Optional, and false without it: each entry's `uses.edge` step is then
+     * reported blocked instead of planned to fail.
+     */
+    edge?: boolean;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -416,8 +428,10 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly jobsScheduler;
     private readonly loginHostBindings;
     private readonly broker;
+    private readonly edgeWorkers;
     private readonly hostFiles;
     private readonly hostAi;
+    private readonly hostEdge;
     private readonly now;
     private readonly leaseTtlMs;
     private readonly appliedVersions;
@@ -566,6 +580,7 @@ export declare class FoundryPlanApply implements PlanApply {
      * which only the plan can read.
      */
     private invalidHosting;
+    private platformServiceHostnames;
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`

package/dist/plan/plan-apply.js

@@ -8,12 +8,14 @@ import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScope
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
+import { entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
+import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
 const PLATFORM_SCOPE = 'platform';
@@ -97,6 +99,9 @@ const HOSTNAME_STEPS = new Set([
     'cloudflare:tunnel',
     'cloudflare:access',
     'jobs:registration',
+    // #318 (F8): the route is itself hostname-shaped, validated against the
+    // org's own domain by `validateEntryWorker`.
+    'cloudflare:worker',
 ]);
 /**
  * The #19 implementation of {@link PlanApply}: computes a plan against live
@@ -116,8 +121,10 @@ export class FoundryPlanApply {
     jobsScheduler;
     loginHostBindings;
     broker;
+    edgeWorkers;
     hostFiles;
     hostAi;
+    hostEdge;
     now;
     leaseTtlMs;
     appliedVersions;
@@ -135,8 +142,10 @@ export class FoundryPlanApply {
         this.jobsScheduler = options.jobsScheduler ?? false;
         this.loginHostBindings = options.loginHostBindings ?? false;
         this.broker = options.broker ?? false;
+        this.edgeWorkers = options.edgeWorkers ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
+        this.hostEdge = options.edge ?? false;
         this.now = options.now ?? (() => new Date());
         this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
         this.appliedVersions = options.appliedVersions;
@@ -477,7 +486,7 @@ export class FoundryPlanApply {
             const serviceIds = { ...(state?.serviceIds ?? {}) };
             let targets;
             try {
-                targets = destroyTargets(serviceIds);
+                targets = destroyTargets(serviceIds, id);
             }
             catch (e) {
                 await this.refuseDestroy(id, e instanceof Error ? e.message : String(e));
@@ -530,6 +539,14 @@ export class FoundryPlanApply {
                         // gone" itself.
                         await this.destroyer.destroy(target, { org, recordedIds: { ...serviceIds } });
                         delete serviceIds[destroyServiceIdKey(target)];
+                        if (target.system === 'cloudflare' && target.kind === 'worker') {
+                            // #318: its partial-deploy traces too, or a retry after a later
+                            // step fails would read this Worker as live again.
+                            const entryKey = target.key.slice(id.length + 1);
+                            for (const scopeKey of workerTraceScopeKeys(entryKey)) {
+                                delete serviceIds[scopeKey];
+                            }
+                        }
                         steps[current] = {
                             step: descriptions[current],
                             status: 'finished',
@@ -593,7 +610,7 @@ export class FoundryPlanApply {
         const state = await this.store.getAppliedState(id);
         const serviceIds = { ...(state?.serviceIds ?? {}) };
         return {
-            steps: destroyStepDescriptions(destroyTargets(serviceIds)),
+            steps: destroyStepDescriptions(destroyTargets(serviceIds, id)),
             kept: keptDescriptions(serviceIds),
         };
     }
@@ -852,12 +869,15 @@ export class FoundryPlanApply {
             this.orgArchonUrl(),
         ]);
         const otherSlugs = (await this.store.list()).filter((o) => o.id !== id).map((o) => o.slug);
+        const platformHostnames = await this.platformServiceHostnames();
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
             broker: this.broker,
+            edgeWorkers: this.edgeWorkers,
             otherSlugs,
             now: () => this.now().getTime(),
             archonUrl,
+            platformHostnames,
         });
         const invalid = await this.invalidHosting(org);
         if (invalid) {
@@ -877,15 +897,15 @@ export class FoundryPlanApply {
      * which only the plan can read.
      */
     async invalidHosting(org) {
-        const platform = await this.platformDeps?.store.get();
-        const platformHostnames = platform
-            ? PLATFORM_SERVICE_KEYS.map((k) => platform[k].hostname)
-            : [];
         return validateHosting(org.hosting, {
             domain: org.domain,
-            locked: lockedHostnames(org, platformHostnames),
+            locked: lockedHostnames(org, await this.platformServiceHostnames()),
         });
     }
+    async platformServiceHostnames() {
+        const platform = await this.platformDeps?.store.get();
+        return platform ? PLATFORM_SERVICE_KEYS.map((k) => platform[k].hostname) : [];
+    }
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`
@@ -909,7 +929,7 @@ export class FoundryPlanApply {
             refs.add(ORG_PLATFORM_KEY_REFS.ai);
         if (this.jobsScheduler)
             refs.add(ORG_PLATFORM_KEY_REFS.jobs);
-        const readiness = orgPlatformReadinessFrom(platform, recorded, refs, !heldKeys);
+        const readiness = orgPlatformReadinessFrom(platform, recorded, refs, !heldKeys, this.hostEdge);
         // Entry env from the platform's mail key or a shared secret (#T8).
         let mailKeyHeld = false;
         try {
@@ -1112,7 +1132,7 @@ const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
  * belongs to is already left in place -- deleting only the rule and not the
  * zone is a decision left for whoever wires teardown in, not made here.
  */
-function destroyTargets(serviceIds) {
+function destroyTargets(serviceIds, orgId) {
     // Reverse-teardown order: everything under one of these prefixes is
     // collected in this order, then every ZITADEL app (there can be several,
     // #71), then the two scope ids last.
@@ -1120,6 +1140,8 @@ function destroyTargets(serviceIds) {
         'zitadel:login-host:',
         'cloudflare:tunnel:',
         'cloudflare:access:',
+        // #318: an entry's Worker and its route.
+        'cloudflare:worker:',
         'coolify:database:',
         'coolify:app:',
         'zitadel:customers:',
@@ -1127,10 +1149,27 @@ function destroyTargets(serviceIds) {
         'ai:key:',
         // F6b: an entry's files key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
         'files:key:',
+        // F7 (#317): an entry's edge key, `<orgId>:<entry>` -- edge has no org-root key.
+        'edge:key:',
     ];
     const targets = [];
     const adopted = adoptedResourceIds(serviceIds);
     for (const prefix of ORDERED_PREFIXES) {
+        if (prefix === 'cloudflare:worker:') {
+            // #318 re-review: not the main ids alone -- `liveWorkers` also
+            // finds an upload-only or route-only partial deploy, and leaves out an
+            // entry whose Worker is already retired (nothing live, so a host with
+            // no WorkersPort is not blocked from destroying the org by it).
+            for (const [entryKey, scriptName] of liveWorkers(orgId, serviceIds)) {
+                targets.push({
+                    system: 'cloudflare',
+                    kind: 'worker',
+                    key: `${orgId}:${entryKey}`,
+                    id: scriptName,
+                });
+            }
+            continue;
+        }
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix))
                 continue;
@@ -1141,10 +1180,49 @@ function destroyTargets(serviceIds) {
                 continue;
             if (prefix === 'files:key:' && !resourceKey.slice(prefix.length).includes(':'))
                 continue;
+            // A key a retire step already revoked before org destroy ever ran
+            // (#317 review): `runSteps` never clears this main id on a step that
+            // returns no resourceId, so without this check destroy would target
+            // an already-revoked key and get stuck on edge' 404 forever.
+            if (prefix === 'edge:key:') {
+                // `resourceKey.slice(prefix.length)` is `<orgId>:<entryKey>`, but
+                // `entryEdgeRetiredScopeKey` takes the bare entry key alone (as
+                // every caller in entry-edge-key.ts/executor.ts gives it) --
+                // entry keys hold no `:` of their own, so the first one found is
+                // exactly the org id/entry key boundary.
+                const fullKey = resourceKey.slice(prefix.length);
+                const entryKey = fullKey.slice(fullKey.indexOf(':') + 1);
+                if (serviceIds[entryEdgeRetiredScopeKey(entryKey)] === id)
+                    continue;
+            }
             const [system, kind] = prefix.split(':');
             targets.push({ system, kind, key: resourceKey.slice(prefix.length), id });
         }
     }
+    // F7 (#317): a key minted but never delivered never gets the main
+    // `edge:key:<org>:<entry>` id recorded (the mint step throws before
+    // `runSteps` sees a `resourceId`), so the loop above never finds it to
+    // revoke on destroy. Skipped if a later mint already succeeded and holds
+    // its own, still-live main id -- entry keys hold no `:`, so matching the
+    // suffix is unambiguous. A main id that equals the entry's retired marker
+    // does not count as "later": mint A, deliver, retire (main id A, retired
+    // marker A); re-declare, mint B, fail delivery three times (undelivered
+    // B, main id stays A). Without this check, A's stale-but-truthy main id
+    // hid B from destroy, leaking it the same way the gone-scan in
+    // `entry-edge-key.ts` once did (#317 re-review).
+    const undeliveredEdgePrefix = 'edge_key_undelivered_';
+    for (const [resourceKey, id] of Object.entries(serviceIds)) {
+        if (!id || !resourceKey.startsWith(undeliveredEdgePrefix))
+            continue;
+        const entryKey = resourceKey.slice(undeliveredEdgePrefix.length);
+        const hasLaterMainId = Object.entries(serviceIds).some(([k, v]) => v &&
+            k.startsWith('edge:key:') &&
+            k.endsWith(`:${entryKey}`) &&
+            serviceIds[entryEdgeRetiredScopeKey(entryKey)] !== v);
+        if (hasLaterMainId)
+            continue;
+        targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
+    }
     for (const [resourceKey, id] of Object.entries(serviceIds)) {
         if (!resourceKey.startsWith('zitadel:app:'))
             continue;
@@ -1226,6 +1304,7 @@ const STEP_FIELDS = {
     'cloudflare:zone': 'hosting.usesDomain',
     'cloudflare:access': 'hosting.accessEmails',
     'cloudflare:ratelimit': 'hosting.usesDomain',
+    'cloudflare:worker': 'hosting.entries.worker',
 };
 function stepField(action) {
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.
@@ -1235,6 +1314,9 @@ function stepField(action) {
     // The org's own files key (F6b) is keyed `<orgId>`, an entry's `<orgId>:<entry>`.
     if (action.system === 'files' && action.kind === 'key')
         return 'hosting.entries.uses.files';
+    // An entry's edge key (F7): always `<orgId>:<entry>`, edge has no org-root key.
+    if (action.system === 'edge' && action.kind === 'key')
+        return 'hosting.entries.uses.edge';
     // An org declares several issuer apps, each keyed by its name (#71).
     if (action.system === 'zitadel' && action.kind === 'app') {
         return `hosting.issuerApps.${action.key}`;
@@ -1283,6 +1365,17 @@ function failedFields(org, detail, completed, serviceIds) {
             }
         }
     }
+    // The same for an entry's edge key (F7): minted, never delivered is no
+    // longer blocked forever on its own (the next apply revokes it and
+    // mints again, #317 re-review) -- but while that retry step is itself
+    // not planned this run (no edge service wired, say), the leftover
+    // undelivered id must still read as unresolved rather than the org
+    // converging silently around it.
+    for (const entry of org.hosting.entries) {
+        if (entry.uses?.edge && serviceIds[entryEdgeUndeliveredScopeKey(entry.key)]) {
+            failed.add('hosting.entries.uses.edge');
+        }
+    }
     // The same for a jobs registration whose credentials never reached the host.
     if (serviceIds[JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY] &&
         !serviceIds[`jobs:registration:${org.id}`]) {

package/dist/plan/platform-diff.d.ts

@@ -118,6 +118,23 @@ export declare const PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY = "archon_applied
  * unrecorded and the old key stays pinned.
  */
 export declare const PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY = "archon_integrations_key_synced";
+/**
+ * #467: sha256 of the exact env set the *last confirmed* Archon deploy ran
+ * with, recorded only once that deploy's `waitForHealthyVersion` passed --
+ * mirroring {@link PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY}'s own
+ * confirm-after-health-check timing, generalized from one env to all of
+ * them. `provisionPlatformArchon` clears this to `''` the moment it decides
+ * a redeploy is needed, before attempting it: a deploy that then fails (or
+ * a crash before the health check passes) must leave the attempt
+ * unconfirmed, and the env hash alone cannot tell a failed retry's intended
+ * content apart from a successful one's, since both intend the same bytes.
+ * Without this, a run that writes new envs and then fails before Archon
+ * redeploys -- `envsDiffer` comparing desired envs against the *live*
+ * store, which this run's own write already updated -- leaves a retry
+ * reading no difference at all, and the container stays on the stale
+ * values until someone redeploys by hand (#467).
+ */
+export declare const PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY = "archon_envs_deployed_hash";
 /**
  * #211 round 4: the broker app id Archon last registered its entry with.
  * `provisionPlatformArchon` reads the broker to register with from
@@ -136,6 +153,21 @@ export declare const PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY = "archon_applied_
  * has recorded it.
  */
 export declare const PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY = "archon_applied_bootstrap_operator";
+/**
+ * #475: whether the last successful Archon apply patched the app with
+ * `custom_network_aliases` and `is_consistent_container_name_enabled: false`
+ * instead of the old fixed `custom_internal_name` alone. Coolify only runs a
+ * rolling, health-checked deploy -- start the new container, wait, then stop
+ * the old one -- when the consistent-name flag is off; with it on (set by
+ * foundry's own pre-#475 applies, or by hand in the Coolify UI) every deploy
+ * stops the old container before the new one exists, which is what took
+ * Archon down for #475's incident. Absent on every platform applied before
+ * this fix landed; `planArchon` plans the step again until
+ * `provisionPlatformArchon` records it, which only happens once that run's
+ * redeploy has passed its health check -- the same confirm-after-health-check
+ * timing {@link PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY} uses.
+ */
+export declare const PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY = "archon_applied_rolling_update";
 /**
  * The owner's ZITADEL user id Archon takes as its first operator, from
  * {@link PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY}. Undefined when none is
@@ -409,6 +441,18 @@ export declare function appEnvAppliedScopeKey(entryKey: string): string;
  * would leave a stale container that no plan notices.
  */
 export declare function dbEnvAppliedScopeKey(entryKey: string): string;
+/**
+ * #456: the same marker as {@link dbEnvAppliedScopeKey}, for the chat and
+ * calls-service sibling platform services' own owner/runtime database split
+ * -- in its own `service_db_env_applied.` namespace, never
+ * `dbEnvAppliedScopeKey`'s `db_env_applied.`. Those two services are not
+ * hosting entries, but `dbEnvAppliedScopeKey`'s `entryKey` is an arbitrary
+ * caller-chosen string with no reserved words (`validateHostingEntry` only
+ * requires a DNS label), so a hosting entry a company declares with the key
+ * `chat` or `calls-service` would otherwise read or clear the sibling
+ * service's own marker, and vice versa.
+ */
+export declare function serviceDbEnvAppliedScopeKey(service: 'chat' | 'calls-service'): string;
 /**
  * The settings `coolifyApp` owns on an entry's app (`folder`, `port`,
  * `autoDeploy`) as the JSON the marker below holds. `coolifyApp` records it
@@ -577,6 +621,50 @@ export declare const PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY = "files_ma
  */
 export declare const PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY = "files_applied_hostname";
 export declare const PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY = "files_applied_git_ref";
+/**
+ * #478: the resource key `planEdge` plans under and
+ * `FoundryPlatformStepExecutor` dispatches on -- the {@link PLATFORM_FILES_KEY}
+ * shape for the edge host (https://github.com/wtfalch/edge). `runPlatformSteps`
+ * records the app's uuid under `coolify:app:platform:edge` once the step
+ * succeeds, which is what stops `planEdge` planning it again.
+ */
+export declare const PLATFORM_EDGE_KEY = "platform:edge";
+/**
+ * #478: the held-key ref the edge platform secret's full value is
+ * delivered under, once, by {@link FoundryStepExecutorPorts.deliverSecret} --
+ * never the host's app env, which gets only its SHA-256 hash
+ * (`EDGE_PLATFORM_KEY_HASH`). Archon's own `EdgePort` reads the full
+ * secret back from this ref to call edge' `mintKey`/`revokeKey`/
+ * `setReservedLabels`.
+ */
+export declare const PLATFORM_EDGE_KEY_REF = "edge:platform:key";
+/**
+ * #478: the held-key ref for edge' own Cloudflare API token (tunnel edit +
+ * DNS edit on one account) -- the issue's own "never Archon's token": this
+ * is a narrower, edge-only credential a human provisions and holds
+ * separately from whatever broader token `PlatformEdgeDeps.cloudflare`
+ * uses to stand the host itself up on Coolify.
+ */
+export declare const PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF = "cloudflare:edge:apiToken";
+/**
+ * #478: scope keys (colon-free) for the edge platform key, the
+ * {@link PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY} pattern once:
+ * the undelivered id is recorded and persisted the moment the secret is
+ * minted, before delivery; the guard is recorded only once it was delivered
+ * AND its hash written to the runner's env. An undelivered id with no guard
+ * means the secret is lost (never kept past that point): the planner
+ * reports it and never mints again. Neither key holds the secret itself.
+ */
+export declare const PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY = "edge_platform_key_undelivered";
+export declare const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = "edge_platform_key_set";
+/**
+ * #478: the hostname and `gitRef` the last successful names run applied.
+ * `planEdge` plans the step again when either differs from the declared
+ * value; a re-run updates `git_branch` and the runner env and redeploys,
+ * and mints no new platform key (the guards above hold).
+ */
+export declare const PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY = "edge_applied_hostname";
+export declare const PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY = "edge_applied_git_ref";
 /**
  * Options for {@link planPlatform}, replacing four positional arguments that
  * shifted on every merge that added a platform service (#186, #187, #188) --
@@ -615,6 +703,8 @@ export interface PlanPlatformOptions {
         ai?: string;
         archon?: string;
         mail?: string;
+        /** #478: why the edge host is blocked, or absent when it is not. */
+        edge?: string;
         /**
          * #257: true once a service's database exists but the host built the
          * platform executor with no backup dependencies -- every such service's
@@ -666,7 +756,8 @@ export interface PlanPlatformOptions {
  * Scope for #167: the frame plus one step, {@link planApexZone}. #173 adds
  * {@link planJobs}, #170 adds {@link planSfu}, #168 adds {@link planAuth},
  * #169 adds {@link planMail}, #174 adds {@link planIntegrations}, #171 adds
- * {@link planFiles}, #172 adds {@link planAi} and #175 adds
+ * {@link planFiles}, #172 adds {@link planAi}, #478 adds {@link planEdge}
+ * and #175 adds
  * {@link planArchon}, the same way #19 shipped org plan/apply against
  * three singletons before #27, #71, #80 and the rest added the remaining
  * twelve. Until then, a live resource under one of those eventual keys is