@wtfalch/foundry 0.17.1 → 0.18.0

package/dist/bootstrap/declare.js

@@ -23,11 +23,11 @@ export const DEFAULT_GIT_REF = 'main';
  */
 export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
 /**
- * Every platform service except `sfu` and `names` is enabled, like the other
+ * Every platform service except `sfu` and `edge` is enabled, like the other
  * steps: a service whose dependencies the host did not supply is reported
  * blocked, not planned. `sfu` stays off because it needs a held SSH key and
- * host fingerprint, a separate human step (issue 170). `names` stays off
- * because the names service (N1) does not exist yet -- a human deploys it
+ * host fingerprint, a separate human step (issue 170). `edge` stays off
+ * because the edge service (N1) does not exist yet -- a human deploys it
  * and sets its hostname before enabling it (#317's own "Human steps").
  */
 const SERVICES_ENABLED_BY_DEFAULT = new Set([

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
@@ -35,7 +35,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformNamesDeps, PlatformNamesRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/index.js

@@ -12,7 +12,7 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';

package/dist/migrations/0045_names_to_edge.sql

@@ -0,0 +1,107 @@
+-- @wtfalch/foundry: the names service is renamed edge, and the hosting entry
+-- field `edge` (a Cloudflare Worker) is renamed `worker`. No behaviour change.
+-- Mirrors `src/store/schema.ts`'s `foundryDeclaredPlatform` columns.
+--
+-- 1. foundry_declared_platform: names_enabled / names_hostname /
+--    names_git_ref become edge_*. Each rename runs only while the old column
+--    exists, so a second run is a no-op.
+-- 2. The hostname moves from `names.<apex>` to `edge.<apex>` only where it
+--    still equals the old default (0043); an operator's own value stays.
+-- 3. Recorded ids are rewritten in place: `names:key:`, `names:reserved-labels:`
+--    and `platform:names` (ids and step ids), and the colon-free scope keys
+--    `names_*` and `*_platform_names*`. The applied-hostname value is left
+--    alone, so the planner sees a changed hostname and applies the step again.
+--    Every WHERE clause matches only text that still holds an old key, so a
+--    second run changes nothing. `foundry_audit_events` is a signed chain and
+--    is not touched.
+-- 4. foundry_declared_orgs.hosting_entries: each entry's `uses.names` becomes
+--    `uses.edge`, and its `edge` becomes `worker`.
+
+do $$
+begin
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_enabled') then
+    alter table foundry_declared_platform rename column names_enabled to edge_enabled;
+  end if;
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_hostname') then
+    alter table foundry_declared_platform rename column names_hostname to edge_hostname;
+  end if;
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_git_ref') then
+    alter table foundry_declared_platform rename column names_git_ref to edge_git_ref;
+  end if;
+end
+$$;
+
+update foundry_declared_platform
+   set edge_hostname = 'edge.' || apex
+ where edge_hostname = 'names.' || apex;
+
+-- The old-to-new text rewrite for recorded ids, applied to the jsonb as text.
+create or replace function pg_temp.names_to_edge(value jsonb) returns jsonb
+language sql immutable as $fn$
+  select replace(
+           replace(
+             replace(
+               replace(
+                 replace(value::text, '"names:key:', '"edge:key:'),
+                 '"names:reserved-labels:', '"edge:reserved-labels:'),
+               '"names_', '"edge_'),
+             '_platform_names', '_platform_edge'),
+           'platform:names', 'platform:edge')::jsonb
+$fn$;
+
+update foundry_declared_platform
+   set service_ids = pg_temp.names_to_edge(service_ids)
+ where service_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set service_ids = pg_temp.names_to_edge(service_ids)
+ where service_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set checkpoints = pg_temp.names_to_edge(checkpoints)
+ where checkpoints::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set destroy = pg_temp.names_to_edge(destroy)
+ where destroy is not null
+   and destroy::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set step_ids = pg_temp.names_to_edge(step_ids)
+ where step_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set checkpoints = pg_temp.names_to_edge(checkpoints)
+ where checkpoints::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set failure = pg_temp.names_to_edge(failure)
+ where failure is not null
+   and failure::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_declared_orgs o
+   set hosting_entries = (
+         select coalesce(jsonb_agg(
+                  case
+                    when jsonb_typeof(s -> 'uses') = 'object' and (s -> 'uses') ? 'names'
+                    then jsonb_set(s, '{uses}',
+                           ((s -> 'uses') - 'names') || jsonb_build_object('edge', s -> 'uses' -> 'names'))
+                    else s
+                  end order by t.ord), '[]'::jsonb)
+           from jsonb_array_elements(o.hosting_entries) with ordinality as t(e, ord),
+                lateral (select case
+                                  when jsonb_typeof(t.e) = 'object' and t.e ? 'edge'
+                                  then (t.e - 'edge') || jsonb_build_object('worker', t.e -> 'edge')
+                                  else t.e
+                                end as s) as r(s))
+ where exists (
+         select 1 from jsonb_array_elements(o.hosting_entries) e
+          where jsonb_typeof(e) = 'object'
+            and (e ? 'edge' or (jsonb_typeof(e -> 'uses') = 'object' and (e -> 'uses') ? 'names'))
+       );

package/dist/org.d.ts

@@ -335,26 +335,26 @@ export interface HostingEntry {
      * F8: a Cloudflare Worker foundry deploys from this entry's own repo,
      * beside the app, on the org's own zone. Only our own repos may use this
      * (#318: outside customers need Workers for Platforms, not built yet), so
-     * `validateEntryEdge` refuses it unless `repo` is set (every non-null
+     * `validateEntryWorker` refuses it unless `repo` is set (every non-null
      * `repo` already matches `wtfalch/...`, {@link REPO}) and the route's zone
      * is the org's own domain.
      */
-    edge?: EdgeConfig;
+    worker?: WorkerConfig;
 }
 /**
  * One Cloudflare rate limiting binding on a Worker (#318) -- Cloudflare's own
  * "simple" shape: a fixed number of requests per period, where `period` is
  * the only two values Cloudflare's rate limiting binding accepts.
  */
-export interface EdgeRateLimitBinding {
+export interface WorkerRateLimitBinding {
     name: string;
     namespaceId: string;
     limit: number;
     period: 10 | 60;
 }
-/** {@link HostingEntry.edge}'s bindings, one list per binding kind -- only rate limits today. */
-export interface EdgeBindings {
-    rateLimits: EdgeRateLimitBinding[];
+/** {@link HostingEntry.worker}'s bindings, one list per binding kind -- only rate limits today. */
+export interface WorkerBindings {
+    rateLimits: WorkerRateLimitBinding[];
 }
 /**
  * A plain Worker deployed beside a hosting entry (#318), named by one route
@@ -365,14 +365,14 @@ export interface EdgeBindings {
  * Worker setup": "The app's automated build process builds the bundle
  * outside Foundry; Foundry consumes and deploys the artifact through the
  * provider boundary... No manual build step and no source checkout/bundling
- * in Foundry"). `validateEntryEdge` refuses anything that is not an
+ * in Foundry"). `validateEntryWorker` refuses anything that is not an
  * `https://` URL -- a bare path or relative file name is exactly the shape
  * this decision rules out.
  */
-export interface EdgeConfig {
+export interface WorkerConfig {
     /** Where foundry fetches the built module from, behind `WorkersPort` -- never checked out or bundled here. */
     artifactUrl: string;
-    /** The built module's sha256, lowercase hex. Verified against the fetched bytes before upload, and the sole signal `planEdgeWorkers` diffs on: an org that rebuilds under an unchanged URL redeploys only when this changes. */
+    /** The built module's sha256, lowercase hex. Verified against the fetched bytes before upload, and the sole signal `planWorkers` diffs on: an org that rebuilds under an unchanged URL redeploys only when this changes. */
     artifactSha256: string;
     /**
      * One route per entry today. A wildcard route (`*.<domain>/*`) matches
@@ -386,7 +386,7 @@ export interface EdgeConfig {
      * separate entry with that exact route; there is no exclusion list.
      */
     route: string;
-    bindings?: EdgeBindings;
+    bindings?: WorkerBindings;
 }
 /**
  * Sign-in for one entry: one ZITADEL client and one broker entry, signing in
@@ -441,16 +441,16 @@ export interface HostingEntryUses {
     ai?: EntryAi;
     files?: EntryFiles;
     /**
-     * F7 (#317): the entry gets its own names key, minted directly below the
-     * org with the names service, and `NAMES_URL`/`NAMES_API_KEY` in its env.
-     * Serves only the org's own domain (names claims `<label>.<org's domain>`),
-     * so `validateEntryNames` refuses it without `hosting.usesDomain` and an
+     * F7 (#317): the entry gets its own edge key, minted directly below the
+     * org with the edge service, and `EDGE_URL`/`EDGE_API_KEY` in its env.
+     * Serves only the org's own domain (edge claims `<label>.<org's domain>`),
+     * so `validateEntryEdge` refuses it without `hosting.usesDomain` and an
      * org `domain`.
      */
-    names?: true;
+    edge?: true;
 }
-/** The env names `uses.names` writes; `env` may not name them (#317). */
-export declare const NAMES_ENTRY_ENV_NAMES: readonly ["NAMES_URL", "NAMES_API_KEY"];
+/** The env names `uses.edge` writes; `env` may not name them (#317). */
+export declare const EDGE_ENTRY_ENV_NAMES: readonly ["EDGE_URL", "EDGE_API_KEY"];
 /**
  * A plain string is pushed as it is, so `validateHosting` refuses one that
  * looks like a secret. `{ from }` names a value the plan already mints.

package/dist/org.js

@@ -36,8 +36,8 @@ export const FILES_ENTRY_ENV_NAMES = [
     'FILES_API_KEY',
 ];
 export const filesCollectionEnvName = (name) => `FILES_COLLECTION_${name}_ID`;
-/** The env names `uses.names` writes; `env` may not name them (#317). */
-export const NAMES_ENTRY_ENV_NAMES = ['NAMES_URL', 'NAMES_API_KEY'];
+/** The env names `uses.edge` writes; `env` may not name them (#317). */
+export const EDGE_ENTRY_ENV_NAMES = ['EDGE_URL', 'EDGE_API_KEY'];
 /** The org's `app` entry: today's one app. */
 export function appEntry(hosting) {
     return hosting.entries.find((entry) => entry.key === APP_ENTRY_KEY);
@@ -132,29 +132,29 @@ export function validateHosting(hosting, names) {
         const invalidFiles = validateEntryFiles(entry, hosting, names?.domain);
         if (invalidFiles)
             return invalidFiles;
-        const invalidEdge = validateEntryEdge(entry, hosting, names?.domain, names?.locked);
-        if (invalidEdge)
-            return invalidEdge;
-        const invalidNamesUse = validateEntryNames(entry, hosting, names?.domain);
-        if (invalidNamesUse)
-            return invalidNamesUse;
+        const invalidWorker = validateEntryWorker(entry, hosting, names?.domain);
+        if (invalidWorker)
+            return invalidWorker;
+        const invalidEdgeUse = validateEntryEdge(entry, hosting, names?.domain);
+        if (invalidEdgeUse)
+            return invalidEdgeUse;
     }
     if (hosting.entries.filter((entry) => entry.uses?.ai?.webhookPath !== undefined).length > 1) {
         return 'at most one hosting entry may set uses.ai webhookPath: ai keeps one webhook per organisation';
     }
-    // #318 re-review: two entries declaring the same edge route both throw at
+    // #318 re-review: two entries declaring the same worker route both throw at
     // apply (`cloudflareWorker` refuses a route already bound to a Worker
     // that is not its own), one of which stops Agora and everything planned
     // after it provisioning at all -- refused here instead, before an apply
     // ever reaches it.
-    const seenEdgeRoutes = new Set();
+    const seenWorkerRoutes = new Set();
     for (const entry of hosting.entries) {
-        if (!entry.edge)
+        if (!entry.worker)
             continue;
-        if (seenEdgeRoutes.has(entry.edge.route)) {
-            return `hosting.entries '${entry.key}' edge route '${entry.edge.route}' is already declared by another entry`;
+        if (seenWorkerRoutes.has(entry.worker.route)) {
+            return `hosting.entries '${entry.key}' worker route '${entry.worker.route}' is already declared by another entry`;
         }
-        seenEdgeRoutes.add(entry.edge.route);
+        seenWorkerRoutes.add(entry.worker.route);
     }
     const invalidNames = validateEntryHostnames(hosting, names);
     if (invalidNames)
@@ -438,27 +438,27 @@ function validateEntryFiles(entry, hosting, domain) {
     return null;
 }
 /** A route pattern's zone apex: the host part before the first `/`, with one leading `*.` label stripped. */
-function edgeRouteZone(route) {
+function workerRouteZone(route) {
     const slash = route.indexOf('/');
     if (slash < 1)
         return null;
     const host = route.slice(0, slash);
     return host.startsWith('*.') ? host.slice(2) : host;
 }
-const EDGE_ROUTE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+\/.*$/;
-const EDGE_SHA256 = /^[0-9a-f]{64}$/;
+const WORKER_ROUTE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+\/.*$/;
+const WORKER_SHA256 = /^[0-9a-f]{64}$/;
 /**
- * Restated, not shared, from `plan/edge-worker.ts`'s `EDGE_WORKER_ORG_HASH_LENGTH`/
- * `EDGE_WORKER_NAME_MAX_LENGTH` -- importing them here would import that
+ * Restated, not shared, from `plan/worker.ts`'s `WORKER_ORG_HASH_LENGTH`/
+ * `WORKER_NAME_MAX_LENGTH` -- importing them here would import that
  * module's own `DeclaredOrg`/`HostingEntry` imports right back into this
- * one. `edgeWorkerName`'s shape is `${8-hex-char hash}-${entry.key}-edge`;
+ * one. `workerName`'s shape is `${8-hex-char hash}-${entry.key}-edge`;
  * the hash and the `-edge` suffix are fixed length, so the entry key's own
  * budget against Cloudflare's 63-character Worker name limit is fixed too.
  */
-const EDGE_WORKER_NAME_FIXED_LENGTH = 8 + 1 + '-edge'.length;
-const EDGE_WORKER_NAME_MAX_LENGTH = 63;
+const WORKER_NAME_FIXED_LENGTH = 8 + 1 + '-edge'.length;
+const WORKER_NAME_MAX_LENGTH = 63;
 /**
- * `edge`: the entry's own repo (never the shared standard app -- entries
+ * `worker`: the entry's own repo (never the shared standard app -- entries
  * with `repo: null` have no Worker source of their own), an `https://`
  * artifact URL with a lowercase-hex sha256 (never a bare path or relative
  * file -- estate DECISIONS.md, 2026-10-04, rules out any checkout or
@@ -467,22 +467,22 @@ const EDGE_WORKER_NAME_MAX_LENGTH = 63;
  * binding's `period` restricted to the two values Cloudflare's simple rate
  * limiting binding accepts.
  */
-function validateEntryEdge(entry, hosting, domain, locked) {
-    const edge = entry.edge;
-    if (!edge)
+function validateEntryWorker(entry, hosting, domain) {
+    const worker = entry.worker;
+    if (!worker)
         return null;
-    const at = `hosting.entries '${entry.key}' edge`;
+    const at = `hosting.entries '${entry.key}' worker`;
     if (!hosting.enabled)
         return `${at} requires hosting.enabled`;
     if (entry.repo === null) {
         return `${at} needs its own repo (repo: null is the shared standard app, not a Worker source)`;
     }
-    if (entry.key.length > EDGE_WORKER_NAME_MAX_LENGTH - EDGE_WORKER_NAME_FIXED_LENGTH) {
-        return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "-edge") must fit Cloudflare's ${EDGE_WORKER_NAME_MAX_LENGTH}-character limit`;
+    if (entry.key.length > WORKER_NAME_MAX_LENGTH - WORKER_NAME_FIXED_LENGTH) {
+        return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "-edge") must fit Cloudflare's ${WORKER_NAME_MAX_LENGTH}-character limit`;
     }
     let artifactUrl;
     try {
-        artifactUrl = new URL(edge.artifactUrl);
+        artifactUrl = new URL(worker.artifactUrl);
     }
     catch {
         return `${at} artifactUrl must be an absolute URL, not a bare path or relative file`;
@@ -497,32 +497,22 @@ function validateEntryEdge(entry, hosting, domain, locked) {
         return `${at} artifactUrl must not carry a query string (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
     }
     // `URL.hash` is '' for a bare trailing `#`, so the raw string is checked.
-    if (edge.artifactUrl.includes('#')) {
+    if (worker.artifactUrl.includes('#')) {
         return `${at} artifactUrl must not carry a fragment (refused for the same reason as a query string)`;
     }
-    if (!EDGE_SHA256.test(edge.artifactSha256)) {
+    if (!WORKER_SHA256.test(worker.artifactSha256)) {
         return `${at} artifactSha256 must be 64 lowercase hex characters`;
     }
-    if (!EDGE_ROUTE.test(edge.route)) {
+    if (!WORKER_ROUTE.test(worker.route)) {
         return `${at} route must be a hostname (an optional leading '*.' label, then at least two more labels) and a path, joined by '/'`;
     }
-    const zone = edgeRouteZone(edge.route);
+    const zone = workerRouteZone(worker.route);
     if (!domain || zone !== domain) {
-        return `${at} route '${edge.route}' must be on the org's own domain${domain ? ` (${domain})` : ''}: edge is only for our own projects`;
-    }
-    // #318 re-review: a Worker route has no path-based exclusion of its own,
-    // so a wildcard (`*.<domain>/*`) captures every hostname foundry already
-    // owns under the domain -- Agora, Boule, the login host and the rest of
-    // `locked-hostnames.ts`'s set -- not only the org's other entries. (A
-    // non-wildcard route can only ever be the bare apex here -- the check
-    // just above requires `edgeRouteZone(edge.route) === domain`, and that
-    // function returns a non-wildcard route's host unchanged -- and the apex
-    // alone is never itself a locked name, so there is no direct-match case
-    // to refuse alongside this one.)
-    if (locked && locked.size > 0 && edge.route.startsWith('*.')) {
-        return `${at} route '${edge.route}' is a wildcard: it would also capture ${[...locked].sort().join(', ')}, every hostname foundry already owns under this domain`;
-    }
-    for (const limit of edge.bindings?.rateLimits ?? []) {
+        return `${at} route '${worker.route}' must be on the org's own domain${domain ? ` (${domain})` : ''}: worker is only for our own projects`;
+    }
+    // A wildcard route (`*.<domain>/*`) is allowed beside hostnames foundry owns:
+    // `planWorkers` plans a no-Worker route for each of them, so they stay out of it.
+    for (const limit of worker.bindings?.rateLimits ?? []) {
         if (!limit.name.trim())
             return `${at} bindings.rateLimits needs a non-empty name`;
         if (!limit.namespaceId.trim())
@@ -537,23 +527,23 @@ function validateEntryEdge(entry, hosting, domain, locked) {
     return null;
 }
 /**
- * `uses.names`: serves only the org's own domain (names claims
+ * `uses.edge`: serves only the org's own domain (edge claims
  * `<label>.<domain>`), so it needs `hosting.usesDomain` and a `domain`, and
- * no `env` entry that names a value `uses.names` writes.
+ * no `env` entry that names a value `uses.edge` writes.
  */
-function validateEntryNames(entry, hosting, domain) {
-    const names = entry.uses?.names;
-    if (names === undefined)
+function validateEntryEdge(entry, hosting, domain) {
+    const edge = entry.uses?.edge;
+    if (edge === undefined)
         return null;
-    const at = `hosting.entries '${entry.key}' uses.names`;
-    if (names !== true)
+    const at = `hosting.entries '${entry.key}' uses.edge`;
+    if (edge !== true)
         return `${at} must be true`;
     if (!hosting.enabled)
         return `${at} requires hosting.enabled`;
     if (!hosting.usesDomain || !domain) {
-        return `${at} needs hosting.usesDomain and an org domain: names serves only the org's own domain`;
+        return `${at} needs hosting.usesDomain and an org domain: edge serves only the org's own domain`;
     }
-    const named = Object.keys(entry.env ?? {}).find((name) => NAMES_ENTRY_ENV_NAMES.includes(name));
+    const named = Object.keys(entry.env ?? {}).find((name) => EDGE_ENTRY_ENV_NAMES.includes(name));
     if (named)
         return `${at} writes ${named}; remove it from env`;
     return null;

package/dist/plan/diff.d.ts

@@ -51,8 +51,10 @@ export interface PlanOrgOptions {
     now?: () => number;
     /** #374: the Archon that bills this org (`plan-apply.ts`'s `orgArchonUrl`), written into Boule's env as `ARCHON_URL`. `null` with no platform wired. */
     archonUrl?: string | null;
-    /** #318: the executor was built with a `WorkersPort`, read by `planEdgeWorkers`. */
+    /** #318: the executor was built with a `WorkersPort`, read by `planWorkers`. */
     edgeWorkers?: boolean;
+    /** The platform's own service hostnames: `edgeReservedLabels` reserves them under the org's domain, and a wildcard Worker route (`planWorkers`) keeps them out. */
+    platformHostnames?: readonly string[];
 }
 export interface PlanDetail {
     orgId: OrgId;

package/dist/plan/diff.js

@@ -3,10 +3,9 @@ import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
-import { planEdgeWorkers } from './edge-worker.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
+import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
-import { planEntryNamesKeys, planNamesReservedLabels } from './entry-names-key.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
@@ -15,6 +14,7 @@ import { DEFAULT_ORG_PLATFORM_READINESS } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
 import { withStepSystem } from './step-system.js';
+import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export function toPlan(detail) {
     return {
@@ -206,14 +206,14 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     plannedSteps.push(...filesKeys.steps);
     // F7 (#317): reserved labels before any entry's own key, so a label is
     // never claimable by a customer in the gap between an entry's key going
-    // live and its siblings' labels reaching names.
-    const namesReservedLabels = planNamesReservedLabels(org, recordedIds, platformReadiness);
-    if (namesReservedLabels.step)
-        plannedSteps.push(namesReservedLabels.step);
-    // After the apps -- a names key needs the entry's app recorded, the same
+    // live and its siblings' labels reaching edge.
+    const edgeReservedLabels = planEdgeReservedLabels(org, recordedIds, platformReadiness, options.platformHostnames ?? []);
+    if (edgeReservedLabels.step)
+        plannedSteps.push(edgeReservedLabels.step);
+    // After the apps -- a edge key needs the entry's app recorded, the same
     // dependency `planEntryAiKeys`/`planFilesKeys` have.
-    const entryNamesKeys = planEntryNamesKeys(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)());
-    plannedSteps.push(...entryNamesKeys.steps);
+    const entryEdgeKeys = planEntryEdgeKeys(org, recordedIds, plannedSteps, platformReadiness, (options.now ?? Date.now)());
+    plannedSteps.push(...entryEdgeKeys.steps);
     const tunnel = planTunnel(org, byKey, claimed, recordedIds);
     // #238: a tunnel that is being provisioned waits for an active zone; parking
     // one never does.
@@ -274,16 +274,16 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // F8 (#318), after Agora and Boule, not right after the zone: a route
     // already bound by a hand-made entry, another entry's route, a taken
     // script name, or no Workers token all throw at apply, and `runSteps`
-    // stops at the first failure -- planned this early, a failing edge step
+    // stops at the first failure -- planned this early, a failing worker step
     // stopped Agora (and everything after it) from provisioning at all
     // (#318 re-review). `cloudflareWorker` still resolves the zone by apex
     // domain the same way `planRateLimit` does, so a deploy (never a
     // retire, which needs no new zone) still waits for it.
-    const edgeWorkers = planEdgeWorkers(org, recordedIds, options.edgeWorkers ?? false);
+    const edgeWorkers = planWorkers(org, recordedIds, options.edgeWorkers ?? false, options.platformHostnames ?? []);
     for (const step of edgeWorkers.steps) {
         if (zoneWaiting && step.action.desired.mode === 'apply') {
             zoneBlocked.push({
-                description: `${org.slug}'s ${step.action.key.slice(org.id.length + 1)} edge Worker is blocked, not planned: the zone for ${org.domain} is not active yet`,
+                description: `${org.slug}'s ${step.action.key.slice(org.id.length + 1)} Worker is blocked, not planned: the zone for ${org.domain} is not active yet`,
                 key: step.action.key,
             });
         }
@@ -312,8 +312,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...filesKeys.blocked);
     unmanaged.push(...entryAiKeys.blocked);
     unmanaged.push(...edgeWorkers.blocked);
-    unmanaged.push(...entryNamesKeys.blocked);
-    unmanaged.push(...namesReservedLabels.blocked);
+    unmanaged.push(...entryEdgeKeys.blocked);
+    unmanaged.push(...edgeReservedLabels.blocked);
     // Same for a jobs registration that cannot run (no scheduler wired) or must
     // not run again (minted, never delivered).
     if (jobsRegistration.blocked) {
@@ -2214,10 +2214,10 @@ function planTunnel(org, byKey, claimed, recordedIds) {
     // differ from the names now declared. An org that never recorded a list
     // has nothing to compare, so only the domain check above applies to it.
     const published = recordedIds[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY];
-    const namesChanged = published !== undefined &&
+    const edgeChanged = published !== undefined &&
         org.domain !== null &&
         sortedNames(published.split(',')) !== sortedNames(tunnelDnsHostnames(org, org.domain));
-    const dnsStale = recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain || namesChanged;
+    const dnsStale = recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain || edgeChanged;
     if (!connectorMissing && !dnsStale)
         return null;
     return {

package/dist/plan/entry-edge-key.d.ts

@@ -0,0 +1,79 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { OrgPlatformReadiness } from './platform-org.js';
+/**
+ * F7 (#317): one edge key per entry with `uses.edge`, minted directly
+ * below the org with the edge service (`EdgePort.mintKey({
+ * organisationId, ... })` -- no org-level root key the way files/ai have
+ * one, since the edge service takes the org id itself). `EDGE_URL` and
+ * `EDGE_API_KEY` go to the entry's env and nowhere else. A edge key has no
+ * declared renewal window in the issue, so unlike `planEntryAiKeys`/
+ * `planFilesKeys` this mints once and never renews.
+ *
+ * `EDGE_*` is written in this step, after the app's own `coolify:app`
+ * create (which never knows the key yet), so the app's first boot has
+ * neither and its first deploy restarts once this step's env write lands --
+ * the same one-extra-restart shape `planEntryAiKeys`'s `AI_*`/
+ * `planFilesKeys`'s `FILES_*` already have, not a names-specific gap.
+ *
+ * A domain change after mint is not detected (#317 re-review): the key is
+ * bound to the domain passed at mint time, but nothing here records that
+ * domain to compare against a later `org.domain`, so an org that changes
+ * domains keeps a edge key still bound to the old one. Not built --
+ * resolving it needs a manual revoke-and-re-mint (drop `uses.edge`, apply,
+ * re-add it) until this is.
+ */
+export declare const entryEdgeUndeliveredScopeKey: (entryKey: string) => string;
+/** The id of a key that was live when its entry stopped declaring `uses.edge`, once handled. */
+export declare const entryEdgeRetiredScopeKey: (entryKey: string) => string;
+export declare const ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS = 3;
+/** How long an entry's edge key lives. The issue names no renewal window, so this mints once and never renews. */
+export declare const EDGE_ENTRY_KEY_DAYS = 365;
+/** The ISO time a delivered key's mint succeeded -- the only trace of its age, since there is no renewal to track against. */
+export declare const entryEdgeMintedAtScopeKey: (entryKey: string) => string;
+/** A key with fewer days left than this is surfaced as a blocked warning row (#317 review): still live, but nothing here renews it. */
+export declare const EDGE_ENTRY_KEY_WARN_WINDOW_DAYS = 30;
+/** The reserved labels last sent to the edge service, as that sorted list's own JSON. */
+export declare const EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY = "edge_reserved_labels_applied";
+export declare const entryEdgeKeyName: (org: DeclaredOrg, entry: HostingEntry) => string;
+/**
+ * Every label under `org.domain` that foundry provisions or the platform
+ * uses, so edge never lets a company claim one: the hostnames foundry routes
+ * (`tunnelIngressHostnames`: entries, site, cms, calls, Agora, Boule, share),
+ * the names it locks (`lockedHostnames`: also the sign-in host and the
+ * platform's service hostnames), each entry's own labels, the mail labels
+ * and `www`. The entry's `*` is the space users claim in, so it reserves
+ * nothing, and neither does the bare domain.
+ *
+ * An org without a domain has no hostnames edge sees (`uses.edge` needs a
+ * domain), so it reserves `www` only.
+ */
+export declare function edgeReservedLabels(org: DeclaredOrg, platformHostnames?: readonly string[]): string[];
+type Blocked = Array<{
+    description: string;
+    key: string;
+}>;
+/**
+ * One step per entry whose edge key is missing, plus one retire step per
+ * entry whose `uses.edge` was removed but still has a recorded key.
+ * Blocked, not planned (rule 2), while the platform has no edge service
+ * wired, the entry's app is not recorded, or a previous mint's delivery
+ * failed.
+ */
+export declare function planEntryEdgeKeys(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], readiness: OrgPlatformReadiness, now?: number): {
+    steps: DraftStep[];
+    blocked: Blocked;
+};
+/**
+ * The reserved-labels step: resent whenever the org's own label set
+ * (`edgeReservedLabels`) differs from what was last sent. While the org
+ * uses edge at all (at least one entry with `uses.edge`) that set is
+ * `edgeReservedLabels(org)`; once the last entry drops `uses.edge`, this
+ * clears whatever was last sent (an empty list) rather than leaving it
+ * stuck in names forever -- a one-time step, same as any other change.
+ */
+export declare function planEdgeReservedLabels(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, readiness: OrgPlatformReadiness, platformHostnames?: readonly string[]): {
+    step: DraftStep | null;
+    blocked: Blocked;
+};
+export {};